Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 19:57
Behavioral task
behavioral1
Sample
efab4e55f715fc0bcf1b1ebf74509c5b96a010ecc76885200a8a96fb161ba3e6N.exe
Resource
win7-20240708-en
General
-
Target
efab4e55f715fc0bcf1b1ebf74509c5b96a010ecc76885200a8a96fb161ba3e6N.exe
-
Size
335KB
-
MD5
3352ae640f8d2019a968527ea34338f0
-
SHA1
0f78bda70a60163b91bae2082e6b9d2f4124cadc
-
SHA256
efab4e55f715fc0bcf1b1ebf74509c5b96a010ecc76885200a8a96fb161ba3e6
-
SHA512
5fdcf2896e3fddc0c102aa88ca2df0b42fa23fe966569efb27a27e38625ccd1dcb2645148fc62fa4e61fbb15535c1b6e3d016b662002331c28807c31865b7505
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeRb:R4wFHoSHYHUrAwfMp3CDRb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
Processes:
resource yara_rule behavioral1/memory/2984-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1656-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1256-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-157-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2004-156-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1488-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1916-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1032-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/856-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2192-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1584-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-327-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2696-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1512-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1876-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-515-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-563-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2076-562-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-623-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3060-627-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-665-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2036-671-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1144-673-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-700-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/760-733-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2432-759-0x0000000077250000-0x000000007734A000-memory.dmp family_blackmoon behavioral1/memory/2432-758-0x0000000077350000-0x000000007746F000-memory.dmp family_blackmoon behavioral1/memory/2856-938-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2388-955-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3052-1018-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2148-1072-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1220-1206-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2432-7283-0x0000000077250000-0x000000007734A000-memory.dmp family_blackmoon behavioral1/memory/2432-8489-0x0000000077350000-0x000000007746F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vpdvj.exeg6884.exew66840.exe602626.exenhbthn.exe246006.exem4246.exe882280.exefxllxfr.exefxrfrfl.exeq02662.exe1tbhtt.exe08848.exejjvdp.exe820028.exes4228.exe7tbtnt.exe48620.exe42440.exe22646.exe646024.exe0460628.exetnbbnn.exe64228.exe7rxrllx.exe2222408.exerrrxflx.exexrlrxxf.exe264668.exe26248.exe8240280.exevpjjd.exenhthtt.exe42024.exelxffrrx.exeo026228.exec022884.exes8040.exerffxlff.exebbnbhn.exe7vjvv.exes6488.exe20404.exe9pdvv.exek28882.exew68400.exe868004.exe240026.exe1vvdp.exerfrrxxx.exenbntnn.exe420004.exenbhbbt.exebnntbb.exe86888.exe868828.exebtnnbh.exe86888.exehbtbhh.exe2080624.exexrrrffl.exebnbbbb.exe042288.exe86484.exepid process 3040 vpdvj.exe 2912 g6884.exe 2492 w66840.exe 2056 602626.exe 2836 nhbthn.exe 2740 246006.exe 2244 m4246.exe 2560 882280.exe 2828 fxllxfr.exe 3036 fxrfrfl.exe 2816 q02662.exe 2604 1tbhtt.exe 3008 08848.exe 1656 jjvdp.exe 1256 820028.exe 1532 s4228.exe 1812 7tbtnt.exe 2004 48620.exe 1488 42440.exe 1916 22646.exe 2860 646024.exe 2848 0460628.exe 2592 tnbbnn.exe 576 64228.exe 1032 7rxrllx.exe 2376 2222408.exe 1792 rrrxflx.exe 656 xrlrxxf.exe 856 264668.exe 2188 26248.exe 292 8240280.exe 540 vpjjd.exe 2192 nhthtt.exe 3068 42024.exe 3052 lxffrrx.exe 1584 o026228.exe 2636 c022884.exe 2104 s8040.exe 284 rffxlff.exe 2076 bbnbhn.exe 2408 7vjvv.exe 2168 s6488.exe 2660 20404.exe 2696 9pdvv.exe 2744 k28882.exe 2808 w68400.exe 2656 868004.exe 2840 240026.exe 2724 1vvdp.exe 2628 rfrrxxx.exe 2804 nbntnn.exe 2720 420004.exe 688 nbhbbt.exe 1688 bnntbb.exe 1512 86888.exe 1824 868828.exe 2112 btnnbh.exe 1644 86888.exe 1876 hbtbhh.exe 2036 2080624.exe 1724 xrrrffl.exe 1444 bnbbbb.exe 2796 042288.exe 1768 86484.exe -
Processes:
resource yara_rule behavioral1/memory/2984-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2984-6-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\vpdvj.exe upx behavioral1/memory/2984-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3040-16-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\g6884.exe upx behavioral1/memory/2912-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2492-26-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\w66840.exe upx behavioral1/memory/2492-34-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\602626.exe upx behavioral1/memory/2056-44-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhbthn.exe upx behavioral1/memory/2836-53-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\246006.exe upx behavioral1/memory/2740-62-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\m4246.exe upx C:\882280.exe upx behavioral1/memory/2560-78-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxllxfr.exe upx C:\fxrfrfl.exe upx behavioral1/memory/2828-86-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\q02662.exe upx behavioral1/memory/2604-103-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1tbhtt.exe upx \??\c:\08848.exe upx C:\jjvdp.exe upx behavioral1/memory/2604-111-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\820028.exe upx behavioral1/memory/1656-127-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\s4228.exe upx behavioral1/memory/1256-134-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7tbtnt.exe upx \??\c:\48620.exe upx C:\42440.exe upx C:\22646.exe upx behavioral1/memory/1488-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1916-174-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\646024.exe upx C:\0460628.exe upx behavioral1/memory/2848-189-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnbbnn.exe upx C:\64228.exe upx \??\c:\7rxrllx.exe upx C:\2222408.exe upx behavioral1/memory/1032-212-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrrxflx.exe upx behavioral1/memory/1792-227-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrlrxxf.exe upx C:\264668.exe upx behavioral1/memory/856-242-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\26248.exe upx C:\8240280.exe upx behavioral1/memory/2188-250-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\vpjjd.exe upx behavioral1/memory/2192-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1584-287-0x00000000002A0000-0x00000000002C7000-memory.dmp upx behavioral1/memory/1584-288-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2660-327-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2696-333-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2408-334-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2656-362-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1512-393-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
2202446.exes4066.exe86662.exexrffrrf.exevvvvd.exec428880.exe00668.exe048082.exe008484.exetthnnh.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2202446.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s4066.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86662.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c428880.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00668.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 048082.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 008484.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
efab4e55f715fc0bcf1b1ebf74509c5b96a010ecc76885200a8a96fb161ba3e6N.exevpdvj.exeg6884.exew66840.exe602626.exenhbthn.exe246006.exem4246.exe882280.exefxllxfr.exefxrfrfl.exeq02662.exe1tbhtt.exe08848.exejjvdp.exe820028.exedescription pid process target process PID 2984 wrote to memory of 3040 2984 efab4e55f715fc0bcf1b1ebf74509c5b96a010ecc76885200a8a96fb161ba3e6N.exe vpdvj.exe PID 2984 wrote to memory of 3040 2984 efab4e55f715fc0bcf1b1ebf74509c5b96a010ecc76885200a8a96fb161ba3e6N.exe vpdvj.exe PID 2984 wrote to memory of 3040 2984 efab4e55f715fc0bcf1b1ebf74509c5b96a010ecc76885200a8a96fb161ba3e6N.exe vpdvj.exe PID 2984 wrote to memory of 3040 2984 efab4e55f715fc0bcf1b1ebf74509c5b96a010ecc76885200a8a96fb161ba3e6N.exe vpdvj.exe PID 3040 wrote to memory of 2912 3040 vpdvj.exe g6884.exe PID 3040 wrote to memory of 2912 3040 vpdvj.exe g6884.exe PID 3040 wrote to memory of 2912 3040 vpdvj.exe g6884.exe PID 3040 wrote to memory of 2912 3040 vpdvj.exe g6884.exe PID 2912 wrote to memory of 2492 2912 g6884.exe w66840.exe PID 2912 wrote to memory of 2492 2912 g6884.exe w66840.exe PID 2912 wrote to memory of 2492 2912 g6884.exe w66840.exe PID 2912 wrote to memory of 2492 2912 g6884.exe w66840.exe PID 2492 wrote to memory of 2056 2492 w66840.exe 602626.exe PID 2492 wrote to memory of 2056 2492 w66840.exe 602626.exe PID 2492 wrote to memory of 2056 2492 w66840.exe 602626.exe PID 2492 wrote to memory of 2056 2492 w66840.exe 602626.exe PID 2056 wrote to memory of 2836 2056 602626.exe nhbthn.exe PID 2056 wrote to memory of 2836 2056 602626.exe nhbthn.exe PID 2056 wrote to memory of 2836 2056 602626.exe nhbthn.exe PID 2056 wrote to memory of 2836 2056 602626.exe nhbthn.exe PID 2836 wrote to memory of 2740 2836 nhbthn.exe 246006.exe PID 2836 wrote to memory of 2740 2836 nhbthn.exe 246006.exe PID 2836 wrote to memory of 2740 2836 nhbthn.exe 246006.exe PID 2836 wrote to memory of 2740 2836 nhbthn.exe 246006.exe PID 2740 wrote to memory of 2244 2740 246006.exe m4246.exe PID 2740 wrote to memory of 2244 2740 246006.exe m4246.exe PID 2740 wrote to memory of 2244 2740 246006.exe m4246.exe PID 2740 wrote to memory of 2244 2740 246006.exe m4246.exe PID 2244 wrote to memory of 2560 2244 m4246.exe 882280.exe PID 2244 wrote to memory of 2560 2244 m4246.exe 882280.exe PID 2244 wrote to memory of 2560 2244 m4246.exe 882280.exe PID 2244 wrote to memory of 2560 2244 m4246.exe 882280.exe PID 2560 wrote to memory of 2828 2560 882280.exe fxllxfr.exe PID 2560 wrote to memory of 2828 2560 882280.exe fxllxfr.exe PID 2560 wrote to memory of 2828 2560 882280.exe fxllxfr.exe PID 2560 wrote to memory of 2828 2560 882280.exe fxllxfr.exe PID 2828 wrote to memory of 3036 2828 fxllxfr.exe fxrfrfl.exe PID 2828 wrote to memory of 3036 2828 fxllxfr.exe fxrfrfl.exe PID 2828 wrote to memory of 3036 2828 fxllxfr.exe fxrfrfl.exe PID 2828 wrote to memory of 3036 2828 fxllxfr.exe fxrfrfl.exe PID 3036 wrote to memory of 2816 3036 fxrfrfl.exe q02662.exe PID 3036 wrote to memory of 2816 3036 fxrfrfl.exe q02662.exe PID 3036 wrote to memory of 2816 3036 fxrfrfl.exe q02662.exe PID 3036 wrote to memory of 2816 3036 fxrfrfl.exe q02662.exe PID 2816 wrote to memory of 2604 2816 q02662.exe 1tbhtt.exe PID 2816 wrote to memory of 2604 2816 q02662.exe 1tbhtt.exe PID 2816 wrote to memory of 2604 2816 q02662.exe 1tbhtt.exe PID 2816 wrote to memory of 2604 2816 q02662.exe 1tbhtt.exe PID 2604 wrote to memory of 3008 2604 1tbhtt.exe 08848.exe PID 2604 wrote to memory of 3008 2604 1tbhtt.exe 08848.exe PID 2604 wrote to memory of 3008 2604 1tbhtt.exe 08848.exe PID 2604 wrote to memory of 3008 2604 1tbhtt.exe 08848.exe PID 3008 wrote to memory of 1656 3008 08848.exe jjvdp.exe PID 3008 wrote to memory of 1656 3008 08848.exe jjvdp.exe PID 3008 wrote to memory of 1656 3008 08848.exe jjvdp.exe PID 3008 wrote to memory of 1656 3008 08848.exe jjvdp.exe PID 1656 wrote to memory of 1256 1656 jjvdp.exe 820028.exe PID 1656 wrote to memory of 1256 1656 jjvdp.exe 820028.exe PID 1656 wrote to memory of 1256 1656 jjvdp.exe 820028.exe PID 1656 wrote to memory of 1256 1656 jjvdp.exe 820028.exe PID 1256 wrote to memory of 1532 1256 820028.exe s4228.exe PID 1256 wrote to memory of 1532 1256 820028.exe s4228.exe PID 1256 wrote to memory of 1532 1256 820028.exe s4228.exe PID 1256 wrote to memory of 1532 1256 820028.exe s4228.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\efab4e55f715fc0bcf1b1ebf74509c5b96a010ecc76885200a8a96fb161ba3e6N.exe"C:\Users\Admin\AppData\Local\Temp\efab4e55f715fc0bcf1b1ebf74509c5b96a010ecc76885200a8a96fb161ba3e6N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\vpdvj.exec:\vpdvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\g6884.exec:\g6884.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\w66840.exec:\w66840.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\602626.exec:\602626.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\nhbthn.exec:\nhbthn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\246006.exec:\246006.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\m4246.exec:\m4246.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\882280.exec:\882280.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\fxllxfr.exec:\fxllxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\fxrfrfl.exec:\fxrfrfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\q02662.exec:\q02662.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\1tbhtt.exec:\1tbhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\08848.exec:\08848.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\jjvdp.exec:\jjvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\820028.exec:\820028.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\s4228.exec:\s4228.exe17⤵
- Executes dropped EXE
PID:1532 -
\??\c:\7tbtnt.exec:\7tbtnt.exe18⤵
- Executes dropped EXE
PID:1812 -
\??\c:\48620.exec:\48620.exe19⤵
- Executes dropped EXE
PID:2004 -
\??\c:\42440.exec:\42440.exe20⤵
- Executes dropped EXE
PID:1488 -
\??\c:\22646.exec:\22646.exe21⤵
- Executes dropped EXE
PID:1916 -
\??\c:\646024.exec:\646024.exe22⤵
- Executes dropped EXE
PID:2860 -
\??\c:\0460628.exec:\0460628.exe23⤵
- Executes dropped EXE
PID:2848 -
\??\c:\tnbbnn.exec:\tnbbnn.exe24⤵
- Executes dropped EXE
PID:2592 -
\??\c:\64228.exec:\64228.exe25⤵
- Executes dropped EXE
PID:576 -
\??\c:\7rxrllx.exec:\7rxrllx.exe26⤵
- Executes dropped EXE
PID:1032 -
\??\c:\2222408.exec:\2222408.exe27⤵
- Executes dropped EXE
PID:2376 -
\??\c:\rrrxflx.exec:\rrrxflx.exe28⤵
- Executes dropped EXE
PID:1792 -
\??\c:\xrlrxxf.exec:\xrlrxxf.exe29⤵
- Executes dropped EXE
PID:656 -
\??\c:\264668.exec:\264668.exe30⤵
- Executes dropped EXE
PID:856 -
\??\c:\26248.exec:\26248.exe31⤵
- Executes dropped EXE
PID:2188 -
\??\c:\8240280.exec:\8240280.exe32⤵
- Executes dropped EXE
PID:292 -
\??\c:\vpjjd.exec:\vpjjd.exe33⤵
- Executes dropped EXE
PID:540 -
\??\c:\nhthtt.exec:\nhthtt.exe34⤵
- Executes dropped EXE
PID:2192 -
\??\c:\42024.exec:\42024.exe35⤵
- Executes dropped EXE
PID:3068 -
\??\c:\lxffrrx.exec:\lxffrrx.exe36⤵
- Executes dropped EXE
PID:3052 -
\??\c:\o026228.exec:\o026228.exe37⤵
- Executes dropped EXE
PID:1584 -
\??\c:\c022884.exec:\c022884.exe38⤵
- Executes dropped EXE
PID:2636 -
\??\c:\s8040.exec:\s8040.exe39⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rffxlff.exec:\rffxlff.exe40⤵
- Executes dropped EXE
PID:284 -
\??\c:\bbnbhn.exec:\bbnbhn.exe41⤵
- Executes dropped EXE
PID:2076 -
\??\c:\7vjvv.exec:\7vjvv.exe42⤵
- Executes dropped EXE
PID:2408 -
\??\c:\s6488.exec:\s6488.exe43⤵
- Executes dropped EXE
PID:2168 -
\??\c:\20404.exec:\20404.exe44⤵
- Executes dropped EXE
PID:2660 -
\??\c:\9pdvv.exec:\9pdvv.exe45⤵
- Executes dropped EXE
PID:2696 -
\??\c:\k28882.exec:\k28882.exe46⤵
- Executes dropped EXE
PID:2744 -
\??\c:\w68400.exec:\w68400.exe47⤵
- Executes dropped EXE
PID:2808 -
\??\c:\868004.exec:\868004.exe48⤵
- Executes dropped EXE
PID:2656 -
\??\c:\240026.exec:\240026.exe49⤵
- Executes dropped EXE
PID:2840 -
\??\c:\1vvdp.exec:\1vvdp.exe50⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rfrrxxx.exec:\rfrrxxx.exe51⤵
- Executes dropped EXE
PID:2628 -
\??\c:\nbntnn.exec:\nbntnn.exe52⤵
- Executes dropped EXE
PID:2804 -
\??\c:\420004.exec:\420004.exe53⤵
- Executes dropped EXE
PID:2720 -
\??\c:\nbhbbt.exec:\nbhbbt.exe54⤵
- Executes dropped EXE
PID:688 -
\??\c:\bnntbb.exec:\bnntbb.exe55⤵
- Executes dropped EXE
PID:1688 -
\??\c:\86888.exec:\86888.exe56⤵
- Executes dropped EXE
PID:1512 -
\??\c:\868828.exec:\868828.exe57⤵
- Executes dropped EXE
PID:1824 -
\??\c:\btnnbh.exec:\btnnbh.exe58⤵
- Executes dropped EXE
PID:2112 -
\??\c:\86888.exec:\86888.exe59⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hbtbhh.exec:\hbtbhh.exe60⤵
- Executes dropped EXE
PID:1876 -
\??\c:\2080624.exec:\2080624.exe61⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xrrrffl.exec:\xrrrffl.exe62⤵
- Executes dropped EXE
PID:1724 -
\??\c:\bnbbbb.exec:\bnbbbb.exe63⤵
- Executes dropped EXE
PID:1444 -
\??\c:\042288.exec:\042288.exe64⤵
- Executes dropped EXE
PID:2796 -
\??\c:\86484.exec:\86484.exe65⤵
- Executes dropped EXE
PID:1768 -
\??\c:\08828.exec:\08828.exe66⤵PID:2872
-
\??\c:\nthhhh.exec:\nthhhh.exe67⤵PID:2128
-
\??\c:\ppdjp.exec:\ppdjp.exe68⤵PID:2436
-
\??\c:\202806.exec:\202806.exe69⤵PID:2136
-
\??\c:\0422440.exec:\0422440.exe70⤵PID:576
-
\??\c:\xflrllr.exec:\xflrllr.exe71⤵PID:2132
-
\??\c:\vjppv.exec:\vjppv.exe72⤵PID:1748
-
\??\c:\pdjpv.exec:\pdjpv.exe73⤵PID:1548
-
\??\c:\80624.exec:\80624.exe74⤵PID:1556
-
\??\c:\8628006.exec:\8628006.exe75⤵PID:2328
-
\??\c:\9pddv.exec:\9pddv.exe76⤵PID:1840
-
\??\c:\2202008.exec:\2202008.exe77⤵PID:2384
-
\??\c:\e02244.exec:\e02244.exe78⤵PID:888
-
\??\c:\3xlxxrr.exec:\3xlxxrr.exe79⤵PID:2472
-
\??\c:\7jjpp.exec:\7jjpp.exe80⤵PID:1248
-
\??\c:\486800.exec:\486800.exe81⤵PID:2984
-
\??\c:\9pvdj.exec:\9pvdj.exe82⤵PID:3040
-
\??\c:\nhttbh.exec:\nhttbh.exe83⤵PID:348
-
\??\c:\s4606.exec:\s4606.exe84⤵PID:1056
-
\??\c:\pppdv.exec:\pppdv.exe85⤵PID:2500
-
\??\c:\42440.exec:\42440.exe86⤵PID:2052
-
\??\c:\q08460.exec:\q08460.exe87⤵PID:2056
-
\??\c:\24284.exec:\24284.exe88⤵PID:2076
-
\??\c:\rlxxxff.exec:\rlxxxff.exe89⤵PID:2768
-
\??\c:\68800.exec:\68800.exe90⤵PID:2740
-
\??\c:\6466824.exec:\6466824.exe91⤵PID:2700
-
\??\c:\frflxfl.exec:\frflxfl.exe92⤵PID:2924
-
\??\c:\64268.exec:\64268.exe93⤵PID:2884
-
\??\c:\3ffflll.exec:\3ffflll.exe94⤵PID:2716
-
\??\c:\420088.exec:\420088.exe95⤵PID:2656
-
\??\c:\rrxfllx.exec:\rrxfllx.exe96⤵PID:2712
-
\??\c:\m4620.exec:\m4620.exe97⤵PID:2624
-
\??\c:\2426626.exec:\2426626.exe98⤵PID:2548
-
\??\c:\xrfxxfl.exec:\xrfxxfl.exe99⤵PID:3032
-
\??\c:\842062.exec:\842062.exe100⤵PID:3060
-
\??\c:\8240280.exec:\8240280.exe101⤵PID:688
-
\??\c:\3rfrrlx.exec:\3rfrrlx.exe102⤵PID:1964
-
\??\c:\c088662.exec:\c088662.exe103⤵PID:1356
-
\??\c:\8622828.exec:\8622828.exe104⤵PID:1324
-
\??\c:\vvvdp.exec:\vvvdp.exe105⤵PID:1952
-
\??\c:\7bnttb.exec:\7bnttb.exe106⤵PID:1648
-
\??\c:\868822.exec:\868822.exe107⤵PID:1732
-
\??\c:\3nbbtb.exec:\3nbbtb.exe108⤵PID:2036
-
\??\c:\5lfxxfr.exec:\5lfxxfr.exe109⤵PID:1144
-
\??\c:\hbtbtt.exec:\hbtbtt.exe110⤵PID:1916
-
\??\c:\886240.exec:\886240.exe111⤵PID:2236
-
\??\c:\8686060.exec:\8686060.exe112⤵PID:2228
-
\??\c:\c222464.exec:\c222464.exe113⤵PID:3016
-
\??\c:\282460.exec:\282460.exe114⤵PID:2728
-
\??\c:\lfxlxxr.exec:\lfxlxxr.exe115⤵PID:2908
-
\??\c:\a8062.exec:\a8062.exe116⤵PID:1720
-
\??\c:\004602.exec:\004602.exe117⤵PID:1736
-
\??\c:\bnthnt.exec:\bnthnt.exe118⤵PID:1684
-
\??\c:\jjvjv.exec:\jjvjv.exe119⤵PID:2264
-
\??\c:\264686.exec:\264686.exe120⤵PID:760
-
\??\c:\nnhhht.exec:\nnhhht.exe121⤵PID:2116
-
\??\c:\k26240.exec:\k26240.exe122⤵PID:2468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-