Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 22:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
50482ce2f76b3320f3b6110ba5648246e2ac4ae05f262698493a07aeb9eb2393.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
General
-
Target
50482ce2f76b3320f3b6110ba5648246e2ac4ae05f262698493a07aeb9eb2393.exe
-
Size
454KB
-
MD5
f0ab189a2b8e4b5e1167a4067197abd6
-
SHA1
a456bb2556840390172b6f2008b1495a1917fea1
-
SHA256
50482ce2f76b3320f3b6110ba5648246e2ac4ae05f262698493a07aeb9eb2393
-
SHA512
ee0600d6e85652e318680a454fa72821de7cf2bddf6d971b5a4316d1e7d5259e58a5dd2b0720f29fd5f96a8f9987014f0ef75096fb53c07a3e09b99175d33f29
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeF:q7Tc2NYHUrAwfMp3CDF
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2484-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-68-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2716-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/684-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-165-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2184-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-193-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2896-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1228-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-316-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2712-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-396-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2132-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/620-535-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/488-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-604-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2004-694-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-703-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2276-722-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1480-745-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2032-768-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-775-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/640-788-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1928-796-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1736-811-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-933-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2596-932-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2020-1098-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1076-1136-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2508 nnbhtb.exe 2308 o028406.exe 1952 7rlrlrx.exe 2344 lfrxfxl.exe 2456 3rllxfl.exe 2784 hhhhnh.exe 2716 djjvj.exe 2000 nhtbnt.exe 2920 7vvdj.exe 2672 m4662.exe 2624 2200224.exe 2232 xxllxxr.exe 684 dvjpd.exe 1732 664048.exe 1248 xlffllf.exe 1160 60802.exe 2868 c204066.exe 816 200444.exe 2184 02402.exe 2896 08444.exe 1088 thhhnh.exe 2844 lxlfxrx.exe 1928 0800044.exe 828 1jpjv.exe 1824 2462440.exe 1036 frfrfff.exe 1852 vppvv.exe 2416 xlxxfxl.exe 2204 c822402.exe 2288 jvdjp.exe 2424 lfrrxxx.exe 540 7pvdd.exe 2100 tbbtbt.exe 1228 ttbbbb.exe 1972 ppjvp.exe 2308 nnntnt.exe 1712 5frrffl.exe 1748 g4284.exe 2816 082244.exe 2712 hbtbhn.exe 2792 9bnnnh.exe 2716 444286.exe 2780 ntthhh.exe 2584 204422.exe 2616 vpvdj.exe 2556 llxfllx.exe 2632 vjvvp.exe 2132 9xrrxfr.exe 840 5btbnt.exe 2092 dvjpv.exe 684 jppjp.exe 2312 o824888.exe 1588 8644284.exe 1764 bnbbbb.exe 1908 k42848.exe 2912 u840222.exe 2452 pdppv.exe 2900 rlflfrl.exe 2160 lxrrxxf.exe 2892 604028.exe 2864 thbbhh.exe 1796 3xrxxxf.exe 1720 bnhthh.exe 2404 9lxfffl.exe -
resource yara_rule behavioral1/memory/2484-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/488-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-597-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2712-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-768-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-797-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-812-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-811-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-925-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-971-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/356-1041-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-1073-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-1117-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60802.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m4606.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 424882.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g8280.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8640046.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o422864.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0264822.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2484 wrote to memory of 2508 2484 50482ce2f76b3320f3b6110ba5648246e2ac4ae05f262698493a07aeb9eb2393.exe 30 PID 2484 wrote to memory of 2508 2484 50482ce2f76b3320f3b6110ba5648246e2ac4ae05f262698493a07aeb9eb2393.exe 30 PID 2484 wrote to memory of 2508 2484 50482ce2f76b3320f3b6110ba5648246e2ac4ae05f262698493a07aeb9eb2393.exe 30 PID 2484 wrote to memory of 2508 2484 50482ce2f76b3320f3b6110ba5648246e2ac4ae05f262698493a07aeb9eb2393.exe 30 PID 2508 wrote to memory of 2308 2508 nnbhtb.exe 31 PID 2508 wrote to memory of 2308 2508 nnbhtb.exe 31 PID 2508 wrote to memory of 2308 2508 nnbhtb.exe 31 PID 2508 wrote to memory of 2308 2508 nnbhtb.exe 31 PID 2308 wrote to memory of 1952 2308 o028406.exe 32 PID 2308 wrote to memory of 1952 2308 o028406.exe 32 PID 2308 wrote to memory of 1952 2308 o028406.exe 32 PID 2308 wrote to memory of 1952 2308 o028406.exe 32 PID 1952 wrote to memory of 2344 1952 7rlrlrx.exe 33 PID 1952 wrote to memory of 2344 1952 7rlrlrx.exe 33 PID 1952 wrote to memory of 2344 1952 7rlrlrx.exe 33 PID 1952 wrote to memory of 2344 1952 7rlrlrx.exe 33 PID 2344 wrote to memory of 2456 2344 lfrxfxl.exe 34 PID 2344 wrote to memory of 2456 2344 lfrxfxl.exe 34 PID 2344 wrote to memory of 2456 2344 lfrxfxl.exe 34 PID 2344 wrote to memory of 2456 2344 lfrxfxl.exe 34 PID 2456 wrote to memory of 2784 2456 3rllxfl.exe 35 PID 2456 wrote to memory of 2784 2456 3rllxfl.exe 35 PID 2456 wrote to memory of 2784 2456 3rllxfl.exe 35 PID 2456 wrote to memory of 2784 2456 3rllxfl.exe 35 PID 2784 wrote to memory of 2716 2784 hhhhnh.exe 36 PID 2784 wrote to memory of 2716 2784 hhhhnh.exe 36 PID 2784 wrote to memory of 2716 2784 hhhhnh.exe 36 PID 2784 wrote to memory of 2716 2784 hhhhnh.exe 36 PID 2716 wrote to memory of 2000 2716 djjvj.exe 37 PID 2716 wrote to memory of 2000 2716 djjvj.exe 37 PID 2716 wrote to memory of 2000 2716 djjvj.exe 37 PID 2716 wrote to memory of 2000 2716 djjvj.exe 37 PID 2000 wrote to memory of 2920 2000 nhtbnt.exe 38 PID 2000 wrote to memory of 2920 2000 nhtbnt.exe 38 PID 2000 wrote to memory of 2920 2000 nhtbnt.exe 38 PID 2000 wrote to memory of 2920 2000 nhtbnt.exe 38 PID 2920 wrote to memory of 2672 2920 7vvdj.exe 39 PID 2920 wrote to memory of 2672 2920 7vvdj.exe 39 PID 2920 wrote to memory of 2672 2920 7vvdj.exe 39 PID 2920 wrote to memory of 2672 2920 7vvdj.exe 39 PID 2672 wrote to memory of 2624 2672 m4662.exe 40 PID 2672 wrote to memory of 2624 2672 m4662.exe 40 PID 2672 wrote to memory of 2624 2672 m4662.exe 40 PID 2672 wrote to memory of 2624 2672 m4662.exe 40 PID 2624 wrote to memory of 2232 2624 2200224.exe 41 PID 2624 wrote to memory of 2232 2624 2200224.exe 41 PID 2624 wrote to memory of 2232 2624 2200224.exe 41 PID 2624 wrote to memory of 2232 2624 2200224.exe 41 PID 2232 wrote to memory of 684 2232 xxllxxr.exe 42 PID 2232 wrote to memory of 684 2232 xxllxxr.exe 42 PID 2232 wrote to memory of 684 2232 xxllxxr.exe 42 PID 2232 wrote to memory of 684 2232 xxllxxr.exe 42 PID 684 wrote to memory of 1732 684 dvjpd.exe 43 PID 684 wrote to memory of 1732 684 dvjpd.exe 43 PID 684 wrote to memory of 1732 684 dvjpd.exe 43 PID 684 wrote to memory of 1732 684 dvjpd.exe 43 PID 1732 wrote to memory of 1248 1732 664048.exe 44 PID 1732 wrote to memory of 1248 1732 664048.exe 44 PID 1732 wrote to memory of 1248 1732 664048.exe 44 PID 1732 wrote to memory of 1248 1732 664048.exe 44 PID 1248 wrote to memory of 1160 1248 xlffllf.exe 45 PID 1248 wrote to memory of 1160 1248 xlffllf.exe 45 PID 1248 wrote to memory of 1160 1248 xlffllf.exe 45 PID 1248 wrote to memory of 1160 1248 xlffllf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\50482ce2f76b3320f3b6110ba5648246e2ac4ae05f262698493a07aeb9eb2393.exe"C:\Users\Admin\AppData\Local\Temp\50482ce2f76b3320f3b6110ba5648246e2ac4ae05f262698493a07aeb9eb2393.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\nnbhtb.exec:\nnbhtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\o028406.exec:\o028406.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\7rlrlrx.exec:\7rlrlrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\lfrxfxl.exec:\lfrxfxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\3rllxfl.exec:\3rllxfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\hhhhnh.exec:\hhhhnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\djjvj.exec:\djjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\nhtbnt.exec:\nhtbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\7vvdj.exec:\7vvdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\m4662.exec:\m4662.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\2200224.exec:\2200224.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\xxllxxr.exec:\xxllxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\dvjpd.exec:\dvjpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\664048.exec:\664048.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\xlffllf.exec:\xlffllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\60802.exec:\60802.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1160 -
\??\c:\c204066.exec:\c204066.exe18⤵
- Executes dropped EXE
PID:2868 -
\??\c:\200444.exec:\200444.exe19⤵
- Executes dropped EXE
PID:816 -
\??\c:\02402.exec:\02402.exe20⤵
- Executes dropped EXE
PID:2184 -
\??\c:\08444.exec:\08444.exe21⤵
- Executes dropped EXE
PID:2896 -
\??\c:\thhhnh.exec:\thhhnh.exe22⤵
- Executes dropped EXE
PID:1088 -
\??\c:\lxlfxrx.exec:\lxlfxrx.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2844 -
\??\c:\0800044.exec:\0800044.exe24⤵
- Executes dropped EXE
PID:1928 -
\??\c:\1jpjv.exec:\1jpjv.exe25⤵
- Executes dropped EXE
PID:828 -
\??\c:\2462440.exec:\2462440.exe26⤵
- Executes dropped EXE
PID:1824 -
\??\c:\frfrfff.exec:\frfrfff.exe27⤵
- Executes dropped EXE
PID:1036 -
\??\c:\vppvv.exec:\vppvv.exe28⤵
- Executes dropped EXE
PID:1852 -
\??\c:\xlxxfxl.exec:\xlxxfxl.exe29⤵
- Executes dropped EXE
PID:2416 -
\??\c:\c822402.exec:\c822402.exe30⤵
- Executes dropped EXE
PID:2204 -
\??\c:\jvdjp.exec:\jvdjp.exe31⤵
- Executes dropped EXE
PID:2288 -
\??\c:\lfrrxxx.exec:\lfrrxxx.exe32⤵
- Executes dropped EXE
PID:2424 -
\??\c:\7pvdd.exec:\7pvdd.exe33⤵
- Executes dropped EXE
PID:540 -
\??\c:\tbbtbt.exec:\tbbtbt.exe34⤵
- Executes dropped EXE
PID:2100 -
\??\c:\ttbbbb.exec:\ttbbbb.exe35⤵
- Executes dropped EXE
PID:1228 -
\??\c:\ppjvp.exec:\ppjvp.exe36⤵
- Executes dropped EXE
PID:1972 -
\??\c:\nnntnt.exec:\nnntnt.exe37⤵
- Executes dropped EXE
PID:2308 -
\??\c:\5frrffl.exec:\5frrffl.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1712 -
\??\c:\g4284.exec:\g4284.exe39⤵
- Executes dropped EXE
PID:1748 -
\??\c:\082244.exec:\082244.exe40⤵
- Executes dropped EXE
PID:2816 -
\??\c:\hbtbhn.exec:\hbtbhn.exe41⤵
- Executes dropped EXE
PID:2712 -
\??\c:\9bnnnh.exec:\9bnnnh.exe42⤵
- Executes dropped EXE
PID:2792 -
\??\c:\444286.exec:\444286.exe43⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ntthhh.exec:\ntthhh.exe44⤵
- Executes dropped EXE
PID:2780 -
\??\c:\204422.exec:\204422.exe45⤵
- Executes dropped EXE
PID:2584 -
\??\c:\vpvdj.exec:\vpvdj.exe46⤵
- Executes dropped EXE
PID:2616 -
\??\c:\llxfllx.exec:\llxfllx.exe47⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vjvvp.exec:\vjvvp.exe48⤵
- Executes dropped EXE
PID:2632 -
\??\c:\9xrrxfr.exec:\9xrrxfr.exe49⤵
- Executes dropped EXE
PID:2132 -
\??\c:\5btbnt.exec:\5btbnt.exe50⤵
- Executes dropped EXE
PID:840 -
\??\c:\dvjpv.exec:\dvjpv.exe51⤵
- Executes dropped EXE
PID:2092 -
\??\c:\jppjp.exec:\jppjp.exe52⤵
- Executes dropped EXE
PID:684 -
\??\c:\o824888.exec:\o824888.exe53⤵
- Executes dropped EXE
PID:2312 -
\??\c:\8644284.exec:\8644284.exe54⤵
- Executes dropped EXE
PID:1588 -
\??\c:\bnbbbb.exec:\bnbbbb.exe55⤵
- Executes dropped EXE
PID:1764 -
\??\c:\k42848.exec:\k42848.exe56⤵
- Executes dropped EXE
PID:1908 -
\??\c:\u840222.exec:\u840222.exe57⤵
- Executes dropped EXE
PID:2912 -
\??\c:\pdppv.exec:\pdppv.exe58⤵
- Executes dropped EXE
PID:2452 -
\??\c:\rlflfrl.exec:\rlflfrl.exe59⤵
- Executes dropped EXE
PID:2900 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe60⤵
- Executes dropped EXE
PID:2160 -
\??\c:\604028.exec:\604028.exe61⤵
- Executes dropped EXE
PID:2892 -
\??\c:\thbbhh.exec:\thbbhh.exe62⤵
- Executes dropped EXE
PID:2864 -
\??\c:\3xrxxxf.exec:\3xrxxxf.exe63⤵
- Executes dropped EXE
PID:1796 -
\??\c:\bnhthh.exec:\bnhthh.exe64⤵
- Executes dropped EXE
PID:1720 -
\??\c:\9lxfffl.exec:\9lxfffl.exe65⤵
- Executes dropped EXE
PID:2404 -
\??\c:\xrrlrxr.exec:\xrrlrxr.exe66⤵PID:1204
-
\??\c:\6428044.exec:\6428044.exe67⤵PID:620
-
\??\c:\9dppd.exec:\9dppd.exe68⤵PID:920
-
\??\c:\2022284.exec:\2022284.exe69⤵PID:1532
-
\??\c:\8628884.exec:\8628884.exe70⤵PID:760
-
\??\c:\246004.exec:\246004.exe71⤵PID:488
-
\??\c:\9frxflx.exec:\9frxflx.exe72⤵PID:1516
-
\??\c:\k26622.exec:\k26622.exe73⤵PID:2400
-
\??\c:\dvppv.exec:\dvppv.exe74⤵PID:884
-
\??\c:\bnbbbb.exec:\bnbbbb.exe75⤵PID:2208
-
\??\c:\7bnntb.exec:\7bnntb.exe76⤵PID:1492
-
\??\c:\08468.exec:\08468.exe77⤵PID:2512
-
\??\c:\9jvvd.exec:\9jvvd.exe78⤵PID:2196
-
\??\c:\nbnntn.exec:\nbnntn.exe79⤵PID:1952
-
\??\c:\4260680.exec:\4260680.exe80⤵PID:3044
-
\??\c:\7btttn.exec:\7btttn.exe81⤵PID:2456
-
\??\c:\rflflxf.exec:\rflflxf.exe82⤵PID:2796
-
\??\c:\7pvvv.exec:\7pvvv.exe83⤵PID:2840
-
\??\c:\3frlfxx.exec:\3frlfxx.exe84⤵PID:2704
-
\??\c:\02882.exec:\02882.exe85⤵PID:2712
-
\??\c:\vvjvd.exec:\vvjvd.exe86⤵PID:2756
-
\??\c:\frfffxf.exec:\frfffxf.exe87⤵PID:2716
-
\??\c:\dpddj.exec:\dpddj.exe88⤵PID:2596
-
\??\c:\s8628.exec:\s8628.exe89⤵PID:2692
-
\??\c:\608406.exec:\608406.exe90⤵PID:2616
-
\??\c:\jjjdj.exec:\jjjdj.exe91⤵PID:2556
-
\??\c:\880404.exec:\880404.exe92⤵PID:2592
-
\??\c:\xrffxxf.exec:\xrffxxf.exe93⤵PID:3036
-
\??\c:\jvpvj.exec:\jvpvj.exe94⤵PID:2608
-
\??\c:\7ffrlfx.exec:\7ffrlfx.exe95⤵PID:2004
-
\??\c:\488462.exec:\488462.exe96⤵PID:860
-
\??\c:\86882.exec:\86882.exe97⤵PID:1668
-
\??\c:\26224.exec:\26224.exe98⤵PID:1948
-
\??\c:\9nnnhb.exec:\9nnnhb.exe99⤵PID:2276
-
\??\c:\vpdpd.exec:\vpdpd.exe100⤵PID:3016
-
\??\c:\6040224.exec:\6040224.exe101⤵PID:2912
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe102⤵PID:2452
-
\??\c:\20662.exec:\20662.exe103⤵PID:1480
-
\??\c:\m2062.exec:\m2062.exe104⤵PID:2160
-
\??\c:\0288488.exec:\0288488.exe105⤵PID:1460
-
\??\c:\xxlfxlr.exec:\xxlfxlr.exe106⤵PID:2032
-
\??\c:\hhbbhh.exec:\hhbbhh.exe107⤵PID:1928
-
\??\c:\48444.exec:\48444.exe108⤵PID:1064
-
\??\c:\1vdvv.exec:\1vdvv.exe109⤵PID:640
-
\??\c:\xlllrll.exec:\xlllrll.exe110⤵PID:1356
-
\??\c:\thtnnn.exec:\thtnnn.exe111⤵PID:2968
-
\??\c:\jvjjv.exec:\jvjjv.exe112⤵PID:1736
-
\??\c:\rlrffrf.exec:\rlrffrf.exe113⤵PID:2124
-
\??\c:\a8624.exec:\a8624.exe114⤵PID:2076
-
\??\c:\20222.exec:\20222.exe115⤵PID:2288
-
\??\c:\26846.exec:\26846.exe116⤵PID:584
-
\??\c:\1lrrrrr.exec:\1lrrrrr.exe117⤵PID:2024
-
\??\c:\pjpjd.exec:\pjpjd.exe118⤵PID:2508
-
\??\c:\5lxxrlr.exec:\5lxxrlr.exe119⤵PID:1076
-
\??\c:\xlxxfxl.exec:\xlxxfxl.exe120⤵
- System Location Discovery: System Language Discovery
PID:2096 -
\??\c:\fxlflfl.exec:\fxlflfl.exe121⤵PID:1608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-