Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 07:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a637de6b59a123e34c9d149c837c779822441203488932df4d8685f557fe1b9d.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a637de6b59a123e34c9d149c837c779822441203488932df4d8685f557fe1b9d.exe
-
Size
454KB
-
MD5
682a866a9617a41b8139c7238ec95490
-
SHA1
fd51118a2272be4a3c5481b9a476ec3d7d8e3bb3
-
SHA256
a637de6b59a123e34c9d149c837c779822441203488932df4d8685f557fe1b9d
-
SHA512
7b14ec573b74120ec677ba9b808408008c001e9faa42bb541acb2462e09c5de8319d42b04013d58563d97b59ac868360a8b2d2f1b63755698b82b2d7a5ff3202
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeZ:q7Tc2NYHUrAwfMp3CDZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2960-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/376-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/376-16-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/1716-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-61-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-81-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2128-102-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2860-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-192-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1552-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-231-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/764-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-267-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1388-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/808-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/808-288-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2804-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-372-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2560-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-394-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2672-393-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3044-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-398-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2860-415-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2936-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-435-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1936-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/784-469-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/3000-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-593-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2300-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-654-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2068-674-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1668-881-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-931-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-944-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-951-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 376 htbnht.exe 1716 64040.exe 1060 lfrffrf.exe 2704 rflfxxf.exe 2844 dvdvv.exe 2740 8020444.exe 2732 ntbnht.exe 2756 tbbbbt.exe 2556 2404044.exe 2128 5flxfxx.exe 832 u882884.exe 2860 48846.exe 3040 vpvvv.exe 2864 bnbnnn.exe 1880 1lffffx.exe 1868 htbhnn.exe 1648 dpjpj.exe 480 46888.exe 1636 xflrxxf.exe 1552 thnntn.exe 2024 c202468.exe 2288 5ntntn.exe 1620 1nbbhh.exe 944 82064.exe 1972 lflxllx.exe 2192 c608408.exe 764 nhbbhh.exe 2436 rlflxxl.exe 2328 26668.exe 1388 jpvpj.exe 808 rflfllx.exe 2324 btttnn.exe 1588 pjvvj.exe 2360 0840046.exe 2096 20822.exe 2828 0422880.exe 2300 0482840.exe 2804 26686.exe 2708 66860.exe 2984 pdpjp.exe 2676 7ppvv.exe 2852 pjppd.exe 2672 jjvdd.exe 2728 3lrrrlr.exe 2560 1nbbbb.exe 3044 rrlxlfr.exe 1792 5nhntb.exe 2872 lflfxrx.exe 2860 64224.exe 340 k20624.exe 2936 pjppp.exe 1340 208400.exe 1880 46884.exe 2420 824066.exe 1936 vdjjj.exe 532 hhtttt.exe 784 htnnbh.exe 580 s2888.exe 268 vjpdv.exe 548 vpjdj.exe 440 8244628.exe 2288 86444.exe 1660 pvdjd.exe 1044 64222.exe -
resource yara_rule behavioral1/memory/2960-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-16-0x0000000001C50000-0x0000000001C7A000-memory.dmp upx behavioral1/memory/1716-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-93-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2128-102-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2860-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-231-0x0000000001C70000-0x0000000001C9A000-memory.dmp upx behavioral1/memory/764-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-281-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1388-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-398-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2936-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/440-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-674-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2412-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-793-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-843-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-856-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-881-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-900-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-931-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-944-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lflxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 420662.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 208060.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e08448.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42028.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 806622.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 802660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 642288.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026606.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86880.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxlxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 424844.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2066644.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2960 wrote to memory of 376 2960 a637de6b59a123e34c9d149c837c779822441203488932df4d8685f557fe1b9d.exe 30 PID 2960 wrote to memory of 376 2960 a637de6b59a123e34c9d149c837c779822441203488932df4d8685f557fe1b9d.exe 30 PID 2960 wrote to memory of 376 2960 a637de6b59a123e34c9d149c837c779822441203488932df4d8685f557fe1b9d.exe 30 PID 2960 wrote to memory of 376 2960 a637de6b59a123e34c9d149c837c779822441203488932df4d8685f557fe1b9d.exe 30 PID 376 wrote to memory of 1716 376 htbnht.exe 31 PID 376 wrote to memory of 1716 376 htbnht.exe 31 PID 376 wrote to memory of 1716 376 htbnht.exe 31 PID 376 wrote to memory of 1716 376 htbnht.exe 31 PID 1716 wrote to memory of 1060 1716 64040.exe 32 PID 1716 wrote to memory of 1060 1716 64040.exe 32 PID 1716 wrote to memory of 1060 1716 64040.exe 32 PID 1716 wrote to memory of 1060 1716 64040.exe 32 PID 1060 wrote to memory of 2704 1060 lfrffrf.exe 33 PID 1060 wrote to memory of 2704 1060 lfrffrf.exe 33 PID 1060 wrote to memory of 2704 1060 lfrffrf.exe 33 PID 1060 wrote to memory of 2704 1060 lfrffrf.exe 33 PID 2704 wrote to memory of 2844 2704 rflfxxf.exe 34 PID 2704 wrote to memory of 2844 2704 rflfxxf.exe 34 PID 2704 wrote to memory of 2844 2704 rflfxxf.exe 34 PID 2704 wrote to memory of 2844 2704 rflfxxf.exe 34 PID 2844 wrote to memory of 2740 2844 dvdvv.exe 35 PID 2844 wrote to memory of 2740 2844 dvdvv.exe 35 PID 2844 wrote to memory of 2740 2844 dvdvv.exe 35 PID 2844 wrote to memory of 2740 2844 dvdvv.exe 35 PID 2740 wrote to memory of 2732 2740 8020444.exe 36 PID 2740 wrote to memory of 2732 2740 8020444.exe 36 PID 2740 wrote to memory of 2732 2740 8020444.exe 36 PID 2740 wrote to memory of 2732 2740 8020444.exe 36 PID 2732 wrote to memory of 2756 2732 ntbnht.exe 37 PID 2732 wrote to memory of 2756 2732 ntbnht.exe 37 PID 2732 wrote to memory of 2756 2732 ntbnht.exe 37 PID 2732 wrote to memory of 2756 2732 ntbnht.exe 37 PID 2756 wrote to memory of 2556 2756 tbbbbt.exe 38 PID 2756 wrote to memory of 2556 2756 tbbbbt.exe 38 PID 2756 wrote to memory of 2556 2756 tbbbbt.exe 38 PID 2756 wrote to memory of 2556 2756 tbbbbt.exe 38 PID 2556 wrote to memory of 2128 2556 2404044.exe 39 PID 2556 wrote to memory of 2128 2556 2404044.exe 39 PID 2556 wrote to memory of 2128 2556 2404044.exe 39 PID 2556 wrote to memory of 2128 2556 2404044.exe 39 PID 2128 wrote to memory of 832 2128 5flxfxx.exe 40 PID 2128 wrote to memory of 832 2128 5flxfxx.exe 40 PID 2128 wrote to memory of 832 2128 5flxfxx.exe 40 PID 2128 wrote to memory of 832 2128 5flxfxx.exe 40 PID 832 wrote to memory of 2860 832 u882884.exe 41 PID 832 wrote to memory of 2860 832 u882884.exe 41 PID 832 wrote to memory of 2860 832 u882884.exe 41 PID 832 wrote to memory of 2860 832 u882884.exe 41 PID 2860 wrote to memory of 3040 2860 48846.exe 42 PID 2860 wrote to memory of 3040 2860 48846.exe 42 PID 2860 wrote to memory of 3040 2860 48846.exe 42 PID 2860 wrote to memory of 3040 2860 48846.exe 42 PID 3040 wrote to memory of 2864 3040 vpvvv.exe 43 PID 3040 wrote to memory of 2864 3040 vpvvv.exe 43 PID 3040 wrote to memory of 2864 3040 vpvvv.exe 43 PID 3040 wrote to memory of 2864 3040 vpvvv.exe 43 PID 2864 wrote to memory of 1880 2864 bnbnnn.exe 44 PID 2864 wrote to memory of 1880 2864 bnbnnn.exe 44 PID 2864 wrote to memory of 1880 2864 bnbnnn.exe 44 PID 2864 wrote to memory of 1880 2864 bnbnnn.exe 44 PID 1880 wrote to memory of 1868 1880 1lffffx.exe 45 PID 1880 wrote to memory of 1868 1880 1lffffx.exe 45 PID 1880 wrote to memory of 1868 1880 1lffffx.exe 45 PID 1880 wrote to memory of 1868 1880 1lffffx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a637de6b59a123e34c9d149c837c779822441203488932df4d8685f557fe1b9d.exe"C:\Users\Admin\AppData\Local\Temp\a637de6b59a123e34c9d149c837c779822441203488932df4d8685f557fe1b9d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\htbnht.exec:\htbnht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\64040.exec:\64040.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\lfrffrf.exec:\lfrffrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\rflfxxf.exec:\rflfxxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\dvdvv.exec:\dvdvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\8020444.exec:\8020444.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\ntbnht.exec:\ntbnht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\tbbbbt.exec:\tbbbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\2404044.exec:\2404044.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\5flxfxx.exec:\5flxfxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\u882884.exec:\u882884.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\48846.exec:\48846.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\vpvvv.exec:\vpvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\bnbnnn.exec:\bnbnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\1lffffx.exec:\1lffffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\htbhnn.exec:\htbhnn.exe17⤵
- Executes dropped EXE
PID:1868 -
\??\c:\dpjpj.exec:\dpjpj.exe18⤵
- Executes dropped EXE
PID:1648 -
\??\c:\46888.exec:\46888.exe19⤵
- Executes dropped EXE
PID:480 -
\??\c:\xflrxxf.exec:\xflrxxf.exe20⤵
- Executes dropped EXE
PID:1636 -
\??\c:\thnntn.exec:\thnntn.exe21⤵
- Executes dropped EXE
PID:1552 -
\??\c:\c202468.exec:\c202468.exe22⤵
- Executes dropped EXE
PID:2024 -
\??\c:\5ntntn.exec:\5ntntn.exe23⤵
- Executes dropped EXE
PID:2288 -
\??\c:\1nbbhh.exec:\1nbbhh.exe24⤵
- Executes dropped EXE
PID:1620 -
\??\c:\82064.exec:\82064.exe25⤵
- Executes dropped EXE
PID:944 -
\??\c:\lflxllx.exec:\lflxllx.exe26⤵
- Executes dropped EXE
PID:1972 -
\??\c:\c608408.exec:\c608408.exe27⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nhbbhh.exec:\nhbbhh.exe28⤵
- Executes dropped EXE
PID:764 -
\??\c:\rlflxxl.exec:\rlflxxl.exe29⤵
- Executes dropped EXE
PID:2436 -
\??\c:\26668.exec:\26668.exe30⤵
- Executes dropped EXE
PID:2328 -
\??\c:\jpvpj.exec:\jpvpj.exe31⤵
- Executes dropped EXE
PID:1388 -
\??\c:\rflfllx.exec:\rflfllx.exe32⤵
- Executes dropped EXE
PID:808 -
\??\c:\btttnn.exec:\btttnn.exe33⤵
- Executes dropped EXE
PID:2324 -
\??\c:\pjvvj.exec:\pjvvj.exe34⤵
- Executes dropped EXE
PID:1588 -
\??\c:\0840046.exec:\0840046.exe35⤵
- Executes dropped EXE
PID:2360 -
\??\c:\20822.exec:\20822.exe36⤵
- Executes dropped EXE
PID:2096 -
\??\c:\0422880.exec:\0422880.exe37⤵
- Executes dropped EXE
PID:2828 -
\??\c:\0482840.exec:\0482840.exe38⤵
- Executes dropped EXE
PID:2300 -
\??\c:\26686.exec:\26686.exe39⤵
- Executes dropped EXE
PID:2804 -
\??\c:\66860.exec:\66860.exe40⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pdpjp.exec:\pdpjp.exe41⤵
- Executes dropped EXE
PID:2984 -
\??\c:\7ppvv.exec:\7ppvv.exe42⤵
- Executes dropped EXE
PID:2676 -
\??\c:\pjppd.exec:\pjppd.exe43⤵
- Executes dropped EXE
PID:2852 -
\??\c:\jjvdd.exec:\jjvdd.exe44⤵
- Executes dropped EXE
PID:2672 -
\??\c:\3lrrrlr.exec:\3lrrrlr.exe45⤵
- Executes dropped EXE
PID:2728 -
\??\c:\1nbbbb.exec:\1nbbbb.exe46⤵
- Executes dropped EXE
PID:2560 -
\??\c:\rrlxlfr.exec:\rrlxlfr.exe47⤵
- Executes dropped EXE
PID:3044 -
\??\c:\5nhntb.exec:\5nhntb.exe48⤵
- Executes dropped EXE
PID:1792 -
\??\c:\lflfxrx.exec:\lflfxrx.exe49⤵
- Executes dropped EXE
PID:2872 -
\??\c:\64224.exec:\64224.exe50⤵
- Executes dropped EXE
PID:2860 -
\??\c:\k20624.exec:\k20624.exe51⤵
- Executes dropped EXE
PID:340 -
\??\c:\pjppp.exec:\pjppp.exe52⤵
- Executes dropped EXE
PID:2936 -
\??\c:\208400.exec:\208400.exe53⤵
- Executes dropped EXE
PID:1340 -
\??\c:\46884.exec:\46884.exe54⤵
- Executes dropped EXE
PID:1880 -
\??\c:\824066.exec:\824066.exe55⤵
- Executes dropped EXE
PID:2420 -
\??\c:\vdjjj.exec:\vdjjj.exe56⤵
- Executes dropped EXE
PID:1936 -
\??\c:\hhtttt.exec:\hhtttt.exe57⤵
- Executes dropped EXE
PID:532 -
\??\c:\htnnbh.exec:\htnnbh.exe58⤵
- Executes dropped EXE
PID:784 -
\??\c:\s2888.exec:\s2888.exe59⤵
- Executes dropped EXE
PID:580 -
\??\c:\vjpdv.exec:\vjpdv.exe60⤵
- Executes dropped EXE
PID:268 -
\??\c:\vpjdj.exec:\vpjdj.exe61⤵
- Executes dropped EXE
PID:548 -
\??\c:\8244628.exec:\8244628.exe62⤵
- Executes dropped EXE
PID:440 -
\??\c:\86444.exec:\86444.exe63⤵
- Executes dropped EXE
PID:2288 -
\??\c:\pvdjd.exec:\pvdjd.exe64⤵
- Executes dropped EXE
PID:1660 -
\??\c:\64222.exec:\64222.exe65⤵
- Executes dropped EXE
PID:1044 -
\??\c:\nhhhnn.exec:\nhhhnn.exe66⤵PID:3000
-
\??\c:\frxfffx.exec:\frxfffx.exe67⤵PID:1712
-
\??\c:\424460.exec:\424460.exe68⤵PID:2976
-
\??\c:\2404088.exec:\2404088.exe69⤵PID:2180
-
\??\c:\82066.exec:\82066.exe70⤵PID:2252
-
\??\c:\3pdvp.exec:\3pdvp.exe71⤵PID:2112
-
\??\c:\vpdvj.exec:\vpdvj.exe72⤵PID:2496
-
\??\c:\260282.exec:\260282.exe73⤵PID:2160
-
\??\c:\0282222.exec:\0282222.exe74⤵PID:1728
-
\??\c:\4802828.exec:\4802828.exe75⤵PID:2248
-
\??\c:\thttbt.exec:\thttbt.exe76⤵PID:2964
-
\??\c:\8600228.exec:\8600228.exe77⤵PID:1596
-
\??\c:\xrlrffr.exec:\xrlrffr.exe78⤵PID:1988
-
\??\c:\xlxrxxf.exec:\xlxrxxf.exe79⤵PID:2464
-
\??\c:\thbbbb.exec:\thbbbb.exe80⤵PID:2828
-
\??\c:\vjjjd.exec:\vjjjd.exe81⤵PID:2300
-
\??\c:\xlrrxfr.exec:\xlrrxfr.exe82⤵PID:2716
-
\??\c:\vpvdj.exec:\vpvdj.exe83⤵PID:2776
-
\??\c:\s4262.exec:\s4262.exe84⤵PID:2588
-
\??\c:\24062.exec:\24062.exe85⤵PID:2908
-
\??\c:\rflflxx.exec:\rflflxx.exe86⤵PID:2696
-
\??\c:\ntbbbt.exec:\ntbbbt.exe87⤵PID:2624
-
\??\c:\5jpjd.exec:\5jpjd.exe88⤵PID:2396
-
\??\c:\2404484.exec:\2404484.exe89⤵PID:2068
-
\??\c:\1rxxfxf.exec:\1rxxfxf.exe90⤵PID:2128
-
\??\c:\q84848.exec:\q84848.exe91⤵PID:1140
-
\??\c:\htbbbt.exec:\htbbbt.exe92⤵PID:2412
-
\??\c:\2064040.exec:\2064040.exe93⤵PID:1612
-
\??\c:\08666.exec:\08666.exe94⤵PID:696
-
\??\c:\g2446.exec:\g2446.exe95⤵PID:2000
-
\??\c:\lrlffxf.exec:\lrlffxf.exe96⤵PID:316
-
\??\c:\68488.exec:\68488.exe97⤵PID:1956
-
\??\c:\7nbbtn.exec:\7nbbtn.exe98⤵PID:2376
-
\??\c:\8022260.exec:\8022260.exe99⤵PID:1648
-
\??\c:\3rfflll.exec:\3rfflll.exe100⤵PID:1964
-
\??\c:\8606222.exec:\8606222.exe101⤵PID:1476
-
\??\c:\xxfllrx.exec:\xxfllrx.exe102⤵PID:1152
-
\??\c:\vjddd.exec:\vjddd.exe103⤵PID:1104
-
\??\c:\646048.exec:\646048.exe104⤵PID:2304
-
\??\c:\46882.exec:\46882.exe105⤵PID:2536
-
\??\c:\djjdd.exec:\djjdd.exe106⤵PID:1620
-
\??\c:\btbbbt.exec:\btbbbt.exe107⤵PID:1804
-
\??\c:\808288.exec:\808288.exe108⤵PID:1764
-
\??\c:\k06666.exec:\k06666.exe109⤵PID:1700
-
\??\c:\240482.exec:\240482.exe110⤵PID:2392
-
\??\c:\0244484.exec:\0244484.exe111⤵PID:2192
-
\??\c:\680022.exec:\680022.exe112⤵PID:3068
-
\??\c:\24668.exec:\24668.exe113⤵PID:1680
-
\??\c:\42488.exec:\42488.exe114⤵PID:2992
-
\??\c:\862260.exec:\862260.exe115⤵PID:304
-
\??\c:\xxrlllr.exec:\xxrlllr.exe116⤵PID:760
-
\??\c:\864400.exec:\864400.exe117⤵PID:2640
-
\??\c:\6422884.exec:\6422884.exe118⤵PID:1600
-
\??\c:\7rrrxxl.exec:\7rrrxxl.exe119⤵PID:2468
-
\??\c:\hnhtbb.exec:\hnhtbb.exe120⤵PID:1572
-
\??\c:\68444.exec:\68444.exe121⤵PID:2004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-