Analysis
- max time kernel
154s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
06/06/2024, 19:53
Behavioral task
behavioral1
Sample
1e51aa6f194be272a9f139c6b71d2553a8a6db5cf4551a532af85344ae9ed936.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
- Target 1e51aa6f194be272a9f139c6b71d2553a8a6db5cf4551a532af85344ae9ed936.exe
- Size 141KB
- Sample240606-ymazcacc22
- SHA256 1e51aa6f194be272a9f139c6b71d2553a8a6db5cf4551a532af85344ae9ed936
- MD5 2d9be0ec57baebad3d679788cfca3450
- SHA1 ad060fc22eba62cba6896a5423962d2151cc6ce1
- SHA512 4fed878cb29dbd5e1bb848d06e8204a538194cd0c238b348f9b08f9830ce706834b5fbd29df1261e25b00936dbc9844c1423f5dd165e9190d5c08d39c31f7ec7
- SSDEEP 3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLX:ccm4FmowdHoSi9Eg
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3540-6-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3968-12-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/984-18-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2260-48-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3800-54-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3944-59-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1052-77-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1052-82-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3748-88-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3588-119-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3100-190-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2752-194-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3396-182-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/388-201-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1588-204-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2892-215-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2424-224-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2020-231-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1200-239-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/376-235-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4476-206-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3828-248-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2200-255-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3092-259-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2152-273-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/680-276-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4720-286-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/896-290-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2944-300-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1928-310-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1756-266-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5028-181-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5104-173-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/404-158-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2720-151-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2312-126-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4992-113-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1196-107-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1644-101-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3092-94-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3828-75-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3060-43-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2896-37-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3516-30-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/536-24-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4016-323-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2128-333-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3100-337-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3548-341-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1560-403-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3452-422-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/680-426-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4212-442-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3984-449-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4320-459-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4004-506-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3732-512-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3588-567-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4356-641-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3704-703-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4392-791-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2128-852-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2688-886-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4396-963-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/3540-0-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0008000000023258-3.dat UPX behavioral2/memory/3540-6-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000800000002325c-13.dat UPX behavioral2/memory/3968-12-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/984-18-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/3516-25-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/2896-32-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0008000000023260-31.dat UPX behavioral2/memory/3060-39-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023261-38.dat UPX behavioral2/files/0x0007000000023262-44.dat UPX behavioral2/memory/2260-48-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023263-49.dat UPX behavioral2/files/0x0007000000023264-55.dat UPX behavioral2/memory/3800-54-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023265-60.dat UPX behavioral2/files/0x0007000000023266-63.dat UPX behavioral2/memory/3944-59-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023268-68.dat UPX behavioral2/files/0x0007000000023269-76.dat UPX behavioral2/memory/1052-77-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002326a-83.dat UPX behavioral2/memory/1052-82-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002326b-89.dat UPX behavioral2/memory/3748-88-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/1644-96-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002326c-95.dat UPX behavioral2/files/0x000700000002326d-102.dat UPX behavioral2/files/0x000700000002326e-108.dat UPX behavioral2/files/0x000700000002326f-114.dat UPX behavioral2/files/0x0007000000023270-120.dat UPX behavioral2/memory/3588-119-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x0007000000023271-123.dat UPX behavioral2/files/0x0007000000023272-131.dat UPX behavioral2/files/0x0007000000023273-136.dat UPX behavioral2/files/0x0007000000023274-139.dat UPX behavioral2/files/0x0007000000023276-146.dat UPX behavioral2/files/0x0007000000023277-152.dat UPX behavioral2/files/0x0007000000023279-161.dat UPX behavioral2/files/0x000700000002327b-174.dat UPX behavioral2/files/0x000700000002327d-184.dat UPX behavioral2/memory/3100-190-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/2752-194-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/3396-182-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/388-201-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/1588-204-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/2892-215-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/2424-224-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/2020-231-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/1200-239-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/376-235-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4476-206-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/3828-248-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/files/0x000700000002327c-178.dat UPX behavioral2/memory/2200-255-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/3092-259-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/2152-273-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/680-276-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/4720-286-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/896-290-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/2944-300-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/1928-310-0x0000000000400000-0x0000000000436000-memory.dmp UPX behavioral2/memory/1756-266-0x0000000000400000-0x0000000000436000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 3968 arq7d64.exe 984 641581.exe 536 2l4xf7.exe 3516 bf4216d.exe 2896 9drb780.exe 3060 21lg03.exe 2260 78t24.exe 3800 6ajj4e.exe 3944 6460842.exe 2516 vn3wamu.exe 696 2xd63f.exe 3828 5lu986.exe 1052 73ehq0.exe 3748 i9gv35.exe 3092 eic11i.exe 1644 579gdko.exe 1196 9i0c89r.exe 4992 a406835.exe 3588 88972.exe 2312 3g9s59g.exe 3348 81v6cu.exe 3768 o95pp2m.exe 3392 4jb9l.exe 4808 klu4a.exe 2720 8ahlp6.exe 404 r5893l3.exe 3744 85432.exe 4716 8tvq3.exe 5104 2oejn.exe 5028 tsk1780.exe 3396 b7s8g.exe 3100 016oi6e.exe 2752 v0945.exe 4644 i72301.exe 388 9fj1kr8.exe 1588 658hi.exe 4476 38vni5.exe 1848 v13962.exe 2892 mxfrh75.exe 2248 dd9a82.exe 4280 e3w6w.exe 2424 75qq4n8.exe 852 p2lasaw.exe 2020 237fipm.exe 376 87969hu.exe 1200 7p0l6e6.exe 696 s2l91.exe 3812 l66t1p1.exe 3828 8vb4ni.exe 1560 6512oh6.exe 2200 f2028k.exe 3092 5j7ex.exe 4392 4p3h2.exe 1756 9q6s0e6.exe 5064 9uf6c94.exe 2152 33c3mx5.exe 680 weh2491.exe 1252 ra9he.exe 2640 n9ps5oh.exe 4720 w3nk3.exe 896 bo9v8.exe 2416 079q32.exe 3392 bqphfl.exe 2944 14di592.exe -
resource yara_rule behavioral2/memory/3540-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0008000000023258-3.dat upx behavioral2/memory/3540-6-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000800000002325c-13.dat upx behavioral2/memory/3968-12-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/984-18-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3516-25-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2896-32-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0008000000023260-31.dat upx behavioral2/memory/3060-39-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023261-38.dat upx behavioral2/files/0x0007000000023262-44.dat upx behavioral2/memory/2260-48-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023263-49.dat upx behavioral2/files/0x0007000000023264-55.dat upx behavioral2/memory/3800-54-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023265-60.dat upx behavioral2/files/0x0007000000023266-63.dat upx behavioral2/memory/3944-59-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023268-68.dat upx behavioral2/files/0x0007000000023269-76.dat upx behavioral2/memory/1052-77-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002326a-83.dat upx behavioral2/memory/1052-82-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002326b-89.dat upx behavioral2/memory/3748-88-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1644-96-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002326c-95.dat upx behavioral2/files/0x000700000002326d-102.dat upx behavioral2/files/0x000700000002326e-108.dat upx behavioral2/files/0x000700000002326f-114.dat upx behavioral2/files/0x0007000000023270-120.dat upx behavioral2/memory/3588-119-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023271-123.dat upx behavioral2/files/0x0007000000023272-131.dat upx behavioral2/files/0x0007000000023273-136.dat upx behavioral2/files/0x0007000000023274-139.dat upx behavioral2/files/0x0007000000023276-146.dat upx behavioral2/files/0x0007000000023277-152.dat upx behavioral2/files/0x0007000000023279-161.dat upx behavioral2/files/0x000700000002327b-174.dat upx behavioral2/files/0x000700000002327d-184.dat upx behavioral2/memory/3100-190-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2752-194-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3396-182-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/388-201-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1588-204-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2892-215-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2424-224-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2020-231-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1200-239-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/376-235-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4476-206-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3828-248-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002327c-178.dat upx behavioral2/memory/2200-255-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3092-259-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2152-273-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/680-276-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4720-286-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/896-290-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2944-300-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1928-310-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1756-266-0x0000000000400000-0x0000000000436000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3540 wrote to memory of 3968 3540 1e51aa6f194be272a9f139c6b71d2553a8a6db5cf4551a532af85344ae9ed936.exe 91 PID 3540 wrote to memory of 3968 3540 1e51aa6f194be272a9f139c6b71d2553a8a6db5cf4551a532af85344ae9ed936.exe 91 PID 3540 wrote to memory of 3968 3540 1e51aa6f194be272a9f139c6b71d2553a8a6db5cf4551a532af85344ae9ed936.exe 91 PID 3968 wrote to memory of 984 3968 arq7d64.exe 92 PID 3968 wrote to memory of 984 3968 arq7d64.exe 92 PID 3968 wrote to memory of 984 3968 arq7d64.exe 92 PID 984 wrote to memory of 536 984 641581.exe 93 PID 984 wrote to memory of 536 984 641581.exe 93 PID 984 wrote to memory of 536 984 641581.exe 93 PID 536 wrote to memory of 3516 536 2l4xf7.exe 94 PID 536 wrote to memory of 3516 536 2l4xf7.exe 94 PID 536 wrote to memory of 3516 536 2l4xf7.exe 94 PID 3516 wrote to memory of 2896 3516 bf4216d.exe 95 PID 3516 wrote to memory of 2896 3516 bf4216d.exe 95 PID 3516 wrote to memory of 2896 3516 bf4216d.exe 95 PID 2896 wrote to memory of 3060 2896 9drb780.exe 96 PID 2896 wrote to memory of 3060 2896 9drb780.exe 96 PID 2896 wrote to memory of 3060 2896 9drb780.exe 96 PID 3060 wrote to memory of 2260 3060 21lg03.exe 97 PID 3060 wrote to memory of 2260 3060 21lg03.exe 97 PID 3060 wrote to memory of 2260 3060 21lg03.exe 97 PID 2260 wrote to memory of 3800 2260 78t24.exe 98 PID 2260 wrote to memory of 3800 2260 78t24.exe 98 PID 2260 wrote to memory of 3800 2260 78t24.exe 98 PID 3800 wrote to memory of 3944 3800 6ajj4e.exe 99 PID 3800 wrote to memory of 3944 3800 6ajj4e.exe 99 PID 3800 wrote to memory of 3944 3800 6ajj4e.exe 99 PID 3944 wrote to memory of 2516 3944 6460842.exe 100 PID 3944 wrote to memory of 2516 3944 6460842.exe 100 PID 3944 wrote to memory of 2516 3944 6460842.exe 100 PID 2516 wrote to memory of 696 2516 vn3wamu.exe 137 PID 2516 wrote to memory of 696 2516 vn3wamu.exe 137 PID 2516 wrote to memory of 696 2516 vn3wamu.exe 137 PID 696 wrote to memory of 3828 696 2xd63f.exe 102 PID 696 wrote to memory of 3828 696 2xd63f.exe 102 PID 696 wrote to memory of 3828 696 2xd63f.exe 102 PID 3828 wrote to memory of 1052 3828 5lu986.exe 103 PID 3828 wrote to memory of 1052 3828 5lu986.exe 103 PID 3828 wrote to memory of 1052 3828 5lu986.exe 103 PID 1052 wrote to memory of 3748 1052 73ehq0.exe 104 PID 1052 wrote to memory of 3748 1052 73ehq0.exe 104 PID 1052 wrote to memory of 3748 1052 73ehq0.exe 104 PID 3748 wrote to memory of 3092 3748 i9gv35.exe 105 PID 3748 wrote to memory of 3092 3748 i9gv35.exe 105 PID 3748 wrote to memory of 3092 3748 i9gv35.exe 105 PID 3092 wrote to memory of 1644 3092 eic11i.exe 106 PID 3092 wrote to memory of 1644 3092 eic11i.exe 106 PID 3092 wrote to memory of 1644 3092 eic11i.exe 106 PID 1644 wrote to memory of 1196 1644 579gdko.exe 107 PID 1644 wrote to memory of 1196 1644 579gdko.exe 107 PID 1644 wrote to memory of 1196 1644 579gdko.exe 107 PID 1196 wrote to memory of 4992 1196 9i0c89r.exe 108 PID 1196 wrote to memory of 4992 1196 9i0c89r.exe 108 PID 1196 wrote to memory of 4992 1196 9i0c89r.exe 108 PID 4992 wrote to memory of 3588 4992 a406835.exe 109 PID 4992 wrote to memory of 3588 4992 a406835.exe 109 PID 4992 wrote to memory of 3588 4992 a406835.exe 109 PID 3588 wrote to memory of 2312 3588 88972.exe 110 PID 3588 wrote to memory of 2312 3588 88972.exe 110 PID 3588 wrote to memory of 2312 3588 88972.exe 110 PID 2312 wrote to memory of 3348 2312 3g9s59g.exe 111 PID 2312 wrote to memory of 3348 2312 3g9s59g.exe 111 PID 2312 wrote to memory of 3348 2312 3g9s59g.exe 111 PID 3348 wrote to memory of 3768 3348 81v6cu.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e51aa6f194be272a9f139c6b71d2553a8a6db5cf4551a532af85344ae9ed936.exe"C:\Users\Admin\AppData\Local\Temp\1e51aa6f194be272a9f139c6b71d2553a8a6db5cf4551a532af85344ae9ed936.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\arq7d64.exec:\arq7d64.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\641581.exec:\641581.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\2l4xf7.exec:\2l4xf7.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\bf4216d.exec:\bf4216d.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\9drb780.exec:\9drb780.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\21lg03.exec:\21lg03.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\78t24.exec:\78t24.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\6ajj4e.exec:\6ajj4e.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\6460842.exec:\6460842.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\vn3wamu.exec:\vn3wamu.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\2xd63f.exec:\2xd63f.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\5lu986.exec:\5lu986.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\73ehq0.exec:\73ehq0.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\i9gv35.exec:\i9gv35.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\eic11i.exec:\eic11i.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\579gdko.exec:\579gdko.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\9i0c89r.exec:\9i0c89r.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\a406835.exec:\a406835.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\88972.exec:\88972.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\3g9s59g.exec:\3g9s59g.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\81v6cu.exec:\81v6cu.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\o95pp2m.exec:\o95pp2m.exe23⤵
- Executes dropped EXE
PID:3768 -
\??\c:\4jb9l.exec:\4jb9l.exe24⤵
- Executes dropped EXE
PID:3392 -
\??\c:\klu4a.exec:\klu4a.exe25⤵
- Executes dropped EXE
PID:4808 -
\??\c:\8ahlp6.exec:\8ahlp6.exe26⤵
- Executes dropped EXE
PID:2720 -
\??\c:\r5893l3.exec:\r5893l3.exe27⤵
- Executes dropped EXE
PID:404 -
\??\c:\85432.exec:\85432.exe28⤵
- Executes dropped EXE
PID:3744 -
\??\c:\8tvq3.exec:\8tvq3.exe29⤵
- Executes dropped EXE
PID:4716 -
\??\c:\2oejn.exec:\2oejn.exe30⤵
- Executes dropped EXE
PID:5104 -
\??\c:\tsk1780.exec:\tsk1780.exe31⤵
- Executes dropped EXE
PID:5028 -
\??\c:\b7s8g.exec:\b7s8g.exe32⤵
- Executes dropped EXE
PID:3396 -
\??\c:\016oi6e.exec:\016oi6e.exe33⤵
- Executes dropped EXE
PID:3100 -
\??\c:\v0945.exec:\v0945.exe34⤵
- Executes dropped EXE
PID:2752 -
\??\c:\i72301.exec:\i72301.exe35⤵
- Executes dropped EXE
PID:4644 -
\??\c:\9fj1kr8.exec:\9fj1kr8.exe36⤵
- Executes dropped EXE
PID:388 -
\??\c:\658hi.exec:\658hi.exe37⤵
- Executes dropped EXE
PID:1588 -
\??\c:\38vni5.exec:\38vni5.exe38⤵
- Executes dropped EXE
PID:4476 -
\??\c:\v13962.exec:\v13962.exe39⤵
- Executes dropped EXE
PID:1848 -
\??\c:\mxfrh75.exec:\mxfrh75.exe40⤵
- Executes dropped EXE
PID:2892 -
\??\c:\dd9a82.exec:\dd9a82.exe41⤵
- Executes dropped EXE
PID:2248 -
\??\c:\e3w6w.exec:\e3w6w.exe42⤵
- Executes dropped EXE
PID:4280 -
\??\c:\75qq4n8.exec:\75qq4n8.exe43⤵
- Executes dropped EXE
PID:2424 -
\??\c:\p2lasaw.exec:\p2lasaw.exe44⤵
- Executes dropped EXE
PID:852 -
\??\c:\237fipm.exec:\237fipm.exe45⤵
- Executes dropped EXE
PID:2020 -
\??\c:\87969hu.exec:\87969hu.exe46⤵
- Executes dropped EXE
PID:376 -
\??\c:\7p0l6e6.exec:\7p0l6e6.exe47⤵
- Executes dropped EXE
PID:1200 -
\??\c:\s2l91.exec:\s2l91.exe48⤵
- Executes dropped EXE
PID:696 -
\??\c:\l66t1p1.exec:\l66t1p1.exe49⤵
- Executes dropped EXE
PID:3812 -
\??\c:\8vb4ni.exec:\8vb4ni.exe50⤵
- Executes dropped EXE
PID:3828 -
\??\c:\6512oh6.exec:\6512oh6.exe51⤵
- Executes dropped EXE
PID:1560 -
\??\c:\f2028k.exec:\f2028k.exe52⤵
- Executes dropped EXE
PID:2200 -
\??\c:\5j7ex.exec:\5j7ex.exe53⤵
- Executes dropped EXE
PID:3092 -
\??\c:\4p3h2.exec:\4p3h2.exe54⤵
- Executes dropped EXE
PID:4392 -
\??\c:\9q6s0e6.exec:\9q6s0e6.exe55⤵
- Executes dropped EXE
PID:1756 -
\??\c:\9uf6c94.exec:\9uf6c94.exe56⤵
- Executes dropped EXE
PID:5064 -
\??\c:\33c3mx5.exec:\33c3mx5.exe57⤵
- Executes dropped EXE
PID:2152 -
\??\c:\weh2491.exec:\weh2491.exe58⤵
- Executes dropped EXE
PID:680 -
\??\c:\ra9he.exec:\ra9he.exe59⤵
- Executes dropped EXE
PID:1252 -
\??\c:\n9ps5oh.exec:\n9ps5oh.exe60⤵
- Executes dropped EXE
PID:2640 -
\??\c:\w3nk3.exec:\w3nk3.exe61⤵
- Executes dropped EXE
PID:4720 -
\??\c:\bo9v8.exec:\bo9v8.exe62⤵
- Executes dropped EXE
PID:896 -
\??\c:\079q32.exec:\079q32.exe63⤵
- Executes dropped EXE
PID:2416 -
\??\c:\bqphfl.exec:\bqphfl.exe64⤵
- Executes dropped EXE
PID:3392 -
\??\c:\14di592.exec:\14di592.exe65⤵
- Executes dropped EXE
PID:2944 -
\??\c:\qeww9t1.exec:\qeww9t1.exe66⤵PID:2868
-
\??\c:\324494.exec:\324494.exe67⤵PID:2720
-
\??\c:\esn188a.exec:\esn188a.exe68⤵PID:1928
-
\??\c:\8fd5mls.exec:\8fd5mls.exe69⤵PID:3728
-
\??\c:\b77xc.exec:\b77xc.exe70⤵PID:3808
-
\??\c:\lls1qw.exec:\lls1qw.exe71⤵PID:4216
-
\??\c:\311tt30.exec:\311tt30.exe72⤵PID:4016
-
\??\c:\a1o9e0.exec:\a1o9e0.exe73⤵PID:3268
-
\??\c:\0i3p3.exec:\0i3p3.exe74⤵PID:4548
-
\??\c:\s67dp6.exec:\s67dp6.exe75⤵PID:2128
-
\??\c:\23637vt.exec:\23637vt.exe76⤵PID:3100
-
\??\c:\p5uum9.exec:\p5uum9.exe77⤵PID:3548
-
\??\c:\c5sh4cu.exec:\c5sh4cu.exe78⤵PID:2440
-
\??\c:\0375o0.exec:\0375o0.exe79⤵PID:3336
-
\??\c:\u1g04.exec:\u1g04.exe80⤵PID:800
-
\??\c:\0ou0m9.exec:\0ou0m9.exe81⤵PID:1820
-
\??\c:\064g79h.exec:\064g79h.exe82⤵PID:4132
-
\??\c:\56f91.exec:\56f91.exe83⤵PID:2172
-
\??\c:\tjp91e.exec:\tjp91e.exe84⤵PID:8
-
\??\c:\30734k.exec:\30734k.exe85⤵PID:228
-
\??\c:\7uht1.exec:\7uht1.exe86⤵PID:4432
-
\??\c:\6w87ru.exec:\6w87ru.exe87⤵PID:4020
-
\??\c:\1q3i4.exec:\1q3i4.exe88⤵PID:4204
-
\??\c:\v4g511.exec:\v4g511.exe89⤵PID:4752
-
\??\c:\b2gbx.exec:\b2gbx.exe90⤵PID:5084
-
\??\c:\727dpm0.exec:\727dpm0.exe91⤵PID:528
-
\??\c:\21645p.exec:\21645p.exe92⤵PID:2384
-
\??\c:\fd8ir3u.exec:\fd8ir3u.exe93⤵PID:1132
-
\??\c:\u9155.exec:\u9155.exe94⤵PID:984
-
\??\c:\9404p3.exec:\9404p3.exe95⤵PID:1812
-
\??\c:\7pa2ffo.exec:\7pa2ffo.exe96⤵PID:2292
-
\??\c:\2wo01t.exec:\2wo01t.exe97⤵PID:1560
-
\??\c:\2vg95.exec:\2vg95.exe98⤵PID:3448
-
\??\c:\ahk43tc.exec:\ahk43tc.exe99⤵PID:4012
-
\??\c:\3peom.exec:\3peom.exe100⤵PID:2236
-
\??\c:\441k841.exec:\441k841.exe101⤵PID:4944
-
\??\c:\36o80o.exec:\36o80o.exe102⤵PID:4000
-
\??\c:\4932l9.exec:\4932l9.exe103⤵PID:3452
-
\??\c:\qu97m.exec:\qu97m.exe104⤵PID:680
-
\??\c:\6i27k6.exec:\6i27k6.exe105⤵PID:1128
-
\??\c:\9705r.exec:\9705r.exe106⤵PID:4580
-
\??\c:\b01ja.exec:\b01ja.exe107⤵PID:692
-
\??\c:\0ve7dq.exec:\0ve7dq.exe108⤵PID:4700
-
\??\c:\5i577.exec:\5i577.exe109⤵PID:4212
-
\??\c:\e52g3wk.exec:\e52g3wk.exe110⤵PID:3464
-
\??\c:\s547g.exec:\s547g.exe111⤵PID:3984
-
\??\c:\2t6rr9.exec:\2t6rr9.exe112⤵PID:5024
-
\??\c:\4rt34.exec:\4rt34.exe113⤵PID:3096
-
\??\c:\85qqeo.exec:\85qqeo.exe114⤵PID:4320
-
\??\c:\6193h.exec:\6193h.exe115⤵PID:3664
-
\??\c:\sg6pm.exec:\sg6pm.exe116⤵PID:4672
-
\??\c:\7pj73.exec:\7pj73.exe117⤵PID:3980
-
\??\c:\up3ocx.exec:\up3ocx.exe118⤵PID:4312
-
\??\c:\j6mmqr.exec:\j6mmqr.exe119⤵PID:5028
-
\??\c:\nvul03o.exec:\nvul03o.exe120⤵PID:4656
-
\??\c:\wa1757.exec:\wa1757.exe121⤵PID:1592
-
\??\c:\vs0hl70.exec:\vs0hl70.exe122⤵PID:1616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-