Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:20
Behavioral task
behavioral1
Sample
51851b97d775370d03b01fe3ced2ccae4a39acd7ec03829d5441753451c44eabN.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
120 seconds
General
-
Target
51851b97d775370d03b01fe3ced2ccae4a39acd7ec03829d5441753451c44eabN.exe
-
Size
332KB
-
MD5
49b8cee86dfaeff949bf8517eed8fa10
-
SHA1
a54eca9847be613c4986d29ff4d7c64510f5afb1
-
SHA256
51851b97d775370d03b01fe3ced2ccae4a39acd7ec03829d5441753451c44eab
-
SHA512
42bed9e7d996cc689b08cfb4d2ad817a96296af727f8c69c50c8bcc797fc49c6305eef024fce4f2e6c1117b20d23aa7e5314b723829da82f7835e559a01acb96
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbe4:R4wFHoSHYHUrAwfMp3CD4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/848-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1860-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-32-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2788-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-51-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2900-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2140-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2012-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1000-165-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2552-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1292-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1892-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1788-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/788-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/892-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/884-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1532-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2280-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-350-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3052-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/580-399-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3028-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1292-488-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1688-511-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-663-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1808-695-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1628-711-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/868-760-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2844-844-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2844-846-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-878-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1916-979-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1212-1306-0x0000000077380000-0x000000007747A000-memory.dmp family_blackmoon behavioral1/memory/1212-1305-0x0000000077260000-0x000000007737F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1860 64802.exe 2508 9frlrrx.exe 2312 206682.exe 2788 8028460.exe 2900 dvpdp.exe 2852 9llfxrr.exe 2140 7vjjp.exe 2720 bthhth.exe 2868 u480628.exe 2708 w00460.exe 352 bttnnh.exe 2736 xfxxllr.exe 2012 2668020.exe 3004 04624.exe 2764 jjjvp.exe 2880 606288.exe 560 860240.exe 2028 6406240.exe 1000 frffllr.exe 2564 828240.exe 2552 2086460.exe 2392 vdpvv.exe 2176 bbbbnn.exe 112 88266.exe 604 42668.exe 1292 9jvjv.exe 1892 xlxxfll.exe 868 rllxflr.exe 2480 6042828.exe 1164 pjjpj.exe 788 26244.exe 1788 48686.exe 892 htntht.exe 884 e68068.exe 2380 jjpdj.exe 1460 640448.exe 1532 6084002.exe 2504 64228.exe 2620 jvdpp.exe 2280 e22462.exe 2228 xrfrxxf.exe 2844 8266828.exe 2940 llllrxf.exe 2904 9xlrrlx.exe 2320 2084044.exe 2812 vjvdj.exe 2716 486600.exe 2872 fxfxrlr.exe 2912 868462.exe 2868 e42022.exe 2708 2028068.exe 1252 pjdjp.exe 1412 0084006.exe 1512 thtnnn.exe 3052 e84866.exe 580 bnhtbt.exe 2992 806288.exe 2764 xlrflfx.exe 1432 428844.exe 3028 0064466.exe 2664 xfrxffl.exe 1360 g2846.exe 2116 420684.exe 2244 48284.exe -
resource yara_rule behavioral1/memory/848-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000012117-5.dat upx behavioral1/memory/848-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2508-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d81-24.dat upx behavioral1/files/0x0007000000015d79-17.dat upx behavioral1/memory/1860-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2788-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2312-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d89-33.dat upx behavioral1/memory/2312-31-0x00000000003A0000-0x00000000003C7000-memory.dmp upx behavioral1/files/0x0007000000015ec4-43.dat upx behavioral1/memory/2900-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2788-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015f25-52.dat upx behavioral1/memory/2900-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015f7b-61.dat upx behavioral1/memory/2852-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001610d-69.dat upx behavioral1/memory/2140-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2720-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d43-77.dat upx behavioral1/files/0x0006000000016d4b-87.dat upx behavioral1/memory/2708-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d54-94.dat upx behavioral1/memory/2708-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d67-104.dat upx behavioral1/files/0x0006000000016d6b-111.dat upx behavioral1/memory/2736-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2012-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015d2a-118.dat upx behavioral1/files/0x0006000000016d6f-126.dat upx behavioral1/files/0x0006000000016d77-134.dat upx behavioral1/files/0x0006000000016d9f-142.dat upx behavioral1/memory/2880-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016de8-150.dat upx behavioral1/files/0x0006000000016dea-157.dat upx behavioral1/files/0x0006000000016df3-166.dat upx behavioral1/files/0x0006000000016ecf-175.dat upx behavioral1/memory/2552-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017049-182.dat upx behavioral1/memory/2552-181-0x00000000002A0000-0x00000000002C7000-memory.dmp upx behavioral1/memory/2392-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017497-191.dat upx behavioral1/files/0x000600000001749c-198.dat upx behavioral1/files/0x000600000001755b-205.dat upx behavioral1/files/0x00050000000186e7-221.dat upx behavioral1/memory/1292-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1292-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018686-213.dat upx behavioral1/files/0x00050000000186ed-228.dat upx behavioral1/memory/1892-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186f1-236.dat upx behavioral1/files/0x00050000000186f4-243.dat upx behavioral1/files/0x0005000000018704-250.dat upx behavioral1/memory/1788-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018739-259.dat upx behavioral1/memory/788-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/892-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/884-277-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1460-288-0x00000000002B0000-0x00000000002D7000-memory.dmp upx behavioral1/memory/1532-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2504-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2280-311-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 042844.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e84866.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 046244.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxlllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 080626.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 608400.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 048444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i468006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 046666.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 848 wrote to memory of 1860 848 51851b97d775370d03b01fe3ced2ccae4a39acd7ec03829d5441753451c44eabN.exe 30 PID 848 wrote to memory of 1860 848 51851b97d775370d03b01fe3ced2ccae4a39acd7ec03829d5441753451c44eabN.exe 30 PID 848 wrote to memory of 1860 848 51851b97d775370d03b01fe3ced2ccae4a39acd7ec03829d5441753451c44eabN.exe 30 PID 848 wrote to memory of 1860 848 51851b97d775370d03b01fe3ced2ccae4a39acd7ec03829d5441753451c44eabN.exe 30 PID 1860 wrote to memory of 2508 1860 64802.exe 31 PID 1860 wrote to memory of 2508 1860 64802.exe 31 PID 1860 wrote to memory of 2508 1860 64802.exe 31 PID 1860 wrote to memory of 2508 1860 64802.exe 31 PID 2508 wrote to memory of 2312 2508 9frlrrx.exe 32 PID 2508 wrote to memory of 2312 2508 9frlrrx.exe 32 PID 2508 wrote to memory of 2312 2508 9frlrrx.exe 32 PID 2508 wrote to memory of 2312 2508 9frlrrx.exe 32 PID 2312 wrote to memory of 2788 2312 206682.exe 33 PID 2312 wrote to memory of 2788 2312 206682.exe 33 PID 2312 wrote to memory of 2788 2312 206682.exe 33 PID 2312 wrote to memory of 2788 2312 206682.exe 33 PID 2788 wrote to memory of 2900 2788 8028460.exe 34 PID 2788 wrote to memory of 2900 2788 8028460.exe 34 PID 2788 wrote to memory of 2900 2788 8028460.exe 34 PID 2788 wrote to memory of 2900 2788 8028460.exe 34 PID 2900 wrote to memory of 2852 2900 dvpdp.exe 35 PID 2900 wrote to memory of 2852 2900 dvpdp.exe 35 PID 2900 wrote to memory of 2852 2900 dvpdp.exe 35 PID 2900 wrote to memory of 2852 2900 dvpdp.exe 35 PID 2852 wrote to memory of 2140 2852 9llfxrr.exe 36 PID 2852 wrote to memory of 2140 2852 9llfxrr.exe 36 PID 2852 wrote to memory of 2140 2852 9llfxrr.exe 36 PID 2852 wrote to memory of 2140 2852 9llfxrr.exe 36 PID 2140 wrote to memory of 2720 2140 7vjjp.exe 37 PID 2140 wrote to memory of 2720 2140 7vjjp.exe 37 PID 2140 wrote to memory of 2720 2140 7vjjp.exe 37 PID 2140 wrote to memory of 2720 2140 7vjjp.exe 37 PID 2720 wrote to memory of 2868 2720 bthhth.exe 38 PID 2720 wrote to memory of 2868 2720 bthhth.exe 38 PID 2720 wrote to memory of 2868 2720 bthhth.exe 38 PID 2720 wrote to memory of 2868 2720 bthhth.exe 38 PID 2868 wrote to memory of 2708 2868 u480628.exe 39 PID 2868 wrote to memory of 2708 2868 u480628.exe 39 PID 2868 wrote to memory of 2708 2868 u480628.exe 39 PID 2868 wrote to memory of 2708 2868 u480628.exe 39 PID 2708 wrote to memory of 352 2708 w00460.exe 40 PID 2708 wrote to memory of 352 2708 w00460.exe 40 PID 2708 wrote to memory of 352 2708 w00460.exe 40 PID 2708 wrote to memory of 352 2708 w00460.exe 40 PID 352 wrote to memory of 2736 352 bttnnh.exe 41 PID 352 wrote to memory of 2736 352 bttnnh.exe 41 PID 352 wrote to memory of 2736 352 bttnnh.exe 41 PID 352 wrote to memory of 2736 352 bttnnh.exe 41 PID 2736 wrote to memory of 2012 2736 xfxxllr.exe 42 PID 2736 wrote to memory of 2012 2736 xfxxllr.exe 42 PID 2736 wrote to memory of 2012 2736 xfxxllr.exe 42 PID 2736 wrote to memory of 2012 2736 xfxxllr.exe 42 PID 2012 wrote to memory of 3004 2012 2668020.exe 43 PID 2012 wrote to memory of 3004 2012 2668020.exe 43 PID 2012 wrote to memory of 3004 2012 2668020.exe 43 PID 2012 wrote to memory of 3004 2012 2668020.exe 43 PID 3004 wrote to memory of 2764 3004 04624.exe 44 PID 3004 wrote to memory of 2764 3004 04624.exe 44 PID 3004 wrote to memory of 2764 3004 04624.exe 44 PID 3004 wrote to memory of 2764 3004 04624.exe 44 PID 2764 wrote to memory of 2880 2764 jjjvp.exe 45 PID 2764 wrote to memory of 2880 2764 jjjvp.exe 45 PID 2764 wrote to memory of 2880 2764 jjjvp.exe 45 PID 2764 wrote to memory of 2880 2764 jjjvp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\51851b97d775370d03b01fe3ced2ccae4a39acd7ec03829d5441753451c44eabN.exe"C:\Users\Admin\AppData\Local\Temp\51851b97d775370d03b01fe3ced2ccae4a39acd7ec03829d5441753451c44eabN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\64802.exec:\64802.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\9frlrrx.exec:\9frlrrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\206682.exec:\206682.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\8028460.exec:\8028460.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\dvpdp.exec:\dvpdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\9llfxrr.exec:\9llfxrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\7vjjp.exec:\7vjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\bthhth.exec:\bthhth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\u480628.exec:\u480628.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\w00460.exec:\w00460.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\bttnnh.exec:\bttnnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\xfxxllr.exec:\xfxxllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\2668020.exec:\2668020.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\04624.exec:\04624.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\jjjvp.exec:\jjjvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\606288.exec:\606288.exe17⤵
- Executes dropped EXE
PID:2880 -
\??\c:\860240.exec:\860240.exe18⤵
- Executes dropped EXE
PID:560 -
\??\c:\6406240.exec:\6406240.exe19⤵
- Executes dropped EXE
PID:2028 -
\??\c:\frffllr.exec:\frffllr.exe20⤵
- Executes dropped EXE
PID:1000 -
\??\c:\828240.exec:\828240.exe21⤵
- Executes dropped EXE
PID:2564 -
\??\c:\2086460.exec:\2086460.exe22⤵
- Executes dropped EXE
PID:2552 -
\??\c:\vdpvv.exec:\vdpvv.exe23⤵
- Executes dropped EXE
PID:2392 -
\??\c:\bbbbnn.exec:\bbbbnn.exe24⤵
- Executes dropped EXE
PID:2176 -
\??\c:\88266.exec:\88266.exe25⤵
- Executes dropped EXE
PID:112 -
\??\c:\42668.exec:\42668.exe26⤵
- Executes dropped EXE
PID:604 -
\??\c:\9jvjv.exec:\9jvjv.exe27⤵
- Executes dropped EXE
PID:1292 -
\??\c:\xlxxfll.exec:\xlxxfll.exe28⤵
- Executes dropped EXE
PID:1892 -
\??\c:\rllxflr.exec:\rllxflr.exe29⤵
- Executes dropped EXE
PID:868 -
\??\c:\6042828.exec:\6042828.exe30⤵
- Executes dropped EXE
PID:2480 -
\??\c:\pjjpj.exec:\pjjpj.exe31⤵
- Executes dropped EXE
PID:1164 -
\??\c:\26244.exec:\26244.exe32⤵
- Executes dropped EXE
PID:788 -
\??\c:\48686.exec:\48686.exe33⤵
- Executes dropped EXE
PID:1788 -
\??\c:\htntht.exec:\htntht.exe34⤵
- Executes dropped EXE
PID:892 -
\??\c:\e68068.exec:\e68068.exe35⤵
- Executes dropped EXE
PID:884 -
\??\c:\jjpdj.exec:\jjpdj.exe36⤵
- Executes dropped EXE
PID:2380 -
\??\c:\640448.exec:\640448.exe37⤵
- Executes dropped EXE
PID:1460 -
\??\c:\6084002.exec:\6084002.exe38⤵
- Executes dropped EXE
PID:1532 -
\??\c:\64228.exec:\64228.exe39⤵
- Executes dropped EXE
PID:2504 -
\??\c:\jvdpp.exec:\jvdpp.exe40⤵
- Executes dropped EXE
PID:2620 -
\??\c:\e22462.exec:\e22462.exe41⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xrfrxxf.exec:\xrfrxxf.exe42⤵
- Executes dropped EXE
PID:2228 -
\??\c:\8266828.exec:\8266828.exe43⤵
- Executes dropped EXE
PID:2844 -
\??\c:\llllrxf.exec:\llllrxf.exe44⤵
- Executes dropped EXE
PID:2940 -
\??\c:\9xlrrlx.exec:\9xlrrlx.exe45⤵
- Executes dropped EXE
PID:2904 -
\??\c:\2084044.exec:\2084044.exe46⤵
- Executes dropped EXE
PID:2320 -
\??\c:\vjvdj.exec:\vjvdj.exe47⤵
- Executes dropped EXE
PID:2812 -
\??\c:\486600.exec:\486600.exe48⤵
- Executes dropped EXE
PID:2716 -
\??\c:\fxfxrlr.exec:\fxfxrlr.exe49⤵
- Executes dropped EXE
PID:2872 -
\??\c:\868462.exec:\868462.exe50⤵
- Executes dropped EXE
PID:2912 -
\??\c:\e42022.exec:\e42022.exe51⤵
- Executes dropped EXE
PID:2868 -
\??\c:\2028068.exec:\2028068.exe52⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pjdjp.exec:\pjdjp.exe53⤵
- Executes dropped EXE
PID:1252 -
\??\c:\0084006.exec:\0084006.exe54⤵
- Executes dropped EXE
PID:1412 -
\??\c:\thtnnn.exec:\thtnnn.exe55⤵
- Executes dropped EXE
PID:1512 -
\??\c:\e84866.exec:\e84866.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3052 -
\??\c:\bnhtbt.exec:\bnhtbt.exe57⤵
- Executes dropped EXE
PID:580 -
\??\c:\806288.exec:\806288.exe58⤵
- Executes dropped EXE
PID:2992 -
\??\c:\xlrflfx.exec:\xlrflfx.exe59⤵
- Executes dropped EXE
PID:2764 -
\??\c:\428844.exec:\428844.exe60⤵
- Executes dropped EXE
PID:1432 -
\??\c:\0064466.exec:\0064466.exe61⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xfrxffl.exec:\xfrxffl.exe62⤵
- Executes dropped EXE
PID:2664 -
\??\c:\g2846.exec:\g2846.exe63⤵
- Executes dropped EXE
PID:1360 -
\??\c:\420684.exec:\420684.exe64⤵
- Executes dropped EXE
PID:2116 -
\??\c:\48284.exec:\48284.exe65⤵
- Executes dropped EXE
PID:2244 -
\??\c:\e46064.exec:\e46064.exe66⤵PID:2372
-
\??\c:\i868444.exec:\i868444.exe67⤵PID:2572
-
\??\c:\e86240.exec:\e86240.exe68⤵PID:2644
-
\??\c:\9hnnhn.exec:\9hnnhn.exe69⤵PID:832
-
\??\c:\tntbnh.exec:\tntbnh.exe70⤵PID:960
-
\??\c:\66606.exec:\66606.exe71⤵PID:2020
-
\??\c:\42066.exec:\42066.exe72⤵PID:2396
-
\??\c:\5xrlllr.exec:\5xrlllr.exe73⤵PID:1292
-
\??\c:\e02880.exec:\e02880.exe74⤵PID:2876
-
\??\c:\9rrfrxl.exec:\9rrfrxl.exe75⤵PID:904
-
\??\c:\u864068.exec:\u864068.exe76⤵PID:2440
-
\??\c:\dpvpp.exec:\dpvpp.exe77⤵PID:1688
-
\??\c:\82440.exec:\82440.exe78⤵PID:1716
-
\??\c:\lfrxflr.exec:\lfrxflr.exe79⤵PID:2148
-
\??\c:\s2024.exec:\s2024.exe80⤵PID:3064
-
\??\c:\rfxlrrx.exec:\rfxlrrx.exe81⤵PID:2008
-
\??\c:\264062.exec:\264062.exe82⤵PID:2640
-
\??\c:\c800062.exec:\c800062.exe83⤵PID:884
-
\??\c:\a0662.exec:\a0662.exe84⤵PID:1464
-
\??\c:\7flflfl.exec:\7flflfl.exe85⤵PID:2496
-
\??\c:\bbttnn.exec:\bbttnn.exe86⤵PID:2224
-
\??\c:\lfxfffl.exec:\lfxfffl.exe87⤵PID:1560
-
\??\c:\m0402.exec:\m0402.exe88⤵PID:2924
-
\??\c:\4240284.exec:\4240284.exe89⤵PID:2476
-
\??\c:\xrllfxl.exec:\xrllfxl.exe90⤵PID:2252
-
\??\c:\3jpvj.exec:\3jpvj.exe91⤵PID:2228
-
\??\c:\5nbhnt.exec:\5nbhnt.exe92⤵PID:2800
-
\??\c:\s4666.exec:\s4666.exe93⤵PID:2920
-
\??\c:\q00206.exec:\q00206.exe94⤵PID:2472
-
\??\c:\bhtthh.exec:\bhtthh.exe95⤵PID:2860
-
\??\c:\80628.exec:\80628.exe96⤵PID:1196
-
\??\c:\60846.exec:\60846.exe97⤵PID:2896
-
\??\c:\7xfxfxf.exec:\7xfxfxf.exe98⤵PID:2692
-
\??\c:\082862.exec:\082862.exe99⤵PID:2696
-
\??\c:\64240.exec:\64240.exe100⤵PID:2760
-
\??\c:\004444.exec:\004444.exe101⤵PID:2536
-
\??\c:\fffrrlf.exec:\fffrrlf.exe102⤵PID:748
-
\??\c:\pjppv.exec:\pjppv.exe103⤵PID:1720
-
\??\c:\5lxxxxf.exec:\5lxxxxf.exe104⤵PID:2016
-
\??\c:\686428.exec:\686428.exe105⤵PID:948
-
\??\c:\nhhtnh.exec:\nhhtnh.exe106⤵PID:3032
-
\??\c:\64880.exec:\64880.exe107⤵PID:3036
-
\??\c:\040466.exec:\040466.exe108⤵PID:1088
-
\??\c:\hbtbht.exec:\hbtbht.exe109⤵PID:712
-
\??\c:\084406.exec:\084406.exe110⤵PID:340
-
\??\c:\xrrxllr.exec:\xrrxllr.exe111⤵PID:1600
-
\??\c:\fxllxxf.exec:\fxllxxf.exe112⤵PID:1808
-
\??\c:\g0402.exec:\g0402.exe113⤵PID:1448
-
\??\c:\htbhbt.exec:\htbhbt.exe114⤵PID:2412
-
\??\c:\86000.exec:\86000.exe115⤵PID:1628
-
\??\c:\7rxrxff.exec:\7rxrxff.exe116⤵PID:1240
-
\??\c:\4288080.exec:\4288080.exe117⤵PID:1124
-
\??\c:\3bhhnt.exec:\3bhhnt.exe118⤵PID:668
-
\??\c:\htbtbt.exec:\htbtbt.exe119⤵PID:1800
-
\??\c:\7hbhnt.exec:\7hbhnt.exe120⤵PID:1544
-
\??\c:\9lxrxxx.exec:\9lxrxxx.exe121⤵PID:308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-