Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 03:02
Behavioral task
behavioral1
Sample
8621402331215fb2efbf8810742d3fb0N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
8621402331215fb2efbf8810742d3fb0N.exe
-
Size
126KB
-
MD5
8621402331215fb2efbf8810742d3fb0
-
SHA1
d39f794c951eb543a5b308b5451ffbcb53951d4a
-
SHA256
689d1b56c18954d6ccaef7aae32f931ca4c7b99fa37e396b14f3b3ab48fa9251
-
SHA512
50a53e889d37dad19e6b4ef43d7bfcd3274f64c750bfee6c4c12f7b5af7c2551b37c48bdec594b436bec658f921210588d833e5b68feab4bcb33f0b59be8de98
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JgY0nU+:9cm4FmowdHoS49oU+
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4168-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1056-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2332-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3420-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3000-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1200-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4980-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2368-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3124-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3076-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/652-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3136-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2752-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3108-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1096-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1268-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4744-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3620-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4268-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4252-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1544-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/316-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/632-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2936-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3024-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1172-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1308-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3504-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/736-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2416-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/468-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1356-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4256-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3176-414-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/632-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/632-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3024-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4380-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1272-531-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2672-586-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1464-599-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4076-622-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1056 0820864.exe 3556 08202.exe 2332 68842.exe 4492 4222466.exe 1724 08824.exe 3420 4222660.exe 3000 e64242.exe 4352 0206480.exe 1200 084668.exe 2272 46002.exe 2016 0068208.exe 4980 046266.exe 3760 20222.exe 2368 o626004.exe 3124 028440.exe 3076 04048.exe 652 2460060.exe 3436 00280.exe 3700 2008446.exe 2012 228068.exe 3136 m4662.exe 2752 q22086.exe 1096 484488.exe 3108 68662.exe 3120 u826464.exe 2864 26080.exe 4664 42622.exe 1268 2486428.exe 3600 q60862.exe 4744 06844.exe 2608 6862000.exe 4792 064022.exe 928 60808.exe 2600 0662822.exe 2100 448828.exe 4824 08244.exe 3620 24266.exe 4944 8886840.exe 1976 860228.exe 1732 42408.exe 4592 24840.exe 4596 8888400.exe 4964 k24488.exe 1284 008244.exe 640 68284.exe 2452 6062402.exe 4268 44660.exe 1544 2480606.exe 4252 848408.exe 1800 006462.exe 3000 o804882.exe 3756 8282884.exe 316 062262.exe 632 42866.exe 2936 6868844.exe 228 4844822.exe 4980 880006.exe 3520 64880.exe 3024 6406088.exe 1172 4082062.exe 3980 84864.exe 3500 4464824.exe 972 i026002.exe 1308 822668.exe -
resource yara_rule behavioral2/memory/4168-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233b6-3.dat upx behavioral2/memory/4168-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1056-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340b-17.dat upx behavioral2/memory/3556-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023403-10.dat upx behavioral2/files/0x000700000002340c-20.dat upx behavioral2/memory/2332-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340d-25.dat upx behavioral2/memory/1724-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340e-30.dat upx behavioral2/files/0x0007000000023410-35.dat upx behavioral2/memory/3420-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023411-41.dat upx behavioral2/memory/3000-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4352-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023412-47.dat upx behavioral2/files/0x0007000000023413-52.dat upx behavioral2/memory/1200-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023414-58.dat upx behavioral2/memory/2272-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023415-64.dat upx behavioral2/memory/2016-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-70.dat upx behavioral2/memory/4980-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023417-76.dat upx behavioral2/memory/2368-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023418-81.dat upx behavioral2/files/0x0007000000023419-87.dat upx behavioral2/memory/3124-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341a-93.dat upx behavioral2/memory/3076-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341b-101.dat upx behavioral2/memory/652-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3436-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023408-105.dat upx behavioral2/files/0x000700000002341c-111.dat upx behavioral2/memory/3700-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2012-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341d-117.dat upx behavioral2/files/0x000700000002341f-123.dat upx behavioral2/memory/3136-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023420-129.dat upx behavioral2/memory/2752-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-136.dat upx behavioral2/memory/3108-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1096-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023422-142.dat upx behavioral2/files/0x0007000000023423-148.dat upx behavioral2/files/0x0007000000023425-159.dat upx behavioral2/memory/4664-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-153.dat upx behavioral2/files/0x0007000000023426-163.dat upx behavioral2/memory/1268-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023427-169.dat upx behavioral2/memory/3600-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-175.dat upx behavioral2/memory/4744-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023429-181.dat upx behavioral2/memory/2100-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3620-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4944-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1732-211-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 862404.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0688226.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0400004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 820006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 026662.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 826622.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o860642.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2422666.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 684488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4046668.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6460460.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86882.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 440440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4286646.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s2602.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4168 wrote to memory of 1056 4168 8621402331215fb2efbf8810742d3fb0N.exe 83 PID 4168 wrote to memory of 1056 4168 8621402331215fb2efbf8810742d3fb0N.exe 83 PID 4168 wrote to memory of 1056 4168 8621402331215fb2efbf8810742d3fb0N.exe 83 PID 1056 wrote to memory of 3556 1056 0820864.exe 84 PID 1056 wrote to memory of 3556 1056 0820864.exe 84 PID 1056 wrote to memory of 3556 1056 0820864.exe 84 PID 3556 wrote to memory of 2332 3556 08202.exe 85 PID 3556 wrote to memory of 2332 3556 08202.exe 85 PID 3556 wrote to memory of 2332 3556 08202.exe 85 PID 2332 wrote to memory of 4492 2332 68842.exe 86 PID 2332 wrote to memory of 4492 2332 68842.exe 86 PID 2332 wrote to memory of 4492 2332 68842.exe 86 PID 4492 wrote to memory of 1724 4492 4222466.exe 87 PID 4492 wrote to memory of 1724 4492 4222466.exe 87 PID 4492 wrote to memory of 1724 4492 4222466.exe 87 PID 1724 wrote to memory of 3420 1724 08824.exe 88 PID 1724 wrote to memory of 3420 1724 08824.exe 88 PID 1724 wrote to memory of 3420 1724 08824.exe 88 PID 3420 wrote to memory of 3000 3420 4222660.exe 89 PID 3420 wrote to memory of 3000 3420 4222660.exe 89 PID 3420 wrote to memory of 3000 3420 4222660.exe 89 PID 3000 wrote to memory of 4352 3000 e64242.exe 90 PID 3000 wrote to memory of 4352 3000 e64242.exe 90 PID 3000 wrote to memory of 4352 3000 e64242.exe 90 PID 4352 wrote to memory of 1200 4352 0206480.exe 91 PID 4352 wrote to memory of 1200 4352 0206480.exe 91 PID 4352 wrote to memory of 1200 4352 0206480.exe 91 PID 1200 wrote to memory of 2272 1200 084668.exe 92 PID 1200 wrote to memory of 2272 1200 084668.exe 92 PID 1200 wrote to memory of 2272 1200 084668.exe 92 PID 2272 wrote to memory of 2016 2272 46002.exe 93 PID 2272 wrote to memory of 2016 2272 46002.exe 93 PID 2272 wrote to memory of 2016 2272 46002.exe 93 PID 2016 wrote to memory of 4980 2016 0068208.exe 94 PID 2016 wrote to memory of 4980 2016 0068208.exe 94 PID 2016 wrote to memory of 4980 2016 0068208.exe 94 PID 4980 wrote to memory of 3760 4980 046266.exe 95 PID 4980 wrote to memory of 3760 4980 046266.exe 95 PID 4980 wrote to memory of 3760 4980 046266.exe 95 PID 3760 wrote to memory of 2368 3760 20222.exe 96 PID 3760 wrote to memory of 2368 3760 20222.exe 96 PID 3760 wrote to memory of 2368 3760 20222.exe 96 PID 2368 wrote to memory of 3124 2368 o626004.exe 97 PID 2368 wrote to memory of 3124 2368 o626004.exe 97 PID 2368 wrote to memory of 3124 2368 o626004.exe 97 PID 3124 wrote to memory of 3076 3124 028440.exe 98 PID 3124 wrote to memory of 3076 3124 028440.exe 98 PID 3124 wrote to memory of 3076 3124 028440.exe 98 PID 3076 wrote to memory of 652 3076 04048.exe 100 PID 3076 wrote to memory of 652 3076 04048.exe 100 PID 3076 wrote to memory of 652 3076 04048.exe 100 PID 652 wrote to memory of 3436 652 2460060.exe 101 PID 652 wrote to memory of 3436 652 2460060.exe 101 PID 652 wrote to memory of 3436 652 2460060.exe 101 PID 3436 wrote to memory of 3700 3436 00280.exe 103 PID 3436 wrote to memory of 3700 3436 00280.exe 103 PID 3436 wrote to memory of 3700 3436 00280.exe 103 PID 3700 wrote to memory of 2012 3700 2008446.exe 104 PID 3700 wrote to memory of 2012 3700 2008446.exe 104 PID 3700 wrote to memory of 2012 3700 2008446.exe 104 PID 2012 wrote to memory of 3136 2012 228068.exe 105 PID 2012 wrote to memory of 3136 2012 228068.exe 105 PID 2012 wrote to memory of 3136 2012 228068.exe 105 PID 3136 wrote to memory of 2752 3136 m4662.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\8621402331215fb2efbf8810742d3fb0N.exe"C:\Users\Admin\AppData\Local\Temp\8621402331215fb2efbf8810742d3fb0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\0820864.exec:\0820864.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\08202.exec:\08202.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\68842.exec:\68842.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\4222466.exec:\4222466.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\08824.exec:\08824.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\4222660.exec:\4222660.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\e64242.exec:\e64242.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\0206480.exec:\0206480.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\084668.exec:\084668.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\46002.exec:\46002.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\0068208.exec:\0068208.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\046266.exec:\046266.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\20222.exec:\20222.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\o626004.exec:\o626004.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\028440.exec:\028440.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\04048.exec:\04048.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\2460060.exec:\2460060.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\00280.exec:\00280.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\2008446.exec:\2008446.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\228068.exec:\228068.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\m4662.exec:\m4662.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\q22086.exec:\q22086.exe23⤵
- Executes dropped EXE
PID:2752 -
\??\c:\484488.exec:\484488.exe24⤵
- Executes dropped EXE
PID:1096 -
\??\c:\68662.exec:\68662.exe25⤵
- Executes dropped EXE
PID:3108 -
\??\c:\u826464.exec:\u826464.exe26⤵
- Executes dropped EXE
PID:3120 -
\??\c:\26080.exec:\26080.exe27⤵
- Executes dropped EXE
PID:2864 -
\??\c:\42622.exec:\42622.exe28⤵
- Executes dropped EXE
PID:4664 -
\??\c:\2486428.exec:\2486428.exe29⤵
- Executes dropped EXE
PID:1268 -
\??\c:\q60862.exec:\q60862.exe30⤵
- Executes dropped EXE
PID:3600 -
\??\c:\06844.exec:\06844.exe31⤵
- Executes dropped EXE
PID:4744 -
\??\c:\6862000.exec:\6862000.exe32⤵
- Executes dropped EXE
PID:2608 -
\??\c:\064022.exec:\064022.exe33⤵
- Executes dropped EXE
PID:4792 -
\??\c:\60808.exec:\60808.exe34⤵
- Executes dropped EXE
PID:928 -
\??\c:\0662822.exec:\0662822.exe35⤵
- Executes dropped EXE
PID:2600 -
\??\c:\448828.exec:\448828.exe36⤵
- Executes dropped EXE
PID:2100 -
\??\c:\08244.exec:\08244.exe37⤵
- Executes dropped EXE
PID:4824 -
\??\c:\24266.exec:\24266.exe38⤵
- Executes dropped EXE
PID:3620 -
\??\c:\8886840.exec:\8886840.exe39⤵
- Executes dropped EXE
PID:4944 -
\??\c:\860228.exec:\860228.exe40⤵
- Executes dropped EXE
PID:1976 -
\??\c:\42408.exec:\42408.exe41⤵
- Executes dropped EXE
PID:1732 -
\??\c:\24840.exec:\24840.exe42⤵
- Executes dropped EXE
PID:4592 -
\??\c:\8888400.exec:\8888400.exe43⤵
- Executes dropped EXE
PID:4596 -
\??\c:\k24488.exec:\k24488.exe44⤵
- Executes dropped EXE
PID:4964 -
\??\c:\008244.exec:\008244.exe45⤵
- Executes dropped EXE
PID:1284 -
\??\c:\68284.exec:\68284.exe46⤵
- Executes dropped EXE
PID:640 -
\??\c:\6062402.exec:\6062402.exe47⤵
- Executes dropped EXE
PID:2452 -
\??\c:\44660.exec:\44660.exe48⤵
- Executes dropped EXE
PID:4268 -
\??\c:\2480606.exec:\2480606.exe49⤵
- Executes dropped EXE
PID:1544 -
\??\c:\848408.exec:\848408.exe50⤵
- Executes dropped EXE
PID:4252 -
\??\c:\006462.exec:\006462.exe51⤵
- Executes dropped EXE
PID:1800 -
\??\c:\o804882.exec:\o804882.exe52⤵
- Executes dropped EXE
PID:3000 -
\??\c:\8282884.exec:\8282884.exe53⤵
- Executes dropped EXE
PID:3756 -
\??\c:\062262.exec:\062262.exe54⤵
- Executes dropped EXE
PID:316 -
\??\c:\42866.exec:\42866.exe55⤵
- Executes dropped EXE
PID:632 -
\??\c:\6868844.exec:\6868844.exe56⤵
- Executes dropped EXE
PID:2936 -
\??\c:\4844822.exec:\4844822.exe57⤵
- Executes dropped EXE
PID:228 -
\??\c:\880006.exec:\880006.exe58⤵
- Executes dropped EXE
PID:4980 -
\??\c:\64880.exec:\64880.exe59⤵
- Executes dropped EXE
PID:3520 -
\??\c:\6406088.exec:\6406088.exe60⤵
- Executes dropped EXE
PID:3024 -
\??\c:\4082062.exec:\4082062.exe61⤵
- Executes dropped EXE
PID:1172 -
\??\c:\84864.exec:\84864.exe62⤵
- Executes dropped EXE
PID:3980 -
\??\c:\4464824.exec:\4464824.exe63⤵
- Executes dropped EXE
PID:3500 -
\??\c:\i026002.exec:\i026002.exe64⤵
- Executes dropped EXE
PID:972 -
\??\c:\822668.exec:\822668.exe65⤵
- Executes dropped EXE
PID:1308 -
\??\c:\68222.exec:\68222.exe66⤵PID:4068
-
\??\c:\4840442.exec:\4840442.exe67⤵PID:3244
-
\??\c:\668222.exec:\668222.exe68⤵PID:1484
-
\??\c:\48482.exec:\48482.exe69⤵PID:3504
-
\??\c:\4008220.exec:\4008220.exe70⤵PID:2012
-
\??\c:\2068006.exec:\2068006.exe71⤵PID:1016
-
\??\c:\2066222.exec:\2066222.exe72⤵PID:4048
-
\??\c:\868846.exec:\868846.exe73⤵PID:704
-
\??\c:\42848.exec:\42848.exe74⤵PID:4380
-
\??\c:\4286660.exec:\4286660.exe75⤵PID:736
-
\??\c:\606604.exec:\606604.exe76⤵PID:4036
-
\??\c:\42864.exec:\42864.exe77⤵PID:2416
-
\??\c:\88260.exec:\88260.exe78⤵PID:2964
-
\??\c:\4066004.exec:\4066004.exe79⤵PID:468
-
\??\c:\k82888.exec:\k82888.exe80⤵PID:1356
-
\??\c:\24444.exec:\24444.exe81⤵PID:4780
-
\??\c:\2622600.exec:\2622600.exe82⤵PID:1660
-
\??\c:\c044000.exec:\c044000.exe83⤵PID:3388
-
\??\c:\8422288.exec:\8422288.exe84⤵PID:1116
-
\??\c:\q24448.exec:\q24448.exe85⤵PID:3276
-
\??\c:\8282666.exec:\8282666.exe86⤵PID:4944
-
\??\c:\240022.exec:\240022.exe87⤵PID:2732
-
\??\c:\222222.exec:\222222.exe88⤵PID:4804
-
\??\c:\44460.exec:\44460.exe89⤵PID:4168
-
\??\c:\0004888.exec:\0004888.exe90⤵PID:3228
-
\??\c:\0244848.exec:\0244848.exe91⤵PID:3556
-
\??\c:\q24822.exec:\q24822.exe92⤵PID:3996
-
\??\c:\a2822.exec:\a2822.exe93⤵PID:4256
-
\??\c:\i026666.exec:\i026666.exe94⤵PID:2996
-
\??\c:\8444488.exec:\8444488.exe95⤵PID:3280
-
\??\c:\264444.exec:\264444.exe96⤵PID:4252
-
\??\c:\48628.exec:\48628.exe97⤵PID:4272
-
\??\c:\0088008.exec:\0088008.exe98⤵PID:3176
-
\??\c:\640064.exec:\640064.exe99⤵PID:1824
-
\??\c:\26620.exec:\26620.exe100⤵PID:1992
-
\??\c:\68482.exec:\68482.exe101⤵PID:632
-
\??\c:\2066486.exec:\2066486.exe102⤵PID:2936
-
\??\c:\280000.exec:\280000.exe103⤵PID:180
-
\??\c:\220842.exec:\220842.exe104⤵PID:3948
-
\??\c:\04608.exec:\04608.exe105⤵PID:4020
-
\??\c:\4604048.exec:\4604048.exe106⤵PID:3024
-
\??\c:\i082266.exec:\i082266.exe107⤵PID:1000
-
\??\c:\264840.exec:\264840.exe108⤵PID:2688
-
\??\c:\242662.exec:\242662.exe109⤵PID:2944
-
\??\c:\a8068.exec:\a8068.exe110⤵PID:3464
-
\??\c:\84046.exec:\84046.exe111⤵PID:1308
-
\??\c:\u266804.exec:\u266804.exe112⤵PID:3436
-
\??\c:\w02226.exec:\w02226.exe113⤵PID:3036
-
\??\c:\882600.exec:\882600.exe114⤵PID:1820
-
\??\c:\82482.exec:\82482.exe115⤵PID:2648
-
\??\c:\22848.exec:\22848.exe116⤵PID:2012
-
\??\c:\4026060.exec:\4026060.exe117⤵PID:4072
-
\??\c:\440444.exec:\440444.exe118⤵PID:4504
-
\??\c:\804222.exec:\804222.exe119⤵PID:4380
-
\??\c:\02282.exec:\02282.exe120⤵PID:4036
-
\??\c:\o282660.exec:\o282660.exe121⤵PID:3600
-
\??\c:\w64404.exec:\w64404.exe122⤵PID:2652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-