Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29-02-2024 08:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HEUR-Trojan.Win32.Injuke.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
HEUR-Trojan.Win32.Injuke.exe
-
Size
210KB
-
MD5
56e5c7ea909d7c745a4fd29fedb213c8
-
SHA1
dae65fadfaad427c37422ef30543551e8b632c3d
-
SHA256
7925d45cc967dae9833291616e782d799652625ae9d507adf7f2fc69d65b91b2
-
SHA512
ecb3ce14b288e39ec72b3393ab0fd669ea37686cfa715e5197cf0cbc57f73e53b7e4a803ad2a19a33ea7a01e597d0cd37afbfa5fffc0c9993e4d0c213db33828
-
SSDEEP
1536:wvQBeOGtrYSSsrc93UBIfdC67m6AJiqQfg3Cip8iXAsG5M0u5Yoz:whOm2sI93UufdC67cizfmCiiiXA6mm
Malware Config
Signatures
-
Detect Blackmoon payload 59 IoCs
resource yara_rule behavioral2/memory/1464-7-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4924-5-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1820-24-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4128-22-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4992-18-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3616-30-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2980-46-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1264-52-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1096-39-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2428-42-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3724-70-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2324-81-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4148-90-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4712-96-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3524-107-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/5024-113-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4964-117-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2080-103-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1792-129-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2640-137-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4112-146-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1012-150-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4124-159-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3908-171-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2996-179-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1152-182-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4532-186-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/736-195-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4428-200-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4648-208-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3320-211-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4924-216-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1144-237-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4860-246-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4000-250-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4476-256-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4004-258-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3076-288-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2892-304-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4828-314-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3120-318-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2300-328-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3588-336-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4316-350-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4396-362-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/1324-380-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4456-387-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4544-398-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4284-411-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2980-432-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4840-435-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3724-457-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3904-464-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/2100-492-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/5104-502-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4024-509-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3132-566-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/4544-577-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon behavioral2/memory/3944-672-0x0000000000400000-0x000000000042C000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/1464-7-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4924-5-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4128-16-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/1820-24-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4128-22-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4992-18-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/3616-30-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/2980-46-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/1264-52-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/1096-39-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/3724-67-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/2428-42-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/3724-70-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/2324-81-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/5076-83-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4148-90-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4712-96-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/3524-107-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/5024-113-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4964-117-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/2080-103-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/1792-129-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/2640-137-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/1012-144-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4112-146-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/1012-150-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4124-159-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/3908-171-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/2996-179-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4532-183-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/1152-182-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4532-186-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/736-195-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4428-200-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4648-208-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/3320-211-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4924-216-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/1928-222-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/1144-237-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4860-246-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4000-247-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4000-250-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4476-256-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4004-258-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/2436-264-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4928-271-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/3076-284-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/3076-288-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/2892-304-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4828-314-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/3120-318-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/2300-328-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/3588-336-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4896-342-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4316-350-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4396-362-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/3932-366-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/1324-376-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/1324-380-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4456-387-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4544-398-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4284-411-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/2980-432-0x0000000000400000-0x000000000042C000-memory.dmp UPX behavioral2/memory/4840-435-0x0000000000400000-0x000000000042C000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 1464 qh739.exe 4992 3dsgak6.exe 4128 e74tgk.exe 1820 71769kg.exe 3616 4puwae.exe 1096 v7as1.exe 2428 8gi022.exe 2980 4ouk2.exe 1264 4su52a9.exe 4476 f759755.exe 224 77r18o.exe 3724 gq16j0.exe 5040 wde769o.exe 2324 jx2kp.exe 5076 8crgsh7.exe 4148 s7eqa0.exe 4712 j150b.exe 2080 7299335.exe 3524 1n392.exe 5024 xke6i.exe 4964 eu11x.exe 1792 qcuk0u.exe 1208 6n451.exe 2640 3b1kn.exe 4112 lguupv7.exe 1012 117317.exe 3864 fek59.exe 4124 sppmw0.exe 4916 50lh8bo.exe 3908 6w56m.exe 2616 u06op.exe 2996 2bn5smm.exe 1152 iv1a9.exe 4532 6t3sb.exe 2552 4h95ss.exe 2884 5b98c.exe 736 1gu67b0.exe 1332 6p73937.exe 4428 l8aue94.exe 4016 x99hl5.exe 4648 dmquqa.exe 3320 974o4e.exe 2572 h08022.exe 4924 96qsuov.exe 2400 f68g5c.exe 1928 p5weu.exe 4852 954m330.exe 1352 dd8as.exe 748 5j33933.exe 1144 f83ndl1.exe 2304 p36i115.exe 4660 p54g32x.exe 4860 151dqe.exe 4000 79muwu.exe 1344 4vh1w8.exe 4476 e3ij1os.exe 4004 c3ox8ul.exe 2112 83ub74.exe 2436 2c1335.exe 2748 881jm43.exe 4928 v95g917.exe 4980 p70cc.exe 3460 t3ius.exe 5064 voa7g.exe -
resource yara_rule behavioral2/memory/1464-7-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4924-5-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4128-16-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1820-24-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4128-22-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4992-18-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3616-30-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2980-46-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1264-52-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1096-39-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3724-67-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2428-42-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3724-70-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2324-81-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/5076-83-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4148-90-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4712-96-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3524-107-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/5024-113-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4964-117-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2080-103-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1792-129-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2640-137-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1012-144-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4112-146-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1012-150-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4124-159-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3908-171-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2996-179-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4532-183-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1152-182-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4532-186-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/736-195-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4428-200-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4648-208-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3320-211-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4924-216-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1144-237-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4860-246-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4000-247-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4000-250-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4476-256-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4004-258-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2436-264-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4928-271-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3076-284-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3076-288-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2892-304-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4828-314-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3120-318-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2300-328-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3588-336-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4896-342-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4316-350-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4396-362-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/3932-366-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1324-376-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/1324-380-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4456-387-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4544-398-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4284-411-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/2980-432-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/4840-435-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral2/memory/432-440-0x0000000000400000-0x000000000042C000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4924 wrote to memory of 1464 4924 HEUR-Trojan.Win32.Injuke.exe 89 PID 4924 wrote to memory of 1464 4924 HEUR-Trojan.Win32.Injuke.exe 89 PID 4924 wrote to memory of 1464 4924 HEUR-Trojan.Win32.Injuke.exe 89 PID 1464 wrote to memory of 4992 1464 qh739.exe 90 PID 1464 wrote to memory of 4992 1464 qh739.exe 90 PID 1464 wrote to memory of 4992 1464 qh739.exe 90 PID 4992 wrote to memory of 4128 4992 3dsgak6.exe 91 PID 4992 wrote to memory of 4128 4992 3dsgak6.exe 91 PID 4992 wrote to memory of 4128 4992 3dsgak6.exe 91 PID 4128 wrote to memory of 1820 4128 e74tgk.exe 92 PID 4128 wrote to memory of 1820 4128 e74tgk.exe 92 PID 4128 wrote to memory of 1820 4128 e74tgk.exe 92 PID 1820 wrote to memory of 3616 1820 71769kg.exe 93 PID 1820 wrote to memory of 3616 1820 71769kg.exe 93 PID 1820 wrote to memory of 3616 1820 71769kg.exe 93 PID 3616 wrote to memory of 1096 3616 4puwae.exe 94 PID 3616 wrote to memory of 1096 3616 4puwae.exe 94 PID 3616 wrote to memory of 1096 3616 4puwae.exe 94 PID 1096 wrote to memory of 2428 1096 v7as1.exe 95 PID 1096 wrote to memory of 2428 1096 v7as1.exe 95 PID 1096 wrote to memory of 2428 1096 v7as1.exe 95 PID 2428 wrote to memory of 2980 2428 8gi022.exe 100 PID 2428 wrote to memory of 2980 2428 8gi022.exe 100 PID 2428 wrote to memory of 2980 2428 8gi022.exe 100 PID 2980 wrote to memory of 1264 2980 4ouk2.exe 99 PID 2980 wrote to memory of 1264 2980 4ouk2.exe 99 PID 2980 wrote to memory of 1264 2980 4ouk2.exe 99 PID 1264 wrote to memory of 4476 1264 4su52a9.exe 98 PID 1264 wrote to memory of 4476 1264 4su52a9.exe 98 PID 1264 wrote to memory of 4476 1264 4su52a9.exe 98 PID 4476 wrote to memory of 224 4476 f759755.exe 97 PID 4476 wrote to memory of 224 4476 f759755.exe 97 PID 4476 wrote to memory of 224 4476 f759755.exe 97 PID 224 wrote to memory of 3724 224 77r18o.exe 96 PID 224 wrote to memory of 3724 224 77r18o.exe 96 PID 224 wrote to memory of 3724 224 77r18o.exe 96 PID 3724 wrote to memory of 5040 3724 gq16j0.exe 101 PID 3724 wrote to memory of 5040 3724 gq16j0.exe 101 PID 3724 wrote to memory of 5040 3724 gq16j0.exe 101 PID 5040 wrote to memory of 2324 5040 wde769o.exe 102 PID 5040 wrote to memory of 2324 5040 wde769o.exe 102 PID 5040 wrote to memory of 2324 5040 wde769o.exe 102 PID 2324 wrote to memory of 5076 2324 jx2kp.exe 103 PID 2324 wrote to memory of 5076 2324 jx2kp.exe 103 PID 2324 wrote to memory of 5076 2324 jx2kp.exe 103 PID 5076 wrote to memory of 4148 5076 8crgsh7.exe 104 PID 5076 wrote to memory of 4148 5076 8crgsh7.exe 104 PID 5076 wrote to memory of 4148 5076 8crgsh7.exe 104 PID 4148 wrote to memory of 4712 4148 s7eqa0.exe 105 PID 4148 wrote to memory of 4712 4148 s7eqa0.exe 105 PID 4148 wrote to memory of 4712 4148 s7eqa0.exe 105 PID 4712 wrote to memory of 2080 4712 j150b.exe 106 PID 4712 wrote to memory of 2080 4712 j150b.exe 106 PID 4712 wrote to memory of 2080 4712 j150b.exe 106 PID 2080 wrote to memory of 3524 2080 7299335.exe 107 PID 2080 wrote to memory of 3524 2080 7299335.exe 107 PID 2080 wrote to memory of 3524 2080 7299335.exe 107 PID 3524 wrote to memory of 5024 3524 1n392.exe 108 PID 3524 wrote to memory of 5024 3524 1n392.exe 108 PID 3524 wrote to memory of 5024 3524 1n392.exe 108 PID 5024 wrote to memory of 4964 5024 xke6i.exe 109 PID 5024 wrote to memory of 4964 5024 xke6i.exe 109 PID 5024 wrote to memory of 4964 5024 xke6i.exe 109 PID 4964 wrote to memory of 1792 4964 eu11x.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Injuke.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Injuke.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\qh739.exec:\qh739.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\3dsgak6.exec:\3dsgak6.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\e74tgk.exec:\e74tgk.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\71769kg.exec:\71769kg.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\4puwae.exec:\4puwae.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\v7as1.exec:\v7as1.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\8gi022.exec:\8gi022.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\4ouk2.exec:\4ouk2.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980
-
-
-
-
-
-
-
-
-
\??\c:\gq16j0.exec:\gq16j0.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\wde769o.exec:\wde769o.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\jx2kp.exec:\jx2kp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\8crgsh7.exec:\8crgsh7.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\s7eqa0.exec:\s7eqa0.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\j150b.exec:\j150b.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\7299335.exec:\7299335.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\1n392.exec:\1n392.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\xke6i.exec:\xke6i.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\eu11x.exec:\eu11x.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\qcuk0u.exec:\qcuk0u.exe11⤵
- Executes dropped EXE
PID:1792 -
\??\c:\6n451.exec:\6n451.exe12⤵
- Executes dropped EXE
PID:1208 -
\??\c:\3b1kn.exec:\3b1kn.exe13⤵
- Executes dropped EXE
PID:2640
-
-
-
-
-
-
-
-
-
-
-
-
-
\??\c:\77r18o.exec:\77r18o.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224
-
\??\c:\f759755.exec:\f759755.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476
-
\??\c:\4su52a9.exec:\4su52a9.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264
-
\??\c:\lguupv7.exec:\lguupv7.exe1⤵
- Executes dropped EXE
PID:4112 -
\??\c:\117317.exec:\117317.exe2⤵
- Executes dropped EXE
PID:1012 -
\??\c:\fek59.exec:\fek59.exe3⤵
- Executes dropped EXE
PID:3864 -
\??\c:\sppmw0.exec:\sppmw0.exe4⤵
- Executes dropped EXE
PID:4124 -
\??\c:\50lh8bo.exec:\50lh8bo.exe5⤵
- Executes dropped EXE
PID:4916 -
\??\c:\6w56m.exec:\6w56m.exe6⤵
- Executes dropped EXE
PID:3908 -
\??\c:\u06op.exec:\u06op.exe7⤵
- Executes dropped EXE
PID:2616 -
\??\c:\2bn5smm.exec:\2bn5smm.exe8⤵
- Executes dropped EXE
PID:2996 -
\??\c:\iv1a9.exec:\iv1a9.exe9⤵
- Executes dropped EXE
PID:1152 -
\??\c:\6t3sb.exec:\6t3sb.exe10⤵
- Executes dropped EXE
PID:4532 -
\??\c:\4h95ss.exec:\4h95ss.exe11⤵
- Executes dropped EXE
PID:2552 -
\??\c:\5b98c.exec:\5b98c.exe12⤵
- Executes dropped EXE
PID:2884 -
\??\c:\1gu67b0.exec:\1gu67b0.exe13⤵
- Executes dropped EXE
PID:736 -
\??\c:\6p73937.exec:\6p73937.exe14⤵
- Executes dropped EXE
PID:1332 -
\??\c:\l8aue94.exec:\l8aue94.exe15⤵
- Executes dropped EXE
PID:4428 -
\??\c:\x99hl5.exec:\x99hl5.exe16⤵
- Executes dropped EXE
PID:4016 -
\??\c:\dmquqa.exec:\dmquqa.exe17⤵
- Executes dropped EXE
PID:4648 -
\??\c:\974o4e.exec:\974o4e.exe18⤵
- Executes dropped EXE
PID:3320 -
\??\c:\h08022.exec:\h08022.exe19⤵
- Executes dropped EXE
PID:2572 -
\??\c:\96qsuov.exec:\96qsuov.exe20⤵
- Executes dropped EXE
PID:4924 -
\??\c:\f68g5c.exec:\f68g5c.exe21⤵
- Executes dropped EXE
PID:2400 -
\??\c:\p5weu.exec:\p5weu.exe22⤵
- Executes dropped EXE
PID:1928 -
\??\c:\954m330.exec:\954m330.exe23⤵
- Executes dropped EXE
PID:4852 -
\??\c:\dd8as.exec:\dd8as.exe24⤵
- Executes dropped EXE
PID:1352 -
\??\c:\5j33933.exec:\5j33933.exe25⤵
- Executes dropped EXE
PID:748 -
\??\c:\f83ndl1.exec:\f83ndl1.exe26⤵
- Executes dropped EXE
PID:1144 -
\??\c:\p36i115.exec:\p36i115.exe27⤵
- Executes dropped EXE
PID:2304 -
\??\c:\p54g32x.exec:\p54g32x.exe28⤵
- Executes dropped EXE
PID:4660 -
\??\c:\151dqe.exec:\151dqe.exe29⤵
- Executes dropped EXE
PID:4860 -
\??\c:\79muwu.exec:\79muwu.exe30⤵
- Executes dropped EXE
PID:4000 -
\??\c:\4vh1w8.exec:\4vh1w8.exe31⤵
- Executes dropped EXE
PID:1344 -
\??\c:\e3ij1os.exec:\e3ij1os.exe32⤵
- Executes dropped EXE
PID:4476 -
\??\c:\c3ox8ul.exec:\c3ox8ul.exe33⤵
- Executes dropped EXE
PID:4004 -
\??\c:\83ub74.exec:\83ub74.exe34⤵
- Executes dropped EXE
PID:2112 -
\??\c:\2c1335.exec:\2c1335.exe35⤵
- Executes dropped EXE
PID:2436 -
\??\c:\881jm43.exec:\881jm43.exe36⤵
- Executes dropped EXE
PID:2748 -
\??\c:\v95g917.exec:\v95g917.exe37⤵
- Executes dropped EXE
PID:4928 -
\??\c:\p70cc.exec:\p70cc.exe38⤵
- Executes dropped EXE
PID:4980 -
\??\c:\t3ius.exec:\t3ius.exe39⤵
- Executes dropped EXE
PID:3460 -
\??\c:\voa7g.exec:\voa7g.exe40⤵
- Executes dropped EXE
PID:5064 -
\??\c:\gp3599.exec:\gp3599.exe41⤵PID:3076
-
\??\c:\0qjkc.exec:\0qjkc.exe42⤵PID:2016
-
\??\c:\d5119k.exec:\d5119k.exe43⤵PID:2080
-
\??\c:\r78rfa.exec:\r78rfa.exe44⤵PID:4152
-
\??\c:\u33873.exec:\u33873.exe45⤵PID:1396
-
\??\c:\t77173.exec:\t77173.exe46⤵PID:2892
-
\??\c:\1442g46.exec:\1442g46.exe47⤵PID:1136
-
\??\c:\451tae0.exec:\451tae0.exe48⤵PID:4184
-
\??\c:\09r72.exec:\09r72.exe49⤵PID:4828
-
\??\c:\0sx58j.exec:\0sx58j.exe50⤵PID:3120
-
\??\c:\as005.exec:\as005.exe51⤵PID:4488
-
\??\c:\8v30b.exec:\8v30b.exe52⤵PID:1708
-
\??\c:\211998i.exec:\211998i.exe53⤵PID:2300
-
\??\c:\2wcmmg.exec:\2wcmmg.exe54⤵PID:3084
-
\??\c:\w3hm6q3.exec:\w3hm6q3.exe55⤵PID:4084
-
\??\c:\l8o957.exec:\l8o957.exe56⤵PID:3588
-
\??\c:\f7559.exec:\f7559.exe57⤵PID:3864
-
\??\c:\wjp7d9.exec:\wjp7d9.exe58⤵PID:4896
-
\??\c:\gqk8n9.exec:\gqk8n9.exe59⤵PID:4316
-
\??\c:\2hg388.exec:\2hg388.exe60⤵PID:3080
-
\??\c:\i6v44.exec:\i6v44.exe61⤵PID:4012
-
\??\c:\34p4gg.exec:\34p4gg.exe62⤵PID:5052
-
\??\c:\p0q925.exec:\p0q925.exe63⤵PID:4396
-
\??\c:\6316w.exec:\6316w.exe64⤵PID:2232
-
\??\c:\n9o7vn.exec:\n9o7vn.exe65⤵PID:3932
-
\??\c:\w90r7.exec:\w90r7.exe66⤵PID:1152
-
\??\c:\g98mq.exec:\g98mq.exe67⤵PID:336
-
\??\c:\13378g.exec:\13378g.exe68⤵PID:1324
-
\??\c:\0ksmq0.exec:\0ksmq0.exe69⤵PID:4908
-
\??\c:\k595137.exec:\k595137.exe70⤵PID:1124
-
\??\c:\lmae137.exec:\lmae137.exe71⤵PID:4456
-
\??\c:\092uwv7.exec:\092uwv7.exe72⤵PID:5068
-
\??\c:\50wad.exec:\50wad.exe73⤵PID:4544
-
\??\c:\u0g733.exec:\u0g733.exe74⤵PID:4116
-
\??\c:\d7ckq8a.exec:\d7ckq8a.exe75⤵PID:4360
-
\??\c:\bieo4os.exec:\bieo4os.exe76⤵PID:2340
-
\??\c:\8uv853.exec:\8uv853.exe77⤵PID:4284
-
\??\c:\91oa6m.exec:\91oa6m.exe78⤵PID:2676
-
\??\c:\29934.exec:\29934.exe79⤵PID:1824
-
\??\c:\3f37115.exec:\3f37115.exe80⤵PID:3040
-
\??\c:\14sx60.exec:\14sx60.exe81⤵PID:456
-
\??\c:\62mlk.exec:\62mlk.exe82⤵PID:4892
-
\??\c:\j1291p.exec:\j1291p.exe83⤵PID:5008
-
\??\c:\r29ls4.exec:\r29ls4.exe84⤵PID:2980
-
\??\c:\496w93.exec:\496w93.exe85⤵PID:4840
-
\??\c:\f253tw.exec:\f253tw.exe86⤵PID:2452
-
\??\c:\j2s57.exec:\j2s57.exe87⤵PID:432
-
\??\c:\88f602.exec:\88f602.exe88⤵PID:1304
-
\??\c:\0p9ar90.exec:\0p9ar90.exe89⤵PID:2720
-
\??\c:\ju6g67.exec:\ju6g67.exe90⤵PID:412
-
\??\c:\xcuo25d.exec:\xcuo25d.exe91⤵PID:3724
-
\??\c:\rs13khv.exec:\rs13khv.exe92⤵PID:1960
-
\??\c:\553sk.exec:\553sk.exe93⤵PID:3904
-
\??\c:\h68g9.exec:\h68g9.exe94⤵PID:968
-
\??\c:\hw93rj.exec:\hw93rj.exe95⤵PID:2272
-
\??\c:\9kwl7lq.exec:\9kwl7lq.exe96⤵PID:4920
-
\??\c:\x42g83.exec:\x42g83.exe97⤵PID:4348
-
\??\c:\40qvqq.exec:\40qvqq.exe98⤵PID:732
-
\??\c:\6w2qg.exec:\6w2qg.exe99⤵PID:4568
-
\??\c:\43wd26.exec:\43wd26.exe100⤵PID:1068
-
\??\c:\rcq7o.exec:\rcq7o.exe101⤵PID:5024
-
\??\c:\299wm.exec:\299wm.exe102⤵PID:2100
-
\??\c:\ncu225.exec:\ncu225.exe103⤵PID:2588
-
\??\c:\e91u4.exec:\e91u4.exe104⤵PID:3808
-
\??\c:\o93iqs0.exec:\o93iqs0.exe105⤵PID:5104
-
\??\c:\o1qp9.exec:\o1qp9.exe106⤵PID:3648
-
\??\c:\5pcv7.exec:\5pcv7.exe107⤵PID:4024
-
\??\c:\0ex6i2.exec:\0ex6i2.exe108⤵PID:4796
-
\??\c:\97q3uiw.exec:\97q3uiw.exe109⤵PID:648
-
\??\c:\wu4607.exec:\wu4607.exe110⤵PID:4948
-
\??\c:\f115b5.exec:\f115b5.exe111⤵PID:3352
-
\??\c:\66aooee.exec:\66aooee.exe112⤵PID:2548
-
\??\c:\cj16gr.exec:\cj16gr.exe113⤵PID:1816
-
\??\c:\n6m93.exec:\n6m93.exe114⤵PID:4916
-
\??\c:\0of3c.exec:\0of3c.exe115⤵PID:4788
-
\??\c:\06qki1a.exec:\06qki1a.exe116⤵PID:4984
-
\??\c:\pjb84.exec:\pjb84.exe117⤵PID:4672
-
\??\c:\ew92p.exec:\ew92p.exe118⤵PID:4040
-
\??\c:\8cp6h.exec:\8cp6h.exe119⤵PID:1644
-
\??\c:\sox70.exec:\sox70.exe120⤵PID:2072
-
\??\c:\2965xt6.exec:\2965xt6.exe121⤵PID:2364
-
\??\c:\391ot8.exec:\391ot8.exe122⤵PID:1324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-