Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 14:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
46c3be32cc3a3f6022502df07c9f17d0N.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
120 seconds
General
-
Target
46c3be32cc3a3f6022502df07c9f17d0N.exe
-
Size
201KB
-
MD5
46c3be32cc3a3f6022502df07c9f17d0
-
SHA1
df0152ba7071c8fb6e835dad3eb3bfae755ebb0c
-
SHA256
b84da9621cc0b636f15838cb29e304546d9dca0b5ab8a8b309cbad299d67aab0
-
SHA512
59c934766ac01dc449c11def0c4215f62ce7df48deaaffc99b72cf816a4bd7b92e2c289026066edd822b395166ef4ef87b025f4e1e2c08bccd5cda1c9ea8d092
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+C2HVM1p6TQpBE0:PhOm2sI93UufdC67ciJTU2HVS6c
Malware Config
Signatures
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/1672-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-28-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2808-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-32-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2732-36-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2912-43-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/2732-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-64-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2724-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/448-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2608-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1324-162-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1324-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/528-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/528-194-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/528-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1860-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1860-217-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/2064-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1844-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-345-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-349-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2780-354-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-362-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/1460-384-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1460-383-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1800-397-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2992-431-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2992-430-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1716-465-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1716-486-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1896-524-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1944-543-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-582-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1156-597-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-623-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/448-702-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/576-729-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/576-728-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1540 6422440.exe 2808 q40022.exe 2732 26406.exe 2912 6206006.exe 2756 6444662.exe 2724 m8228.exe 2792 a4280.exe 2580 e20062.exe 2676 m8686.exe 2968 6422040.exe 2432 u422880.exe 2192 66840.exe 448 s6888.exe 2800 2468242.exe 2608 602860.exe 1324 26824.exe 2448 4200824.exe 2020 206284.exe 2388 008866.exe 528 86840.exe 2224 c424606.exe 1860 608046.exe 2064 646244.exe 1844 26280.exe 2484 424400.exe 2360 e20284.exe 2556 26620.exe 1816 6462886.exe 2052 k20082.exe 1660 04000.exe 1672 64006.exe 2396 8202424.exe 1072 886806.exe 2240 60280.exe 2872 20626.exe 2728 2400228.exe 2928 646028.exe 2780 w02200.exe 2816 a4680.exe 2920 2062406.exe 2792 8200624.exe 1460 864400.exe 976 868026.exe 1800 g6062.exe 2220 0806222.exe 1056 208428.exe 2488 084000.exe 2956 42828.exe 2992 20622.exe 376 o240262.exe 2832 4406828.exe 1596 646688.exe 660 g8002.exe 1716 86068.exe 1060 2644068.exe 1648 6028024.exe 2212 602688.exe 2352 m0224.exe 1144 82066.exe 1896 2022844.exe 2096 0484068.exe 932 040288.exe 1136 86440.exe 1728 48062.exe -
resource yara_rule behavioral1/memory/1540-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-90-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2968-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/448-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2608-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1324-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2448-171-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2020-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/528-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/528-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1860-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1860-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1844-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1672-298-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2240-316-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2872-330-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-337-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-345-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-346-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-349-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2780-354-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2816-358-0x00000000003A0000-0x00000000003C9000-memory.dmp upx behavioral1/memory/1460-384-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1800-397-0x00000000001B0000-0x00000000001D9000-memory.dmp upx behavioral1/memory/2220-398-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-430-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/376-432-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1716-458-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1944-543-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-550-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-582-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/1156-590-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1156-597-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-636-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-656-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-670-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/448-695-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/448-702-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-709-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/576-729-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82066.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64628.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6422266.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86662.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m4684.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86200.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u644262.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g8002.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82246.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0468440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00668.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 646626.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42066.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1672 wrote to memory of 1540 1672 46c3be32cc3a3f6022502df07c9f17d0N.exe 30 PID 1672 wrote to memory of 1540 1672 46c3be32cc3a3f6022502df07c9f17d0N.exe 30 PID 1672 wrote to memory of 1540 1672 46c3be32cc3a3f6022502df07c9f17d0N.exe 30 PID 1672 wrote to memory of 1540 1672 46c3be32cc3a3f6022502df07c9f17d0N.exe 30 PID 1540 wrote to memory of 2808 1540 6422440.exe 31 PID 1540 wrote to memory of 2808 1540 6422440.exe 31 PID 1540 wrote to memory of 2808 1540 6422440.exe 31 PID 1540 wrote to memory of 2808 1540 6422440.exe 31 PID 2808 wrote to memory of 2732 2808 q40022.exe 32 PID 2808 wrote to memory of 2732 2808 q40022.exe 32 PID 2808 wrote to memory of 2732 2808 q40022.exe 32 PID 2808 wrote to memory of 2732 2808 q40022.exe 32 PID 2732 wrote to memory of 2912 2732 26406.exe 33 PID 2732 wrote to memory of 2912 2732 26406.exe 33 PID 2732 wrote to memory of 2912 2732 26406.exe 33 PID 2732 wrote to memory of 2912 2732 26406.exe 33 PID 2912 wrote to memory of 2756 2912 6206006.exe 34 PID 2912 wrote to memory of 2756 2912 6206006.exe 34 PID 2912 wrote to memory of 2756 2912 6206006.exe 34 PID 2912 wrote to memory of 2756 2912 6206006.exe 34 PID 2756 wrote to memory of 2724 2756 6444662.exe 35 PID 2756 wrote to memory of 2724 2756 6444662.exe 35 PID 2756 wrote to memory of 2724 2756 6444662.exe 35 PID 2756 wrote to memory of 2724 2756 6444662.exe 35 PID 2724 wrote to memory of 2792 2724 m8228.exe 36 PID 2724 wrote to memory of 2792 2724 m8228.exe 36 PID 2724 wrote to memory of 2792 2724 m8228.exe 36 PID 2724 wrote to memory of 2792 2724 m8228.exe 36 PID 2792 wrote to memory of 2580 2792 a4280.exe 37 PID 2792 wrote to memory of 2580 2792 a4280.exe 37 PID 2792 wrote to memory of 2580 2792 a4280.exe 37 PID 2792 wrote to memory of 2580 2792 a4280.exe 37 PID 2580 wrote to memory of 2676 2580 e20062.exe 38 PID 2580 wrote to memory of 2676 2580 e20062.exe 38 PID 2580 wrote to memory of 2676 2580 e20062.exe 38 PID 2580 wrote to memory of 2676 2580 e20062.exe 38 PID 2676 wrote to memory of 2968 2676 m8686.exe 39 PID 2676 wrote to memory of 2968 2676 m8686.exe 39 PID 2676 wrote to memory of 2968 2676 m8686.exe 39 PID 2676 wrote to memory of 2968 2676 m8686.exe 39 PID 2968 wrote to memory of 2432 2968 6422040.exe 40 PID 2968 wrote to memory of 2432 2968 6422040.exe 40 PID 2968 wrote to memory of 2432 2968 6422040.exe 40 PID 2968 wrote to memory of 2432 2968 6422040.exe 40 PID 2432 wrote to memory of 2192 2432 u422880.exe 41 PID 2432 wrote to memory of 2192 2432 u422880.exe 41 PID 2432 wrote to memory of 2192 2432 u422880.exe 41 PID 2432 wrote to memory of 2192 2432 u422880.exe 41 PID 2192 wrote to memory of 448 2192 66840.exe 42 PID 2192 wrote to memory of 448 2192 66840.exe 42 PID 2192 wrote to memory of 448 2192 66840.exe 42 PID 2192 wrote to memory of 448 2192 66840.exe 42 PID 448 wrote to memory of 2800 448 s6888.exe 43 PID 448 wrote to memory of 2800 448 s6888.exe 43 PID 448 wrote to memory of 2800 448 s6888.exe 43 PID 448 wrote to memory of 2800 448 s6888.exe 43 PID 2800 wrote to memory of 2608 2800 2468242.exe 44 PID 2800 wrote to memory of 2608 2800 2468242.exe 44 PID 2800 wrote to memory of 2608 2800 2468242.exe 44 PID 2800 wrote to memory of 2608 2800 2468242.exe 44 PID 2608 wrote to memory of 1324 2608 602860.exe 45 PID 2608 wrote to memory of 1324 2608 602860.exe 45 PID 2608 wrote to memory of 1324 2608 602860.exe 45 PID 2608 wrote to memory of 1324 2608 602860.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\46c3be32cc3a3f6022502df07c9f17d0N.exe"C:\Users\Admin\AppData\Local\Temp\46c3be32cc3a3f6022502df07c9f17d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\6422440.exec:\6422440.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\q40022.exec:\q40022.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\26406.exec:\26406.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\6206006.exec:\6206006.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\6444662.exec:\6444662.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\m8228.exec:\m8228.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\a4280.exec:\a4280.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\e20062.exec:\e20062.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\m8686.exec:\m8686.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\6422040.exec:\6422040.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\u422880.exec:\u422880.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\66840.exec:\66840.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\s6888.exec:\s6888.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\2468242.exec:\2468242.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\602860.exec:\602860.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\26824.exec:\26824.exe17⤵
- Executes dropped EXE
PID:1324 -
\??\c:\4200824.exec:\4200824.exe18⤵
- Executes dropped EXE
PID:2448 -
\??\c:\206284.exec:\206284.exe19⤵
- Executes dropped EXE
PID:2020 -
\??\c:\008866.exec:\008866.exe20⤵
- Executes dropped EXE
PID:2388 -
\??\c:\86840.exec:\86840.exe21⤵
- Executes dropped EXE
PID:528 -
\??\c:\c424606.exec:\c424606.exe22⤵
- Executes dropped EXE
PID:2224 -
\??\c:\608046.exec:\608046.exe23⤵
- Executes dropped EXE
PID:1860 -
\??\c:\646244.exec:\646244.exe24⤵
- Executes dropped EXE
PID:2064 -
\??\c:\26280.exec:\26280.exe25⤵
- Executes dropped EXE
PID:1844 -
\??\c:\424400.exec:\424400.exe26⤵
- Executes dropped EXE
PID:2484 -
\??\c:\e20284.exec:\e20284.exe27⤵
- Executes dropped EXE
PID:2360 -
\??\c:\26620.exec:\26620.exe28⤵
- Executes dropped EXE
PID:2556 -
\??\c:\6462886.exec:\6462886.exe29⤵
- Executes dropped EXE
PID:1816 -
\??\c:\k20082.exec:\k20082.exe30⤵
- Executes dropped EXE
PID:2052 -
\??\c:\04000.exec:\04000.exe31⤵
- Executes dropped EXE
PID:1660 -
\??\c:\64006.exec:\64006.exe32⤵
- Executes dropped EXE
PID:1672 -
\??\c:\8202424.exec:\8202424.exe33⤵
- Executes dropped EXE
PID:2396 -
\??\c:\886806.exec:\886806.exe34⤵
- Executes dropped EXE
PID:1072 -
\??\c:\60280.exec:\60280.exe35⤵
- Executes dropped EXE
PID:2240 -
\??\c:\20626.exec:\20626.exe36⤵
- Executes dropped EXE
PID:2872 -
\??\c:\2400228.exec:\2400228.exe37⤵
- Executes dropped EXE
PID:2728 -
\??\c:\646028.exec:\646028.exe38⤵
- Executes dropped EXE
PID:2928 -
\??\c:\w02200.exec:\w02200.exe39⤵
- Executes dropped EXE
PID:2780 -
\??\c:\a4680.exec:\a4680.exe40⤵
- Executes dropped EXE
PID:2816 -
\??\c:\2062406.exec:\2062406.exe41⤵
- Executes dropped EXE
PID:2920 -
\??\c:\8200624.exec:\8200624.exe42⤵
- Executes dropped EXE
PID:2792 -
\??\c:\864400.exec:\864400.exe43⤵
- Executes dropped EXE
PID:1460 -
\??\c:\868026.exec:\868026.exe44⤵
- Executes dropped EXE
PID:976 -
\??\c:\g6062.exec:\g6062.exe45⤵
- Executes dropped EXE
PID:1800 -
\??\c:\0806222.exec:\0806222.exe46⤵
- Executes dropped EXE
PID:2220 -
\??\c:\208428.exec:\208428.exe47⤵
- Executes dropped EXE
PID:1056 -
\??\c:\084000.exec:\084000.exe48⤵
- Executes dropped EXE
PID:2488 -
\??\c:\42828.exec:\42828.exe49⤵
- Executes dropped EXE
PID:2956 -
\??\c:\20622.exec:\20622.exe50⤵
- Executes dropped EXE
PID:2992 -
\??\c:\o240262.exec:\o240262.exe51⤵
- Executes dropped EXE
PID:376 -
\??\c:\4406828.exec:\4406828.exe52⤵
- Executes dropped EXE
PID:2832 -
\??\c:\646688.exec:\646688.exe53⤵
- Executes dropped EXE
PID:1596 -
\??\c:\g8002.exec:\g8002.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:660 -
\??\c:\86068.exec:\86068.exe55⤵
- Executes dropped EXE
PID:1716 -
\??\c:\2644068.exec:\2644068.exe56⤵
- Executes dropped EXE
PID:1060 -
\??\c:\6028024.exec:\6028024.exe57⤵
- Executes dropped EXE
PID:1648 -
\??\c:\602688.exec:\602688.exe58⤵
- Executes dropped EXE
PID:2212 -
\??\c:\m0224.exec:\m0224.exe59⤵
- Executes dropped EXE
PID:2352 -
\??\c:\82066.exec:\82066.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1144 -
\??\c:\2022844.exec:\2022844.exe61⤵
- Executes dropped EXE
PID:1896 -
\??\c:\0484068.exec:\0484068.exe62⤵
- Executes dropped EXE
PID:2096 -
\??\c:\040288.exec:\040288.exe63⤵
- Executes dropped EXE
PID:932 -
\??\c:\86440.exec:\86440.exe64⤵
- Executes dropped EXE
PID:1136 -
\??\c:\48062.exec:\48062.exe65⤵
- Executes dropped EXE
PID:1728 -
\??\c:\6466228.exec:\6466228.exe66⤵PID:2460
-
\??\c:\8644062.exec:\8644062.exe67⤵PID:1944
-
\??\c:\086248.exec:\086248.exe68⤵PID:2556
-
\??\c:\480648.exec:\480648.exe69⤵PID:1792
-
\??\c:\48002.exec:\48002.exe70⤵PID:652
-
\??\c:\64006.exec:\64006.exe71⤵PID:308
-
\??\c:\2022884.exec:\2022884.exe72⤵PID:2076
-
\??\c:\868628.exec:\868628.exe73⤵PID:1732
-
\??\c:\080066.exec:\080066.exe74⤵PID:2396
-
\??\c:\64440.exec:\64440.exe75⤵PID:1156
-
\??\c:\82402.exec:\82402.exe76⤵PID:2772
-
\??\c:\2624040.exec:\2624040.exe77⤵PID:2764
-
\??\c:\860688.exec:\860688.exe78⤵PID:2856
-
\??\c:\646626.exec:\646626.exe79⤵
- System Location Discovery: System Language Discovery
PID:2888 -
\??\c:\86228.exec:\86228.exe80⤵PID:2928
-
\??\c:\o084002.exec:\o084002.exe81⤵PID:2664
-
\??\c:\e64466.exec:\e64466.exe82⤵PID:2620
-
\??\c:\e62606.exec:\e62606.exe83⤵PID:1612
-
\??\c:\08068.exec:\08068.exe84⤵PID:2684
-
\??\c:\s0402.exec:\s0402.exe85⤵PID:2108
-
\??\c:\0800268.exec:\0800268.exe86⤵PID:2676
-
\??\c:\8060262.exec:\8060262.exe87⤵PID:2080
-
\??\c:\202406.exec:\202406.exe88⤵PID:1708
-
\??\c:\64006.exec:\64006.exe89⤵PID:2180
-
\??\c:\08440.exec:\08440.exe90⤵PID:2940
-
\??\c:\i244400.exec:\i244400.exe91⤵PID:448
-
\??\c:\w26484.exec:\w26484.exe92⤵PID:2812
-
\??\c:\480408.exec:\480408.exe93⤵PID:2672
-
\??\c:\60628.exec:\60628.exe94⤵PID:2600
-
\??\c:\a8440.exec:\a8440.exe95⤵PID:576
-
\??\c:\2022446.exec:\2022446.exe96⤵PID:1300
-
\??\c:\640682.exec:\640682.exe97⤵PID:2028
-
\??\c:\e86248.exec:\e86248.exe98⤵PID:3028
-
\??\c:\82468.exec:\82468.exe99⤵PID:2392
-
\??\c:\8200444.exec:\8200444.exe100⤵PID:528
-
\??\c:\246448.exec:\246448.exe101⤵PID:1492
-
\??\c:\824844.exec:\824844.exe102⤵PID:936
-
\??\c:\26846.exec:\26846.exe103⤵PID:692
-
\??\c:\s8406.exec:\s8406.exe104⤵PID:880
-
\??\c:\8684062.exec:\8684062.exe105⤵PID:748
-
\??\c:\8244602.exec:\8244602.exe106⤵PID:1616
-
\??\c:\646240.exec:\646240.exe107⤵PID:2484
-
\??\c:\808406.exec:\808406.exe108⤵PID:1432
-
\??\c:\68482.exec:\68482.exe109⤵PID:2532
-
\??\c:\0804668.exec:\0804668.exe110⤵PID:3060
-
\??\c:\i846440.exec:\i846440.exe111⤵PID:860
-
\??\c:\824060.exec:\824060.exe112⤵PID:1792
-
\??\c:\w42288.exec:\w42288.exe113⤵PID:652
-
\??\c:\64260.exec:\64260.exe114⤵PID:308
-
\??\c:\08004.exec:\08004.exe115⤵PID:548
-
\??\c:\6466622.exec:\6466622.exe116⤵PID:1732
-
\??\c:\0806622.exec:\0806622.exe117⤵PID:1680
-
\??\c:\468884.exec:\468884.exe118⤵PID:2944
-
\??\c:\862244.exec:\862244.exe119⤵PID:2896
-
\??\c:\s0806.exec:\s0806.exe120⤵PID:2732
-
\??\c:\64286.exec:\64286.exe121⤵PID:2856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-