Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 04:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67N.exe
-
Size
455KB
-
MD5
c7f1f4b8ae83f4a1949435c9192845a0
-
SHA1
7fc551e6b21a57f222aa3f10d744ea20b0b9ebbf
-
SHA256
08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67
-
SHA512
0c22de0dac2048c13cd8f44f1c46f009a981b85c1ea34a55708be5e857a24679e8c1141c94c9cf5ae2d9142eea5e231d1c96dc83ddf5b5e2d164dd219799ca34
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR4:q7Tc2NYHUrAwfMp3CDR4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2464-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1412-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-131-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/564-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1324-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-396-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3060-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-505-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1732-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-642-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2224-663-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2224-664-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2292-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-686-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-970-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2108 20824.exe 2896 5frrrfl.exe 2744 864028.exe 2872 042462.exe 2720 202806.exe 2668 3ffxxxl.exe 2652 82228.exe 2428 1vjpv.exe 1728 fxflffx.exe 2036 206860.exe 1412 42068.exe 2804 fffrrfx.exe 2980 vvjjv.exe 564 dvjjp.exe 2424 42020.exe 1304 086240.exe 1868 u646408.exe 996 1tbbbn.exe 776 xrllrxf.exe 2044 26464.exe 1324 5dpdj.exe 1344 64220.exe 840 666888.exe 1996 m8660.exe 1984 dvpdp.exe 1712 3jvpv.exe 2376 1rrxllr.exe 2564 9xrrfrx.exe 1212 ddvpj.exe 544 2022440.exe 2480 1jvpv.exe 1056 htnhnn.exe 1564 1rlrrxf.exe 2924 w86684.exe 2204 7ntnhb.exe 2932 42444.exe 2780 tnhhnn.exe 2448 8062884.exe 2792 2066822.exe 2640 nhtbhn.exe 1068 jdvjp.exe 1824 5jdjp.exe 2416 3pvpj.exe 2092 7xllrrf.exe 1472 lxrxrfl.exe 2300 4800624.exe 1412 xrlffxf.exe 2852 ddpvp.exe 668 c644224.exe 2008 pdvvv.exe 3060 u862828.exe 760 0484842.exe 3052 080060.exe 2388 q00628.exe 2212 6804600.exe 2504 3nthth.exe 1928 tnbtnt.exe 2552 8800624.exe 864 648806.exe 844 5pdvd.exe 1524 0484064.exe 840 9rflllf.exe 1544 00846.exe 2216 82286.exe -
resource yara_rule behavioral1/memory/2464-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-131-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/564-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-663-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2292-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-772-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-779-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-874-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-881-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-888-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-919-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-932-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-957-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-970-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04268.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m8240.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c822020.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2606840.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 040028.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2400000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46822.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 208468.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4800846.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42002.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 882802.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60262.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88242.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2464 wrote to memory of 2108 2464 08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67N.exe 31 PID 2464 wrote to memory of 2108 2464 08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67N.exe 31 PID 2464 wrote to memory of 2108 2464 08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67N.exe 31 PID 2464 wrote to memory of 2108 2464 08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67N.exe 31 PID 2108 wrote to memory of 2896 2108 20824.exe 32 PID 2108 wrote to memory of 2896 2108 20824.exe 32 PID 2108 wrote to memory of 2896 2108 20824.exe 32 PID 2108 wrote to memory of 2896 2108 20824.exe 32 PID 2896 wrote to memory of 2744 2896 5frrrfl.exe 33 PID 2896 wrote to memory of 2744 2896 5frrrfl.exe 33 PID 2896 wrote to memory of 2744 2896 5frrrfl.exe 33 PID 2896 wrote to memory of 2744 2896 5frrrfl.exe 33 PID 2744 wrote to memory of 2872 2744 864028.exe 34 PID 2744 wrote to memory of 2872 2744 864028.exe 34 PID 2744 wrote to memory of 2872 2744 864028.exe 34 PID 2744 wrote to memory of 2872 2744 864028.exe 34 PID 2872 wrote to memory of 2720 2872 042462.exe 35 PID 2872 wrote to memory of 2720 2872 042462.exe 35 PID 2872 wrote to memory of 2720 2872 042462.exe 35 PID 2872 wrote to memory of 2720 2872 042462.exe 35 PID 2720 wrote to memory of 2668 2720 202806.exe 36 PID 2720 wrote to memory of 2668 2720 202806.exe 36 PID 2720 wrote to memory of 2668 2720 202806.exe 36 PID 2720 wrote to memory of 2668 2720 202806.exe 36 PID 2668 wrote to memory of 2652 2668 3ffxxxl.exe 37 PID 2668 wrote to memory of 2652 2668 3ffxxxl.exe 37 PID 2668 wrote to memory of 2652 2668 3ffxxxl.exe 37 PID 2668 wrote to memory of 2652 2668 3ffxxxl.exe 37 PID 2652 wrote to memory of 2428 2652 82228.exe 38 PID 2652 wrote to memory of 2428 2652 82228.exe 38 PID 2652 wrote to memory of 2428 2652 82228.exe 38 PID 2652 wrote to memory of 2428 2652 82228.exe 38 PID 2428 wrote to memory of 1728 2428 1vjpv.exe 39 PID 2428 wrote to memory of 1728 2428 1vjpv.exe 39 PID 2428 wrote to memory of 1728 2428 1vjpv.exe 39 PID 2428 wrote to memory of 1728 2428 1vjpv.exe 39 PID 1728 wrote to memory of 2036 1728 fxflffx.exe 40 PID 1728 wrote to memory of 2036 1728 fxflffx.exe 40 PID 1728 wrote to memory of 2036 1728 fxflffx.exe 40 PID 1728 wrote to memory of 2036 1728 fxflffx.exe 40 PID 2036 wrote to memory of 1412 2036 206860.exe 41 PID 2036 wrote to memory of 1412 2036 206860.exe 41 PID 2036 wrote to memory of 1412 2036 206860.exe 41 PID 2036 wrote to memory of 1412 2036 206860.exe 41 PID 1412 wrote to memory of 2804 1412 42068.exe 42 PID 1412 wrote to memory of 2804 1412 42068.exe 42 PID 1412 wrote to memory of 2804 1412 42068.exe 42 PID 1412 wrote to memory of 2804 1412 42068.exe 42 PID 2804 wrote to memory of 2980 2804 fffrrfx.exe 43 PID 2804 wrote to memory of 2980 2804 fffrrfx.exe 43 PID 2804 wrote to memory of 2980 2804 fffrrfx.exe 43 PID 2804 wrote to memory of 2980 2804 fffrrfx.exe 43 PID 2980 wrote to memory of 564 2980 vvjjv.exe 44 PID 2980 wrote to memory of 564 2980 vvjjv.exe 44 PID 2980 wrote to memory of 564 2980 vvjjv.exe 44 PID 2980 wrote to memory of 564 2980 vvjjv.exe 44 PID 564 wrote to memory of 2424 564 dvjjp.exe 45 PID 564 wrote to memory of 2424 564 dvjjp.exe 45 PID 564 wrote to memory of 2424 564 dvjjp.exe 45 PID 564 wrote to memory of 2424 564 dvjjp.exe 45 PID 2424 wrote to memory of 1304 2424 42020.exe 46 PID 2424 wrote to memory of 1304 2424 42020.exe 46 PID 2424 wrote to memory of 1304 2424 42020.exe 46 PID 2424 wrote to memory of 1304 2424 42020.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67N.exe"C:\Users\Admin\AppData\Local\Temp\08135e419a9611033b74b4cee56d374da783ae605dead077269a4e9465abbe67N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\20824.exec:\20824.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\5frrrfl.exec:\5frrrfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\864028.exec:\864028.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\042462.exec:\042462.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\202806.exec:\202806.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\3ffxxxl.exec:\3ffxxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\82228.exec:\82228.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\1vjpv.exec:\1vjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\fxflffx.exec:\fxflffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\206860.exec:\206860.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\42068.exec:\42068.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\fffrrfx.exec:\fffrrfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\vvjjv.exec:\vvjjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\dvjjp.exec:\dvjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\42020.exec:\42020.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\086240.exec:\086240.exe17⤵
- Executes dropped EXE
PID:1304 -
\??\c:\u646408.exec:\u646408.exe18⤵
- Executes dropped EXE
PID:1868 -
\??\c:\1tbbbn.exec:\1tbbbn.exe19⤵
- Executes dropped EXE
PID:996 -
\??\c:\xrllrxf.exec:\xrllrxf.exe20⤵
- Executes dropped EXE
PID:776 -
\??\c:\26464.exec:\26464.exe21⤵
- Executes dropped EXE
PID:2044 -
\??\c:\5dpdj.exec:\5dpdj.exe22⤵
- Executes dropped EXE
PID:1324 -
\??\c:\64220.exec:\64220.exe23⤵
- Executes dropped EXE
PID:1344 -
\??\c:\666888.exec:\666888.exe24⤵
- Executes dropped EXE
PID:840 -
\??\c:\m8660.exec:\m8660.exe25⤵
- Executes dropped EXE
PID:1996 -
\??\c:\dvpdp.exec:\dvpdp.exe26⤵
- Executes dropped EXE
PID:1984 -
\??\c:\3jvpv.exec:\3jvpv.exe27⤵
- Executes dropped EXE
PID:1712 -
\??\c:\1rrxllr.exec:\1rrxllr.exe28⤵
- Executes dropped EXE
PID:2376 -
\??\c:\9xrrfrx.exec:\9xrrfrx.exe29⤵
- Executes dropped EXE
PID:2564 -
\??\c:\ddvpj.exec:\ddvpj.exe30⤵
- Executes dropped EXE
PID:1212 -
\??\c:\2022440.exec:\2022440.exe31⤵
- Executes dropped EXE
PID:544 -
\??\c:\1jvpv.exec:\1jvpv.exe32⤵
- Executes dropped EXE
PID:2480 -
\??\c:\htnhnn.exec:\htnhnn.exe33⤵
- Executes dropped EXE
PID:1056 -
\??\c:\1rlrrxf.exec:\1rlrrxf.exe34⤵
- Executes dropped EXE
PID:1564 -
\??\c:\w86684.exec:\w86684.exe35⤵
- Executes dropped EXE
PID:2924 -
\??\c:\7ntnhb.exec:\7ntnhb.exe36⤵
- Executes dropped EXE
PID:2204 -
\??\c:\42444.exec:\42444.exe37⤵
- Executes dropped EXE
PID:2932 -
\??\c:\tnhhnn.exec:\tnhhnn.exe38⤵
- Executes dropped EXE
PID:2780 -
\??\c:\8062884.exec:\8062884.exe39⤵
- Executes dropped EXE
PID:2448 -
\??\c:\2066822.exec:\2066822.exe40⤵
- Executes dropped EXE
PID:2792 -
\??\c:\nhtbhn.exec:\nhtbhn.exe41⤵
- Executes dropped EXE
PID:2640 -
\??\c:\jdvjp.exec:\jdvjp.exe42⤵
- Executes dropped EXE
PID:1068 -
\??\c:\5jdjp.exec:\5jdjp.exe43⤵
- Executes dropped EXE
PID:1824 -
\??\c:\3pvpj.exec:\3pvpj.exe44⤵
- Executes dropped EXE
PID:2416 -
\??\c:\7xllrrf.exec:\7xllrrf.exe45⤵
- Executes dropped EXE
PID:2092 -
\??\c:\lxrxrfl.exec:\lxrxrfl.exe46⤵
- Executes dropped EXE
PID:1472 -
\??\c:\4800624.exec:\4800624.exe47⤵
- Executes dropped EXE
PID:2300 -
\??\c:\xrlffxf.exec:\xrlffxf.exe48⤵
- Executes dropped EXE
PID:1412 -
\??\c:\ddpvp.exec:\ddpvp.exe49⤵
- Executes dropped EXE
PID:2852 -
\??\c:\c644224.exec:\c644224.exe50⤵
- Executes dropped EXE
PID:668 -
\??\c:\pdvvv.exec:\pdvvv.exe51⤵
- Executes dropped EXE
PID:2008 -
\??\c:\u862828.exec:\u862828.exe52⤵
- Executes dropped EXE
PID:3060 -
\??\c:\0484842.exec:\0484842.exe53⤵
- Executes dropped EXE
PID:760 -
\??\c:\080060.exec:\080060.exe54⤵
- Executes dropped EXE
PID:3052 -
\??\c:\q00628.exec:\q00628.exe55⤵
- Executes dropped EXE
PID:2388 -
\??\c:\6804600.exec:\6804600.exe56⤵
- Executes dropped EXE
PID:2212 -
\??\c:\3nthth.exec:\3nthth.exe57⤵
- Executes dropped EXE
PID:2504 -
\??\c:\tnbtnt.exec:\tnbtnt.exe58⤵
- Executes dropped EXE
PID:1928 -
\??\c:\8800624.exec:\8800624.exe59⤵
- Executes dropped EXE
PID:2552 -
\??\c:\648806.exec:\648806.exe60⤵
- Executes dropped EXE
PID:864 -
\??\c:\5pdvd.exec:\5pdvd.exe61⤵
- Executes dropped EXE
PID:844 -
\??\c:\0484064.exec:\0484064.exe62⤵
- Executes dropped EXE
PID:1524 -
\??\c:\9rflllf.exec:\9rflllf.exe63⤵
- Executes dropped EXE
PID:840 -
\??\c:\00846.exec:\00846.exe64⤵
- Executes dropped EXE
PID:1544 -
\??\c:\82286.exec:\82286.exe65⤵
- Executes dropped EXE
PID:2216 -
\??\c:\ffxlfrx.exec:\ffxlfrx.exe66⤵PID:1720
-
\??\c:\240660.exec:\240660.exe67⤵PID:2160
-
\??\c:\g4228.exec:\g4228.exe68⤵PID:1732
-
\??\c:\pjvvd.exec:\pjvvd.exe69⤵PID:580
-
\??\c:\826248.exec:\826248.exe70⤵PID:924
-
\??\c:\9bhbtt.exec:\9bhbtt.exe71⤵PID:2012
-
\??\c:\vpjpj.exec:\vpjpj.exe72⤵PID:3068
-
\??\c:\bbnthh.exec:\bbnthh.exe73⤵PID:2184
-
\??\c:\jjjjp.exec:\jjjjp.exe74⤵PID:1696
-
\??\c:\rfrlfxx.exec:\rfrlfxx.exe75⤵PID:1564
-
\??\c:\nnhthn.exec:\nnhthn.exe76⤵PID:2916
-
\??\c:\860462.exec:\860462.exe77⤵PID:2784
-
\??\c:\0440220.exec:\0440220.exe78⤵PID:2920
-
\??\c:\1rxfxfr.exec:\1rxfxfr.exe79⤵PID:3032
-
\??\c:\i862406.exec:\i862406.exe80⤵PID:3028
-
\??\c:\404646.exec:\404646.exe81⤵PID:2944
-
\??\c:\u080268.exec:\u080268.exe82⤵PID:2740
-
\??\c:\2084002.exec:\2084002.exe83⤵PID:2672
-
\??\c:\8206402.exec:\8206402.exe84⤵PID:1068
-
\??\c:\nhtnbh.exec:\nhtnbh.exe85⤵PID:1728
-
\??\c:\8640842.exec:\8640842.exe86⤵PID:2660
-
\??\c:\2688020.exec:\2688020.exe87⤵PID:2224
-
\??\c:\608462.exec:\608462.exe88⤵PID:2268
-
\??\c:\nnhthn.exec:\nnhthn.exe89⤵PID:2292
-
\??\c:\vvpvv.exec:\vvpvv.exe90⤵PID:3008
-
\??\c:\rfxfllr.exec:\rfxfllr.exe91⤵PID:2988
-
\??\c:\1dpvj.exec:\1dpvj.exe92⤵PID:1860
-
\??\c:\7pdpj.exec:\7pdpj.exe93⤵PID:564
-
\??\c:\1vpvj.exec:\1vpvj.exe94⤵PID:2424
-
\??\c:\68000.exec:\68000.exe95⤵PID:2364
-
\??\c:\7ddpp.exec:\7ddpp.exe96⤵PID:1792
-
\??\c:\046266.exec:\046266.exe97⤵PID:2344
-
\??\c:\824062.exec:\824062.exe98⤵PID:1084
-
\??\c:\vjvvv.exec:\vjvvv.exe99⤵PID:816
-
\??\c:\024060.exec:\024060.exe100⤵PID:1108
-
\??\c:\3xlllfl.exec:\3xlllfl.exe101⤵PID:348
-
\??\c:\i424668.exec:\i424668.exe102⤵PID:316
-
\??\c:\6084064.exec:\6084064.exe103⤵PID:1000
-
\??\c:\c428624.exec:\c428624.exe104⤵PID:2404
-
\??\c:\rllfxrf.exec:\rllfxrf.exe105⤵PID:1368
-
\??\c:\5rlrflx.exec:\5rlrflx.exe106⤵PID:1956
-
\??\c:\660628.exec:\660628.exe107⤵PID:1984
-
\??\c:\lfrxrxf.exec:\lfrxrxf.exe108⤵PID:2588
-
\??\c:\1rlrrxl.exec:\1rlrrxl.exe109⤵PID:2168
-
\??\c:\bbtbhn.exec:\bbtbhn.exe110⤵PID:2864
-
\??\c:\48622.exec:\48622.exe111⤵PID:700
-
\??\c:\hhbhbb.exec:\hhbhbb.exe112⤵PID:1744
-
\??\c:\68628.exec:\68628.exe113⤵PID:1576
-
\??\c:\5llrxfr.exec:\5llrxfr.exe114⤵PID:2340
-
\??\c:\dvdjj.exec:\dvdjj.exe115⤵PID:1312
-
\??\c:\9lfrfll.exec:\9lfrfll.exe116⤵PID:2260
-
\??\c:\6824064.exec:\6824064.exe117⤵PID:1592
-
\??\c:\pppjv.exec:\pppjv.exe118⤵PID:2924
-
\??\c:\vpjpp.exec:\vpjpp.exe119⤵PID:2736
-
\??\c:\bnhnnt.exec:\bnhnnt.exe120⤵PID:2628
-
\??\c:\08606.exec:\08606.exe121⤵PID:2644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-