Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 22:01
Behavioral task
behavioral1
Sample
3daaaa1ec0a948ac1444153ad80042388b48e7a9980b598db0fbb0e94e3e06d8.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
General
-
Target
3daaaa1ec0a948ac1444153ad80042388b48e7a9980b598db0fbb0e94e3e06d8.exe
-
Size
333KB
-
MD5
a64942b29998a73d418b86af0400b1ca
-
SHA1
6f8beaeff7146178e76a22f64b537bb83c42a71a
-
SHA256
3daaaa1ec0a948ac1444153ad80042388b48e7a9980b598db0fbb0e94e3e06d8
-
SHA512
b9546bc6174c39385ebbbe7a981413a439a08f565e11de13cbe6513c6604cee0b0a97967e422c309e77b3eaac6e458af5810f7a7ff5093b7d09afb36f8f3c03d
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeV+:R4wFHoSHYHUrAwfMp3CDV+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2360-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1452-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/964-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1092-128-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1628-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1196-170-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1196-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1308-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/612-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/768-228-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1436-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3024-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1592-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1592-294-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2736-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-333-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2720-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-347-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2552-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-364-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1664-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/796-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2136-448-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-561-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2440-579-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2364-654-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2612-671-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/612-730-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1324-20777-0x0000000077AE0000-0x0000000077BFF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2980 9pdjp.exe 3032 lxllrlr.exe 1452 xxlxlrx.exe 2764 5nhhnb.exe 2752 xxrlxfl.exe 2672 048422.exe 2888 pjvdp.exe 2728 660684.exe 2552 3nnthn.exe 2624 220028.exe 3012 w64682.exe 1836 82406.exe 964 26620.exe 1764 i828806.exe 1092 00246.exe 1660 ttttbh.exe 1628 4020428.exe 2900 9tbhbb.exe 2648 xlfrxlr.exe 1196 vjvvd.exe 2880 6040464.exe 2432 lrrfrff.exe 1308 fllxllr.exe 612 1ddpd.exe 2380 nnhthn.exe 2940 m6006.exe 768 llflxfl.exe 1716 26882.exe 560 hbthhn.exe 2028 pjjpd.exe 1436 jdddj.exe 1156 008246.exe 1492 c046628.exe 2920 q24462.exe 3024 llfxlrx.exe 1592 000868.exe 2736 thtttt.exe 1648 04240.exe 2768 ffxrfxr.exe 2760 48464.exe 2700 m0860.exe 2584 hthbbh.exe 2572 jpjpv.exe 2720 64622.exe 2824 2044006.exe 1600 7pppp.exe 2552 24620.exe 3000 3httbb.exe 2600 2688840.exe 2388 3dpvv.exe 1664 flllxff.exe 2816 o200668.exe 2032 c822006.exe 320 28682.exe 1920 86262.exe 796 rlxxfff.exe 2860 tnhhnn.exe 2976 dpjvd.exe 2184 424066.exe 2168 dvdvj.exe 2376 42440.exe 2844 c484620.exe 2136 64240.exe 2652 3rxfflr.exe -
resource yara_rule behavioral1/memory/2360-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001225f-5.dat upx behavioral1/memory/2980-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2360-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c03-17.dat upx behavioral1/memory/2980-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1452-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c7c-24.dat upx behavioral1/files/0x0007000000016ca5-32.dat upx behavioral1/files/0x0007000000016cb2-40.dat upx behavioral1/memory/2752-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2764-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000016cbc-47.dat upx behavioral1/memory/2672-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017355-63.dat upx behavioral1/memory/2728-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019345-72.dat upx behavioral1/files/0x0009000000016cc4-56.dat upx behavioral1/memory/2552-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019369-80.dat upx behavioral1/memory/2552-79-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2624-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019371-88.dat upx behavioral1/memory/3012-95-0x00000000002B0000-0x00000000002D7000-memory.dmp upx behavioral1/files/0x000500000001937b-98.dat upx behavioral1/memory/3012-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019382-104.dat upx behavioral1/memory/964-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001938e-112.dat upx behavioral1/memory/1764-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193a8-120.dat upx behavioral1/files/0x00050000000193d1-130.dat upx behavioral1/files/0x00050000000193e6-138.dat upx behavioral1/files/0x00050000000193f0-149.dat upx behavioral1/memory/1628-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001945c-158.dat upx behavioral1/memory/2900-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1196-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001678f-166.dat upx behavioral1/files/0x000500000001948d-174.dat upx behavioral1/files/0x00050000000194e2-183.dat upx behavioral1/memory/2880-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001958b-190.dat upx behavioral1/memory/1308-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c2-198.dat upx behavioral1/memory/612-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c4-206.dat upx behavioral1/memory/2380-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c6-214.dat upx behavioral1/files/0x00050000000195c7-221.dat upx behavioral1/files/0x00050000000195c8-229.dat upx behavioral1/files/0x00050000000195ca-236.dat upx behavioral1/files/0x00050000000195cc-247.dat upx behavioral1/memory/2028-246-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195ce-255.dat upx behavioral1/files/0x00050000000195d0-263.dat upx behavioral1/memory/1436-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3024-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1592-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2736-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2700-321-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2720-340-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-341-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o200220.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 208446.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rllrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 446406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8206284.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60244.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82402.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2980 2360 3daaaa1ec0a948ac1444153ad80042388b48e7a9980b598db0fbb0e94e3e06d8.exe 31 PID 2360 wrote to memory of 2980 2360 3daaaa1ec0a948ac1444153ad80042388b48e7a9980b598db0fbb0e94e3e06d8.exe 31 PID 2360 wrote to memory of 2980 2360 3daaaa1ec0a948ac1444153ad80042388b48e7a9980b598db0fbb0e94e3e06d8.exe 31 PID 2360 wrote to memory of 2980 2360 3daaaa1ec0a948ac1444153ad80042388b48e7a9980b598db0fbb0e94e3e06d8.exe 31 PID 2980 wrote to memory of 3032 2980 9pdjp.exe 32 PID 2980 wrote to memory of 3032 2980 9pdjp.exe 32 PID 2980 wrote to memory of 3032 2980 9pdjp.exe 32 PID 2980 wrote to memory of 3032 2980 9pdjp.exe 32 PID 3032 wrote to memory of 1452 3032 lxllrlr.exe 33 PID 3032 wrote to memory of 1452 3032 lxllrlr.exe 33 PID 3032 wrote to memory of 1452 3032 lxllrlr.exe 33 PID 3032 wrote to memory of 1452 3032 lxllrlr.exe 33 PID 1452 wrote to memory of 2764 1452 xxlxlrx.exe 34 PID 1452 wrote to memory of 2764 1452 xxlxlrx.exe 34 PID 1452 wrote to memory of 2764 1452 xxlxlrx.exe 34 PID 1452 wrote to memory of 2764 1452 xxlxlrx.exe 34 PID 2764 wrote to memory of 2752 2764 5nhhnb.exe 35 PID 2764 wrote to memory of 2752 2764 5nhhnb.exe 35 PID 2764 wrote to memory of 2752 2764 5nhhnb.exe 35 PID 2764 wrote to memory of 2752 2764 5nhhnb.exe 35 PID 2752 wrote to memory of 2672 2752 xxrlxfl.exe 36 PID 2752 wrote to memory of 2672 2752 xxrlxfl.exe 36 PID 2752 wrote to memory of 2672 2752 xxrlxfl.exe 36 PID 2752 wrote to memory of 2672 2752 xxrlxfl.exe 36 PID 2672 wrote to memory of 2888 2672 048422.exe 37 PID 2672 wrote to memory of 2888 2672 048422.exe 37 PID 2672 wrote to memory of 2888 2672 048422.exe 37 PID 2672 wrote to memory of 2888 2672 048422.exe 37 PID 2888 wrote to memory of 2728 2888 pjvdp.exe 38 PID 2888 wrote to memory of 2728 2888 pjvdp.exe 38 PID 2888 wrote to memory of 2728 2888 pjvdp.exe 38 PID 2888 wrote to memory of 2728 2888 pjvdp.exe 38 PID 2728 wrote to memory of 2552 2728 660684.exe 39 PID 2728 wrote to memory of 2552 2728 660684.exe 39 PID 2728 wrote to memory of 2552 2728 660684.exe 39 PID 2728 wrote to memory of 2552 2728 660684.exe 39 PID 2552 wrote to memory of 2624 2552 3nnthn.exe 40 PID 2552 wrote to memory of 2624 2552 3nnthn.exe 40 PID 2552 wrote to memory of 2624 2552 3nnthn.exe 40 PID 2552 wrote to memory of 2624 2552 3nnthn.exe 40 PID 2624 wrote to memory of 3012 2624 220028.exe 41 PID 2624 wrote to memory of 3012 2624 220028.exe 41 PID 2624 wrote to memory of 3012 2624 220028.exe 41 PID 2624 wrote to memory of 3012 2624 220028.exe 41 PID 3012 wrote to memory of 1836 3012 w64682.exe 42 PID 3012 wrote to memory of 1836 3012 w64682.exe 42 PID 3012 wrote to memory of 1836 3012 w64682.exe 42 PID 3012 wrote to memory of 1836 3012 w64682.exe 42 PID 1836 wrote to memory of 964 1836 82406.exe 43 PID 1836 wrote to memory of 964 1836 82406.exe 43 PID 1836 wrote to memory of 964 1836 82406.exe 43 PID 1836 wrote to memory of 964 1836 82406.exe 43 PID 964 wrote to memory of 1764 964 26620.exe 44 PID 964 wrote to memory of 1764 964 26620.exe 44 PID 964 wrote to memory of 1764 964 26620.exe 44 PID 964 wrote to memory of 1764 964 26620.exe 44 PID 1764 wrote to memory of 1092 1764 i828806.exe 45 PID 1764 wrote to memory of 1092 1764 i828806.exe 45 PID 1764 wrote to memory of 1092 1764 i828806.exe 45 PID 1764 wrote to memory of 1092 1764 i828806.exe 45 PID 1092 wrote to memory of 1660 1092 00246.exe 46 PID 1092 wrote to memory of 1660 1092 00246.exe 46 PID 1092 wrote to memory of 1660 1092 00246.exe 46 PID 1092 wrote to memory of 1660 1092 00246.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\3daaaa1ec0a948ac1444153ad80042388b48e7a9980b598db0fbb0e94e3e06d8.exe"C:\Users\Admin\AppData\Local\Temp\3daaaa1ec0a948ac1444153ad80042388b48e7a9980b598db0fbb0e94e3e06d8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\9pdjp.exec:\9pdjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\lxllrlr.exec:\lxllrlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\xxlxlrx.exec:\xxlxlrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\5nhhnb.exec:\5nhhnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\xxrlxfl.exec:\xxrlxfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\048422.exec:\048422.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\pjvdp.exec:\pjvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\660684.exec:\660684.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\3nnthn.exec:\3nnthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\220028.exec:\220028.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\w64682.exec:\w64682.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\82406.exec:\82406.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\26620.exec:\26620.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\i828806.exec:\i828806.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\00246.exec:\00246.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\ttttbh.exec:\ttttbh.exe17⤵
- Executes dropped EXE
PID:1660 -
\??\c:\4020428.exec:\4020428.exe18⤵
- Executes dropped EXE
PID:1628 -
\??\c:\9tbhbb.exec:\9tbhbb.exe19⤵
- Executes dropped EXE
PID:2900 -
\??\c:\xlfrxlr.exec:\xlfrxlr.exe20⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vjvvd.exec:\vjvvd.exe21⤵
- Executes dropped EXE
PID:1196 -
\??\c:\6040464.exec:\6040464.exe22⤵
- Executes dropped EXE
PID:2880 -
\??\c:\lrrfrff.exec:\lrrfrff.exe23⤵
- Executes dropped EXE
PID:2432 -
\??\c:\fllxllr.exec:\fllxllr.exe24⤵
- Executes dropped EXE
PID:1308 -
\??\c:\1ddpd.exec:\1ddpd.exe25⤵
- Executes dropped EXE
PID:612 -
\??\c:\nnhthn.exec:\nnhthn.exe26⤵
- Executes dropped EXE
PID:2380 -
\??\c:\m6006.exec:\m6006.exe27⤵
- Executes dropped EXE
PID:2940 -
\??\c:\llflxfl.exec:\llflxfl.exe28⤵
- Executes dropped EXE
PID:768 -
\??\c:\26882.exec:\26882.exe29⤵
- Executes dropped EXE
PID:1716 -
\??\c:\hbthhn.exec:\hbthhn.exe30⤵
- Executes dropped EXE
PID:560 -
\??\c:\pjjpd.exec:\pjjpd.exe31⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jdddj.exec:\jdddj.exe32⤵
- Executes dropped EXE
PID:1436 -
\??\c:\008246.exec:\008246.exe33⤵
- Executes dropped EXE
PID:1156 -
\??\c:\c046628.exec:\c046628.exe34⤵
- Executes dropped EXE
PID:1492 -
\??\c:\q24462.exec:\q24462.exe35⤵
- Executes dropped EXE
PID:2920 -
\??\c:\llfxlrx.exec:\llfxlrx.exe36⤵
- Executes dropped EXE
PID:3024 -
\??\c:\000868.exec:\000868.exe37⤵
- Executes dropped EXE
PID:1592 -
\??\c:\thtttt.exec:\thtttt.exe38⤵
- Executes dropped EXE
PID:2736 -
\??\c:\04240.exec:\04240.exe39⤵
- Executes dropped EXE
PID:1648 -
\??\c:\ffxrfxr.exec:\ffxrfxr.exe40⤵
- Executes dropped EXE
PID:2768 -
\??\c:\48464.exec:\48464.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\m0860.exec:\m0860.exe42⤵
- Executes dropped EXE
PID:2700 -
\??\c:\hthbbh.exec:\hthbbh.exe43⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jpjpv.exec:\jpjpv.exe44⤵
- Executes dropped EXE
PID:2572 -
\??\c:\64622.exec:\64622.exe45⤵
- Executes dropped EXE
PID:2720 -
\??\c:\2044006.exec:\2044006.exe46⤵
- Executes dropped EXE
PID:2824 -
\??\c:\7pppp.exec:\7pppp.exe47⤵
- Executes dropped EXE
PID:1600 -
\??\c:\24620.exec:\24620.exe48⤵
- Executes dropped EXE
PID:2552 -
\??\c:\3httbb.exec:\3httbb.exe49⤵
- Executes dropped EXE
PID:3000 -
\??\c:\2688840.exec:\2688840.exe50⤵
- Executes dropped EXE
PID:2600 -
\??\c:\3dpvv.exec:\3dpvv.exe51⤵
- Executes dropped EXE
PID:2388 -
\??\c:\flllxff.exec:\flllxff.exe52⤵
- Executes dropped EXE
PID:1664 -
\??\c:\o200668.exec:\o200668.exe53⤵
- Executes dropped EXE
PID:2816 -
\??\c:\c822006.exec:\c822006.exe54⤵
- Executes dropped EXE
PID:2032 -
\??\c:\28682.exec:\28682.exe55⤵
- Executes dropped EXE
PID:320 -
\??\c:\86262.exec:\86262.exe56⤵
- Executes dropped EXE
PID:1920 -
\??\c:\rlxxfff.exec:\rlxxfff.exe57⤵
- Executes dropped EXE
PID:796 -
\??\c:\tnhhnn.exec:\tnhhnn.exe58⤵
- Executes dropped EXE
PID:2860 -
\??\c:\dpjvd.exec:\dpjvd.exe59⤵
- Executes dropped EXE
PID:2976 -
\??\c:\424066.exec:\424066.exe60⤵
- Executes dropped EXE
PID:2184 -
\??\c:\dvdvj.exec:\dvdvj.exe61⤵
- Executes dropped EXE
PID:2168 -
\??\c:\42440.exec:\42440.exe62⤵
- Executes dropped EXE
PID:2376 -
\??\c:\c484620.exec:\c484620.exe63⤵
- Executes dropped EXE
PID:2844 -
\??\c:\64240.exec:\64240.exe64⤵
- Executes dropped EXE
PID:2136 -
\??\c:\3rxfflr.exec:\3rxfflr.exe65⤵
- Executes dropped EXE
PID:2652 -
\??\c:\btttbb.exec:\btttbb.exe66⤵PID:1848
-
\??\c:\9ppvv.exec:\9ppvv.exe67⤵PID:828
-
\??\c:\0282224.exec:\0282224.exe68⤵PID:1308
-
\??\c:\5lflrrr.exec:\5lflrrr.exe69⤵PID:1532
-
\??\c:\fxlxffl.exec:\fxlxffl.exe70⤵PID:824
-
\??\c:\080284.exec:\080284.exe71⤵PID:1728
-
\??\c:\xlxxfxx.exec:\xlxxfxx.exe72⤵PID:1712
-
\??\c:\042402.exec:\042402.exe73⤵PID:2884
-
\??\c:\644044.exec:\644044.exe74⤵PID:684
-
\??\c:\228084.exec:\228084.exe75⤵PID:1360
-
\??\c:\htttbh.exec:\htttbh.exe76⤵PID:560
-
\??\c:\2640248.exec:\2640248.exe77⤵PID:1472
-
\??\c:\8262068.exec:\8262068.exe78⤵PID:2056
-
\??\c:\4240224.exec:\4240224.exe79⤵PID:1356
-
\??\c:\844286.exec:\844286.exe80⤵PID:1776
-
\??\c:\lflfffr.exec:\lflfffr.exe81⤵PID:340
-
\??\c:\08068.exec:\08068.exe82⤵PID:2360
-
\??\c:\vjvvj.exec:\vjvvj.exe83⤵PID:1584
-
\??\c:\1lfxxlr.exec:\1lfxxlr.exe84⤵PID:2980
-
\??\c:\426806.exec:\426806.exe85⤵PID:2912
-
\??\c:\420222.exec:\420222.exe86⤵PID:1452
-
\??\c:\a2004.exec:\a2004.exe87⤵PID:2644
-
\??\c:\9nnhbb.exec:\9nnhbb.exe88⤵PID:2748
-
\??\c:\k08428.exec:\k08428.exe89⤵PID:2440
-
\??\c:\jddjp.exec:\jddjp.exe90⤵PID:2704
-
\??\c:\c640628.exec:\c640628.exe91⤵PID:2724
-
\??\c:\20240.exec:\20240.exe92⤵PID:2656
-
\??\c:\826628.exec:\826628.exe93⤵PID:2780
-
\??\c:\pvjdd.exec:\pvjdd.exe94⤵PID:2560
-
\??\c:\060028.exec:\060028.exe95⤵PID:3004
-
\??\c:\6088444.exec:\6088444.exe96⤵PID:2444
-
\??\c:\880246.exec:\880246.exe97⤵PID:1656
-
\??\c:\u262884.exec:\u262884.exe98⤵PID:2428
-
\??\c:\bnhhth.exec:\bnhhth.exe99⤵PID:2364
-
\??\c:\i462266.exec:\i462266.exe100⤵PID:276
-
\??\c:\046284.exec:\046284.exe101⤵PID:548
-
\??\c:\3vdjj.exec:\3vdjj.exe102⤵PID:1764
-
\??\c:\802226.exec:\802226.exe103⤵PID:2456
-
\??\c:\08040.exec:\08040.exe104⤵PID:1660
-
\??\c:\lfrxflr.exec:\lfrxflr.exe105⤵PID:2612
-
\??\c:\pdvjj.exec:\pdvjj.exe106⤵PID:1708
-
\??\c:\nhbhbb.exec:\nhbhbb.exe107⤵PID:1628
-
\??\c:\7xrflfl.exec:\7xrflfl.exe108⤵PID:2120
-
\??\c:\7rxxlrf.exec:\7rxxlrf.exe109⤵PID:2064
-
\??\c:\hbbhhh.exec:\hbbhhh.exe110⤵PID:2424
-
\??\c:\pdpjp.exec:\pdpjp.exe111⤵PID:1524
-
\??\c:\864828.exec:\864828.exe112⤵PID:2880
-
\??\c:\3bnhnn.exec:\3bnhnn.exe113⤵PID:2432
-
\??\c:\424488.exec:\424488.exe114⤵PID:944
-
\??\c:\thhbbh.exec:\thhbbh.exe115⤵PID:1608
-
\??\c:\a2406.exec:\a2406.exe116⤵PID:612
-
\??\c:\426222.exec:\426222.exe117⤵PID:604
-
\??\c:\flrrfrr.exec:\flrrfrr.exe118⤵PID:1528
-
\??\c:\w20240.exec:\w20240.exe119⤵PID:1368
-
\??\c:\s0868.exec:\s0868.exe120⤵PID:1980
-
\??\c:\fxrrrrx.exec:\fxrrrrx.exe121⤵PID:2352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-