Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 11:17
Behavioral task
behavioral1
Sample
94c5d09e7063dba9084ce23232694c9454c520f39092cde8f6d03f45232343a2.exe
Resource
win7-20241023-en
General
-
Target
94c5d09e7063dba9084ce23232694c9454c520f39092cde8f6d03f45232343a2.exe
-
Size
332KB
-
MD5
327d873702a29e016b3efb1d652ef7f1
-
SHA1
d492d233471bd1a83a19d3f32d0fe1f4ef610514
-
SHA256
94c5d09e7063dba9084ce23232694c9454c520f39092cde8f6d03f45232343a2
-
SHA512
9ee0b24f1beb135d5a9022e711adb0f993ace447a4a3edfc0b861b884940b5145dacf73c055e7c1248d6392c967961bc9bfb9711c4faf66c1954139096c5121c
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbe2:R4wFHoSHYHUrAwfMp3CD2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
Processes:
resource yara_rule behavioral1/memory/1972-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/848-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-80-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2740-89-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2740-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-113-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2236-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1224-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-150-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2904-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-168-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2976-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-177-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2856-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1392-186-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2088-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/768-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1516-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/836-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/836-291-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2704-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-414-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1088-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/688-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-492-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/544-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1476-519-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2416-535-0x0000000076EA0000-0x0000000076FBF000-memory.dmp family_blackmoon behavioral1/memory/2416-536-0x0000000076DA0000-0x0000000076E9A000-memory.dmp family_blackmoon behavioral1/memory/2684-552-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-572-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2344-579-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2656-623-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2656-622-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2972-698-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1000-732-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1696-741-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-878-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1180-965-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2416-11651-0x0000000076EA0000-0x0000000076FBF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
428400.exew04684.exe0408624.exenbtthn.exe480800.exeffxxlrl.exedvppj.exevvjpd.exei084468.exe04242.exe0862884.exefrfflll.exe060644.exedvpdp.exe7jppv.exe5tbhtt.exerrrrxxx.exe28824.exetbhtbb.exedddjv.exe88682.exevdppj.exennthhh.exevvvdj.exe424024.exe042468.exe488664.exetnhnbh.exee88084.exeppjvj.exe1rfllrr.exeq64048.exe5vjpv.exefrrlrff.exeo462884.exe08006.exexlrxxxl.exevddvv.exeflrrrlx.exehtnntt.exe64284.exe680062.exee80000.exe4228848.exe04602.exe6660848.exe04868.exebtbhhn.exe3nhntb.exenntnnn.exevjvdj.exerlflxrx.exe260288.exexrxffll.exe222264.exe820608.exexrfrxxl.exe66802.exe486846.exek22266.exellxlflf.exehntttn.exe862402.exe400486.exepid process 848 428400.exe 2292 w04684.exe 2076 0408624.exe 2228 nbtthn.exe 2432 480800.exe 2800 ffxxlrl.exe 2728 dvppj.exe 2864 vvjpd.exe 2740 i084468.exe 2612 04242.exe 2144 0862884.exe 2236 frfflll.exe 1224 060644.exe 1840 dvpdp.exe 1856 7jppv.exe 1700 5tbhtt.exe 2904 rrrrxxx.exe 2860 28824.exe 2976 tbhtbb.exe 2856 dddjv.exe 1392 88682.exe 3020 vdppj.exe 2088 nnthhh.exe 748 vvvdj.exe 688 424024.exe 2392 042468.exe 3052 488664.exe 1208 tnhnbh.exe 768 e88084.exe 1516 ppjvj.exe 2552 1rfllrr.exe 2484 q64048.exe 2356 5vjpv.exe 2352 frrlrff.exe 836 o462884.exe 2988 08006.exe 848 xlrxxxl.exe 1888 vddvv.exe 1536 flrrrlx.exe 2556 htnntt.exe 2272 64284.exe 2704 680062.exe 2824 e80000.exe 2752 4228848.exe 2800 04602.exe 2868 6660848.exe 2764 04868.exe 2340 btbhhn.exe 2676 3nhntb.exe 2324 nntnnn.exe 1976 vjvdj.exe 2360 rlflxrx.exe 1120 260288.exe 1224 xrxffll.exe 2268 222264.exe 1840 820608.exe 1856 xrfrxxl.exe 1720 66802.exe 2784 486846.exe 2232 k22266.exe 2456 llxlflf.exe 2980 hntttn.exe 1828 862402.exe 1444 400486.exe -
Processes:
resource yara_rule behavioral1/memory/1972-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\428400.exe upx behavioral1/memory/1972-8-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\w04684.exe upx behavioral1/memory/848-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\0408624.exe upx behavioral1/memory/2292-26-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nbtthn.exe upx behavioral1/memory/2228-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2432-47-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\480800.exe upx C:\ffxxlrl.exe upx behavioral1/memory/2800-63-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvppj.exe upx behavioral1/memory/2800-61-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2728-71-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvjpd.exe upx behavioral1/memory/2864-82-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\i084468.exe upx behavioral1/memory/2740-91-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\04242.exe upx C:\0862884.exe upx behavioral1/memory/2612-98-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frfflll.exe upx C:\060644.exe upx behavioral1/memory/2236-116-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvpdp.exe upx behavioral1/memory/1224-124-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7jppv.exe upx C:\5tbhtt.exe upx C:\rrrrxxx.exe upx C:\28824.exe upx behavioral1/memory/2904-154-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbhtbb.exe upx behavioral1/memory/2860-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2976-172-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dddjv.exe upx C:\88682.exe upx behavioral1/memory/2856-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1392-186-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\vdppj.exe upx C:\nnthhh.exe upx behavioral1/memory/2088-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/748-206-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvvdj.exe upx C:\424024.exe upx C:\042468.exe upx C:\488664.exe upx behavioral1/memory/2392-227-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnhnbh.exe upx C:\e88084.exe upx behavioral1/memory/768-249-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ppjvj.exe upx behavioral1/memory/1516-257-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1rfllrr.exe upx behavioral1/memory/2552-259-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2484-274-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\q64048.exe upx behavioral1/memory/836-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2556-318-0x0000000000430000-0x0000000000457000-memory.dmp upx behavioral1/memory/2704-329-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2800-346-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2764-358-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1720-414-0x0000000000220000-0x0000000000247000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
e86684.exe1fllrfl.exebtbntn.exeq04424.exe28606.exepdddp.exe204888.exe082860.exefxrfrrf.exelxlrxrx.exe3lxlfll.exepdpjp.exe8824068.exe048460.exe9hnntt.exevvdjp.exeflrrlff.exerfffrff.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e86684.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fllrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q04424.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28606.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 204888.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 082860.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxlfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8824068.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 048460.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffrff.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
94c5d09e7063dba9084ce23232694c9454c520f39092cde8f6d03f45232343a2.exe428400.exew04684.exe0408624.exenbtthn.exe480800.exeffxxlrl.exedvppj.exevvjpd.exei084468.exe04242.exe0862884.exefrfflll.exe060644.exedvpdp.exe7jppv.exedescription pid process target process PID 1972 wrote to memory of 848 1972 94c5d09e7063dba9084ce23232694c9454c520f39092cde8f6d03f45232343a2.exe 428400.exe PID 1972 wrote to memory of 848 1972 94c5d09e7063dba9084ce23232694c9454c520f39092cde8f6d03f45232343a2.exe 428400.exe PID 1972 wrote to memory of 848 1972 94c5d09e7063dba9084ce23232694c9454c520f39092cde8f6d03f45232343a2.exe 428400.exe PID 1972 wrote to memory of 848 1972 94c5d09e7063dba9084ce23232694c9454c520f39092cde8f6d03f45232343a2.exe 428400.exe PID 848 wrote to memory of 2292 848 428400.exe w04684.exe PID 848 wrote to memory of 2292 848 428400.exe w04684.exe PID 848 wrote to memory of 2292 848 428400.exe w04684.exe PID 848 wrote to memory of 2292 848 428400.exe w04684.exe PID 2292 wrote to memory of 2076 2292 w04684.exe 0408624.exe PID 2292 wrote to memory of 2076 2292 w04684.exe 0408624.exe PID 2292 wrote to memory of 2076 2292 w04684.exe 0408624.exe PID 2292 wrote to memory of 2076 2292 w04684.exe 0408624.exe PID 2076 wrote to memory of 2228 2076 0408624.exe nbtthn.exe PID 2076 wrote to memory of 2228 2076 0408624.exe nbtthn.exe PID 2076 wrote to memory of 2228 2076 0408624.exe nbtthn.exe PID 2076 wrote to memory of 2228 2076 0408624.exe nbtthn.exe PID 2228 wrote to memory of 2432 2228 nbtthn.exe 480800.exe PID 2228 wrote to memory of 2432 2228 nbtthn.exe 480800.exe PID 2228 wrote to memory of 2432 2228 nbtthn.exe 480800.exe PID 2228 wrote to memory of 2432 2228 nbtthn.exe 480800.exe PID 2432 wrote to memory of 2800 2432 480800.exe ffxxlrl.exe PID 2432 wrote to memory of 2800 2432 480800.exe ffxxlrl.exe PID 2432 wrote to memory of 2800 2432 480800.exe ffxxlrl.exe PID 2432 wrote to memory of 2800 2432 480800.exe ffxxlrl.exe PID 2800 wrote to memory of 2728 2800 ffxxlrl.exe dvppj.exe PID 2800 wrote to memory of 2728 2800 ffxxlrl.exe dvppj.exe PID 2800 wrote to memory of 2728 2800 ffxxlrl.exe dvppj.exe PID 2800 wrote to memory of 2728 2800 ffxxlrl.exe dvppj.exe PID 2728 wrote to memory of 2864 2728 dvppj.exe vvjpd.exe PID 2728 wrote to memory of 2864 2728 dvppj.exe vvjpd.exe PID 2728 wrote to memory of 2864 2728 dvppj.exe vvjpd.exe PID 2728 wrote to memory of 2864 2728 dvppj.exe vvjpd.exe PID 2864 wrote to memory of 2740 2864 vvjpd.exe i084468.exe PID 2864 wrote to memory of 2740 2864 vvjpd.exe i084468.exe PID 2864 wrote to memory of 2740 2864 vvjpd.exe i084468.exe PID 2864 wrote to memory of 2740 2864 vvjpd.exe i084468.exe PID 2740 wrote to memory of 2612 2740 i084468.exe 04242.exe PID 2740 wrote to memory of 2612 2740 i084468.exe 04242.exe PID 2740 wrote to memory of 2612 2740 i084468.exe 04242.exe PID 2740 wrote to memory of 2612 2740 i084468.exe 04242.exe PID 2612 wrote to memory of 2144 2612 04242.exe 0862884.exe PID 2612 wrote to memory of 2144 2612 04242.exe 0862884.exe PID 2612 wrote to memory of 2144 2612 04242.exe 0862884.exe PID 2612 wrote to memory of 2144 2612 04242.exe 0862884.exe PID 2144 wrote to memory of 2236 2144 0862884.exe frfflll.exe PID 2144 wrote to memory of 2236 2144 0862884.exe frfflll.exe PID 2144 wrote to memory of 2236 2144 0862884.exe frfflll.exe PID 2144 wrote to memory of 2236 2144 0862884.exe frfflll.exe PID 2236 wrote to memory of 1224 2236 frfflll.exe 060644.exe PID 2236 wrote to memory of 1224 2236 frfflll.exe 060644.exe PID 2236 wrote to memory of 1224 2236 frfflll.exe 060644.exe PID 2236 wrote to memory of 1224 2236 frfflll.exe 060644.exe PID 1224 wrote to memory of 1840 1224 060644.exe dvpdp.exe PID 1224 wrote to memory of 1840 1224 060644.exe dvpdp.exe PID 1224 wrote to memory of 1840 1224 060644.exe dvpdp.exe PID 1224 wrote to memory of 1840 1224 060644.exe dvpdp.exe PID 1840 wrote to memory of 1856 1840 dvpdp.exe 7jppv.exe PID 1840 wrote to memory of 1856 1840 dvpdp.exe 7jppv.exe PID 1840 wrote to memory of 1856 1840 dvpdp.exe 7jppv.exe PID 1840 wrote to memory of 1856 1840 dvpdp.exe 7jppv.exe PID 1856 wrote to memory of 1700 1856 7jppv.exe 5tbhtt.exe PID 1856 wrote to memory of 1700 1856 7jppv.exe 5tbhtt.exe PID 1856 wrote to memory of 1700 1856 7jppv.exe 5tbhtt.exe PID 1856 wrote to memory of 1700 1856 7jppv.exe 5tbhtt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\94c5d09e7063dba9084ce23232694c9454c520f39092cde8f6d03f45232343a2.exe"C:\Users\Admin\AppData\Local\Temp\94c5d09e7063dba9084ce23232694c9454c520f39092cde8f6d03f45232343a2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\428400.exec:\428400.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\w04684.exec:\w04684.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\0408624.exec:\0408624.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\nbtthn.exec:\nbtthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\480800.exec:\480800.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\ffxxlrl.exec:\ffxxlrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\dvppj.exec:\dvppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\vvjpd.exec:\vvjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\i084468.exec:\i084468.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\04242.exec:\04242.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\0862884.exec:\0862884.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\frfflll.exec:\frfflll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\060644.exec:\060644.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\dvpdp.exec:\dvpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\7jppv.exec:\7jppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\5tbhtt.exec:\5tbhtt.exe17⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rrrrxxx.exec:\rrrrxxx.exe18⤵
- Executes dropped EXE
PID:2904 -
\??\c:\28824.exec:\28824.exe19⤵
- Executes dropped EXE
PID:2860 -
\??\c:\tbhtbb.exec:\tbhtbb.exe20⤵
- Executes dropped EXE
PID:2976 -
\??\c:\dddjv.exec:\dddjv.exe21⤵
- Executes dropped EXE
PID:2856 -
\??\c:\88682.exec:\88682.exe22⤵
- Executes dropped EXE
PID:1392 -
\??\c:\vdppj.exec:\vdppj.exe23⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nnthhh.exec:\nnthhh.exe24⤵
- Executes dropped EXE
PID:2088 -
\??\c:\vvvdj.exec:\vvvdj.exe25⤵
- Executes dropped EXE
PID:748 -
\??\c:\424024.exec:\424024.exe26⤵
- Executes dropped EXE
PID:688 -
\??\c:\042468.exec:\042468.exe27⤵
- Executes dropped EXE
PID:2392 -
\??\c:\488664.exec:\488664.exe28⤵
- Executes dropped EXE
PID:3052 -
\??\c:\tnhnbh.exec:\tnhnbh.exe29⤵
- Executes dropped EXE
PID:1208 -
\??\c:\e88084.exec:\e88084.exe30⤵
- Executes dropped EXE
PID:768 -
\??\c:\ppjvj.exec:\ppjvj.exe31⤵
- Executes dropped EXE
PID:1516 -
\??\c:\1rfllrr.exec:\1rfllrr.exe32⤵
- Executes dropped EXE
PID:2552 -
\??\c:\q64048.exec:\q64048.exe33⤵
- Executes dropped EXE
PID:2484 -
\??\c:\5vjpv.exec:\5vjpv.exe34⤵
- Executes dropped EXE
PID:2356 -
\??\c:\frrlrff.exec:\frrlrff.exe35⤵
- Executes dropped EXE
PID:2352 -
\??\c:\o462884.exec:\o462884.exe36⤵
- Executes dropped EXE
PID:836 -
\??\c:\08006.exec:\08006.exe37⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xlrxxxl.exec:\xlrxxxl.exe38⤵
- Executes dropped EXE
PID:848 -
\??\c:\vddvv.exec:\vddvv.exe39⤵
- Executes dropped EXE
PID:1888 -
\??\c:\flrrrlx.exec:\flrrrlx.exe40⤵
- Executes dropped EXE
PID:1536 -
\??\c:\htnntt.exec:\htnntt.exe41⤵
- Executes dropped EXE
PID:2556 -
\??\c:\64284.exec:\64284.exe42⤵
- Executes dropped EXE
PID:2272 -
\??\c:\680062.exec:\680062.exe43⤵
- Executes dropped EXE
PID:2704 -
\??\c:\e80000.exec:\e80000.exe44⤵
- Executes dropped EXE
PID:2824 -
\??\c:\4228848.exec:\4228848.exe45⤵
- Executes dropped EXE
PID:2752 -
\??\c:\04602.exec:\04602.exe46⤵
- Executes dropped EXE
PID:2800 -
\??\c:\6660848.exec:\6660848.exe47⤵
- Executes dropped EXE
PID:2868 -
\??\c:\04868.exec:\04868.exe48⤵
- Executes dropped EXE
PID:2764 -
\??\c:\btbhhn.exec:\btbhhn.exe49⤵
- Executes dropped EXE
PID:2340 -
\??\c:\3nhntb.exec:\3nhntb.exe50⤵
- Executes dropped EXE
PID:2676 -
\??\c:\nntnnn.exec:\nntnnn.exe51⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vjvdj.exec:\vjvdj.exe52⤵
- Executes dropped EXE
PID:1976 -
\??\c:\rlflxrx.exec:\rlflxrx.exe53⤵
- Executes dropped EXE
PID:2360 -
\??\c:\260288.exec:\260288.exe54⤵
- Executes dropped EXE
PID:1120 -
\??\c:\xrxffll.exec:\xrxffll.exe55⤵
- Executes dropped EXE
PID:1224 -
\??\c:\222264.exec:\222264.exe56⤵
- Executes dropped EXE
PID:2268 -
\??\c:\820608.exec:\820608.exe57⤵
- Executes dropped EXE
PID:1840 -
\??\c:\xrfrxxl.exec:\xrfrxxl.exe58⤵
- Executes dropped EXE
PID:1856 -
\??\c:\66802.exec:\66802.exe59⤵
- Executes dropped EXE
PID:1720 -
\??\c:\486846.exec:\486846.exe60⤵
- Executes dropped EXE
PID:2784 -
\??\c:\k22266.exec:\k22266.exe61⤵
- Executes dropped EXE
PID:2232 -
\??\c:\llxlflf.exec:\llxlflf.exe62⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hntttn.exec:\hntttn.exe63⤵
- Executes dropped EXE
PID:2980 -
\??\c:\862402.exec:\862402.exe64⤵
- Executes dropped EXE
PID:1828 -
\??\c:\400486.exec:\400486.exe65⤵
- Executes dropped EXE
PID:1444 -
\??\c:\u460800.exec:\u460800.exe66⤵PID:1396
-
\??\c:\xrxrrrx.exec:\xrxrrrx.exe67⤵PID:1088
-
\??\c:\7jvdp.exec:\7jvdp.exe68⤵PID:2220
-
\??\c:\tnbbnt.exec:\tnbbnt.exe69⤵PID:2088
-
\??\c:\hhttbh.exec:\hhttbh.exe70⤵PID:1532
-
\??\c:\86284.exec:\86284.exe71⤵PID:112
-
\??\c:\xxxrfxx.exec:\xxxrfxx.exe72⤵PID:688
-
\??\c:\0444840.exec:\0444840.exe73⤵PID:2696
-
\??\c:\hhnbth.exec:\hhnbth.exe74⤵PID:544
-
\??\c:\jdppd.exec:\jdppd.exe75⤵PID:2424
-
\??\c:\608806.exec:\608806.exe76⤵PID:1456
-
\??\c:\rfrrxxf.exec:\rfrrxxf.exe77⤵PID:2468
-
\??\c:\1bhhnn.exec:\1bhhnn.exe78⤵PID:1476
-
\??\c:\g2446.exec:\g2446.exe79⤵PID:2552
-
\??\c:\2680288.exec:\2680288.exe80⤵PID:2484
-
\??\c:\8862068.exec:\8862068.exe81⤵PID:108
-
\??\c:\ttnbtt.exec:\ttnbtt.exe82⤵PID:2416
-
\??\c:\7htntt.exec:\7htntt.exe83⤵PID:1528
-
\??\c:\ttntnt.exec:\ttntnt.exe84⤵PID:2780
-
\??\c:\pdpdj.exec:\pdpdj.exe85⤵PID:2684
-
\??\c:\4824002.exec:\4824002.exe86⤵PID:2988
-
\??\c:\00804.exec:\00804.exe87⤵PID:2564
-
\??\c:\3nhbnh.exec:\3nhbnh.exe88⤵PID:2296
-
\??\c:\hhhtbn.exec:\hhhtbn.exe89⤵PID:1536
-
\??\c:\8880224.exec:\8880224.exe90⤵PID:2344
-
\??\c:\btbbbb.exec:\btbbbb.exe91⤵PID:2744
-
\??\c:\i244648.exec:\i244648.exe92⤵PID:2760
-
\??\c:\680444.exec:\680444.exe93⤵PID:2836
-
\??\c:\bttbnn.exec:\bttbnn.exe94⤵PID:2148
-
\??\c:\26068.exec:\26068.exe95⤵PID:2624
-
\??\c:\4484286.exec:\4484286.exe96⤵PID:3068
-
\??\c:\i484668.exec:\i484668.exe97⤵PID:2848
-
\??\c:\q04024.exec:\q04024.exe98⤵PID:2656
-
\??\c:\2084624.exec:\2084624.exe99⤵PID:892
-
\??\c:\rfxlrfr.exec:\rfxlrfr.exe100⤵PID:272
-
\??\c:\44420.exec:\44420.exe101⤵PID:828
-
\??\c:\8688644.exec:\8688644.exe102⤵PID:1468
-
\??\c:\6660240.exec:\6660240.exe103⤵PID:1740
-
\??\c:\e20028.exec:\e20028.exe104⤵PID:1676
-
\??\c:\428800.exec:\428800.exe105⤵PID:2064
-
\??\c:\o200802.exec:\o200802.exe106⤵PID:1920
-
\??\c:\ffxxllf.exec:\ffxxllf.exe107⤵PID:2940
-
\??\c:\xxrlxfr.exec:\xxrlxfr.exe108⤵PID:2932
-
\??\c:\lfxfrrr.exec:\lfxfrrr.exe109⤵PID:2060
-
\??\c:\660066.exec:\660066.exe110⤵PID:1404
-
\??\c:\i646228.exec:\i646228.exe111⤵PID:484
-
\??\c:\8680886.exec:\8680886.exe112⤵PID:2972
-
\??\c:\rrflrxl.exec:\rrflrxl.exe113⤵PID:672
-
\??\c:\60620.exec:\60620.exe114⤵PID:2832
-
\??\c:\2468062.exec:\2468062.exe115⤵PID:1232
-
\??\c:\g2684.exec:\g2684.exe116⤵PID:2168
-
\??\c:\m4224.exec:\m4224.exe117⤵PID:1276
-
\??\c:\7tnthn.exec:\7tnthn.exe118⤵PID:2572
-
\??\c:\086862.exec:\086862.exe119⤵PID:1000
-
\??\c:\7jdvp.exec:\7jdvp.exe120⤵PID:112
-
\??\c:\208844.exec:\208844.exe121⤵PID:1696
-
\??\c:\rrxxffl.exec:\rrxxffl.exe122⤵PID:924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-