Analysis
- max time kernel
154s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 19:54
Behavioral task
behavioral1
Sample
29d9502951929b2e1f1d89938e61f7ccf06e11d5d500a244b73065b7f10b6943.exe
Resource
win7-20240220-en
windows7-x64
6 signatures
150 seconds
General
- Target 29d9502951929b2e1f1d89938e61f7ccf06e11d5d500a244b73065b7f10b6943.exe
- Size 453KB
- Sample240519-ymg3nafa71
- SHA256 29d9502951929b2e1f1d89938e61f7ccf06e11d5d500a244b73065b7f10b6943
- MD5 18d22171b93cfb1cc373a4850e3e4ee5
- SHA1 5882ad5f9e6e07ca65420d071886f370ba4ea8a4
- SHA512 77c5b0914fe7af0c851b769030001303f21ed599954414b8e5c829c82c41e37959745a4fe666fd20a262742f908e5ba0e302cb585b6593220de5e1abee712b73
- SSDEEP 6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1xrloBNTNm9:x4wFHoS3eFaKHpv/VycgE81lg2
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1308-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4204-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2148-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2240-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1464-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2628-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1012-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1544-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1824-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4752-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2884-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3592-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4472-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1020-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2536-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4092-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3684-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1308-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2880-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1048-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1284-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/912-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1504-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1112-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3872-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4216-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2724-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4092-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1184-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1496-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3092-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/904-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3792-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2208-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-448-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1988-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-479-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4704-619-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4448-683-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-711-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1640-794-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3972-880-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-943-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-973-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/1308-0-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000800000002326d-3.dat UPX behavioral2/memory/1308-6-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4204-11-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4204-17-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0008000000023270-18.dat UPX behavioral2/memory/2148-13-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000800000002326e-10.dat UPX behavioral2/files/0x0008000000023272-22.dat UPX behavioral2/memory/2240-24-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023273-28.dat UPX behavioral2/memory/3460-30-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023274-34.dat UPX behavioral2/files/0x0007000000023275-40.dat UPX behavioral2/memory/1464-42-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023276-47.dat UPX behavioral2/files/0x0007000000023277-50.dat UPX behavioral2/memory/5020-53-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023278-59.dat UPX behavioral2/memory/2628-58-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1012-61-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023279-63.dat UPX behavioral2/files/0x000700000002327a-68.dat UPX behavioral2/files/0x000700000002327b-73.dat UPX behavioral2/files/0x000700000002327c-78.dat UPX behavioral2/memory/1544-80-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1824-86-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002327d-84.dat UPX behavioral2/files/0x000700000002327e-90.dat UPX behavioral2/memory/2764-92-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4752-98-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002327f-96.dat UPX behavioral2/files/0x0007000000023280-102.dat UPX behavioral2/memory/2884-107-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/3600-105-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023281-110.dat UPX behavioral2/files/0x0007000000023282-113.dat UPX behavioral2/files/0x0007000000023284-119.dat UPX behavioral2/memory/3592-122-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4472-127-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023285-128.dat UPX behavioral2/files/0x0007000000023286-131.dat UPX behavioral2/memory/4388-136-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1020-135-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023287-139.dat UPX behavioral2/memory/3980-141-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x0007000000023288-144.dat UPX behavioral2/files/0x0007000000023289-149.dat UPX behavioral2/memory/2536-151-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002328a-155.dat UPX behavioral2/memory/4092-157-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002328b-161.dat UPX behavioral2/files/0x000700000002328c-166.dat UPX behavioral2/files/0x000700000002328d-171.dat UPX behavioral2/files/0x000700000002328e-176.dat UPX behavioral2/memory/3684-178-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/4300-186-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/files/0x000700000002328f-183.dat UPX behavioral2/memory/1308-195-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/2880-202-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/5068-209-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1048-216-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/116-220-0x0000000000400000-0x0000000000427000-memory.dmp UPX behavioral2/memory/1284-221-0x0000000000400000-0x0000000000427000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 2148 23k324.exe 4204 og5wqc.exe 2240 2664ani.exe 3460 i5f39k.exe 4232 4k9h1.exe 1464 4bo24.exe 224 cjr05p.exe 5020 h048mki.exe 2628 q294b9.exe 1012 3l17g1.exe 516 n82fc1r.exe 796 47md6n.exe 1544 emrcc8.exe 1824 q1u5u.exe 2764 2k631.exe 4752 wa77a3.exe 3600 e23jq26.exe 2884 m3h3bk.exe 3168 d8a9qlw.exe 3592 0v2974.exe 4472 u52v5n.exe 1020 e050wms.exe 4388 3s93s.exe 3980 apjw03.exe 2536 on06r9.exe 4092 f1a9wc2.exe 4564 e045i.exe 3968 133d66.exe 4060 6xu54.exe 3684 q75w0.exe 4300 47c3ch.exe 1900 jbb2e.exe 2344 tk4l93v.exe 1308 512e7.exe 2776 471553.exe 2880 o3vj58.exe 5040 8i62a.exe 5068 7v5d5.exe 3460 q6n76.exe 1048 7vpkc54.exe 116 ps52e.exe 1284 h0okht7.exe 228 6ijrm3.exe 3776 3de6355.exe 5064 97745.exe 912 92699x.exe 1504 k5m21b.exe 1364 xixcp71.exe 4640 4p8q3.exe 796 861bn2.exe 2316 na94p3.exe 936 aoo0aj.exe 4700 lc83r1.exe 1456 htbi72m.exe 3100 ncc920w.exe 4348 87n3gs.exe 1112 81wp5.exe 4728 594ljwr.exe 3872 6lr77m.exe 4824 jpgeu4.exe 4216 90gpw6.exe 2208 htn64.exe 3432 0hf58pw.exe 2724 wrijd8.exe -
resource yara_rule behavioral2/memory/1308-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002326d-3.dat upx behavioral2/memory/1308-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4204-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4204-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023270-18.dat upx behavioral2/memory/2148-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002326e-10.dat upx behavioral2/files/0x0008000000023272-22.dat upx behavioral2/memory/2240-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023273-28.dat upx behavioral2/memory/3460-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023274-34.dat upx behavioral2/files/0x0007000000023275-40.dat upx behavioral2/memory/1464-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023276-47.dat upx behavioral2/files/0x0007000000023277-50.dat upx behavioral2/memory/5020-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023278-59.dat upx behavioral2/memory/2628-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1012-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023279-63.dat upx behavioral2/files/0x000700000002327a-68.dat upx behavioral2/files/0x000700000002327b-73.dat upx behavioral2/files/0x000700000002327c-78.dat upx behavioral2/memory/1544-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1824-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002327d-84.dat upx behavioral2/files/0x000700000002327e-90.dat upx behavioral2/memory/2764-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4752-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002327f-96.dat upx behavioral2/files/0x0007000000023280-102.dat upx behavioral2/memory/2884-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3600-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023281-110.dat upx behavioral2/files/0x0007000000023282-113.dat upx behavioral2/files/0x0007000000023284-119.dat upx behavioral2/memory/3592-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4472-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023285-128.dat upx behavioral2/files/0x0007000000023286-131.dat upx behavioral2/memory/4388-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1020-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023287-139.dat upx behavioral2/memory/3980-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023288-144.dat upx behavioral2/files/0x0007000000023289-149.dat upx behavioral2/memory/2536-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002328a-155.dat upx behavioral2/memory/4092-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002328b-161.dat upx behavioral2/files/0x000700000002328c-166.dat upx behavioral2/files/0x000700000002328d-171.dat upx behavioral2/files/0x000700000002328e-176.dat upx behavioral2/memory/3684-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4300-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002328f-183.dat upx behavioral2/memory/1308-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2880-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5068-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1048-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/116-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1284-221-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1308 wrote to memory of 2148 1308 29d9502951929b2e1f1d89938e61f7ccf06e11d5d500a244b73065b7f10b6943.exe 91 PID 1308 wrote to memory of 2148 1308 29d9502951929b2e1f1d89938e61f7ccf06e11d5d500a244b73065b7f10b6943.exe 91 PID 1308 wrote to memory of 2148 1308 29d9502951929b2e1f1d89938e61f7ccf06e11d5d500a244b73065b7f10b6943.exe 91 PID 2148 wrote to memory of 4204 2148 23k324.exe 92 PID 2148 wrote to memory of 4204 2148 23k324.exe 92 PID 2148 wrote to memory of 4204 2148 23k324.exe 92 PID 4204 wrote to memory of 2240 4204 og5wqc.exe 93 PID 4204 wrote to memory of 2240 4204 og5wqc.exe 93 PID 4204 wrote to memory of 2240 4204 og5wqc.exe 93 PID 2240 wrote to memory of 3460 2240 2664ani.exe 94 PID 2240 wrote to memory of 3460 2240 2664ani.exe 94 PID 2240 wrote to memory of 3460 2240 2664ani.exe 94 PID 3460 wrote to memory of 4232 3460 i5f39k.exe 95 PID 3460 wrote to memory of 4232 3460 i5f39k.exe 95 PID 3460 wrote to memory of 4232 3460 i5f39k.exe 95 PID 4232 wrote to memory of 1464 4232 4k9h1.exe 96 PID 4232 wrote to memory of 1464 4232 4k9h1.exe 96 PID 4232 wrote to memory of 1464 4232 4k9h1.exe 96 PID 1464 wrote to memory of 224 1464 4bo24.exe 97 PID 1464 wrote to memory of 224 1464 4bo24.exe 97 PID 1464 wrote to memory of 224 1464 4bo24.exe 97 PID 224 wrote to memory of 5020 224 cjr05p.exe 98 PID 224 wrote to memory of 5020 224 cjr05p.exe 98 PID 224 wrote to memory of 5020 224 cjr05p.exe 98 PID 5020 wrote to memory of 2628 5020 h048mki.exe 99 PID 5020 wrote to memory of 2628 5020 h048mki.exe 99 PID 5020 wrote to memory of 2628 5020 h048mki.exe 99 PID 2628 wrote to memory of 1012 2628 q294b9.exe 100 PID 2628 wrote to memory of 1012 2628 q294b9.exe 100 PID 2628 wrote to memory of 1012 2628 q294b9.exe 100 PID 1012 wrote to memory of 516 1012 3l17g1.exe 101 PID 1012 wrote to memory of 516 1012 3l17g1.exe 101 PID 1012 wrote to memory of 516 1012 3l17g1.exe 101 PID 516 wrote to memory of 796 516 n82fc1r.exe 102 PID 516 wrote to memory of 796 516 n82fc1r.exe 102 PID 516 wrote to memory of 796 516 n82fc1r.exe 102 PID 796 wrote to memory of 1544 796 47md6n.exe 103 PID 796 wrote to memory of 1544 796 47md6n.exe 103 PID 796 wrote to memory of 1544 796 47md6n.exe 103 PID 1544 wrote to memory of 1824 1544 emrcc8.exe 104 PID 1544 wrote to memory of 1824 1544 emrcc8.exe 104 PID 1544 wrote to memory of 1824 1544 emrcc8.exe 104 PID 1824 wrote to memory of 2764 1824 q1u5u.exe 105 PID 1824 wrote to memory of 2764 1824 q1u5u.exe 105 PID 1824 wrote to memory of 2764 1824 q1u5u.exe 105 PID 2764 wrote to memory of 4752 2764 2k631.exe 106 PID 2764 wrote to memory of 4752 2764 2k631.exe 106 PID 2764 wrote to memory of 4752 2764 2k631.exe 106 PID 4752 wrote to memory of 3600 4752 wa77a3.exe 107 PID 4752 wrote to memory of 3600 4752 wa77a3.exe 107 PID 4752 wrote to memory of 3600 4752 wa77a3.exe 107 PID 3600 wrote to memory of 2884 3600 e23jq26.exe 108 PID 3600 wrote to memory of 2884 3600 e23jq26.exe 108 PID 3600 wrote to memory of 2884 3600 e23jq26.exe 108 PID 2884 wrote to memory of 3168 2884 m3h3bk.exe 109 PID 2884 wrote to memory of 3168 2884 m3h3bk.exe 109 PID 2884 wrote to memory of 3168 2884 m3h3bk.exe 109 PID 3168 wrote to memory of 3592 3168 d8a9qlw.exe 110 PID 3168 wrote to memory of 3592 3168 d8a9qlw.exe 110 PID 3168 wrote to memory of 3592 3168 d8a9qlw.exe 110 PID 3592 wrote to memory of 4472 3592 0v2974.exe 111 PID 3592 wrote to memory of 4472 3592 0v2974.exe 111 PID 3592 wrote to memory of 4472 3592 0v2974.exe 111 PID 4472 wrote to memory of 1020 4472 u52v5n.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\29d9502951929b2e1f1d89938e61f7ccf06e11d5d500a244b73065b7f10b6943.exe"C:\Users\Admin\AppData\Local\Temp\29d9502951929b2e1f1d89938e61f7ccf06e11d5d500a244b73065b7f10b6943.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\23k324.exec:\23k324.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\og5wqc.exec:\og5wqc.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\2664ani.exec:\2664ani.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\i5f39k.exec:\i5f39k.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\4k9h1.exec:\4k9h1.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\4bo24.exec:\4bo24.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\cjr05p.exec:\cjr05p.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\h048mki.exec:\h048mki.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\q294b9.exec:\q294b9.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\3l17g1.exec:\3l17g1.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\n82fc1r.exec:\n82fc1r.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\47md6n.exec:\47md6n.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\emrcc8.exec:\emrcc8.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\q1u5u.exec:\q1u5u.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\2k631.exec:\2k631.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\wa77a3.exec:\wa77a3.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\e23jq26.exec:\e23jq26.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\m3h3bk.exec:\m3h3bk.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\d8a9qlw.exec:\d8a9qlw.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\0v2974.exec:\0v2974.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\u52v5n.exec:\u52v5n.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\e050wms.exec:\e050wms.exe23⤵
- Executes dropped EXE
PID:1020 -
\??\c:\3s93s.exec:\3s93s.exe24⤵
- Executes dropped EXE
PID:4388 -
\??\c:\apjw03.exec:\apjw03.exe25⤵
- Executes dropped EXE
PID:3980 -
\??\c:\on06r9.exec:\on06r9.exe26⤵
- Executes dropped EXE
PID:2536 -
\??\c:\f1a9wc2.exec:\f1a9wc2.exe27⤵
- Executes dropped EXE
PID:4092 -
\??\c:\e045i.exec:\e045i.exe28⤵
- Executes dropped EXE
PID:4564 -
\??\c:\133d66.exec:\133d66.exe29⤵
- Executes dropped EXE
PID:3968 -
\??\c:\6xu54.exec:\6xu54.exe30⤵
- Executes dropped EXE
PID:4060 -
\??\c:\q75w0.exec:\q75w0.exe31⤵
- Executes dropped EXE
PID:3684 -
\??\c:\47c3ch.exec:\47c3ch.exe32⤵
- Executes dropped EXE
PID:4300 -
\??\c:\jbb2e.exec:\jbb2e.exe33⤵
- Executes dropped EXE
PID:1900 -
\??\c:\tk4l93v.exec:\tk4l93v.exe34⤵
- Executes dropped EXE
PID:2344 -
\??\c:\512e7.exec:\512e7.exe35⤵
- Executes dropped EXE
PID:1308 -
\??\c:\471553.exec:\471553.exe36⤵
- Executes dropped EXE
PID:2776 -
\??\c:\o3vj58.exec:\o3vj58.exe37⤵
- Executes dropped EXE
PID:2880 -
\??\c:\8i62a.exec:\8i62a.exe38⤵
- Executes dropped EXE
PID:5040 -
\??\c:\7v5d5.exec:\7v5d5.exe39⤵
- Executes dropped EXE
PID:5068 -
\??\c:\q6n76.exec:\q6n76.exe40⤵
- Executes dropped EXE
PID:3460 -
\??\c:\7vpkc54.exec:\7vpkc54.exe41⤵
- Executes dropped EXE
PID:1048 -
\??\c:\ps52e.exec:\ps52e.exe42⤵
- Executes dropped EXE
PID:116 -
\??\c:\h0okht7.exec:\h0okht7.exe43⤵
- Executes dropped EXE
PID:1284 -
\??\c:\6ijrm3.exec:\6ijrm3.exe44⤵
- Executes dropped EXE
PID:228 -
\??\c:\3de6355.exec:\3de6355.exe45⤵
- Executes dropped EXE
PID:3776 -
\??\c:\97745.exec:\97745.exe46⤵
- Executes dropped EXE
PID:5064 -
\??\c:\92699x.exec:\92699x.exe47⤵
- Executes dropped EXE
PID:912 -
\??\c:\k5m21b.exec:\k5m21b.exe48⤵
- Executes dropped EXE
PID:1504 -
\??\c:\xixcp71.exec:\xixcp71.exe49⤵
- Executes dropped EXE
PID:1364 -
\??\c:\4p8q3.exec:\4p8q3.exe50⤵
- Executes dropped EXE
PID:4640 -
\??\c:\861bn2.exec:\861bn2.exe51⤵
- Executes dropped EXE
PID:796 -
\??\c:\na94p3.exec:\na94p3.exe52⤵
- Executes dropped EXE
PID:2316 -
\??\c:\aoo0aj.exec:\aoo0aj.exe53⤵
- Executes dropped EXE
PID:936 -
\??\c:\lc83r1.exec:\lc83r1.exe54⤵
- Executes dropped EXE
PID:4700 -
\??\c:\htbi72m.exec:\htbi72m.exe55⤵
- Executes dropped EXE
PID:1456 -
\??\c:\ncc920w.exec:\ncc920w.exe56⤵
- Executes dropped EXE
PID:3100 -
\??\c:\87n3gs.exec:\87n3gs.exe57⤵
- Executes dropped EXE
PID:4348 -
\??\c:\81wp5.exec:\81wp5.exe58⤵
- Executes dropped EXE
PID:1112 -
\??\c:\594ljwr.exec:\594ljwr.exe59⤵
- Executes dropped EXE
PID:4728 -
\??\c:\6lr77m.exec:\6lr77m.exe60⤵
- Executes dropped EXE
PID:3872 -
\??\c:\jpgeu4.exec:\jpgeu4.exe61⤵
- Executes dropped EXE
PID:4824 -
\??\c:\90gpw6.exec:\90gpw6.exe62⤵
- Executes dropped EXE
PID:4216 -
\??\c:\htn64.exec:\htn64.exe63⤵
- Executes dropped EXE
PID:2208 -
\??\c:\0hf58pw.exec:\0hf58pw.exe64⤵
- Executes dropped EXE
PID:3432 -
\??\c:\wrijd8.exec:\wrijd8.exe65⤵
- Executes dropped EXE
PID:2724 -
\??\c:\sq86w.exec:\sq86w.exe66⤵PID:3980
-
\??\c:\ne229s.exec:\ne229s.exe67⤵PID:3120
-
\??\c:\59qbbu.exec:\59qbbu.exe68⤵PID:4540
-
\??\c:\asa2p.exec:\asa2p.exe69⤵PID:4092
-
\??\c:\u1422.exec:\u1422.exe70⤵PID:4564
-
\??\c:\dx55137.exec:\dx55137.exe71⤵PID:3532
-
\??\c:\ld4q27v.exec:\ld4q27v.exe72⤵PID:4716
-
\??\c:\046vbn7.exec:\046vbn7.exe73⤵PID:1184
-
\??\c:\fc3lf.exec:\fc3lf.exe74⤵PID:4448
-
\??\c:\4da9v10.exec:\4da9v10.exe75⤵PID:5028
-
\??\c:\i349vp1.exec:\i349vp1.exe76⤵PID:1752
-
\??\c:\26p4mg3.exec:\26p4mg3.exe77⤵PID:3468
-
\??\c:\15c8l8g.exec:\15c8l8g.exe78⤵PID:4400
-
\??\c:\eh64l.exec:\eh64l.exe79⤵PID:2336
-
\??\c:\tx0158.exec:\tx0158.exe80⤵PID:2412
-
\??\c:\v28sd4.exec:\v28sd4.exe81⤵PID:3352
-
\??\c:\5u53393.exec:\5u53393.exe82⤵PID:4484
-
\??\c:\xw3qt.exec:\xw3qt.exe83⤵PID:1900
-
\??\c:\5u5x6u.exec:\5u5x6u.exe84⤵PID:1496
-
\??\c:\isp1pb.exec:\isp1pb.exe85⤵PID:3092
-
\??\c:\57ajq6c.exec:\57ajq6c.exe86⤵PID:852
-
\??\c:\ox702.exec:\ox702.exe87⤵PID:4984
-
\??\c:\2w5aa1w.exec:\2w5aa1w.exe88⤵PID:3972
-
\??\c:\953171e.exec:\953171e.exe89⤵PID:3776
-
\??\c:\6ll9t.exec:\6ll9t.exe90⤵PID:5064
-
\??\c:\mjfmquf.exec:\mjfmquf.exe91⤵PID:624
-
\??\c:\b71u4g.exec:\b71u4g.exe92⤵PID:1504
-
\??\c:\p8uv2.exec:\p8uv2.exe93⤵PID:1556
-
\??\c:\9x9vq8.exec:\9x9vq8.exe94⤵PID:1040
-
\??\c:\m9k97.exec:\m9k97.exe95⤵PID:3496
-
\??\c:\26812v.exec:\26812v.exe96⤵PID:5012
-
\??\c:\aspe525.exec:\aspe525.exe97⤵PID:1772
-
\??\c:\123lo9l.exec:\123lo9l.exe98⤵PID:936
-
\??\c:\fdpkic.exec:\fdpkic.exe99⤵PID:4752
-
\??\c:\k4l3c5q.exec:\k4l3c5q.exe100⤵PID:4968
-
\??\c:\49379.exec:\49379.exe101⤵PID:904
-
\??\c:\o79oeo.exec:\o79oeo.exe102⤵PID:4348
-
\??\c:\0ggk22v.exec:\0ggk22v.exe103⤵PID:3584
-
\??\c:\w47aen.exec:\w47aen.exe104⤵PID:3792
-
\??\c:\n35qb.exec:\n35qb.exe105⤵PID:4460
-
\??\c:\10r9597.exec:\10r9597.exe106⤵PID:4824
-
\??\c:\72am1w9.exec:\72am1w9.exe107⤵PID:4392
-
\??\c:\323h7.exec:\323h7.exe108⤵PID:2208
-
\??\c:\mm8qk.exec:\mm8qk.exe109⤵PID:3432
-
\??\c:\5c6oo.exec:\5c6oo.exe110⤵PID:4056
-
\??\c:\m03tk0.exec:\m03tk0.exe111⤵PID:5100
-
\??\c:\bx8cn81.exec:\bx8cn81.exe112⤵PID:4372
-
\??\c:\4tl5t21.exec:\4tl5t21.exe113⤵PID:3464
-
\??\c:\k872n.exec:\k872n.exe114⤵PID:1988
-
\??\c:\xlwwcg1.exec:\xlwwcg1.exe115⤵PID:2108
-
\??\c:\3vd67h.exec:\3vd67h.exe116⤵PID:4780
-
\??\c:\mfcx3.exec:\mfcx3.exe117⤵PID:1184
-
\??\c:\q3mww9w.exec:\q3mww9w.exe118⤵PID:4016
-
\??\c:\6mmwb.exec:\6mmwb.exe119⤵PID:2344
-
\??\c:\qk59fo1.exec:\qk59fo1.exe120⤵PID:2756
-
\??\c:\w00017.exec:\w00017.exe121⤵PID:4400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-