Analysis
- max time kernel
150s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
15/06/2024, 22:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6c2a88c268f2b9f378cb4e3b89aad1d47261ccd966c2aa4a7b1b1b0cb57bd598.exe
Resource
win7-20240611-en
6 signatures
150 seconds
General
- Target 6c2a88c268f2b9f378cb4e3b89aad1d47261ccd966c2aa4a7b1b1b0cb57bd598.exe
- Size 409KB
- Sample240615-2hmdcsxdjb
- SHA256 6c2a88c268f2b9f378cb4e3b89aad1d47261ccd966c2aa4a7b1b1b0cb57bd598
- MD5 84da8b02c7051b643b875fd32cb062ff
- SHA1 02efaab44701e6d43715b1e856e73abd5b66113f
- SHA512 2e7467b1cd5dd109830bf2e35654fb14ad70cf93c4dc572ed567fe12382b61e95302328d214b03d15723cfb69d948ec2be47f8e491a422187e5b03eaf4ac9b73
- SSDEEP 3072:PhOm2sI93UufdC67cihfmCiiiXAsACF486jJSp1Bwc2:Pcm7ImGddXtWrXD486jJq1Bwc2
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4764-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/320-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/872-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3180-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2784-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/928-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3104-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/932-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1376-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3796-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1392-279-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2748-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-326-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-333-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-343-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-351-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-360-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-367-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-380-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-399-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-439-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-446-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-478-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-603-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-646-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1844-705-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-709-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4648-836-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4188-971-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-1028-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-1033-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-1326-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-1342-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon - UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/4764-6-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4520-12-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2032-13-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2032-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4212-25-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4544-27-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4544-32-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1892-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1872-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/320-49-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4464-55-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/404-58-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/872-63-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4344-83-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3180-89-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4864-95-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3772-102-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4360-108-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2784-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/928-119-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3516-126-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3104-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3104-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4692-143-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4356-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4508-157-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2024-167-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2024-171-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/932-177-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3176-180-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3176-188-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4884-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4052-199-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4520-203-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4320-210-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1376-213-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4580-221-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1872-225-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4524-235-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2796-242-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2400-246-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4244-256-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3796-260-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2476-264-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1392-279-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2748-286-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3516-290-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2084-297-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2084-301-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2152-326-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4480-333-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2380-343-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1996-351-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4320-360-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4844-367-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2612-380-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3276-399-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2084-439-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3872-446-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4212-478-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3404-538-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3008-603-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3016-646-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4308-695-0x0000000000400000-0x0000000000429000-memory.dmp UPX - Executes dropped EXE 64 IoCs
pid Process 4520 31261re.exe 2032 45i65.exe 4212 4qnt9.exe 4544 ch3dd.exe 1892 0a54p.exe 1872 2th97m.exe 320 ew7of.exe 4464 eds92.exe 404 9jg6s1.exe 872 776bo.exe 4280 k7bk6a3.exe 5016 qu0pg53.exe 4344 jj90u9n.exe 3180 0n1g4kq.exe 4864 1rkaquo.exe 3772 90if7p5.exe 4360 oh9gs9.exe 2784 0j70a9.exe 928 h27lfjq.exe 3516 jm199.exe 3104 l9erj.exe 4120 o6kij0r.exe 4692 4ug5sg6.exe 4356 8g6tq3.exe 4508 7sge3.exe 3152 41c8ajs.exe 3944 6k1mgm.exe 2024 ndwu8a.exe 932 2j1aee.exe 3176 8uov04.exe 4316 d5ddk.exe 4884 1q73m9.exe 4052 tpq739.exe 4520 7c1a3.exe 3120 s9u71q7.exe 4320 ejw6i8.exe 1376 55thw.exe 5000 0o8v72o.exe 4580 6f89a2.exe 1872 3dwu725.exe 260 l0s14.exe 3828 398a44.exe 4524 hj17te0.exe 3616 wtu6n0.exe 2796 nv0c4.exe 2400 2wk55h6.exe 1676 uu33nk5.exe 1504 su07spe.exe 4244 j9kp9du.exe 3796 3k1k9.exe 2476 95211.exe 1244 66fm9qf.exe 2596 d7jo4.exe 4440 emup88.exe 4360 xg2mp.exe 1392 frp375u.exe 4604 fol6s.exe 2748 35902rc.exe 3516 m3s83.exe 832 ewiaq1.exe 3104 kl6s6x.exe 2084 0m796.exe 1272 t9w5rg.exe 1624 l5rlm.exe -
resource yara_rule behavioral2/memory/4764-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/320-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3180-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/928-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3104-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/932-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3796-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-279-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-297-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-326-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-333-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-343-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-351-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-360-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-367-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-380-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-399-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-439-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-446-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-478-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3404-538-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-590-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-603-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-646-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-695-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1844-705-0x0000000000400000-0x0000000000429000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4764 wrote to memory of 4520 4764 6c2a88c268f2b9f378cb4e3b89aad1d47261ccd966c2aa4a7b1b1b0cb57bd598.exe 91 PID 4764 wrote to memory of 4520 4764 6c2a88c268f2b9f378cb4e3b89aad1d47261ccd966c2aa4a7b1b1b0cb57bd598.exe 91 PID 4764 wrote to memory of 4520 4764 6c2a88c268f2b9f378cb4e3b89aad1d47261ccd966c2aa4a7b1b1b0cb57bd598.exe 91 PID 4520 wrote to memory of 2032 4520 31261re.exe 92 PID 4520 wrote to memory of 2032 4520 31261re.exe 92 PID 4520 wrote to memory of 2032 4520 31261re.exe 92 PID 2032 wrote to memory of 4212 2032 45i65.exe 93 PID 2032 wrote to memory of 4212 2032 45i65.exe 93 PID 2032 wrote to memory of 4212 2032 45i65.exe 93 PID 4212 wrote to memory of 4544 4212 4qnt9.exe 94 PID 4212 wrote to memory of 4544 4212 4qnt9.exe 94 PID 4212 wrote to memory of 4544 4212 4qnt9.exe 94 PID 4544 wrote to memory of 1892 4544 ch3dd.exe 95 PID 4544 wrote to memory of 1892 4544 ch3dd.exe 95 PID 4544 wrote to memory of 1892 4544 ch3dd.exe 95 PID 1892 wrote to memory of 1872 1892 0a54p.exe 96 PID 1892 wrote to memory of 1872 1892 0a54p.exe 96 PID 1892 wrote to memory of 1872 1892 0a54p.exe 96 PID 1872 wrote to memory of 320 1872 2th97m.exe 97 PID 1872 wrote to memory of 320 1872 2th97m.exe 97 PID 1872 wrote to memory of 320 1872 2th97m.exe 97 PID 320 wrote to memory of 4464 320 ew7of.exe 98 PID 320 wrote to memory of 4464 320 ew7of.exe 98 PID 320 wrote to memory of 4464 320 ew7of.exe 98 PID 4464 wrote to memory of 404 4464 eds92.exe 99 PID 4464 wrote to memory of 404 4464 eds92.exe 99 PID 4464 wrote to memory of 404 4464 eds92.exe 99 PID 404 wrote to memory of 872 404 9jg6s1.exe 100 PID 404 wrote to memory of 872 404 9jg6s1.exe 100 PID 404 wrote to memory of 872 404 9jg6s1.exe 100 PID 872 wrote to memory of 4280 872 776bo.exe 101 PID 872 wrote to memory of 4280 872 776bo.exe 101 PID 872 wrote to memory of 4280 872 776bo.exe 101 PID 4280 wrote to memory of 5016 4280 k7bk6a3.exe 102 PID 4280 wrote to memory of 5016 4280 k7bk6a3.exe 102 PID 4280 wrote to memory of 5016 4280 k7bk6a3.exe 102 PID 5016 wrote to memory of 4344 5016 qu0pg53.exe 103 PID 5016 wrote to memory of 4344 5016 qu0pg53.exe 103 PID 5016 wrote to memory of 4344 5016 qu0pg53.exe 103 PID 4344 wrote to memory of 3180 4344 jj90u9n.exe 104 PID 4344 wrote to memory of 3180 4344 jj90u9n.exe 104 PID 4344 wrote to memory of 3180 4344 jj90u9n.exe 104 PID 3180 wrote to memory of 4864 3180 0n1g4kq.exe 105 PID 3180 wrote to memory of 4864 3180 0n1g4kq.exe 105 PID 3180 wrote to memory of 4864 3180 0n1g4kq.exe 105 PID 4864 wrote to memory of 3772 4864 1rkaquo.exe 106 PID 4864 wrote to memory of 3772 4864 1rkaquo.exe 106 PID 4864 wrote to memory of 3772 4864 1rkaquo.exe 106 PID 3772 wrote to memory of 4360 3772 90if7p5.exe 107 PID 3772 wrote to memory of 4360 3772 90if7p5.exe 107 PID 3772 wrote to memory of 4360 3772 90if7p5.exe 107 PID 4360 wrote to memory of 2784 4360 oh9gs9.exe 108 PID 4360 wrote to memory of 2784 4360 oh9gs9.exe 108 PID 4360 wrote to memory of 2784 4360 oh9gs9.exe 108 PID 2784 wrote to memory of 928 2784 0j70a9.exe 109 PID 2784 wrote to memory of 928 2784 0j70a9.exe 109 PID 2784 wrote to memory of 928 2784 0j70a9.exe 109 PID 928 wrote to memory of 3516 928 h27lfjq.exe 110 PID 928 wrote to memory of 3516 928 h27lfjq.exe 110 PID 928 wrote to memory of 3516 928 h27lfjq.exe 110 PID 3516 wrote to memory of 3104 3516 jm199.exe 111 PID 3516 wrote to memory of 3104 3516 jm199.exe 111 PID 3516 wrote to memory of 3104 3516 jm199.exe 111 PID 3104 wrote to memory of 4120 3104 l9erj.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c2a88c268f2b9f378cb4e3b89aad1d47261ccd966c2aa4a7b1b1b0cb57bd598.exe"C:\Users\Admin\AppData\Local\Temp\6c2a88c268f2b9f378cb4e3b89aad1d47261ccd966c2aa4a7b1b1b0cb57bd598.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\31261re.exec:\31261re.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\45i65.exec:\45i65.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\4qnt9.exec:\4qnt9.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\ch3dd.exec:\ch3dd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\0a54p.exec:\0a54p.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\2th97m.exec:\2th97m.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\ew7of.exec:\ew7of.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\eds92.exec:\eds92.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\9jg6s1.exec:\9jg6s1.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\776bo.exec:\776bo.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\k7bk6a3.exec:\k7bk6a3.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\qu0pg53.exec:\qu0pg53.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\jj90u9n.exec:\jj90u9n.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\0n1g4kq.exec:\0n1g4kq.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\1rkaquo.exec:\1rkaquo.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\90if7p5.exec:\90if7p5.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\oh9gs9.exec:\oh9gs9.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\0j70a9.exec:\0j70a9.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\h27lfjq.exec:\h27lfjq.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\jm199.exec:\jm199.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\l9erj.exec:\l9erj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\o6kij0r.exec:\o6kij0r.exe23⤵
- Executes dropped EXE
PID:4120 -
\??\c:\4ug5sg6.exec:\4ug5sg6.exe24⤵
- Executes dropped EXE
PID:4692 -
\??\c:\8g6tq3.exec:\8g6tq3.exe25⤵
- Executes dropped EXE
PID:4356 -
\??\c:\7sge3.exec:\7sge3.exe26⤵
- Executes dropped EXE
PID:4508 -
\??\c:\41c8ajs.exec:\41c8ajs.exe27⤵
- Executes dropped EXE
PID:3152 -
\??\c:\6k1mgm.exec:\6k1mgm.exe28⤵
- Executes dropped EXE
PID:3944 -
\??\c:\ndwu8a.exec:\ndwu8a.exe29⤵
- Executes dropped EXE
PID:2024 -
\??\c:\2j1aee.exec:\2j1aee.exe30⤵
- Executes dropped EXE
PID:932 -
\??\c:\8uov04.exec:\8uov04.exe31⤵
- Executes dropped EXE
PID:3176 -
\??\c:\d5ddk.exec:\d5ddk.exe32⤵
- Executes dropped EXE
PID:4316 -
\??\c:\1q73m9.exec:\1q73m9.exe33⤵
- Executes dropped EXE
PID:4884 -
\??\c:\tpq739.exec:\tpq739.exe34⤵
- Executes dropped EXE
PID:4052 -
\??\c:\7c1a3.exec:\7c1a3.exe35⤵
- Executes dropped EXE
PID:4520 -
\??\c:\s9u71q7.exec:\s9u71q7.exe36⤵
- Executes dropped EXE
PID:3120 -
\??\c:\ejw6i8.exec:\ejw6i8.exe37⤵
- Executes dropped EXE
PID:4320 -
\??\c:\55thw.exec:\55thw.exe38⤵
- Executes dropped EXE
PID:1376 -
\??\c:\0o8v72o.exec:\0o8v72o.exe39⤵
- Executes dropped EXE
PID:5000 -
\??\c:\6f89a2.exec:\6f89a2.exe40⤵
- Executes dropped EXE
PID:4580 -
\??\c:\3dwu725.exec:\3dwu725.exe41⤵
- Executes dropped EXE
PID:1872 -
\??\c:\l0s14.exec:\l0s14.exe42⤵
- Executes dropped EXE
PID:260 -
\??\c:\398a44.exec:\398a44.exe43⤵
- Executes dropped EXE
PID:3828 -
\??\c:\hj17te0.exec:\hj17te0.exe44⤵
- Executes dropped EXE
PID:4524 -
\??\c:\wtu6n0.exec:\wtu6n0.exe45⤵
- Executes dropped EXE
PID:3616 -
\??\c:\nv0c4.exec:\nv0c4.exe46⤵
- Executes dropped EXE
PID:2796 -
\??\c:\2wk55h6.exec:\2wk55h6.exe47⤵
- Executes dropped EXE
PID:2400 -
\??\c:\uu33nk5.exec:\uu33nk5.exe48⤵
- Executes dropped EXE
PID:1676 -
\??\c:\su07spe.exec:\su07spe.exe49⤵
- Executes dropped EXE
PID:1504 -
\??\c:\j9kp9du.exec:\j9kp9du.exe50⤵
- Executes dropped EXE
PID:4244 -
\??\c:\3k1k9.exec:\3k1k9.exe51⤵
- Executes dropped EXE
PID:3796 -
\??\c:\95211.exec:\95211.exe52⤵
- Executes dropped EXE
PID:2476 -
\??\c:\66fm9qf.exec:\66fm9qf.exe53⤵
- Executes dropped EXE
PID:1244 -
\??\c:\d7jo4.exec:\d7jo4.exe54⤵
- Executes dropped EXE
PID:2596 -
\??\c:\emup88.exec:\emup88.exe55⤵
- Executes dropped EXE
PID:4440 -
\??\c:\xg2mp.exec:\xg2mp.exe56⤵
- Executes dropped EXE
PID:4360 -
\??\c:\frp375u.exec:\frp375u.exe57⤵
- Executes dropped EXE
PID:1392 -
\??\c:\fol6s.exec:\fol6s.exe58⤵
- Executes dropped EXE
PID:4604 -
\??\c:\35902rc.exec:\35902rc.exe59⤵
- Executes dropped EXE
PID:2748 -
\??\c:\m3s83.exec:\m3s83.exe60⤵
- Executes dropped EXE
PID:3516 -
\??\c:\ewiaq1.exec:\ewiaq1.exe61⤵
- Executes dropped EXE
PID:832 -
\??\c:\kl6s6x.exec:\kl6s6x.exe62⤵
- Executes dropped EXE
PID:3104 -
\??\c:\0m796.exec:\0m796.exe63⤵
- Executes dropped EXE
PID:2084 -
\??\c:\t9w5rg.exec:\t9w5rg.exe64⤵
- Executes dropped EXE
PID:1272 -
\??\c:\l5rlm.exec:\l5rlm.exe65⤵
- Executes dropped EXE
PID:1624 -
\??\c:\9x66w.exec:\9x66w.exe66⤵PID:3800
-
\??\c:\7su454.exec:\7su454.exe67⤵PID:4112
-
\??\c:\75e041.exec:\75e041.exe68⤵PID:2800
-
\??\c:\81iw75.exec:\81iw75.exe69⤵PID:2304
-
\??\c:\mv06q4.exec:\mv06q4.exe70⤵PID:4744
-
\??\c:\92564.exec:\92564.exe71⤵PID:2152
-
\??\c:\444q1.exec:\444q1.exe72⤵PID:2664
-
\??\c:\8t9m85.exec:\8t9m85.exe73⤵PID:4480
-
\??\c:\02er7b1.exec:\02er7b1.exe74⤵PID:1972
-
\??\c:\sd46kc5.exec:\sd46kc5.exe75⤵PID:5004
-
\??\c:\77x8ehi.exec:\77x8ehi.exe76⤵PID:2380
-
\??\c:\ruc3s9.exec:\ruc3s9.exe77⤵PID:1712
-
\??\c:\p68a45.exec:\p68a45.exe78⤵PID:1996
-
\??\c:\0bc4137.exec:\0bc4137.exe79⤵PID:2032
-
\??\c:\j745lj.exec:\j745lj.exe80⤵PID:4220
-
\??\c:\r41d53.exec:\r41d53.exe81⤵PID:4320
-
\??\c:\2pj3m2.exec:\2pj3m2.exe82⤵PID:5012
-
\??\c:\p24h233.exec:\p24h233.exe83⤵PID:5108
-
\??\c:\a7c5vla.exec:\a7c5vla.exe84⤵PID:4844
-
\??\c:\1937s.exec:\1937s.exe85⤵PID:1812
-
\??\c:\v9co5j.exec:\v9co5j.exe86⤵PID:996
-
\??\c:\mi9335.exec:\mi9335.exe87⤵PID:404
-
\??\c:\6443h.exec:\6443h.exe88⤵PID:2612
-
\??\c:\7d5s5o6.exec:\7d5s5o6.exe89⤵PID:3984
-
\??\c:\2pd3kn.exec:\2pd3kn.exe90⤵PID:5076
-
\??\c:\j6p57.exec:\j6p57.exe91⤵PID:1804
-
\??\c:\pq2n6r.exec:\pq2n6r.exe92⤵PID:3980
-
\??\c:\d8ux1.exec:\d8ux1.exe93⤵PID:3276
-
\??\c:\t9u5a2.exec:\t9u5a2.exe94⤵PID:4952
-
\??\c:\2dd693.exec:\2dd693.exe95⤵PID:4476
-
\??\c:\764cj.exec:\764cj.exe96⤵PID:2392
-
\??\c:\h3k0e4l.exec:\h3k0e4l.exe97⤵PID:3764
-
\??\c:\8305a9q.exec:\8305a9q.exe98⤵PID:4444
-
\??\c:\312d9nk.exec:\312d9nk.exe99⤵PID:1688
-
\??\c:\68575d8.exec:\68575d8.exe100⤵PID:4352
-
\??\c:\38a09.exec:\38a09.exe101⤵PID:4604
-
\??\c:\5g5804g.exec:\5g5804g.exe102⤵PID:2748
-
\??\c:\5i1jd.exec:\5i1jd.exe103⤵PID:2348
-
\??\c:\j43v18e.exec:\j43v18e.exe104⤵PID:2060
-
\??\c:\cic64l1.exec:\cic64l1.exe105⤵PID:4284
-
\??\c:\3sj2x0.exec:\3sj2x0.exe106⤵PID:2084
-
\??\c:\4avex1f.exec:\4avex1f.exe107⤵PID:4856
-
\??\c:\e0u45s.exec:\e0u45s.exe108⤵PID:3872
-
\??\c:\2d3a9.exec:\2d3a9.exe109⤵PID:3800
-
\??\c:\27uge.exec:\27uge.exe110⤵PID:3920
-
\??\c:\66o2140.exec:\66o2140.exe111⤵PID:3240
-
\??\c:\ct7t565.exec:\ct7t565.exe112⤵PID:2984
-
\??\c:\9o78m5.exec:\9o78m5.exe113⤵PID:3816
-
\??\c:\r83sv.exec:\r83sv.exe114⤵PID:4432
-
\??\c:\xn6e797.exec:\xn6e797.exe115⤵PID:4316
-
\??\c:\996m89.exec:\996m89.exe116⤵PID:1420
-
\??\c:\q84w8.exec:\q84w8.exe117⤵PID:4488
-
\??\c:\qur63b.exec:\qur63b.exe118⤵PID:1712
-
\??\c:\x2cp6.exec:\x2cp6.exe119⤵PID:4212
-
\??\c:\ip79ln.exec:\ip79ln.exe120⤵PID:4784
-
\??\c:\e81kb2r.exec:\e81kb2r.exe121⤵PID:1376
-
\??\c:\b1w92.exec:\b1w92.exe122⤵PID:4580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-