Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 01:57
Static task
static1
Behavioral task
behavioral1
Sample
8ee1379ee9b3ad588715e12bbea03acf1c771c6449ceab360fb1e0ac4c8d8ce2.exe
Resource
win7-20241023-en
General
-
Target
8ee1379ee9b3ad588715e12bbea03acf1c771c6449ceab360fb1e0ac4c8d8ce2.exe
-
Size
455KB
-
MD5
3ab6b4f090cbbed10e9b78296a059cad
-
SHA1
14c2b8d29fba31a45631b7e47260511470779f11
-
SHA256
8ee1379ee9b3ad588715e12bbea03acf1c771c6449ceab360fb1e0ac4c8d8ce2
-
SHA512
62338cb1353e1a90263d8764b989230ce6fa91be7864f7c61a652030b2132fd7f7d788b4cf464fbdf3551ca0335a272d0062b6319e129ffe6643ef54e2a04b6a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR7:q7Tc2NYHUrAwfMp3CDR7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
Processes:
resource yara_rule behavioral1/memory/2360-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-31-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/1828-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/788-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-71-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2380-80-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-89-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2092-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-108-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1856-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-126-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3000-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/868-140-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/868-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-146-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/536-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-269-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/484-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-509-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2732-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-515-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1064-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-555-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2360-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-664-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/3032-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-713-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2656-731-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1508-766-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-805-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-831-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-953-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-967-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2732-1051-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
04286.exe9dppp.exe48246.exe48286.exe6046846.exe1dvjp.exe86462.exelfxxflr.exek64066.exe7frxflr.exefxllrrf.exe264088.exe3rfxffx.exem2028.exe7bhbbb.exe1bntbb.exe860020.exe08286.exe88460.exe08286.exe4806846.exe260280.exe60286.exefxllflx.exeddvjp.exerrlrxxf.exevpddd.exexrlrflr.exejdvvd.exe4806220.exejjvdj.exerfxfflx.exe608062.exedvjpv.exepvdpj.exelfrrflx.exe640826.exe6028824.exe9dpvj.exevvpjv.exehnbbhn.exe7rffllx.exexlxrxrx.exeu800220.exe4800224.exe2662824.exes0224.exe5bttbb.exeu824220.exe48846.exedddpd.exepjdjd.exellflxfr.exebnbbhn.exe0806884.exe2022880.exe2040608.exedvppd.exe7btbbh.exejdvvd.exe428466.exe4806288.exe3xlrlrr.exelflrffr.exepid process 1512 04286.exe 320 9dppp.exe 1828 48246.exe 2152 48286.exe 2888 6046846.exe 788 1dvjp.exe 2952 86462.exe 2380 lfxxflr.exe 2692 k64066.exe 2092 7frxflr.exe 2136 fxllrrf.exe 1856 264088.exe 3000 3rfxffx.exe 868 m2028.exe 3004 7bhbbb.exe 1680 1bntbb.exe 536 860020.exe 2072 08286.exe 2460 88460.exe 1096 08286.exe 1692 4806846.exe 2424 260280.exe 1040 60286.exe 2876 fxllflx.exe 2584 ddvjp.exe 888 rrlrxxf.exe 2268 vpddd.exe 1496 xrlrflr.exe 2356 jdvvd.exe 484 4806220.exe 1748 jjvdj.exe 1600 rfxfflx.exe 400 608062.exe 2512 dvjpv.exe 2664 pvdpj.exe 2788 lfrrflx.exe 2440 640826.exe 2916 6028824.exe 2896 9dpvj.exe 2812 vvpjv.exe 2988 hnbbhn.exe 2952 7rffllx.exe 2868 xlxrxrx.exe 2712 u800220.exe 2352 4800224.exe 2816 2662824.exe 588 s0224.exe 3064 5bttbb.exe 2144 u824220.exe 3000 48846.exe 908 dddpd.exe 1928 pjdjd.exe 2980 llflxfr.exe 544 bnbbhn.exe 1296 0806884.exe 2656 2022880.exe 2240 2040608.exe 2272 dvppd.exe 1940 7btbbh.exe 1864 jdvvd.exe 2476 428466.exe 1944 4806288.exe 624 3xlrlrr.exe 2732 lflrffr.exe -
Processes:
resource yara_rule behavioral1/memory/2360-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-101-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1856-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-211-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2584-239-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2268-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-555-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2360-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-798-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-805-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-824-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-831-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-878-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-891-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-940-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-953-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-994-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-1053-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-1066-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-1073-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
nhthnn.exebbbhnn.exebhhnbb.exe048804.exejdpvd.exe424066.exeu202488.exevvpvj.exe4800224.exe824888.exeu240884.exea6806.exe5flrrxf.exe826288.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 048804.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 424066.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u202488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4800224.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 824888.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u240884.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a6806.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 826288.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8ee1379ee9b3ad588715e12bbea03acf1c771c6449ceab360fb1e0ac4c8d8ce2.exe04286.exe9dppp.exe48246.exe48286.exe6046846.exe1dvjp.exe86462.exelfxxflr.exek64066.exe7frxflr.exefxllrrf.exe264088.exe3rfxffx.exem2028.exe7bhbbb.exedescription pid process target process PID 2360 wrote to memory of 1512 2360 8ee1379ee9b3ad588715e12bbea03acf1c771c6449ceab360fb1e0ac4c8d8ce2.exe 04286.exe PID 2360 wrote to memory of 1512 2360 8ee1379ee9b3ad588715e12bbea03acf1c771c6449ceab360fb1e0ac4c8d8ce2.exe 04286.exe PID 2360 wrote to memory of 1512 2360 8ee1379ee9b3ad588715e12bbea03acf1c771c6449ceab360fb1e0ac4c8d8ce2.exe 04286.exe PID 2360 wrote to memory of 1512 2360 8ee1379ee9b3ad588715e12bbea03acf1c771c6449ceab360fb1e0ac4c8d8ce2.exe 04286.exe PID 1512 wrote to memory of 320 1512 04286.exe 9dppp.exe PID 1512 wrote to memory of 320 1512 04286.exe 9dppp.exe PID 1512 wrote to memory of 320 1512 04286.exe 9dppp.exe PID 1512 wrote to memory of 320 1512 04286.exe 9dppp.exe PID 320 wrote to memory of 1828 320 9dppp.exe 48246.exe PID 320 wrote to memory of 1828 320 9dppp.exe 48246.exe PID 320 wrote to memory of 1828 320 9dppp.exe 48246.exe PID 320 wrote to memory of 1828 320 9dppp.exe 48246.exe PID 1828 wrote to memory of 2152 1828 48246.exe 48286.exe PID 1828 wrote to memory of 2152 1828 48246.exe 48286.exe PID 1828 wrote to memory of 2152 1828 48246.exe 48286.exe PID 1828 wrote to memory of 2152 1828 48246.exe 48286.exe PID 2152 wrote to memory of 2888 2152 48286.exe 6046846.exe PID 2152 wrote to memory of 2888 2152 48286.exe 6046846.exe PID 2152 wrote to memory of 2888 2152 48286.exe 6046846.exe PID 2152 wrote to memory of 2888 2152 48286.exe 6046846.exe PID 2888 wrote to memory of 788 2888 6046846.exe 1dvjp.exe PID 2888 wrote to memory of 788 2888 6046846.exe 1dvjp.exe PID 2888 wrote to memory of 788 2888 6046846.exe 1dvjp.exe PID 2888 wrote to memory of 788 2888 6046846.exe 1dvjp.exe PID 788 wrote to memory of 2952 788 1dvjp.exe 86462.exe PID 788 wrote to memory of 2952 788 1dvjp.exe 86462.exe PID 788 wrote to memory of 2952 788 1dvjp.exe 86462.exe PID 788 wrote to memory of 2952 788 1dvjp.exe 86462.exe PID 2952 wrote to memory of 2380 2952 86462.exe lfxxflr.exe PID 2952 wrote to memory of 2380 2952 86462.exe lfxxflr.exe PID 2952 wrote to memory of 2380 2952 86462.exe lfxxflr.exe PID 2952 wrote to memory of 2380 2952 86462.exe lfxxflr.exe PID 2380 wrote to memory of 2692 2380 lfxxflr.exe k64066.exe PID 2380 wrote to memory of 2692 2380 lfxxflr.exe k64066.exe PID 2380 wrote to memory of 2692 2380 lfxxflr.exe k64066.exe PID 2380 wrote to memory of 2692 2380 lfxxflr.exe k64066.exe PID 2692 wrote to memory of 2092 2692 k64066.exe 7frxflr.exe PID 2692 wrote to memory of 2092 2692 k64066.exe 7frxflr.exe PID 2692 wrote to memory of 2092 2692 k64066.exe 7frxflr.exe PID 2692 wrote to memory of 2092 2692 k64066.exe 7frxflr.exe PID 2092 wrote to memory of 2136 2092 7frxflr.exe fxllrrf.exe PID 2092 wrote to memory of 2136 2092 7frxflr.exe fxllrrf.exe PID 2092 wrote to memory of 2136 2092 7frxflr.exe fxllrrf.exe PID 2092 wrote to memory of 2136 2092 7frxflr.exe fxllrrf.exe PID 2136 wrote to memory of 1856 2136 fxllrrf.exe 264088.exe PID 2136 wrote to memory of 1856 2136 fxllrrf.exe 264088.exe PID 2136 wrote to memory of 1856 2136 fxllrrf.exe 264088.exe PID 2136 wrote to memory of 1856 2136 fxllrrf.exe 264088.exe PID 1856 wrote to memory of 3000 1856 264088.exe 3rfxffx.exe PID 1856 wrote to memory of 3000 1856 264088.exe 3rfxffx.exe PID 1856 wrote to memory of 3000 1856 264088.exe 3rfxffx.exe PID 1856 wrote to memory of 3000 1856 264088.exe 3rfxffx.exe PID 3000 wrote to memory of 868 3000 3rfxffx.exe m2028.exe PID 3000 wrote to memory of 868 3000 3rfxffx.exe m2028.exe PID 3000 wrote to memory of 868 3000 3rfxffx.exe m2028.exe PID 3000 wrote to memory of 868 3000 3rfxffx.exe m2028.exe PID 868 wrote to memory of 3004 868 m2028.exe 7bhbbb.exe PID 868 wrote to memory of 3004 868 m2028.exe 7bhbbb.exe PID 868 wrote to memory of 3004 868 m2028.exe 7bhbbb.exe PID 868 wrote to memory of 3004 868 m2028.exe 7bhbbb.exe PID 3004 wrote to memory of 1680 3004 7bhbbb.exe 1bntbb.exe PID 3004 wrote to memory of 1680 3004 7bhbbb.exe 1bntbb.exe PID 3004 wrote to memory of 1680 3004 7bhbbb.exe 1bntbb.exe PID 3004 wrote to memory of 1680 3004 7bhbbb.exe 1bntbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ee1379ee9b3ad588715e12bbea03acf1c771c6449ceab360fb1e0ac4c8d8ce2.exe"C:\Users\Admin\AppData\Local\Temp\8ee1379ee9b3ad588715e12bbea03acf1c771c6449ceab360fb1e0ac4c8d8ce2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\04286.exec:\04286.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\9dppp.exec:\9dppp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\48246.exec:\48246.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\48286.exec:\48286.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\6046846.exec:\6046846.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\1dvjp.exec:\1dvjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
\??\c:\86462.exec:\86462.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\lfxxflr.exec:\lfxxflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\k64066.exec:\k64066.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\7frxflr.exec:\7frxflr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\fxllrrf.exec:\fxllrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\264088.exec:\264088.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\3rfxffx.exec:\3rfxffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\m2028.exec:\m2028.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\7bhbbb.exec:\7bhbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\1bntbb.exec:\1bntbb.exe17⤵
- Executes dropped EXE
PID:1680 -
\??\c:\860020.exec:\860020.exe18⤵
- Executes dropped EXE
PID:536 -
\??\c:\08286.exec:\08286.exe19⤵
- Executes dropped EXE
PID:2072 -
\??\c:\88460.exec:\88460.exe20⤵
- Executes dropped EXE
PID:2460 -
\??\c:\08286.exec:\08286.exe21⤵
- Executes dropped EXE
PID:1096 -
\??\c:\4806846.exec:\4806846.exe22⤵
- Executes dropped EXE
PID:1692 -
\??\c:\260280.exec:\260280.exe23⤵
- Executes dropped EXE
PID:2424 -
\??\c:\60286.exec:\60286.exe24⤵
- Executes dropped EXE
PID:1040 -
\??\c:\fxllflx.exec:\fxllflx.exe25⤵
- Executes dropped EXE
PID:2876 -
\??\c:\ddvjp.exec:\ddvjp.exe26⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rrlrxxf.exec:\rrlrxxf.exe27⤵
- Executes dropped EXE
PID:888 -
\??\c:\vpddd.exec:\vpddd.exe28⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xrlrflr.exec:\xrlrflr.exe29⤵
- Executes dropped EXE
PID:1496 -
\??\c:\jdvvd.exec:\jdvvd.exe30⤵
- Executes dropped EXE
PID:2356 -
\??\c:\4806220.exec:\4806220.exe31⤵
- Executes dropped EXE
PID:484 -
\??\c:\jjvdj.exec:\jjvdj.exe32⤵
- Executes dropped EXE
PID:1748 -
\??\c:\rfxfflx.exec:\rfxfflx.exe33⤵
- Executes dropped EXE
PID:1600 -
\??\c:\608062.exec:\608062.exe34⤵
- Executes dropped EXE
PID:400 -
\??\c:\dvjpv.exec:\dvjpv.exe35⤵
- Executes dropped EXE
PID:2512 -
\??\c:\pvdpj.exec:\pvdpj.exe36⤵
- Executes dropped EXE
PID:2664 -
\??\c:\lfrrflx.exec:\lfrrflx.exe37⤵
- Executes dropped EXE
PID:2788 -
\??\c:\640826.exec:\640826.exe38⤵
- Executes dropped EXE
PID:2440 -
\??\c:\6028824.exec:\6028824.exe39⤵
- Executes dropped EXE
PID:2916 -
\??\c:\9dpvj.exec:\9dpvj.exe40⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vvpjv.exec:\vvpjv.exe41⤵
- Executes dropped EXE
PID:2812 -
\??\c:\hnbbhn.exec:\hnbbhn.exe42⤵
- Executes dropped EXE
PID:2988 -
\??\c:\7rffllx.exec:\7rffllx.exe43⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xlxrxrx.exec:\xlxrxrx.exe44⤵
- Executes dropped EXE
PID:2868 -
\??\c:\u800220.exec:\u800220.exe45⤵
- Executes dropped EXE
PID:2712 -
\??\c:\4800224.exec:\4800224.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2352 -
\??\c:\2662824.exec:\2662824.exe47⤵
- Executes dropped EXE
PID:2816 -
\??\c:\s0224.exec:\s0224.exe48⤵
- Executes dropped EXE
PID:588 -
\??\c:\5bttbb.exec:\5bttbb.exe49⤵
- Executes dropped EXE
PID:3064 -
\??\c:\u824220.exec:\u824220.exe50⤵
- Executes dropped EXE
PID:2144 -
\??\c:\48846.exec:\48846.exe51⤵
- Executes dropped EXE
PID:3000 -
\??\c:\dddpd.exec:\dddpd.exe52⤵
- Executes dropped EXE
PID:908 -
\??\c:\pjdjd.exec:\pjdjd.exe53⤵
- Executes dropped EXE
PID:1928 -
\??\c:\llflxfr.exec:\llflxfr.exe54⤵
- Executes dropped EXE
PID:2980 -
\??\c:\bnbbhn.exec:\bnbbhn.exe55⤵
- Executes dropped EXE
PID:544 -
\??\c:\0806884.exec:\0806884.exe56⤵
- Executes dropped EXE
PID:1296 -
\??\c:\2022880.exec:\2022880.exe57⤵
- Executes dropped EXE
PID:2656 -
\??\c:\2040608.exec:\2040608.exe58⤵
- Executes dropped EXE
PID:2240 -
\??\c:\dvppd.exec:\dvppd.exe59⤵
- Executes dropped EXE
PID:2272 -
\??\c:\7btbbh.exec:\7btbbh.exe60⤵
- Executes dropped EXE
PID:1940 -
\??\c:\jdvvd.exec:\jdvvd.exe61⤵
- Executes dropped EXE
PID:1864 -
\??\c:\428466.exec:\428466.exe62⤵
- Executes dropped EXE
PID:2476 -
\??\c:\4806288.exec:\4806288.exe63⤵
- Executes dropped EXE
PID:1944 -
\??\c:\3xlrlrr.exec:\3xlrlrr.exe64⤵
- Executes dropped EXE
PID:624 -
\??\c:\lflrffr.exec:\lflrffr.exe65⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jdvdd.exec:\jdvdd.exe66⤵PID:2496
-
\??\c:\5pjjp.exec:\5pjjp.exe67⤵PID:1560
-
\??\c:\264022.exec:\264022.exe68⤵PID:1792
-
\??\c:\60844.exec:\60844.exe69⤵PID:2268
-
\??\c:\008068.exec:\008068.exe70⤵PID:2064
-
\??\c:\lxflllf.exec:\lxflllf.exe71⤵PID:1064
-
\??\c:\a4002.exec:\a4002.exe72⤵PID:884
-
\??\c:\6488446.exec:\6488446.exe73⤵PID:2244
-
\??\c:\82068.exec:\82068.exe74⤵PID:1608
-
\??\c:\vjvdv.exec:\vjvdv.exe75⤵PID:2360
-
\??\c:\thtthn.exec:\thtthn.exe76⤵PID:1512
-
\??\c:\s0846.exec:\s0846.exe77⤵PID:2532
-
\??\c:\u240884.exec:\u240884.exe78⤵
- System Location Discovery: System Language Discovery
PID:2636 -
\??\c:\vvvpd.exec:\vvvpd.exe79⤵PID:1828
-
\??\c:\m2668.exec:\m2668.exe80⤵PID:2824
-
\??\c:\w04862.exec:\w04862.exe81⤵PID:2820
-
\??\c:\m8684.exec:\m8684.exe82⤵PID:2916
-
\??\c:\604628.exec:\604628.exe83⤵PID:2728
-
\??\c:\20008.exec:\20008.exe84⤵PID:2808
-
\??\c:\26046.exec:\26046.exe85⤵PID:2796
-
\??\c:\g6068.exec:\g6068.exe86⤵PID:2724
-
\??\c:\xxxfxff.exec:\xxxfxff.exe87⤵PID:2760
-
\??\c:\k20640.exec:\k20640.exe88⤵PID:2864
-
\??\c:\8206840.exec:\8206840.exe89⤵PID:2336
-
\??\c:\60284.exec:\60284.exe90⤵PID:3032
-
\??\c:\xrllrrx.exec:\xrllrrx.exe91⤵PID:3056
-
\??\c:\fxlxxxx.exec:\fxlxxxx.exe92⤵PID:3040
-
\??\c:\llldpvd.exec:\llldpvd.exe93⤵PID:1528
-
\??\c:\646282.exec:\646282.exe94⤵PID:3028
-
\??\c:\1dvpv.exec:\1dvpv.exe95⤵PID:2872
-
\??\c:\4046460.exec:\4046460.exe96⤵PID:3024
-
\??\c:\264060.exec:\264060.exe97⤵PID:2156
-
\??\c:\tnbhnt.exec:\tnbhnt.exe98⤵PID:544
-
\??\c:\i862442.exec:\i862442.exe99⤵PID:1296
-
\??\c:\rxlfrxl.exec:\rxlfrxl.exe100⤵PID:2656
-
\??\c:\ttbbnt.exec:\ttbbnt.exe101⤵PID:1976
-
\??\c:\24806.exec:\24806.exe102⤵PID:2200
-
\??\c:\o082888.exec:\o082888.exe103⤵PID:864
-
\??\c:\nbhbhb.exec:\nbhbhb.exe104⤵PID:1032
-
\??\c:\424066.exec:\424066.exe105⤵
- System Location Discovery: System Language Discovery
PID:1508 -
\??\c:\xrxfxrr.exec:\xrxfxrr.exe106⤵PID:1780
-
\??\c:\g2064.exec:\g2064.exe107⤵PID:624
-
\??\c:\080622.exec:\080622.exe108⤵PID:2584
-
\??\c:\60840.exec:\60840.exe109⤵PID:1548
-
\??\c:\242804.exec:\242804.exe110⤵PID:2668
-
\??\c:\pdppv.exec:\pdppv.exe111⤵PID:2224
-
\??\c:\jvjjp.exec:\jvjjp.exe112⤵PID:2560
-
\??\c:\o822402.exec:\o822402.exe113⤵PID:2880
-
\??\c:\448622.exec:\448622.exe114⤵PID:1668
-
\??\c:\820682.exec:\820682.exe115⤵PID:2540
-
\??\c:\s4684.exec:\s4684.exe116⤵PID:2000
-
\??\c:\080448.exec:\080448.exe117⤵PID:2044
-
\??\c:\xxlrrrx.exec:\xxlrrrx.exe118⤵PID:2348
-
\??\c:\rlxfrfl.exec:\rlxfrfl.exe119⤵PID:400
-
\??\c:\8622288.exec:\8622288.exe120⤵PID:2632
-
\??\c:\1xllllr.exec:\1xllllr.exe121⤵PID:2520
-
\??\c:\o466440.exec:\o466440.exe122⤵PID:2788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-