Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 10:54
Behavioral task
behavioral1
Sample
3cae756ae1851ad6aba300be01231c3313905d1366ac3543c23417ba0681ca3cN.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
120 seconds
General
-
Target
3cae756ae1851ad6aba300be01231c3313905d1366ac3543c23417ba0681ca3cN.exe
-
Size
334KB
-
MD5
fbd581bd9a79232f40fd35cbf76e44a0
-
SHA1
6639c2dae176054b12085a390beb544c61f71004
-
SHA256
3cae756ae1851ad6aba300be01231c3313905d1366ac3543c23417ba0681ca3c
-
SHA512
39e61c762b7505b34055ef0d361ba671ba6ca4c588052f035bcc53a1919af2b8aa32d07947bbd7eba17e9d0910b3e5ea860db01ff17aeaaa5b46ba5a1bd1b7b1
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeR+:R4wFHoSHYHUrAwfMp3CDR+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/3000-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/536-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/316-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2440-157-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1644-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-181-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1988-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-204-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2088-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/988-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-215-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1904-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1992-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/604-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1796-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1980-402-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1104-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1768-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1824-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-487-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2476-545-0x0000000077900000-0x0000000077A1F000-memory.dmp family_blackmoon behavioral1/memory/2616-561-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2000-739-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-783-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-862-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2836-868-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/496-916-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/920-1002-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2420-1174-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/3052-1231-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2476-15381-0x0000000077A20000-0x0000000077B1A000-memory.dmp family_blackmoon behavioral1/memory/2476-16217-0x0000000077900000-0x0000000077A1F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2492 0042288.exe 1728 7httbt.exe 2392 a0840.exe 2860 m6880.exe 536 k40848.exe 2892 hbhnnt.exe 2268 q46666.exe 2840 7pddd.exe 2960 80846.exe 1804 bthbhh.exe 2744 rxlrxxl.exe 2428 4822220.exe 316 htbbhh.exe 1936 2000046.exe 2856 pjppd.exe 1720 60884.exe 2980 vjdjj.exe 2440 g8006.exe 1948 80222.exe 1644 vvpjd.exe 3060 rlxrxrf.exe 3048 268842.exe 1988 6088842.exe 2552 rlflrfl.exe 2088 0466262.exe 988 8264024.exe 1904 202848.exe 1992 jdppv.exe 332 s8284.exe 604 1rxfrrl.exe 344 04224.exe 1448 82002.exe 2320 e68248.exe 896 pdpvv.exe 1796 202466.exe 2144 m4246.exe 1600 1thbhh.exe 1628 9xlfrrx.exe 2352 g0884.exe 1728 7hthhb.exe 2380 646622.exe 2772 k82808.exe 2824 8688084.exe 2904 hthbhb.exe 2812 6686640.exe 2888 4822828.exe 2304 5jdjp.exe 2896 k20028.exe 2528 nhhtbb.exe 2692 hhbbbb.exe 1296 e22662.exe 2724 xxllrrx.exe 2712 5bhhtt.exe 2428 5nhnbh.exe 1104 3hhhtb.exe 1516 622046.exe 1980 8646624.exe 576 5hbnbh.exe 968 hhnnbh.exe 376 4820224.exe 2972 btnbbh.exe 1444 0460284.exe 1768 9lffrxl.exe 1824 0882868.exe -
resource yara_rule behavioral1/memory/3000-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b00000001202c-7.dat upx behavioral1/memory/3000-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d81-16.dat upx behavioral1/memory/2492-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d89-25.dat upx behavioral1/memory/1728-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015ec4-31.dat upx behavioral1/memory/536-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015f25-39.dat upx behavioral1/memory/2860-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/536-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2892-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001610d-58.dat upx behavioral1/memory/2268-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d2a-67.dat upx behavioral1/memory/2392-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015f7b-50.dat upx behavioral1/memory/2840-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d3a-75.dat upx behavioral1/files/0x0006000000016d4b-94.dat upx behavioral1/files/0x0006000000016d43-86.dat upx behavioral1/memory/2960-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2428-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d54-103.dat upx behavioral1/memory/2744-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d67-110.dat upx behavioral1/files/0x0006000000016d6f-125.dat upx behavioral1/files/0x0006000000016d6b-119.dat upx behavioral1/memory/316-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2856-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d77-134.dat upx behavioral1/memory/1720-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d9f-140.dat upx behavioral1/files/0x0009000000015d2a-151.dat upx behavioral1/memory/2980-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016de8-158.dat upx behavioral1/files/0x0006000000016dea-166.dat upx behavioral1/files/0x0006000000016df3-174.dat upx behavioral1/memory/1644-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ecf-183.dat upx behavioral1/files/0x0006000000017049-189.dat upx behavioral1/memory/1988-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017497-197.dat upx behavioral1/memory/2088-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001749c-207.dat upx behavioral1/files/0x000600000001755b-216.dat upx behavioral1/memory/988-223-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018686-222.dat upx behavioral1/files/0x00050000000186e7-232.dat upx behavioral1/memory/1904-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186ed-240.dat upx behavioral1/memory/1992-238-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186f1-247.dat upx behavioral1/files/0x00050000000186f4-254.dat upx behavioral1/memory/604-253-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018704-262.dat upx behavioral1/memory/1796-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2772-314-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2904-325-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-341-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2896-349-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2692-366-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2712-394-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 426626.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 646688.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 082862.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4862880.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 260688.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 080622.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2492 3000 3cae756ae1851ad6aba300be01231c3313905d1366ac3543c23417ba0681ca3cN.exe 30 PID 3000 wrote to memory of 2492 3000 3cae756ae1851ad6aba300be01231c3313905d1366ac3543c23417ba0681ca3cN.exe 30 PID 3000 wrote to memory of 2492 3000 3cae756ae1851ad6aba300be01231c3313905d1366ac3543c23417ba0681ca3cN.exe 30 PID 3000 wrote to memory of 2492 3000 3cae756ae1851ad6aba300be01231c3313905d1366ac3543c23417ba0681ca3cN.exe 30 PID 2492 wrote to memory of 1728 2492 0042288.exe 31 PID 2492 wrote to memory of 1728 2492 0042288.exe 31 PID 2492 wrote to memory of 1728 2492 0042288.exe 31 PID 2492 wrote to memory of 1728 2492 0042288.exe 31 PID 1728 wrote to memory of 2392 1728 7httbt.exe 32 PID 1728 wrote to memory of 2392 1728 7httbt.exe 32 PID 1728 wrote to memory of 2392 1728 7httbt.exe 32 PID 1728 wrote to memory of 2392 1728 7httbt.exe 32 PID 2392 wrote to memory of 2860 2392 a0840.exe 33 PID 2392 wrote to memory of 2860 2392 a0840.exe 33 PID 2392 wrote to memory of 2860 2392 a0840.exe 33 PID 2392 wrote to memory of 2860 2392 a0840.exe 33 PID 2860 wrote to memory of 536 2860 m6880.exe 34 PID 2860 wrote to memory of 536 2860 m6880.exe 34 PID 2860 wrote to memory of 536 2860 m6880.exe 34 PID 2860 wrote to memory of 536 2860 m6880.exe 34 PID 536 wrote to memory of 2892 536 k40848.exe 35 PID 536 wrote to memory of 2892 536 k40848.exe 35 PID 536 wrote to memory of 2892 536 k40848.exe 35 PID 536 wrote to memory of 2892 536 k40848.exe 35 PID 2892 wrote to memory of 2268 2892 hbhnnt.exe 36 PID 2892 wrote to memory of 2268 2892 hbhnnt.exe 36 PID 2892 wrote to memory of 2268 2892 hbhnnt.exe 36 PID 2892 wrote to memory of 2268 2892 hbhnnt.exe 36 PID 2268 wrote to memory of 2840 2268 q46666.exe 37 PID 2268 wrote to memory of 2840 2268 q46666.exe 37 PID 2268 wrote to memory of 2840 2268 q46666.exe 37 PID 2268 wrote to memory of 2840 2268 q46666.exe 37 PID 2840 wrote to memory of 2960 2840 7pddd.exe 38 PID 2840 wrote to memory of 2960 2840 7pddd.exe 38 PID 2840 wrote to memory of 2960 2840 7pddd.exe 38 PID 2840 wrote to memory of 2960 2840 7pddd.exe 38 PID 2960 wrote to memory of 1804 2960 80846.exe 39 PID 2960 wrote to memory of 1804 2960 80846.exe 39 PID 2960 wrote to memory of 1804 2960 80846.exe 39 PID 2960 wrote to memory of 1804 2960 80846.exe 39 PID 1804 wrote to memory of 2744 1804 bthbhh.exe 40 PID 1804 wrote to memory of 2744 1804 bthbhh.exe 40 PID 1804 wrote to memory of 2744 1804 bthbhh.exe 40 PID 1804 wrote to memory of 2744 1804 bthbhh.exe 40 PID 2744 wrote to memory of 2428 2744 rxlrxxl.exe 41 PID 2744 wrote to memory of 2428 2744 rxlrxxl.exe 41 PID 2744 wrote to memory of 2428 2744 rxlrxxl.exe 41 PID 2744 wrote to memory of 2428 2744 rxlrxxl.exe 41 PID 2428 wrote to memory of 316 2428 4822220.exe 42 PID 2428 wrote to memory of 316 2428 4822220.exe 42 PID 2428 wrote to memory of 316 2428 4822220.exe 42 PID 2428 wrote to memory of 316 2428 4822220.exe 42 PID 316 wrote to memory of 1936 316 htbbhh.exe 43 PID 316 wrote to memory of 1936 316 htbbhh.exe 43 PID 316 wrote to memory of 1936 316 htbbhh.exe 43 PID 316 wrote to memory of 1936 316 htbbhh.exe 43 PID 1936 wrote to memory of 2856 1936 2000046.exe 44 PID 1936 wrote to memory of 2856 1936 2000046.exe 44 PID 1936 wrote to memory of 2856 1936 2000046.exe 44 PID 1936 wrote to memory of 2856 1936 2000046.exe 44 PID 2856 wrote to memory of 1720 2856 pjppd.exe 45 PID 2856 wrote to memory of 1720 2856 pjppd.exe 45 PID 2856 wrote to memory of 1720 2856 pjppd.exe 45 PID 2856 wrote to memory of 1720 2856 pjppd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cae756ae1851ad6aba300be01231c3313905d1366ac3543c23417ba0681ca3cN.exe"C:\Users\Admin\AppData\Local\Temp\3cae756ae1851ad6aba300be01231c3313905d1366ac3543c23417ba0681ca3cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\0042288.exec:\0042288.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\7httbt.exec:\7httbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\a0840.exec:\a0840.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\m6880.exec:\m6880.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\k40848.exec:\k40848.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\hbhnnt.exec:\hbhnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\q46666.exec:\q46666.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\7pddd.exec:\7pddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\80846.exec:\80846.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\bthbhh.exec:\bthbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\rxlrxxl.exec:\rxlrxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\4822220.exec:\4822220.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\htbbhh.exec:\htbbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\2000046.exec:\2000046.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\pjppd.exec:\pjppd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\60884.exec:\60884.exe17⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vjdjj.exec:\vjdjj.exe18⤵
- Executes dropped EXE
PID:2980 -
\??\c:\g8006.exec:\g8006.exe19⤵
- Executes dropped EXE
PID:2440 -
\??\c:\80222.exec:\80222.exe20⤵
- Executes dropped EXE
PID:1948 -
\??\c:\vvpjd.exec:\vvpjd.exe21⤵
- Executes dropped EXE
PID:1644 -
\??\c:\rlxrxrf.exec:\rlxrxrf.exe22⤵
- Executes dropped EXE
PID:3060 -
\??\c:\268842.exec:\268842.exe23⤵
- Executes dropped EXE
PID:3048 -
\??\c:\6088842.exec:\6088842.exe24⤵
- Executes dropped EXE
PID:1988 -
\??\c:\rlflrfl.exec:\rlflrfl.exe25⤵
- Executes dropped EXE
PID:2552 -
\??\c:\0466262.exec:\0466262.exe26⤵
- Executes dropped EXE
PID:2088 -
\??\c:\8264024.exec:\8264024.exe27⤵
- Executes dropped EXE
PID:988 -
\??\c:\202848.exec:\202848.exe28⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jdppv.exec:\jdppv.exe29⤵
- Executes dropped EXE
PID:1992 -
\??\c:\s8284.exec:\s8284.exe30⤵
- Executes dropped EXE
PID:332 -
\??\c:\1rxfrrl.exec:\1rxfrrl.exe31⤵
- Executes dropped EXE
PID:604 -
\??\c:\04224.exec:\04224.exe32⤵
- Executes dropped EXE
PID:344 -
\??\c:\82002.exec:\82002.exe33⤵
- Executes dropped EXE
PID:1448 -
\??\c:\e68248.exec:\e68248.exe34⤵
- Executes dropped EXE
PID:2320 -
\??\c:\pdpvv.exec:\pdpvv.exe35⤵
- Executes dropped EXE
PID:896 -
\??\c:\202466.exec:\202466.exe36⤵
- Executes dropped EXE
PID:1796 -
\??\c:\m4246.exec:\m4246.exe37⤵
- Executes dropped EXE
PID:2144 -
\??\c:\1thbhh.exec:\1thbhh.exe38⤵
- Executes dropped EXE
PID:1600 -
\??\c:\9xlfrrx.exec:\9xlfrrx.exe39⤵
- Executes dropped EXE
PID:1628 -
\??\c:\g0884.exec:\g0884.exe40⤵
- Executes dropped EXE
PID:2352 -
\??\c:\7hthhb.exec:\7hthhb.exe41⤵
- Executes dropped EXE
PID:1728 -
\??\c:\646622.exec:\646622.exe42⤵
- Executes dropped EXE
PID:2380 -
\??\c:\k82808.exec:\k82808.exe43⤵
- Executes dropped EXE
PID:2772 -
\??\c:\8688084.exec:\8688084.exe44⤵
- Executes dropped EXE
PID:2824 -
\??\c:\hthbhb.exec:\hthbhb.exe45⤵
- Executes dropped EXE
PID:2904 -
\??\c:\6686640.exec:\6686640.exe46⤵
- Executes dropped EXE
PID:2812 -
\??\c:\4822828.exec:\4822828.exe47⤵
- Executes dropped EXE
PID:2888 -
\??\c:\5jdjp.exec:\5jdjp.exe48⤵
- Executes dropped EXE
PID:2304 -
\??\c:\k20028.exec:\k20028.exe49⤵
- Executes dropped EXE
PID:2896 -
\??\c:\nhhtbb.exec:\nhhtbb.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2528 -
\??\c:\hhbbbb.exec:\hhbbbb.exe51⤵
- Executes dropped EXE
PID:2692 -
\??\c:\e22662.exec:\e22662.exe52⤵
- Executes dropped EXE
PID:1296 -
\??\c:\xxllrrx.exec:\xxllrrx.exe53⤵
- Executes dropped EXE
PID:2724 -
\??\c:\5bhhtt.exec:\5bhhtt.exe54⤵
- Executes dropped EXE
PID:2712 -
\??\c:\5nhnbh.exec:\5nhnbh.exe55⤵
- Executes dropped EXE
PID:2428 -
\??\c:\3hhhtb.exec:\3hhhtb.exe56⤵
- Executes dropped EXE
PID:1104 -
\??\c:\622046.exec:\622046.exe57⤵
- Executes dropped EXE
PID:1516 -
\??\c:\8646624.exec:\8646624.exe58⤵
- Executes dropped EXE
PID:1980 -
\??\c:\5hbnbh.exec:\5hbnbh.exe59⤵
- Executes dropped EXE
PID:576 -
\??\c:\hhnnbh.exec:\hhnnbh.exe60⤵
- Executes dropped EXE
PID:968 -
\??\c:\4820224.exec:\4820224.exe61⤵
- Executes dropped EXE
PID:376 -
\??\c:\btnbbh.exec:\btnbbh.exe62⤵
- Executes dropped EXE
PID:2972 -
\??\c:\0460284.exec:\0460284.exe63⤵
- Executes dropped EXE
PID:1444 -
\??\c:\9lffrxl.exec:\9lffrxl.exe64⤵
- Executes dropped EXE
PID:1768 -
\??\c:\0882868.exec:\0882868.exe65⤵
- Executes dropped EXE
PID:1824 -
\??\c:\66828.exec:\66828.exe66⤵PID:3008
-
\??\c:\8644444.exec:\8644444.exe67⤵PID:1776
-
\??\c:\bththn.exec:\bththn.exe68⤵PID:548
-
\??\c:\c248088.exec:\c248088.exe69⤵PID:1812
-
\??\c:\rlflxrx.exec:\rlflxrx.exe70⤵PID:2540
-
\??\c:\m6828.exec:\m6828.exe71⤵PID:2000
-
\??\c:\48006.exec:\48006.exe72⤵PID:2088
-
\??\c:\7rlrrxf.exec:\7rlrrxf.exe73⤵PID:1952
-
\??\c:\080622.exec:\080622.exe74⤵
- System Location Discovery: System Language Discovery
PID:1816 -
\??\c:\5vjpv.exec:\5vjpv.exe75⤵PID:2316
-
\??\c:\o280404.exec:\o280404.exe76⤵PID:1588
-
\??\c:\646022.exec:\646022.exe77⤵PID:2236
-
\??\c:\tbhthb.exec:\tbhthb.exe78⤵PID:2344
-
\??\c:\q80406.exec:\q80406.exe79⤵PID:1676
-
\??\c:\64228.exec:\64228.exe80⤵PID:2228
-
\??\c:\llrlrxr.exec:\llrlrxr.exe81⤵PID:1496
-
\??\c:\60666.exec:\60666.exe82⤵PID:1448
-
\??\c:\26480.exec:\26480.exe83⤵PID:1964
-
\??\c:\5flrrll.exec:\5flrrll.exe84⤵PID:1960
-
\??\c:\w80448.exec:\w80448.exe85⤵PID:2476
-
\??\c:\220400.exec:\220400.exe86⤵PID:1748
-
\??\c:\9bnhnn.exec:\9bnhnn.exe87⤵PID:2372
-
\??\c:\204688.exec:\204688.exe88⤵PID:2616
-
\??\c:\xlxfllr.exec:\xlxfllr.exe89⤵PID:1332
-
\??\c:\vjpvd.exec:\vjpvd.exe90⤵PID:2112
-
\??\c:\o428840.exec:\o428840.exe91⤵PID:2392
-
\??\c:\42488.exec:\42488.exe92⤵PID:2860
-
\??\c:\k64406.exec:\k64406.exe93⤵PID:2884
-
\??\c:\bthhtt.exec:\bthhtt.exe94⤵PID:2168
-
\??\c:\420026.exec:\420026.exe95⤵PID:2292
-
\??\c:\pjvvp.exec:\pjvvp.exe96⤵PID:2812
-
\??\c:\xlfflrx.exec:\xlfflrx.exe97⤵PID:2888
-
\??\c:\i862280.exec:\i862280.exe98⤵PID:2944
-
\??\c:\20228.exec:\20228.exe99⤵PID:2848
-
\??\c:\646222.exec:\646222.exe100⤵PID:2852
-
\??\c:\820022.exec:\820022.exe101⤵PID:2680
-
\??\c:\42628.exec:\42628.exe102⤵PID:2420
-
\??\c:\8226604.exec:\8226604.exe103⤵PID:2532
-
\??\c:\8644622.exec:\8644622.exe104⤵PID:2584
-
\??\c:\dpdvv.exec:\dpdvv.exe105⤵PID:2920
-
\??\c:\048284.exec:\048284.exe106⤵PID:1664
-
\??\c:\9hbhth.exec:\9hbhth.exe107⤵PID:2356
-
\??\c:\6640246.exec:\6640246.exe108⤵PID:1556
-
\??\c:\26462.exec:\26462.exe109⤵PID:1980
-
\??\c:\rffxxrr.exec:\rffxxrr.exe110⤵PID:816
-
\??\c:\3lflrrx.exec:\3lflrrx.exe111⤵PID:968
-
\??\c:\64004.exec:\64004.exe112⤵PID:2044
-
\??\c:\jdpjj.exec:\jdpjj.exe113⤵PID:2972
-
\??\c:\60228.exec:\60228.exe114⤵PID:1292
-
\??\c:\802282.exec:\802282.exe115⤵PID:1768
-
\??\c:\088428.exec:\088428.exe116⤵PID:3028
-
\??\c:\tthntn.exec:\tthntn.exe117⤵PID:1228
-
\??\c:\4422822.exec:\4422822.exe118⤵PID:2080
-
\??\c:\dpdpv.exec:\dpdpv.exe119⤵PID:2628
-
\??\c:\thtnnh.exec:\thtnnh.exe120⤵PID:2196
-
\??\c:\htbbhb.exec:\htbbhb.exe121⤵PID:1100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-