Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 06:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
General
-
Target
f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe
-
Size
454KB
-
MD5
5bf3f682fd3484161bbe2f106cc7e3e2
-
SHA1
81aa8c7cc5771050123dbaf006396a35997d7e51
-
SHA256
f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367
-
SHA512
301797a6faed0b1ca1b9db2935e1d0d49b257759a622d83b8e59992966d28921eead42bf0ab92dbea0b71ff29367f653ef8aaa09585ad8a1f45cc05d27190890
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeA:q7Tc2NYHUrAwfMp3CDA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/1924-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/328-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1284-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/704-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/720-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-692-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-718-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1324-1164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2096 dpvjv.exe 328 866264.exe 2576 642802.exe 2320 666424.exe 1284 604688.exe 2820 3tntbn.exe 2732 60460.exe 2912 468460.exe 2928 44204.exe 1668 pppdj.exe 2664 8866442.exe 1996 00628.exe 580 426868.exe 2836 tbntbb.exe 2352 60802.exe 2864 u824864.exe 1740 fxxlfrf.exe 1528 82248.exe 2984 88648.exe 2152 xfxfrrx.exe 2956 vppdp.exe 1920 846004.exe 2336 3rlxfxf.exe 1676 0680666.exe 1704 q44028.exe 1120 w08424.exe 704 xllxrll.exe 2020 rxxrlxr.exe 1744 7lxrlff.exe 632 e60242.exe 1056 2280404.exe 2000 6488068.exe 720 nnthtn.exe 1060 86664.exe 328 xflflrl.exe 1864 bhnhnh.exe 1852 604246.exe 2704 888228.exe 2824 044606.exe 2724 tntbbh.exe 2556 048606.exe 2960 8460444.exe 2880 bbthbh.exe 2604 1llxlxr.exe 1668 4046880.exe 2220 2800606.exe 3008 ttnhbn.exe 2948 nnnbtb.exe 1708 o602064.exe 2864 1jdjv.exe 1740 djjdj.exe 2648 vdjjv.exe 1868 lfxffrr.exe 1640 0046086.exe 2980 48860.exe 1648 lrrxxxx.exe 2052 2086888.exe 2316 3nhhtt.exe 1856 vpddd.exe 2484 rxfffxf.exe 1860 1jddj.exe 1224 0062804.exe 788 hbbhtn.exe 1484 btnbtb.exe -
resource yara_rule behavioral1/memory/1924-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/704-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/720-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-848-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-867-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-953-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-959-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2364-967-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-1035-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-1080-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-1093-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-1100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-1107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-1120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-1157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-1164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-1168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-1207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-1220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-1336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-1343-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 820624.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 086246.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 026626.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 884646.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6866228.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o200620.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 260202.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4482060.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2096 1924 f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe 30 PID 1924 wrote to memory of 2096 1924 f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe 30 PID 1924 wrote to memory of 2096 1924 f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe 30 PID 1924 wrote to memory of 2096 1924 f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe 30 PID 2096 wrote to memory of 328 2096 dpvjv.exe 64 PID 2096 wrote to memory of 328 2096 dpvjv.exe 64 PID 2096 wrote to memory of 328 2096 dpvjv.exe 64 PID 2096 wrote to memory of 328 2096 dpvjv.exe 64 PID 328 wrote to memory of 2576 328 866264.exe 32 PID 328 wrote to memory of 2576 328 866264.exe 32 PID 328 wrote to memory of 2576 328 866264.exe 32 PID 328 wrote to memory of 2576 328 866264.exe 32 PID 2576 wrote to memory of 2320 2576 642802.exe 33 PID 2576 wrote to memory of 2320 2576 642802.exe 33 PID 2576 wrote to memory of 2320 2576 642802.exe 33 PID 2576 wrote to memory of 2320 2576 642802.exe 33 PID 2320 wrote to memory of 1284 2320 666424.exe 34 PID 2320 wrote to memory of 1284 2320 666424.exe 34 PID 2320 wrote to memory of 1284 2320 666424.exe 34 PID 2320 wrote to memory of 1284 2320 666424.exe 34 PID 1284 wrote to memory of 2820 1284 604688.exe 35 PID 1284 wrote to memory of 2820 1284 604688.exe 35 PID 1284 wrote to memory of 2820 1284 604688.exe 35 PID 1284 wrote to memory of 2820 1284 604688.exe 35 PID 2820 wrote to memory of 2732 2820 3tntbn.exe 36 PID 2820 wrote to memory of 2732 2820 3tntbn.exe 36 PID 2820 wrote to memory of 2732 2820 3tntbn.exe 36 PID 2820 wrote to memory of 2732 2820 3tntbn.exe 36 PID 2732 wrote to memory of 2912 2732 60460.exe 37 PID 2732 wrote to memory of 2912 2732 60460.exe 37 PID 2732 wrote to memory of 2912 2732 60460.exe 37 PID 2732 wrote to memory of 2912 2732 60460.exe 37 PID 2912 wrote to memory of 2928 2912 468460.exe 38 PID 2912 wrote to memory of 2928 2912 468460.exe 38 PID 2912 wrote to memory of 2928 2912 468460.exe 38 PID 2912 wrote to memory of 2928 2912 468460.exe 38 PID 2928 wrote to memory of 1668 2928 44204.exe 39 PID 2928 wrote to memory of 1668 2928 44204.exe 39 PID 2928 wrote to memory of 1668 2928 44204.exe 39 PID 2928 wrote to memory of 1668 2928 44204.exe 39 PID 1668 wrote to memory of 2664 1668 pppdj.exe 40 PID 1668 wrote to memory of 2664 1668 pppdj.exe 40 PID 1668 wrote to memory of 2664 1668 pppdj.exe 40 PID 1668 wrote to memory of 2664 1668 pppdj.exe 40 PID 2664 wrote to memory of 1996 2664 8866442.exe 41 PID 2664 wrote to memory of 1996 2664 8866442.exe 41 PID 2664 wrote to memory of 1996 2664 8866442.exe 41 PID 2664 wrote to memory of 1996 2664 8866442.exe 41 PID 1996 wrote to memory of 580 1996 00628.exe 42 PID 1996 wrote to memory of 580 1996 00628.exe 42 PID 1996 wrote to memory of 580 1996 00628.exe 42 PID 1996 wrote to memory of 580 1996 00628.exe 42 PID 580 wrote to memory of 2836 580 426868.exe 43 PID 580 wrote to memory of 2836 580 426868.exe 43 PID 580 wrote to memory of 2836 580 426868.exe 43 PID 580 wrote to memory of 2836 580 426868.exe 43 PID 2836 wrote to memory of 2352 2836 tbntbb.exe 44 PID 2836 wrote to memory of 2352 2836 tbntbb.exe 44 PID 2836 wrote to memory of 2352 2836 tbntbb.exe 44 PID 2836 wrote to memory of 2352 2836 tbntbb.exe 44 PID 2352 wrote to memory of 2864 2352 60802.exe 45 PID 2352 wrote to memory of 2864 2352 60802.exe 45 PID 2352 wrote to memory of 2864 2352 60802.exe 45 PID 2352 wrote to memory of 2864 2352 60802.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe"C:\Users\Admin\AppData\Local\Temp\f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\dpvjv.exec:\dpvjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\866264.exec:\866264.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:328 -
\??\c:\642802.exec:\642802.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\666424.exec:\666424.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\604688.exec:\604688.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\3tntbn.exec:\3tntbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\60460.exec:\60460.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\468460.exec:\468460.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\44204.exec:\44204.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\pppdj.exec:\pppdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\8866442.exec:\8866442.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\00628.exec:\00628.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\426868.exec:\426868.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\tbntbb.exec:\tbntbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\60802.exec:\60802.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\u824864.exec:\u824864.exe17⤵
- Executes dropped EXE
PID:2864 -
\??\c:\fxxlfrf.exec:\fxxlfrf.exe18⤵
- Executes dropped EXE
PID:1740 -
\??\c:\82248.exec:\82248.exe19⤵
- Executes dropped EXE
PID:1528 -
\??\c:\88648.exec:\88648.exe20⤵
- Executes dropped EXE
PID:2984 -
\??\c:\xfxfrrx.exec:\xfxfrrx.exe21⤵
- Executes dropped EXE
PID:2152 -
\??\c:\vppdp.exec:\vppdp.exe22⤵
- Executes dropped EXE
PID:2956 -
\??\c:\846004.exec:\846004.exe23⤵
- Executes dropped EXE
PID:1920 -
\??\c:\3rlxfxf.exec:\3rlxfxf.exe24⤵
- Executes dropped EXE
PID:2336 -
\??\c:\0680666.exec:\0680666.exe25⤵
- Executes dropped EXE
PID:1676 -
\??\c:\q44028.exec:\q44028.exe26⤵
- Executes dropped EXE
PID:1704 -
\??\c:\w08424.exec:\w08424.exe27⤵
- Executes dropped EXE
PID:1120 -
\??\c:\xllxrll.exec:\xllxrll.exe28⤵
- Executes dropped EXE
PID:704 -
\??\c:\rxxrlxr.exec:\rxxrlxr.exe29⤵
- Executes dropped EXE
PID:2020 -
\??\c:\7lxrlff.exec:\7lxrlff.exe30⤵
- Executes dropped EXE
PID:1744 -
\??\c:\e60242.exec:\e60242.exe31⤵
- Executes dropped EXE
PID:632 -
\??\c:\2280404.exec:\2280404.exe32⤵
- Executes dropped EXE
PID:1056 -
\??\c:\6488068.exec:\6488068.exe33⤵
- Executes dropped EXE
PID:2000 -
\??\c:\nnthtn.exec:\nnthtn.exe34⤵
- Executes dropped EXE
PID:720 -
\??\c:\86664.exec:\86664.exe35⤵
- Executes dropped EXE
PID:1060 -
\??\c:\xflflrl.exec:\xflflrl.exe36⤵
- Executes dropped EXE
PID:328 -
\??\c:\bhnhnh.exec:\bhnhnh.exe37⤵
- Executes dropped EXE
PID:1864 -
\??\c:\604246.exec:\604246.exe38⤵
- Executes dropped EXE
PID:1852 -
\??\c:\888228.exec:\888228.exe39⤵
- Executes dropped EXE
PID:2704 -
\??\c:\044606.exec:\044606.exe40⤵
- Executes dropped EXE
PID:2824 -
\??\c:\tntbbh.exec:\tntbbh.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\048606.exec:\048606.exe42⤵
- Executes dropped EXE
PID:2556 -
\??\c:\8460444.exec:\8460444.exe43⤵
- Executes dropped EXE
PID:2960 -
\??\c:\bbthbh.exec:\bbthbh.exe44⤵
- Executes dropped EXE
PID:2880 -
\??\c:\1llxlxr.exec:\1llxlxr.exe45⤵
- Executes dropped EXE
PID:2604 -
\??\c:\4046880.exec:\4046880.exe46⤵
- Executes dropped EXE
PID:1668 -
\??\c:\2800606.exec:\2800606.exe47⤵
- Executes dropped EXE
PID:2220 -
\??\c:\ttnhbn.exec:\ttnhbn.exe48⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nnnbtb.exec:\nnnbtb.exe49⤵
- Executes dropped EXE
PID:2948 -
\??\c:\o602064.exec:\o602064.exe50⤵
- Executes dropped EXE
PID:1708 -
\??\c:\1jdjv.exec:\1jdjv.exe51⤵
- Executes dropped EXE
PID:2864 -
\??\c:\djjdj.exec:\djjdj.exe52⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vdjjv.exec:\vdjjv.exe53⤵
- Executes dropped EXE
PID:2648 -
\??\c:\lfxffrr.exec:\lfxffrr.exe54⤵
- Executes dropped EXE
PID:1868 -
\??\c:\0046086.exec:\0046086.exe55⤵
- Executes dropped EXE
PID:1640 -
\??\c:\48860.exec:\48860.exe56⤵
- Executes dropped EXE
PID:2980 -
\??\c:\lrrxxxx.exec:\lrrxxxx.exe57⤵
- Executes dropped EXE
PID:1648 -
\??\c:\2086888.exec:\2086888.exe58⤵
- Executes dropped EXE
PID:2052 -
\??\c:\3nhhtt.exec:\3nhhtt.exe59⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vpddd.exec:\vpddd.exe60⤵
- Executes dropped EXE
PID:1856 -
\??\c:\rxfffxf.exec:\rxfffxf.exe61⤵
- Executes dropped EXE
PID:2484 -
\??\c:\1jddj.exec:\1jddj.exe62⤵
- Executes dropped EXE
PID:1860 -
\??\c:\0062804.exec:\0062804.exe63⤵
- Executes dropped EXE
PID:1224 -
\??\c:\hbbhtn.exec:\hbbhtn.exe64⤵
- Executes dropped EXE
PID:788 -
\??\c:\btnbtb.exec:\btnbtb.exe65⤵
- Executes dropped EXE
PID:1484 -
\??\c:\1lfflxf.exec:\1lfflxf.exe66⤵PID:632
-
\??\c:\440820.exec:\440820.exe67⤵PID:1056
-
\??\c:\ddpvd.exec:\ddpvd.exe68⤵PID:572
-
\??\c:\688006.exec:\688006.exe69⤵PID:236
-
\??\c:\2840266.exec:\2840266.exe70⤵PID:1244
-
\??\c:\5nbttt.exec:\5nbttt.exe71⤵PID:2168
-
\??\c:\btnhnn.exec:\btnhnn.exe72⤵PID:908
-
\??\c:\pjdjp.exec:\pjdjp.exe73⤵PID:2340
-
\??\c:\5btbnh.exec:\5btbnh.exe74⤵PID:2108
-
\??\c:\hbnbhb.exec:\hbnbhb.exe75⤵PID:1620
-
\??\c:\44404.exec:\44404.exe76⤵PID:2748
-
\??\c:\w66868.exec:\w66868.exe77⤵PID:2412
-
\??\c:\28282.exec:\28282.exe78⤵PID:2060
-
\??\c:\9vvdd.exec:\9vvdd.exe79⤵PID:592
-
\??\c:\860062.exec:\860062.exe80⤵PID:2820
-
\??\c:\ttnbnn.exec:\ttnbnn.exe81⤵PID:2772
-
\??\c:\q42840.exec:\q42840.exe82⤵PID:1400
-
\??\c:\8268626.exec:\8268626.exe83⤵PID:2936
-
\??\c:\fxxfxfr.exec:\fxxfxfr.exe84⤵PID:2612
-
\??\c:\1dvjp.exec:\1dvjp.exe85⤵PID:2620
-
\??\c:\4400804.exec:\4400804.exe86⤵PID:2676
-
\??\c:\2808800.exec:\2808800.exe87⤵PID:2332
-
\??\c:\84666.exec:\84666.exe88⤵PID:1716
-
\??\c:\ffrrlxr.exec:\ffrrlxr.exe89⤵PID:2968
-
\??\c:\llxllrl.exec:\llxllrl.exe90⤵PID:928
-
\??\c:\nnhnht.exec:\nnhnht.exe91⤵PID:1628
-
\??\c:\llrxlrl.exec:\llrxlrl.exe92⤵PID:2784
-
\??\c:\4280468.exec:\4280468.exe93⤵PID:2372
-
\??\c:\60808.exec:\60808.exe94⤵PID:2864
-
\??\c:\jddpd.exec:\jddpd.exe95⤵PID:2136
-
\??\c:\tbtnhn.exec:\tbtnhn.exe96⤵PID:2644
-
\??\c:\htbhbb.exec:\htbhbb.exe97⤵PID:2944
-
\??\c:\42624.exec:\42624.exe98⤵PID:1640
-
\??\c:\vjpjj.exec:\vjpjj.exe99⤵PID:1028
-
\??\c:\g4464.exec:\g4464.exe100⤵PID:2148
-
\??\c:\048484.exec:\048484.exe101⤵PID:2056
-
\??\c:\6280088.exec:\6280088.exe102⤵PID:1932
-
\??\c:\02440.exec:\02440.exe103⤵PID:2908
-
\??\c:\26686.exec:\26686.exe104⤵PID:2560
-
\??\c:\222084.exec:\222084.exe105⤵PID:2004
-
\??\c:\flrffrf.exec:\flrffrf.exe106⤵PID:596
-
\??\c:\vvvdp.exec:\vvvdp.exe107⤵PID:2392
-
\??\c:\llflfrx.exec:\llflfrx.exe108⤵PID:1484
-
\??\c:\lrlfxlf.exec:\lrlfxlf.exe109⤵PID:1500
-
\??\c:\02284.exec:\02284.exe110⤵PID:1056
-
\??\c:\lrflrff.exec:\lrflrff.exe111⤵PID:720
-
\??\c:\jpvdp.exec:\jpvdp.exe112⤵PID:236
-
\??\c:\262808.exec:\262808.exe113⤵PID:2532
-
\??\c:\3tttnt.exec:\3tttnt.exe114⤵PID:2096
-
\??\c:\48246.exec:\48246.exe115⤵PID:1564
-
\??\c:\1ppvj.exec:\1ppvj.exe116⤵PID:1596
-
\??\c:\g0204.exec:\g0204.exe117⤵PID:2916
-
\??\c:\666246.exec:\666246.exe118⤵PID:2692
-
\??\c:\lllfllx.exec:\lllfllx.exe119⤵PID:2320
-
\??\c:\djpjd.exec:\djpjd.exe120⤵PID:680
-
\??\c:\llfxrlf.exec:\llfxrlf.exe121⤵PID:2816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-