Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08/01/2025, 07:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f568fe920c9ae0ec8625d5769885091e016ca5fa7878db173ba429ed2c3aef36N.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
f568fe920c9ae0ec8625d5769885091e016ca5fa7878db173ba429ed2c3aef36N.exe
-
Size
455KB
-
MD5
90863307f046bee34d1c0e42de87ece0
-
SHA1
200963cea7ea5d2c1c728bfc27cc97833df4ceaa
-
SHA256
f568fe920c9ae0ec8625d5769885091e016ca5fa7878db173ba429ed2c3aef36
-
SHA512
54e05ab59efdca7b44ce38be0702030fe92e8c8a53a4a9f563e1ccc7787f10261cc3faae50703dc2266946336b656a285210eaec05a2a090b15f6fc26b3b636b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT1:q7Tc2NYHUrAwfMp3CDB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/1720-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-25-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1976-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-61-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2916-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/632-153-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1696-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-291-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1964-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-331-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2740-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/688-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-690-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1776-703-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-773-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-780-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/768-788-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2348-830-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1980-863-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-914-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-921-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-1186-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1812-1262-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/756-1275-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2728-1284-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/756-1295-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2296 m0828.exe 2276 426240.exe 1976 7frxffl.exe 2504 tbnnth.exe 2896 020622.exe 2760 3fxlrrx.exe 2916 9dpvd.exe 1948 8206228.exe 2808 1rfflxl.exe 2756 nhhthn.exe 2396 48002.exe 1808 6400600.exe 2832 w64466.exe 2064 9dvvd.exe 2928 8824064.exe 632 lrlxrlf.exe 1696 ppjvj.exe 2996 ffflrrr.exe 2368 3btbnt.exe 2148 1hhnbh.exe 3068 88064.exe 2976 djdpd.exe 1348 fffrxfr.exe 1124 1ppdp.exe 1252 0428668.exe 604 48280.exe 1388 flxxlff.exe 2500 0488086.exe 2140 046862.exe 2100 7dpvd.exe 872 486246.exe 1004 jdjpv.exe 2248 xxrfxrf.exe 1700 44846.exe 1972 tnnnht.exe 1964 ppdjp.exe 2276 8808020.exe 2572 lxxxrxf.exe 2740 84426.exe 3056 2266220.exe 2200 9vjjv.exe 2760 486800.exe 2668 pddjp.exe 2688 806844.exe 1948 ffllllx.exe 2808 8204228.exe 2696 8646268.exe 1196 vpdjv.exe 536 bthnbb.exe 1800 2640628.exe 2832 rfllllx.exe 1336 o202406.exe 2064 ntthth.exe 2928 ffrxflr.exe 688 i488602.exe 2828 fflrxxx.exe 3008 5xlrxxf.exe 2732 2206880.exe 2392 jdvvd.exe 3024 26064.exe 2400 4648440.exe 3064 600246.exe 2136 1pjvj.exe 1892 k42866.exe -
resource yara_rule behavioral1/memory/1720-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-291-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1964-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/688-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/688-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-651-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2676-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-723-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-780-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/768-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-844-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-864-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-863-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-914-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-921-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-1123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-1149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-1205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-1212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-1296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-1353-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4806884.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 206004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 426828.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0468620.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e60022.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4228068.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60868.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66402.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1720 wrote to memory of 2296 1720 f568fe920c9ae0ec8625d5769885091e016ca5fa7878db173ba429ed2c3aef36N.exe 31 PID 1720 wrote to memory of 2296 1720 f568fe920c9ae0ec8625d5769885091e016ca5fa7878db173ba429ed2c3aef36N.exe 31 PID 1720 wrote to memory of 2296 1720 f568fe920c9ae0ec8625d5769885091e016ca5fa7878db173ba429ed2c3aef36N.exe 31 PID 1720 wrote to memory of 2296 1720 f568fe920c9ae0ec8625d5769885091e016ca5fa7878db173ba429ed2c3aef36N.exe 31 PID 2296 wrote to memory of 2276 2296 m0828.exe 32 PID 2296 wrote to memory of 2276 2296 m0828.exe 32 PID 2296 wrote to memory of 2276 2296 m0828.exe 32 PID 2296 wrote to memory of 2276 2296 m0828.exe 32 PID 2276 wrote to memory of 1976 2276 426240.exe 33 PID 2276 wrote to memory of 1976 2276 426240.exe 33 PID 2276 wrote to memory of 1976 2276 426240.exe 33 PID 2276 wrote to memory of 1976 2276 426240.exe 33 PID 1976 wrote to memory of 2504 1976 7frxffl.exe 34 PID 1976 wrote to memory of 2504 1976 7frxffl.exe 34 PID 1976 wrote to memory of 2504 1976 7frxffl.exe 34 PID 1976 wrote to memory of 2504 1976 7frxffl.exe 34 PID 2504 wrote to memory of 2896 2504 tbnnth.exe 35 PID 2504 wrote to memory of 2896 2504 tbnnth.exe 35 PID 2504 wrote to memory of 2896 2504 tbnnth.exe 35 PID 2504 wrote to memory of 2896 2504 tbnnth.exe 35 PID 2896 wrote to memory of 2760 2896 020622.exe 36 PID 2896 wrote to memory of 2760 2896 020622.exe 36 PID 2896 wrote to memory of 2760 2896 020622.exe 36 PID 2896 wrote to memory of 2760 2896 020622.exe 36 PID 2760 wrote to memory of 2916 2760 3fxlrrx.exe 37 PID 2760 wrote to memory of 2916 2760 3fxlrrx.exe 37 PID 2760 wrote to memory of 2916 2760 3fxlrrx.exe 37 PID 2760 wrote to memory of 2916 2760 3fxlrrx.exe 37 PID 2916 wrote to memory of 1948 2916 9dpvd.exe 38 PID 2916 wrote to memory of 1948 2916 9dpvd.exe 38 PID 2916 wrote to memory of 1948 2916 9dpvd.exe 38 PID 2916 wrote to memory of 1948 2916 9dpvd.exe 38 PID 1948 wrote to memory of 2808 1948 8206228.exe 39 PID 1948 wrote to memory of 2808 1948 8206228.exe 39 PID 1948 wrote to memory of 2808 1948 8206228.exe 39 PID 1948 wrote to memory of 2808 1948 8206228.exe 39 PID 2808 wrote to memory of 2756 2808 1rfflxl.exe 40 PID 2808 wrote to memory of 2756 2808 1rfflxl.exe 40 PID 2808 wrote to memory of 2756 2808 1rfflxl.exe 40 PID 2808 wrote to memory of 2756 2808 1rfflxl.exe 40 PID 2756 wrote to memory of 2396 2756 nhhthn.exe 41 PID 2756 wrote to memory of 2396 2756 nhhthn.exe 41 PID 2756 wrote to memory of 2396 2756 nhhthn.exe 41 PID 2756 wrote to memory of 2396 2756 nhhthn.exe 41 PID 2396 wrote to memory of 1808 2396 48002.exe 42 PID 2396 wrote to memory of 1808 2396 48002.exe 42 PID 2396 wrote to memory of 1808 2396 48002.exe 42 PID 2396 wrote to memory of 1808 2396 48002.exe 42 PID 1808 wrote to memory of 2832 1808 6400600.exe 43 PID 1808 wrote to memory of 2832 1808 6400600.exe 43 PID 1808 wrote to memory of 2832 1808 6400600.exe 43 PID 1808 wrote to memory of 2832 1808 6400600.exe 43 PID 2832 wrote to memory of 2064 2832 w64466.exe 44 PID 2832 wrote to memory of 2064 2832 w64466.exe 44 PID 2832 wrote to memory of 2064 2832 w64466.exe 44 PID 2832 wrote to memory of 2064 2832 w64466.exe 44 PID 2064 wrote to memory of 2928 2064 9dvvd.exe 45 PID 2064 wrote to memory of 2928 2064 9dvvd.exe 45 PID 2064 wrote to memory of 2928 2064 9dvvd.exe 45 PID 2064 wrote to memory of 2928 2064 9dvvd.exe 45 PID 2928 wrote to memory of 632 2928 8824064.exe 46 PID 2928 wrote to memory of 632 2928 8824064.exe 46 PID 2928 wrote to memory of 632 2928 8824064.exe 46 PID 2928 wrote to memory of 632 2928 8824064.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\f568fe920c9ae0ec8625d5769885091e016ca5fa7878db173ba429ed2c3aef36N.exe"C:\Users\Admin\AppData\Local\Temp\f568fe920c9ae0ec8625d5769885091e016ca5fa7878db173ba429ed2c3aef36N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\m0828.exec:\m0828.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\426240.exec:\426240.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\7frxffl.exec:\7frxffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\tbnnth.exec:\tbnnth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\020622.exec:\020622.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\3fxlrrx.exec:\3fxlrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\9dpvd.exec:\9dpvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\8206228.exec:\8206228.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\1rfflxl.exec:\1rfflxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\nhhthn.exec:\nhhthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\48002.exec:\48002.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\6400600.exec:\6400600.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\w64466.exec:\w64466.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\9dvvd.exec:\9dvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\8824064.exec:\8824064.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\lrlxrlf.exec:\lrlxrlf.exe17⤵
- Executes dropped EXE
PID:632 -
\??\c:\ppjvj.exec:\ppjvj.exe18⤵
- Executes dropped EXE
PID:1696 -
\??\c:\ffflrrr.exec:\ffflrrr.exe19⤵
- Executes dropped EXE
PID:2996 -
\??\c:\3btbnt.exec:\3btbnt.exe20⤵
- Executes dropped EXE
PID:2368 -
\??\c:\1hhnbh.exec:\1hhnbh.exe21⤵
- Executes dropped EXE
PID:2148 -
\??\c:\88064.exec:\88064.exe22⤵
- Executes dropped EXE
PID:3068 -
\??\c:\djdpd.exec:\djdpd.exe23⤵
- Executes dropped EXE
PID:2976 -
\??\c:\fffrxfr.exec:\fffrxfr.exe24⤵
- Executes dropped EXE
PID:1348 -
\??\c:\1ppdp.exec:\1ppdp.exe25⤵
- Executes dropped EXE
PID:1124 -
\??\c:\0428668.exec:\0428668.exe26⤵
- Executes dropped EXE
PID:1252 -
\??\c:\48280.exec:\48280.exe27⤵
- Executes dropped EXE
PID:604 -
\??\c:\flxxlff.exec:\flxxlff.exe28⤵
- Executes dropped EXE
PID:1388 -
\??\c:\0488086.exec:\0488086.exe29⤵
- Executes dropped EXE
PID:2500 -
\??\c:\046862.exec:\046862.exe30⤵
- Executes dropped EXE
PID:2140 -
\??\c:\7dpvd.exec:\7dpvd.exe31⤵
- Executes dropped EXE
PID:2100 -
\??\c:\486246.exec:\486246.exe32⤵
- Executes dropped EXE
PID:872 -
\??\c:\jdjpv.exec:\jdjpv.exe33⤵
- Executes dropped EXE
PID:1004 -
\??\c:\xxrfxrf.exec:\xxrfxrf.exe34⤵
- Executes dropped EXE
PID:2248 -
\??\c:\44846.exec:\44846.exe35⤵
- Executes dropped EXE
PID:1700 -
\??\c:\tnnnht.exec:\tnnnht.exe36⤵
- Executes dropped EXE
PID:1972 -
\??\c:\ppdjp.exec:\ppdjp.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1964 -
\??\c:\8808020.exec:\8808020.exe38⤵
- Executes dropped EXE
PID:2276 -
\??\c:\lxxxrxf.exec:\lxxxrxf.exe39⤵
- Executes dropped EXE
PID:2572 -
\??\c:\84426.exec:\84426.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\2266220.exec:\2266220.exe41⤵
- Executes dropped EXE
PID:3056 -
\??\c:\9vjjv.exec:\9vjjv.exe42⤵
- Executes dropped EXE
PID:2200 -
\??\c:\486800.exec:\486800.exe43⤵
- Executes dropped EXE
PID:2760 -
\??\c:\pddjp.exec:\pddjp.exe44⤵
- Executes dropped EXE
PID:2668 -
\??\c:\806844.exec:\806844.exe45⤵
- Executes dropped EXE
PID:2688 -
\??\c:\ffllllx.exec:\ffllllx.exe46⤵
- Executes dropped EXE
PID:1948 -
\??\c:\8204228.exec:\8204228.exe47⤵
- Executes dropped EXE
PID:2808 -
\??\c:\8646268.exec:\8646268.exe48⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vpdjv.exec:\vpdjv.exe49⤵
- Executes dropped EXE
PID:1196 -
\??\c:\bthnbb.exec:\bthnbb.exe50⤵
- Executes dropped EXE
PID:536 -
\??\c:\2640628.exec:\2640628.exe51⤵
- Executes dropped EXE
PID:1800 -
\??\c:\rfllllx.exec:\rfllllx.exe52⤵
- Executes dropped EXE
PID:2832 -
\??\c:\o202406.exec:\o202406.exe53⤵
- Executes dropped EXE
PID:1336 -
\??\c:\ntthth.exec:\ntthth.exe54⤵
- Executes dropped EXE
PID:2064 -
\??\c:\ffrxflr.exec:\ffrxflr.exe55⤵
- Executes dropped EXE
PID:2928 -
\??\c:\i488602.exec:\i488602.exe56⤵
- Executes dropped EXE
PID:688 -
\??\c:\fflrxxx.exec:\fflrxxx.exe57⤵
- Executes dropped EXE
PID:2828 -
\??\c:\5xlrxxf.exec:\5xlrxxf.exe58⤵
- Executes dropped EXE
PID:3008 -
\??\c:\2206880.exec:\2206880.exe59⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jdvvd.exec:\jdvvd.exe60⤵
- Executes dropped EXE
PID:2392 -
\??\c:\26064.exec:\26064.exe61⤵
- Executes dropped EXE
PID:3024 -
\??\c:\4648440.exec:\4648440.exe62⤵
- Executes dropped EXE
PID:2400 -
\??\c:\600246.exec:\600246.exe63⤵
- Executes dropped EXE
PID:3064 -
\??\c:\1pjvj.exec:\1pjvj.exe64⤵
- Executes dropped EXE
PID:2136 -
\??\c:\k42866.exec:\k42866.exe65⤵
- Executes dropped EXE
PID:1892 -
\??\c:\266422.exec:\266422.exe66⤵PID:2488
-
\??\c:\tbbnth.exec:\tbbnth.exe67⤵PID:2044
-
\??\c:\xxrrrrr.exec:\xxrrrrr.exe68⤵PID:1064
-
\??\c:\2084624.exec:\2084624.exe69⤵PID:2580
-
\??\c:\vpdjp.exec:\vpdjp.exe70⤵PID:2096
-
\??\c:\jpvdj.exec:\jpvdj.exe71⤵PID:2992
-
\??\c:\nhthbb.exec:\nhthbb.exe72⤵PID:1744
-
\??\c:\thnntt.exec:\thnntt.exe73⤵PID:3036
-
\??\c:\20284.exec:\20284.exe74⤵PID:812
-
\??\c:\fxllxxx.exec:\fxllxxx.exe75⤵PID:2100
-
\??\c:\hbnbht.exec:\hbnbht.exe76⤵PID:1824
-
\??\c:\c266446.exec:\c266446.exe77⤵PID:2208
-
\??\c:\lxflllx.exec:\lxflllx.exe78⤵PID:1568
-
\??\c:\20628.exec:\20628.exe79⤵PID:1956
-
\??\c:\fflrlxf.exec:\fflrlxf.exe80⤵PID:2608
-
\??\c:\q42840.exec:\q42840.exe81⤵PID:1028
-
\??\c:\9nhntt.exec:\9nhntt.exe82⤵PID:2724
-
\??\c:\vpvpp.exec:\vpvpp.exe83⤵PID:2436
-
\??\c:\rfrxffl.exec:\rfrxffl.exe84⤵PID:2572
-
\??\c:\866228.exec:\866228.exe85⤵PID:2792
-
\??\c:\1hbhnt.exec:\1hbhnt.exe86⤵PID:3040
-
\??\c:\6062868.exec:\6062868.exe87⤵PID:2200
-
\??\c:\4828606.exec:\4828606.exe88⤵PID:2916
-
\??\c:\hhhntt.exec:\hhhntt.exe89⤵PID:2844
-
\??\c:\5hbbhn.exec:\5hbbhn.exe90⤵PID:2912
-
\??\c:\hhtbnn.exec:\hhtbnn.exe91⤵PID:2704
-
\??\c:\ddppv.exec:\ddppv.exe92⤵PID:2808
-
\??\c:\djjvj.exec:\djjvj.exe93⤵PID:1448
-
\??\c:\3hnntt.exec:\3hnntt.exe94⤵PID:2676
-
\??\c:\60464.exec:\60464.exe95⤵PID:388
-
\??\c:\hhbbhn.exec:\hhbbhn.exe96⤵PID:1684
-
\??\c:\886688.exec:\886688.exe97⤵PID:2832
-
\??\c:\w60622.exec:\w60622.exe98⤵PID:1776
-
\??\c:\bbthnb.exec:\bbthnb.exe99⤵PID:2064
-
\??\c:\8200242.exec:\8200242.exe100⤵PID:2928
-
\??\c:\1tnnbh.exec:\1tnnbh.exe101⤵PID:2736
-
\??\c:\tnbnth.exec:\tnbnth.exe102⤵PID:1668
-
\??\c:\jjdpd.exec:\jjdpd.exe103⤵PID:3008
-
\??\c:\9ttntn.exec:\9ttntn.exe104⤵PID:2732
-
\??\c:\7vvdd.exec:\7vvdd.exe105⤵PID:2172
-
\??\c:\rrxrxfr.exec:\rrxrxfr.exe106⤵PID:3024
-
\??\c:\g6480.exec:\g6480.exe107⤵PID:1368
-
\??\c:\btnntt.exec:\btnntt.exe108⤵PID:3064
-
\??\c:\684864.exec:\684864.exe109⤵PID:2136
-
\??\c:\3xlrxlx.exec:\3xlrxlx.exe110⤵PID:1628
-
\??\c:\5bbnnb.exec:\5bbnnb.exe111⤵PID:768
-
\??\c:\0480280.exec:\0480280.exe112⤵PID:1380
-
\??\c:\hnhtnh.exec:\hnhtnh.exe113⤵PID:2144
-
\??\c:\1fxxrxl.exec:\1fxxrxl.exe114⤵PID:1548
-
\??\c:\882406.exec:\882406.exe115⤵PID:1276
-
\??\c:\e64406.exec:\e64406.exe116⤵PID:1648
-
\??\c:\2684668.exec:\2684668.exe117⤵PID:2060
-
\??\c:\htthtb.exec:\htthtb.exe118⤵PID:2348
-
\??\c:\pvpvp.exec:\pvpvp.exe119⤵PID:1056
-
\??\c:\9vvvp.exec:\9vvvp.exe120⤵PID:1264
-
\??\c:\jjdvd.exec:\jjdvd.exe121⤵PID:2300
-
\??\c:\vdpdd.exec:\vdpdd.exe122⤵PID:1584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-