Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 19:44
Behavioral task
behavioral1
Sample
1126085785f71201baecdcf699af82ca66d7220a4cad89a7be9158eb3883268a.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
1126085785f71201baecdcf699af82ca66d7220a4cad89a7be9158eb3883268a.exe
-
Size
332KB
-
MD5
1524c7123eb53fe802c10383c06094a7
-
SHA1
333438f0d802c55d9b613e79472115f82cf399a0
-
SHA256
1126085785f71201baecdcf699af82ca66d7220a4cad89a7be9158eb3883268a
-
SHA512
a3b4b55161b0835626e3323974c7485327effde4b3c8fa481f5554f04d7a5735157c03d165d9288771dcf8c262d3628a7effeab75c4ec106ddba1bf7722170f8
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbe4:R4wFHoSHYHUrAwfMp3CD4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/2352-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2356-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1628-24-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1628-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1804-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-119-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1972-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1996-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/864-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1080-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/836-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/836-170-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2880-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-183-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/464-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/836-196-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1416-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/444-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/444-218-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1580-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1000-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-297-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2436-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2356-331-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1804-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-359-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2816-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2172-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1972-409-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1832-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1200-463-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2248-474-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/776-497-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/984-519-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-552-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-558-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1552-970-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2676-1002-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2956-1117-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2956-1133-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2600-1199-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2428-6625-0x0000000076CD0000-0x0000000076DEF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2356 w26628.exe 1628 9fxxflr.exe 2220 7pvpv.exe 2512 djjvj.exe 1804 1pdvd.exe 2796 88624.exe 2688 u684608.exe 2696 604086.exe 2604 220022.exe 2752 4880800.exe 2656 20402.exe 1972 pdppp.exe 2360 1xxlrlr.exe 1996 7fxxlrf.exe 2336 btnntb.exe 864 00406.exe 1400 rrrxlrx.exe 1080 26846.exe 836 nhbnbn.exe 2880 ntnbth.exe 2088 xrffrxl.exe 464 vpdpp.exe 1416 48846.exe 2940 o602064.exe 444 jjjjv.exe 956 a4408.exe 1580 lrrxlfx.exe 1516 4884686.exe 1744 82688.exe 2568 ttttbh.exe 2424 bnhttn.exe 1780 4820246.exe 568 7vpvd.exe 1000 204840.exe 1428 5htbnb.exe 2436 jdvjv.exe 2340 44860.exe 2296 2606448.exe 2356 9ttntn.exe 2272 820240.exe 1260 3dvdv.exe 2440 pvdvp.exe 3008 426840.exe 2264 48000.exe 2776 a4280.exe 1804 dpjjp.exe 2684 hnbtbb.exe 2816 5xrlrrf.exe 2172 086622.exe 2628 k66484.exe 2636 ttbhbh.exe 2596 86808.exe 2748 82404.exe 2276 662646.exe 1728 082244.exe 1972 thnnbh.exe 1832 tnntnh.exe 1240 826824.exe 1224 886244.exe 1472 xrlrflx.exe 864 0428068.exe 2004 7frrlfr.exe 1200 846082.exe 1080 hbtbnt.exe -
resource yara_rule behavioral1/memory/2352-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000120f9-7.dat upx behavioral1/memory/2356-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2352-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2356-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001660e-16.dat upx behavioral1/files/0x0008000000016890-27.dat upx behavioral1/memory/1628-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2220-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c89-35.dat upx behavioral1/files/0x0007000000016ca0-43.dat upx behavioral1/memory/2512-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cab-52.dat upx behavioral1/memory/1804-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d22-62.dat upx behavioral1/memory/2796-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000174b4-70.dat upx behavioral1/memory/2688-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1804-79-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2696-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174f8-82.dat upx behavioral1/files/0x0006000000017570-89.dat upx behavioral1/files/0x00090000000162e4-97.dat upx behavioral1/memory/2752-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2656-102-0x00000000002A0000-0x00000000002C7000-memory.dmp upx behavioral1/files/0x00060000000175f1-106.dat upx behavioral1/memory/2656-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175f7-116.dat upx behavioral1/files/0x000d000000018683-123.dat upx behavioral1/memory/1972-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1996-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018697-131.dat upx behavioral1/files/0x0005000000018706-138.dat upx behavioral1/memory/864-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001870c-146.dat upx behavioral1/files/0x000500000001871c-154.dat upx behavioral1/memory/1080-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018745-162.dat upx behavioral1/memory/836-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018be7-171.dat upx behavioral1/memory/2880-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018d7b-179.dat upx behavioral1/files/0x0006000000018d83-187.dat upx behavioral1/memory/464-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018fdf-195.dat upx behavioral1/memory/1416-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019056-204.dat upx behavioral1/files/0x0005000000019203-214.dat upx behavioral1/memory/444-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2940-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019237-222.dat upx behavioral1/files/0x000500000001924f-229.dat upx behavioral1/memory/1580-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019261-238.dat upx behavioral1/files/0x0005000000019274-245.dat upx behavioral1/files/0x000500000001927a-253.dat upx behavioral1/files/0x0005000000019299-260.dat upx behavioral1/memory/2424-261-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000192a1-268.dat upx behavioral1/memory/1000-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2436-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2272-320-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1804-353-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2816-365-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g6020.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2660800.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60084.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4868006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86066.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4646842.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2356 2352 1126085785f71201baecdcf699af82ca66d7220a4cad89a7be9158eb3883268a.exe 30 PID 2352 wrote to memory of 2356 2352 1126085785f71201baecdcf699af82ca66d7220a4cad89a7be9158eb3883268a.exe 30 PID 2352 wrote to memory of 2356 2352 1126085785f71201baecdcf699af82ca66d7220a4cad89a7be9158eb3883268a.exe 30 PID 2352 wrote to memory of 2356 2352 1126085785f71201baecdcf699af82ca66d7220a4cad89a7be9158eb3883268a.exe 30 PID 2356 wrote to memory of 1628 2356 w26628.exe 31 PID 2356 wrote to memory of 1628 2356 w26628.exe 31 PID 2356 wrote to memory of 1628 2356 w26628.exe 31 PID 2356 wrote to memory of 1628 2356 w26628.exe 31 PID 1628 wrote to memory of 2220 1628 9fxxflr.exe 32 PID 1628 wrote to memory of 2220 1628 9fxxflr.exe 32 PID 1628 wrote to memory of 2220 1628 9fxxflr.exe 32 PID 1628 wrote to memory of 2220 1628 9fxxflr.exe 32 PID 2220 wrote to memory of 2512 2220 7pvpv.exe 33 PID 2220 wrote to memory of 2512 2220 7pvpv.exe 33 PID 2220 wrote to memory of 2512 2220 7pvpv.exe 33 PID 2220 wrote to memory of 2512 2220 7pvpv.exe 33 PID 2512 wrote to memory of 1804 2512 djjvj.exe 34 PID 2512 wrote to memory of 1804 2512 djjvj.exe 34 PID 2512 wrote to memory of 1804 2512 djjvj.exe 34 PID 2512 wrote to memory of 1804 2512 djjvj.exe 34 PID 1804 wrote to memory of 2796 1804 1pdvd.exe 35 PID 1804 wrote to memory of 2796 1804 1pdvd.exe 35 PID 1804 wrote to memory of 2796 1804 1pdvd.exe 35 PID 1804 wrote to memory of 2796 1804 1pdvd.exe 35 PID 2796 wrote to memory of 2688 2796 88624.exe 36 PID 2796 wrote to memory of 2688 2796 88624.exe 36 PID 2796 wrote to memory of 2688 2796 88624.exe 36 PID 2796 wrote to memory of 2688 2796 88624.exe 36 PID 2688 wrote to memory of 2696 2688 u684608.exe 37 PID 2688 wrote to memory of 2696 2688 u684608.exe 37 PID 2688 wrote to memory of 2696 2688 u684608.exe 37 PID 2688 wrote to memory of 2696 2688 u684608.exe 37 PID 2696 wrote to memory of 2604 2696 604086.exe 38 PID 2696 wrote to memory of 2604 2696 604086.exe 38 PID 2696 wrote to memory of 2604 2696 604086.exe 38 PID 2696 wrote to memory of 2604 2696 604086.exe 38 PID 2604 wrote to memory of 2752 2604 220022.exe 39 PID 2604 wrote to memory of 2752 2604 220022.exe 39 PID 2604 wrote to memory of 2752 2604 220022.exe 39 PID 2604 wrote to memory of 2752 2604 220022.exe 39 PID 2752 wrote to memory of 2656 2752 4880800.exe 40 PID 2752 wrote to memory of 2656 2752 4880800.exe 40 PID 2752 wrote to memory of 2656 2752 4880800.exe 40 PID 2752 wrote to memory of 2656 2752 4880800.exe 40 PID 2656 wrote to memory of 1972 2656 20402.exe 41 PID 2656 wrote to memory of 1972 2656 20402.exe 41 PID 2656 wrote to memory of 1972 2656 20402.exe 41 PID 2656 wrote to memory of 1972 2656 20402.exe 41 PID 1972 wrote to memory of 2360 1972 pdppp.exe 42 PID 1972 wrote to memory of 2360 1972 pdppp.exe 42 PID 1972 wrote to memory of 2360 1972 pdppp.exe 42 PID 1972 wrote to memory of 2360 1972 pdppp.exe 42 PID 2360 wrote to memory of 1996 2360 1xxlrlr.exe 43 PID 2360 wrote to memory of 1996 2360 1xxlrlr.exe 43 PID 2360 wrote to memory of 1996 2360 1xxlrlr.exe 43 PID 2360 wrote to memory of 1996 2360 1xxlrlr.exe 43 PID 1996 wrote to memory of 2336 1996 7fxxlrf.exe 44 PID 1996 wrote to memory of 2336 1996 7fxxlrf.exe 44 PID 1996 wrote to memory of 2336 1996 7fxxlrf.exe 44 PID 1996 wrote to memory of 2336 1996 7fxxlrf.exe 44 PID 2336 wrote to memory of 864 2336 btnntb.exe 45 PID 2336 wrote to memory of 864 2336 btnntb.exe 45 PID 2336 wrote to memory of 864 2336 btnntb.exe 45 PID 2336 wrote to memory of 864 2336 btnntb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1126085785f71201baecdcf699af82ca66d7220a4cad89a7be9158eb3883268a.exe"C:\Users\Admin\AppData\Local\Temp\1126085785f71201baecdcf699af82ca66d7220a4cad89a7be9158eb3883268a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\w26628.exec:\w26628.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\9fxxflr.exec:\9fxxflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\7pvpv.exec:\7pvpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\djjvj.exec:\djjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\1pdvd.exec:\1pdvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\88624.exec:\88624.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\u684608.exec:\u684608.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\604086.exec:\604086.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\220022.exec:\220022.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\4880800.exec:\4880800.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\20402.exec:\20402.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\pdppp.exec:\pdppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\1xxlrlr.exec:\1xxlrlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\7fxxlrf.exec:\7fxxlrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\btnntb.exec:\btnntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\00406.exec:\00406.exe17⤵
- Executes dropped EXE
PID:864 -
\??\c:\rrrxlrx.exec:\rrrxlrx.exe18⤵
- Executes dropped EXE
PID:1400 -
\??\c:\26846.exec:\26846.exe19⤵
- Executes dropped EXE
PID:1080 -
\??\c:\nhbnbn.exec:\nhbnbn.exe20⤵
- Executes dropped EXE
PID:836 -
\??\c:\ntnbth.exec:\ntnbth.exe21⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xrffrxl.exec:\xrffrxl.exe22⤵
- Executes dropped EXE
PID:2088 -
\??\c:\vpdpp.exec:\vpdpp.exe23⤵
- Executes dropped EXE
PID:464 -
\??\c:\48846.exec:\48846.exe24⤵
- Executes dropped EXE
PID:1416 -
\??\c:\o602064.exec:\o602064.exe25⤵
- Executes dropped EXE
PID:2940 -
\??\c:\jjjjv.exec:\jjjjv.exe26⤵
- Executes dropped EXE
PID:444 -
\??\c:\a4408.exec:\a4408.exe27⤵
- Executes dropped EXE
PID:956 -
\??\c:\lrrxlfx.exec:\lrrxlfx.exe28⤵
- Executes dropped EXE
PID:1580 -
\??\c:\4884686.exec:\4884686.exe29⤵
- Executes dropped EXE
PID:1516 -
\??\c:\82688.exec:\82688.exe30⤵
- Executes dropped EXE
PID:1744 -
\??\c:\ttttbh.exec:\ttttbh.exe31⤵
- Executes dropped EXE
PID:2568 -
\??\c:\bnhttn.exec:\bnhttn.exe32⤵
- Executes dropped EXE
PID:2424 -
\??\c:\4820246.exec:\4820246.exe33⤵
- Executes dropped EXE
PID:1780 -
\??\c:\7vpvd.exec:\7vpvd.exe34⤵
- Executes dropped EXE
PID:568 -
\??\c:\204840.exec:\204840.exe35⤵
- Executes dropped EXE
PID:1000 -
\??\c:\5htbnb.exec:\5htbnb.exe36⤵
- Executes dropped EXE
PID:1428 -
\??\c:\jdvjv.exec:\jdvjv.exe37⤵
- Executes dropped EXE
PID:2436 -
\??\c:\44860.exec:\44860.exe38⤵
- Executes dropped EXE
PID:2340 -
\??\c:\2606448.exec:\2606448.exe39⤵
- Executes dropped EXE
PID:2296 -
\??\c:\9ttntn.exec:\9ttntn.exe40⤵
- Executes dropped EXE
PID:2356 -
\??\c:\820240.exec:\820240.exe41⤵
- Executes dropped EXE
PID:2272 -
\??\c:\3dvdv.exec:\3dvdv.exe42⤵
- Executes dropped EXE
PID:1260 -
\??\c:\pvdvp.exec:\pvdvp.exe43⤵
- Executes dropped EXE
PID:2440 -
\??\c:\426840.exec:\426840.exe44⤵
- Executes dropped EXE
PID:3008 -
\??\c:\48000.exec:\48000.exe45⤵
- Executes dropped EXE
PID:2264 -
\??\c:\a4280.exec:\a4280.exe46⤵
- Executes dropped EXE
PID:2776 -
\??\c:\dpjjp.exec:\dpjjp.exe47⤵
- Executes dropped EXE
PID:1804 -
\??\c:\hnbtbb.exec:\hnbtbb.exe48⤵
- Executes dropped EXE
PID:2684 -
\??\c:\5xrlrrf.exec:\5xrlrrf.exe49⤵
- Executes dropped EXE
PID:2816 -
\??\c:\086622.exec:\086622.exe50⤵
- Executes dropped EXE
PID:2172 -
\??\c:\k66484.exec:\k66484.exe51⤵
- Executes dropped EXE
PID:2628 -
\??\c:\ttbhbh.exec:\ttbhbh.exe52⤵
- Executes dropped EXE
PID:2636 -
\??\c:\86808.exec:\86808.exe53⤵
- Executes dropped EXE
PID:2596 -
\??\c:\82404.exec:\82404.exe54⤵
- Executes dropped EXE
PID:2748 -
\??\c:\662646.exec:\662646.exe55⤵
- Executes dropped EXE
PID:2276 -
\??\c:\082244.exec:\082244.exe56⤵
- Executes dropped EXE
PID:1728 -
\??\c:\thnnbh.exec:\thnnbh.exe57⤵
- Executes dropped EXE
PID:1972 -
\??\c:\tnntnh.exec:\tnntnh.exe58⤵
- Executes dropped EXE
PID:1832 -
\??\c:\826824.exec:\826824.exe59⤵
- Executes dropped EXE
PID:1240 -
\??\c:\886244.exec:\886244.exe60⤵
- Executes dropped EXE
PID:1224 -
\??\c:\xrlrflx.exec:\xrlrflx.exe61⤵
- Executes dropped EXE
PID:1472 -
\??\c:\0428068.exec:\0428068.exe62⤵
- Executes dropped EXE
PID:864 -
\??\c:\7frrlfr.exec:\7frrlfr.exe63⤵
- Executes dropped EXE
PID:2004 -
\??\c:\846082.exec:\846082.exe64⤵
- Executes dropped EXE
PID:1200 -
\??\c:\hbtbnt.exec:\hbtbnt.exe65⤵
- Executes dropped EXE
PID:1080 -
\??\c:\e82466.exec:\e82466.exe66⤵PID:2972
-
\??\c:\jdjjv.exec:\jdjjv.exe67⤵PID:2224
-
\??\c:\44604.exec:\44604.exe68⤵PID:2252
-
\??\c:\c606442.exec:\c606442.exe69⤵PID:2248
-
\??\c:\tnhhnh.exec:\tnhhnh.exe70⤵PID:776
-
\??\c:\5ppjv.exec:\5ppjv.exe71⤵PID:2300
-
\??\c:\4868006.exec:\4868006.exe72⤵
- System Location Discovery: System Language Discovery
PID:2412 -
\??\c:\fxlxllr.exec:\fxlxllr.exe73⤵PID:2932
-
\??\c:\7dvpv.exec:\7dvpv.exe74⤵PID:1952
-
\??\c:\3llxflx.exec:\3llxflx.exe75⤵PID:444
-
\??\c:\04806.exec:\04806.exe76⤵PID:1304
-
\??\c:\604688.exec:\604688.exe77⤵PID:984
-
\??\c:\a6066.exec:\a6066.exe78⤵PID:1840
-
\??\c:\tbbbnt.exec:\tbbbnt.exe79⤵PID:1652
-
\??\c:\4868466.exec:\4868466.exe80⤵PID:2260
-
\??\c:\5tnhnt.exec:\5tnhnt.exe81⤵PID:3052
-
\??\c:\266808.exec:\266808.exe82⤵PID:2952
-
\??\c:\0802406.exec:\0802406.exe83⤵PID:2328
-
\??\c:\1rrfxlr.exec:\1rrfxlr.exe84⤵PID:2104
-
\??\c:\48680.exec:\48680.exe85⤵PID:2948
-
\??\c:\60468.exec:\60468.exe86⤵PID:888
-
\??\c:\jjdpd.exec:\jjdpd.exe87⤵PID:2120
-
\??\c:\86000.exec:\86000.exe88⤵PID:2544
-
\??\c:\dpjjj.exec:\dpjjj.exe89⤵PID:2340
-
\??\c:\42626.exec:\42626.exe90⤵PID:2092
-
\??\c:\8884026.exec:\8884026.exe91⤵PID:2356
-
\??\c:\7dpvd.exec:\7dpvd.exe92⤵PID:1628
-
\??\c:\nhtnhb.exec:\nhtnhb.exe93⤵PID:2504
-
\??\c:\0046664.exec:\0046664.exe94⤵PID:2848
-
\??\c:\228046.exec:\228046.exe95⤵PID:3068
-
\??\c:\ffxlflr.exec:\ffxlflr.exe96⤵PID:2832
-
\??\c:\48240.exec:\48240.exe97⤵PID:3064
-
\??\c:\048062.exec:\048062.exe98⤵PID:2712
-
\??\c:\bbhbtb.exec:\bbhbtb.exe99⤵PID:2820
-
\??\c:\jvpdd.exec:\jvpdd.exe100⤵PID:2128
-
\??\c:\6000062.exec:\6000062.exe101⤵PID:2608
-
\??\c:\9rlxllr.exec:\9rlxllr.exe102⤵PID:2804
-
\??\c:\7dvdp.exec:\7dvdp.exe103⤵PID:2604
-
\??\c:\o646446.exec:\o646446.exe104⤵PID:2644
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe105⤵PID:2992
-
\??\c:\7pdjp.exec:\7pdjp.exe106⤵PID:2988
-
\??\c:\llxrxxl.exec:\llxrxxl.exe107⤵PID:280
-
\??\c:\5pvdp.exec:\5pvdp.exe108⤵PID:1728
-
\??\c:\3jdjv.exec:\3jdjv.exe109⤵PID:1380
-
\??\c:\3nhtnb.exec:\3nhtnb.exe110⤵PID:328
-
\??\c:\9hnbnb.exec:\9hnbnb.exe111⤵PID:1876
-
\??\c:\486600.exec:\486600.exe112⤵PID:1560
-
\??\c:\xrfxffl.exec:\xrfxffl.exe113⤵PID:848
-
\??\c:\bbhhtb.exec:\bbhhtb.exe114⤵PID:1400
-
\??\c:\q42466.exec:\q42466.exe115⤵PID:756
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe116⤵PID:2984
-
\??\c:\w08864.exec:\w08864.exe117⤵PID:2876
-
\??\c:\jjjvd.exec:\jjjvd.exe118⤵PID:1732
-
\??\c:\vpjjj.exec:\vpjjj.exe119⤵PID:2180
-
\??\c:\8222406.exec:\8222406.exe120⤵PID:2252
-
\??\c:\vpjpv.exec:\vpjpv.exe121⤵PID:2236
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-