Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 19:44
Behavioral task
behavioral1
Sample
1126085785f71201baecdcf699af82ca66d7220a4cad89a7be9158eb3883268a.exe
Resource
win7-20240903-en
General
-
Target
1126085785f71201baecdcf699af82ca66d7220a4cad89a7be9158eb3883268a.exe
-
Size
332KB
-
MD5
1524c7123eb53fe802c10383c06094a7
-
SHA1
333438f0d802c55d9b613e79472115f82cf399a0
-
SHA256
1126085785f71201baecdcf699af82ca66d7220a4cad89a7be9158eb3883268a
-
SHA512
a3b4b55161b0835626e3323974c7485327effde4b3c8fa481f5554f04d7a5735157c03d165d9288771dcf8c262d3628a7effeab75c4ec106ddba1bf7722170f8
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbe4:R4wFHoSHYHUrAwfMp3CD4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
Processes:
resource yara_rule behavioral1/memory/2352-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2356-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1628-24-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1628-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1804-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-119-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1972-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1996-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/864-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1080-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/836-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/836-170-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2880-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-183-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/464-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/836-196-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1416-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/444-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/444-218-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1580-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1000-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-297-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2436-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2356-331-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1804-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-359-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2816-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2172-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1972-409-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1832-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1200-463-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2248-474-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/776-497-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/984-519-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-552-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-558-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1552-970-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2676-1002-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2956-1117-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2956-1133-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2600-1199-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2428-6625-0x0000000076CD0000-0x0000000076DEF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
w26628.exe9fxxflr.exe7pvpv.exedjjvj.exe1pdvd.exe88624.exeu684608.exe604086.exe220022.exe4880800.exe20402.exepdppp.exe1xxlrlr.exe7fxxlrf.exebtnntb.exe00406.exerrrxlrx.exe26846.exenhbnbn.exentnbth.exexrffrxl.exevpdpp.exe48846.exeo602064.exejjjjv.exea4408.exelrrxlfx.exe4884686.exe82688.exettttbh.exebnhttn.exe4820246.exe7vpvd.exe204840.exe5htbnb.exejdvjv.exe44860.exe2606448.exe9ttntn.exe820240.exe3dvdv.exepvdvp.exe426840.exe48000.exea4280.exedpjjp.exehnbtbb.exe5xrlrrf.exe086622.exek66484.exettbhbh.exe86808.exe82404.exe662646.exe082244.exethnnbh.exetnntnh.exe826824.exe886244.exexrlrflx.exe0428068.exe7frrlfr.exe846082.exehbtbnt.exepid process 2356 w26628.exe 1628 9fxxflr.exe 2220 7pvpv.exe 2512 djjvj.exe 1804 1pdvd.exe 2796 88624.exe 2688 u684608.exe 2696 604086.exe 2604 220022.exe 2752 4880800.exe 2656 20402.exe 1972 pdppp.exe 2360 1xxlrlr.exe 1996 7fxxlrf.exe 2336 btnntb.exe 864 00406.exe 1400 rrrxlrx.exe 1080 26846.exe 836 nhbnbn.exe 2880 ntnbth.exe 2088 xrffrxl.exe 464 vpdpp.exe 1416 48846.exe 2940 o602064.exe 444 jjjjv.exe 956 a4408.exe 1580 lrrxlfx.exe 1516 4884686.exe 1744 82688.exe 2568 ttttbh.exe 2424 bnhttn.exe 1780 4820246.exe 568 7vpvd.exe 1000 204840.exe 1428 5htbnb.exe 2436 jdvjv.exe 2340 44860.exe 2296 2606448.exe 2356 9ttntn.exe 2272 820240.exe 1260 3dvdv.exe 2440 pvdvp.exe 3008 426840.exe 2264 48000.exe 2776 a4280.exe 1804 dpjjp.exe 2684 hnbtbb.exe 2816 5xrlrrf.exe 2172 086622.exe 2628 k66484.exe 2636 ttbhbh.exe 2596 86808.exe 2748 82404.exe 2276 662646.exe 1728 082244.exe 1972 thnnbh.exe 1832 tnntnh.exe 1240 826824.exe 1224 886244.exe 1472 xrlrflx.exe 864 0428068.exe 2004 7frrlfr.exe 1200 846082.exe 1080 hbtbnt.exe -
Processes:
resource yara_rule behavioral1/memory/2352-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\w26628.exe upx behavioral1/memory/2356-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2352-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2356-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9fxxflr.exe upx \??\c:\7pvpv.exe upx behavioral1/memory/1628-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2220-34-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djjvj.exe upx C:\1pdvd.exe upx behavioral1/memory/2512-44-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\88624.exe upx behavioral1/memory/1804-53-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\u684608.exe upx behavioral1/memory/2796-61-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\604086.exe upx behavioral1/memory/2688-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1804-79-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2696-81-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\220022.exe upx C:\4880800.exe upx C:\20402.exe upx behavioral1/memory/2752-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2656-102-0x00000000002A0000-0x00000000002C7000-memory.dmp upx C:\pdppp.exe upx behavioral1/memory/2656-107-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1xxlrlr.exe upx C:\7fxxlrf.exe upx behavioral1/memory/1972-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1996-130-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btnntb.exe upx C:\00406.exe upx behavioral1/memory/864-145-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrrxlrx.exe upx C:\26846.exe upx behavioral1/memory/1080-161-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhbnbn.exe upx behavioral1/memory/836-169-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ntnbth.exe upx behavioral1/memory/2880-178-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrffrxl.exe upx C:\vpdpp.exe upx behavioral1/memory/464-194-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\48846.exe upx behavioral1/memory/1416-203-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\o602064.exe upx \??\c:\jjjjv.exe upx behavioral1/memory/444-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2940-213-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\a4408.exe upx C:\lrrxlfx.exe upx behavioral1/memory/1580-231-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\4884686.exe upx C:\82688.exe upx C:\ttttbh.exe upx C:\bnhttn.exe upx behavioral1/memory/2424-261-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\4820246.exe upx behavioral1/memory/1000-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2436-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2272-320-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1804-353-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2816-365-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
g6020.exerfxrxrx.exe2660800.exe60084.exehhhnth.exevjvvd.exe4868006.exe1bbthh.exe86066.exe4646842.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g6020.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2660800.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60084.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4868006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86066.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4646842.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1126085785f71201baecdcf699af82ca66d7220a4cad89a7be9158eb3883268a.exew26628.exe9fxxflr.exe7pvpv.exedjjvj.exe1pdvd.exe88624.exeu684608.exe604086.exe220022.exe4880800.exe20402.exepdppp.exe1xxlrlr.exe7fxxlrf.exebtnntb.exedescription pid process target process PID 2352 wrote to memory of 2356 2352 1126085785f71201baecdcf699af82ca66d7220a4cad89a7be9158eb3883268a.exe w26628.exe PID 2352 wrote to memory of 2356 2352 1126085785f71201baecdcf699af82ca66d7220a4cad89a7be9158eb3883268a.exe w26628.exe PID 2352 wrote to memory of 2356 2352 1126085785f71201baecdcf699af82ca66d7220a4cad89a7be9158eb3883268a.exe w26628.exe PID 2352 wrote to memory of 2356 2352 1126085785f71201baecdcf699af82ca66d7220a4cad89a7be9158eb3883268a.exe w26628.exe PID 2356 wrote to memory of 1628 2356 w26628.exe 9fxxflr.exe PID 2356 wrote to memory of 1628 2356 w26628.exe 9fxxflr.exe PID 2356 wrote to memory of 1628 2356 w26628.exe 9fxxflr.exe PID 2356 wrote to memory of 1628 2356 w26628.exe 9fxxflr.exe PID 1628 wrote to memory of 2220 1628 9fxxflr.exe 7pvpv.exe PID 1628 wrote to memory of 2220 1628 9fxxflr.exe 7pvpv.exe PID 1628 wrote to memory of 2220 1628 9fxxflr.exe 7pvpv.exe PID 1628 wrote to memory of 2220 1628 9fxxflr.exe 7pvpv.exe PID 2220 wrote to memory of 2512 2220 7pvpv.exe djjvj.exe PID 2220 wrote to memory of 2512 2220 7pvpv.exe djjvj.exe PID 2220 wrote to memory of 2512 2220 7pvpv.exe djjvj.exe PID 2220 wrote to memory of 2512 2220 7pvpv.exe djjvj.exe PID 2512 wrote to memory of 1804 2512 djjvj.exe 1pdvd.exe PID 2512 wrote to memory of 1804 2512 djjvj.exe 1pdvd.exe PID 2512 wrote to memory of 1804 2512 djjvj.exe 1pdvd.exe PID 2512 wrote to memory of 1804 2512 djjvj.exe 1pdvd.exe PID 1804 wrote to memory of 2796 1804 1pdvd.exe 88624.exe PID 1804 wrote to memory of 2796 1804 1pdvd.exe 88624.exe PID 1804 wrote to memory of 2796 1804 1pdvd.exe 88624.exe PID 1804 wrote to memory of 2796 1804 1pdvd.exe 88624.exe PID 2796 wrote to memory of 2688 2796 88624.exe u684608.exe PID 2796 wrote to memory of 2688 2796 88624.exe u684608.exe PID 2796 wrote to memory of 2688 2796 88624.exe u684608.exe PID 2796 wrote to memory of 2688 2796 88624.exe u684608.exe PID 2688 wrote to memory of 2696 2688 u684608.exe 604086.exe PID 2688 wrote to memory of 2696 2688 u684608.exe 604086.exe PID 2688 wrote to memory of 2696 2688 u684608.exe 604086.exe PID 2688 wrote to memory of 2696 2688 u684608.exe 604086.exe PID 2696 wrote to memory of 2604 2696 604086.exe 220022.exe PID 2696 wrote to memory of 2604 2696 604086.exe 220022.exe PID 2696 wrote to memory of 2604 2696 604086.exe 220022.exe PID 2696 wrote to memory of 2604 2696 604086.exe 220022.exe PID 2604 wrote to memory of 2752 2604 220022.exe 4880800.exe PID 2604 wrote to memory of 2752 2604 220022.exe 4880800.exe PID 2604 wrote to memory of 2752 2604 220022.exe 4880800.exe PID 2604 wrote to memory of 2752 2604 220022.exe 4880800.exe PID 2752 wrote to memory of 2656 2752 4880800.exe 20402.exe PID 2752 wrote to memory of 2656 2752 4880800.exe 20402.exe PID 2752 wrote to memory of 2656 2752 4880800.exe 20402.exe PID 2752 wrote to memory of 2656 2752 4880800.exe 20402.exe PID 2656 wrote to memory of 1972 2656 20402.exe pdppp.exe PID 2656 wrote to memory of 1972 2656 20402.exe pdppp.exe PID 2656 wrote to memory of 1972 2656 20402.exe pdppp.exe PID 2656 wrote to memory of 1972 2656 20402.exe pdppp.exe PID 1972 wrote to memory of 2360 1972 pdppp.exe 1xxlrlr.exe PID 1972 wrote to memory of 2360 1972 pdppp.exe 1xxlrlr.exe PID 1972 wrote to memory of 2360 1972 pdppp.exe 1xxlrlr.exe PID 1972 wrote to memory of 2360 1972 pdppp.exe 1xxlrlr.exe PID 2360 wrote to memory of 1996 2360 1xxlrlr.exe 7fxxlrf.exe PID 2360 wrote to memory of 1996 2360 1xxlrlr.exe 7fxxlrf.exe PID 2360 wrote to memory of 1996 2360 1xxlrlr.exe 7fxxlrf.exe PID 2360 wrote to memory of 1996 2360 1xxlrlr.exe 7fxxlrf.exe PID 1996 wrote to memory of 2336 1996 7fxxlrf.exe btnntb.exe PID 1996 wrote to memory of 2336 1996 7fxxlrf.exe btnntb.exe PID 1996 wrote to memory of 2336 1996 7fxxlrf.exe btnntb.exe PID 1996 wrote to memory of 2336 1996 7fxxlrf.exe btnntb.exe PID 2336 wrote to memory of 864 2336 btnntb.exe 00406.exe PID 2336 wrote to memory of 864 2336 btnntb.exe 00406.exe PID 2336 wrote to memory of 864 2336 btnntb.exe 00406.exe PID 2336 wrote to memory of 864 2336 btnntb.exe 00406.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1126085785f71201baecdcf699af82ca66d7220a4cad89a7be9158eb3883268a.exe"C:\Users\Admin\AppData\Local\Temp\1126085785f71201baecdcf699af82ca66d7220a4cad89a7be9158eb3883268a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\w26628.exec:\w26628.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\9fxxflr.exec:\9fxxflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\7pvpv.exec:\7pvpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\djjvj.exec:\djjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\1pdvd.exec:\1pdvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\88624.exec:\88624.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\u684608.exec:\u684608.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\604086.exec:\604086.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\220022.exec:\220022.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\4880800.exec:\4880800.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\20402.exec:\20402.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\pdppp.exec:\pdppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\1xxlrlr.exec:\1xxlrlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\7fxxlrf.exec:\7fxxlrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\btnntb.exec:\btnntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\00406.exec:\00406.exe17⤵
- Executes dropped EXE
PID:864 -
\??\c:\rrrxlrx.exec:\rrrxlrx.exe18⤵
- Executes dropped EXE
PID:1400 -
\??\c:\26846.exec:\26846.exe19⤵
- Executes dropped EXE
PID:1080 -
\??\c:\nhbnbn.exec:\nhbnbn.exe20⤵
- Executes dropped EXE
PID:836 -
\??\c:\ntnbth.exec:\ntnbth.exe21⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xrffrxl.exec:\xrffrxl.exe22⤵
- Executes dropped EXE
PID:2088 -
\??\c:\vpdpp.exec:\vpdpp.exe23⤵
- Executes dropped EXE
PID:464 -
\??\c:\48846.exec:\48846.exe24⤵
- Executes dropped EXE
PID:1416 -
\??\c:\o602064.exec:\o602064.exe25⤵
- Executes dropped EXE
PID:2940 -
\??\c:\jjjjv.exec:\jjjjv.exe26⤵
- Executes dropped EXE
PID:444 -
\??\c:\a4408.exec:\a4408.exe27⤵
- Executes dropped EXE
PID:956 -
\??\c:\lrrxlfx.exec:\lrrxlfx.exe28⤵
- Executes dropped EXE
PID:1580 -
\??\c:\4884686.exec:\4884686.exe29⤵
- Executes dropped EXE
PID:1516 -
\??\c:\82688.exec:\82688.exe30⤵
- Executes dropped EXE
PID:1744 -
\??\c:\ttttbh.exec:\ttttbh.exe31⤵
- Executes dropped EXE
PID:2568 -
\??\c:\bnhttn.exec:\bnhttn.exe32⤵
- Executes dropped EXE
PID:2424 -
\??\c:\4820246.exec:\4820246.exe33⤵
- Executes dropped EXE
PID:1780 -
\??\c:\7vpvd.exec:\7vpvd.exe34⤵
- Executes dropped EXE
PID:568 -
\??\c:\204840.exec:\204840.exe35⤵
- Executes dropped EXE
PID:1000 -
\??\c:\5htbnb.exec:\5htbnb.exe36⤵
- Executes dropped EXE
PID:1428 -
\??\c:\jdvjv.exec:\jdvjv.exe37⤵
- Executes dropped EXE
PID:2436 -
\??\c:\44860.exec:\44860.exe38⤵
- Executes dropped EXE
PID:2340 -
\??\c:\2606448.exec:\2606448.exe39⤵
- Executes dropped EXE
PID:2296 -
\??\c:\9ttntn.exec:\9ttntn.exe40⤵
- Executes dropped EXE
PID:2356 -
\??\c:\820240.exec:\820240.exe41⤵
- Executes dropped EXE
PID:2272 -
\??\c:\3dvdv.exec:\3dvdv.exe42⤵
- Executes dropped EXE
PID:1260 -
\??\c:\pvdvp.exec:\pvdvp.exe43⤵
- Executes dropped EXE
PID:2440 -
\??\c:\426840.exec:\426840.exe44⤵
- Executes dropped EXE
PID:3008 -
\??\c:\48000.exec:\48000.exe45⤵
- Executes dropped EXE
PID:2264 -
\??\c:\a4280.exec:\a4280.exe46⤵
- Executes dropped EXE
PID:2776 -
\??\c:\dpjjp.exec:\dpjjp.exe47⤵
- Executes dropped EXE
PID:1804 -
\??\c:\hnbtbb.exec:\hnbtbb.exe48⤵
- Executes dropped EXE
PID:2684 -
\??\c:\5xrlrrf.exec:\5xrlrrf.exe49⤵
- Executes dropped EXE
PID:2816 -
\??\c:\086622.exec:\086622.exe50⤵
- Executes dropped EXE
PID:2172 -
\??\c:\k66484.exec:\k66484.exe51⤵
- Executes dropped EXE
PID:2628 -
\??\c:\ttbhbh.exec:\ttbhbh.exe52⤵
- Executes dropped EXE
PID:2636 -
\??\c:\86808.exec:\86808.exe53⤵
- Executes dropped EXE
PID:2596 -
\??\c:\82404.exec:\82404.exe54⤵
- Executes dropped EXE
PID:2748 -
\??\c:\662646.exec:\662646.exe55⤵
- Executes dropped EXE
PID:2276 -
\??\c:\082244.exec:\082244.exe56⤵
- Executes dropped EXE
PID:1728 -
\??\c:\thnnbh.exec:\thnnbh.exe57⤵
- Executes dropped EXE
PID:1972 -
\??\c:\tnntnh.exec:\tnntnh.exe58⤵
- Executes dropped EXE
PID:1832 -
\??\c:\826824.exec:\826824.exe59⤵
- Executes dropped EXE
PID:1240 -
\??\c:\886244.exec:\886244.exe60⤵
- Executes dropped EXE
PID:1224 -
\??\c:\xrlrflx.exec:\xrlrflx.exe61⤵
- Executes dropped EXE
PID:1472 -
\??\c:\0428068.exec:\0428068.exe62⤵
- Executes dropped EXE
PID:864 -
\??\c:\7frrlfr.exec:\7frrlfr.exe63⤵
- Executes dropped EXE
PID:2004 -
\??\c:\846082.exec:\846082.exe64⤵
- Executes dropped EXE
PID:1200 -
\??\c:\hbtbnt.exec:\hbtbnt.exe65⤵
- Executes dropped EXE
PID:1080 -
\??\c:\e82466.exec:\e82466.exe66⤵PID:2972
-
\??\c:\jdjjv.exec:\jdjjv.exe67⤵PID:2224
-
\??\c:\44604.exec:\44604.exe68⤵PID:2252
-
\??\c:\c606442.exec:\c606442.exe69⤵PID:2248
-
\??\c:\tnhhnh.exec:\tnhhnh.exe70⤵PID:776
-
\??\c:\5ppjv.exec:\5ppjv.exe71⤵PID:2300
-
\??\c:\4868006.exec:\4868006.exe72⤵
- System Location Discovery: System Language Discovery
PID:2412 -
\??\c:\fxlxllr.exec:\fxlxllr.exe73⤵PID:2932
-
\??\c:\7dvpv.exec:\7dvpv.exe74⤵PID:1952
-
\??\c:\3llxflx.exec:\3llxflx.exe75⤵PID:444
-
\??\c:\04806.exec:\04806.exe76⤵PID:1304
-
\??\c:\604688.exec:\604688.exe77⤵PID:984
-
\??\c:\a6066.exec:\a6066.exe78⤵PID:1840
-
\??\c:\tbbbnt.exec:\tbbbnt.exe79⤵PID:1652
-
\??\c:\4868466.exec:\4868466.exe80⤵PID:2260
-
\??\c:\5tnhnt.exec:\5tnhnt.exe81⤵PID:3052
-
\??\c:\266808.exec:\266808.exe82⤵PID:2952
-
\??\c:\0802406.exec:\0802406.exe83⤵PID:2328
-
\??\c:\1rrfxlr.exec:\1rrfxlr.exe84⤵PID:2104
-
\??\c:\48680.exec:\48680.exe85⤵PID:2948
-
\??\c:\60468.exec:\60468.exe86⤵PID:888
-
\??\c:\jjdpd.exec:\jjdpd.exe87⤵PID:2120
-
\??\c:\86000.exec:\86000.exe88⤵PID:2544
-
\??\c:\dpjjj.exec:\dpjjj.exe89⤵PID:2340
-
\??\c:\42626.exec:\42626.exe90⤵PID:2092
-
\??\c:\8884026.exec:\8884026.exe91⤵PID:2356
-
\??\c:\7dpvd.exec:\7dpvd.exe92⤵PID:1628
-
\??\c:\nhtnhb.exec:\nhtnhb.exe93⤵PID:2504
-
\??\c:\0046664.exec:\0046664.exe94⤵PID:2848
-
\??\c:\228046.exec:\228046.exe95⤵PID:3068
-
\??\c:\ffxlflr.exec:\ffxlflr.exe96⤵PID:2832
-
\??\c:\48240.exec:\48240.exe97⤵PID:3064
-
\??\c:\048062.exec:\048062.exe98⤵PID:2712
-
\??\c:\bbhbtb.exec:\bbhbtb.exe99⤵PID:2820
-
\??\c:\jvpdd.exec:\jvpdd.exe100⤵PID:2128
-
\??\c:\6000062.exec:\6000062.exe101⤵PID:2608
-
\??\c:\9rlxllr.exec:\9rlxllr.exe102⤵PID:2804
-
\??\c:\7dvdp.exec:\7dvdp.exe103⤵PID:2604
-
\??\c:\o646446.exec:\o646446.exe104⤵PID:2644
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe105⤵PID:2992
-
\??\c:\7pdjp.exec:\7pdjp.exe106⤵PID:2988
-
\??\c:\llxrxxl.exec:\llxrxxl.exe107⤵PID:280
-
\??\c:\5pvdp.exec:\5pvdp.exe108⤵PID:1728
-
\??\c:\3jdjv.exec:\3jdjv.exe109⤵PID:1380
-
\??\c:\3nhtnb.exec:\3nhtnb.exe110⤵PID:328
-
\??\c:\9hnbnb.exec:\9hnbnb.exe111⤵PID:1876
-
\??\c:\486600.exec:\486600.exe112⤵PID:1560
-
\??\c:\xrfxffl.exec:\xrfxffl.exe113⤵PID:848
-
\??\c:\bbhhtb.exec:\bbhhtb.exe114⤵PID:1400
-
\??\c:\q42466.exec:\q42466.exe115⤵PID:756
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe116⤵PID:2984
-
\??\c:\w08864.exec:\w08864.exe117⤵PID:2876
-
\??\c:\jjjvd.exec:\jjjvd.exe118⤵PID:1732
-
\??\c:\vpjjj.exec:\vpjjj.exe119⤵PID:2180
-
\??\c:\8222406.exec:\8222406.exe120⤵PID:2252
-
\??\c:\vpjpv.exec:\vpjpv.exe121⤵PID:2236
-
\??\c:\m8668.exec:\m8668.exe122⤵PID:1564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-