Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 10:27
Behavioral task
behavioral1
Sample
1381c1a36eb672a3e8d5d99f9c7c66450bee729ef3a05e76bc394fef1a563cc2N.exe
Resource
win7-20241023-en
7 signatures
120 seconds
General
-
Target
1381c1a36eb672a3e8d5d99f9c7c66450bee729ef3a05e76bc394fef1a563cc2N.exe
-
Size
98KB
-
MD5
c150a55eb1dbc03353b65b1ad9820b80
-
SHA1
485608d0d78e869e735944487987fdb974cf648f
-
SHA256
1381c1a36eb672a3e8d5d99f9c7c66450bee729ef3a05e76bc394fef1a563cc2
-
SHA512
4ffca5742963c42da98663f283ec5baa433fd807e0b1fdcf86cad9b22f8547f9f858afa74bdf3be7ca3bbcb3b7b3f1625f76ce2ed6c55b0b379352c542109983
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzgE:8cm4FmowdHoSgWrXUgE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/2384-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-24-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2748-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-51-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2772-61-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2772-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1380-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1220-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2440-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1872-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1560-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-190-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2420-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2152-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1772-243-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1724-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/944-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/896-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1412-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1876-385-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2848-406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1884-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1540-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1992-507-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2232-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/300-572-0x0000000076DB0000-0x0000000076ECF000-memory.dmp family_blackmoon behavioral1/memory/2672-612-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1920-643-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-736-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2156-754-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-787-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1592-800-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1676-806-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/600-830-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2888-859-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/300-8507-0x0000000076ED0000-0x0000000076FCA000-memory.dmp family_blackmoon behavioral1/memory/300-9274-0x0000000076ED0000-0x0000000076FCA000-memory.dmp family_blackmoon behavioral1/memory/300-12352-0x0000000076ED0000-0x0000000076FCA000-memory.dmp family_blackmoon behavioral1/memory/300-14243-0x0000000076DB0000-0x0000000076ECF000-memory.dmp family_blackmoon behavioral1/memory/300-15351-0x0000000076DB0000-0x0000000076ECF000-memory.dmp family_blackmoon behavioral1/memory/300-17840-0x0000000076DB0000-0x0000000076ECF000-memory.dmp family_blackmoon behavioral1/memory/300-21191-0x0000000076DB0000-0x0000000076ECF000-memory.dmp family_blackmoon behavioral1/memory/300-21755-0x0000000076DB0000-0x0000000076ECF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2384 4844624.exe 2748 w08026.exe 2800 9hnbbt.exe 2892 jdpdj.exe 2816 g0228.exe 2772 rxxfxrx.exe 2540 246626.exe 2976 48066.exe 2992 8628462.exe 848 nhhntn.exe 1380 1dpjp.exe 2776 5xlrxfl.exe 2848 jjdjv.exe 1220 5ddjd.exe 1964 m6880.exe 2440 o202886.exe 1616 nbtbth.exe 2416 80246.exe 1872 xrrfffl.exe 1560 6062842.exe 2040 0462846.exe 2504 ffrrflr.exe 2420 dvjpj.exe 1536 000820.exe 2152 e20288.exe 2352 bhnnhh.exe 972 5rllxfx.exe 816 httttt.exe 1772 o484224.exe 1724 dpvdp.exe 944 1httbh.exe 896 s2482.exe 2088 i468440.exe 292 i828068.exe 568 486284.exe 1412 9vpdj.exe 3008 200268.exe 2732 480804.exe 1620 pvjpd.exe 2616 8808202.exe 2808 864468.exe 2668 86424.exe 2656 6844662.exe 2800 vjdjp.exe 2716 k02804.exe 2544 02468.exe 2816 642800.exe 2520 djpjp.exe 3060 s8280.exe 2980 5rlxlfl.exe 1920 7xlrxxf.exe 296 4866842.exe 264 206248.exe 1876 1rfrlll.exe 2780 622882.exe 2744 820240.exe 2872 ppdpp.exe 2848 7xrllrr.exe 2964 pjvdv.exe 1960 48004.exe 1964 2860204.exe 1692 nhbnbh.exe 1240 djvpp.exe 1884 606862.exe -
resource yara_rule behavioral1/memory/2100-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012118-5.dat upx behavioral1/memory/2384-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2100-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000014b3c-17.dat upx behavioral1/memory/2748-24-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0008000000014ba6-25.dat upx behavioral1/memory/2800-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2748-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2800-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000014bef-35.dat upx behavioral1/memory/2892-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2816-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014f35-42.dat upx behavioral1/files/0x0007000000014f83-52.dat upx behavioral1/memory/2816-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000152aa-62.dat upx behavioral1/memory/2772-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2540-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015cfc-70.dat upx behavioral1/memory/2976-77-0x0000000000430000-0x0000000000457000-memory.dmp upx behavioral1/memory/2976-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d0e-78.dat upx behavioral1/memory/2992-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/848-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d18-87.dat upx behavioral1/files/0x0006000000015d2a-95.dat upx behavioral1/memory/1380-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d41-103.dat upx behavioral1/memory/2776-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d59-111.dat upx behavioral1/memory/2848-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d79-120.dat upx behavioral1/files/0x0006000000015d81-127.dat upx behavioral1/memory/1220-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1964-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d89-135.dat upx behavioral1/files/0x0006000000015ec4-143.dat upx behavioral1/memory/2440-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015f25-151.dat upx behavioral1/files/0x0006000000015f7b-158.dat upx behavioral1/files/0x002e000000014733-167.dat upx behavioral1/memory/1872-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1560-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001604c-177.dat upx behavioral1/files/0x000600000001610d-184.dat upx behavioral1/files/0x000600000001628b-191.dat upx behavioral1/files/0x0006000000016332-200.dat upx behavioral1/memory/2420-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000164b1-208.dat upx behavioral1/memory/1536-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000165c7-215.dat upx behavioral1/memory/2152-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016650-222.dat upx behavioral1/files/0x0006000000016875-229.dat upx behavioral1/files/0x0006000000016b47-236.dat upx behavioral1/files/0x0006000000016c66-244.dat upx behavioral1/memory/1724-251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c80-252.dat upx behavioral1/memory/944-254-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c88-260.dat upx behavioral1/memory/896-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/568-278-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1412-289-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 080666.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 680648.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtttt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2384 2100 1381c1a36eb672a3e8d5d99f9c7c66450bee729ef3a05e76bc394fef1a563cc2N.exe 28 PID 2100 wrote to memory of 2384 2100 1381c1a36eb672a3e8d5d99f9c7c66450bee729ef3a05e76bc394fef1a563cc2N.exe 28 PID 2100 wrote to memory of 2384 2100 1381c1a36eb672a3e8d5d99f9c7c66450bee729ef3a05e76bc394fef1a563cc2N.exe 28 PID 2100 wrote to memory of 2384 2100 1381c1a36eb672a3e8d5d99f9c7c66450bee729ef3a05e76bc394fef1a563cc2N.exe 28 PID 2384 wrote to memory of 2748 2384 4844624.exe 29 PID 2384 wrote to memory of 2748 2384 4844624.exe 29 PID 2384 wrote to memory of 2748 2384 4844624.exe 29 PID 2384 wrote to memory of 2748 2384 4844624.exe 29 PID 2748 wrote to memory of 2800 2748 w08026.exe 30 PID 2748 wrote to memory of 2800 2748 w08026.exe 30 PID 2748 wrote to memory of 2800 2748 w08026.exe 30 PID 2748 wrote to memory of 2800 2748 w08026.exe 30 PID 2800 wrote to memory of 2892 2800 9hnbbt.exe 31 PID 2800 wrote to memory of 2892 2800 9hnbbt.exe 31 PID 2800 wrote to memory of 2892 2800 9hnbbt.exe 31 PID 2800 wrote to memory of 2892 2800 9hnbbt.exe 31 PID 2892 wrote to memory of 2816 2892 jdpdj.exe 32 PID 2892 wrote to memory of 2816 2892 jdpdj.exe 32 PID 2892 wrote to memory of 2816 2892 jdpdj.exe 32 PID 2892 wrote to memory of 2816 2892 jdpdj.exe 32 PID 2816 wrote to memory of 2772 2816 g0228.exe 33 PID 2816 wrote to memory of 2772 2816 g0228.exe 33 PID 2816 wrote to memory of 2772 2816 g0228.exe 33 PID 2816 wrote to memory of 2772 2816 g0228.exe 33 PID 2772 wrote to memory of 2540 2772 rxxfxrx.exe 34 PID 2772 wrote to memory of 2540 2772 rxxfxrx.exe 34 PID 2772 wrote to memory of 2540 2772 rxxfxrx.exe 34 PID 2772 wrote to memory of 2540 2772 rxxfxrx.exe 34 PID 2540 wrote to memory of 2976 2540 246626.exe 35 PID 2540 wrote to memory of 2976 2540 246626.exe 35 PID 2540 wrote to memory of 2976 2540 246626.exe 35 PID 2540 wrote to memory of 2976 2540 246626.exe 35 PID 2976 wrote to memory of 2992 2976 48066.exe 36 PID 2976 wrote to memory of 2992 2976 48066.exe 36 PID 2976 wrote to memory of 2992 2976 48066.exe 36 PID 2976 wrote to memory of 2992 2976 48066.exe 36 PID 2992 wrote to memory of 848 2992 8628462.exe 37 PID 2992 wrote to memory of 848 2992 8628462.exe 37 PID 2992 wrote to memory of 848 2992 8628462.exe 37 PID 2992 wrote to memory of 848 2992 8628462.exe 37 PID 848 wrote to memory of 1380 848 nhhntn.exe 38 PID 848 wrote to memory of 1380 848 nhhntn.exe 38 PID 848 wrote to memory of 1380 848 nhhntn.exe 38 PID 848 wrote to memory of 1380 848 nhhntn.exe 38 PID 1380 wrote to memory of 2776 1380 1dpjp.exe 39 PID 1380 wrote to memory of 2776 1380 1dpjp.exe 39 PID 1380 wrote to memory of 2776 1380 1dpjp.exe 39 PID 1380 wrote to memory of 2776 1380 1dpjp.exe 39 PID 2776 wrote to memory of 2848 2776 5xlrxfl.exe 40 PID 2776 wrote to memory of 2848 2776 5xlrxfl.exe 40 PID 2776 wrote to memory of 2848 2776 5xlrxfl.exe 40 PID 2776 wrote to memory of 2848 2776 5xlrxfl.exe 40 PID 2848 wrote to memory of 1220 2848 jjdjv.exe 41 PID 2848 wrote to memory of 1220 2848 jjdjv.exe 41 PID 2848 wrote to memory of 1220 2848 jjdjv.exe 41 PID 2848 wrote to memory of 1220 2848 jjdjv.exe 41 PID 1220 wrote to memory of 1964 1220 5ddjd.exe 42 PID 1220 wrote to memory of 1964 1220 5ddjd.exe 42 PID 1220 wrote to memory of 1964 1220 5ddjd.exe 42 PID 1220 wrote to memory of 1964 1220 5ddjd.exe 42 PID 1964 wrote to memory of 2440 1964 m6880.exe 43 PID 1964 wrote to memory of 2440 1964 m6880.exe 43 PID 1964 wrote to memory of 2440 1964 m6880.exe 43 PID 1964 wrote to memory of 2440 1964 m6880.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1381c1a36eb672a3e8d5d99f9c7c66450bee729ef3a05e76bc394fef1a563cc2N.exe"C:\Users\Admin\AppData\Local\Temp\1381c1a36eb672a3e8d5d99f9c7c66450bee729ef3a05e76bc394fef1a563cc2N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\4844624.exec:\4844624.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\w08026.exec:\w08026.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\9hnbbt.exec:\9hnbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\jdpdj.exec:\jdpdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\g0228.exec:\g0228.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\rxxfxrx.exec:\rxxfxrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\246626.exec:\246626.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\48066.exec:\48066.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\8628462.exec:\8628462.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\nhhntn.exec:\nhhntn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\1dpjp.exec:\1dpjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\5xlrxfl.exec:\5xlrxfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\jjdjv.exec:\jjdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\5ddjd.exec:\5ddjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\m6880.exec:\m6880.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\o202886.exec:\o202886.exe17⤵
- Executes dropped EXE
PID:2440 -
\??\c:\nbtbth.exec:\nbtbth.exe18⤵
- Executes dropped EXE
PID:1616 -
\??\c:\80246.exec:\80246.exe19⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xrrfffl.exec:\xrrfffl.exe20⤵
- Executes dropped EXE
PID:1872 -
\??\c:\6062842.exec:\6062842.exe21⤵
- Executes dropped EXE
PID:1560 -
\??\c:\0462846.exec:\0462846.exe22⤵
- Executes dropped EXE
PID:2040 -
\??\c:\ffrrflr.exec:\ffrrflr.exe23⤵
- Executes dropped EXE
PID:2504 -
\??\c:\dvjpj.exec:\dvjpj.exe24⤵
- Executes dropped EXE
PID:2420 -
\??\c:\000820.exec:\000820.exe25⤵
- Executes dropped EXE
PID:1536 -
\??\c:\e20288.exec:\e20288.exe26⤵
- Executes dropped EXE
PID:2152 -
\??\c:\bhnnhh.exec:\bhnnhh.exe27⤵
- Executes dropped EXE
PID:2352 -
\??\c:\5rllxfx.exec:\5rllxfx.exe28⤵
- Executes dropped EXE
PID:972 -
\??\c:\httttt.exec:\httttt.exe29⤵
- Executes dropped EXE
PID:816 -
\??\c:\o484224.exec:\o484224.exe30⤵
- Executes dropped EXE
PID:1772 -
\??\c:\dpvdp.exec:\dpvdp.exe31⤵
- Executes dropped EXE
PID:1724 -
\??\c:\1httbh.exec:\1httbh.exe32⤵
- Executes dropped EXE
PID:944 -
\??\c:\s2482.exec:\s2482.exe33⤵
- Executes dropped EXE
PID:896 -
\??\c:\i468440.exec:\i468440.exe34⤵
- Executes dropped EXE
PID:2088 -
\??\c:\i828068.exec:\i828068.exe35⤵
- Executes dropped EXE
PID:292 -
\??\c:\486284.exec:\486284.exe36⤵
- Executes dropped EXE
PID:568 -
\??\c:\9vpdj.exec:\9vpdj.exe37⤵
- Executes dropped EXE
PID:1412 -
\??\c:\200268.exec:\200268.exe38⤵
- Executes dropped EXE
PID:3008 -
\??\c:\480804.exec:\480804.exe39⤵
- Executes dropped EXE
PID:2732 -
\??\c:\pvjpd.exec:\pvjpd.exe40⤵
- Executes dropped EXE
PID:1620 -
\??\c:\8808202.exec:\8808202.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\864468.exec:\864468.exe42⤵
- Executes dropped EXE
PID:2808 -
\??\c:\86424.exec:\86424.exe43⤵
- Executes dropped EXE
PID:2668 -
\??\c:\6844662.exec:\6844662.exe44⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vjdjp.exec:\vjdjp.exe45⤵
- Executes dropped EXE
PID:2800 -
\??\c:\k02804.exec:\k02804.exe46⤵
- Executes dropped EXE
PID:2716 -
\??\c:\02468.exec:\02468.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\642800.exec:\642800.exe48⤵
- Executes dropped EXE
PID:2816 -
\??\c:\djpjp.exec:\djpjp.exe49⤵
- Executes dropped EXE
PID:2520 -
\??\c:\s8280.exec:\s8280.exe50⤵
- Executes dropped EXE
PID:3060 -
\??\c:\5rlxlfl.exec:\5rlxlfl.exe51⤵
- Executes dropped EXE
PID:2980 -
\??\c:\7xlrxxf.exec:\7xlrxxf.exe52⤵
- Executes dropped EXE
PID:1920 -
\??\c:\4866842.exec:\4866842.exe53⤵
- Executes dropped EXE
PID:296 -
\??\c:\206248.exec:\206248.exe54⤵
- Executes dropped EXE
PID:264 -
\??\c:\1rfrlll.exec:\1rfrlll.exe55⤵
- Executes dropped EXE
PID:1876 -
\??\c:\622882.exec:\622882.exe56⤵
- Executes dropped EXE
PID:2780 -
\??\c:\820240.exec:\820240.exe57⤵
- Executes dropped EXE
PID:2744 -
\??\c:\ppdpp.exec:\ppdpp.exe58⤵
- Executes dropped EXE
PID:2872 -
\??\c:\7xrllrr.exec:\7xrllrr.exe59⤵
- Executes dropped EXE
PID:2848 -
\??\c:\pjvdv.exec:\pjvdv.exe60⤵
- Executes dropped EXE
PID:2964 -
\??\c:\48004.exec:\48004.exe61⤵
- Executes dropped EXE
PID:1960 -
\??\c:\2860204.exec:\2860204.exe62⤵
- Executes dropped EXE
PID:1964 -
\??\c:\nhbnbh.exec:\nhbnbh.exe63⤵
- Executes dropped EXE
PID:1692 -
\??\c:\djvpp.exec:\djvpp.exe64⤵
- Executes dropped EXE
PID:1240 -
\??\c:\606862.exec:\606862.exe65⤵
- Executes dropped EXE
PID:1884 -
\??\c:\dpvvd.exec:\dpvvd.exe66⤵PID:1632
-
\??\c:\pjvjp.exec:\pjvjp.exe67⤵PID:900
-
\??\c:\jvjpv.exec:\jvjpv.exe68⤵PID:2380
-
\??\c:\7httnn.exec:\7httnn.exe69⤵PID:1640
-
\??\c:\tthntb.exec:\tthntb.exe70⤵PID:992
-
\??\c:\3flrxfr.exec:\3flrxfr.exe71⤵PID:1496
-
\??\c:\nhtttn.exec:\nhtttn.exe72⤵PID:2920
-
\??\c:\0840266.exec:\0840266.exe73⤵PID:1420
-
\??\c:\a8840.exec:\a8840.exe74⤵PID:1540
-
\??\c:\xfflfll.exec:\xfflfll.exe75⤵PID:444
-
\??\c:\nthnnn.exec:\nthnnn.exe76⤵PID:2212
-
\??\c:\tbntnt.exec:\tbntnt.exe77⤵PID:2480
-
\??\c:\404804.exec:\404804.exe78⤵PID:1992
-
\??\c:\e40066.exec:\e40066.exe79⤵PID:2064
-
\??\c:\868228.exec:\868228.exe80⤵PID:1716
-
\??\c:\60846.exec:\60846.exe81⤵PID:1676
-
\??\c:\pdjjv.exec:\pdjjv.exe82⤵PID:1124
-
\??\c:\hthbbt.exec:\hthbbt.exe83⤵PID:3032
-
\??\c:\u688008.exec:\u688008.exe84⤵PID:2232
-
\??\c:\o028488.exec:\o028488.exe85⤵PID:2432
-
\??\c:\04286.exec:\04286.exe86⤵PID:2608
-
\??\c:\4880280.exec:\4880280.exe87⤵PID:2444
-
\??\c:\hbhthn.exec:\hbhthn.exe88⤵PID:1408
-
\??\c:\1pdpd.exec:\1pdpd.exe89⤵PID:1732
-
\??\c:\240062.exec:\240062.exe90⤵PID:2712
-
\??\c:\i244402.exec:\i244402.exe91⤵PID:300
-
\??\c:\tntbbb.exec:\tntbbb.exe92⤵PID:3048
-
\??\c:\w26244.exec:\w26244.exe93⤵PID:2260
-
\??\c:\nhttbh.exec:\nhttbh.exe94⤵PID:2672
-
\??\c:\bbthhn.exec:\bbthhn.exe95⤵PID:2652
-
\??\c:\jvjpp.exec:\jvjpp.exe96⤵PID:2904
-
\??\c:\frxxfff.exec:\frxxfff.exe97⤵PID:308
-
\??\c:\1ppvd.exec:\1ppvd.exe98⤵PID:2788
-
\??\c:\dpjpp.exec:\dpjpp.exe99⤵PID:2568
-
\??\c:\2028440.exec:\2028440.exe100⤵PID:2816
-
\??\c:\4862002.exec:\4862002.exe101⤵PID:2516
-
\??\c:\flxlxlr.exec:\flxlxlr.exe102⤵PID:3028
-
\??\c:\tnbnhh.exec:\tnbnhh.exe103⤵PID:1952
-
\??\c:\vpvjj.exec:\vpvjj.exe104⤵PID:1920
-
\??\c:\rfrflrx.exec:\rfrflrx.exe105⤵PID:296
-
\??\c:\nbtbnb.exec:\nbtbnb.exe106⤵PID:264
-
\??\c:\60842.exec:\60842.exe107⤵PID:1384
-
\??\c:\ffxflrx.exec:\ffxflrx.exe108⤵PID:1684
-
\??\c:\486462.exec:\486462.exe109⤵PID:1880
-
\??\c:\7nbhtt.exec:\7nbhtt.exe110⤵PID:2880
-
\??\c:\4240266.exec:\4240266.exe111⤵PID:1348
-
\??\c:\3jddv.exec:\3jddv.exe112⤵PID:1956
-
\??\c:\604062.exec:\604062.exe113⤵PID:1936
-
\??\c:\dpddj.exec:\dpddj.exe114⤵PID:2016
-
\??\c:\088402.exec:\088402.exe115⤵PID:820
-
\??\c:\jdvpd.exec:\jdvpd.exe116⤵PID:1900
-
\??\c:\5bbhnn.exec:\5bbhnn.exe117⤵PID:2012
-
\??\c:\m4240.exec:\m4240.exe118⤵PID:1896
-
\??\c:\0088468.exec:\0088468.exe119⤵PID:2908
-
\??\c:\q68446.exec:\q68446.exe120⤵PID:2380
-
\??\c:\48802.exec:\48802.exe121⤵PID:2504
-
\??\c:\04806.exec:\04806.exe122⤵PID:992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-