Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 23:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe
-
Size
453KB
-
MD5
94da7d64bbcaa3d3eac8984cc2c7131d
-
SHA1
7012e588c2711449d5658246a2d47049d9f47e02
-
SHA256
42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82
-
SHA512
703ee914dea5cc2c63a17079e1db7404f6deec62e65c5016bbe030b9a572151a4b59c36d3a27f2749df2a0529e7bf10bb68252709ea4aa8154971d524d09e520
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/2556-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-35-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2772-65-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2772-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-129-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2076-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-141-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2468-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/344-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-719-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-864-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2596-739-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2724-694-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-621-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1840-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-474-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2220-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-419-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2784-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/328-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/548-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-122-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2672-113-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2744-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-1025-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1124-1024-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2944-1045-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2944-1065-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1568-1114-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1664-1118-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1664-1123-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2376-1131-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2564-1143-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2920-1163-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2648-1220-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2968-1251-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2376 rlllxfr.exe 2540 6206880.exe 2988 080622.exe 1696 vpjpv.exe 2724 ffrlrxx.exe 2772 7nhhbh.exe 2844 646622.exe 2908 m6840.exe 2656 8262406.exe 2744 e42660.exe 2672 8644602.exe 2216 0468068.exe 568 a0226.exe 2076 pjvdd.exe 1676 9dppd.exe 2692 3tnbnn.exe 2828 ppjvp.exe 1792 vvjpv.exe 1780 jdpvj.exe 2468 260288.exe 1916 2640280.exe 2348 08624.exe 484 bthntb.exe 1520 264684.exe 1700 rfllllr.exe 1764 086028.exe 2016 0866662.exe 548 btthbn.exe 1032 pvjjp.exe 356 080082.exe 328 086626.exe 872 0802880.exe 344 08222.exe 2332 vpjpd.exe 1544 w86622.exe 2560 7djdv.exe 2540 bhthhb.exe 2096 1fllxxf.exe 2044 pdppv.exe 300 1pddj.exe 2192 80648.exe 3020 6462400.exe 2900 7rfxxrx.exe 2808 6428002.exe 2740 bnttbh.exe 2784 vpjjp.exe 2708 nhbbnn.exe 2280 9xrrllx.exe 664 82020.exe 888 4446886.exe 2928 e08422.exe 2968 llxfffr.exe 1676 ddpdj.exe 2256 jdppv.exe 1432 64620.exe 1436 7xxlxfl.exe 2220 lffxffl.exe 2208 tnbbhn.exe 1864 60402.exe 332 s4802.exe 2348 004028.exe 2992 lfxlrrl.exe 2156 826240.exe 1772 nhbhnn.exe -
resource yara_rule behavioral1/memory/2556-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-810-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-1182-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 042200.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3htbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28240.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0460444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4484668.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20224.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8206224.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2556 wrote to memory of 2376 2556 42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe 30 PID 2556 wrote to memory of 2376 2556 42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe 30 PID 2556 wrote to memory of 2376 2556 42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe 30 PID 2556 wrote to memory of 2376 2556 42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe 30 PID 2376 wrote to memory of 2540 2376 rlllxfr.exe 66 PID 2376 wrote to memory of 2540 2376 rlllxfr.exe 66 PID 2376 wrote to memory of 2540 2376 rlllxfr.exe 66 PID 2376 wrote to memory of 2540 2376 rlllxfr.exe 66 PID 2540 wrote to memory of 2988 2540 6206880.exe 32 PID 2540 wrote to memory of 2988 2540 6206880.exe 32 PID 2540 wrote to memory of 2988 2540 6206880.exe 32 PID 2540 wrote to memory of 2988 2540 6206880.exe 32 PID 2988 wrote to memory of 1696 2988 080622.exe 33 PID 2988 wrote to memory of 1696 2988 080622.exe 33 PID 2988 wrote to memory of 1696 2988 080622.exe 33 PID 2988 wrote to memory of 1696 2988 080622.exe 33 PID 1696 wrote to memory of 2724 1696 vpjpv.exe 124 PID 1696 wrote to memory of 2724 1696 vpjpv.exe 124 PID 1696 wrote to memory of 2724 1696 vpjpv.exe 124 PID 1696 wrote to memory of 2724 1696 vpjpv.exe 124 PID 2724 wrote to memory of 2772 2724 ffrlrxx.exe 156 PID 2724 wrote to memory of 2772 2724 ffrlrxx.exe 156 PID 2724 wrote to memory of 2772 2724 ffrlrxx.exe 156 PID 2724 wrote to memory of 2772 2724 ffrlrxx.exe 156 PID 2772 wrote to memory of 2844 2772 7nhhbh.exe 36 PID 2772 wrote to memory of 2844 2772 7nhhbh.exe 36 PID 2772 wrote to memory of 2844 2772 7nhhbh.exe 36 PID 2772 wrote to memory of 2844 2772 7nhhbh.exe 36 PID 2844 wrote to memory of 2908 2844 646622.exe 37 PID 2844 wrote to memory of 2908 2844 646622.exe 37 PID 2844 wrote to memory of 2908 2844 646622.exe 37 PID 2844 wrote to memory of 2908 2844 646622.exe 37 PID 2908 wrote to memory of 2656 2908 m6840.exe 38 PID 2908 wrote to memory of 2656 2908 m6840.exe 38 PID 2908 wrote to memory of 2656 2908 m6840.exe 38 PID 2908 wrote to memory of 2656 2908 m6840.exe 38 PID 2656 wrote to memory of 2744 2656 8262406.exe 39 PID 2656 wrote to memory of 2744 2656 8262406.exe 39 PID 2656 wrote to memory of 2744 2656 8262406.exe 39 PID 2656 wrote to memory of 2744 2656 8262406.exe 39 PID 2744 wrote to memory of 2672 2744 e42660.exe 40 PID 2744 wrote to memory of 2672 2744 e42660.exe 40 PID 2744 wrote to memory of 2672 2744 e42660.exe 40 PID 2744 wrote to memory of 2672 2744 e42660.exe 40 PID 2672 wrote to memory of 2216 2672 8644602.exe 170 PID 2672 wrote to memory of 2216 2672 8644602.exe 170 PID 2672 wrote to memory of 2216 2672 8644602.exe 170 PID 2672 wrote to memory of 2216 2672 8644602.exe 170 PID 2216 wrote to memory of 568 2216 0468068.exe 42 PID 2216 wrote to memory of 568 2216 0468068.exe 42 PID 2216 wrote to memory of 568 2216 0468068.exe 42 PID 2216 wrote to memory of 568 2216 0468068.exe 42 PID 568 wrote to memory of 2076 568 a0226.exe 43 PID 568 wrote to memory of 2076 568 a0226.exe 43 PID 568 wrote to memory of 2076 568 a0226.exe 43 PID 568 wrote to memory of 2076 568 a0226.exe 43 PID 2076 wrote to memory of 1676 2076 pjvdd.exe 44 PID 2076 wrote to memory of 1676 2076 pjvdd.exe 44 PID 2076 wrote to memory of 1676 2076 pjvdd.exe 44 PID 2076 wrote to memory of 1676 2076 pjvdd.exe 44 PID 1676 wrote to memory of 2692 1676 9dppd.exe 45 PID 1676 wrote to memory of 2692 1676 9dppd.exe 45 PID 1676 wrote to memory of 2692 1676 9dppd.exe 45 PID 1676 wrote to memory of 2692 1676 9dppd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe"C:\Users\Admin\AppData\Local\Temp\42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\rlllxfr.exec:\rlllxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\6206880.exec:\6206880.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\080622.exec:\080622.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\vpjpv.exec:\vpjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\ffrlrxx.exec:\ffrlrxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\7nhhbh.exec:\7nhhbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\646622.exec:\646622.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\m6840.exec:\m6840.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\8262406.exec:\8262406.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\e42660.exec:\e42660.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\8644602.exec:\8644602.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\0468068.exec:\0468068.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\a0226.exec:\a0226.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\pjvdd.exec:\pjvdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\9dppd.exec:\9dppd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\3tnbnn.exec:\3tnbnn.exe17⤵
- Executes dropped EXE
PID:2692 -
\??\c:\ppjvp.exec:\ppjvp.exe18⤵
- Executes dropped EXE
PID:2828 -
\??\c:\vvjpv.exec:\vvjpv.exe19⤵
- Executes dropped EXE
PID:1792 -
\??\c:\jdpvj.exec:\jdpvj.exe20⤵
- Executes dropped EXE
PID:1780 -
\??\c:\260288.exec:\260288.exe21⤵
- Executes dropped EXE
PID:2468 -
\??\c:\2640280.exec:\2640280.exe22⤵
- Executes dropped EXE
PID:1916 -
\??\c:\08624.exec:\08624.exe23⤵
- Executes dropped EXE
PID:2348 -
\??\c:\bthntb.exec:\bthntb.exe24⤵
- Executes dropped EXE
PID:484 -
\??\c:\264684.exec:\264684.exe25⤵
- Executes dropped EXE
PID:1520 -
\??\c:\rfllllr.exec:\rfllllr.exe26⤵
- Executes dropped EXE
PID:1700 -
\??\c:\086028.exec:\086028.exe27⤵
- Executes dropped EXE
PID:1764 -
\??\c:\0866662.exec:\0866662.exe28⤵
- Executes dropped EXE
PID:2016 -
\??\c:\btthbn.exec:\btthbn.exe29⤵
- Executes dropped EXE
PID:548 -
\??\c:\pvjjp.exec:\pvjjp.exe30⤵
- Executes dropped EXE
PID:1032 -
\??\c:\080082.exec:\080082.exe31⤵
- Executes dropped EXE
PID:356 -
\??\c:\086626.exec:\086626.exe32⤵
- Executes dropped EXE
PID:328 -
\??\c:\0802880.exec:\0802880.exe33⤵
- Executes dropped EXE
PID:872 -
\??\c:\08222.exec:\08222.exe34⤵
- Executes dropped EXE
PID:344 -
\??\c:\vpjpd.exec:\vpjpd.exe35⤵
- Executes dropped EXE
PID:2332 -
\??\c:\w86622.exec:\w86622.exe36⤵
- Executes dropped EXE
PID:1544 -
\??\c:\7djdv.exec:\7djdv.exe37⤵
- Executes dropped EXE
PID:2560 -
\??\c:\bhthhb.exec:\bhthhb.exe38⤵
- Executes dropped EXE
PID:2540 -
\??\c:\1fllxxf.exec:\1fllxxf.exe39⤵
- Executes dropped EXE
PID:2096 -
\??\c:\pdppv.exec:\pdppv.exe40⤵
- Executes dropped EXE
PID:2044 -
\??\c:\1pddj.exec:\1pddj.exe41⤵
- Executes dropped EXE
PID:300 -
\??\c:\80648.exec:\80648.exe42⤵
- Executes dropped EXE
PID:2192 -
\??\c:\6462400.exec:\6462400.exe43⤵
- Executes dropped EXE
PID:3020 -
\??\c:\7rfxxrx.exec:\7rfxxrx.exe44⤵
- Executes dropped EXE
PID:2900 -
\??\c:\6428002.exec:\6428002.exe45⤵
- Executes dropped EXE
PID:2808 -
\??\c:\bnttbh.exec:\bnttbh.exe46⤵
- Executes dropped EXE
PID:2740 -
\??\c:\vpjjp.exec:\vpjjp.exe47⤵
- Executes dropped EXE
PID:2784 -
\??\c:\nhbbnn.exec:\nhbbnn.exe48⤵
- Executes dropped EXE
PID:2708 -
\??\c:\9xrrllx.exec:\9xrrllx.exe49⤵
- Executes dropped EXE
PID:2280 -
\??\c:\82020.exec:\82020.exe50⤵
- Executes dropped EXE
PID:664 -
\??\c:\4446886.exec:\4446886.exe51⤵
- Executes dropped EXE
PID:888 -
\??\c:\e08422.exec:\e08422.exe52⤵
- Executes dropped EXE
PID:2928 -
\??\c:\llxfffr.exec:\llxfffr.exe53⤵
- Executes dropped EXE
PID:2968 -
\??\c:\ddpdj.exec:\ddpdj.exe54⤵
- Executes dropped EXE
PID:1676 -
\??\c:\jdppv.exec:\jdppv.exe55⤵
- Executes dropped EXE
PID:2256 -
\??\c:\64620.exec:\64620.exe56⤵
- Executes dropped EXE
PID:1432 -
\??\c:\7xxlxfl.exec:\7xxlxfl.exe57⤵
- Executes dropped EXE
PID:1436 -
\??\c:\lffxffl.exec:\lffxffl.exe58⤵
- Executes dropped EXE
PID:2220 -
\??\c:\tnbbhn.exec:\tnbbhn.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\60402.exec:\60402.exe60⤵
- Executes dropped EXE
PID:1864 -
\??\c:\s4802.exec:\s4802.exe61⤵
- Executes dropped EXE
PID:332 -
\??\c:\004028.exec:\004028.exe62⤵
- Executes dropped EXE
PID:2348 -
\??\c:\lfxlrrl.exec:\lfxlrrl.exe63⤵
- Executes dropped EXE
PID:2992 -
\??\c:\826240.exec:\826240.exe64⤵
- Executes dropped EXE
PID:2156 -
\??\c:\nhbhnn.exec:\nhbhnn.exe65⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nhbntb.exec:\nhbntb.exe66⤵PID:1840
-
\??\c:\vpjpd.exec:\vpjpd.exe67⤵PID:2232
-
\??\c:\tththb.exec:\tththb.exe68⤵PID:2212
-
\??\c:\xfxfrxl.exec:\xfxfrxl.exe69⤵PID:1768
-
\??\c:\u602008.exec:\u602008.exe70⤵PID:2440
-
\??\c:\4424024.exec:\4424024.exe71⤵PID:1032
-
\??\c:\26468.exec:\26468.exe72⤵PID:1716
-
\??\c:\xrfxrff.exec:\xrfxrff.exe73⤵PID:2400
-
\??\c:\42002.exec:\42002.exe74⤵PID:1972
-
\??\c:\1hbbhh.exec:\1hbbhh.exe75⤵PID:2084
-
\??\c:\tththh.exec:\tththh.exe76⤵PID:1560
-
\??\c:\1hnttb.exec:\1hnttb.exe77⤵PID:2600
-
\??\c:\6080224.exec:\6080224.exe78⤵PID:1544
-
\??\c:\vvppv.exec:\vvppv.exe79⤵PID:2564
-
\??\c:\jpjdv.exec:\jpjdv.exe80⤵PID:2540
-
\??\c:\5jjjp.exec:\5jjjp.exe81⤵PID:2096
-
\??\c:\tbttbb.exec:\tbttbb.exe82⤵PID:1084
-
\??\c:\jdpvd.exec:\jdpvd.exe83⤵PID:2476
-
\??\c:\3tnnnt.exec:\3tnnnt.exe84⤵PID:1720
-
\??\c:\248422.exec:\248422.exe85⤵PID:2792
-
\??\c:\pjdjv.exec:\pjdjv.exe86⤵PID:2664
-
\??\c:\lfrxxlx.exec:\lfrxxlx.exe87⤵PID:2668
-
\??\c:\tbtntb.exec:\tbtntb.exe88⤵PID:1948
-
\??\c:\7lxllrx.exec:\7lxllrx.exe89⤵PID:2740
-
\??\c:\266248.exec:\266248.exe90⤵PID:2752
-
\??\c:\bnnhtb.exec:\bnnhtb.exe91⤵PID:2124
-
\??\c:\pdvdj.exec:\pdvdj.exe92⤵PID:2756
-
\??\c:\2606862.exec:\2606862.exe93⤵PID:2816
-
\??\c:\bbthbn.exec:\bbthbn.exe94⤵
- System Location Discovery: System Language Discovery
PID:568 -
\??\c:\1hnntt.exec:\1hnntt.exe95⤵PID:2640
-
\??\c:\9vjpd.exec:\9vjpd.exe96⤵PID:2724
-
\??\c:\9dppv.exec:\9dppv.exe97⤵PID:1676
-
\??\c:\s6028.exec:\s6028.exe98⤵PID:2256
-
\??\c:\4684402.exec:\4684402.exe99⤵PID:2628
-
\??\c:\hbhnhh.exec:\hbhnhh.exe100⤵PID:2488
-
\??\c:\5bhnhn.exec:\5bhnhn.exe101⤵PID:2444
-
\??\c:\9xxflfr.exec:\9xxflfr.exe102⤵PID:2596
-
\??\c:\rflfrxf.exec:\rflfrxf.exe103⤵PID:2532
-
\??\c:\1xfflll.exec:\1xfflll.exe104⤵PID:944
-
\??\c:\jjvjp.exec:\jjvjp.exe105⤵PID:1424
-
\??\c:\62868.exec:\62868.exe106⤵PID:2036
-
\??\c:\7lrrxxf.exec:\7lrrxxf.exe107⤵PID:1504
-
\??\c:\4408288.exec:\4408288.exe108⤵PID:684
-
\??\c:\428466.exec:\428466.exe109⤵PID:320
-
\??\c:\thhbtn.exec:\thhbtn.exe110⤵PID:876
-
\??\c:\tnbnnh.exec:\tnbnnh.exe111⤵PID:1704
-
\??\c:\w64400.exec:\w64400.exe112⤵PID:2428
-
\??\c:\jdpvj.exec:\jdpvj.exe113⤵PID:432
-
\??\c:\2466606.exec:\2466606.exe114⤵PID:1044
-
\??\c:\2466262.exec:\2466262.exe115⤵PID:2496
-
\??\c:\hnhhhb.exec:\hnhhhb.exe116⤵PID:1740
-
\??\c:\u682662.exec:\u682662.exe117⤵PID:872
-
\??\c:\flrllfl.exec:\flrllfl.exe118⤵PID:1708
-
\??\c:\084028.exec:\084028.exe119⤵PID:1564
-
\??\c:\xrfxfxf.exec:\xrfxfxf.exe120⤵PID:2128
-
\??\c:\o066044.exec:\o066044.exe121⤵PID:1484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-