Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 21:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fa95cb213ee6a6b4fe84d6d371df142b6cf08f84cc9e178b4cfde83c59bc4163.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
120 seconds
General
-
Target
fa95cb213ee6a6b4fe84d6d371df142b6cf08f84cc9e178b4cfde83c59bc4163.exe
-
Size
453KB
-
MD5
f4d418ee444467f7b5a47c902e7ab49c
-
SHA1
61805c9cf3f2b3e5881314bc4bb08206fbdaf20e
-
SHA256
fa95cb213ee6a6b4fe84d6d371df142b6cf08f84cc9e178b4cfde83c59bc4163
-
SHA512
024ce7679d6f39b1db52d97e29593fd8bc1eb1637164e4268ea3394adb275ec3e773e1b6370aece55db89435c1488d6ce8d6afdf24ec6b0235e38e1daed3d310
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2364-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-45-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2780-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-44-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2920-60-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-118-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2028-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/340-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-189-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2276-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-358-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2844-361-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2984-372-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1752-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-434-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1928-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1336-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1452-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-569-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1996-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-654-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2808-666-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2044-686-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1168-700-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1940-714-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-752-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2588-1120-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/700-1334-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2144-1364-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2364 httnnn.exe 2596 04628.exe 2360 q42866.exe 2056 20280.exe 2780 9jvvd.exe 2920 c462402.exe 2828 1djjj.exe 3036 80228.exe 2988 rrlrflr.exe 2744 622406.exe 2752 8640628.exe 1648 o206448.exe 1588 vvvdp.exe 2028 08628.exe 1220 rrfrxxf.exe 1940 9jvjp.exe 1740 pjvvd.exe 340 04620.exe 3016 e62840.exe 2276 9vjjp.exe 2252 86888.exe 2124 5htntb.exe 1556 086244.exe 2656 bbnnbt.exe 2524 6400622.exe 1700 040226.exe 2464 s6822.exe 2488 5nhbbt.exe 564 1rfxxxr.exe 2564 pdjdd.exe 892 k02806.exe 2144 bhhhhb.exe 1608 864268.exe 1800 868840.exe 2052 4046482.exe 2356 rxrxlll.exe 2640 02406.exe 1488 6804040.exe 2056 w20644.exe 2948 860248.exe 2908 1nnbhh.exe 2940 2640602.exe 2844 3rxflrf.exe 2984 httbhn.exe 1752 jdppj.exe 2700 4206602.exe 2744 pddjv.exe 2064 jvpvd.exe 1340 tnnbht.exe 1944 48064.exe 1644 26222.exe 1524 i202068.exe 1216 hbtntt.exe 1784 m6802.exe 1928 bbnnbb.exe 1336 lfrxllf.exe 1452 w02266.exe 2788 1xrrllr.exe 2260 9hbtbb.exe 2276 vpjpp.exe 2456 jjvdj.exe 2208 4206668.exe 1380 0806840.exe 2300 7dpjp.exe -
resource yara_rule behavioral1/memory/2364-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/340-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-238-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1700-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-789-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-839-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-912-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-919-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-962-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-1170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-1341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-1364-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8206222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 086000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 086022.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g2446.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c866228.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u800666.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 606806.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8206406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c462402.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q24400.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 2364 2312 fa95cb213ee6a6b4fe84d6d371df142b6cf08f84cc9e178b4cfde83c59bc4163.exe 30 PID 2312 wrote to memory of 2364 2312 fa95cb213ee6a6b4fe84d6d371df142b6cf08f84cc9e178b4cfde83c59bc4163.exe 30 PID 2312 wrote to memory of 2364 2312 fa95cb213ee6a6b4fe84d6d371df142b6cf08f84cc9e178b4cfde83c59bc4163.exe 30 PID 2312 wrote to memory of 2364 2312 fa95cb213ee6a6b4fe84d6d371df142b6cf08f84cc9e178b4cfde83c59bc4163.exe 30 PID 2364 wrote to memory of 2596 2364 httnnn.exe 31 PID 2364 wrote to memory of 2596 2364 httnnn.exe 31 PID 2364 wrote to memory of 2596 2364 httnnn.exe 31 PID 2364 wrote to memory of 2596 2364 httnnn.exe 31 PID 2596 wrote to memory of 2360 2596 04628.exe 32 PID 2596 wrote to memory of 2360 2596 04628.exe 32 PID 2596 wrote to memory of 2360 2596 04628.exe 32 PID 2596 wrote to memory of 2360 2596 04628.exe 32 PID 2360 wrote to memory of 2056 2360 q42866.exe 33 PID 2360 wrote to memory of 2056 2360 q42866.exe 33 PID 2360 wrote to memory of 2056 2360 q42866.exe 33 PID 2360 wrote to memory of 2056 2360 q42866.exe 33 PID 2056 wrote to memory of 2780 2056 20280.exe 34 PID 2056 wrote to memory of 2780 2056 20280.exe 34 PID 2056 wrote to memory of 2780 2056 20280.exe 34 PID 2056 wrote to memory of 2780 2056 20280.exe 34 PID 2780 wrote to memory of 2920 2780 9jvvd.exe 35 PID 2780 wrote to memory of 2920 2780 9jvvd.exe 35 PID 2780 wrote to memory of 2920 2780 9jvvd.exe 35 PID 2780 wrote to memory of 2920 2780 9jvvd.exe 35 PID 2920 wrote to memory of 2828 2920 c462402.exe 36 PID 2920 wrote to memory of 2828 2920 c462402.exe 36 PID 2920 wrote to memory of 2828 2920 c462402.exe 36 PID 2920 wrote to memory of 2828 2920 c462402.exe 36 PID 2828 wrote to memory of 3036 2828 1djjj.exe 37 PID 2828 wrote to memory of 3036 2828 1djjj.exe 37 PID 2828 wrote to memory of 3036 2828 1djjj.exe 37 PID 2828 wrote to memory of 3036 2828 1djjj.exe 37 PID 3036 wrote to memory of 2988 3036 80228.exe 38 PID 3036 wrote to memory of 2988 3036 80228.exe 38 PID 3036 wrote to memory of 2988 3036 80228.exe 38 PID 3036 wrote to memory of 2988 3036 80228.exe 38 PID 2988 wrote to memory of 2744 2988 rrlrflr.exe 39 PID 2988 wrote to memory of 2744 2988 rrlrflr.exe 39 PID 2988 wrote to memory of 2744 2988 rrlrflr.exe 39 PID 2988 wrote to memory of 2744 2988 rrlrflr.exe 39 PID 2744 wrote to memory of 2752 2744 622406.exe 40 PID 2744 wrote to memory of 2752 2744 622406.exe 40 PID 2744 wrote to memory of 2752 2744 622406.exe 40 PID 2744 wrote to memory of 2752 2744 622406.exe 40 PID 2752 wrote to memory of 1648 2752 8640628.exe 41 PID 2752 wrote to memory of 1648 2752 8640628.exe 41 PID 2752 wrote to memory of 1648 2752 8640628.exe 41 PID 2752 wrote to memory of 1648 2752 8640628.exe 41 PID 1648 wrote to memory of 1588 1648 o206448.exe 42 PID 1648 wrote to memory of 1588 1648 o206448.exe 42 PID 1648 wrote to memory of 1588 1648 o206448.exe 42 PID 1648 wrote to memory of 1588 1648 o206448.exe 42 PID 1588 wrote to memory of 2028 1588 vvvdp.exe 43 PID 1588 wrote to memory of 2028 1588 vvvdp.exe 43 PID 1588 wrote to memory of 2028 1588 vvvdp.exe 43 PID 1588 wrote to memory of 2028 1588 vvvdp.exe 43 PID 2028 wrote to memory of 1220 2028 08628.exe 44 PID 2028 wrote to memory of 1220 2028 08628.exe 44 PID 2028 wrote to memory of 1220 2028 08628.exe 44 PID 2028 wrote to memory of 1220 2028 08628.exe 44 PID 1220 wrote to memory of 1940 1220 rrfrxxf.exe 45 PID 1220 wrote to memory of 1940 1220 rrfrxxf.exe 45 PID 1220 wrote to memory of 1940 1220 rrfrxxf.exe 45 PID 1220 wrote to memory of 1940 1220 rrfrxxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa95cb213ee6a6b4fe84d6d371df142b6cf08f84cc9e178b4cfde83c59bc4163.exe"C:\Users\Admin\AppData\Local\Temp\fa95cb213ee6a6b4fe84d6d371df142b6cf08f84cc9e178b4cfde83c59bc4163.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\httnnn.exec:\httnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\04628.exec:\04628.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\q42866.exec:\q42866.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\20280.exec:\20280.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\9jvvd.exec:\9jvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\c462402.exec:\c462402.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\1djjj.exec:\1djjj.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\80228.exec:\80228.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\rrlrflr.exec:\rrlrflr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\622406.exec:\622406.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\8640628.exec:\8640628.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\o206448.exec:\o206448.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\vvvdp.exec:\vvvdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\08628.exec:\08628.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\rrfrxxf.exec:\rrfrxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\9jvjp.exec:\9jvjp.exe17⤵
- Executes dropped EXE
PID:1940 -
\??\c:\pjvvd.exec:\pjvvd.exe18⤵
- Executes dropped EXE
PID:1740 -
\??\c:\04620.exec:\04620.exe19⤵
- Executes dropped EXE
PID:340 -
\??\c:\e62840.exec:\e62840.exe20⤵
- Executes dropped EXE
PID:3016 -
\??\c:\9vjjp.exec:\9vjjp.exe21⤵
- Executes dropped EXE
PID:2276 -
\??\c:\86888.exec:\86888.exe22⤵
- Executes dropped EXE
PID:2252 -
\??\c:\5htntb.exec:\5htntb.exe23⤵
- Executes dropped EXE
PID:2124 -
\??\c:\086244.exec:\086244.exe24⤵
- Executes dropped EXE
PID:1556 -
\??\c:\bbnnbt.exec:\bbnnbt.exe25⤵
- Executes dropped EXE
PID:2656 -
\??\c:\6400622.exec:\6400622.exe26⤵
- Executes dropped EXE
PID:2524 -
\??\c:\040226.exec:\040226.exe27⤵
- Executes dropped EXE
PID:1700 -
\??\c:\s6822.exec:\s6822.exe28⤵
- Executes dropped EXE
PID:2464 -
\??\c:\5nhbbt.exec:\5nhbbt.exe29⤵
- Executes dropped EXE
PID:2488 -
\??\c:\1rfxxxr.exec:\1rfxxxr.exe30⤵
- Executes dropped EXE
PID:564 -
\??\c:\pdjdd.exec:\pdjdd.exe31⤵
- Executes dropped EXE
PID:2564 -
\??\c:\k02806.exec:\k02806.exe32⤵
- Executes dropped EXE
PID:892 -
\??\c:\bhhhhb.exec:\bhhhhb.exe33⤵
- Executes dropped EXE
PID:2144 -
\??\c:\864268.exec:\864268.exe34⤵
- Executes dropped EXE
PID:1608 -
\??\c:\868840.exec:\868840.exe35⤵
- Executes dropped EXE
PID:1800 -
\??\c:\4046482.exec:\4046482.exe36⤵
- Executes dropped EXE
PID:2052 -
\??\c:\rxrxlll.exec:\rxrxlll.exe37⤵
- Executes dropped EXE
PID:2356 -
\??\c:\02406.exec:\02406.exe38⤵
- Executes dropped EXE
PID:2640 -
\??\c:\6804040.exec:\6804040.exe39⤵
- Executes dropped EXE
PID:1488 -
\??\c:\w20644.exec:\w20644.exe40⤵
- Executes dropped EXE
PID:2056 -
\??\c:\860248.exec:\860248.exe41⤵
- Executes dropped EXE
PID:2948 -
\??\c:\1nnbhh.exec:\1nnbhh.exe42⤵
- Executes dropped EXE
PID:2908 -
\??\c:\2640602.exec:\2640602.exe43⤵
- Executes dropped EXE
PID:2940 -
\??\c:\3rxflrf.exec:\3rxflrf.exe44⤵
- Executes dropped EXE
PID:2844 -
\??\c:\httbhn.exec:\httbhn.exe45⤵
- Executes dropped EXE
PID:2984 -
\??\c:\jdppj.exec:\jdppj.exe46⤵
- Executes dropped EXE
PID:1752 -
\??\c:\4206602.exec:\4206602.exe47⤵
- Executes dropped EXE
PID:2700 -
\??\c:\pddjv.exec:\pddjv.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2744 -
\??\c:\jvpvd.exec:\jvpvd.exe49⤵
- Executes dropped EXE
PID:2064 -
\??\c:\tnnbht.exec:\tnnbht.exe50⤵
- Executes dropped EXE
PID:1340 -
\??\c:\48064.exec:\48064.exe51⤵
- Executes dropped EXE
PID:1944 -
\??\c:\26222.exec:\26222.exe52⤵
- Executes dropped EXE
PID:1644 -
\??\c:\i202068.exec:\i202068.exe53⤵
- Executes dropped EXE
PID:1524 -
\??\c:\hbtntt.exec:\hbtntt.exe54⤵
- Executes dropped EXE
PID:1216 -
\??\c:\m6802.exec:\m6802.exe55⤵
- Executes dropped EXE
PID:1784 -
\??\c:\bbnnbb.exec:\bbnnbb.exe56⤵
- Executes dropped EXE
PID:1928 -
\??\c:\lfrxllf.exec:\lfrxllf.exe57⤵
- Executes dropped EXE
PID:1336 -
\??\c:\w02266.exec:\w02266.exe58⤵
- Executes dropped EXE
PID:1452 -
\??\c:\1xrrllr.exec:\1xrrllr.exe59⤵
- Executes dropped EXE
PID:2788 -
\??\c:\9hbtbb.exec:\9hbtbb.exe60⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vpjpp.exec:\vpjpp.exe61⤵
- Executes dropped EXE
PID:2276 -
\??\c:\jjvdj.exec:\jjvdj.exe62⤵
- Executes dropped EXE
PID:2456 -
\??\c:\4206668.exec:\4206668.exe63⤵
- Executes dropped EXE
PID:2208 -
\??\c:\0806840.exec:\0806840.exe64⤵
- Executes dropped EXE
PID:1380 -
\??\c:\7dpjp.exec:\7dpjp.exe65⤵
- Executes dropped EXE
PID:2300 -
\??\c:\5jjjp.exec:\5jjjp.exe66⤵PID:1680
-
\??\c:\dpvvv.exec:\dpvvv.exe67⤵PID:2524
-
\??\c:\20828.exec:\20828.exe68⤵PID:112
-
\??\c:\3bnhhb.exec:\3bnhhb.exe69⤵PID:1628
-
\??\c:\084888.exec:\084888.exe70⤵PID:1756
-
\??\c:\a8062.exec:\a8062.exe71⤵PID:2488
-
\??\c:\86666.exec:\86666.exe72⤵PID:564
-
\??\c:\tntntb.exec:\tntntb.exe73⤵
- System Location Discovery: System Language Discovery
PID:536 -
\??\c:\rlxxffl.exec:\rlxxffl.exe74⤵PID:1716
-
\??\c:\8626066.exec:\8626066.exe75⤵PID:1044
-
\??\c:\thbnbt.exec:\thbnbt.exe76⤵PID:2144
-
\??\c:\k08244.exec:\k08244.exe77⤵PID:2312
-
\??\c:\64628.exec:\64628.exe78⤵PID:1996
-
\??\c:\604400.exec:\604400.exe79⤵PID:2600
-
\??\c:\rrfxrff.exec:\rrfxrff.exe80⤵PID:2592
-
\??\c:\lxffxrx.exec:\lxffxrx.exe81⤵PID:2968
-
\??\c:\5vjjp.exec:\5vjjp.exe82⤵PID:2832
-
\??\c:\4806262.exec:\4806262.exe83⤵PID:2892
-
\??\c:\2066224.exec:\2066224.exe84⤵PID:2888
-
\??\c:\608804.exec:\608804.exe85⤵PID:2896
-
\??\c:\jdpvd.exec:\jdpvd.exe86⤵PID:2828
-
\??\c:\20846.exec:\20846.exe87⤵PID:2696
-
\??\c:\c422884.exec:\c422884.exe88⤵PID:2340
-
\??\c:\lxflrrr.exec:\lxflrrr.exe89⤵PID:2856
-
\??\c:\bhttbb.exec:\bhttbb.exe90⤵PID:2708
-
\??\c:\pdppd.exec:\pdppd.exe91⤵PID:2808
-
\??\c:\k26846.exec:\k26846.exe92⤵PID:2064
-
\??\c:\9xflxfl.exec:\9xflxfl.exe93⤵PID:2440
-
\??\c:\i240624.exec:\i240624.exe94⤵PID:2044
-
\??\c:\hbnthn.exec:\hbnthn.exe95⤵PID:2028
-
\??\c:\5bbhbt.exec:\5bbhbt.exe96⤵PID:1168
-
\??\c:\xlrxlrf.exec:\xlrxlrf.exe97⤵PID:1792
-
\??\c:\4840006.exec:\4840006.exe98⤵PID:1940
-
\??\c:\llrfxxl.exec:\llrfxxl.exe99⤵PID:2980
-
\??\c:\28628.exec:\28628.exe100⤵PID:2184
-
\??\c:\w20628.exec:\w20628.exe101⤵PID:2224
-
\??\c:\42002.exec:\42002.exe102⤵PID:2304
-
\??\c:\0426884.exec:\0426884.exe103⤵PID:2204
-
\??\c:\xlflrxf.exec:\xlflrxf.exe104⤵PID:1480
-
\??\c:\e04800.exec:\e04800.exe105⤵PID:968
-
\??\c:\3vppp.exec:\3vppp.exe106⤵PID:1028
-
\??\c:\640000.exec:\640000.exe107⤵PID:2316
-
\??\c:\086022.exec:\086022.exe108⤵
- System Location Discovery: System Language Discovery
PID:1148 -
\??\c:\hthnnh.exec:\hthnnh.exe109⤵PID:1540
-
\??\c:\3lxrrrx.exec:\3lxrrrx.exe110⤵PID:3052
-
\??\c:\xxrxllr.exec:\xxrxllr.exe111⤵PID:1068
-
\??\c:\tnnntn.exec:\tnnntn.exe112⤵PID:2552
-
\??\c:\42402.exec:\42402.exe113⤵PID:2216
-
\??\c:\604648.exec:\604648.exe114⤵PID:1252
-
\??\c:\20802.exec:\20802.exe115⤵PID:564
-
\??\c:\xxxfllr.exec:\xxxfllr.exe116⤵PID:2572
-
\??\c:\thhnbh.exec:\thhnbh.exe117⤵PID:1604
-
\??\c:\60662.exec:\60662.exe118⤵PID:1044
-
\??\c:\dvjdj.exec:\dvjdj.exe119⤵PID:2520
-
\??\c:\frlrxxl.exec:\frlrxxl.exe120⤵PID:2364
-
\??\c:\08662.exec:\08662.exe121⤵PID:2596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-