Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 07:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
General
-
Target
f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe
-
Size
454KB
-
MD5
5bf3f682fd3484161bbe2f106cc7e3e2
-
SHA1
81aa8c7cc5771050123dbaf006396a35997d7e51
-
SHA256
f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367
-
SHA512
301797a6faed0b1ca1b9db2935e1d0d49b257759a622d83b8e59992966d28921eead42bf0ab92dbea0b71ff29367f653ef8aaa09585ad8a1f45cc05d27190890
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeA:q7Tc2NYHUrAwfMp3CDA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/3048-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-246-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2020-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-310-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1976-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-328-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2016-327-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1912-260-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2016-348-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2656-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/972-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-718-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1596-719-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-738-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/776-979-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1340-1041-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2856-1225-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2372-1367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3048 i422824.exe 1156 lxlffxx.exe 3060 bhbbth.exe 2768 4688682.exe 3000 3lxlxxf.exe 2348 08240.exe 3056 00864.exe 2792 u222404.exe 2648 00846.exe 3068 pvdjv.exe 2540 o480420.exe 1504 2044062.exe 876 9lxxfrl.exe 1812 nnnttt.exe 1996 dpjjv.exe 1304 688864.exe 2944 482244.exe 2716 ffxlflx.exe 2292 1fxlxfx.exe 2312 pjvjv.exe 3016 w00446.exe 408 004624.exe 1800 2644684.exe 1816 20024.exe 1388 288660.exe 1824 e60646.exe 1592 7nhhhn.exe 1912 nbtbtb.exe 2020 820240.exe 1976 vvdpd.exe 1724 4202248.exe 2992 htnbnt.exe 2376 k46084.exe 1576 9vdvp.exe 2976 m4246.exe 2016 pppdp.exe 320 xrllflx.exe 2160 9bbbht.exe 2756 88828.exe 2828 ddpjv.exe 2928 3btnhn.exe 2884 66644.exe 2656 tnnntt.exe 2672 rrlrllr.exe 2248 26842.exe 2796 6266260.exe 1804 620240.exe 2916 66644.exe 2688 8208284.exe 876 22080.exe 996 8864680.exe 1848 448688.exe 2728 a0486.exe 2060 880080.exe 2948 5thnnt.exe 2056 4408808.exe 2716 48202.exe 2088 60862.exe 1052 tnnthn.exe 2312 04808.exe 2336 826684.exe 2812 nnthbn.exe 972 hbnhnt.exe 2612 tbthbh.exe -
resource yara_rule behavioral1/memory/3032-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-327-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2016-348-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2656-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/972-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-856-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-869-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-979-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-1004-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-1114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-1127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-1152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-1238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-1263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-1276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-1367-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48680.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 666240.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60868.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 042688.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44022.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g2068.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2044066.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c046286.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22202.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3032 wrote to memory of 3048 3032 f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe 30 PID 3032 wrote to memory of 3048 3032 f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe 30 PID 3032 wrote to memory of 3048 3032 f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe 30 PID 3032 wrote to memory of 3048 3032 f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe 30 PID 3048 wrote to memory of 1156 3048 i422824.exe 31 PID 3048 wrote to memory of 1156 3048 i422824.exe 31 PID 3048 wrote to memory of 1156 3048 i422824.exe 31 PID 3048 wrote to memory of 1156 3048 i422824.exe 31 PID 1156 wrote to memory of 3060 1156 lxlffxx.exe 32 PID 1156 wrote to memory of 3060 1156 lxlffxx.exe 32 PID 1156 wrote to memory of 3060 1156 lxlffxx.exe 32 PID 1156 wrote to memory of 3060 1156 lxlffxx.exe 32 PID 3060 wrote to memory of 2768 3060 bhbbth.exe 33 PID 3060 wrote to memory of 2768 3060 bhbbth.exe 33 PID 3060 wrote to memory of 2768 3060 bhbbth.exe 33 PID 3060 wrote to memory of 2768 3060 bhbbth.exe 33 PID 2768 wrote to memory of 3000 2768 4688682.exe 34 PID 2768 wrote to memory of 3000 2768 4688682.exe 34 PID 2768 wrote to memory of 3000 2768 4688682.exe 34 PID 2768 wrote to memory of 3000 2768 4688682.exe 34 PID 3000 wrote to memory of 2348 3000 3lxlxxf.exe 35 PID 3000 wrote to memory of 2348 3000 3lxlxxf.exe 35 PID 3000 wrote to memory of 2348 3000 3lxlxxf.exe 35 PID 3000 wrote to memory of 2348 3000 3lxlxxf.exe 35 PID 2348 wrote to memory of 3056 2348 08240.exe 36 PID 2348 wrote to memory of 3056 2348 08240.exe 36 PID 2348 wrote to memory of 3056 2348 08240.exe 36 PID 2348 wrote to memory of 3056 2348 08240.exe 36 PID 3056 wrote to memory of 2792 3056 00864.exe 37 PID 3056 wrote to memory of 2792 3056 00864.exe 37 PID 3056 wrote to memory of 2792 3056 00864.exe 37 PID 3056 wrote to memory of 2792 3056 00864.exe 37 PID 2792 wrote to memory of 2648 2792 u222404.exe 38 PID 2792 wrote to memory of 2648 2792 u222404.exe 38 PID 2792 wrote to memory of 2648 2792 u222404.exe 38 PID 2792 wrote to memory of 2648 2792 u222404.exe 38 PID 2648 wrote to memory of 3068 2648 00846.exe 39 PID 2648 wrote to memory of 3068 2648 00846.exe 39 PID 2648 wrote to memory of 3068 2648 00846.exe 39 PID 2648 wrote to memory of 3068 2648 00846.exe 39 PID 3068 wrote to memory of 2540 3068 pvdjv.exe 40 PID 3068 wrote to memory of 2540 3068 pvdjv.exe 40 PID 3068 wrote to memory of 2540 3068 pvdjv.exe 40 PID 3068 wrote to memory of 2540 3068 pvdjv.exe 40 PID 2540 wrote to memory of 1504 2540 o480420.exe 41 PID 2540 wrote to memory of 1504 2540 o480420.exe 41 PID 2540 wrote to memory of 1504 2540 o480420.exe 41 PID 2540 wrote to memory of 1504 2540 o480420.exe 41 PID 1504 wrote to memory of 876 1504 2044062.exe 42 PID 1504 wrote to memory of 876 1504 2044062.exe 42 PID 1504 wrote to memory of 876 1504 2044062.exe 42 PID 1504 wrote to memory of 876 1504 2044062.exe 42 PID 876 wrote to memory of 1812 876 9lxxfrl.exe 43 PID 876 wrote to memory of 1812 876 9lxxfrl.exe 43 PID 876 wrote to memory of 1812 876 9lxxfrl.exe 43 PID 876 wrote to memory of 1812 876 9lxxfrl.exe 43 PID 1812 wrote to memory of 1996 1812 nnnttt.exe 44 PID 1812 wrote to memory of 1996 1812 nnnttt.exe 44 PID 1812 wrote to memory of 1996 1812 nnnttt.exe 44 PID 1812 wrote to memory of 1996 1812 nnnttt.exe 44 PID 1996 wrote to memory of 1304 1996 dpjjv.exe 45 PID 1996 wrote to memory of 1304 1996 dpjjv.exe 45 PID 1996 wrote to memory of 1304 1996 dpjjv.exe 45 PID 1996 wrote to memory of 1304 1996 dpjjv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe"C:\Users\Admin\AppData\Local\Temp\f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\i422824.exec:\i422824.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\lxlffxx.exec:\lxlffxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\bhbbth.exec:\bhbbth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\4688682.exec:\4688682.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\3lxlxxf.exec:\3lxlxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\08240.exec:\08240.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\00864.exec:\00864.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\u222404.exec:\u222404.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\00846.exec:\00846.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\pvdjv.exec:\pvdjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\o480420.exec:\o480420.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\2044062.exec:\2044062.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\9lxxfrl.exec:\9lxxfrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\nnnttt.exec:\nnnttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\dpjjv.exec:\dpjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\688864.exec:\688864.exe17⤵
- Executes dropped EXE
PID:1304 -
\??\c:\482244.exec:\482244.exe18⤵
- Executes dropped EXE
PID:2944 -
\??\c:\ffxlflx.exec:\ffxlflx.exe19⤵
- Executes dropped EXE
PID:2716 -
\??\c:\1fxlxfx.exec:\1fxlxfx.exe20⤵
- Executes dropped EXE
PID:2292 -
\??\c:\pjvjv.exec:\pjvjv.exe21⤵
- Executes dropped EXE
PID:2312 -
\??\c:\w00446.exec:\w00446.exe22⤵
- Executes dropped EXE
PID:3016 -
\??\c:\004624.exec:\004624.exe23⤵
- Executes dropped EXE
PID:408 -
\??\c:\2644684.exec:\2644684.exe24⤵
- Executes dropped EXE
PID:1800 -
\??\c:\20024.exec:\20024.exe25⤵
- Executes dropped EXE
PID:1816 -
\??\c:\288660.exec:\288660.exe26⤵
- Executes dropped EXE
PID:1388 -
\??\c:\e60646.exec:\e60646.exe27⤵
- Executes dropped EXE
PID:1824 -
\??\c:\7nhhhn.exec:\7nhhhn.exe28⤵
- Executes dropped EXE
PID:1592 -
\??\c:\nbtbtb.exec:\nbtbtb.exe29⤵
- Executes dropped EXE
PID:1912 -
\??\c:\820240.exec:\820240.exe30⤵
- Executes dropped EXE
PID:2020 -
\??\c:\vvdpd.exec:\vvdpd.exe31⤵
- Executes dropped EXE
PID:1976 -
\??\c:\4202248.exec:\4202248.exe32⤵
- Executes dropped EXE
PID:1724 -
\??\c:\htnbnt.exec:\htnbnt.exe33⤵
- Executes dropped EXE
PID:2992 -
\??\c:\k46084.exec:\k46084.exe34⤵
- Executes dropped EXE
PID:2376 -
\??\c:\9vdvp.exec:\9vdvp.exe35⤵
- Executes dropped EXE
PID:1576 -
\??\c:\m4246.exec:\m4246.exe36⤵
- Executes dropped EXE
PID:2976 -
\??\c:\pppdp.exec:\pppdp.exe37⤵
- Executes dropped EXE
PID:2016 -
\??\c:\xrllflx.exec:\xrllflx.exe38⤵
- Executes dropped EXE
PID:320 -
\??\c:\9bbbht.exec:\9bbbht.exe39⤵
- Executes dropped EXE
PID:2160 -
\??\c:\88828.exec:\88828.exe40⤵
- Executes dropped EXE
PID:2756 -
\??\c:\ddpjv.exec:\ddpjv.exe41⤵
- Executes dropped EXE
PID:2828 -
\??\c:\3btnhn.exec:\3btnhn.exe42⤵
- Executes dropped EXE
PID:2928 -
\??\c:\66644.exec:\66644.exe43⤵
- Executes dropped EXE
PID:2884 -
\??\c:\tnnntt.exec:\tnnntt.exe44⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rrlrllr.exec:\rrlrllr.exe45⤵
- Executes dropped EXE
PID:2672 -
\??\c:\26842.exec:\26842.exe46⤵
- Executes dropped EXE
PID:2248 -
\??\c:\6266260.exec:\6266260.exe47⤵
- Executes dropped EXE
PID:2796 -
\??\c:\620240.exec:\620240.exe48⤵
- Executes dropped EXE
PID:1804 -
\??\c:\66644.exec:\66644.exe49⤵
- Executes dropped EXE
PID:2916 -
\??\c:\8208284.exec:\8208284.exe50⤵
- Executes dropped EXE
PID:2688 -
\??\c:\22080.exec:\22080.exe51⤵
- Executes dropped EXE
PID:876 -
\??\c:\8864680.exec:\8864680.exe52⤵
- Executes dropped EXE
PID:996 -
\??\c:\448688.exec:\448688.exe53⤵
- Executes dropped EXE
PID:1848 -
\??\c:\a0486.exec:\a0486.exe54⤵
- Executes dropped EXE
PID:2728 -
\??\c:\880080.exec:\880080.exe55⤵
- Executes dropped EXE
PID:2060 -
\??\c:\5thnnt.exec:\5thnnt.exe56⤵
- Executes dropped EXE
PID:2948 -
\??\c:\4408808.exec:\4408808.exe57⤵
- Executes dropped EXE
PID:2056 -
\??\c:\48202.exec:\48202.exe58⤵
- Executes dropped EXE
PID:2716 -
\??\c:\60862.exec:\60862.exe59⤵
- Executes dropped EXE
PID:2088 -
\??\c:\tnnthn.exec:\tnnthn.exe60⤵
- Executes dropped EXE
PID:1052 -
\??\c:\04808.exec:\04808.exe61⤵
- Executes dropped EXE
PID:2312 -
\??\c:\826684.exec:\826684.exe62⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nnthbn.exec:\nnthbn.exe63⤵
- Executes dropped EXE
PID:2812 -
\??\c:\hbnhnt.exec:\hbnhnt.exe64⤵
- Executes dropped EXE
PID:972 -
\??\c:\tbthbh.exec:\tbthbh.exe65⤵
- Executes dropped EXE
PID:2612 -
\??\c:\jdvjp.exec:\jdvjp.exe66⤵PID:1972
-
\??\c:\w66400.exec:\w66400.exe67⤵PID:1388
-
\??\c:\7fxxflr.exec:\7fxxflr.exe68⤵PID:1788
-
\??\c:\e40640.exec:\e40640.exe69⤵PID:112
-
\??\c:\vvpjv.exec:\vvpjv.exe70⤵PID:2508
-
\??\c:\826468.exec:\826468.exe71⤵PID:1564
-
\??\c:\1ffrxfx.exec:\1ffrxfx.exe72⤵PID:2472
-
\??\c:\lllfrlx.exec:\lllfrlx.exe73⤵PID:1528
-
\??\c:\264422.exec:\264422.exe74⤵PID:2156
-
\??\c:\xrlrxfx.exec:\xrlrxfx.exe75⤵PID:2432
-
\??\c:\1vppd.exec:\1vppd.exe76⤵PID:1268
-
\??\c:\482806.exec:\482806.exe77⤵PID:1456
-
\??\c:\048240.exec:\048240.exe78⤵PID:2536
-
\??\c:\ttnntn.exec:\ttnntn.exe79⤵PID:2500
-
\??\c:\86446.exec:\86446.exe80⤵PID:2016
-
\??\c:\rlflxxr.exec:\rlflxxr.exe81⤵
- System Location Discovery: System Language Discovery
PID:2360 -
\??\c:\ddvjp.exec:\ddvjp.exe82⤵PID:2832
-
\??\c:\hhtbnt.exec:\hhtbnt.exe83⤵PID:2160
-
\??\c:\6084804.exec:\6084804.exe84⤵PID:2164
-
\??\c:\dvvjp.exec:\dvvjp.exe85⤵PID:3000
-
\??\c:\pjdjp.exec:\pjdjp.exe86⤵PID:2896
-
\??\c:\ffxrxrx.exec:\ffxrxrx.exe87⤵PID:2884
-
\??\c:\6848440.exec:\6848440.exe88⤵PID:2704
-
\??\c:\fxrxrxf.exec:\fxrxrxf.exe89⤵PID:2632
-
\??\c:\48680.exec:\48680.exe90⤵
- System Location Discovery: System Language Discovery
PID:2680 -
\??\c:\00026.exec:\00026.exe91⤵PID:3068
-
\??\c:\4440860.exec:\4440860.exe92⤵PID:1500
-
\??\c:\202240.exec:\202240.exe93⤵PID:1480
-
\??\c:\686622.exec:\686622.exe94⤵PID:1240
-
\??\c:\rrxfxrl.exec:\rrxfxrl.exe95⤵PID:1656
-
\??\c:\tnhbht.exec:\tnhbht.exe96⤵PID:1104
-
\??\c:\220206.exec:\220206.exe97⤵PID:1596
-
\??\c:\68024.exec:\68024.exe98⤵PID:1848
-
\??\c:\68642.exec:\68642.exe99⤵PID:2956
-
\??\c:\g2664.exec:\g2664.exe100⤵PID:2456
-
\??\c:\448468.exec:\448468.exe101⤵PID:548
-
\??\c:\pvjvj.exec:\pvjvj.exe102⤵PID:2128
-
\??\c:\c028402.exec:\c028402.exe103⤵PID:1340
-
\??\c:\bbhnbn.exec:\bbhnbn.exe104⤵PID:2004
-
\??\c:\0468408.exec:\0468408.exe105⤵PID:2352
-
\??\c:\nnnbth.exec:\nnnbth.exe106⤵PID:2996
-
\??\c:\bhtbnb.exec:\bhtbnb.exe107⤵PID:408
-
\??\c:\xrllxfr.exec:\xrllxfr.exe108⤵PID:2812
-
\??\c:\262206.exec:\262206.exe109⤵PID:2504
-
\??\c:\220240.exec:\220240.exe110⤵PID:1348
-
\??\c:\vpjpj.exec:\vpjpj.exe111⤵PID:1036
-
\??\c:\6044228.exec:\6044228.exe112⤵PID:1388
-
\??\c:\060680.exec:\060680.exe113⤵PID:1788
-
\??\c:\frlxrfr.exec:\frlxrfr.exe114⤵PID:1584
-
\??\c:\jpppp.exec:\jpppp.exe115⤵PID:2508
-
\??\c:\04246.exec:\04246.exe116⤵PID:324
-
\??\c:\g2068.exec:\g2068.exe117⤵
- System Location Discovery: System Language Discovery
PID:1300 -
\??\c:\4460206.exec:\4460206.exe118⤵PID:276
-
\??\c:\608028.exec:\608028.exe119⤵PID:2156
-
\??\c:\0084286.exec:\0084286.exe120⤵PID:1720
-
\??\c:\xfxfrff.exec:\xfxfrff.exe121⤵PID:2072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-