Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 22:16
Behavioral task
behavioral1
Sample
4ccaca10d878daadbf4cf83be9561206691fc89dee26ac027c78eddefb88228d.exe
Resource
win7-20241023-en
General
-
Target
4ccaca10d878daadbf4cf83be9561206691fc89dee26ac027c78eddefb88228d.exe
-
Size
334KB
-
MD5
a3dbbd28f2a2d907d8b5433ae6909a96
-
SHA1
7a479aea6032abb1c4b75ab2c576fcf5856f1f1d
-
SHA256
4ccaca10d878daadbf4cf83be9561206691fc89dee26ac027c78eddefb88228d
-
SHA512
29edaa4cd14c9de5d037bb81f01ae52a650334d18f7b1dcab80047d696a70df2d9bf46f37e61d5b94a03ccce77d18440f069c8356612abea29b044e2789018eb
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeRO:R4wFHoSHYHUrAwfMp3CDRO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
Processes:
resource yara_rule behavioral1/memory/2452-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-103-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1952-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/792-135-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/792-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1932-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2172-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1896-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/444-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1120-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1288-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-549-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2140-573-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2780-598-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2748-663-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2748-683-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2540-696-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-719-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1852-782-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1548-883-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2516-894-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2384-12418-0x0000000077820000-0x000000007793F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lfxxrlr.exew64484.exea2606.exenbtbnn.exe820288.exebhhnbt.exe64228.exe2480804.exe66462.exevdjvp.exe7bhhhh.exem4668.exe60640.exe8202462.exejpjdj.exe408080.exew20622.exe9frlxll.exennbttn.exe824466.exennbthh.exejddjp.exe8842660.exepdvpd.exedvdjv.exevddvd.exei866840.exevpvpd.exejvpvd.exec824606.exeq02844.exerfrflfr.exek02460.exec680488.exe86802.exe3lrlxxx.exe2080224.exeddvpv.exe046026.exetnbhtt.exe3hbbhn.exehbnthn.exeo240662.exe2028066.exefxlrllx.exe860244.exe02848.exe66682.exe3thnnh.exe428640.exexfxlllf.exe3bhhhh.exebttnbn.exepjvdj.exenhhntb.exes8040.exe0044806.exes2000.exe82002.exe824068.exem4846.exe264080.exe3vjpp.exe866244.exepid process 2808 lfxxrlr.exe 2816 w64484.exe 2948 a2606.exe 3012 nbtbnn.exe 2944 820288.exe 2680 bhhnbt.exe 2532 64228.exe 1252 2480804.exe 2988 66462.exe 2164 vdjvp.exe 2080 7bhhhh.exe 2572 m4668.exe 1952 60640.exe 2844 8202462.exe 3048 jpjdj.exe 792 408080.exe 572 w20622.exe 2540 9frlxll.exe 1932 nnbttn.exe 1924 824466.exe 1864 nnbthh.exe 2224 jddjp.exe 2172 8842660.exe 444 pdvpd.exe 1896 dvdjv.exe 1120 vddvd.exe 1288 i866840.exe 324 vpvpd.exe 1988 jvpvd.exe 2332 c824606.exe 1688 q02844.exe 2200 rfrflfr.exe 1872 k02460.exe 1596 c680488.exe 2580 86802.exe 2452 3lrlxxx.exe 2784 2080224.exe 2860 ddvpv.exe 2968 046026.exe 2788 tnbhtt.exe 2996 3hbbhn.exe 2824 hbnthn.exe 2908 o240662.exe 2944 2028066.exe 1600 fxlrllx.exe 2532 860244.exe 1548 02848.exe 2524 66682.exe 2108 3thnnh.exe 2056 428640.exe 3032 xfxlllf.exe 1296 3bhhhh.exe 2572 bttnbn.exe 1440 pjvdj.exe 2748 nhhntb.exe 2868 s8040.exe 1208 0044806.exe 2480 s2000.exe 592 82002.exe 588 824068.exe 1556 m4846.exe 2324 264080.exe 1936 3vjpp.exe 2640 866244.exe -
Processes:
resource yara_rule behavioral1/memory/2452-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2452-7-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lfxxrlr.exe upx behavioral1/memory/2808-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2816-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\w64484.exe upx C:\a2606.exe upx behavioral1/memory/2816-25-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbtbnn.exe upx behavioral1/memory/2948-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-42-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\820288.exe upx C:\bhhnbt.exe upx behavioral1/memory/2680-57-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\64228.exe upx C:\2480804.exe upx \??\c:\66462.exe upx behavioral1/memory/2988-73-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vdjvp.exe upx behavioral1/memory/2988-80-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7bhhhh.exe upx behavioral1/memory/2164-89-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\m4668.exe upx C:\60640.exe upx behavioral1/memory/2572-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1952-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1952-115-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\8202462.exe upx C:\jpjdj.exe upx \??\c:\408080.exe upx behavioral1/memory/2844-124-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\w20622.exe upx behavioral1/memory/792-139-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9frlxll.exe upx C:\nnbttn.exe upx behavioral1/memory/1932-163-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\824466.exe upx behavioral1/memory/1924-172-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnbthh.exe upx behavioral1/memory/1864-179-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jddjp.exe upx C:\8842660.exe upx behavioral1/memory/2224-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2172-195-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdvpd.exe upx \??\c:\dvdjv.exe upx behavioral1/memory/1896-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/444-206-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vddvd.exe upx C:\i866840.exe upx behavioral1/memory/1120-222-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpvpd.exe upx behavioral1/memory/1288-230-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvpvd.exe upx C:\c824606.exe upx C:\q02844.exe upx C:\rfrflfr.exe upx behavioral1/memory/2200-268-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2580-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2580-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2968-301-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2788-307-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2788-313-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-324-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rlflrrl.exefxlxflx.exe60468.exec888406.exec460284.exerllrffr.exei046228.exe022226.exe7nbbhb.exei862424.exeq02844.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60468.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c888406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c460284.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i046228.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 022226.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i862424.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q02844.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4ccaca10d878daadbf4cf83be9561206691fc89dee26ac027c78eddefb88228d.exelfxxrlr.exew64484.exea2606.exenbtbnn.exe820288.exebhhnbt.exe64228.exe2480804.exe66462.exevdjvp.exe7bhhhh.exem4668.exe60640.exe8202462.exejpjdj.exedescription pid process target process PID 2452 wrote to memory of 2808 2452 4ccaca10d878daadbf4cf83be9561206691fc89dee26ac027c78eddefb88228d.exe lfxxrlr.exe PID 2452 wrote to memory of 2808 2452 4ccaca10d878daadbf4cf83be9561206691fc89dee26ac027c78eddefb88228d.exe lfxxrlr.exe PID 2452 wrote to memory of 2808 2452 4ccaca10d878daadbf4cf83be9561206691fc89dee26ac027c78eddefb88228d.exe lfxxrlr.exe PID 2452 wrote to memory of 2808 2452 4ccaca10d878daadbf4cf83be9561206691fc89dee26ac027c78eddefb88228d.exe lfxxrlr.exe PID 2808 wrote to memory of 2816 2808 lfxxrlr.exe w64484.exe PID 2808 wrote to memory of 2816 2808 lfxxrlr.exe w64484.exe PID 2808 wrote to memory of 2816 2808 lfxxrlr.exe w64484.exe PID 2808 wrote to memory of 2816 2808 lfxxrlr.exe w64484.exe PID 2816 wrote to memory of 2948 2816 w64484.exe a2606.exe PID 2816 wrote to memory of 2948 2816 w64484.exe a2606.exe PID 2816 wrote to memory of 2948 2816 w64484.exe a2606.exe PID 2816 wrote to memory of 2948 2816 w64484.exe a2606.exe PID 2948 wrote to memory of 3012 2948 a2606.exe nbtbnn.exe PID 2948 wrote to memory of 3012 2948 a2606.exe nbtbnn.exe PID 2948 wrote to memory of 3012 2948 a2606.exe nbtbnn.exe PID 2948 wrote to memory of 3012 2948 a2606.exe nbtbnn.exe PID 3012 wrote to memory of 2944 3012 nbtbnn.exe 820288.exe PID 3012 wrote to memory of 2944 3012 nbtbnn.exe 820288.exe PID 3012 wrote to memory of 2944 3012 nbtbnn.exe 820288.exe PID 3012 wrote to memory of 2944 3012 nbtbnn.exe 820288.exe PID 2944 wrote to memory of 2680 2944 820288.exe bhhnbt.exe PID 2944 wrote to memory of 2680 2944 820288.exe bhhnbt.exe PID 2944 wrote to memory of 2680 2944 820288.exe bhhnbt.exe PID 2944 wrote to memory of 2680 2944 820288.exe bhhnbt.exe PID 2680 wrote to memory of 2532 2680 bhhnbt.exe 64228.exe PID 2680 wrote to memory of 2532 2680 bhhnbt.exe 64228.exe PID 2680 wrote to memory of 2532 2680 bhhnbt.exe 64228.exe PID 2680 wrote to memory of 2532 2680 bhhnbt.exe 64228.exe PID 2532 wrote to memory of 1252 2532 64228.exe 2480804.exe PID 2532 wrote to memory of 1252 2532 64228.exe 2480804.exe PID 2532 wrote to memory of 1252 2532 64228.exe 2480804.exe PID 2532 wrote to memory of 1252 2532 64228.exe 2480804.exe PID 1252 wrote to memory of 2988 1252 2480804.exe 66462.exe PID 1252 wrote to memory of 2988 1252 2480804.exe 66462.exe PID 1252 wrote to memory of 2988 1252 2480804.exe 66462.exe PID 1252 wrote to memory of 2988 1252 2480804.exe 66462.exe PID 2988 wrote to memory of 2164 2988 66462.exe vdjvp.exe PID 2988 wrote to memory of 2164 2988 66462.exe vdjvp.exe PID 2988 wrote to memory of 2164 2988 66462.exe vdjvp.exe PID 2988 wrote to memory of 2164 2988 66462.exe vdjvp.exe PID 2164 wrote to memory of 2080 2164 vdjvp.exe 7bhhhh.exe PID 2164 wrote to memory of 2080 2164 vdjvp.exe 7bhhhh.exe PID 2164 wrote to memory of 2080 2164 vdjvp.exe 7bhhhh.exe PID 2164 wrote to memory of 2080 2164 vdjvp.exe 7bhhhh.exe PID 2080 wrote to memory of 2572 2080 7bhhhh.exe m4668.exe PID 2080 wrote to memory of 2572 2080 7bhhhh.exe m4668.exe PID 2080 wrote to memory of 2572 2080 7bhhhh.exe m4668.exe PID 2080 wrote to memory of 2572 2080 7bhhhh.exe m4668.exe PID 2572 wrote to memory of 1952 2572 m4668.exe 60640.exe PID 2572 wrote to memory of 1952 2572 m4668.exe 60640.exe PID 2572 wrote to memory of 1952 2572 m4668.exe 60640.exe PID 2572 wrote to memory of 1952 2572 m4668.exe 60640.exe PID 1952 wrote to memory of 2844 1952 60640.exe 8202462.exe PID 1952 wrote to memory of 2844 1952 60640.exe 8202462.exe PID 1952 wrote to memory of 2844 1952 60640.exe 8202462.exe PID 1952 wrote to memory of 2844 1952 60640.exe 8202462.exe PID 2844 wrote to memory of 3048 2844 8202462.exe jpjdj.exe PID 2844 wrote to memory of 3048 2844 8202462.exe jpjdj.exe PID 2844 wrote to memory of 3048 2844 8202462.exe jpjdj.exe PID 2844 wrote to memory of 3048 2844 8202462.exe jpjdj.exe PID 3048 wrote to memory of 792 3048 jpjdj.exe 408080.exe PID 3048 wrote to memory of 792 3048 jpjdj.exe 408080.exe PID 3048 wrote to memory of 792 3048 jpjdj.exe 408080.exe PID 3048 wrote to memory of 792 3048 jpjdj.exe 408080.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ccaca10d878daadbf4cf83be9561206691fc89dee26ac027c78eddefb88228d.exe"C:\Users\Admin\AppData\Local\Temp\4ccaca10d878daadbf4cf83be9561206691fc89dee26ac027c78eddefb88228d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\lfxxrlr.exec:\lfxxrlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\w64484.exec:\w64484.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\a2606.exec:\a2606.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\nbtbnn.exec:\nbtbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\820288.exec:\820288.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\bhhnbt.exec:\bhhnbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\64228.exec:\64228.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\2480804.exec:\2480804.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\66462.exec:\66462.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\vdjvp.exec:\vdjvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\7bhhhh.exec:\7bhhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\m4668.exec:\m4668.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\60640.exec:\60640.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\8202462.exec:\8202462.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\jpjdj.exec:\jpjdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\408080.exec:\408080.exe17⤵
- Executes dropped EXE
PID:792 -
\??\c:\w20622.exec:\w20622.exe18⤵
- Executes dropped EXE
PID:572 -
\??\c:\9frlxll.exec:\9frlxll.exe19⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nnbttn.exec:\nnbttn.exe20⤵
- Executes dropped EXE
PID:1932 -
\??\c:\824466.exec:\824466.exe21⤵
- Executes dropped EXE
PID:1924 -
\??\c:\nnbthh.exec:\nnbthh.exe22⤵
- Executes dropped EXE
PID:1864 -
\??\c:\jddjp.exec:\jddjp.exe23⤵
- Executes dropped EXE
PID:2224 -
\??\c:\8842660.exec:\8842660.exe24⤵
- Executes dropped EXE
PID:2172 -
\??\c:\pdvpd.exec:\pdvpd.exe25⤵
- Executes dropped EXE
PID:444 -
\??\c:\dvdjv.exec:\dvdjv.exe26⤵
- Executes dropped EXE
PID:1896 -
\??\c:\vddvd.exec:\vddvd.exe27⤵
- Executes dropped EXE
PID:1120 -
\??\c:\i866840.exec:\i866840.exe28⤵
- Executes dropped EXE
PID:1288 -
\??\c:\vpvpd.exec:\vpvpd.exe29⤵
- Executes dropped EXE
PID:324 -
\??\c:\jvpvd.exec:\jvpvd.exe30⤵
- Executes dropped EXE
PID:1988 -
\??\c:\c824606.exec:\c824606.exe31⤵
- Executes dropped EXE
PID:2332 -
\??\c:\q02844.exec:\q02844.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1688 -
\??\c:\rfrflfr.exec:\rfrflfr.exe33⤵
- Executes dropped EXE
PID:2200 -
\??\c:\k02460.exec:\k02460.exe34⤵
- Executes dropped EXE
PID:1872 -
\??\c:\c680488.exec:\c680488.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\86802.exec:\86802.exe36⤵
- Executes dropped EXE
PID:2580 -
\??\c:\3lrlxxx.exec:\3lrlxxx.exe37⤵
- Executes dropped EXE
PID:2452 -
\??\c:\2080224.exec:\2080224.exe38⤵
- Executes dropped EXE
PID:2784 -
\??\c:\ddvpv.exec:\ddvpv.exe39⤵
- Executes dropped EXE
PID:2860 -
\??\c:\046026.exec:\046026.exe40⤵
- Executes dropped EXE
PID:2968 -
\??\c:\tnbhtt.exec:\tnbhtt.exe41⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3hbbhn.exec:\3hbbhn.exe42⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hbnthn.exec:\hbnthn.exe43⤵
- Executes dropped EXE
PID:2824 -
\??\c:\o240662.exec:\o240662.exe44⤵
- Executes dropped EXE
PID:2908 -
\??\c:\2028066.exec:\2028066.exe45⤵
- Executes dropped EXE
PID:2944 -
\??\c:\fxlrllx.exec:\fxlrllx.exe46⤵
- Executes dropped EXE
PID:1600 -
\??\c:\860244.exec:\860244.exe47⤵
- Executes dropped EXE
PID:2532 -
\??\c:\02848.exec:\02848.exe48⤵
- Executes dropped EXE
PID:1548 -
\??\c:\66682.exec:\66682.exe49⤵
- Executes dropped EXE
PID:2524 -
\??\c:\3thnnh.exec:\3thnnh.exe50⤵
- Executes dropped EXE
PID:2108 -
\??\c:\428640.exec:\428640.exe51⤵
- Executes dropped EXE
PID:2056 -
\??\c:\xfxlllf.exec:\xfxlllf.exe52⤵
- Executes dropped EXE
PID:3032 -
\??\c:\3bhhhh.exec:\3bhhhh.exe53⤵
- Executes dropped EXE
PID:1296 -
\??\c:\bttnbn.exec:\bttnbn.exe54⤵
- Executes dropped EXE
PID:2572 -
\??\c:\pjvdj.exec:\pjvdj.exe55⤵
- Executes dropped EXE
PID:1440 -
\??\c:\nhhntb.exec:\nhhntb.exe56⤵
- Executes dropped EXE
PID:2748 -
\??\c:\s8040.exec:\s8040.exe57⤵
- Executes dropped EXE
PID:2868 -
\??\c:\0044806.exec:\0044806.exe58⤵
- Executes dropped EXE
PID:1208 -
\??\c:\s2000.exec:\s2000.exe59⤵
- Executes dropped EXE
PID:2480 -
\??\c:\82002.exec:\82002.exe60⤵
- Executes dropped EXE
PID:592 -
\??\c:\824068.exec:\824068.exe61⤵
- Executes dropped EXE
PID:588 -
\??\c:\m4846.exec:\m4846.exe62⤵
- Executes dropped EXE
PID:1556 -
\??\c:\264080.exec:\264080.exe63⤵
- Executes dropped EXE
PID:2324 -
\??\c:\3vjpp.exec:\3vjpp.exe64⤵
- Executes dropped EXE
PID:1936 -
\??\c:\866244.exec:\866244.exe65⤵
- Executes dropped EXE
PID:2640 -
\??\c:\08624.exec:\08624.exe66⤵PID:2644
-
\??\c:\bbhttb.exec:\bbhttb.exe67⤵PID:2232
-
\??\c:\2664620.exec:\2664620.exe68⤵PID:2236
-
\??\c:\q20022.exec:\q20022.exe69⤵PID:2440
-
\??\c:\xrxxrfr.exec:\xrxxrfr.exe70⤵PID:2060
-
\??\c:\5jvdj.exec:\5jvdj.exe71⤵PID:1832
-
\??\c:\0464828.exec:\0464828.exe72⤵PID:1108
-
\??\c:\0828000.exec:\0828000.exe73⤵PID:1672
-
\??\c:\e24028.exec:\e24028.exe74⤵PID:1976
-
\??\c:\lflxxlx.exec:\lflxxlx.exe75⤵PID:1192
-
\??\c:\6028880.exec:\6028880.exe76⤵PID:836
-
\??\c:\rfrxxxl.exec:\rfrxxxl.exe77⤵PID:920
-
\??\c:\rlxfllr.exec:\rlxfllr.exe78⤵PID:1988
-
\??\c:\c600222.exec:\c600222.exe79⤵PID:2020
-
\??\c:\jdvjv.exec:\jdvjv.exe80⤵PID:2412
-
\??\c:\e24084.exec:\e24084.exe81⤵PID:932
-
\??\c:\7pjjj.exec:\7pjjj.exe82⤵PID:2200
-
\??\c:\48620.exec:\48620.exe83⤵PID:1448
-
\??\c:\jjjvd.exec:\jjjvd.exe84⤵PID:1444
-
\??\c:\u688446.exec:\u688446.exe85⤵PID:2764
-
\??\c:\vjvdp.exec:\vjvdp.exe86⤵PID:2136
-
\??\c:\202844.exec:\202844.exe87⤵PID:2912
-
\??\c:\hbtthn.exec:\hbtthn.exe88⤵PID:1536
-
\??\c:\264426.exec:\264426.exe89⤵PID:2140
-
\??\c:\1pjjj.exec:\1pjjj.exe90⤵PID:2820
-
\??\c:\64664.exec:\64664.exe91⤵PID:2936
-
\??\c:\9tnhnn.exec:\9tnhnn.exe92⤵PID:2688
-
\??\c:\rllxlxl.exec:\rllxlxl.exe93⤵PID:2692
-
\??\c:\82080.exec:\82080.exe94⤵PID:2780
-
\??\c:\0086400.exec:\0086400.exe95⤵PID:268
-
\??\c:\48006.exec:\48006.exe96⤵PID:2828
-
\??\c:\bhhtht.exec:\bhhtht.exe97⤵PID:1252
-
\??\c:\nhtbnn.exec:\nhtbnn.exe98⤵PID:2404
-
\??\c:\8644662.exec:\8644662.exe99⤵PID:2756
-
\??\c:\jdvjv.exec:\jdvjv.exe100⤵PID:2272
-
\??\c:\0048260.exec:\0048260.exe101⤵PID:2080
-
\??\c:\5vpdp.exec:\5vpdp.exe102⤵PID:2156
-
\??\c:\bbtbnt.exec:\bbtbnt.exe103⤵PID:2876
-
\??\c:\446226.exec:\446226.exe104⤵PID:2880
-
\??\c:\nnbhbb.exec:\nnbhbb.exe105⤵PID:2748
-
\??\c:\vvjpj.exec:\vvjpj.exe106⤵PID:864
-
\??\c:\640600.exec:\640600.exe107⤵PID:2984
-
\??\c:\btbtht.exec:\btbtht.exe108⤵PID:1432
-
\??\c:\vjddv.exec:\vjddv.exe109⤵PID:1048
-
\??\c:\vvpdd.exec:\vvpdd.exe110⤵PID:2540
-
\??\c:\xrfrllr.exec:\xrfrllr.exe111⤵PID:1728
-
\??\c:\7xrxlrx.exec:\7xrxlrx.exe112⤵PID:2428
-
\??\c:\dvvjd.exec:\dvvjd.exe113⤵PID:2076
-
\??\c:\60402.exec:\60402.exe114⤵PID:2408
-
\??\c:\ntnbbn.exec:\ntnbbn.exe115⤵PID:2232
-
\??\c:\06680.exec:\06680.exe116⤵PID:2184
-
\??\c:\thtbbb.exec:\thtbbb.exe117⤵PID:2440
-
\??\c:\9pjvv.exec:\9pjvv.exe118⤵PID:1104
-
\??\c:\808804.exec:\808804.exe119⤵PID:1832
-
\??\c:\bnhhhb.exec:\bnhhhb.exe120⤵PID:1108
-
\??\c:\66060.exec:\66060.exe121⤵PID:1672
-
\??\c:\c422002.exec:\c422002.exe122⤵PID:1480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-