Analysis
-
max time kernel
153s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
22/04/2024, 20:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
28954641e3051d3f7225cca0ef79aca89f04dbb4e97194d160ad3a3f061a1a72.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
28954641e3051d3f7225cca0ef79aca89f04dbb4e97194d160ad3a3f061a1a72.exe
-
Size
91KB
-
MD5
b0573313ea87ba4ffa8dbabc73c2ddec
-
SHA1
4d857eb401184bb32e633ad59feca52a887ac997
-
SHA256
28954641e3051d3f7225cca0ef79aca89f04dbb4e97194d160ad3a3f061a1a72
-
SHA512
7c0cb628d1e73edcd21dab9405698081821c99bc75b0d390212b0cfdd72216bf139343e56dd1115be1451341e9b8b8f4d92cfddd630f6abfe1807913e71c7b3c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxS1rj/21S:ymb3NkkiQ3mdBjFo73PYP1lri3K8GA
Malware Config
Signatures
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral2/memory/568-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/568-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1428-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3884-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/820-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2728-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3728-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1592-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3392-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2100-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1732-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4316-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3444-270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2728-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2808-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2972-320-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-328-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-347-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2648-352-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1320-370-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2076-388-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-391-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-400-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1732-407-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 62 IoCs
resource yara_rule behavioral2/memory/568-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/568-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4316-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/568-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4316-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1428-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1428-21-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4936-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4080-35-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2464-42-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3884-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/820-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4060-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2728-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4276-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4276-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4240-85-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2056-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2156-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3728-118-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3976-125-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4884-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2796-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4784-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1592-158-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1592-162-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4056-165-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3392-172-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3392-175-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5032-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2100-187-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1732-206-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4384-213-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4316-231-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4448-236-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3084-244-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3084-247-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4080-252-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2764-265-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3444-268-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3444-270-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4880-274-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2728-280-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2808-289-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1872-293-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4708-299-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1872-297-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4708-304-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2044-309-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3472-315-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2972-320-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3976-328-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3976-330-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1156-347-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2648-352-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1320-370-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2076-382-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2076-388-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1692-389-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1692-391-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/404-400-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1732-407-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 4316 1xfig.exe 1428 dphtxx.exe 4936 391tc9.exe 4080 83hw2.exe 2464 r183k.exe 3884 ito3d.exe 820 lraw5.exe 4060 75c7b70.exe 2728 083q37m.exe 4276 5m6s3.exe 4240 82g5w4c.exe 2056 s9l05.exe 2436 7o5a5.exe 2156 dmn26h1.exe 2564 85j9v.exe 3728 brxllb.exe 3976 u314d.exe 4884 ctqi6v.exe 2796 5780e.exe 1976 dhl476.exe 4784 7n71c.exe 1592 970668f.exe 4056 xg973.exe 3392 09q02.exe 5032 x1naw.exe 2100 02nr4e.exe 4680 n97e9.exe 4488 4en1qb.exe 1732 pfvb62.exe 4384 2lb36t.exe 3796 61q7g1u.exe 1248 c16q3.exe 4316 511lx.exe 4448 77k16.exe 3484 5bkh3.exe 3084 9255fn.exe 4080 rj26f.exe 1828 w55xu7s.exe 1764 g5p144.exe 2764 x8spw.exe 3444 a3ggqhw.exe 4880 v3cdf.exe 2728 1rkl97w.exe 888 1obr4.exe 2808 1foxj.exe 1872 9s52t.exe 4708 9ari7.exe 4536 032k1g5.exe 2044 0bw7uf.exe 3472 j5935e3.exe 2972 o5c4x.exe 3996 vs4w28k.exe 3976 8mcm823.exe 4884 hsp4kn.exe 1972 enua1d8.exe 4760 xb7l7.exe 1156 34bc59f.exe 2648 glu2q8j.exe 656 vjw4kl.exe 4792 kfwb6td.exe 3452 c7wrf.exe 1320 dmvt398.exe 4924 r04e7.exe 4960 22w1a.exe -
resource yara_rule behavioral2/memory/568-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/568-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/568-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1428-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1428-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3884-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/820-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3728-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1592-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1592-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4316-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3444-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3444-270-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-280-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-289-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-297-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-309-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2972-320-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-328-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-330-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-347-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2648-352-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1320-370-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-373-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-382-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-388-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-389-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-391-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-400-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-407-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 568 wrote to memory of 4316 568 28954641e3051d3f7225cca0ef79aca89f04dbb4e97194d160ad3a3f061a1a72.exe 90 PID 568 wrote to memory of 4316 568 28954641e3051d3f7225cca0ef79aca89f04dbb4e97194d160ad3a3f061a1a72.exe 90 PID 568 wrote to memory of 4316 568 28954641e3051d3f7225cca0ef79aca89f04dbb4e97194d160ad3a3f061a1a72.exe 90 PID 4316 wrote to memory of 1428 4316 1xfig.exe 91 PID 4316 wrote to memory of 1428 4316 1xfig.exe 91 PID 4316 wrote to memory of 1428 4316 1xfig.exe 91 PID 1428 wrote to memory of 4936 1428 dphtxx.exe 92 PID 1428 wrote to memory of 4936 1428 dphtxx.exe 92 PID 1428 wrote to memory of 4936 1428 dphtxx.exe 92 PID 4936 wrote to memory of 4080 4936 391tc9.exe 93 PID 4936 wrote to memory of 4080 4936 391tc9.exe 93 PID 4936 wrote to memory of 4080 4936 391tc9.exe 93 PID 4080 wrote to memory of 2464 4080 83hw2.exe 94 PID 4080 wrote to memory of 2464 4080 83hw2.exe 94 PID 4080 wrote to memory of 2464 4080 83hw2.exe 94 PID 2464 wrote to memory of 3884 2464 r183k.exe 95 PID 2464 wrote to memory of 3884 2464 r183k.exe 95 PID 2464 wrote to memory of 3884 2464 r183k.exe 95 PID 3884 wrote to memory of 820 3884 ito3d.exe 96 PID 3884 wrote to memory of 820 3884 ito3d.exe 96 PID 3884 wrote to memory of 820 3884 ito3d.exe 96 PID 820 wrote to memory of 4060 820 lraw5.exe 97 PID 820 wrote to memory of 4060 820 lraw5.exe 97 PID 820 wrote to memory of 4060 820 lraw5.exe 97 PID 4060 wrote to memory of 2728 4060 75c7b70.exe 98 PID 4060 wrote to memory of 2728 4060 75c7b70.exe 98 PID 4060 wrote to memory of 2728 4060 75c7b70.exe 98 PID 2728 wrote to memory of 4276 2728 083q37m.exe 99 PID 2728 wrote to memory of 4276 2728 083q37m.exe 99 PID 2728 wrote to memory of 4276 2728 083q37m.exe 99 PID 4276 wrote to memory of 4240 4276 5m6s3.exe 100 PID 4276 wrote to memory of 4240 4276 5m6s3.exe 100 PID 4276 wrote to memory of 4240 4276 5m6s3.exe 100 PID 4240 wrote to memory of 2056 4240 82g5w4c.exe 101 PID 4240 wrote to memory of 2056 4240 82g5w4c.exe 101 PID 4240 wrote to memory of 2056 4240 82g5w4c.exe 101 PID 2056 wrote to memory of 2436 2056 s9l05.exe 102 PID 2056 wrote to memory of 2436 2056 s9l05.exe 102 PID 2056 wrote to memory of 2436 2056 s9l05.exe 102 PID 2436 wrote to memory of 2156 2436 7o5a5.exe 103 PID 2436 wrote to memory of 2156 2436 7o5a5.exe 103 PID 2436 wrote to memory of 2156 2436 7o5a5.exe 103 PID 2156 wrote to memory of 2564 2156 dmn26h1.exe 104 PID 2156 wrote to memory of 2564 2156 dmn26h1.exe 104 PID 2156 wrote to memory of 2564 2156 dmn26h1.exe 104 PID 2564 wrote to memory of 3728 2564 85j9v.exe 105 PID 2564 wrote to memory of 3728 2564 85j9v.exe 105 PID 2564 wrote to memory of 3728 2564 85j9v.exe 105 PID 3728 wrote to memory of 3976 3728 brxllb.exe 106 PID 3728 wrote to memory of 3976 3728 brxllb.exe 106 PID 3728 wrote to memory of 3976 3728 brxllb.exe 106 PID 3976 wrote to memory of 4884 3976 u314d.exe 107 PID 3976 wrote to memory of 4884 3976 u314d.exe 107 PID 3976 wrote to memory of 4884 3976 u314d.exe 107 PID 4884 wrote to memory of 2796 4884 ctqi6v.exe 108 PID 4884 wrote to memory of 2796 4884 ctqi6v.exe 108 PID 4884 wrote to memory of 2796 4884 ctqi6v.exe 108 PID 2796 wrote to memory of 1976 2796 5780e.exe 109 PID 2796 wrote to memory of 1976 2796 5780e.exe 109 PID 2796 wrote to memory of 1976 2796 5780e.exe 109 PID 1976 wrote to memory of 4784 1976 dhl476.exe 110 PID 1976 wrote to memory of 4784 1976 dhl476.exe 110 PID 1976 wrote to memory of 4784 1976 dhl476.exe 110 PID 4784 wrote to memory of 1592 4784 7n71c.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\28954641e3051d3f7225cca0ef79aca89f04dbb4e97194d160ad3a3f061a1a72.exe"C:\Users\Admin\AppData\Local\Temp\28954641e3051d3f7225cca0ef79aca89f04dbb4e97194d160ad3a3f061a1a72.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\1xfig.exec:\1xfig.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\dphtxx.exec:\dphtxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\391tc9.exec:\391tc9.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\83hw2.exec:\83hw2.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\r183k.exec:\r183k.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\ito3d.exec:\ito3d.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\lraw5.exec:\lraw5.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\75c7b70.exec:\75c7b70.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\083q37m.exec:\083q37m.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\5m6s3.exec:\5m6s3.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\82g5w4c.exec:\82g5w4c.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\s9l05.exec:\s9l05.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\7o5a5.exec:\7o5a5.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\dmn26h1.exec:\dmn26h1.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\85j9v.exec:\85j9v.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\brxllb.exec:\brxllb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\u314d.exec:\u314d.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\ctqi6v.exec:\ctqi6v.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\5780e.exec:\5780e.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\dhl476.exec:\dhl476.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\7n71c.exec:\7n71c.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\970668f.exec:\970668f.exe23⤵
- Executes dropped EXE
PID:1592 -
\??\c:\xg973.exec:\xg973.exe24⤵
- Executes dropped EXE
PID:4056 -
\??\c:\09q02.exec:\09q02.exe25⤵
- Executes dropped EXE
PID:3392 -
\??\c:\x1naw.exec:\x1naw.exe26⤵
- Executes dropped EXE
PID:5032 -
\??\c:\02nr4e.exec:\02nr4e.exe27⤵
- Executes dropped EXE
PID:2100 -
\??\c:\n97e9.exec:\n97e9.exe28⤵
- Executes dropped EXE
PID:4680 -
\??\c:\4en1qb.exec:\4en1qb.exe29⤵
- Executes dropped EXE
PID:4488 -
\??\c:\pfvb62.exec:\pfvb62.exe30⤵
- Executes dropped EXE
PID:1732 -
\??\c:\2lb36t.exec:\2lb36t.exe31⤵
- Executes dropped EXE
PID:4384 -
\??\c:\61q7g1u.exec:\61q7g1u.exe32⤵
- Executes dropped EXE
PID:3796 -
\??\c:\c16q3.exec:\c16q3.exe33⤵
- Executes dropped EXE
PID:1248 -
\??\c:\511lx.exec:\511lx.exe34⤵
- Executes dropped EXE
PID:4316 -
\??\c:\77k16.exec:\77k16.exe35⤵
- Executes dropped EXE
PID:4448 -
\??\c:\5bkh3.exec:\5bkh3.exe36⤵
- Executes dropped EXE
PID:3484 -
\??\c:\9255fn.exec:\9255fn.exe37⤵
- Executes dropped EXE
PID:3084 -
\??\c:\rj26f.exec:\rj26f.exe38⤵
- Executes dropped EXE
PID:4080 -
\??\c:\w55xu7s.exec:\w55xu7s.exe39⤵
- Executes dropped EXE
PID:1828 -
\??\c:\g5p144.exec:\g5p144.exe40⤵
- Executes dropped EXE
PID:1764 -
\??\c:\x8spw.exec:\x8spw.exe41⤵
- Executes dropped EXE
PID:2764 -
\??\c:\a3ggqhw.exec:\a3ggqhw.exe42⤵
- Executes dropped EXE
PID:3444 -
\??\c:\v3cdf.exec:\v3cdf.exe43⤵
- Executes dropped EXE
PID:4880 -
\??\c:\1rkl97w.exec:\1rkl97w.exe44⤵
- Executes dropped EXE
PID:2728 -
\??\c:\1obr4.exec:\1obr4.exe45⤵
- Executes dropped EXE
PID:888 -
\??\c:\1foxj.exec:\1foxj.exe46⤵
- Executes dropped EXE
PID:2808 -
\??\c:\9s52t.exec:\9s52t.exe47⤵
- Executes dropped EXE
PID:1872 -
\??\c:\9ari7.exec:\9ari7.exe48⤵
- Executes dropped EXE
PID:4708 -
\??\c:\032k1g5.exec:\032k1g5.exe49⤵
- Executes dropped EXE
PID:4536 -
\??\c:\0bw7uf.exec:\0bw7uf.exe50⤵
- Executes dropped EXE
PID:2044 -
\??\c:\j5935e3.exec:\j5935e3.exe51⤵
- Executes dropped EXE
PID:3472 -
\??\c:\o5c4x.exec:\o5c4x.exe52⤵
- Executes dropped EXE
PID:2972 -
\??\c:\vs4w28k.exec:\vs4w28k.exe53⤵
- Executes dropped EXE
PID:3996 -
\??\c:\8mcm823.exec:\8mcm823.exe54⤵
- Executes dropped EXE
PID:3976 -
\??\c:\hsp4kn.exec:\hsp4kn.exe55⤵
- Executes dropped EXE
PID:4884 -
\??\c:\enua1d8.exec:\enua1d8.exe56⤵
- Executes dropped EXE
PID:1972 -
\??\c:\xb7l7.exec:\xb7l7.exe57⤵
- Executes dropped EXE
PID:4760 -
\??\c:\34bc59f.exec:\34bc59f.exe58⤵
- Executes dropped EXE
PID:1156 -
\??\c:\glu2q8j.exec:\glu2q8j.exe59⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vjw4kl.exec:\vjw4kl.exe60⤵
- Executes dropped EXE
PID:656 -
\??\c:\kfwb6td.exec:\kfwb6td.exe61⤵
- Executes dropped EXE
PID:4792 -
\??\c:\c7wrf.exec:\c7wrf.exe62⤵
- Executes dropped EXE
PID:3452 -
\??\c:\dmvt398.exec:\dmvt398.exe63⤵
- Executes dropped EXE
PID:1320 -
\??\c:\r04e7.exec:\r04e7.exe64⤵
- Executes dropped EXE
PID:4924 -
\??\c:\22w1a.exec:\22w1a.exe65⤵
- Executes dropped EXE
PID:4960 -
\??\c:\irv9m05.exec:\irv9m05.exe66⤵PID:2076
-
\??\c:\1s39ajt.exec:\1s39ajt.exe67⤵PID:1692
-
\??\c:\xdxxxh.exec:\xdxxxh.exe68⤵PID:2308
-
\??\c:\ajsnc38.exec:\ajsnc38.exe69⤵PID:404
-
\??\c:\qwhom.exec:\qwhom.exe70⤵PID:1732
-
\??\c:\ob674.exec:\ob674.exe71⤵PID:548
-
\??\c:\olg4o9.exec:\olg4o9.exe72⤵PID:1420
-
\??\c:\23vj8.exec:\23vj8.exe73⤵PID:4976
-
\??\c:\r1idx.exec:\r1idx.exe74⤵PID:2784
-
\??\c:\n39lcw1.exec:\n39lcw1.exe75⤵PID:1428
-
\??\c:\1w690.exec:\1w690.exe76⤵PID:1188
-
\??\c:\3k4fp9.exec:\3k4fp9.exe77⤵PID:4864
-
\??\c:\94fvk.exec:\94fvk.exe78⤵PID:4080
-
\??\c:\iha85k0.exec:\iha85k0.exe79⤵PID:544
-
\??\c:\arxmdd1.exec:\arxmdd1.exe80⤵PID:5092
-
\??\c:\1f262d.exec:\1f262d.exe81⤵PID:4560
-
\??\c:\37cop.exec:\37cop.exe82⤵PID:5088
-
\??\c:\878jc.exec:\878jc.exe83⤵PID:4404
-
\??\c:\lfqc0.exec:\lfqc0.exe84⤵PID:1400
-
\??\c:\50f51.exec:\50f51.exe85⤵PID:4240
-
\??\c:\d22w04.exec:\d22w04.exe86⤵PID:1304
-
\??\c:\3w37o9x.exec:\3w37o9x.exe87⤵PID:2304
-
\??\c:\so5bj7.exec:\so5bj7.exe88⤵PID:2988
-
\??\c:\u37q9.exec:\u37q9.exe89⤵PID:4536
-
\??\c:\thhhxpd.exec:\thhhxpd.exe90⤵PID:2920
-
\??\c:\9vfmd97.exec:\9vfmd97.exe91⤵PID:3472
-
\??\c:\30jmge.exec:\30jmge.exe92⤵PID:3812
-
\??\c:\11mg4.exec:\11mg4.exe93⤵PID:3468
-
\??\c:\4df3co.exec:\4df3co.exe94⤵PID:4336
-
\??\c:\2727m.exec:\2727m.exe95⤵PID:1172
-
\??\c:\uq5sgk.exec:\uq5sgk.exe96⤵PID:2948
-
\??\c:\b75dk.exec:\b75dk.exe97⤵PID:3868
-
\??\c:\g2b44x.exec:\g2b44x.exe98⤵PID:2136
-
\??\c:\6h1qko.exec:\6h1qko.exe99⤵PID:4772
-
\??\c:\7hcvm52.exec:\7hcvm52.exe100⤵PID:2272
-
\??\c:\lk9o6.exec:\lk9o6.exe101⤵PID:4156
-
\??\c:\3ee3ti3.exec:\3ee3ti3.exe102⤵PID:3392
-
\??\c:\253rq29.exec:\253rq29.exe103⤵PID:4604
-
\??\c:\0816h4.exec:\0816h4.exe104⤵PID:4924
-
\??\c:\q5m1734.exec:\q5m1734.exe105⤵PID:2712
-
\??\c:\jdn9175.exec:\jdn9175.exe106⤵PID:4268
-
\??\c:\818aom.exec:\818aom.exe107⤵PID:1408
-
\??\c:\nr6ij.exec:\nr6ij.exe108⤵PID:4216
-
\??\c:\c645h7u.exec:\c645h7u.exe109⤵PID:404
-
\??\c:\mmahi.exec:\mmahi.exe110⤵PID:4132
-
\??\c:\tb5wn1.exec:\tb5wn1.exe111⤵PID:548
-
\??\c:\hk4ew6.exec:\hk4ew6.exe112⤵PID:4244
-
\??\c:\758jp.exec:\758jp.exe113⤵PID:1560
-
\??\c:\dtltlld.exec:\dtltlld.exe114⤵PID:2784
-
\??\c:\39guhf.exec:\39guhf.exe115⤵PID:4824
-
\??\c:\6i3vde5.exec:\6i3vde5.exe116⤵PID:3484
-
\??\c:\s1759o.exec:\s1759o.exe117⤵PID:4148
-
\??\c:\06i96k.exec:\06i96k.exe118⤵PID:4788
-
\??\c:\5xcs1.exec:\5xcs1.exe119⤵PID:2128
-
\??\c:\0997kd.exec:\0997kd.exe120⤵PID:832
-
\??\c:\w1cnpp.exec:\w1cnpp.exe121⤵PID:3444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-