1067b1ee685c708502440b4e8d994b9ca6c5257be81051545e2e571ebcd36696

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/01/2024, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
84ddc2e657cd04234e636acca0070b5f.exe
Size 92KB
Sample240131-tn9f3sgca2
SHA256 1067b1ee685c708502440b4e8d994b9ca6c5257be81051545e2e571ebcd36696
MD5 84ddc2e657cd04234e636acca0070b5f
SHA1 5bc8cf9a74eaadf450df1e1da89b6283bd21b0a7
SHA512 cac1b04c98f50382de6d851a3bf8f0e8deeeaf507084464e80a9ac7bc9760231d6990d416fee9e66cbf0318af020fc6ed6fd7d92579a6eab1bbc1199d11addef
SSDEEP 1536:7QOnr2Z76JtXnA9wSjbQpMcBsP3maSTKdbVS3Kc+wmJV05sPHUahX6g:HSZGXQ9n+BFa2Kxyc2qP7hq
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

vmprotect

Malware Config

Signatures

VMProtect packed file 22 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/5076-0-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/2232-2-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/4556-4-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/4736-7-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/4644-9-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/4232-12-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/4492-14-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/628-16-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/5076-17-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/700-20-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/2240-23-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/4568-27-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/3264-30-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/2948-33-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/3664-36-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/1808-39-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/4304-42-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/4048-46-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/1780-50-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/2016-57-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/544-59-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect
behavioral2/memory/4132-62-0x0000000000420000-0x0000000000451000-memory.dmp	vmprotect

Suspicious behavior: RenamesItself 64 IoCs

pid	Process
5076	84ddc2e657cd04234e636acca0070b5f.exe
2232	ayonwmyayw.exe
4556	bbsq.exe
4120	gyetikwzn.exe
4736	sjpyspt.exe
4644	kukanke.exe
4888	giejthtpctj.exe
4232	nphvauvhc.exe
4492	tgpiltrxdmzk.exe
628	t.exe
700	s.exe
2240	fpbiv.exe
1696	urctgqk.exe
4568	cajmdfa.exe
3264	quhtjwsmsu.exe
2948	kykvggmquoli.exe
3664	vditem.exe
1808	cy.exe
4304	lcy.exe
2032	dnhnrrtxd.exe
4984	om.exe
4048	blpokalmqd.exe
3572	nzpmdom.exe
1780	tleykvo.exe
2896	hmonltsgg.exe
3200	sqg.exe
2016	rikn.exe
544	qetkvdrzb.exe
4988	dx.exe
4212	gajct.exe
4132	xf.exe
2192	lggkghttz.exe
1900	qrhji.exe
3984	gr.exe
1352	ijwouiegtejf.exe
1464	hqwhnjvd.exe
4848	j.exe
1968	itg.exe
2916	gwzj.exe
3880	hjdodildbjre.exe
4744	fsgw.exe
4924	mflkk.exe
2920	thoelri.exe
1384	keurknaikqo.exe
2244	dlzaiohhbaq.exe
420	qkwpz.exe
2388	hmqpvje.exe
8	npusxwzurq.exe
1920	ztmtczpfpzyx.exe
740	fyulynuhzgf.exe
4248	ngonvtdcqkv.exe
2040	frbsarjeieib.exe
2120	vgwov.exe
876	iftxmowsnsoo.exe
2504	tvvnwmpwxc.exe
3932	smqlfviqcp.exe
1216	ekapfv.exe
2820	zscyqcijk.exe
2308	evdp.exe
4644	ghyqh.exe
4840	ambjui.exe
2596	dtvbwl.exe
4712	vbelodrj.exe
460	anosw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2232	5076	84ddc2e657cd04234e636acca0070b5f.exe	84
PID 5076 wrote to memory of 2232	5076	84ddc2e657cd04234e636acca0070b5f.exe	84
PID 5076 wrote to memory of 2232	5076	84ddc2e657cd04234e636acca0070b5f.exe	84
PID 2232 wrote to memory of 4556	2232	ayonwmyayw.exe	85
PID 2232 wrote to memory of 4556	2232	ayonwmyayw.exe	85
PID 2232 wrote to memory of 4556	2232	ayonwmyayw.exe	85
PID 4556 wrote to memory of 4120	4556	bbsq.exe	88
PID 4556 wrote to memory of 4120	4556	bbsq.exe	88
PID 4556 wrote to memory of 4120	4556	bbsq.exe	88
PID 4120 wrote to memory of 4736	4120	gyetikwzn.exe	91
PID 4120 wrote to memory of 4736	4120	gyetikwzn.exe	91
PID 4120 wrote to memory of 4736	4120	gyetikwzn.exe	91
PID 4736 wrote to memory of 4644	4736	sjpyspt.exe	92
PID 4736 wrote to memory of 4644	4736	sjpyspt.exe	92
PID 4736 wrote to memory of 4644	4736	sjpyspt.exe	92
PID 4644 wrote to memory of 4888	4644	kukanke.exe	94
PID 4644 wrote to memory of 4888	4644	kukanke.exe	94
PID 4644 wrote to memory of 4888	4644	kukanke.exe	94
PID 4888 wrote to memory of 4232	4888	giejthtpctj.exe	95
PID 4888 wrote to memory of 4232	4888	giejthtpctj.exe	95
PID 4888 wrote to memory of 4232	4888	giejthtpctj.exe	95
PID 4232 wrote to memory of 4492	4232	nphvauvhc.exe	96
PID 4232 wrote to memory of 4492	4232	nphvauvhc.exe	96
PID 4232 wrote to memory of 4492	4232	nphvauvhc.exe	96
PID 4492 wrote to memory of 628	4492	tgpiltrxdmzk.exe	99
PID 4492 wrote to memory of 628	4492	tgpiltrxdmzk.exe	99
PID 4492 wrote to memory of 628	4492	tgpiltrxdmzk.exe	99
PID 628 wrote to memory of 700	628	t.exe	100
PID 628 wrote to memory of 700	628	t.exe	100
PID 628 wrote to memory of 700	628	t.exe	100
PID 700 wrote to memory of 2240	700	s.exe	101
PID 700 wrote to memory of 2240	700	s.exe	101
PID 700 wrote to memory of 2240	700	s.exe	101
PID 2240 wrote to memory of 1696	2240	fpbiv.exe	102
PID 2240 wrote to memory of 1696	2240	fpbiv.exe	102
PID 2240 wrote to memory of 1696	2240	fpbiv.exe	102
PID 1696 wrote to memory of 4568	1696	urctgqk.exe	103
PID 1696 wrote to memory of 4568	1696	urctgqk.exe	103
PID 1696 wrote to memory of 4568	1696	urctgqk.exe	103
PID 4568 wrote to memory of 3264	4568	cajmdfa.exe	104
PID 4568 wrote to memory of 3264	4568	cajmdfa.exe	104
PID 4568 wrote to memory of 3264	4568	cajmdfa.exe	104
PID 3264 wrote to memory of 2948	3264	quhtjwsmsu.exe	105
PID 3264 wrote to memory of 2948	3264	quhtjwsmsu.exe	105
PID 3264 wrote to memory of 2948	3264	quhtjwsmsu.exe	105
PID 2948 wrote to memory of 3664	2948	kykvggmquoli.exe	106
PID 2948 wrote to memory of 3664	2948	kykvggmquoli.exe	106
PID 2948 wrote to memory of 3664	2948	kykvggmquoli.exe	106
PID 3664 wrote to memory of 1808	3664	vditem.exe	107
PID 3664 wrote to memory of 1808	3664	vditem.exe	107
PID 3664 wrote to memory of 1808	3664	vditem.exe	107
PID 1808 wrote to memory of 4304	1808	cy.exe	108
PID 1808 wrote to memory of 4304	1808	cy.exe	108
PID 1808 wrote to memory of 4304	1808	cy.exe	108
PID 4304 wrote to memory of 2032	4304	lcy.exe	109
PID 4304 wrote to memory of 2032	4304	lcy.exe	109
PID 4304 wrote to memory of 2032	4304	lcy.exe	109
PID 2032 wrote to memory of 4984	2032	dnhnrrtxd.exe	110
PID 2032 wrote to memory of 4984	2032	dnhnrrtxd.exe	110
PID 2032 wrote to memory of 4984	2032	dnhnrrtxd.exe	110
PID 4984 wrote to memory of 4048	4984	om.exe	111
PID 4984 wrote to memory of 4048	4984	om.exe	111
PID 4984 wrote to memory of 4048	4984	om.exe	111
PID 4048 wrote to memory of 3572	4048	blpokalmqd.exe	112

C:\Users\Admin\AppData\Local\Temp\84ddc2e657cd04234e636acca0070b5f.exe
"C:\Users\Admin\AppData\Local\Temp\84ddc2e657cd04234e636acca0070b5f.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\ayonwmyayw.exe
  C:\Windows\system32\ayonwmyayw.exe
  2⤵
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2232
- - C:\Windows\SysWOW64\bbsq.exe
    C:\Windows\system32\bbsq.exe
    3⤵
    - Suspicious behavior: RenamesItself
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Windows\SysWOW64\gyetikwzn.exe
      C:\Windows\system32\gyetikwzn.exe
      4⤵
      Suspicious behavior: RenamesItself
      Suspicious use of WriteProcessMemory
      PID:4120
    - - C:\Windows\SysWOW64\sjpyspt.exe
        
        C:\Windows\system32\sjpyspt.exe
        5⤵
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:4736
      - C:\Windows\SysWOW64\kukanke.exe
        
        C:\Windows\system32\kukanke.exe
        6⤵
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Windows\SysWOW64\giejthtpctj.exe
        
        C:\Windows\system32\giejthtpctj.exe
        7⤵
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:4888
        
        C:\Windows\SysWOW64\nphvauvhc.exe
        
        C:\Windows\system32\nphvauvhc.exe
        8⤵
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Windows\SysWOW64\tgpiltrxdmzk.exe
        
        C:\Windows\system32\tgpiltrxdmzk.exe
        9⤵
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:4492
        
        C:\Windows\SysWOW64\t.exe
        
        C:\Windows\system32\t.exe
        10⤵
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\SysWOW64\s.exe
        
        C:\Windows\system32\s.exe
        11⤵
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:700
        
        C:\Windows\SysWOW64\fpbiv.exe
        
        C:\Windows\system32\fpbiv.exe
        12⤵
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:2240
        
        C:\Windows\SysWOW64\urctgqk.exe
        
        C:\Windows\system32\urctgqk.exe
        13⤵
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:1696
        
        C:\Windows\SysWOW64\cajmdfa.exe
        
        C:\Windows\system32\cajmdfa.exe
        14⤵
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\SysWOW64\quhtjwsmsu.exe
        
        C:\Windows\system32\quhtjwsmsu.exe
        15⤵
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\SysWOW64\kykvggmquoli.exe
        
        C:\Windows\system32\kykvggmquoli.exe
        16⤵
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:2948
        
        C:\Windows\SysWOW64\vditem.exe
        
        C:\Windows\system32\vditem.exe
        17⤵
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:3664
        
        C:\Windows\SysWOW64\cy.exe
        
        C:\Windows\system32\cy.exe
        18⤵
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:1808
        
        C:\Windows\SysWOW64\lcy.exe
        
        C:\Windows\system32\lcy.exe
        19⤵
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:4304
        
        C:\Windows\SysWOW64\dnhnrrtxd.exe
        
        C:\Windows\system32\dnhnrrtxd.exe
        20⤵
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Windows\SysWOW64\om.exe
        
        C:\Windows\system32\om.exe
        21⤵
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\SysWOW64\blpokalmqd.exe
        
        C:\Windows\system32\blpokalmqd.exe
        22⤵
        Suspicious behavior: RenamesItself
        Suspicious use of WriteProcessMemory
        
        PID:4048
        
        C:\Windows\SysWOW64\nzpmdom.exe
        
        C:\Windows\system32\nzpmdom.exe
        23⤵
        Suspicious behavior: RenamesItself
        
        PID:3572
        
        C:\Windows\SysWOW64\tleykvo.exe
        
        C:\Windows\system32\tleykvo.exe
        24⤵
        Suspicious behavior: RenamesItself
        
        PID:1780
        
        C:\Windows\SysWOW64\hmonltsgg.exe
        
        C:\Windows\system32\hmonltsgg.exe
        25⤵
        Suspicious behavior: RenamesItself
        
        PID:2896
        
        C:\Windows\SysWOW64\sqg.exe
        
        C:\Windows\system32\sqg.exe
        26⤵
        Suspicious behavior: RenamesItself
        
        PID:3200
        
        C:\Windows\SysWOW64\rikn.exe
        
        C:\Windows\system32\rikn.exe
        27⤵
        Suspicious behavior: RenamesItself
        
        PID:2016
        
        C:\Windows\SysWOW64\qetkvdrzb.exe
        
        C:\Windows\system32\qetkvdrzb.exe
        28⤵
        Suspicious behavior: RenamesItself
        
        PID:544
        
        C:\Windows\SysWOW64\dx.exe
        
        C:\Windows\system32\dx.exe
        29⤵
        Suspicious behavior: RenamesItself
        
        PID:4988
        
        C:\Windows\SysWOW64\gajct.exe
        
        C:\Windows\system32\gajct.exe
        30⤵
        Suspicious behavior: RenamesItself
        
        PID:4212
        
        C:\Windows\SysWOW64\xf.exe
        
        C:\Windows\system32\xf.exe
        31⤵
        Suspicious behavior: RenamesItself
        
        PID:4132
        
        C:\Windows\SysWOW64\lggkghttz.exe
        
        C:\Windows\system32\lggkghttz.exe
        32⤵
        Suspicious behavior: RenamesItself
        
        PID:2192
        
        C:\Windows\SysWOW64\qrhji.exe
        
        C:\Windows\system32\qrhji.exe
        33⤵
        Suspicious behavior: RenamesItself
        
        PID:1900
        
        C:\Windows\SysWOW64\gr.exe
        
        C:\Windows\system32\gr.exe
        34⤵
        Suspicious behavior: RenamesItself
        
        PID:3984
        
        C:\Windows\SysWOW64\ijwouiegtejf.exe
        
        C:\Windows\system32\ijwouiegtejf.exe
        35⤵
        Suspicious behavior: RenamesItself
        
        PID:1352
        
        C:\Windows\SysWOW64\hqwhnjvd.exe
        
        C:\Windows\system32\hqwhnjvd.exe
        36⤵
        Suspicious behavior: RenamesItself
        
        PID:1464
        
        C:\Windows\SysWOW64\j.exe
        
        C:\Windows\system32\j.exe
        37⤵
        Suspicious behavior: RenamesItself
        
        PID:4848
        
        C:\Windows\SysWOW64\itg.exe
        
        C:\Windows\system32\itg.exe
        38⤵
        Suspicious behavior: RenamesItself
        
        PID:1968
        
        C:\Windows\SysWOW64\gwzj.exe
        
        C:\Windows\system32\gwzj.exe
        39⤵
        Suspicious behavior: RenamesItself
        
        PID:2916
        
        C:\Windows\SysWOW64\hjdodildbjre.exe
        
        C:\Windows\system32\hjdodildbjre.exe
        40⤵
        Suspicious behavior: RenamesItself
        
        PID:3880
        
        C:\Windows\SysWOW64\fsgw.exe
        
        C:\Windows\system32\fsgw.exe
        41⤵
        Suspicious behavior: RenamesItself
        
        PID:4744
        
        C:\Windows\SysWOW64\mflkk.exe
        
        C:\Windows\system32\mflkk.exe
        42⤵
        Suspicious behavior: RenamesItself
        
        PID:4924
        
        C:\Windows\SysWOW64\thoelri.exe
        
        C:\Windows\system32\thoelri.exe
        43⤵
        Suspicious behavior: RenamesItself
        
        PID:2920
        
        C:\Windows\SysWOW64\keurknaikqo.exe
        
        C:\Windows\system32\keurknaikqo.exe
        44⤵
        Suspicious behavior: RenamesItself
        
        PID:1384
        
        C:\Windows\SysWOW64\dlzaiohhbaq.exe
        
        C:\Windows\system32\dlzaiohhbaq.exe
        45⤵
        Suspicious behavior: RenamesItself
        
        PID:2244
        
        C:\Windows\SysWOW64\qkwpz.exe
        
        C:\Windows\system32\qkwpz.exe
        46⤵
        Suspicious behavior: RenamesItself
        
        PID:420
        
        C:\Windows\SysWOW64\hmqpvje.exe
        
        C:\Windows\system32\hmqpvje.exe
        47⤵
        Suspicious behavior: RenamesItself
        
        PID:2388
        
        C:\Windows\SysWOW64\npusxwzurq.exe
        
        C:\Windows\system32\npusxwzurq.exe
        48⤵
        Suspicious behavior: RenamesItself
        
        PID:8
        
        C:\Windows\SysWOW64\ztmtczpfpzyx.exe
        
        C:\Windows\system32\ztmtczpfpzyx.exe
        49⤵
        Suspicious behavior: RenamesItself
        
        PID:1920
        
        C:\Windows\SysWOW64\fyulynuhzgf.exe
        
        C:\Windows\system32\fyulynuhzgf.exe
        50⤵
        Suspicious behavior: RenamesItself
        
        PID:740
        
        C:\Windows\SysWOW64\ngonvtdcqkv.exe
        
        C:\Windows\system32\ngonvtdcqkv.exe
        51⤵
        Suspicious behavior: RenamesItself
        
        PID:4248
        
        C:\Windows\SysWOW64\frbsarjeieib.exe
        
        C:\Windows\system32\frbsarjeieib.exe
        52⤵
        Suspicious behavior: RenamesItself
        
        PID:2040
        
        C:\Windows\SysWOW64\vgwov.exe
        
        C:\Windows\system32\vgwov.exe
        53⤵
        Suspicious behavior: RenamesItself
        
        PID:2120
        
        C:\Windows\SysWOW64\iftxmowsnsoo.exe
        
        C:\Windows\system32\iftxmowsnsoo.exe
        54⤵
        Suspicious behavior: RenamesItself
        
        PID:876
        
        C:\Windows\SysWOW64\tvvnwmpwxc.exe
        
        C:\Windows\system32\tvvnwmpwxc.exe
        55⤵
        Suspicious behavior: RenamesItself
        
        PID:2504
        
        C:\Windows\SysWOW64\smqlfviqcp.exe
        
        C:\Windows\system32\smqlfviqcp.exe
        56⤵
        Suspicious behavior: RenamesItself
        
        PID:3932
        
        C:\Windows\SysWOW64\ekapfv.exe
        
        C:\Windows\system32\ekapfv.exe
        57⤵
        Suspicious behavior: RenamesItself
        
        PID:1216
        
        C:\Windows\SysWOW64\zscyqcijk.exe
        
        C:\Windows\system32\zscyqcijk.exe
        58⤵
        Suspicious behavior: RenamesItself
        
        PID:2820
        
        C:\Windows\SysWOW64\evdp.exe
        
        C:\Windows\system32\evdp.exe
        59⤵
        Suspicious behavior: RenamesItself
        
        PID:2308
        
        C:\Windows\SysWOW64\ghyqh.exe
        
        C:\Windows\system32\ghyqh.exe
        60⤵
        Suspicious behavior: RenamesItself
        
        PID:4644
        
        C:\Windows\SysWOW64\ambjui.exe
        
        C:\Windows\system32\ambjui.exe
        61⤵
        Suspicious behavior: RenamesItself
        
        PID:4840
        
        C:\Windows\SysWOW64\dtvbwl.exe
        
        C:\Windows\system32\dtvbwl.exe
        62⤵
        Suspicious behavior: RenamesItself
        
        PID:2596
        
        C:\Windows\SysWOW64\vbelodrj.exe
        
        C:\Windows\system32\vbelodrj.exe
        63⤵
        Suspicious behavior: RenamesItself
        
        PID:4712
        
        C:\Windows\SysWOW64\anosw.exe
        
        C:\Windows\system32\anosw.exe
        64⤵
        Suspicious behavior: RenamesItself
        
        PID:460
        
        C:\Windows\SysWOW64\uicnyfcscs.exe
        
        C:\Windows\system32\uicnyfcscs.exe
        65⤵
        
        PID:700
        
        C:\Windows\SysWOW64\uhefztjhip.exe
        
        C:\Windows\system32\uhefztjhip.exe
        66⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\vlhfcpnvml.exe
        
        C:\Windows\system32\vlhfcpnvml.exe
        67⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\zfjv.exe
        
        C:\Windows\system32\zfjv.exe
        68⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\lqsbdvg.exe
        
        C:\Windows\system32\lqsbdvg.exe
        69⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\dhtgcwfw.exe
        
        C:\Windows\system32\dhtgcwfw.exe
        70⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\avksjb.exe
        
        C:\Windows\system32\avksjb.exe
        71⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\y.exe
        
        C:\Windows\system32\y.exe
        72⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\thiwzeohhbmo.exe
        
        C:\Windows\system32\thiwzeohhbmo.exe
        73⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\vvwqmrigv.exe
        
        C:\Windows\system32\vvwqmrigv.exe
        74⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\mqf.exe
        
        C:\Windows\system32\mqf.exe
        75⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\wxcap.exe
        
        C:\Windows\system32\wxcap.exe
        76⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\gk.exe
        
        C:\Windows\system32\gk.exe
        77⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\zhsetqilzlku.exe
        
        C:\Windows\system32\zhsetqilzlku.exe
        78⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\is.exe
        
        C:\Windows\system32\is.exe
        79⤵
        
        PID:3572
        
        C:\Windows\SysWOW64\jrjlsb.exe
        
        C:\Windows\system32\jrjlsb.exe
        80⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\jaclzbcwetmi.exe
        
        C:\Windows\system32\jaclzbcwetmi.exe
        81⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\fplljkduj.exe
        
        C:\Windows\system32\fplljkduj.exe
        82⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\imsqqr.exe
        
        C:\Windows\system32\imsqqr.exe
        83⤵
        
        PID:208
        
        C:\Windows\SysWOW64\bsiauzsduj.exe
        
        C:\Windows\system32\bsiauzsduj.exe
        84⤵
        
        PID:368
        
        C:\Windows\SysWOW64\cb.exe
        
        C:\Windows\system32\cb.exe
        85⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\jqkallcvsoxx.exe
        
        C:\Windows\system32\jqkallcvsoxx.exe
        86⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\sjagzhriwsmq.exe
        
        C:\Windows\system32\sjagzhriwsmq.exe
        87⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\nweotlxgrgld.exe
        
        C:\Windows\system32\nweotlxgrgld.exe
        88⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\hs.exe
        
        C:\Windows\system32\hs.exe
        89⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\ipfqlh.exe
        
        C:\Windows\system32\ipfqlh.exe
        90⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\u.exe
        
        C:\Windows\system32\u.exe
        91⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\anyraxevd.exe
        
        C:\Windows\system32\anyraxevd.exe
        92⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\hjybvkdeftz.exe
        
        C:\Windows\system32\hjybvkdeftz.exe
        93⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\bjugyo.exe
        
        C:\Windows\system32\bjugyo.exe
        94⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\uvefttnwpk.exe
        
        C:\Windows\system32\uvefttnwpk.exe
        95⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\cg.exe
        
        C:\Windows\system32\cg.exe
        96⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\opcpzow.exe
        
        C:\Windows\system32\opcpzow.exe
        97⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\pnbqlavidnhs.exe
        
        C:\Windows\system32\pnbqlavidnhs.exe
        98⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\thragkxz.exe
        
        C:\Windows\system32\thragkxz.exe
        99⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\vfikir.exe
        
        C:\Windows\system32\vfikir.exe
        100⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\m.exe
        
        C:\Windows\system32\m.exe
        101⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\jmfnbe.exe
        
        C:\Windows\system32\jmfnbe.exe
        102⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\ylcyd.exe
        
        C:\Windows\system32\ylcyd.exe
        103⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\qt.exe
        
        C:\Windows\system32\qt.exe
        104⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\jdbcci.exe
        
        C:\Windows\system32\jdbcci.exe
        105⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\zgyf.exe
        
        C:\Windows\system32\zgyf.exe
        106⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\dgrsrahpbmrm.exe
        
        C:\Windows\system32\dgrsrahpbmrm.exe
        107⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\gjijdbdt.exe
        
        C:\Windows\system32\gjijdbdt.exe
        108⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\sxidnejjp.exe
        
        C:\Windows\system32\sxidnejjp.exe
        109⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\fyaiigsfyws.exe
        
        C:\Windows\system32\fyaiigsfyws.exe
        110⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\n.exe
        
        C:\Windows\system32\n.exe
        111⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\dtfpmvjfsv.exe
        
        C:\Windows\system32\dtfpmvjfsv.exe
        112⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\ykeqzzjbgonj.exe
        
        C:\Windows\system32\ykeqzzjbgonj.exe
        113⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\pbsvuz.exe
        
        C:\Windows\system32\pbsvuz.exe
        114⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\vljibekq.exe
        
        C:\Windows\system32\vljibekq.exe
        115⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\gotvzeny.exe
        
        C:\Windows\system32\gotvzeny.exe
        116⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\nzn.exe
        
        C:\Windows\system32\nzn.exe
        117⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\vsjadhvmfsy.exe
        
        C:\Windows\system32\vsjadhvmfsy.exe
        118⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\pifcs.exe
        
        C:\Windows\system32\pifcs.exe
        119⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\zc.exe
        
        C:\Windows\system32\zc.exe
        120⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\eszcnuw.exe
        
        C:\Windows\system32\eszcnuw.exe
        121⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\hkgh.exe
        
        C:\Windows\system32\hkgh.exe
        122⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\xyqgyxut.exe
        
        C:\Windows\system32\xyqgyxut.exe
        123⤵
        
        PID:4736

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/544-59-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/628-19-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/628-16-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/628-43-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/700-44-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/700-22-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/700-20-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/1696-26-0x00000000001E0000-0x00000000001F8000-memory.dmp

Download

memory/1696-47-0x00000000001E0000-0x00000000001F8000-memory.dmp

Download

memory/1780-50-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/1808-55-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/1808-41-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/1808-39-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/2016-57-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/2016-58-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/2032-45-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/2032-60-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/2232-21-0x00000000001D0000-0x00000000001E8000-memory.dmp

Download

memory/2232-3-0x00000000001D0000-0x00000000001E8000-memory.dmp

Download

memory/2232-2-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/2240-23-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/2896-53-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/2948-52-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/2948-35-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/2948-33-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/3200-56-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/3264-51-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/3264-30-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/3264-32-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/3572-49-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/3572-63-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/3664-54-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/3664-36-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/3664-38-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/4048-46-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/4120-25-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/4120-6-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/4132-62-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/4212-61-0x00000000001D0000-0x00000000001E8000-memory.dmp

Download

memory/4232-37-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/4232-12-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/4232-13-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/4304-42-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/4492-40-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/4492-15-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/4492-14-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/4556-5-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/4556-4-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/4556-24-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/4568-48-0x00000000001E0000-0x00000000001F8000-memory.dmp

Download

memory/4568-27-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/4568-29-0x00000000001E0000-0x00000000001F8000-memory.dmp

Download

memory/4644-9-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/4644-31-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/4644-10-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/4736-7-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/4736-28-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/4736-8-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/4888-34-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/4888-11-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/5076-0-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/5076-18-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

memory/5076-17-0x0000000000420000-0x0000000000451000-memory.dmp

Download

memory/5076-1-0x00000000001C0000-0x00000000001D8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads