Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 02:13
Behavioral task
behavioral1
Sample
972dddce899d31c60f99842aa57781887cb216f0d1a126a10c14f7c915f5c246.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
972dddce899d31c60f99842aa57781887cb216f0d1a126a10c14f7c915f5c246.exe
-
Size
97KB
-
MD5
34c282c20fb8a8cdb562a09a80aca2ef
-
SHA1
eef7b468c3b45dfb67c6266d7c5b57bbf5df392a
-
SHA256
972dddce899d31c60f99842aa57781887cb216f0d1a126a10c14f7c915f5c246
-
SHA512
0198119ccafcf90346e9eb54c5dc237d1190a2bd57010f1277e1b86499a69d52b4ad40f1a53928ea8310e632fe73a841e1afa6839ba04a0257331a6c9d828eb2
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzgb:8cm4FmowdHoSgWrXUgb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/2400-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1932-203-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2964-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1932-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-138-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1540-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/568-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/568-88-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1108-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-71-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2628-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-229-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/876-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1804-250-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2516-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2348-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/868-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2256-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/772-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1424-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2132-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1628-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-601-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-616-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2648-620-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/568-613-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/568-612-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2648-637-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2756-664-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2088-709-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1464-748-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/832-776-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2916-835-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-896-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2476-927-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2332-1304-0x00000000775E0000-0x00000000776FF000-memory.dmp family_blackmoon behavioral1/memory/2332-13099-0x00000000775E0000-0x00000000776FF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2720 ppjvv.exe 2780 3pvpv.exe 2852 268806.exe 2596 g2064.exe 2628 xrxffrf.exe 2604 642800.exe 2636 tbntbh.exe 3016 nhtthn.exe 1108 82464.exe 568 22208.exe 2208 42006.exe 2216 6422840.exe 2864 88828.exe 1580 008244.exe 1540 5llfrfx.exe 2812 nbnbbh.exe 852 4822262.exe 2472 u666884.exe 1376 9rrfrrr.exe 2952 bnhntb.exe 2188 7xlxrxf.exe 2308 fxxxxfl.exe 2276 268640.exe 1932 rlxrxxx.exe 2964 428022.exe 1804 thttnt.exe 2500 s0446.exe 876 268422.exe 1704 6640684.exe 2516 jjddj.exe 2532 nbnhnn.exe 2348 7vjvj.exe 868 82228.exe 2684 q80680.exe 2720 g2484.exe 2936 7ffrxfl.exe 2848 nhbbhn.exe 1800 44240.exe 2736 btntbh.exe 2572 lflfffl.exe 1012 8628406.exe 2256 bntthn.exe 1532 vvvdj.exe 2616 048088.exe 772 tnbhbb.exe 1424 nhhnhh.exe 576 7vpvv.exe 2464 26624.exe 2104 m2668.exe 1308 jdvjj.exe 1220 bttthh.exe 2132 0806842.exe 1540 1pjpd.exe 2040 60668.exe 2004 202244.exe 1880 3thhnb.exe 1036 g4440.exe 1584 g2444.exe 1720 jjddv.exe 1452 w68026.exe 2280 lflrrrr.exe 2392 jjjdv.exe 1628 nbhntt.exe 2088 jdvvv.exe -
resource yara_rule behavioral1/files/0x000b000000012280-7.dat upx behavioral1/memory/2720-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2400-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2400-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2720-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001939f-16.dat upx behavioral1/files/0x00070000000193d0-26.dat upx behavioral1/memory/2852-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2780-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019426-43.dat upx behavioral1/files/0x00060000000193f9-34.dat upx behavioral1/memory/2628-46-0x00000000002A0000-0x00000000002C7000-memory.dmp upx behavioral1/files/0x00070000000194c3-59.dat upx behavioral1/files/0x0005000000019647-75.dat upx behavioral1/files/0x00060000000194d5-68.dat upx behavioral1/files/0x0005000000019a85-111.dat upx behavioral1/files/0x0005000000019b18-126.dat upx behavioral1/files/0x0005000000019c8f-144.dat upx behavioral1/files/0x0005000000019c91-151.dat upx behavioral1/files/0x0005000000019f62-176.dat upx behavioral1/files/0x000500000001a077-192.dat upx behavioral1/files/0x000500000001a0b4-209.dat upx behavioral1/files/0x000500000001a30e-217.dat upx behavioral1/memory/2964-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a07f-200.dat upx behavioral1/memory/1932-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019f77-185.dat upx behavioral1/memory/2188-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2952-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d98-168.dat upx behavioral1/files/0x0005000000019cc8-160.dat upx behavioral1/memory/2472-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2812-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2812-138-0x00000000003C0000-0x00000000003E7000-memory.dmp upx behavioral1/files/0x0005000000019c79-135.dat upx behavioral1/memory/1540-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019b16-119.dat upx behavioral1/memory/2216-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000197e4-102.dat upx behavioral1/files/0x0005000000019650-94.dat upx behavioral1/memory/568-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001964f-85.dat upx behavioral1/memory/1108-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019428-52.dat upx behavioral1/memory/2628-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2596-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a340-226.dat upx behavioral1/files/0x000500000001a444-233.dat upx behavioral1/memory/876-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0032000000019354-242.dat upx behavioral1/memory/2516-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a446-248.dat upx behavioral1/files/0x000500000001a447-260.dat upx behavioral1/memory/2516-258-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a448-266.dat upx behavioral1/memory/2348-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/868-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2736-311-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2572-317-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2256-328-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/772-339-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/772-345-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1424-351-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 826204.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m8006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 822280.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44240.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2720 2400 972dddce899d31c60f99842aa57781887cb216f0d1a126a10c14f7c915f5c246.exe 30 PID 2400 wrote to memory of 2720 2400 972dddce899d31c60f99842aa57781887cb216f0d1a126a10c14f7c915f5c246.exe 30 PID 2400 wrote to memory of 2720 2400 972dddce899d31c60f99842aa57781887cb216f0d1a126a10c14f7c915f5c246.exe 30 PID 2400 wrote to memory of 2720 2400 972dddce899d31c60f99842aa57781887cb216f0d1a126a10c14f7c915f5c246.exe 30 PID 2720 wrote to memory of 2780 2720 ppjvv.exe 31 PID 2720 wrote to memory of 2780 2720 ppjvv.exe 31 PID 2720 wrote to memory of 2780 2720 ppjvv.exe 31 PID 2720 wrote to memory of 2780 2720 ppjvv.exe 31 PID 2780 wrote to memory of 2852 2780 3pvpv.exe 32 PID 2780 wrote to memory of 2852 2780 3pvpv.exe 32 PID 2780 wrote to memory of 2852 2780 3pvpv.exe 32 PID 2780 wrote to memory of 2852 2780 3pvpv.exe 32 PID 2852 wrote to memory of 2596 2852 268806.exe 33 PID 2852 wrote to memory of 2596 2852 268806.exe 33 PID 2852 wrote to memory of 2596 2852 268806.exe 33 PID 2852 wrote to memory of 2596 2852 268806.exe 33 PID 2596 wrote to memory of 2628 2596 g2064.exe 34 PID 2596 wrote to memory of 2628 2596 g2064.exe 34 PID 2596 wrote to memory of 2628 2596 g2064.exe 34 PID 2596 wrote to memory of 2628 2596 g2064.exe 34 PID 2628 wrote to memory of 2604 2628 xrxffrf.exe 35 PID 2628 wrote to memory of 2604 2628 xrxffrf.exe 35 PID 2628 wrote to memory of 2604 2628 xrxffrf.exe 35 PID 2628 wrote to memory of 2604 2628 xrxffrf.exe 35 PID 2604 wrote to memory of 2636 2604 642800.exe 36 PID 2604 wrote to memory of 2636 2604 642800.exe 36 PID 2604 wrote to memory of 2636 2604 642800.exe 36 PID 2604 wrote to memory of 2636 2604 642800.exe 36 PID 2636 wrote to memory of 3016 2636 tbntbh.exe 37 PID 2636 wrote to memory of 3016 2636 tbntbh.exe 37 PID 2636 wrote to memory of 3016 2636 tbntbh.exe 37 PID 2636 wrote to memory of 3016 2636 tbntbh.exe 37 PID 3016 wrote to memory of 1108 3016 nhtthn.exe 38 PID 3016 wrote to memory of 1108 3016 nhtthn.exe 38 PID 3016 wrote to memory of 1108 3016 nhtthn.exe 38 PID 3016 wrote to memory of 1108 3016 nhtthn.exe 38 PID 1108 wrote to memory of 568 1108 82464.exe 39 PID 1108 wrote to memory of 568 1108 82464.exe 39 PID 1108 wrote to memory of 568 1108 82464.exe 39 PID 1108 wrote to memory of 568 1108 82464.exe 39 PID 568 wrote to memory of 2208 568 22208.exe 40 PID 568 wrote to memory of 2208 568 22208.exe 40 PID 568 wrote to memory of 2208 568 22208.exe 40 PID 568 wrote to memory of 2208 568 22208.exe 40 PID 2208 wrote to memory of 2216 2208 42006.exe 41 PID 2208 wrote to memory of 2216 2208 42006.exe 41 PID 2208 wrote to memory of 2216 2208 42006.exe 41 PID 2208 wrote to memory of 2216 2208 42006.exe 41 PID 2216 wrote to memory of 2864 2216 6422840.exe 42 PID 2216 wrote to memory of 2864 2216 6422840.exe 42 PID 2216 wrote to memory of 2864 2216 6422840.exe 42 PID 2216 wrote to memory of 2864 2216 6422840.exe 42 PID 2864 wrote to memory of 1580 2864 88828.exe 43 PID 2864 wrote to memory of 1580 2864 88828.exe 43 PID 2864 wrote to memory of 1580 2864 88828.exe 43 PID 2864 wrote to memory of 1580 2864 88828.exe 43 PID 1580 wrote to memory of 1540 1580 008244.exe 44 PID 1580 wrote to memory of 1540 1580 008244.exe 44 PID 1580 wrote to memory of 1540 1580 008244.exe 44 PID 1580 wrote to memory of 1540 1580 008244.exe 44 PID 1540 wrote to memory of 2812 1540 5llfrfx.exe 45 PID 1540 wrote to memory of 2812 1540 5llfrfx.exe 45 PID 1540 wrote to memory of 2812 1540 5llfrfx.exe 45 PID 1540 wrote to memory of 2812 1540 5llfrfx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\972dddce899d31c60f99842aa57781887cb216f0d1a126a10c14f7c915f5c246.exe"C:\Users\Admin\AppData\Local\Temp\972dddce899d31c60f99842aa57781887cb216f0d1a126a10c14f7c915f5c246.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\ppjvv.exec:\ppjvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\3pvpv.exec:\3pvpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\268806.exec:\268806.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\g2064.exec:\g2064.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\xrxffrf.exec:\xrxffrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\642800.exec:\642800.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\tbntbh.exec:\tbntbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\nhtthn.exec:\nhtthn.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\82464.exec:\82464.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\22208.exec:\22208.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\42006.exec:\42006.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\6422840.exec:\6422840.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\88828.exec:\88828.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\008244.exec:\008244.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\5llfrfx.exec:\5llfrfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\nbnbbh.exec:\nbnbbh.exe17⤵
- Executes dropped EXE
PID:2812 -
\??\c:\4822262.exec:\4822262.exe18⤵
- Executes dropped EXE
PID:852 -
\??\c:\u666884.exec:\u666884.exe19⤵
- Executes dropped EXE
PID:2472 -
\??\c:\9rrfrrr.exec:\9rrfrrr.exe20⤵
- Executes dropped EXE
PID:1376 -
\??\c:\bnhntb.exec:\bnhntb.exe21⤵
- Executes dropped EXE
PID:2952 -
\??\c:\7xlxrxf.exec:\7xlxrxf.exe22⤵
- Executes dropped EXE
PID:2188 -
\??\c:\fxxxxfl.exec:\fxxxxfl.exe23⤵
- Executes dropped EXE
PID:2308 -
\??\c:\268640.exec:\268640.exe24⤵
- Executes dropped EXE
PID:2276 -
\??\c:\rlxrxxx.exec:\rlxrxxx.exe25⤵
- Executes dropped EXE
PID:1932 -
\??\c:\428022.exec:\428022.exe26⤵
- Executes dropped EXE
PID:2964 -
\??\c:\thttnt.exec:\thttnt.exe27⤵
- Executes dropped EXE
PID:1804 -
\??\c:\s0446.exec:\s0446.exe28⤵
- Executes dropped EXE
PID:2500 -
\??\c:\268422.exec:\268422.exe29⤵
- Executes dropped EXE
PID:876 -
\??\c:\6640684.exec:\6640684.exe30⤵
- Executes dropped EXE
PID:1704 -
\??\c:\jjddj.exec:\jjddj.exe31⤵
- Executes dropped EXE
PID:2516 -
\??\c:\nbnhnn.exec:\nbnhnn.exe32⤵
- Executes dropped EXE
PID:2532 -
\??\c:\7vjvj.exec:\7vjvj.exe33⤵
- Executes dropped EXE
PID:2348 -
\??\c:\82228.exec:\82228.exe34⤵
- Executes dropped EXE
PID:868 -
\??\c:\q80680.exec:\q80680.exe35⤵
- Executes dropped EXE
PID:2684 -
\??\c:\g2484.exec:\g2484.exe36⤵
- Executes dropped EXE
PID:2720 -
\??\c:\7ffrxfl.exec:\7ffrxfl.exe37⤵
- Executes dropped EXE
PID:2936 -
\??\c:\nhbbhn.exec:\nhbbhn.exe38⤵
- Executes dropped EXE
PID:2848 -
\??\c:\44240.exec:\44240.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1800 -
\??\c:\btntbh.exec:\btntbh.exe40⤵
- Executes dropped EXE
PID:2736 -
\??\c:\lflfffl.exec:\lflfffl.exe41⤵
- Executes dropped EXE
PID:2572 -
\??\c:\8628406.exec:\8628406.exe42⤵
- Executes dropped EXE
PID:1012 -
\??\c:\bntthn.exec:\bntthn.exe43⤵
- Executes dropped EXE
PID:2256 -
\??\c:\vvvdj.exec:\vvvdj.exe44⤵
- Executes dropped EXE
PID:1532 -
\??\c:\048088.exec:\048088.exe45⤵
- Executes dropped EXE
PID:2616 -
\??\c:\tnbhbb.exec:\tnbhbb.exe46⤵
- Executes dropped EXE
PID:772 -
\??\c:\nhhnhh.exec:\nhhnhh.exe47⤵
- Executes dropped EXE
PID:1424 -
\??\c:\7vpvv.exec:\7vpvv.exe48⤵
- Executes dropped EXE
PID:576 -
\??\c:\26624.exec:\26624.exe49⤵
- Executes dropped EXE
PID:2464 -
\??\c:\m2668.exec:\m2668.exe50⤵
- Executes dropped EXE
PID:2104 -
\??\c:\jdvjj.exec:\jdvjj.exe51⤵
- Executes dropped EXE
PID:1308 -
\??\c:\bttthh.exec:\bttthh.exe52⤵
- Executes dropped EXE
PID:1220 -
\??\c:\0806842.exec:\0806842.exe53⤵
- Executes dropped EXE
PID:2132 -
\??\c:\1pjpd.exec:\1pjpd.exe54⤵
- Executes dropped EXE
PID:1540 -
\??\c:\60668.exec:\60668.exe55⤵
- Executes dropped EXE
PID:2040 -
\??\c:\202244.exec:\202244.exe56⤵
- Executes dropped EXE
PID:2004 -
\??\c:\3thhnb.exec:\3thhnb.exe57⤵
- Executes dropped EXE
PID:1880 -
\??\c:\g4440.exec:\g4440.exe58⤵
- Executes dropped EXE
PID:1036 -
\??\c:\g2444.exec:\g2444.exe59⤵
- Executes dropped EXE
PID:1584 -
\??\c:\jjddv.exec:\jjddv.exe60⤵
- Executes dropped EXE
PID:1720 -
\??\c:\w68026.exec:\w68026.exe61⤵
- Executes dropped EXE
PID:1452 -
\??\c:\lflrrrr.exec:\lflrrrr.exe62⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jjjdv.exec:\jjjdv.exe63⤵
- Executes dropped EXE
PID:2392 -
\??\c:\nbhntt.exec:\nbhntt.exe64⤵
- Executes dropped EXE
PID:1628 -
\??\c:\jdvvv.exec:\jdvvv.exe65⤵
- Executes dropped EXE
PID:2088 -
\??\c:\xfflfrr.exec:\xfflfrr.exe66⤵PID:2312
-
\??\c:\022684.exec:\022684.exe67⤵PID:1736
-
\??\c:\xrffrrx.exec:\xrffrrx.exe68⤵PID:2412
-
\??\c:\lxfflfr.exec:\lxfflfr.exe69⤵PID:2252
-
\??\c:\08002.exec:\08002.exe70⤵PID:2228
-
\??\c:\048462.exec:\048462.exe71⤵PID:1284
-
\??\c:\86242.exec:\86242.exe72⤵PID:904
-
\??\c:\lfxlrlx.exec:\lfxlrlx.exe73⤵
- System Location Discovery: System Language Discovery
PID:1292 -
\??\c:\04464.exec:\04464.exe74⤵PID:1804
-
\??\c:\dvdjp.exec:\dvdjp.exe75⤵PID:1364
-
\??\c:\268482.exec:\268482.exe76⤵PID:932
-
\??\c:\xrfxlrr.exec:\xrfxlrr.exe77⤵PID:876
-
\??\c:\ntttnb.exec:\ntttnb.exe78⤵PID:1300
-
\??\c:\264028.exec:\264028.exe79⤵PID:1712
-
\??\c:\w24444.exec:\w24444.exe80⤵PID:2292
-
\??\c:\3bnnhn.exec:\3bnnhn.exe81⤵PID:2384
-
\??\c:\s6880.exec:\s6880.exe82⤵PID:2080
-
\??\c:\20228.exec:\20228.exe83⤵PID:2404
-
\??\c:\260846.exec:\260846.exe84⤵PID:352
-
\??\c:\bnbhbb.exec:\bnbhbb.exe85⤵PID:2284
-
\??\c:\6462888.exec:\6462888.exe86⤵PID:1528
-
\??\c:\600688.exec:\600688.exe87⤵PID:2780
-
\??\c:\xlfllrx.exec:\xlfllrx.exe88⤵PID:2868
-
\??\c:\5dpvj.exec:\5dpvj.exe89⤵PID:2904
-
\??\c:\nhbbnn.exec:\nhbbnn.exe90⤵PID:2916
-
\??\c:\5vddp.exec:\5vddp.exe91⤵PID:2572
-
\??\c:\208422.exec:\208422.exe92⤵PID:2604
-
\??\c:\nhbhnn.exec:\nhbhnn.exe93⤵PID:2636
-
\??\c:\xrxfxxf.exec:\xrxfxxf.exe94⤵PID:1532
-
\??\c:\2080002.exec:\2080002.exe95⤵PID:1416
-
\??\c:\tnbhnn.exec:\tnbhnn.exe96⤵PID:2836
-
\??\c:\xlxffff.exec:\xlxffff.exe97⤵PID:568
-
\??\c:\ppvdv.exec:\ppvdv.exe98⤵PID:2648
-
\??\c:\o860666.exec:\o860666.exe99⤵PID:2464
-
\??\c:\i484688.exec:\i484688.exe100⤵PID:2884
-
\??\c:\e42428.exec:\e42428.exe101⤵PID:696
-
\??\c:\26202.exec:\26202.exe102⤵PID:1220
-
\??\c:\lrxxxrr.exec:\lrxxxrr.exe103⤵PID:2460
-
\??\c:\48060.exec:\48060.exe104⤵PID:2340
-
\??\c:\btbhnn.exec:\btbhnn.exe105⤵PID:2632
-
\??\c:\48628.exec:\48628.exe106⤵PID:2756
-
\??\c:\bthbnh.exec:\bthbnh.exe107⤵PID:2888
-
\??\c:\rlrrrll.exec:\rlrrrll.exe108⤵PID:1724
-
\??\c:\9nhtbh.exec:\9nhtbh.exe109⤵PID:2072
-
\??\c:\pjpvv.exec:\pjpvv.exe110⤵PID:1452
-
\??\c:\7dpjj.exec:\7dpjj.exe111⤵PID:2408
-
\??\c:\lflllrl.exec:\lflllrl.exe112⤵PID:2768
-
\??\c:\862622.exec:\862622.exe113⤵PID:2112
-
\??\c:\4824062.exec:\4824062.exe114⤵PID:2088
-
\??\c:\9ttbnt.exec:\9ttbnt.exe115⤵PID:1932
-
\??\c:\606880.exec:\606880.exe116⤵PID:1736
-
\??\c:\602200.exec:\602200.exe117⤵PID:2036
-
\??\c:\7flxxrr.exec:\7flxxrr.exe118⤵PID:1464
-
\??\c:\nbhhtn.exec:\nbhhtn.exe119⤵PID:2240
-
\??\c:\662888.exec:\662888.exe120⤵PID:1132
-
\??\c:\k84444.exec:\k84444.exe121⤵PID:764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-