Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 02:04
Static task
static1
Behavioral task
behavioral1
Sample
926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe
Resource
win7-20241010-en
General
-
Target
926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe
-
Size
453KB
-
MD5
f0669a0ecc6efac4e3159d57b9ce7ee9
-
SHA1
6e9abbd2a5e52fb8dd8023332cc7f593c2bf6798
-
SHA256
926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5
-
SHA512
3b46cfe494247febf41d5d9edd315ab01e0081eb21a7d678e44378a10434eae33d53b35295d481cf9ccae7cd32fa497f9869be5dbc974339d88eb48e01bcdaf0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
Processes:
resource yara_rule behavioral1/memory/2372-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-68-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2780-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-89-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2768-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-98-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/2624-105-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2624-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-110-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/988-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-176-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2000-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-184-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1712-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-248-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/876-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-417-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2156-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/444-499-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1516-519-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1968-539-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1768-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-560-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1544-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-592-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2724-632-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2036-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-704-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-741-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/780-784-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1764-809-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/884-834-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2412-847-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-881-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/344-889-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2344-888-0x00000000001E0000-0x000000000020A000-memory.dmp family_blackmoon behavioral1/memory/1288-902-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
46444.exe862288.exea4220.exe202288.exe42402.exexlxxffx.exec626040.exe2802642.exe20228.exe7tnnbh.exennhnnn.exefrxrxxf.exe08628.exejvjdj.exevjppv.exe3ntttt.exexflrrrx.exehtnnhb.exe0804048.exe0284006.exetthhhn.exexrrfxrr.exevpdpd.exenbnthh.exellxflrx.exedpdpv.exe648282.exe2088484.exem0222.exebtnnth.exenhttbt.exe2066228.exe9xlxfxf.exe0800440.exevvjpv.exelfrrfxf.exek64444.exe208844.exevvvpp.exei200662.exe484066.exea8044.exe3jvvv.exei646824.exe428848.exe202284.exe0604220.exes6446.exeffxfxrr.exe084882.exe2688406.exefxxllrr.exebnbhhh.exefrfxffl.exe028222.exe26880.exe1lrlllr.exec088446.exe4248484.exehntthb.exe04680.exe08662.exe08482.exe646626.exepid process 2572 46444.exe 1200 862288.exe 1248 a4220.exe 1952 202288.exe 2448 42402.exe 2780 xlxxffx.exe 2784 c626040.exe 2756 2802642.exe 2768 20228.exe 2624 7tnnbh.exe 2112 nnhnnn.exe 988 frxrxxf.exe 2972 08628.exe 316 jvjdj.exe 2020 vjppv.exe 2948 3ntttt.exe 2080 xflrrrx.exe 2000 htnnhb.exe 1972 0804048.exe 1916 0284006.exe 444 tthhhn.exe 896 xrrfxrr.exe 1500 vpdpd.exe 2904 nbnthh.exe 1712 llxflrx.exe 876 dpdpv.exe 1768 648282.exe 1284 2088484.exe 604 m0222.exe 872 btnnth.exe 2432 nhttbt.exe 344 2066228.exe 2576 9xlxfxf.exe 2128 0800440.exe 1200 vvjpv.exe 2096 lfrrfxf.exe 1688 k64444.exe 1928 208844.exe 2840 vvvpp.exe 2476 i200662.exe 2908 484066.exe 2888 a8044.exe 2668 3jvvv.exe 2872 i646824.exe 2672 428848.exe 2696 202284.exe 2628 0604220.exe 2680 s6446.exe 2884 ffxfxrr.exe 1684 084882.exe 1492 2688406.exe 1476 fxxllrr.exe 1316 bnbhhh.exe 2956 frfxffl.exe 2932 028222.exe 1756 26880.exe 1964 1lrlllr.exe 2208 c088446.exe 2156 4248484.exe 272 hntthb.exe 444 04680.exe 1736 08662.exe 1328 08482.exe 1516 646626.exe -
Processes:
resource yara_rule behavioral1/memory/2372-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-412-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2884-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-512-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1768-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-741-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-809-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2412-847-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-854-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-867-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-874-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-881-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2344-888-0x00000000001E0000-0x000000000020A000-memory.dmp upx behavioral1/memory/1288-902-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/2264-921-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1jdjj.exe9pjpv.exevpdvd.exe8240628.exe2684444.exe084400.exepvjpv.exe8688480.exe2626240.exenhtthb.exe864684.exe4428624.exei200662.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8240628.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2684444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 084400.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8688480.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2626240.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 864684.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4428624.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i200662.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe46444.exe862288.exea4220.exe202288.exe42402.exexlxxffx.exec626040.exe2802642.exe20228.exe7tnnbh.exennhnnn.exefrxrxxf.exe08628.exejvjdj.exevjppv.exedescription pid process target process PID 2372 wrote to memory of 2572 2372 926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe 46444.exe PID 2372 wrote to memory of 2572 2372 926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe 46444.exe PID 2372 wrote to memory of 2572 2372 926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe 46444.exe PID 2372 wrote to memory of 2572 2372 926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe 46444.exe PID 2572 wrote to memory of 1200 2572 46444.exe 862288.exe PID 2572 wrote to memory of 1200 2572 46444.exe 862288.exe PID 2572 wrote to memory of 1200 2572 46444.exe 862288.exe PID 2572 wrote to memory of 1200 2572 46444.exe 862288.exe PID 1200 wrote to memory of 1248 1200 862288.exe a4220.exe PID 1200 wrote to memory of 1248 1200 862288.exe a4220.exe PID 1200 wrote to memory of 1248 1200 862288.exe a4220.exe PID 1200 wrote to memory of 1248 1200 862288.exe a4220.exe PID 1248 wrote to memory of 1952 1248 a4220.exe 202288.exe PID 1248 wrote to memory of 1952 1248 a4220.exe 202288.exe PID 1248 wrote to memory of 1952 1248 a4220.exe 202288.exe PID 1248 wrote to memory of 1952 1248 a4220.exe 202288.exe PID 1952 wrote to memory of 2448 1952 202288.exe 42402.exe PID 1952 wrote to memory of 2448 1952 202288.exe 42402.exe PID 1952 wrote to memory of 2448 1952 202288.exe 42402.exe PID 1952 wrote to memory of 2448 1952 202288.exe 42402.exe PID 2448 wrote to memory of 2780 2448 42402.exe xlxxffx.exe PID 2448 wrote to memory of 2780 2448 42402.exe xlxxffx.exe PID 2448 wrote to memory of 2780 2448 42402.exe xlxxffx.exe PID 2448 wrote to memory of 2780 2448 42402.exe xlxxffx.exe PID 2780 wrote to memory of 2784 2780 xlxxffx.exe c626040.exe PID 2780 wrote to memory of 2784 2780 xlxxffx.exe c626040.exe PID 2780 wrote to memory of 2784 2780 xlxxffx.exe c626040.exe PID 2780 wrote to memory of 2784 2780 xlxxffx.exe c626040.exe PID 2784 wrote to memory of 2756 2784 c626040.exe 2802642.exe PID 2784 wrote to memory of 2756 2784 c626040.exe 2802642.exe PID 2784 wrote to memory of 2756 2784 c626040.exe 2802642.exe PID 2784 wrote to memory of 2756 2784 c626040.exe 2802642.exe PID 2756 wrote to memory of 2768 2756 2802642.exe 20228.exe PID 2756 wrote to memory of 2768 2756 2802642.exe 20228.exe PID 2756 wrote to memory of 2768 2756 2802642.exe 20228.exe PID 2756 wrote to memory of 2768 2756 2802642.exe 20228.exe PID 2768 wrote to memory of 2624 2768 20228.exe 7tnnbh.exe PID 2768 wrote to memory of 2624 2768 20228.exe 7tnnbh.exe PID 2768 wrote to memory of 2624 2768 20228.exe 7tnnbh.exe PID 2768 wrote to memory of 2624 2768 20228.exe 7tnnbh.exe PID 2624 wrote to memory of 2112 2624 7tnnbh.exe nnhnnn.exe PID 2624 wrote to memory of 2112 2624 7tnnbh.exe nnhnnn.exe PID 2624 wrote to memory of 2112 2624 7tnnbh.exe nnhnnn.exe PID 2624 wrote to memory of 2112 2624 7tnnbh.exe nnhnnn.exe PID 2112 wrote to memory of 988 2112 nnhnnn.exe frxrxxf.exe PID 2112 wrote to memory of 988 2112 nnhnnn.exe frxrxxf.exe PID 2112 wrote to memory of 988 2112 nnhnnn.exe frxrxxf.exe PID 2112 wrote to memory of 988 2112 nnhnnn.exe frxrxxf.exe PID 988 wrote to memory of 2972 988 frxrxxf.exe 08628.exe PID 988 wrote to memory of 2972 988 frxrxxf.exe 08628.exe PID 988 wrote to memory of 2972 988 frxrxxf.exe 08628.exe PID 988 wrote to memory of 2972 988 frxrxxf.exe 08628.exe PID 2972 wrote to memory of 316 2972 08628.exe jvjdj.exe PID 2972 wrote to memory of 316 2972 08628.exe jvjdj.exe PID 2972 wrote to memory of 316 2972 08628.exe jvjdj.exe PID 2972 wrote to memory of 316 2972 08628.exe jvjdj.exe PID 316 wrote to memory of 2020 316 jvjdj.exe vjppv.exe PID 316 wrote to memory of 2020 316 jvjdj.exe vjppv.exe PID 316 wrote to memory of 2020 316 jvjdj.exe vjppv.exe PID 316 wrote to memory of 2020 316 jvjdj.exe vjppv.exe PID 2020 wrote to memory of 2948 2020 vjppv.exe 3ntttt.exe PID 2020 wrote to memory of 2948 2020 vjppv.exe 3ntttt.exe PID 2020 wrote to memory of 2948 2020 vjppv.exe 3ntttt.exe PID 2020 wrote to memory of 2948 2020 vjppv.exe 3ntttt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe"C:\Users\Admin\AppData\Local\Temp\926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\46444.exec:\46444.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\862288.exec:\862288.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\a4220.exec:\a4220.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\202288.exec:\202288.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\42402.exec:\42402.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\xlxxffx.exec:\xlxxffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\c626040.exec:\c626040.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\2802642.exec:\2802642.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\20228.exec:\20228.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\7tnnbh.exec:\7tnnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\nnhnnn.exec:\nnhnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\frxrxxf.exec:\frxrxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\08628.exec:\08628.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\jvjdj.exec:\jvjdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\vjppv.exec:\vjppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\3ntttt.exec:\3ntttt.exe17⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xflrrrx.exec:\xflrrrx.exe18⤵
- Executes dropped EXE
PID:2080 -
\??\c:\htnnhb.exec:\htnnhb.exe19⤵
- Executes dropped EXE
PID:2000 -
\??\c:\0804048.exec:\0804048.exe20⤵
- Executes dropped EXE
PID:1972 -
\??\c:\0284006.exec:\0284006.exe21⤵
- Executes dropped EXE
PID:1916 -
\??\c:\tthhhn.exec:\tthhhn.exe22⤵
- Executes dropped EXE
PID:444 -
\??\c:\xrrfxrr.exec:\xrrfxrr.exe23⤵
- Executes dropped EXE
PID:896 -
\??\c:\vpdpd.exec:\vpdpd.exe24⤵
- Executes dropped EXE
PID:1500 -
\??\c:\nbnthh.exec:\nbnthh.exe25⤵
- Executes dropped EXE
PID:2904 -
\??\c:\llxflrx.exec:\llxflrx.exe26⤵
- Executes dropped EXE
PID:1712 -
\??\c:\dpdpv.exec:\dpdpv.exe27⤵
- Executes dropped EXE
PID:876 -
\??\c:\648282.exec:\648282.exe28⤵
- Executes dropped EXE
PID:1768 -
\??\c:\2088484.exec:\2088484.exe29⤵
- Executes dropped EXE
PID:1284 -
\??\c:\m0222.exec:\m0222.exe30⤵
- Executes dropped EXE
PID:604 -
\??\c:\btnnth.exec:\btnnth.exe31⤵
- Executes dropped EXE
PID:872 -
\??\c:\nhttbt.exec:\nhttbt.exe32⤵
- Executes dropped EXE
PID:2432 -
\??\c:\2066228.exec:\2066228.exe33⤵
- Executes dropped EXE
PID:344 -
\??\c:\9xlxfxf.exec:\9xlxfxf.exe34⤵
- Executes dropped EXE
PID:2576 -
\??\c:\0800440.exec:\0800440.exe35⤵
- Executes dropped EXE
PID:2128 -
\??\c:\vvjpv.exec:\vvjpv.exe36⤵
- Executes dropped EXE
PID:1200 -
\??\c:\lfrrfxf.exec:\lfrrfxf.exe37⤵
- Executes dropped EXE
PID:2096 -
\??\c:\k64444.exec:\k64444.exe38⤵
- Executes dropped EXE
PID:1688 -
\??\c:\208844.exec:\208844.exe39⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vvvpp.exec:\vvvpp.exe40⤵
- Executes dropped EXE
PID:2840 -
\??\c:\i200662.exec:\i200662.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2476 -
\??\c:\484066.exec:\484066.exe42⤵
- Executes dropped EXE
PID:2908 -
\??\c:\a8044.exec:\a8044.exe43⤵
- Executes dropped EXE
PID:2888 -
\??\c:\3jvvv.exec:\3jvvv.exe44⤵
- Executes dropped EXE
PID:2668 -
\??\c:\i646824.exec:\i646824.exe45⤵
- Executes dropped EXE
PID:2872 -
\??\c:\428848.exec:\428848.exe46⤵
- Executes dropped EXE
PID:2672 -
\??\c:\202284.exec:\202284.exe47⤵
- Executes dropped EXE
PID:2696 -
\??\c:\0604220.exec:\0604220.exe48⤵
- Executes dropped EXE
PID:2628 -
\??\c:\s6446.exec:\s6446.exe49⤵
- Executes dropped EXE
PID:2680 -
\??\c:\ffxfxrr.exec:\ffxfxrr.exe50⤵
- Executes dropped EXE
PID:2884 -
\??\c:\084882.exec:\084882.exe51⤵
- Executes dropped EXE
PID:1684 -
\??\c:\2688406.exec:\2688406.exe52⤵
- Executes dropped EXE
PID:1492 -
\??\c:\fxxllrr.exec:\fxxllrr.exe53⤵
- Executes dropped EXE
PID:1476 -
\??\c:\bnbhhh.exec:\bnbhhh.exe54⤵
- Executes dropped EXE
PID:1316 -
\??\c:\frfxffl.exec:\frfxffl.exe55⤵
- Executes dropped EXE
PID:2956 -
\??\c:\028222.exec:\028222.exe56⤵
- Executes dropped EXE
PID:2932 -
\??\c:\26880.exec:\26880.exe57⤵
- Executes dropped EXE
PID:1756 -
\??\c:\1lrlllr.exec:\1lrlllr.exe58⤵
- Executes dropped EXE
PID:1964 -
\??\c:\c088446.exec:\c088446.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\4248484.exec:\4248484.exe60⤵
- Executes dropped EXE
PID:2156 -
\??\c:\hntthb.exec:\hntthb.exe61⤵
- Executes dropped EXE
PID:272 -
\??\c:\04680.exec:\04680.exe62⤵
- Executes dropped EXE
PID:444 -
\??\c:\08662.exec:\08662.exe63⤵
- Executes dropped EXE
PID:1736 -
\??\c:\08482.exec:\08482.exe64⤵
- Executes dropped EXE
PID:1328 -
\??\c:\646626.exec:\646626.exe65⤵
- Executes dropped EXE
PID:1516 -
\??\c:\vvvjj.exec:\vvvjj.exe66⤵PID:1708
-
\??\c:\rlxrlrx.exec:\rlxrlrx.exe67⤵PID:2212
-
\??\c:\rlxfrrf.exec:\rlxfrrf.exe68⤵PID:1968
-
\??\c:\426066.exec:\426066.exe69⤵PID:2428
-
\??\c:\8262624.exec:\8262624.exe70⤵PID:1768
-
\??\c:\dvjvd.exec:\dvjvd.exe71⤵PID:764
-
\??\c:\rrxflxf.exec:\rrxflxf.exe72⤵PID:604
-
\??\c:\864442.exec:\864442.exe73⤵PID:872
-
\??\c:\i484402.exec:\i484402.exe74⤵PID:1544
-
\??\c:\s2486.exec:\s2486.exe75⤵PID:1568
-
\??\c:\086800.exec:\086800.exe76⤵PID:2084
-
\??\c:\5pdpp.exec:\5pdpp.exe77⤵PID:2352
-
\??\c:\2268608.exec:\2268608.exe78⤵PID:2044
-
\??\c:\k26284.exec:\k26284.exe79⤵PID:2724
-
\??\c:\q26840.exec:\q26840.exe80⤵PID:2848
-
\??\c:\nnhtnn.exec:\nnhtnn.exe81⤵PID:2368
-
\??\c:\824022.exec:\824022.exe82⤵PID:2472
-
\??\c:\64002.exec:\64002.exe83⤵PID:2760
-
\??\c:\66028.exec:\66028.exe84⤵PID:2476
-
\??\c:\2026846.exec:\2026846.exe85⤵PID:2900
-
\??\c:\48284.exec:\48284.exe86⤵PID:2888
-
\??\c:\3ddpj.exec:\3ddpj.exe87⤵PID:2676
-
\??\c:\e60088.exec:\e60088.exe88⤵PID:2036
-
\??\c:\m6062.exec:\m6062.exe89⤵PID:2124
-
\??\c:\jppdd.exec:\jppdd.exe90⤵PID:2700
-
\??\c:\42026.exec:\42026.exe91⤵PID:2076
-
\??\c:\7hbnth.exec:\7hbnth.exe92⤵PID:2800
-
\??\c:\82002.exec:\82002.exe93⤵PID:1620
-
\??\c:\4868008.exec:\4868008.exe94⤵PID:1684
-
\??\c:\04246.exec:\04246.exe95⤵PID:1908
-
\??\c:\6006024.exec:\6006024.exe96⤵PID:2984
-
\??\c:\hthbnt.exec:\hthbnt.exe97⤵PID:1432
-
\??\c:\5rlxlrl.exec:\5rlxlrl.exe98⤵PID:1984
-
\??\c:\m6062.exec:\m6062.exe99⤵PID:1268
-
\??\c:\260666.exec:\260666.exe100⤵PID:2420
-
\??\c:\64828.exec:\64828.exe101⤵PID:2000
-
\??\c:\3rffrrl.exec:\3rffrrl.exe102⤵PID:1924
-
\??\c:\8206886.exec:\8206886.exe103⤵PID:1856
-
\??\c:\i268684.exec:\i268684.exe104⤵PID:832
-
\??\c:\64280.exec:\64280.exe105⤵PID:772
-
\??\c:\jjdvp.exec:\jjdvp.exe106⤵PID:780
-
\??\c:\nththh.exec:\nththh.exe107⤵PID:1500
-
\??\c:\08246.exec:\08246.exe108⤵PID:2904
-
\??\c:\1lffffl.exec:\1lffffl.exe109⤵PID:2008
-
\??\c:\q84066.exec:\q84066.exe110⤵PID:1764
-
\??\c:\04280.exec:\04280.exe111⤵PID:2212
-
\??\c:\2080884.exec:\2080884.exe112⤵PID:2408
-
\??\c:\3jvjd.exec:\3jvjd.exe113⤵PID:2148
-
\??\c:\s4240.exec:\s4240.exe114⤵PID:884
-
\??\c:\3xrfllx.exec:\3xrfllx.exe115⤵PID:1980
-
\??\c:\xrlxllf.exec:\xrlxllf.exe116⤵PID:2412
-
\??\c:\xxllrxf.exec:\xxllrxf.exe117⤵PID:2588
-
\??\c:\nnhhtb.exec:\nnhhtb.exe118⤵PID:2716
-
\??\c:\pjvpv.exec:\pjvpv.exe119⤵PID:344
-
\??\c:\vpdjv.exec:\vpdjv.exe120⤵PID:2560
-
\??\c:\thnntt.exec:\thnntt.exe121⤵PID:2988
-
\??\c:\pjpjv.exec:\pjpjv.exe122⤵PID:2344
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-