Analysis
-
max time kernel
120s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-12-2024 10:27
Behavioral task
behavioral1
Sample
1381c1a36eb672a3e8d5d99f9c7c66450bee729ef3a05e76bc394fef1a563cc2N.exe
Resource
win7-20241023-en
7 signatures
120 seconds
General
-
Target
1381c1a36eb672a3e8d5d99f9c7c66450bee729ef3a05e76bc394fef1a563cc2N.exe
-
Size
98KB
-
MD5
c150a55eb1dbc03353b65b1ad9820b80
-
SHA1
485608d0d78e869e735944487987fdb974cf648f
-
SHA256
1381c1a36eb672a3e8d5d99f9c7c66450bee729ef3a05e76bc394fef1a563cc2
-
SHA512
4ffca5742963c42da98663f283ec5baa433fd807e0b1fdcf86cad9b22f8547f9f858afa74bdf3be7ca3bbcb3b7b3f1625f76ce2ed6c55b0b379352c542109983
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzgE:8cm4FmowdHoSgWrXUgE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4656-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4268-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4868-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2724-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2544-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3052-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5008-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2328-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/384-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1792-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2096-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1616-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1896-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2368-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5056-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1320-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2260-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2448-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1744-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2020-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1072-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1748-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1292-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2984-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2464-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3772-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4140-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2956-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3148-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2724-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3688-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2052-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2080-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/396-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2572-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/688-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3060-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2104-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2472-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4016-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4472-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3012-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3004-478-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2060-543-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-688-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1968-960-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 216 844882.exe 3984 2460040.exe 4416 0426666.exe 4268 00000.exe 2280 9jjdv.exe 4868 5hhbnn.exe 2724 jvpjj.exe 2544 060000.exe 4576 826880.exe 3052 djjdj.exe 5008 48604.exe 2328 s8004.exe 384 ppjvp.exe 1324 8460662.exe 4524 jddvv.exe 5048 hnhnnh.exe 1792 3jdvj.exe 4884 068260.exe 4584 8222440.exe 2096 84604.exe 4032 k48222.exe 4436 28442.exe 1616 0460000.exe 1896 0848266.exe 1052 rflrlfx.exe 1696 dpvpv.exe 1756 dvpvp.exe 4052 btbnbb.exe 4948 028262.exe 4224 4002208.exe 2368 m2264.exe 5056 602026.exe 4356 6626826.exe 1320 rrllfxf.exe 2260 3pvpj.exe 2440 e62644.exe 2448 o848884.exe 1744 pvdvj.exe 4988 vvvjv.exe 960 220040.exe 2020 64026.exe 1892 c042240.exe 2288 k48428.exe 1072 7hnhbb.exe 3160 thhbtt.exe 1748 8004226.exe 4060 frfxrll.exe 1292 648204.exe 1448 rfffxfx.exe 2984 hbtnbt.exe 2464 42260.exe 3772 3xxlffx.exe 1428 hnnnbt.exe 4140 jppdp.exe 220 g4488.exe 2480 00264.exe 2956 hnhbnh.exe 2436 bhtnbb.exe 3196 bnnhhb.exe 392 8800820.exe 4268 u004882.exe 1336 tntnnn.exe 3148 pjpjp.exe 1432 xrrlxxr.exe -
resource yara_rule behavioral2/memory/4656-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b80-9.dat upx behavioral2/memory/4656-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/216-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b27-3.dat upx behavioral2/files/0x000a000000023b85-11.dat upx behavioral2/memory/3984-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b86-18.dat upx behavioral2/memory/4268-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4416-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2280-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4868-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b89-34.dat upx behavioral2/memory/2724-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b88-30.dat upx behavioral2/files/0x000a000000023b87-24.dat upx behavioral2/files/0x000a000000023b8a-39.dat upx behavioral2/memory/2724-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8b-44.dat upx behavioral2/memory/2544-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8c-49.dat upx behavioral2/files/0x000a000000023b8d-53.dat upx behavioral2/memory/3052-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8e-58.dat upx behavioral2/memory/5008-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8f-63.dat upx behavioral2/memory/2328-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b90-68.dat upx behavioral2/memory/1324-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/384-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b91-74.dat upx behavioral2/memory/4524-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b92-79.dat upx behavioral2/files/0x000a000000023b93-83.dat upx behavioral2/memory/5048-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b94-88.dat upx behavioral2/memory/1792-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4884-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b95-93.dat upx behavioral2/files/0x000a000000023b96-98.dat upx behavioral2/memory/2096-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b81-102.dat upx behavioral2/files/0x000a000000023b97-107.dat upx behavioral2/memory/4032-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b98-112.dat upx behavioral2/files/0x000a000000023b99-117.dat upx behavioral2/memory/1616-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1896-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1896-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9a-123.dat upx behavioral2/files/0x000a000000023b9b-127.dat upx behavioral2/files/0x000a000000023b9d-131.dat upx behavioral2/files/0x000a000000023b9e-135.dat upx behavioral2/files/0x000a000000023b9f-140.dat upx behavioral2/files/0x000b000000023ba0-144.dat upx behavioral2/memory/4224-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4948-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023ba1-149.dat upx behavioral2/files/0x000b000000023ba2-154.dat upx behavioral2/memory/2368-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4356-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5056-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1320-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2260-168-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 668400.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a6604.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0844404.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i068020.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4844244.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4826888.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o404482.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66608.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20808.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4656 wrote to memory of 216 4656 1381c1a36eb672a3e8d5d99f9c7c66450bee729ef3a05e76bc394fef1a563cc2N.exe 83 PID 4656 wrote to memory of 216 4656 1381c1a36eb672a3e8d5d99f9c7c66450bee729ef3a05e76bc394fef1a563cc2N.exe 83 PID 4656 wrote to memory of 216 4656 1381c1a36eb672a3e8d5d99f9c7c66450bee729ef3a05e76bc394fef1a563cc2N.exe 83 PID 216 wrote to memory of 3984 216 844882.exe 84 PID 216 wrote to memory of 3984 216 844882.exe 84 PID 216 wrote to memory of 3984 216 844882.exe 84 PID 3984 wrote to memory of 4416 3984 2460040.exe 85 PID 3984 wrote to memory of 4416 3984 2460040.exe 85 PID 3984 wrote to memory of 4416 3984 2460040.exe 85 PID 4416 wrote to memory of 4268 4416 0426666.exe 86 PID 4416 wrote to memory of 4268 4416 0426666.exe 86 PID 4416 wrote to memory of 4268 4416 0426666.exe 86 PID 4268 wrote to memory of 2280 4268 00000.exe 87 PID 4268 wrote to memory of 2280 4268 00000.exe 87 PID 4268 wrote to memory of 2280 4268 00000.exe 87 PID 2280 wrote to memory of 4868 2280 9jjdv.exe 88 PID 2280 wrote to memory of 4868 2280 9jjdv.exe 88 PID 2280 wrote to memory of 4868 2280 9jjdv.exe 88 PID 4868 wrote to memory of 2724 4868 5hhbnn.exe 89 PID 4868 wrote to memory of 2724 4868 5hhbnn.exe 89 PID 4868 wrote to memory of 2724 4868 5hhbnn.exe 89 PID 2724 wrote to memory of 2544 2724 jvpjj.exe 90 PID 2724 wrote to memory of 2544 2724 jvpjj.exe 90 PID 2724 wrote to memory of 2544 2724 jvpjj.exe 90 PID 2544 wrote to memory of 4576 2544 060000.exe 91 PID 2544 wrote to memory of 4576 2544 060000.exe 91 PID 2544 wrote to memory of 4576 2544 060000.exe 91 PID 4576 wrote to memory of 3052 4576 826880.exe 92 PID 4576 wrote to memory of 3052 4576 826880.exe 92 PID 4576 wrote to memory of 3052 4576 826880.exe 92 PID 3052 wrote to memory of 5008 3052 djjdj.exe 93 PID 3052 wrote to memory of 5008 3052 djjdj.exe 93 PID 3052 wrote to memory of 5008 3052 djjdj.exe 93 PID 5008 wrote to memory of 2328 5008 48604.exe 94 PID 5008 wrote to memory of 2328 5008 48604.exe 94 PID 5008 wrote to memory of 2328 5008 48604.exe 94 PID 2328 wrote to memory of 384 2328 s8004.exe 95 PID 2328 wrote to memory of 384 2328 s8004.exe 95 PID 2328 wrote to memory of 384 2328 s8004.exe 95 PID 384 wrote to memory of 1324 384 ppjvp.exe 96 PID 384 wrote to memory of 1324 384 ppjvp.exe 96 PID 384 wrote to memory of 1324 384 ppjvp.exe 96 PID 1324 wrote to memory of 4524 1324 8460662.exe 97 PID 1324 wrote to memory of 4524 1324 8460662.exe 97 PID 1324 wrote to memory of 4524 1324 8460662.exe 97 PID 4524 wrote to memory of 5048 4524 jddvv.exe 98 PID 4524 wrote to memory of 5048 4524 jddvv.exe 98 PID 4524 wrote to memory of 5048 4524 jddvv.exe 98 PID 5048 wrote to memory of 1792 5048 hnhnnh.exe 99 PID 5048 wrote to memory of 1792 5048 hnhnnh.exe 99 PID 5048 wrote to memory of 1792 5048 hnhnnh.exe 99 PID 1792 wrote to memory of 4884 1792 3jdvj.exe 100 PID 1792 wrote to memory of 4884 1792 3jdvj.exe 100 PID 1792 wrote to memory of 4884 1792 3jdvj.exe 100 PID 4884 wrote to memory of 4584 4884 068260.exe 101 PID 4884 wrote to memory of 4584 4884 068260.exe 101 PID 4884 wrote to memory of 4584 4884 068260.exe 101 PID 4584 wrote to memory of 2096 4584 8222440.exe 102 PID 4584 wrote to memory of 2096 4584 8222440.exe 102 PID 4584 wrote to memory of 2096 4584 8222440.exe 102 PID 2096 wrote to memory of 4032 2096 84604.exe 103 PID 2096 wrote to memory of 4032 2096 84604.exe 103 PID 2096 wrote to memory of 4032 2096 84604.exe 103 PID 4032 wrote to memory of 4436 4032 k48222.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\1381c1a36eb672a3e8d5d99f9c7c66450bee729ef3a05e76bc394fef1a563cc2N.exe"C:\Users\Admin\AppData\Local\Temp\1381c1a36eb672a3e8d5d99f9c7c66450bee729ef3a05e76bc394fef1a563cc2N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\844882.exec:\844882.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\2460040.exec:\2460040.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\0426666.exec:\0426666.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\00000.exec:\00000.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\9jjdv.exec:\9jjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\5hhbnn.exec:\5hhbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\jvpjj.exec:\jvpjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\060000.exec:\060000.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\826880.exec:\826880.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\djjdj.exec:\djjdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\48604.exec:\48604.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\s8004.exec:\s8004.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\ppjvp.exec:\ppjvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\8460662.exec:\8460662.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\jddvv.exec:\jddvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\hnhnnh.exec:\hnhnnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\3jdvj.exec:\3jdvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\068260.exec:\068260.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\8222440.exec:\8222440.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\84604.exec:\84604.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\k48222.exec:\k48222.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\28442.exec:\28442.exe23⤵
- Executes dropped EXE
PID:4436 -
\??\c:\0460000.exec:\0460000.exe24⤵
- Executes dropped EXE
PID:1616 -
\??\c:\0848266.exec:\0848266.exe25⤵
- Executes dropped EXE
PID:1896 -
\??\c:\rflrlfx.exec:\rflrlfx.exe26⤵
- Executes dropped EXE
PID:1052 -
\??\c:\dpvpv.exec:\dpvpv.exe27⤵
- Executes dropped EXE
PID:1696 -
\??\c:\dvpvp.exec:\dvpvp.exe28⤵
- Executes dropped EXE
PID:1756 -
\??\c:\btbnbb.exec:\btbnbb.exe29⤵
- Executes dropped EXE
PID:4052 -
\??\c:\028262.exec:\028262.exe30⤵
- Executes dropped EXE
PID:4948 -
\??\c:\4002208.exec:\4002208.exe31⤵
- Executes dropped EXE
PID:4224 -
\??\c:\m2264.exec:\m2264.exe32⤵
- Executes dropped EXE
PID:2368 -
\??\c:\602026.exec:\602026.exe33⤵
- Executes dropped EXE
PID:5056 -
\??\c:\6626826.exec:\6626826.exe34⤵
- Executes dropped EXE
PID:4356 -
\??\c:\rrllfxf.exec:\rrllfxf.exe35⤵
- Executes dropped EXE
PID:1320 -
\??\c:\3pvpj.exec:\3pvpj.exe36⤵
- Executes dropped EXE
PID:2260 -
\??\c:\e62644.exec:\e62644.exe37⤵
- Executes dropped EXE
PID:2440 -
\??\c:\o848884.exec:\o848884.exe38⤵
- Executes dropped EXE
PID:2448 -
\??\c:\pvdvj.exec:\pvdvj.exe39⤵
- Executes dropped EXE
PID:1744 -
\??\c:\vvvjv.exec:\vvvjv.exe40⤵
- Executes dropped EXE
PID:4988 -
\??\c:\220040.exec:\220040.exe41⤵
- Executes dropped EXE
PID:960 -
\??\c:\64026.exec:\64026.exe42⤵
- Executes dropped EXE
PID:2020 -
\??\c:\c042240.exec:\c042240.exe43⤵
- Executes dropped EXE
PID:1892 -
\??\c:\k48428.exec:\k48428.exe44⤵
- Executes dropped EXE
PID:2288 -
\??\c:\7hnhbb.exec:\7hnhbb.exe45⤵
- Executes dropped EXE
PID:1072 -
\??\c:\thhbtt.exec:\thhbtt.exe46⤵
- Executes dropped EXE
PID:3160 -
\??\c:\8004226.exec:\8004226.exe47⤵
- Executes dropped EXE
PID:1748 -
\??\c:\frfxrll.exec:\frfxrll.exe48⤵
- Executes dropped EXE
PID:4060 -
\??\c:\648204.exec:\648204.exe49⤵
- Executes dropped EXE
PID:1292 -
\??\c:\rfffxfx.exec:\rfffxfx.exe50⤵
- Executes dropped EXE
PID:1448 -
\??\c:\hbtnbt.exec:\hbtnbt.exe51⤵
- Executes dropped EXE
PID:2984 -
\??\c:\42260.exec:\42260.exe52⤵
- Executes dropped EXE
PID:2464 -
\??\c:\3xxlffx.exec:\3xxlffx.exe53⤵
- Executes dropped EXE
PID:3772 -
\??\c:\hnnnbt.exec:\hnnnbt.exe54⤵
- Executes dropped EXE
PID:1428 -
\??\c:\jppdp.exec:\jppdp.exe55⤵
- Executes dropped EXE
PID:4140 -
\??\c:\g4488.exec:\g4488.exe56⤵
- Executes dropped EXE
PID:220 -
\??\c:\00264.exec:\00264.exe57⤵
- Executes dropped EXE
PID:2480 -
\??\c:\hnhbnh.exec:\hnhbnh.exe58⤵
- Executes dropped EXE
PID:2956 -
\??\c:\bhtnbb.exec:\bhtnbb.exe59⤵
- Executes dropped EXE
PID:2436 -
\??\c:\bnnhhb.exec:\bnnhhb.exe60⤵
- Executes dropped EXE
PID:3196 -
\??\c:\8800820.exec:\8800820.exe61⤵
- Executes dropped EXE
PID:392 -
\??\c:\u004882.exec:\u004882.exe62⤵
- Executes dropped EXE
PID:4268 -
\??\c:\tntnnn.exec:\tntnnn.exe63⤵
- Executes dropped EXE
PID:1336 -
\??\c:\pjpjp.exec:\pjpjp.exe64⤵
- Executes dropped EXE
PID:3148 -
\??\c:\xrrlxxr.exec:\xrrlxxr.exe65⤵
- Executes dropped EXE
PID:1432 -
\??\c:\vjjvp.exec:\vjjvp.exe66⤵PID:2724
-
\??\c:\bbhbnn.exec:\bbhbnn.exe67⤵PID:2544
-
\??\c:\00608.exec:\00608.exe68⤵PID:1340
-
\??\c:\xrrffxl.exec:\xrrffxl.exe69⤵PID:1924
-
\??\c:\tbbtnh.exec:\tbbtnh.exe70⤵PID:2300
-
\??\c:\06260.exec:\06260.exe71⤵PID:5116
-
\??\c:\vjjvp.exec:\vjjvp.exe72⤵PID:2576
-
\??\c:\822026.exec:\822026.exe73⤵PID:3688
-
\??\c:\82804.exec:\82804.exe74⤵PID:3840
-
\??\c:\ddvpv.exec:\ddvpv.exe75⤵PID:3548
-
\??\c:\9bbtbt.exec:\9bbtbt.exe76⤵PID:680
-
\??\c:\04886.exec:\04886.exe77⤵PID:924
-
\??\c:\1jjvj.exec:\1jjvj.exe78⤵PID:4832
-
\??\c:\5ppjv.exec:\5ppjv.exe79⤵PID:2500
-
\??\c:\hbtbhb.exec:\hbtbhb.exe80⤵PID:1900
-
\??\c:\htbthn.exec:\htbthn.exe81⤵PID:3464
-
\??\c:\684646.exec:\684646.exe82⤵PID:4596
-
\??\c:\xlllfxr.exec:\xlllfxr.exe83⤵PID:4884
-
\??\c:\086044.exec:\086044.exe84⤵PID:3756
-
\??\c:\dvdvd.exec:\dvdvd.exe85⤵PID:2052
-
\??\c:\i068020.exec:\i068020.exe86⤵
- System Location Discovery: System Language Discovery
PID:3624 -
\??\c:\frrlffx.exec:\frrlffx.exe87⤵PID:4032
-
\??\c:\64044.exec:\64044.exe88⤵PID:2476
-
\??\c:\00604.exec:\00604.exe89⤵PID:3488
-
\??\c:\7bthtn.exec:\7bthtn.exe90⤵PID:3416
-
\??\c:\xrxllll.exec:\xrxllll.exe91⤵PID:2960
-
\??\c:\804260.exec:\804260.exe92⤵PID:2080
-
\??\c:\rxfxfff.exec:\rxfxfff.exe93⤵PID:396
-
\??\c:\9xrlxrl.exec:\9xrlxrl.exe94⤵PID:624
-
\??\c:\flrllfx.exec:\flrllfx.exe95⤵PID:1756
-
\??\c:\k44822.exec:\k44822.exe96⤵PID:2572
-
\??\c:\0408282.exec:\0408282.exe97⤵PID:996
-
\??\c:\lllfxrx.exec:\lllfxrx.exe98⤵PID:4008
-
\??\c:\8084606.exec:\8084606.exe99⤵PID:4224
-
\??\c:\2286042.exec:\2286042.exe100⤵PID:936
-
\??\c:\rlrffxx.exec:\rlrffxx.exe101⤵PID:4324
-
\??\c:\htbbtt.exec:\htbbtt.exe102⤵PID:2648
-
\??\c:\djdpj.exec:\djdpj.exe103⤵PID:4796
-
\??\c:\k46668.exec:\k46668.exe104⤵PID:688
-
\??\c:\dpjdp.exec:\dpjdp.exe105⤵PID:4020
-
\??\c:\ddvvj.exec:\ddvvj.exe106⤵PID:1264
-
\??\c:\frlxlfr.exec:\frlxlfr.exe107⤵PID:3060
-
\??\c:\8404826.exec:\8404826.exe108⤵PID:2448
-
\??\c:\268646.exec:\268646.exe109⤵PID:1744
-
\??\c:\02886.exec:\02886.exe110⤵PID:1540
-
\??\c:\rrfrfxr.exec:\rrfrfxr.exe111⤵PID:3136
-
\??\c:\8626004.exec:\8626004.exe112⤵PID:2028
-
\??\c:\jddjp.exec:\jddjp.exe113⤵PID:3912
-
\??\c:\40028.exec:\40028.exe114⤵PID:3904
-
\??\c:\q68648.exec:\q68648.exe115⤵PID:2104
-
\??\c:\9thntb.exec:\9thntb.exe116⤵PID:1072
-
\??\c:\flrxlfl.exec:\flrxlfl.exe117⤵PID:2796
-
\??\c:\808686.exec:\808686.exe118⤵PID:1748
-
\??\c:\0826826.exec:\0826826.exe119⤵PID:4580
-
\??\c:\426266.exec:\426266.exe120⤵PID:4520
-
\??\c:\hbthtn.exec:\hbthtn.exe121⤵PID:5032
-
\??\c:\2848228.exec:\2848228.exe122⤵PID:4808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-