Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 21:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f9c7ee941bec33f38aaab322f20f12dcf5530ebbd60d11d4741baeb327f4f29dN.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
120 seconds
General
-
Target
f9c7ee941bec33f38aaab322f20f12dcf5530ebbd60d11d4741baeb327f4f29dN.exe
-
Size
495KB
-
MD5
843be149f32c55ef88c4925783dedca0
-
SHA1
3dea64d371f6777705f47237681e2c0433ac9423
-
SHA256
f9c7ee941bec33f38aaab322f20f12dcf5530ebbd60d11d4741baeb327f4f29d
-
SHA512
63c3dc6b2cdccb148fe47ceaa0be48b59f9862795b6d8852d4d41a24cc19e1075facee0ff8276eaa644347ee64cb307cf4c1c5b8830535137206d8489876214a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2CfNnkymTwaJ3o8K31Os:q7Tc2NYHUrAwfMHNnpls48I1Os
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/2292-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-66-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2108-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-96-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2620-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-152-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1660-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-156-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1972-172-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1972-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1404-278-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3048-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-318-0x0000000077180000-0x000000007727A000-memory.dmp family_blackmoon behavioral1/memory/824-326-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2244-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-359-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/812-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-379-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1848-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-564-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1348-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-700-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2056-844-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1348-870-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-884-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1508-903-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1592-907-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2244-934-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2416-984-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2716-991-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-1017-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2444 4488062.exe 2432 pvvpv.exe 2248 608084.exe 2448 60842.exe 2416 ffxflrf.exe 2768 4484280.exe 2108 88626.exe 2872 264022.exe 2620 pdjjj.exe 2600 3ppdp.exe 2408 nthtnn.exe 2948 608028.exe 2388 g8484.exe 2224 m2062.exe 1784 jjvvj.exe 1660 26024.exe 2320 5lxxflx.exe 1972 fxrrxrx.exe 1908 2800664.exe 2728 w86248.exe 2040 208428.exe 2084 268062.exe 1504 hthhnh.exe 916 400486.exe 1172 3fxrxfl.exe 2724 2028068.exe 1640 dvpjd.exe 1648 fllrlxl.exe 1404 bhhhnn.exe 596 9bnttn.exe 2180 424462.exe 3048 dpjpv.exe 1196 00006.exe 1592 btthnt.exe 2024 nnhthh.exe 2244 lfflflr.exe 2260 6080824.exe 2248 vjddj.exe 2240 2640280.exe 812 q26206.exe 1244 7htbhh.exe 2636 26684.exe 2592 lfrfflr.exe 2612 pvdvj.exe 2716 4202628.exe 2752 lfrxrxr.exe 2428 tthbtt.exe 2540 nhbnbh.exe 1992 844664.exe 2504 648862.exe 1848 26484.exe 2476 8266266.exe 1068 2606846.exe 1368 6028068.exe 1964 vpvvd.exe 1300 82004.exe 1272 426240.exe 1608 866424.exe 2796 48684.exe 2780 nhbbtb.exe 2096 8820420.exe 2176 jpppv.exe 2076 8200002.exe 1596 jppjj.exe -
resource yara_rule behavioral1/memory/2292-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-318-0x0000000077180000-0x000000007727A000-memory.dmp upx behavioral1/memory/2244-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-700-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/740-831-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-863-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-870-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-877-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-921-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-991-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-1017-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 808606.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8200002.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m6446.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20446.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q44084.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w26800.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00404.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 820206.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u480280.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 226802.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 882028.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4820286.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nntnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2444 2292 f9c7ee941bec33f38aaab322f20f12dcf5530ebbd60d11d4741baeb327f4f29dN.exe 28 PID 2292 wrote to memory of 2444 2292 f9c7ee941bec33f38aaab322f20f12dcf5530ebbd60d11d4741baeb327f4f29dN.exe 28 PID 2292 wrote to memory of 2444 2292 f9c7ee941bec33f38aaab322f20f12dcf5530ebbd60d11d4741baeb327f4f29dN.exe 28 PID 2292 wrote to memory of 2444 2292 f9c7ee941bec33f38aaab322f20f12dcf5530ebbd60d11d4741baeb327f4f29dN.exe 28 PID 2444 wrote to memory of 2432 2444 4488062.exe 29 PID 2444 wrote to memory of 2432 2444 4488062.exe 29 PID 2444 wrote to memory of 2432 2444 4488062.exe 29 PID 2444 wrote to memory of 2432 2444 4488062.exe 29 PID 2432 wrote to memory of 2248 2432 pvvpv.exe 30 PID 2432 wrote to memory of 2248 2432 pvvpv.exe 30 PID 2432 wrote to memory of 2248 2432 pvvpv.exe 30 PID 2432 wrote to memory of 2248 2432 pvvpv.exe 30 PID 2248 wrote to memory of 2448 2248 608084.exe 31 PID 2248 wrote to memory of 2448 2248 608084.exe 31 PID 2248 wrote to memory of 2448 2248 608084.exe 31 PID 2248 wrote to memory of 2448 2248 608084.exe 31 PID 2448 wrote to memory of 2416 2448 60842.exe 32 PID 2448 wrote to memory of 2416 2448 60842.exe 32 PID 2448 wrote to memory of 2416 2448 60842.exe 32 PID 2448 wrote to memory of 2416 2448 60842.exe 32 PID 2416 wrote to memory of 2768 2416 ffxflrf.exe 33 PID 2416 wrote to memory of 2768 2416 ffxflrf.exe 33 PID 2416 wrote to memory of 2768 2416 ffxflrf.exe 33 PID 2416 wrote to memory of 2768 2416 ffxflrf.exe 33 PID 2768 wrote to memory of 2108 2768 4484280.exe 34 PID 2768 wrote to memory of 2108 2768 4484280.exe 34 PID 2768 wrote to memory of 2108 2768 4484280.exe 34 PID 2768 wrote to memory of 2108 2768 4484280.exe 34 PID 2108 wrote to memory of 2872 2108 88626.exe 35 PID 2108 wrote to memory of 2872 2108 88626.exe 35 PID 2108 wrote to memory of 2872 2108 88626.exe 35 PID 2108 wrote to memory of 2872 2108 88626.exe 35 PID 2872 wrote to memory of 2620 2872 264022.exe 36 PID 2872 wrote to memory of 2620 2872 264022.exe 36 PID 2872 wrote to memory of 2620 2872 264022.exe 36 PID 2872 wrote to memory of 2620 2872 264022.exe 36 PID 2620 wrote to memory of 2600 2620 pdjjj.exe 37 PID 2620 wrote to memory of 2600 2620 pdjjj.exe 37 PID 2620 wrote to memory of 2600 2620 pdjjj.exe 37 PID 2620 wrote to memory of 2600 2620 pdjjj.exe 37 PID 2600 wrote to memory of 2408 2600 3ppdp.exe 38 PID 2600 wrote to memory of 2408 2600 3ppdp.exe 38 PID 2600 wrote to memory of 2408 2600 3ppdp.exe 38 PID 2600 wrote to memory of 2408 2600 3ppdp.exe 38 PID 2408 wrote to memory of 2948 2408 nthtnn.exe 39 PID 2408 wrote to memory of 2948 2408 nthtnn.exe 39 PID 2408 wrote to memory of 2948 2408 nthtnn.exe 39 PID 2408 wrote to memory of 2948 2408 nthtnn.exe 39 PID 2948 wrote to memory of 2388 2948 608028.exe 40 PID 2948 wrote to memory of 2388 2948 608028.exe 40 PID 2948 wrote to memory of 2388 2948 608028.exe 40 PID 2948 wrote to memory of 2388 2948 608028.exe 40 PID 2388 wrote to memory of 2224 2388 g8484.exe 41 PID 2388 wrote to memory of 2224 2388 g8484.exe 41 PID 2388 wrote to memory of 2224 2388 g8484.exe 41 PID 2388 wrote to memory of 2224 2388 g8484.exe 41 PID 2224 wrote to memory of 1784 2224 m2062.exe 42 PID 2224 wrote to memory of 1784 2224 m2062.exe 42 PID 2224 wrote to memory of 1784 2224 m2062.exe 42 PID 2224 wrote to memory of 1784 2224 m2062.exe 42 PID 1784 wrote to memory of 1660 1784 jjvvj.exe 43 PID 1784 wrote to memory of 1660 1784 jjvvj.exe 43 PID 1784 wrote to memory of 1660 1784 jjvvj.exe 43 PID 1784 wrote to memory of 1660 1784 jjvvj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9c7ee941bec33f38aaab322f20f12dcf5530ebbd60d11d4741baeb327f4f29dN.exe"C:\Users\Admin\AppData\Local\Temp\f9c7ee941bec33f38aaab322f20f12dcf5530ebbd60d11d4741baeb327f4f29dN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\4488062.exec:\4488062.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\pvvpv.exec:\pvvpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\608084.exec:\608084.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\60842.exec:\60842.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\ffxflrf.exec:\ffxflrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\4484280.exec:\4484280.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\88626.exec:\88626.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\264022.exec:\264022.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\pdjjj.exec:\pdjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\3ppdp.exec:\3ppdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\nthtnn.exec:\nthtnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\608028.exec:\608028.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\g8484.exec:\g8484.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\m2062.exec:\m2062.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\jjvvj.exec:\jjvvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\26024.exec:\26024.exe17⤵
- Executes dropped EXE
PID:1660 -
\??\c:\5lxxflx.exec:\5lxxflx.exe18⤵
- Executes dropped EXE
PID:2320 -
\??\c:\fxrrxrx.exec:\fxrrxrx.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1972 -
\??\c:\2800664.exec:\2800664.exe20⤵
- Executes dropped EXE
PID:1908 -
\??\c:\w86248.exec:\w86248.exe21⤵
- Executes dropped EXE
PID:2728 -
\??\c:\208428.exec:\208428.exe22⤵
- Executes dropped EXE
PID:2040 -
\??\c:\268062.exec:\268062.exe23⤵
- Executes dropped EXE
PID:2084 -
\??\c:\hthhnh.exec:\hthhnh.exe24⤵
- Executes dropped EXE
PID:1504 -
\??\c:\400486.exec:\400486.exe25⤵
- Executes dropped EXE
PID:916 -
\??\c:\3fxrxfl.exec:\3fxrxfl.exe26⤵
- Executes dropped EXE
PID:1172 -
\??\c:\2028068.exec:\2028068.exe27⤵
- Executes dropped EXE
PID:2724 -
\??\c:\dvpjd.exec:\dvpjd.exe28⤵
- Executes dropped EXE
PID:1640 -
\??\c:\fllrlxl.exec:\fllrlxl.exe29⤵
- Executes dropped EXE
PID:1648 -
\??\c:\bhhhnn.exec:\bhhhnn.exe30⤵
- Executes dropped EXE
PID:1404 -
\??\c:\9bnttn.exec:\9bnttn.exe31⤵
- Executes dropped EXE
PID:596 -
\??\c:\424462.exec:\424462.exe32⤵
- Executes dropped EXE
PID:2180 -
\??\c:\dpjpv.exec:\dpjpv.exe33⤵
- Executes dropped EXE
PID:3048 -
\??\c:\00006.exec:\00006.exe34⤵
- Executes dropped EXE
PID:1196 -
\??\c:\btthnt.exec:\btthnt.exe35⤵
- Executes dropped EXE
PID:1592 -
\??\c:\e42468.exec:\e42468.exe36⤵PID:824
-
\??\c:\nnhthh.exec:\nnhthh.exe37⤵
- Executes dropped EXE
PID:2024 -
\??\c:\lfflflr.exec:\lfflflr.exe38⤵
- Executes dropped EXE
PID:2244 -
\??\c:\6080824.exec:\6080824.exe39⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vjddj.exec:\vjddj.exe40⤵
- Executes dropped EXE
PID:2248 -
\??\c:\2640280.exec:\2640280.exe41⤵
- Executes dropped EXE
PID:2240 -
\??\c:\q26206.exec:\q26206.exe42⤵
- Executes dropped EXE
PID:812 -
\??\c:\7htbhh.exec:\7htbhh.exe43⤵
- Executes dropped EXE
PID:1244 -
\??\c:\26684.exec:\26684.exe44⤵
- Executes dropped EXE
PID:2636 -
\??\c:\lfrfflr.exec:\lfrfflr.exe45⤵
- Executes dropped EXE
PID:2592 -
\??\c:\pvdvj.exec:\pvdvj.exe46⤵
- Executes dropped EXE
PID:2612 -
\??\c:\4202628.exec:\4202628.exe47⤵
- Executes dropped EXE
PID:2716 -
\??\c:\lfrxrxr.exec:\lfrxrxr.exe48⤵
- Executes dropped EXE
PID:2752 -
\??\c:\tthbtt.exec:\tthbtt.exe49⤵
- Executes dropped EXE
PID:2428 -
\??\c:\nhbnbh.exec:\nhbnbh.exe50⤵
- Executes dropped EXE
PID:2540 -
\??\c:\844664.exec:\844664.exe51⤵
- Executes dropped EXE
PID:1992 -
\??\c:\648862.exec:\648862.exe52⤵
- Executes dropped EXE
PID:2504 -
\??\c:\26484.exec:\26484.exe53⤵
- Executes dropped EXE
PID:1848 -
\??\c:\8266266.exec:\8266266.exe54⤵
- Executes dropped EXE
PID:2476 -
\??\c:\2606846.exec:\2606846.exe55⤵
- Executes dropped EXE
PID:1068 -
\??\c:\6028068.exec:\6028068.exe56⤵
- Executes dropped EXE
PID:1368 -
\??\c:\vpvvd.exec:\vpvvd.exe57⤵
- Executes dropped EXE
PID:1964 -
\??\c:\82004.exec:\82004.exe58⤵
- Executes dropped EXE
PID:1300 -
\??\c:\426240.exec:\426240.exe59⤵
- Executes dropped EXE
PID:1272 -
\??\c:\866424.exec:\866424.exe60⤵
- Executes dropped EXE
PID:1608 -
\??\c:\48684.exec:\48684.exe61⤵
- Executes dropped EXE
PID:2796 -
\??\c:\nhbbtb.exec:\nhbbtb.exe62⤵
- Executes dropped EXE
PID:2780 -
\??\c:\8820420.exec:\8820420.exe63⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jpppv.exec:\jpppv.exe64⤵
- Executes dropped EXE
PID:2176 -
\??\c:\8200002.exec:\8200002.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2076 -
\??\c:\jppjj.exec:\jppjj.exe66⤵
- Executes dropped EXE
PID:1596 -
\??\c:\vvdjp.exec:\vvdjp.exe67⤵PID:1536
-
\??\c:\008840.exec:\008840.exe68⤵PID:2344
-
\??\c:\840820.exec:\840820.exe69⤵PID:2840
-
\??\c:\7rxrrrx.exec:\7rxrrrx.exe70⤵PID:1668
-
\??\c:\pjdpv.exec:\pjdpv.exe71⤵PID:1520
-
\??\c:\0862488.exec:\0862488.exe72⤵PID:1160
-
\??\c:\8200846.exec:\8200846.exe73⤵PID:1492
-
\??\c:\0806268.exec:\0806268.exe74⤵PID:1348
-
\??\c:\nbnthn.exec:\nbnthn.exe75⤵PID:2104
-
\??\c:\hhbnhn.exec:\hhbnhn.exe76⤵PID:2124
-
\??\c:\c480242.exec:\c480242.exe77⤵PID:2164
-
\??\c:\pdpvp.exec:\pdpvp.exe78⤵PID:1480
-
\??\c:\pvjpv.exec:\pvjpv.exe79⤵PID:1136
-
\??\c:\a8006.exec:\a8006.exe80⤵PID:2924
-
\??\c:\82046.exec:\82046.exe81⤵PID:876
-
\??\c:\bbthth.exec:\bbthth.exe82⤵PID:1724
-
\??\c:\5rrfrlx.exec:\5rrfrlx.exe83⤵PID:2444
-
\??\c:\lllxrxx.exec:\lllxrxx.exe84⤵PID:1808
-
\??\c:\048422.exec:\048422.exe85⤵PID:2572
-
\??\c:\nbthhn.exec:\nbthhn.exe86⤵PID:2232
-
\??\c:\frlfxff.exec:\frlfxff.exe87⤵PID:852
-
\??\c:\jddjv.exec:\jddjv.exe88⤵PID:2852
-
\??\c:\bbthtb.exec:\bbthtb.exe89⤵PID:2668
-
\??\c:\btnntt.exec:\btnntt.exe90⤵PID:2688
-
\??\c:\vjdvj.exec:\vjdvj.exe91⤵PID:2632
-
\??\c:\rlffflx.exec:\rlffflx.exe92⤵PID:2696
-
\??\c:\s4808.exec:\s4808.exe93⤵PID:2800
-
\??\c:\64086.exec:\64086.exe94⤵PID:2672
-
\??\c:\pjpvj.exec:\pjpvj.exe95⤵PID:2772
-
\??\c:\dvvdj.exec:\dvvdj.exe96⤵PID:2508
-
\??\c:\5djjd.exec:\5djjd.exe97⤵PID:2540
-
\??\c:\2088006.exec:\2088006.exe98⤵PID:2944
-
\??\c:\8268242.exec:\8268242.exe99⤵PID:2504
-
\??\c:\08440.exec:\08440.exe100⤵PID:1696
-
\??\c:\vjjvp.exec:\vjjvp.exe101⤵PID:1380
-
\??\c:\48666.exec:\48666.exe102⤵PID:1184
-
\??\c:\882248.exec:\882248.exe103⤵PID:2032
-
\??\c:\u082840.exec:\u082840.exe104⤵PID:1944
-
\??\c:\486288.exec:\486288.exe105⤵PID:1948
-
\??\c:\vpdvd.exec:\vpdvd.exe106⤵PID:1972
-
\??\c:\9lxfllx.exec:\9lxfllx.exe107⤵PID:1912
-
\??\c:\g6402.exec:\g6402.exe108⤵PID:1916
-
\??\c:\86888.exec:\86888.exe109⤵PID:2804
-
\??\c:\406664.exec:\406664.exe110⤵PID:2160
-
\??\c:\48242.exec:\48242.exe111⤵PID:2576
-
\??\c:\6848068.exec:\6848068.exe112⤵PID:1080
-
\??\c:\024608.exec:\024608.exe113⤵PID:340
-
\??\c:\24802.exec:\24802.exe114⤵PID:2056
-
\??\c:\q86660.exec:\q86660.exe115⤵PID:956
-
\??\c:\20668.exec:\20668.exe116⤵PID:740
-
\??\c:\k04240.exec:\k04240.exe117⤵PID:844
-
\??\c:\c266280.exec:\c266280.exe118⤵PID:2080
-
\??\c:\bbtbnb.exec:\bbtbnb.exe119⤵PID:1640
-
\??\c:\4820868.exec:\4820868.exe120⤵PID:1616
-
\??\c:\e68428.exec:\e68428.exe121⤵PID:1648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-