Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 09:06
Behavioral task
behavioral1
Sample
c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe
Resource
win7-20241010-en
General
-
Target
c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe
-
Size
91KB
-
MD5
f66665e8915c3d3682adc114cd97f658
-
SHA1
790d90a518b13d1abd9356b21b34d84257ff9b30
-
SHA256
c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379
-
SHA512
433dff41a794073667047e34048dd625f0f2cab5757f43d17e98b65a5b188ce83cd1e94e11deaa2210c08f0187e1c9b96bb23b8f28bfedadf3d57a7b4cbbf90b
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8yaVskCzYBbKd+XsWgADUOj2YUW+S436CS:9hOmTsF93UYfwC6GIoutyaVszyKd+XYM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
Processes:
resource yara_rule behavioral2/memory/212-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3508-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3808-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4880-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3360-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1360-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3280-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3096-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2444-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1644-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/840-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2972-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1824-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4196-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3812-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1364-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2964-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4092-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/412-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/956-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2164-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4316-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2968-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1720-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2396-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2200-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/816-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4840-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1300-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2116-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2968-406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3268-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4296-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1552-445-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3796-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3476-474-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1564-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-548-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-583-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-626-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-756-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3152-865-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-1516-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lrfflll.exebbhhnh.exe686022.exe486284.exe1lrrxxr.exec460448.exe3bnntb.exefrxlffx.exe8422222.exedpvdv.exe26460.exe6422266.exehntttt.exerfllfff.exe9rrllll.exe04040.exe48442.exe8244888.exejvvvv.exexxrrrff.exejjddd.exeppddd.exejdpjj.exefrffxff.exei800004.exe08666.exexxxrrrx.exe624000.exe082008.exe0620008.exe88202.exe4488624.exevdjdj.exehhhhbh.exefllfrrf.exe262662.exe5nnnhh.exetbbbht.exea2882.exeq42844.exe88444.exeu666006.exevpjdd.exethhhht.exe46806.exeo400400.exe882086.exe0626008.exe2248642.exeflllffx.exehbbttt.exek42226.exe406044.exe80420.exeffllllx.exehbbttn.exe00408.exexxxlfff.exexrrrrrr.exe80004.exeflxxrrr.exehbnhht.exew66600.exe20268.exepid Process 212 lrfflll.exe 4568 bbhhnh.exe 3808 686022.exe 4880 486284.exe 3360 1lrrxxr.exe 1360 c460448.exe 2520 3bnntb.exe 3096 frxlffx.exe 2352 8422222.exe 3280 dpvdv.exe 1788 26460.exe 2444 6422266.exe 2016 hntttt.exe 1152 rfllfff.exe 1644 9rrllll.exe 840 04040.exe 2972 48442.exe 3324 8244888.exe 2136 jvvvv.exe 1512 xxrrrff.exe 1824 jjddd.exe 3724 ppddd.exe 4996 jdpjj.exe 4196 frffxff.exe 1364 i800004.exe 3812 08666.exe 1744 xxxrrrx.exe 5004 624000.exe 2964 082008.exe 60 0620008.exe 4092 88202.exe 2560 4488624.exe 4324 vdjdj.exe 4416 hhhhbh.exe 412 fllfrrf.exe 4468 262662.exe 956 5nnnhh.exe 2164 tbbbht.exe 2120 a2882.exe 3800 q42844.exe 3672 88444.exe 3896 u666006.exe 4316 vpjdd.exe 2968 thhhht.exe 1720 46806.exe 4480 o400400.exe 552 882086.exe 5040 0626008.exe 2396 2248642.exe 2200 flllffx.exe 2008 hbbttt.exe 5108 k42226.exe 116 406044.exe 816 80420.exe 2520 ffllllx.exe 1972 hbbttn.exe 3352 00408.exe 2288 xxxlfff.exe 220 xrrrrrr.exe 1792 80004.exe 1780 flxxrrr.exe 456 hbnhht.exe 3668 w66600.exe 3248 20268.exe -
Processes:
resource yara_rule behavioral2/memory/3508-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b03-5.dat upx behavioral2/memory/212-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3508-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b53-10.dat upx behavioral2/memory/4568-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b57-13.dat upx behavioral2/memory/4568-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b59-22.dat upx behavioral2/memory/3808-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4880-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b5a-31.dat upx behavioral2/files/0x000a000000023b5b-34.dat upx behavioral2/memory/3360-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b5c-40.dat upx behavioral2/memory/1360-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2520-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b5d-48.dat upx behavioral2/files/0x000a000000023b5e-52.dat upx behavioral2/files/0x000a000000023b5f-59.dat upx behavioral2/files/0x000a000000023b60-64.dat upx behavioral2/files/0x000a000000023b61-69.dat upx behavioral2/memory/3280-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3096-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b62-74.dat upx behavioral2/memory/2444-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b63-80.dat upx behavioral2/memory/2016-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b64-86.dat upx behavioral2/files/0x000a000000023b65-91.dat upx behavioral2/memory/1644-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b66-98.dat upx behavioral2/files/0x000a000000023b67-104.dat upx behavioral2/memory/840-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2972-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b54-109.dat upx behavioral2/files/0x000a000000023b69-114.dat upx behavioral2/files/0x000a000000023b6a-119.dat upx behavioral2/memory/1824-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b6b-126.dat upx behavioral2/memory/3724-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b6c-130.dat upx behavioral2/memory/4996-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b6d-136.dat upx behavioral2/memory/4196-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b6e-143.dat upx behavioral2/files/0x000a000000023b6f-149.dat upx behavioral2/memory/3812-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b70-155.dat upx behavioral2/memory/1364-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b71-160.dat upx behavioral2/files/0x000a000000023b72-166.dat upx behavioral2/files/0x000a000000023b73-170.dat upx behavioral2/memory/2964-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/60-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b74-178.dat upx behavioral2/files/0x000a000000023b75-182.dat upx behavioral2/memory/4092-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/412-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/956-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2164-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4316-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2968-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1720-233-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
04222.exe2400444.exe26226.exe646000.exexlllfff.exetnbbhh.exevdppv.exe04004.exec848808.exeo644888.exerllfxrr.exe1nnhbb.exevppdd.exes0484.exe426666.exe20864.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2400444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26226.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 646000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c848808.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o644888.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s0484.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 426666.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20864.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exelrfflll.exebbhhnh.exe686022.exe486284.exe1lrrxxr.exec460448.exe3bnntb.exefrxlffx.exe8422222.exedpvdv.exe26460.exe6422266.exehntttt.exerfllfff.exe9rrllll.exe04040.exe48442.exe8244888.exejvvvv.exexxrrrff.exejjddd.exedescription pid Process procid_target PID 3508 wrote to memory of 212 3508 c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe 82 PID 3508 wrote to memory of 212 3508 c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe 82 PID 3508 wrote to memory of 212 3508 c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe 82 PID 212 wrote to memory of 4568 212 lrfflll.exe 83 PID 212 wrote to memory of 4568 212 lrfflll.exe 83 PID 212 wrote to memory of 4568 212 lrfflll.exe 83 PID 4568 wrote to memory of 3808 4568 bbhhnh.exe 84 PID 4568 wrote to memory of 3808 4568 bbhhnh.exe 84 PID 4568 wrote to memory of 3808 4568 bbhhnh.exe 84 PID 3808 wrote to memory of 4880 3808 686022.exe 85 PID 3808 wrote to memory of 4880 3808 686022.exe 85 PID 3808 wrote to memory of 4880 3808 686022.exe 85 PID 4880 wrote to memory of 3360 4880 486284.exe 86 PID 4880 wrote to memory of 3360 4880 486284.exe 86 PID 4880 wrote to memory of 3360 4880 486284.exe 86 PID 3360 wrote to memory of 1360 3360 1lrrxxr.exe 87 PID 3360 wrote to memory of 1360 3360 1lrrxxr.exe 87 PID 3360 wrote to memory of 1360 3360 1lrrxxr.exe 87 PID 1360 wrote to memory of 2520 1360 c460448.exe 88 PID 1360 wrote to memory of 2520 1360 c460448.exe 88 PID 1360 wrote to memory of 2520 1360 c460448.exe 88 PID 2520 wrote to memory of 3096 2520 3bnntb.exe 89 PID 2520 wrote to memory of 3096 2520 3bnntb.exe 89 PID 2520 wrote to memory of 3096 2520 3bnntb.exe 89 PID 3096 wrote to memory of 2352 3096 frxlffx.exe 90 PID 3096 wrote to memory of 2352 3096 frxlffx.exe 90 PID 3096 wrote to memory of 2352 3096 frxlffx.exe 90 PID 2352 wrote to memory of 3280 2352 8422222.exe 91 PID 2352 wrote to memory of 3280 2352 8422222.exe 91 PID 2352 wrote to memory of 3280 2352 8422222.exe 91 PID 3280 wrote to memory of 1788 3280 dpvdv.exe 92 PID 3280 wrote to memory of 1788 3280 dpvdv.exe 92 PID 3280 wrote to memory of 1788 3280 dpvdv.exe 92 PID 1788 wrote to memory of 2444 1788 26460.exe 93 PID 1788 wrote to memory of 2444 1788 26460.exe 93 PID 1788 wrote to memory of 2444 1788 26460.exe 93 PID 2444 wrote to memory of 2016 2444 6422266.exe 94 PID 2444 wrote to memory of 2016 2444 6422266.exe 94 PID 2444 wrote to memory of 2016 2444 6422266.exe 94 PID 2016 wrote to memory of 1152 2016 hntttt.exe 95 PID 2016 wrote to memory of 1152 2016 hntttt.exe 95 PID 2016 wrote to memory of 1152 2016 hntttt.exe 95 PID 1152 wrote to memory of 1644 1152 rfllfff.exe 96 PID 1152 wrote to memory of 1644 1152 rfllfff.exe 96 PID 1152 wrote to memory of 1644 1152 rfllfff.exe 96 PID 1644 wrote to memory of 840 1644 9rrllll.exe 97 PID 1644 wrote to memory of 840 1644 9rrllll.exe 97 PID 1644 wrote to memory of 840 1644 9rrllll.exe 97 PID 840 wrote to memory of 2972 840 04040.exe 98 PID 840 wrote to memory of 2972 840 04040.exe 98 PID 840 wrote to memory of 2972 840 04040.exe 98 PID 2972 wrote to memory of 3324 2972 48442.exe 99 PID 2972 wrote to memory of 3324 2972 48442.exe 99 PID 2972 wrote to memory of 3324 2972 48442.exe 99 PID 3324 wrote to memory of 2136 3324 8244888.exe 100 PID 3324 wrote to memory of 2136 3324 8244888.exe 100 PID 3324 wrote to memory of 2136 3324 8244888.exe 100 PID 2136 wrote to memory of 1512 2136 jvvvv.exe 101 PID 2136 wrote to memory of 1512 2136 jvvvv.exe 101 PID 2136 wrote to memory of 1512 2136 jvvvv.exe 101 PID 1512 wrote to memory of 1824 1512 xxrrrff.exe 102 PID 1512 wrote to memory of 1824 1512 xxrrrff.exe 102 PID 1512 wrote to memory of 1824 1512 xxrrrff.exe 102 PID 1824 wrote to memory of 3724 1824 jjddd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe"C:\Users\Admin\AppData\Local\Temp\c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\lrfflll.exec:\lrfflll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\bbhhnh.exec:\bbhhnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\686022.exec:\686022.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\486284.exec:\486284.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\1lrrxxr.exec:\1lrrxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\c460448.exec:\c460448.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\3bnntb.exec:\3bnntb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\frxlffx.exec:\frxlffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\8422222.exec:\8422222.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\dpvdv.exec:\dpvdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\26460.exec:\26460.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\6422266.exec:\6422266.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\hntttt.exec:\hntttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\rfllfff.exec:\rfllfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\9rrllll.exec:\9rrllll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\04040.exec:\04040.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\48442.exec:\48442.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\8244888.exec:\8244888.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\jvvvv.exec:\jvvvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\xxrrrff.exec:\xxrrrff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\jjddd.exec:\jjddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\ppddd.exec:\ppddd.exe23⤵
- Executes dropped EXE
PID:3724 -
\??\c:\jdpjj.exec:\jdpjj.exe24⤵
- Executes dropped EXE
PID:4996 -
\??\c:\frffxff.exec:\frffxff.exe25⤵
- Executes dropped EXE
PID:4196 -
\??\c:\i800004.exec:\i800004.exe26⤵
- Executes dropped EXE
PID:1364 -
\??\c:\08666.exec:\08666.exe27⤵
- Executes dropped EXE
PID:3812 -
\??\c:\xxxrrrx.exec:\xxxrrrx.exe28⤵
- Executes dropped EXE
PID:1744 -
\??\c:\624000.exec:\624000.exe29⤵
- Executes dropped EXE
PID:5004 -
\??\c:\082008.exec:\082008.exe30⤵
- Executes dropped EXE
PID:2964 -
\??\c:\0620008.exec:\0620008.exe31⤵
- Executes dropped EXE
PID:60 -
\??\c:\88202.exec:\88202.exe32⤵
- Executes dropped EXE
PID:4092 -
\??\c:\4488624.exec:\4488624.exe33⤵
- Executes dropped EXE
PID:2560 -
\??\c:\vdjdj.exec:\vdjdj.exe34⤵
- Executes dropped EXE
PID:4324 -
\??\c:\hhhhbh.exec:\hhhhbh.exe35⤵
- Executes dropped EXE
PID:4416 -
\??\c:\fllfrrf.exec:\fllfrrf.exe36⤵
- Executes dropped EXE
PID:412 -
\??\c:\262662.exec:\262662.exe37⤵
- Executes dropped EXE
PID:4468 -
\??\c:\5nnnhh.exec:\5nnnhh.exe38⤵
- Executes dropped EXE
PID:956 -
\??\c:\tbbbht.exec:\tbbbht.exe39⤵
- Executes dropped EXE
PID:2164 -
\??\c:\a2882.exec:\a2882.exe40⤵
- Executes dropped EXE
PID:2120 -
\??\c:\q42844.exec:\q42844.exe41⤵
- Executes dropped EXE
PID:3800 -
\??\c:\88444.exec:\88444.exe42⤵
- Executes dropped EXE
PID:3672 -
\??\c:\u666006.exec:\u666006.exe43⤵
- Executes dropped EXE
PID:3896 -
\??\c:\vpjdd.exec:\vpjdd.exe44⤵
- Executes dropped EXE
PID:4316 -
\??\c:\thhhht.exec:\thhhht.exe45⤵
- Executes dropped EXE
PID:2968 -
\??\c:\46806.exec:\46806.exe46⤵
- Executes dropped EXE
PID:1720 -
\??\c:\o400400.exec:\o400400.exe47⤵
- Executes dropped EXE
PID:4480 -
\??\c:\882086.exec:\882086.exe48⤵
- Executes dropped EXE
PID:552 -
\??\c:\0626008.exec:\0626008.exe49⤵
- Executes dropped EXE
PID:5040 -
\??\c:\2248642.exec:\2248642.exe50⤵
- Executes dropped EXE
PID:2396 -
\??\c:\flllffx.exec:\flllffx.exe51⤵
- Executes dropped EXE
PID:2200 -
\??\c:\hbbttt.exec:\hbbttt.exe52⤵
- Executes dropped EXE
PID:2008 -
\??\c:\k42226.exec:\k42226.exe53⤵
- Executes dropped EXE
PID:5108 -
\??\c:\406044.exec:\406044.exe54⤵
- Executes dropped EXE
PID:116 -
\??\c:\80420.exec:\80420.exe55⤵
- Executes dropped EXE
PID:816 -
\??\c:\ffllllx.exec:\ffllllx.exe56⤵
- Executes dropped EXE
PID:2520 -
\??\c:\hbbttn.exec:\hbbttn.exe57⤵
- Executes dropped EXE
PID:1972 -
\??\c:\00408.exec:\00408.exe58⤵
- Executes dropped EXE
PID:3352 -
\??\c:\xxxlfff.exec:\xxxlfff.exe59⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe60⤵
- Executes dropped EXE
PID:220 -
\??\c:\80004.exec:\80004.exe61⤵
- Executes dropped EXE
PID:1792 -
\??\c:\flxxrrr.exec:\flxxrrr.exe62⤵
- Executes dropped EXE
PID:1780 -
\??\c:\hbnhht.exec:\hbnhht.exe63⤵
- Executes dropped EXE
PID:456 -
\??\c:\w66600.exec:\w66600.exe64⤵
- Executes dropped EXE
PID:3668 -
\??\c:\20268.exec:\20268.exe65⤵
- Executes dropped EXE
PID:3248 -
\??\c:\btbbnt.exec:\btbbnt.exe66⤵PID:2772
-
\??\c:\8224662.exec:\8224662.exe67⤵PID:1152
-
\??\c:\88460.exec:\88460.exe68⤵PID:2556
-
\??\c:\0460480.exec:\0460480.exe69⤵PID:3944
-
\??\c:\808888.exec:\808888.exe70⤵PID:4840
-
\??\c:\080662.exec:\080662.exe71⤵PID:5016
-
\??\c:\frfxrrl.exec:\frfxrrl.exe72⤵PID:2100
-
\??\c:\266048.exec:\266048.exe73⤵PID:4068
-
\??\c:\bnthnn.exec:\bnthnn.exe74⤵PID:1824
-
\??\c:\q46660.exec:\q46660.exe75⤵PID:1300
-
\??\c:\8480000.exec:\8480000.exe76⤵PID:3368
-
\??\c:\26222.exec:\26222.exe77⤵PID:3068
-
\??\c:\22842.exec:\22842.exe78⤵PID:2436
-
\??\c:\9vvvp.exec:\9vvvp.exe79⤵PID:4980
-
\??\c:\hbhbhn.exec:\hbhbhn.exe80⤵PID:5004
-
\??\c:\dvjjv.exec:\dvjjv.exe81⤵PID:2964
-
\??\c:\442262.exec:\442262.exe82⤵PID:3436
-
\??\c:\fllxrll.exec:\fllxrll.exe83⤵PID:2116
-
\??\c:\082802.exec:\082802.exe84⤵PID:2664
-
\??\c:\6826204.exec:\6826204.exe85⤵PID:3240
-
\??\c:\64604.exec:\64604.exe86⤵PID:2844
-
\??\c:\u682064.exec:\u682064.exe87⤵PID:4900
-
\??\c:\040000.exec:\040000.exe88⤵PID:1724
-
\??\c:\2646266.exec:\2646266.exe89⤵PID:2360
-
\??\c:\nnhbhh.exec:\nnhbhh.exe90⤵PID:968
-
\??\c:\o400066.exec:\o400066.exe91⤵PID:436
-
\??\c:\rrrlllf.exec:\rrrlllf.exe92⤵PID:2292
-
\??\c:\hhttbb.exec:\hhttbb.exe93⤵PID:3800
-
\??\c:\dppjd.exec:\dppjd.exe94⤵PID:3672
-
\??\c:\428266.exec:\428266.exe95⤵PID:3712
-
\??\c:\jpvpv.exec:\jpvpv.exe96⤵PID:4316
-
\??\c:\866086.exec:\866086.exe97⤵PID:2968
-
\??\c:\u622604.exec:\u622604.exe98⤵PID:1720
-
\??\c:\206600.exec:\206600.exe99⤵PID:3956
-
\??\c:\0888020.exec:\0888020.exe100⤵PID:3268
-
\??\c:\pdppp.exec:\pdppp.exe101⤵PID:4296
-
\??\c:\88044.exec:\88044.exe102⤵PID:1012
-
\??\c:\a0460.exec:\a0460.exe103⤵PID:4880
-
\??\c:\488862.exec:\488862.exe104⤵PID:3616
-
\??\c:\86260.exec:\86260.exe105⤵PID:3300
-
\??\c:\rxllffl.exec:\rxllffl.exe106⤵PID:4924
-
\??\c:\268266.exec:\268266.exe107⤵PID:116
-
\??\c:\jpvvj.exec:\jpvvj.exe108⤵PID:1232
-
\??\c:\84466.exec:\84466.exe109⤵PID:1552
-
\??\c:\rfxxxlf.exec:\rfxxxlf.exe110⤵PID:1544
-
\??\c:\22240.exec:\22240.exe111⤵PID:3352
-
\??\c:\1nnbnt.exec:\1nnbnt.exe112⤵PID:4544
-
\??\c:\a8668.exec:\a8668.exe113⤵PID:4036
-
\??\c:\40886.exec:\40886.exe114⤵PID:5064
-
\??\c:\48004.exec:\48004.exe115⤵PID:2060
-
\??\c:\6060006.exec:\6060006.exe116⤵PID:3796
-
\??\c:\frxrrxx.exec:\frxrrxx.exe117⤵PID:1948
-
\??\c:\48806.exec:\48806.exe118⤵PID:3476
-
\??\c:\xffxrrl.exec:\xffxrrl.exe119⤵PID:1952
-
\??\c:\m8044.exec:\m8044.exe120⤵PID:1644
-
\??\c:\84228.exec:\84228.exe121⤵PID:3236
-
\??\c:\284444.exec:\284444.exe122⤵PID:2068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-