Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 14:37
Static task
static1
Behavioral task
behavioral1
Sample
e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe
Resource
win7-20240708-en
General
-
Target
e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe
-
Size
384KB
-
MD5
0ada576629d2a2c79ab1cafcf823718c
-
SHA1
6dde40cdbd6857ffc06569bdf9b9c8b5978c6046
-
SHA256
e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff
-
SHA512
9567227eb22f308cde4f42a5f6a271ea2ae314c4d6593fd436bd17a9039e9781041d68667eada4122431bff99364089c4efe0acfc4a662bc05d8476bdd763610
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFw41/t49:8cm7ImGddXmNt251UriZFwkS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
Processes:
resource yara_rule behavioral1/memory/2152-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-73-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2364-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-89-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2920-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-165-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-316-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2764-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-353-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2828-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-374-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2124-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1196-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-415-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1764-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-460-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1584-597-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2992-602-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2632-655-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/2620-727-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ntbtbh.exew86860.exe066060.exebtthnh.exe420628.exe6024662.exew86682.exe0480280.exea4286.exejvjjv.exe48622.exe08406.exek24404.exejdpvd.exek48466.exe060680.exe1xllrxl.exe8802064.exeg8684.exejjdpv.exe5llrfrx.exec864846.exe000064.exe7rllxrx.exejjpjj.exe02028.exe0862828.exe6404006.exe208466.exejjjdp.exee26684.exe3jddp.exe5bnhtn.exe82288.exe8606888.exe824082.exefxrxflf.exe0424286.exe3jppv.exe6044068.exellfflrx.exe4246626.exe4284444.exe5tnttb.exeq82028.exe208062.exeq68466.exe646248.exe7xrrlxr.exe1pvvv.exek64400.exe7thhhn.exerlxrfll.exe884428.exe86266.exe3hhbhb.exe208406.exevpdpv.exevpdjj.exevjppv.exepdddj.exee24022.exe048468.exe9flflfl.exepid process 2212 ntbtbh.exe 2796 w86860.exe 2772 066060.exe 2848 btthnh.exe 2748 420628.exe 2608 6024662.exe 2636 w86682.exe 2364 0480280.exe 1724 a4286.exe 2920 jvjjv.exe 1276 48622.exe 1060 08406.exe 1616 k24404.exe 580 jdpvd.exe 2620 k48466.exe 2868 060680.exe 772 1xllrxl.exe 2976 8802064.exe 2816 g8684.exe 2284 jjdpv.exe 2380 5llrfrx.exe 464 c864846.exe 2516 000064.exe 1708 7rllxrx.exe 2020 jjpjj.exe 1752 02028.exe 1692 0862828.exe 2080 6404006.exe 2280 208466.exe 2340 jjjdp.exe 1856 e26684.exe 904 3jddp.exe 2464 5bnhtn.exe 1904 82288.exe 1700 8606888.exe 2704 824082.exe 2756 fxrxflf.exe 2764 0424286.exe 2760 3jppv.exe 2828 6044068.exe 2672 llfflrx.exe 2604 4246626.exe 2124 4284444.exe 2880 5tnttb.exe 3020 q82028.exe 2904 208062.exe 708 q68466.exe 736 646248.exe 1196 7xrrlxr.exe 1764 1pvvv.exe 860 k64400.exe 1320 7thhhn.exe 1008 rlxrfll.exe 1828 884428.exe 1744 86266.exe 2968 3hhbhb.exe 1600 208406.exe 2132 vpdpv.exe 2292 vpdjj.exe 712 vjppv.exe 1892 pdddj.exe 2120 e24022.exe 788 048468.exe 1708 9flflfl.exe -
Processes:
resource yara_rule behavioral1/memory/2152-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/736-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/272-815-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
tttbnb.exee26806.exe9dvvv.exe7httnh.exe6024662.exe08406.exe3xrlrxf.exe066060.exe260684.exenhtnbb.exe482866.exe42622.exe642884.exe60462.exe2640840.exe864660.exe7bhhht.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e26806.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7httnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6024662.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 066060.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 260684.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 482866.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42622.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 642884.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60462.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2640840.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 864660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exentbtbh.exew86860.exe066060.exebtthnh.exe420628.exe6024662.exew86682.exe0480280.exea4286.exejvjjv.exe48622.exe08406.exek24404.exejdpvd.exek48466.exedescription pid process target process PID 2152 wrote to memory of 2212 2152 e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe ntbtbh.exe PID 2152 wrote to memory of 2212 2152 e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe ntbtbh.exe PID 2152 wrote to memory of 2212 2152 e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe ntbtbh.exe PID 2152 wrote to memory of 2212 2152 e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe ntbtbh.exe PID 2212 wrote to memory of 2796 2212 ntbtbh.exe w86860.exe PID 2212 wrote to memory of 2796 2212 ntbtbh.exe w86860.exe PID 2212 wrote to memory of 2796 2212 ntbtbh.exe w86860.exe PID 2212 wrote to memory of 2796 2212 ntbtbh.exe w86860.exe PID 2796 wrote to memory of 2772 2796 w86860.exe 066060.exe PID 2796 wrote to memory of 2772 2796 w86860.exe 066060.exe PID 2796 wrote to memory of 2772 2796 w86860.exe 066060.exe PID 2796 wrote to memory of 2772 2796 w86860.exe 066060.exe PID 2772 wrote to memory of 2848 2772 066060.exe btthnh.exe PID 2772 wrote to memory of 2848 2772 066060.exe btthnh.exe PID 2772 wrote to memory of 2848 2772 066060.exe btthnh.exe PID 2772 wrote to memory of 2848 2772 066060.exe btthnh.exe PID 2848 wrote to memory of 2748 2848 btthnh.exe 420628.exe PID 2848 wrote to memory of 2748 2848 btthnh.exe 420628.exe PID 2848 wrote to memory of 2748 2848 btthnh.exe 420628.exe PID 2848 wrote to memory of 2748 2848 btthnh.exe 420628.exe PID 2748 wrote to memory of 2608 2748 420628.exe 6024662.exe PID 2748 wrote to memory of 2608 2748 420628.exe 6024662.exe PID 2748 wrote to memory of 2608 2748 420628.exe 6024662.exe PID 2748 wrote to memory of 2608 2748 420628.exe 6024662.exe PID 2608 wrote to memory of 2636 2608 6024662.exe w86682.exe PID 2608 wrote to memory of 2636 2608 6024662.exe w86682.exe PID 2608 wrote to memory of 2636 2608 6024662.exe w86682.exe PID 2608 wrote to memory of 2636 2608 6024662.exe w86682.exe PID 2636 wrote to memory of 2364 2636 w86682.exe 0480280.exe PID 2636 wrote to memory of 2364 2636 w86682.exe 0480280.exe PID 2636 wrote to memory of 2364 2636 w86682.exe 0480280.exe PID 2636 wrote to memory of 2364 2636 w86682.exe 0480280.exe PID 2364 wrote to memory of 1724 2364 0480280.exe a4286.exe PID 2364 wrote to memory of 1724 2364 0480280.exe a4286.exe PID 2364 wrote to memory of 1724 2364 0480280.exe a4286.exe PID 2364 wrote to memory of 1724 2364 0480280.exe a4286.exe PID 1724 wrote to memory of 2920 1724 a4286.exe jvjjv.exe PID 1724 wrote to memory of 2920 1724 a4286.exe jvjjv.exe PID 1724 wrote to memory of 2920 1724 a4286.exe jvjjv.exe PID 1724 wrote to memory of 2920 1724 a4286.exe jvjjv.exe PID 2920 wrote to memory of 1276 2920 jvjjv.exe 48622.exe PID 2920 wrote to memory of 1276 2920 jvjjv.exe 48622.exe PID 2920 wrote to memory of 1276 2920 jvjjv.exe 48622.exe PID 2920 wrote to memory of 1276 2920 jvjjv.exe 48622.exe PID 1276 wrote to memory of 1060 1276 48622.exe 08406.exe PID 1276 wrote to memory of 1060 1276 48622.exe 08406.exe PID 1276 wrote to memory of 1060 1276 48622.exe 08406.exe PID 1276 wrote to memory of 1060 1276 48622.exe 08406.exe PID 1060 wrote to memory of 1616 1060 08406.exe k24404.exe PID 1060 wrote to memory of 1616 1060 08406.exe k24404.exe PID 1060 wrote to memory of 1616 1060 08406.exe k24404.exe PID 1060 wrote to memory of 1616 1060 08406.exe k24404.exe PID 1616 wrote to memory of 580 1616 k24404.exe jdpvd.exe PID 1616 wrote to memory of 580 1616 k24404.exe jdpvd.exe PID 1616 wrote to memory of 580 1616 k24404.exe jdpvd.exe PID 1616 wrote to memory of 580 1616 k24404.exe jdpvd.exe PID 580 wrote to memory of 2620 580 jdpvd.exe k48466.exe PID 580 wrote to memory of 2620 580 jdpvd.exe k48466.exe PID 580 wrote to memory of 2620 580 jdpvd.exe k48466.exe PID 580 wrote to memory of 2620 580 jdpvd.exe k48466.exe PID 2620 wrote to memory of 2868 2620 k48466.exe 060680.exe PID 2620 wrote to memory of 2868 2620 k48466.exe 060680.exe PID 2620 wrote to memory of 2868 2620 k48466.exe 060680.exe PID 2620 wrote to memory of 2868 2620 k48466.exe 060680.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe"C:\Users\Admin\AppData\Local\Temp\e410cd0189d8717eaceadd677ce79a8d8bdf68ae4ab865732858c677eac5f4ff.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\ntbtbh.exec:\ntbtbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\w86860.exec:\w86860.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\066060.exec:\066060.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\btthnh.exec:\btthnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\420628.exec:\420628.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\6024662.exec:\6024662.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\w86682.exec:\w86682.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\0480280.exec:\0480280.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\a4286.exec:\a4286.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\jvjjv.exec:\jvjjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\48622.exec:\48622.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\08406.exec:\08406.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\k24404.exec:\k24404.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\jdpvd.exec:\jdpvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\k48466.exec:\k48466.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\060680.exec:\060680.exe17⤵
- Executes dropped EXE
PID:2868 -
\??\c:\1xllrxl.exec:\1xllrxl.exe18⤵
- Executes dropped EXE
PID:772 -
\??\c:\8802064.exec:\8802064.exe19⤵
- Executes dropped EXE
PID:2976 -
\??\c:\g8684.exec:\g8684.exe20⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jjdpv.exec:\jjdpv.exe21⤵
- Executes dropped EXE
PID:2284 -
\??\c:\5llrfrx.exec:\5llrfrx.exe22⤵
- Executes dropped EXE
PID:2380 -
\??\c:\c864846.exec:\c864846.exe23⤵
- Executes dropped EXE
PID:464 -
\??\c:\000064.exec:\000064.exe24⤵
- Executes dropped EXE
PID:2516 -
\??\c:\7rllxrx.exec:\7rllxrx.exe25⤵
- Executes dropped EXE
PID:1708 -
\??\c:\jjpjj.exec:\jjpjj.exe26⤵
- Executes dropped EXE
PID:2020 -
\??\c:\02028.exec:\02028.exe27⤵
- Executes dropped EXE
PID:1752 -
\??\c:\0862828.exec:\0862828.exe28⤵
- Executes dropped EXE
PID:1692 -
\??\c:\6404006.exec:\6404006.exe29⤵
- Executes dropped EXE
PID:2080 -
\??\c:\208466.exec:\208466.exe30⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jjjdp.exec:\jjjdp.exe31⤵
- Executes dropped EXE
PID:2340 -
\??\c:\e26684.exec:\e26684.exe32⤵
- Executes dropped EXE
PID:1856 -
\??\c:\3jddp.exec:\3jddp.exe33⤵
- Executes dropped EXE
PID:904 -
\??\c:\5bnhtn.exec:\5bnhtn.exe34⤵
- Executes dropped EXE
PID:2464 -
\??\c:\82288.exec:\82288.exe35⤵
- Executes dropped EXE
PID:1904 -
\??\c:\8606888.exec:\8606888.exe36⤵
- Executes dropped EXE
PID:1700 -
\??\c:\824082.exec:\824082.exe37⤵
- Executes dropped EXE
PID:2704 -
\??\c:\fxrxflf.exec:\fxrxflf.exe38⤵
- Executes dropped EXE
PID:2756 -
\??\c:\0424286.exec:\0424286.exe39⤵
- Executes dropped EXE
PID:2764 -
\??\c:\3jppv.exec:\3jppv.exe40⤵
- Executes dropped EXE
PID:2760 -
\??\c:\6044068.exec:\6044068.exe41⤵
- Executes dropped EXE
PID:2828 -
\??\c:\llfflrx.exec:\llfflrx.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\4246626.exec:\4246626.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\4284444.exec:\4284444.exe44⤵
- Executes dropped EXE
PID:2124 -
\??\c:\5tnttb.exec:\5tnttb.exe45⤵
- Executes dropped EXE
PID:2880 -
\??\c:\q82028.exec:\q82028.exe46⤵
- Executes dropped EXE
PID:3020 -
\??\c:\208062.exec:\208062.exe47⤵
- Executes dropped EXE
PID:2904 -
\??\c:\q68466.exec:\q68466.exe48⤵
- Executes dropped EXE
PID:708 -
\??\c:\646248.exec:\646248.exe49⤵
- Executes dropped EXE
PID:736 -
\??\c:\7xrrlxr.exec:\7xrrlxr.exe50⤵
- Executes dropped EXE
PID:1196 -
\??\c:\1pvvv.exec:\1pvvv.exe51⤵
- Executes dropped EXE
PID:1764 -
\??\c:\k64400.exec:\k64400.exe52⤵
- Executes dropped EXE
PID:860 -
\??\c:\7thhhn.exec:\7thhhn.exe53⤵
- Executes dropped EXE
PID:1320 -
\??\c:\rlxrfll.exec:\rlxrfll.exe54⤵
- Executes dropped EXE
PID:1008 -
\??\c:\884428.exec:\884428.exe55⤵
- Executes dropped EXE
PID:1828 -
\??\c:\86266.exec:\86266.exe56⤵
- Executes dropped EXE
PID:1744 -
\??\c:\3hhbhb.exec:\3hhbhb.exe57⤵
- Executes dropped EXE
PID:2968 -
\??\c:\208406.exec:\208406.exe58⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vpdpv.exec:\vpdpv.exe59⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vpdjj.exec:\vpdjj.exe60⤵
- Executes dropped EXE
PID:2292 -
\??\c:\vjppv.exec:\vjppv.exe61⤵
- Executes dropped EXE
PID:712 -
\??\c:\pdddj.exec:\pdddj.exe62⤵
- Executes dropped EXE
PID:1892 -
\??\c:\e24022.exec:\e24022.exe63⤵
- Executes dropped EXE
PID:2120 -
\??\c:\048468.exec:\048468.exe64⤵
- Executes dropped EXE
PID:788 -
\??\c:\9flflfl.exec:\9flflfl.exe65⤵
- Executes dropped EXE
PID:1708 -
\??\c:\64224.exec:\64224.exe66⤵PID:564
-
\??\c:\086840.exec:\086840.exe67⤵PID:1480
-
\??\c:\vpjpp.exec:\vpjpp.exe68⤵PID:1068
-
\??\c:\rrffxxl.exec:\rrffxxl.exe69⤵PID:2040
-
\??\c:\608088.exec:\608088.exe70⤵PID:1780
-
\??\c:\7bhhnt.exec:\7bhhnt.exe71⤵PID:2332
-
\??\c:\nnnttb.exec:\nnnttb.exe72⤵PID:3060
-
\??\c:\hbtnhn.exec:\hbtnhn.exe73⤵PID:2456
-
\??\c:\486240.exec:\486240.exe74⤵PID:2220
-
\??\c:\8282224.exec:\8282224.exe75⤵PID:2992
-
\??\c:\080684.exec:\080684.exe76⤵PID:1432
-
\??\c:\dvjpd.exec:\dvjpd.exe77⤵PID:1584
-
\??\c:\jdvvj.exec:\jdvvj.exe78⤵PID:2956
-
\??\c:\5btbhb.exec:\5btbhb.exe79⤵PID:2704
-
\??\c:\vvpjj.exec:\vvpjj.exe80⤵PID:2692
-
\??\c:\60240.exec:\60240.exe81⤵PID:2764
-
\??\c:\4800228.exec:\4800228.exe82⤵PID:2900
-
\??\c:\20262.exec:\20262.exe83⤵PID:2572
-
\??\c:\1frxxxf.exec:\1frxxxf.exe84⤵PID:3032
-
\??\c:\480062.exec:\480062.exe85⤵PID:2632
-
\??\c:\thhbnn.exec:\thhbnn.exe86⤵PID:3036
-
\??\c:\fllrffl.exec:\fllrffl.exe87⤵PID:2888
-
\??\c:\9lffllr.exec:\9lffllr.exe88⤵PID:2912
-
\??\c:\rlfffrx.exec:\rlfffrx.exe89⤵PID:2836
-
\??\c:\ppdjj.exec:\ppdjj.exe90⤵PID:1428
-
\??\c:\ttbhhn.exec:\ttbhhn.exe91⤵PID:1508
-
\??\c:\ffrxrfr.exec:\ffrxrfr.exe92⤵PID:2360
-
\??\c:\88628.exec:\88628.exe93⤵PID:1244
-
\??\c:\a6024.exec:\a6024.exe94⤵PID:2248
-
\??\c:\9vvdp.exec:\9vvdp.exe95⤵PID:2736
-
\??\c:\bbtbtb.exec:\bbtbtb.exe96⤵PID:1980
-
\??\c:\60824.exec:\60824.exe97⤵PID:2620
-
\??\c:\e26200.exec:\e26200.exe98⤵PID:772
-
\??\c:\rxxxrxr.exec:\rxxxrxr.exe99⤵PID:2184
-
\??\c:\rfrxllf.exec:\rfrxllf.exe100⤵PID:1784
-
\??\c:\442868.exec:\442868.exe101⤵PID:1908
-
\??\c:\tththn.exec:\tththn.exe102⤵PID:1100
-
\??\c:\m8624.exec:\m8624.exe103⤵PID:1792
-
\??\c:\9vpdp.exec:\9vpdp.exe104⤵PID:2292
-
\??\c:\3frxflr.exec:\3frxflr.exe105⤵PID:712
-
\??\c:\608040.exec:\608040.exe106⤵PID:1892
-
\??\c:\xxxlxxl.exec:\xxxlxxl.exe107⤵PID:2120
-
\??\c:\ddvdj.exec:\ddvdj.exe108⤵PID:788
-
\??\c:\jvjpp.exec:\jvjpp.exe109⤵PID:2412
-
\??\c:\ttnhth.exec:\ttnhth.exe110⤵PID:1752
-
\??\c:\w60684.exec:\w60684.exe111⤵PID:272
-
\??\c:\g6402.exec:\g6402.exe112⤵PID:1252
-
\??\c:\860622.exec:\860622.exe113⤵PID:2424
-
\??\c:\m6064.exec:\m6064.exe114⤵PID:2348
-
\??\c:\008806.exec:\008806.exe115⤵PID:696
-
\??\c:\4426882.exec:\4426882.exe116⤵PID:1856
-
\??\c:\04686.exec:\04686.exe117⤵PID:1492
-
\??\c:\882406.exec:\882406.exe118⤵PID:2308
-
\??\c:\480206.exec:\480206.exe119⤵PID:1588
-
\??\c:\224644.exec:\224644.exe120⤵PID:2792
-
\??\c:\28488.exec:\28488.exe121⤵PID:2664
-
\??\c:\nhhntb.exec:\nhhntb.exe122⤵PID:2128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-