Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 04:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fb6dd5a6e953e85501e4650956fc6b61bf0c0d95f4d5c3421a248d0631544c76.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
150 seconds
General
-
Target
fb6dd5a6e953e85501e4650956fc6b61bf0c0d95f4d5c3421a248d0631544c76.exe
-
Size
453KB
-
MD5
7cdad160b1451e26a37a9b4282022c4a
-
SHA1
0382b1fdf59df4875c22f19633db94b338848b9b
-
SHA256
fb6dd5a6e953e85501e4650956fc6b61bf0c0d95f4d5c3421a248d0631544c76
-
SHA512
d848807da1f8cb50125be62849a19409f4871d14237f2b8c60e22ace601b8d89e819524423ed306b18692dc762596d764197fa5bbec1a00b67e00f4f71eecf12
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2592-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-48-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2548-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/468-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/752-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-343-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2904-342-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2796-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/388-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-449-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1372-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-484-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/288-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/744-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-654-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1484-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-726-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-746-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2248-765-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1580-863-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2792-883-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1124-1029-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1124-1028-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/748-1062-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/748-1063-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2444-1225-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1544 1hbbbt.exe 1752 dvddp.exe 1420 24046.exe 2008 q42222.exe 2548 rfrrfxx.exe 2888 60840.exe 2788 rfrrllr.exe 2892 2088006.exe 2688 i244628.exe 2880 e64028.exe 2736 28068.exe 2492 20228.exe 1128 64808.exe 2972 ppdjp.exe 752 3vdvv.exe 1424 fxllrlr.exe 1028 tnhntn.exe 1608 862224.exe 468 btntbh.exe 3028 jvvdj.exe 2244 8688844.exe 2760 60222.exe 1664 5djdv.exe 648 2628828.exe 2600 bnbttn.exe 1684 20882.exe 1792 tnbnnn.exe 1872 k46804.exe 2540 026622.exe 684 5ffflll.exe 884 bthhnn.exe 2112 i026888.exe 2636 lfrlxff.exe 2576 nnhthh.exe 1744 2044444.exe 2384 8644884.exe 1992 820000.exe 1692 3xflllr.exe 2772 tttnbb.exe 2756 o204062.exe 2904 nbbhhh.exe 2796 20006.exe 2128 vjppp.exe 2800 vvddv.exe 2680 rfxxfxl.exe 2872 dppjj.exe 2832 rlxrlrr.exe 2932 1djdd.exe 844 pdddp.exe 388 dpjdd.exe 1660 htnnbb.exe 2968 0204000.exe 1656 jddvp.exe 1028 6444488.exe 1988 tnbthh.exe 2116 24224.exe 3044 9tnhhh.exe 2532 k42228.exe 2632 jvvjp.exe 1372 c262400.exe 1940 424884.exe 1072 82006.exe 832 tnttbt.exe 2924 xlxrxrx.exe -
resource yara_rule behavioral1/memory/2592-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/468-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/388-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/744-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-654-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1484-680-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1484-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-733-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-768-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3000-964-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-983-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-990-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1800-1037-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/748-1062-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1420-1100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-1162-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2352-1213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-1241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-1281-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82068.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20280.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2662024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g6446.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 860622.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a4224.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2592 wrote to memory of 1544 2592 fb6dd5a6e953e85501e4650956fc6b61bf0c0d95f4d5c3421a248d0631544c76.exe 30 PID 2592 wrote to memory of 1544 2592 fb6dd5a6e953e85501e4650956fc6b61bf0c0d95f4d5c3421a248d0631544c76.exe 30 PID 2592 wrote to memory of 1544 2592 fb6dd5a6e953e85501e4650956fc6b61bf0c0d95f4d5c3421a248d0631544c76.exe 30 PID 2592 wrote to memory of 1544 2592 fb6dd5a6e953e85501e4650956fc6b61bf0c0d95f4d5c3421a248d0631544c76.exe 30 PID 1544 wrote to memory of 1752 1544 1hbbbt.exe 31 PID 1544 wrote to memory of 1752 1544 1hbbbt.exe 31 PID 1544 wrote to memory of 1752 1544 1hbbbt.exe 31 PID 1544 wrote to memory of 1752 1544 1hbbbt.exe 31 PID 1752 wrote to memory of 1420 1752 dvddp.exe 32 PID 1752 wrote to memory of 1420 1752 dvddp.exe 32 PID 1752 wrote to memory of 1420 1752 dvddp.exe 32 PID 1752 wrote to memory of 1420 1752 dvddp.exe 32 PID 1420 wrote to memory of 2008 1420 24046.exe 33 PID 1420 wrote to memory of 2008 1420 24046.exe 33 PID 1420 wrote to memory of 2008 1420 24046.exe 33 PID 1420 wrote to memory of 2008 1420 24046.exe 33 PID 2008 wrote to memory of 2548 2008 q42222.exe 34 PID 2008 wrote to memory of 2548 2008 q42222.exe 34 PID 2008 wrote to memory of 2548 2008 q42222.exe 34 PID 2008 wrote to memory of 2548 2008 q42222.exe 34 PID 2548 wrote to memory of 2888 2548 rfrrfxx.exe 35 PID 2548 wrote to memory of 2888 2548 rfrrfxx.exe 35 PID 2548 wrote to memory of 2888 2548 rfrrfxx.exe 35 PID 2548 wrote to memory of 2888 2548 rfrrfxx.exe 35 PID 2888 wrote to memory of 2788 2888 60840.exe 36 PID 2888 wrote to memory of 2788 2888 60840.exe 36 PID 2888 wrote to memory of 2788 2888 60840.exe 36 PID 2888 wrote to memory of 2788 2888 60840.exe 36 PID 2788 wrote to memory of 2892 2788 rfrrllr.exe 37 PID 2788 wrote to memory of 2892 2788 rfrrllr.exe 37 PID 2788 wrote to memory of 2892 2788 rfrrllr.exe 37 PID 2788 wrote to memory of 2892 2788 rfrrllr.exe 37 PID 2892 wrote to memory of 2688 2892 2088006.exe 38 PID 2892 wrote to memory of 2688 2892 2088006.exe 38 PID 2892 wrote to memory of 2688 2892 2088006.exe 38 PID 2892 wrote to memory of 2688 2892 2088006.exe 38 PID 2688 wrote to memory of 2880 2688 i244628.exe 39 PID 2688 wrote to memory of 2880 2688 i244628.exe 39 PID 2688 wrote to memory of 2880 2688 i244628.exe 39 PID 2688 wrote to memory of 2880 2688 i244628.exe 39 PID 2880 wrote to memory of 2736 2880 e64028.exe 40 PID 2880 wrote to memory of 2736 2880 e64028.exe 40 PID 2880 wrote to memory of 2736 2880 e64028.exe 40 PID 2880 wrote to memory of 2736 2880 e64028.exe 40 PID 2736 wrote to memory of 2492 2736 28068.exe 41 PID 2736 wrote to memory of 2492 2736 28068.exe 41 PID 2736 wrote to memory of 2492 2736 28068.exe 41 PID 2736 wrote to memory of 2492 2736 28068.exe 41 PID 2492 wrote to memory of 1128 2492 20228.exe 42 PID 2492 wrote to memory of 1128 2492 20228.exe 42 PID 2492 wrote to memory of 1128 2492 20228.exe 42 PID 2492 wrote to memory of 1128 2492 20228.exe 42 PID 1128 wrote to memory of 2972 1128 64808.exe 43 PID 1128 wrote to memory of 2972 1128 64808.exe 43 PID 1128 wrote to memory of 2972 1128 64808.exe 43 PID 1128 wrote to memory of 2972 1128 64808.exe 43 PID 2972 wrote to memory of 752 2972 ppdjp.exe 44 PID 2972 wrote to memory of 752 2972 ppdjp.exe 44 PID 2972 wrote to memory of 752 2972 ppdjp.exe 44 PID 2972 wrote to memory of 752 2972 ppdjp.exe 44 PID 752 wrote to memory of 1424 752 3vdvv.exe 45 PID 752 wrote to memory of 1424 752 3vdvv.exe 45 PID 752 wrote to memory of 1424 752 3vdvv.exe 45 PID 752 wrote to memory of 1424 752 3vdvv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb6dd5a6e953e85501e4650956fc6b61bf0c0d95f4d5c3421a248d0631544c76.exe"C:\Users\Admin\AppData\Local\Temp\fb6dd5a6e953e85501e4650956fc6b61bf0c0d95f4d5c3421a248d0631544c76.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\1hbbbt.exec:\1hbbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\dvddp.exec:\dvddp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\24046.exec:\24046.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\q42222.exec:\q42222.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\rfrrfxx.exec:\rfrrfxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\60840.exec:\60840.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\rfrrllr.exec:\rfrrllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\2088006.exec:\2088006.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\i244628.exec:\i244628.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\e64028.exec:\e64028.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\28068.exec:\28068.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\20228.exec:\20228.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\64808.exec:\64808.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\ppdjp.exec:\ppdjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\3vdvv.exec:\3vdvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\fxllrlr.exec:\fxllrlr.exe17⤵
- Executes dropped EXE
PID:1424 -
\??\c:\tnhntn.exec:\tnhntn.exe18⤵
- Executes dropped EXE
PID:1028 -
\??\c:\862224.exec:\862224.exe19⤵
- Executes dropped EXE
PID:1608 -
\??\c:\btntbh.exec:\btntbh.exe20⤵
- Executes dropped EXE
PID:468 -
\??\c:\jvvdj.exec:\jvvdj.exe21⤵
- Executes dropped EXE
PID:3028 -
\??\c:\8688844.exec:\8688844.exe22⤵
- Executes dropped EXE
PID:2244 -
\??\c:\60222.exec:\60222.exe23⤵
- Executes dropped EXE
PID:2760 -
\??\c:\5djdv.exec:\5djdv.exe24⤵
- Executes dropped EXE
PID:1664 -
\??\c:\2628828.exec:\2628828.exe25⤵
- Executes dropped EXE
PID:648 -
\??\c:\bnbttn.exec:\bnbttn.exe26⤵
- Executes dropped EXE
PID:2600 -
\??\c:\20882.exec:\20882.exe27⤵
- Executes dropped EXE
PID:1684 -
\??\c:\tnbnnn.exec:\tnbnnn.exe28⤵
- Executes dropped EXE
PID:1792 -
\??\c:\k46804.exec:\k46804.exe29⤵
- Executes dropped EXE
PID:1872 -
\??\c:\026622.exec:\026622.exe30⤵
- Executes dropped EXE
PID:2540 -
\??\c:\5ffflll.exec:\5ffflll.exe31⤵
- Executes dropped EXE
PID:684 -
\??\c:\bthhnn.exec:\bthhnn.exe32⤵
- Executes dropped EXE
PID:884 -
\??\c:\i026888.exec:\i026888.exe33⤵
- Executes dropped EXE
PID:2112 -
\??\c:\lfrlxff.exec:\lfrlxff.exe34⤵
- Executes dropped EXE
PID:2636 -
\??\c:\nnhthh.exec:\nnhthh.exe35⤵
- Executes dropped EXE
PID:2576 -
\??\c:\2044444.exec:\2044444.exe36⤵
- Executes dropped EXE
PID:1744 -
\??\c:\8644884.exec:\8644884.exe37⤵
- Executes dropped EXE
PID:2384 -
\??\c:\820000.exec:\820000.exe38⤵
- Executes dropped EXE
PID:1992 -
\??\c:\3xflllr.exec:\3xflllr.exe39⤵
- Executes dropped EXE
PID:1692 -
\??\c:\tttnbb.exec:\tttnbb.exe40⤵
- Executes dropped EXE
PID:2772 -
\??\c:\o204062.exec:\o204062.exe41⤵
- Executes dropped EXE
PID:2756 -
\??\c:\nbbhhh.exec:\nbbhhh.exe42⤵
- Executes dropped EXE
PID:2904 -
\??\c:\20006.exec:\20006.exe43⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vjppp.exec:\vjppp.exe44⤵
- Executes dropped EXE
PID:2128 -
\??\c:\vvddv.exec:\vvddv.exe45⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rfxxfxl.exec:\rfxxfxl.exe46⤵
- Executes dropped EXE
PID:2680 -
\??\c:\dppjj.exec:\dppjj.exe47⤵
- Executes dropped EXE
PID:2872 -
\??\c:\rlxrlrr.exec:\rlxrlrr.exe48⤵
- Executes dropped EXE
PID:2832 -
\??\c:\1djdd.exec:\1djdd.exe49⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pdddp.exec:\pdddp.exe50⤵
- Executes dropped EXE
PID:844 -
\??\c:\dpjdd.exec:\dpjdd.exe51⤵
- Executes dropped EXE
PID:388 -
\??\c:\htnnbb.exec:\htnnbb.exe52⤵
- Executes dropped EXE
PID:1660 -
\??\c:\0204000.exec:\0204000.exe53⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jddvp.exec:\jddvp.exe54⤵
- Executes dropped EXE
PID:1656 -
\??\c:\6444488.exec:\6444488.exe55⤵
- Executes dropped EXE
PID:1028 -
\??\c:\tnbthh.exec:\tnbthh.exe56⤵
- Executes dropped EXE
PID:1988 -
\??\c:\24224.exec:\24224.exe57⤵
- Executes dropped EXE
PID:2116 -
\??\c:\9tnhhh.exec:\9tnhhh.exe58⤵
- Executes dropped EXE
PID:3044 -
\??\c:\k42228.exec:\k42228.exe59⤵
- Executes dropped EXE
PID:2532 -
\??\c:\jvvjp.exec:\jvvjp.exe60⤵
- Executes dropped EXE
PID:2632 -
\??\c:\c262400.exec:\c262400.exe61⤵
- Executes dropped EXE
PID:1372 -
\??\c:\424884.exec:\424884.exe62⤵
- Executes dropped EXE
PID:1940 -
\??\c:\82006.exec:\82006.exe63⤵
- Executes dropped EXE
PID:1072 -
\??\c:\tnttbt.exec:\tnttbt.exe64⤵
- Executes dropped EXE
PID:832 -
\??\c:\xlxrxrx.exec:\xlxrxrx.exe65⤵
- Executes dropped EXE
PID:2924 -
\??\c:\vpdjj.exec:\vpdjj.exe66⤵PID:744
-
\??\c:\88044.exec:\88044.exe67⤵PID:288
-
\??\c:\bthtbt.exec:\bthtbt.exe68⤵PID:2156
-
\??\c:\nhbtbt.exec:\nhbtbt.exe69⤵PID:2044
-
\??\c:\hhnnbh.exec:\hhnnbh.exe70⤵PID:1816
-
\??\c:\3xfrxxf.exec:\3xfrxxf.exe71⤵PID:2456
-
\??\c:\6088606.exec:\6088606.exe72⤵PID:1292
-
\??\c:\llfrxfx.exec:\llfrxfx.exe73⤵PID:1176
-
\??\c:\486622.exec:\486622.exe74⤵PID:1748
-
\??\c:\u088002.exec:\u088002.exe75⤵PID:2340
-
\??\c:\c028662.exec:\c028662.exe76⤵PID:2060
-
\??\c:\46800.exec:\46800.exe77⤵PID:2476
-
\??\c:\fxlxllr.exec:\fxlxllr.exe78⤵PID:1428
-
\??\c:\dvdjd.exec:\dvdjd.exe79⤵PID:2344
-
\??\c:\dddjp.exec:\dddjp.exe80⤵PID:2240
-
\??\c:\dvjpp.exec:\dvjpp.exe81⤵PID:2808
-
\??\c:\9htbbb.exec:\9htbbb.exe82⤵PID:2592
-
\??\c:\rrllxlr.exec:\rrllxlr.exe83⤵PID:2948
-
\??\c:\s0888.exec:\s0888.exe84⤵PID:336
-
\??\c:\o200288.exec:\o200288.exe85⤵PID:2780
-
\??\c:\k04422.exec:\k04422.exe86⤵PID:2816
-
\??\c:\864462.exec:\864462.exe87⤵PID:2776
-
\??\c:\hbtbhn.exec:\hbtbhn.exe88⤵PID:2720
-
\??\c:\26628.exec:\26628.exe89⤵PID:2736
-
\??\c:\608806.exec:\608806.exe90⤵PID:2508
-
\??\c:\rrlrxfr.exec:\rrlrxfr.exe91⤵PID:2960
-
\??\c:\ddvdj.exec:\ddvdj.exe92⤵PID:1340
-
\??\c:\66408.exec:\66408.exe93⤵PID:1484
-
\??\c:\o206288.exec:\o206288.exe94⤵PID:752
-
\??\c:\pvvjd.exec:\pvvjd.exe95⤵PID:1996
-
\??\c:\6624062.exec:\6624062.exe96⤵PID:1912
-
\??\c:\64620.exec:\64620.exe97⤵PID:1700
-
\??\c:\60406.exec:\60406.exe98⤵PID:1904
-
\??\c:\o040280.exec:\o040280.exe99⤵PID:2116
-
\??\c:\08040.exec:\08040.exe100⤵PID:3048
-
\??\c:\02288.exec:\02288.exe101⤵PID:2272
-
\??\c:\dvddd.exec:\dvddd.exe102⤵PID:1260
-
\??\c:\i820624.exec:\i820624.exe103⤵PID:2248
-
\??\c:\bbthnt.exec:\bbthnt.exe104⤵PID:1144
-
\??\c:\26064.exec:\26064.exe105⤵PID:648
-
\??\c:\9jjjv.exec:\9jjjv.exe106⤵PID:2208
-
\??\c:\rlflxxf.exec:\rlflxxf.exe107⤵PID:3052
-
\??\c:\480684.exec:\480684.exe108⤵PID:2648
-
\??\c:\04846.exec:\04846.exe109⤵PID:1872
-
\??\c:\s6884.exec:\s6884.exe110⤵PID:2376
-
\??\c:\btnthh.exec:\btnthh.exe111⤵PID:2156
-
\??\c:\3fxfrxl.exec:\3fxfrxl.exe112⤵PID:1948
-
\??\c:\2688628.exec:\2688628.exe113⤵PID:608
-
\??\c:\dpppv.exec:\dpppv.exe114⤵PID:2456
-
\??\c:\rrffflr.exec:\rrffflr.exe115⤵PID:1784
-
\??\c:\1jdjd.exec:\1jdjd.exe116⤵PID:2636
-
\??\c:\jdvdp.exec:\jdvdp.exe117⤵PID:2900
-
\??\c:\64668.exec:\64668.exe118⤵PID:2340
-
\??\c:\20840.exec:\20840.exe119⤵PID:1744
-
\??\c:\btbhbb.exec:\btbhbb.exe120⤵PID:1712
-
\??\c:\lfrrflr.exec:\lfrrflr.exe121⤵PID:1888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-