Analysis
- max time kernel
157s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 21:34
Behavioral task
behavioral1
Sample
50f525fda26ab6b0471379332ccac455862f5de073b66670588e0f5858e85a8e.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
- Target 50f525fda26ab6b0471379332ccac455862f5de073b66670588e0f5858e85a8e.exe
- Size 89KB
- Sample240519-1eznvaba9w
- SHA256 50f525fda26ab6b0471379332ccac455862f5de073b66670588e0f5858e85a8e
- MD5 2d046f0dff16a0f58189bb368dc93fc1
- SHA1 e6afba0829b17ff3d93fc98e9724cd69d2959dea
- SHA512 93f06fce4b5de390d250df804c83490c23ca0045bd9b5107b8b20539007c41953cf80ddc98e69439d1bc6a27b96f09cfd9012536474befcf9b6c25be8ce8e5c0
- SSDEEP 1536:cvQBeOGtrYS3srx93UBWfwC6Ggnouy8mVeygryFU2li0gx4EBbhnyLFW+YY:chOmTsF93UYfwC6GIoutieyhC2lbgGi6
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4744-6-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1824-11-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2096-17-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2700-26-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4576-23-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2172-32-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1716-42-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4612-49-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2736-51-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2868-57-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2868-61-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4632-67-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/220-72-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1252-79-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1008-84-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4996-90-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1420-96-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4948-103-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4124-113-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1240-119-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4908-125-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2284-135-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2320-131-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4736-140-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2520-150-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3888-155-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3620-161-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3616-177-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3576-180-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3444-190-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/896-194-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1844-196-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5068-202-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4496-206-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/628-216-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1592-229-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1064-233-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3980-237-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1252-256-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3296-263-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2108-279-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1240-286-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1616-298-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2276-323-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1388-351-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1852-358-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3188-360-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3800-375-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1384-379-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2536-395-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2980-420-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3812-427-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3956-437-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4820-444-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1068-455-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2276-459-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4428-472-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1064-503-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1412-546-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2416-557-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3576-713-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1728-735-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3028-739-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2592-1114-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/4744-0-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000c000000022f7b-3.dat UPX behavioral2/memory/4744-6-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000800000002324f-9.dat UPX behavioral2/memory/1824-11-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0008000000023254-13.dat UPX behavioral2/memory/2096-17-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0009000000023256-21.dat UPX behavioral2/memory/2700-26-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4576-23-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0008000000023257-27.dat UPX behavioral2/memory/2172-32-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023258-36.dat UPX behavioral2/memory/1716-37-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/1716-42-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023259-43.dat UPX behavioral2/memory/4612-49-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002325a-48.dat UPX behavioral2/memory/2736-51-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002325b-53.dat UPX behavioral2/memory/2868-57-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002325c-59.dat UPX behavioral2/memory/2868-61-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4632-67-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002325d-68.dat UPX behavioral2/memory/220-69-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/220-72-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002325e-73.dat UPX behavioral2/files/0x000700000002325f-77.dat UPX behavioral2/memory/1252-79-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/1008-84-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023260-83.dat UPX behavioral2/files/0x0007000000023261-88.dat UPX behavioral2/memory/4996-90-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023262-94.dat UPX behavioral2/memory/1420-96-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023263-100.dat UPX behavioral2/memory/4948-103-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023264-107.dat UPX behavioral2/files/0x0007000000023265-111.dat UPX behavioral2/memory/4124-113-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023266-117.dat UPX behavioral2/memory/1240-119-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023267-123.dat UPX behavioral2/memory/4908-125-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023268-129.dat UPX behavioral2/memory/2284-135-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/2320-131-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4736-140-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023269-138.dat UPX behavioral2/files/0x000700000002326a-142.dat UPX behavioral2/files/0x000700000002326b-148.dat UPX behavioral2/memory/2520-150-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002326d-156.dat UPX behavioral2/memory/3888-155-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002326e-159.dat UPX behavioral2/memory/3620-161-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002326f-166.dat UPX behavioral2/files/0x0007000000023270-170.dat UPX behavioral2/memory/3616-177-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023271-178.dat UPX behavioral2/memory/3576-180-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023272-182.dat UPX behavioral2/files/0x0007000000023273-189.dat UPX - Executes dropped EXE 64 IoCs
pid Process 1824 web3w9.exe 2096 g4xbqf.exe 4576 kk14q4.exe 2700 i9cofl.exe 2172 b4thw7.exe 1716 w6ff89.exe 4612 ntt638d.exe 2736 s2hh59.exe 2868 t9g3q4n.exe 4632 gj150.exe 220 8b155m5.exe 1252 96kj27.exe 1008 fux132.exe 4996 p999ibl.exe 1420 x0wq96.exe 4948 9qqw92d.exe 4312 9rpk9.exe 4124 6wh355.exe 1240 l45jb8k.exe 4908 bwp1d94.exe 2320 167khb.exe 2284 ajaw5ni.exe 4736 4nw734.exe 2520 d2nn2.exe 3888 67mtqus.exe 3620 shbg4sq.exe 808 luoc2p.exe 1068 0kox8s.exe 3616 d74s860.exe 3576 0c45e4.exe 3444 wdskc7.exe 896 a6v5r.exe 1844 1cic1.exe 5068 i2448g.exe 4496 99333j7.exe 3280 8p97be.exe 4804 h2i3cc.exe 628 beumq.exe 2020 l6r44dm.exe 4260 nb873.exe 1736 h4ek33w.exe 1592 8h1twxr.exe 1064 7dxgwv7.exe 3980 qbn15w0.exe 1796 75h0ul.exe 844 i6gipm.exe 560 3g835.exe 4788 3h4wl.exe 1312 gjjvb9t.exe 1252 7k7u6w.exe 3452 ir5ewj.exe 3296 03bq3.exe 3988 blm9e7.exe 2880 8k790.exe 4544 8w9l5lc.exe 1268 6q1f7.exe 2108 4h0m6.exe 3972 k3w236.exe 1240 j1kh23.exe 4440 v5uu29.exe 1700 tcl4o2.exe 376 o1f5bnw.exe 1616 5k6cc3w.exe 5064 4rh5719.exe -
resource yara_rule behavioral2/memory/4744-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000c000000022f7b-3.dat upx behavioral2/memory/4744-6-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000800000002324f-9.dat upx behavioral2/memory/1824-11-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0008000000023254-13.dat upx behavioral2/memory/2096-17-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0009000000023256-21.dat upx behavioral2/memory/2700-26-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4576-23-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0008000000023257-27.dat upx behavioral2/memory/2172-32-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023258-36.dat upx behavioral2/memory/1716-37-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1716-42-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023259-43.dat upx behavioral2/memory/4612-49-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002325a-48.dat upx behavioral2/memory/2736-51-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002325b-53.dat upx behavioral2/memory/2868-57-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002325c-59.dat upx behavioral2/memory/2868-61-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4632-67-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002325d-68.dat upx behavioral2/memory/220-69-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/220-72-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002325e-73.dat upx behavioral2/files/0x000700000002325f-77.dat upx behavioral2/memory/1252-79-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1008-84-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023260-83.dat upx behavioral2/files/0x0007000000023261-88.dat upx behavioral2/memory/4996-90-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023262-94.dat upx behavioral2/memory/1420-96-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023263-100.dat upx behavioral2/memory/4948-103-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023264-107.dat upx behavioral2/files/0x0007000000023265-111.dat upx behavioral2/memory/4124-113-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023266-117.dat upx behavioral2/memory/1240-119-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023267-123.dat upx behavioral2/memory/4908-125-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023268-129.dat upx behavioral2/memory/2284-135-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2320-131-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4736-140-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023269-138.dat upx behavioral2/files/0x000700000002326a-142.dat upx behavioral2/files/0x000700000002326b-148.dat upx behavioral2/memory/2520-150-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002326d-156.dat upx behavioral2/memory/3888-155-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002326e-159.dat upx behavioral2/memory/3620-161-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002326f-166.dat upx behavioral2/files/0x0007000000023270-170.dat upx behavioral2/memory/3616-177-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023271-178.dat upx behavioral2/memory/3576-180-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023272-182.dat upx behavioral2/files/0x0007000000023273-189.dat upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4744 wrote to memory of 1824 4744 50f525fda26ab6b0471379332ccac455862f5de073b66670588e0f5858e85a8e.exe 90 PID 4744 wrote to memory of 1824 4744 50f525fda26ab6b0471379332ccac455862f5de073b66670588e0f5858e85a8e.exe 90 PID 4744 wrote to memory of 1824 4744 50f525fda26ab6b0471379332ccac455862f5de073b66670588e0f5858e85a8e.exe 90 PID 1824 wrote to memory of 2096 1824 web3w9.exe 91 PID 1824 wrote to memory of 2096 1824 web3w9.exe 91 PID 1824 wrote to memory of 2096 1824 web3w9.exe 91 PID 2096 wrote to memory of 4576 2096 g4xbqf.exe 92 PID 2096 wrote to memory of 4576 2096 g4xbqf.exe 92 PID 2096 wrote to memory of 4576 2096 g4xbqf.exe 92 PID 4576 wrote to memory of 2700 4576 kk14q4.exe 93 PID 4576 wrote to memory of 2700 4576 kk14q4.exe 93 PID 4576 wrote to memory of 2700 4576 kk14q4.exe 93 PID 2700 wrote to memory of 2172 2700 i9cofl.exe 94 PID 2700 wrote to memory of 2172 2700 i9cofl.exe 94 PID 2700 wrote to memory of 2172 2700 i9cofl.exe 94 PID 2172 wrote to memory of 1716 2172 b4thw7.exe 95 PID 2172 wrote to memory of 1716 2172 b4thw7.exe 95 PID 2172 wrote to memory of 1716 2172 b4thw7.exe 95 PID 1716 wrote to memory of 4612 1716 w6ff89.exe 96 PID 1716 wrote to memory of 4612 1716 w6ff89.exe 96 PID 1716 wrote to memory of 4612 1716 w6ff89.exe 96 PID 4612 wrote to memory of 2736 4612 ntt638d.exe 97 PID 4612 wrote to memory of 2736 4612 ntt638d.exe 97 PID 4612 wrote to memory of 2736 4612 ntt638d.exe 97 PID 2736 wrote to memory of 2868 2736 s2hh59.exe 98 PID 2736 wrote to memory of 2868 2736 s2hh59.exe 98 PID 2736 wrote to memory of 2868 2736 s2hh59.exe 98 PID 2868 wrote to memory of 4632 2868 t9g3q4n.exe 99 PID 2868 wrote to memory of 4632 2868 t9g3q4n.exe 99 PID 2868 wrote to memory of 4632 2868 t9g3q4n.exe 99 PID 4632 wrote to memory of 220 4632 gj150.exe 100 PID 4632 wrote to memory of 220 4632 gj150.exe 100 PID 4632 wrote to memory of 220 4632 gj150.exe 100 PID 220 wrote to memory of 1252 220 8b155m5.exe 101 PID 220 wrote to memory of 1252 220 8b155m5.exe 101 PID 220 wrote to memory of 1252 220 8b155m5.exe 101 PID 1252 wrote to memory of 1008 1252 96kj27.exe 102 PID 1252 wrote to memory of 1008 1252 96kj27.exe 102 PID 1252 wrote to memory of 1008 1252 96kj27.exe 102 PID 1008 wrote to memory of 4996 1008 fux132.exe 103 PID 1008 wrote to memory of 4996 1008 fux132.exe 103 PID 1008 wrote to memory of 4996 1008 fux132.exe 103 PID 4996 wrote to memory of 1420 4996 p999ibl.exe 104 PID 4996 wrote to memory of 1420 4996 p999ibl.exe 104 PID 4996 wrote to memory of 1420 4996 p999ibl.exe 104 PID 1420 wrote to memory of 4948 1420 x0wq96.exe 105 PID 1420 wrote to memory of 4948 1420 x0wq96.exe 105 PID 1420 wrote to memory of 4948 1420 x0wq96.exe 105 PID 4948 wrote to memory of 4312 4948 9qqw92d.exe 106 PID 4948 wrote to memory of 4312 4948 9qqw92d.exe 106 PID 4948 wrote to memory of 4312 4948 9qqw92d.exe 106 PID 4312 wrote to memory of 4124 4312 9rpk9.exe 107 PID 4312 wrote to memory of 4124 4312 9rpk9.exe 107 PID 4312 wrote to memory of 4124 4312 9rpk9.exe 107 PID 4124 wrote to memory of 1240 4124 6wh355.exe 108 PID 4124 wrote to memory of 1240 4124 6wh355.exe 108 PID 4124 wrote to memory of 1240 4124 6wh355.exe 108 PID 1240 wrote to memory of 4908 1240 l45jb8k.exe 109 PID 1240 wrote to memory of 4908 1240 l45jb8k.exe 109 PID 1240 wrote to memory of 4908 1240 l45jb8k.exe 109 PID 4908 wrote to memory of 2320 4908 bwp1d94.exe 110 PID 4908 wrote to memory of 2320 4908 bwp1d94.exe 110 PID 4908 wrote to memory of 2320 4908 bwp1d94.exe 110 PID 2320 wrote to memory of 2284 2320 167khb.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\50f525fda26ab6b0471379332ccac455862f5de073b66670588e0f5858e85a8e.exe"C:\Users\Admin\AppData\Local\Temp\50f525fda26ab6b0471379332ccac455862f5de073b66670588e0f5858e85a8e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\web3w9.exec:\web3w9.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\g4xbqf.exec:\g4xbqf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\kk14q4.exec:\kk14q4.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\i9cofl.exec:\i9cofl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\b4thw7.exec:\b4thw7.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\w6ff89.exec:\w6ff89.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\ntt638d.exec:\ntt638d.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\s2hh59.exec:\s2hh59.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\t9g3q4n.exec:\t9g3q4n.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\gj150.exec:\gj150.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\8b155m5.exec:\8b155m5.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\96kj27.exec:\96kj27.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\fux132.exec:\fux132.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\p999ibl.exec:\p999ibl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\x0wq96.exec:\x0wq96.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\9qqw92d.exec:\9qqw92d.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\9rpk9.exec:\9rpk9.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\6wh355.exec:\6wh355.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\l45jb8k.exec:\l45jb8k.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\bwp1d94.exec:\bwp1d94.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\167khb.exec:\167khb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\ajaw5ni.exec:\ajaw5ni.exe23⤵
- Executes dropped EXE
PID:2284 -
\??\c:\4nw734.exec:\4nw734.exe24⤵
- Executes dropped EXE
PID:4736 -
\??\c:\d2nn2.exec:\d2nn2.exe25⤵
- Executes dropped EXE
PID:2520 -
\??\c:\67mtqus.exec:\67mtqus.exe26⤵
- Executes dropped EXE
PID:3888 -
\??\c:\shbg4sq.exec:\shbg4sq.exe27⤵
- Executes dropped EXE
PID:3620 -
\??\c:\luoc2p.exec:\luoc2p.exe28⤵
- Executes dropped EXE
PID:808 -
\??\c:\0kox8s.exec:\0kox8s.exe29⤵
- Executes dropped EXE
PID:1068 -
\??\c:\d74s860.exec:\d74s860.exe30⤵
- Executes dropped EXE
PID:3616 -
\??\c:\0c45e4.exec:\0c45e4.exe31⤵
- Executes dropped EXE
PID:3576 -
\??\c:\wdskc7.exec:\wdskc7.exe32⤵
- Executes dropped EXE
PID:3444 -
\??\c:\a6v5r.exec:\a6v5r.exe33⤵
- Executes dropped EXE
PID:896 -
\??\c:\1cic1.exec:\1cic1.exe34⤵
- Executes dropped EXE
PID:1844 -
\??\c:\i2448g.exec:\i2448g.exe35⤵
- Executes dropped EXE
PID:5068 -
\??\c:\99333j7.exec:\99333j7.exe36⤵
- Executes dropped EXE
PID:4496 -
\??\c:\8p97be.exec:\8p97be.exe37⤵
- Executes dropped EXE
PID:3280 -
\??\c:\h2i3cc.exec:\h2i3cc.exe38⤵
- Executes dropped EXE
PID:4804 -
\??\c:\beumq.exec:\beumq.exe39⤵
- Executes dropped EXE
PID:628 -
\??\c:\l6r44dm.exec:\l6r44dm.exe40⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nb873.exec:\nb873.exe41⤵
- Executes dropped EXE
PID:4260 -
\??\c:\h4ek33w.exec:\h4ek33w.exe42⤵
- Executes dropped EXE
PID:1736 -
\??\c:\8h1twxr.exec:\8h1twxr.exe43⤵
- Executes dropped EXE
PID:1592 -
\??\c:\7dxgwv7.exec:\7dxgwv7.exe44⤵
- Executes dropped EXE
PID:1064 -
\??\c:\qbn15w0.exec:\qbn15w0.exe45⤵
- Executes dropped EXE
PID:3980 -
\??\c:\75h0ul.exec:\75h0ul.exe46⤵
- Executes dropped EXE
PID:1796 -
\??\c:\i6gipm.exec:\i6gipm.exe47⤵
- Executes dropped EXE
PID:844 -
\??\c:\3g835.exec:\3g835.exe48⤵
- Executes dropped EXE
PID:560 -
\??\c:\3h4wl.exec:\3h4wl.exe49⤵
- Executes dropped EXE
PID:4788 -
\??\c:\gjjvb9t.exec:\gjjvb9t.exe50⤵
- Executes dropped EXE
PID:1312 -
\??\c:\7k7u6w.exec:\7k7u6w.exe51⤵
- Executes dropped EXE
PID:1252 -
\??\c:\ir5ewj.exec:\ir5ewj.exe52⤵
- Executes dropped EXE
PID:3452 -
\??\c:\03bq3.exec:\03bq3.exe53⤵
- Executes dropped EXE
PID:3296 -
\??\c:\blm9e7.exec:\blm9e7.exe54⤵
- Executes dropped EXE
PID:3988 -
\??\c:\8k790.exec:\8k790.exe55⤵
- Executes dropped EXE
PID:2880 -
\??\c:\8w9l5lc.exec:\8w9l5lc.exe56⤵
- Executes dropped EXE
PID:4544 -
\??\c:\6q1f7.exec:\6q1f7.exe57⤵
- Executes dropped EXE
PID:1268 -
\??\c:\4h0m6.exec:\4h0m6.exe58⤵
- Executes dropped EXE
PID:2108 -
\??\c:\k3w236.exec:\k3w236.exe59⤵
- Executes dropped EXE
PID:3972 -
\??\c:\j1kh23.exec:\j1kh23.exe60⤵
- Executes dropped EXE
PID:1240 -
\??\c:\v5uu29.exec:\v5uu29.exe61⤵
- Executes dropped EXE
PID:4440 -
\??\c:\tcl4o2.exec:\tcl4o2.exe62⤵
- Executes dropped EXE
PID:1700 -
\??\c:\o1f5bnw.exec:\o1f5bnw.exe63⤵
- Executes dropped EXE
PID:376 -
\??\c:\5k6cc3w.exec:\5k6cc3w.exe64⤵
- Executes dropped EXE
PID:1616 -
\??\c:\4rh5719.exec:\4rh5719.exe65⤵
- Executes dropped EXE
PID:5064 -
\??\c:\fl0spn.exec:\fl0spn.exe66⤵PID:976
-
\??\c:\3w23v.exec:\3w23v.exe67⤵PID:1676
-
\??\c:\9ov8s.exec:\9ov8s.exe68⤵PID:3560
-
\??\c:\ti5v0c.exec:\ti5v0c.exe69⤵PID:4532
-
\??\c:\j2fr9.exec:\j2fr9.exe70⤵PID:3620
-
\??\c:\urosk.exec:\urosk.exe71⤵PID:8
-
\??\c:\477b7.exec:\477b7.exe72⤵PID:2276
-
\??\c:\qwwipsh.exec:\qwwipsh.exe73⤵PID:2984
-
\??\c:\4oo2v5.exec:\4oo2v5.exe74⤵PID:3616
-
\??\c:\0pr494.exec:\0pr494.exe75⤵PID:3716
-
\??\c:\a90k94.exec:\a90k94.exe76⤵PID:2756
-
\??\c:\bqcs1e7.exec:\bqcs1e7.exe77⤵PID:4392
-
\??\c:\mgb35.exec:\mgb35.exe78⤵PID:4468
-
\??\c:\ocga0k.exec:\ocga0k.exe79⤵PID:4904
-
\??\c:\k1e008.exec:\k1e008.exe80⤵PID:5068
-
\??\c:\b6fc9r.exec:\b6fc9r.exe81⤵PID:1388
-
\??\c:\ulqh8.exec:\ulqh8.exe82⤵PID:568
-
\??\c:\ma9i0.exec:\ma9i0.exe83⤵PID:1852
-
\??\c:\6d92d.exec:\6d92d.exe84⤵PID:3188
-
\??\c:\935b61.exec:\935b61.exe85⤵PID:4912
-
\??\c:\i7788.exec:\i7788.exe86⤵PID:3292
-
\??\c:\u33x28c.exec:\u33x28c.exe87⤵PID:3984
-
\??\c:\18b4x.exec:\18b4x.exe88⤵PID:3800
-
\??\c:\leknc.exec:\leknc.exe89⤵PID:1384
-
\??\c:\g71g23.exec:\g71g23.exe90⤵PID:560
-
\??\c:\49773l.exec:\49773l.exe91⤵PID:864
-
\??\c:\9f0v0.exec:\9f0v0.exe92⤵PID:2940
-
\??\c:\dxt33.exec:\dxt33.exe93⤵PID:3712
-
\??\c:\312fhov.exec:\312fhov.exe94⤵PID:2536
-
\??\c:\gg17v.exec:\gg17v.exe95⤵PID:1436
-
\??\c:\3l89j1.exec:\3l89j1.exe96⤵PID:4432
-
\??\c:\g7xqo7.exec:\g7xqo7.exe97⤵PID:4388
-
\??\c:\4r752.exec:\4r752.exe98⤵PID:5016
-
\??\c:\9622n1w.exec:\9622n1w.exe99⤵PID:1504
-
\??\c:\t5b749.exec:\t5b749.exe100⤵PID:3596
-
\??\c:\hw1nh.exec:\hw1nh.exe101⤵PID:4380
-
\??\c:\s3i68.exec:\s3i68.exe102⤵PID:2980
-
\??\c:\l5w874.exec:\l5w874.exe103⤵PID:4440
-
\??\c:\5f14o7.exec:\5f14o7.exe104⤵PID:3812
-
\??\c:\pprsgi.exec:\pprsgi.exe105⤵PID:3720
-
\??\c:\ium7f5.exec:\ium7f5.exe106⤵PID:3148
-
\??\c:\45i50d.exec:\45i50d.exe107⤵PID:3956
-
\??\c:\75lw7.exec:\75lw7.exe108⤵PID:1984
-
\??\c:\dj93r5x.exec:\dj93r5x.exe109⤵PID:4820
-
\??\c:\69co4sb.exec:\69co4sb.exe110⤵PID:4128
-
\??\c:\6bhuw.exec:\6bhuw.exe111⤵PID:224
-
\??\c:\d5cl3o2.exec:\d5cl3o2.exe112⤵PID:1068
-
\??\c:\3q3kh3.exec:\3q3kh3.exe113⤵PID:2276
-
\??\c:\qqe5r.exec:\qqe5r.exe114⤵PID:2956
-
\??\c:\i96gj.exec:\i96gj.exe115⤵PID:4972
-
\??\c:\1kf98c.exec:\1kf98c.exe116⤵PID:1428
-
\??\c:\x317bj5.exec:\x317bj5.exe117⤵PID:4428
-
\??\c:\t05s5b.exec:\t05s5b.exe118⤵PID:896
-
\??\c:\pd0g0ke.exec:\pd0g0ke.exe119⤵PID:4620
-
\??\c:\s6uvb.exec:\s6uvb.exe120⤵PID:4752
-
\??\c:\9938n.exec:\9938n.exe121⤵PID:4880
-
\??\c:\ne3r60.exec:\ne3r60.exe122⤵PID:4548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-