Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 21:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
40036d1adfa4dcfbf468b95482aaa4777e5c6653c3f0480e7fc54d83b7a86e95.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
40036d1adfa4dcfbf468b95482aaa4777e5c6653c3f0480e7fc54d83b7a86e95.exe
-
Size
453KB
-
MD5
5cde33f2b270e7cfbe6dfbdc742d1f93
-
SHA1
1d29beac7294a36f66c8d7f3e7659da0ca2c85dc
-
SHA256
40036d1adfa4dcfbf468b95482aaa4777e5c6653c3f0480e7fc54d83b7a86e95
-
SHA512
c5cf8b4ac5b1c6956c27a6f2bad1cc0707ab00bd78744bde8992bc85d1088726387c97a1719204d0d2c7f2e3ff8d30e9f2309dc61c20d5ca6012292aeb9b65be
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeX:q7Tc2NYHUrAwfMp3CDX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/1788-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-93-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2584-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-140-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1056-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-159-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2024-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-255-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2168-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-315-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2148-324-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2848-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-351-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2808-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-379-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3036-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-393-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1916-394-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2396-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-427-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2004-440-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2680-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/796-529-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/340-554-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2880-605-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2744-633-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2808-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-752-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2268-811-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/904-830-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3000-837-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2188 dvjjv.exe 2524 lfrfllx.exe 2336 3dppv.exe 2692 bbbhtn.exe 2884 pvjjp.exe 2860 tnbbbb.exe 2896 5bnntt.exe 2612 lrlfrxl.exe 2584 9hbbhb.exe 2704 llxrxxf.exe 1844 xlxrffl.exe 2324 ppjpd.exe 1696 llxfrlx.exe 1972 pjdjp.exe 1056 vvpvd.exe 2572 1btbhh.exe 2024 dvpvv.exe 2868 9xlrxfl.exe 2440 bnbbbb.exe 2220 3rlrrrf.exe 1720 btbbhh.exe 1084 vppdd.exe 2128 rrxxllr.exe 1680 1httbb.exe 796 5pjjd.exe 2136 3tbthb.exe 2152 dvvvd.exe 2168 lxlrxfl.exe 1736 hnhthb.exe 896 7pddd.exe 1272 pjvpv.exe 1684 bnbbbt.exe 2052 jjvpp.exe 2148 xrxrrll.exe 2172 1xllxfr.exe 2892 bthnbb.exe 2848 pjvvd.exe 2688 3vddd.exe 2744 llrrflf.exe 2808 bnbttn.exe 2752 5thbhh.exe 2604 1jdvv.exe 3036 rfrffxr.exe 1916 xfrfxll.exe 3052 bnbbtn.exe 2396 dpddd.exe 1676 pdjpd.exe 1480 rrffllx.exe 1856 3htbhb.exe 760 1tbnbt.exe 2004 vjvvj.exe 1420 rlrrlfr.exe 1384 lflrxxf.exe 1380 7nhhtt.exe 2680 jjvjp.exe 2436 vdvdp.exe 560 xrxxllx.exe 924 frffrrx.exe 448 nthnbh.exe 408 dpvpv.exe 1664 jvvpj.exe 2128 xrfffxf.exe 2224 xlxlfxl.exe 536 hthhhh.exe -
resource yara_rule behavioral1/memory/1788-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-440-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2680-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-605-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2808-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-721-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1516-772-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-779-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-830-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/3000-837-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-847-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-861-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1788 wrote to memory of 2188 1788 40036d1adfa4dcfbf468b95482aaa4777e5c6653c3f0480e7fc54d83b7a86e95.exe 30 PID 1788 wrote to memory of 2188 1788 40036d1adfa4dcfbf468b95482aaa4777e5c6653c3f0480e7fc54d83b7a86e95.exe 30 PID 1788 wrote to memory of 2188 1788 40036d1adfa4dcfbf468b95482aaa4777e5c6653c3f0480e7fc54d83b7a86e95.exe 30 PID 1788 wrote to memory of 2188 1788 40036d1adfa4dcfbf468b95482aaa4777e5c6653c3f0480e7fc54d83b7a86e95.exe 30 PID 2188 wrote to memory of 2524 2188 dvjjv.exe 31 PID 2188 wrote to memory of 2524 2188 dvjjv.exe 31 PID 2188 wrote to memory of 2524 2188 dvjjv.exe 31 PID 2188 wrote to memory of 2524 2188 dvjjv.exe 31 PID 2524 wrote to memory of 2336 2524 lfrfllx.exe 32 PID 2524 wrote to memory of 2336 2524 lfrfllx.exe 32 PID 2524 wrote to memory of 2336 2524 lfrfllx.exe 32 PID 2524 wrote to memory of 2336 2524 lfrfllx.exe 32 PID 2336 wrote to memory of 2692 2336 3dppv.exe 33 PID 2336 wrote to memory of 2692 2336 3dppv.exe 33 PID 2336 wrote to memory of 2692 2336 3dppv.exe 33 PID 2336 wrote to memory of 2692 2336 3dppv.exe 33 PID 2692 wrote to memory of 2884 2692 bbbhtn.exe 34 PID 2692 wrote to memory of 2884 2692 bbbhtn.exe 34 PID 2692 wrote to memory of 2884 2692 bbbhtn.exe 34 PID 2692 wrote to memory of 2884 2692 bbbhtn.exe 34 PID 2884 wrote to memory of 2860 2884 pvjjp.exe 35 PID 2884 wrote to memory of 2860 2884 pvjjp.exe 35 PID 2884 wrote to memory of 2860 2884 pvjjp.exe 35 PID 2884 wrote to memory of 2860 2884 pvjjp.exe 35 PID 2860 wrote to memory of 2896 2860 tnbbbb.exe 36 PID 2860 wrote to memory of 2896 2860 tnbbbb.exe 36 PID 2860 wrote to memory of 2896 2860 tnbbbb.exe 36 PID 2860 wrote to memory of 2896 2860 tnbbbb.exe 36 PID 2896 wrote to memory of 2612 2896 5bnntt.exe 37 PID 2896 wrote to memory of 2612 2896 5bnntt.exe 37 PID 2896 wrote to memory of 2612 2896 5bnntt.exe 37 PID 2896 wrote to memory of 2612 2896 5bnntt.exe 37 PID 2612 wrote to memory of 2584 2612 lrlfrxl.exe 38 PID 2612 wrote to memory of 2584 2612 lrlfrxl.exe 38 PID 2612 wrote to memory of 2584 2612 lrlfrxl.exe 38 PID 2612 wrote to memory of 2584 2612 lrlfrxl.exe 38 PID 2584 wrote to memory of 2704 2584 9hbbhb.exe 39 PID 2584 wrote to memory of 2704 2584 9hbbhb.exe 39 PID 2584 wrote to memory of 2704 2584 9hbbhb.exe 39 PID 2584 wrote to memory of 2704 2584 9hbbhb.exe 39 PID 2704 wrote to memory of 1844 2704 llxrxxf.exe 40 PID 2704 wrote to memory of 1844 2704 llxrxxf.exe 40 PID 2704 wrote to memory of 1844 2704 llxrxxf.exe 40 PID 2704 wrote to memory of 1844 2704 llxrxxf.exe 40 PID 1844 wrote to memory of 2324 1844 xlxrffl.exe 41 PID 1844 wrote to memory of 2324 1844 xlxrffl.exe 41 PID 1844 wrote to memory of 2324 1844 xlxrffl.exe 41 PID 1844 wrote to memory of 2324 1844 xlxrffl.exe 41 PID 2324 wrote to memory of 1696 2324 ppjpd.exe 42 PID 2324 wrote to memory of 1696 2324 ppjpd.exe 42 PID 2324 wrote to memory of 1696 2324 ppjpd.exe 42 PID 2324 wrote to memory of 1696 2324 ppjpd.exe 42 PID 1696 wrote to memory of 1972 1696 llxfrlx.exe 43 PID 1696 wrote to memory of 1972 1696 llxfrlx.exe 43 PID 1696 wrote to memory of 1972 1696 llxfrlx.exe 43 PID 1696 wrote to memory of 1972 1696 llxfrlx.exe 43 PID 1972 wrote to memory of 1056 1972 pjdjp.exe 44 PID 1972 wrote to memory of 1056 1972 pjdjp.exe 44 PID 1972 wrote to memory of 1056 1972 pjdjp.exe 44 PID 1972 wrote to memory of 1056 1972 pjdjp.exe 44 PID 1056 wrote to memory of 2572 1056 vvpvd.exe 45 PID 1056 wrote to memory of 2572 1056 vvpvd.exe 45 PID 1056 wrote to memory of 2572 1056 vvpvd.exe 45 PID 1056 wrote to memory of 2572 1056 vvpvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\40036d1adfa4dcfbf468b95482aaa4777e5c6653c3f0480e7fc54d83b7a86e95.exe"C:\Users\Admin\AppData\Local\Temp\40036d1adfa4dcfbf468b95482aaa4777e5c6653c3f0480e7fc54d83b7a86e95.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\dvjjv.exec:\dvjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\lfrfllx.exec:\lfrfllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\3dppv.exec:\3dppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\bbbhtn.exec:\bbbhtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\pvjjp.exec:\pvjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\tnbbbb.exec:\tnbbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\5bnntt.exec:\5bnntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\lrlfrxl.exec:\lrlfrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\9hbbhb.exec:\9hbbhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\llxrxxf.exec:\llxrxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\xlxrffl.exec:\xlxrffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\ppjpd.exec:\ppjpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\llxfrlx.exec:\llxfrlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\pjdjp.exec:\pjdjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\vvpvd.exec:\vvpvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\1btbhh.exec:\1btbhh.exe17⤵
- Executes dropped EXE
PID:2572 -
\??\c:\dvpvv.exec:\dvpvv.exe18⤵
- Executes dropped EXE
PID:2024 -
\??\c:\9xlrxfl.exec:\9xlrxfl.exe19⤵
- Executes dropped EXE
PID:2868 -
\??\c:\bnbbbb.exec:\bnbbbb.exe20⤵
- Executes dropped EXE
PID:2440 -
\??\c:\3rlrrrf.exec:\3rlrrrf.exe21⤵
- Executes dropped EXE
PID:2220 -
\??\c:\btbbhh.exec:\btbbhh.exe22⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vppdd.exec:\vppdd.exe23⤵
- Executes dropped EXE
PID:1084 -
\??\c:\rrxxllr.exec:\rrxxllr.exe24⤵
- Executes dropped EXE
PID:2128 -
\??\c:\1httbb.exec:\1httbb.exe25⤵
- Executes dropped EXE
PID:1680 -
\??\c:\5pjjd.exec:\5pjjd.exe26⤵
- Executes dropped EXE
PID:796 -
\??\c:\3tbthb.exec:\3tbthb.exe27⤵
- Executes dropped EXE
PID:2136 -
\??\c:\dvvvd.exec:\dvvvd.exe28⤵
- Executes dropped EXE
PID:2152 -
\??\c:\lxlrxfl.exec:\lxlrxfl.exe29⤵
- Executes dropped EXE
PID:2168 -
\??\c:\hnhthb.exec:\hnhthb.exe30⤵
- Executes dropped EXE
PID:1736 -
\??\c:\7pddd.exec:\7pddd.exe31⤵
- Executes dropped EXE
PID:896 -
\??\c:\pjvpv.exec:\pjvpv.exe32⤵
- Executes dropped EXE
PID:1272 -
\??\c:\bnbbbt.exec:\bnbbbt.exe33⤵
- Executes dropped EXE
PID:1684 -
\??\c:\jjvpp.exec:\jjvpp.exe34⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xrxrrll.exec:\xrxrrll.exe35⤵
- Executes dropped EXE
PID:2148 -
\??\c:\1xllxfr.exec:\1xllxfr.exe36⤵
- Executes dropped EXE
PID:2172 -
\??\c:\bthnbb.exec:\bthnbb.exe37⤵
- Executes dropped EXE
PID:2892 -
\??\c:\pjvvd.exec:\pjvvd.exe38⤵
- Executes dropped EXE
PID:2848 -
\??\c:\3vddd.exec:\3vddd.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\llrrflf.exec:\llrrflf.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\bnbttn.exec:\bnbttn.exe41⤵
- Executes dropped EXE
PID:2808 -
\??\c:\5thbhh.exec:\5thbhh.exe42⤵
- Executes dropped EXE
PID:2752 -
\??\c:\1jdvv.exec:\1jdvv.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\rfrffxr.exec:\rfrffxr.exe44⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xfrfxll.exec:\xfrfxll.exe45⤵
- Executes dropped EXE
PID:1916 -
\??\c:\bnbbtn.exec:\bnbbtn.exe46⤵
- Executes dropped EXE
PID:3052 -
\??\c:\dpddd.exec:\dpddd.exe47⤵
- Executes dropped EXE
PID:2396 -
\??\c:\pdjpd.exec:\pdjpd.exe48⤵
- Executes dropped EXE
PID:1676 -
\??\c:\rrffllx.exec:\rrffllx.exe49⤵
- Executes dropped EXE
PID:1480 -
\??\c:\3htbhb.exec:\3htbhb.exe50⤵
- Executes dropped EXE
PID:1856 -
\??\c:\1tbnbt.exec:\1tbnbt.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:760 -
\??\c:\vjvvj.exec:\vjvvj.exe52⤵
- Executes dropped EXE
PID:2004 -
\??\c:\rlrrlfr.exec:\rlrrlfr.exe53⤵
- Executes dropped EXE
PID:1420 -
\??\c:\lflrxxf.exec:\lflrxxf.exe54⤵
- Executes dropped EXE
PID:1384 -
\??\c:\7nhhtt.exec:\7nhhtt.exe55⤵
- Executes dropped EXE
PID:1380 -
\??\c:\jjvjp.exec:\jjvjp.exe56⤵
- Executes dropped EXE
PID:2680 -
\??\c:\vdvdp.exec:\vdvdp.exe57⤵
- Executes dropped EXE
PID:2436 -
\??\c:\xrxxllx.exec:\xrxxllx.exe58⤵
- Executes dropped EXE
PID:560 -
\??\c:\frffrrx.exec:\frffrrx.exe59⤵
- Executes dropped EXE
PID:924 -
\??\c:\nthnbh.exec:\nthnbh.exe60⤵
- Executes dropped EXE
PID:448 -
\??\c:\dpvpv.exec:\dpvpv.exe61⤵
- Executes dropped EXE
PID:408 -
\??\c:\jvvpj.exec:\jvvpj.exe62⤵
- Executes dropped EXE
PID:1664 -
\??\c:\xrfffxf.exec:\xrfffxf.exe63⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xlxlfxl.exec:\xlxlfxl.exe64⤵
- Executes dropped EXE
PID:2224 -
\??\c:\hthhhh.exec:\hthhhh.exe65⤵
- Executes dropped EXE
PID:536 -
\??\c:\nbbtth.exec:\nbbtth.exe66⤵PID:796
-
\??\c:\9jppv.exec:\9jppv.exe67⤵
- System Location Discovery: System Language Discovery
PID:788 -
\??\c:\lxfrxxx.exec:\lxfrxxx.exe68⤵PID:592
-
\??\c:\xrxflfl.exec:\xrxflfl.exe69⤵PID:316
-
\??\c:\bntntn.exec:\bntntn.exe70⤵PID:340
-
\??\c:\3jdpd.exec:\3jdpd.exe71⤵PID:2356
-
\??\c:\dpdvv.exec:\dpdvv.exe72⤵PID:3000
-
\??\c:\5lxlrll.exec:\5lxlrll.exe73⤵PID:3016
-
\??\c:\3rxfxlf.exec:\3rxfxlf.exe74⤵PID:2664
-
\??\c:\hntnnh.exec:\hntnnh.exe75⤵PID:1684
-
\??\c:\ntbbth.exec:\ntbbth.exe76⤵PID:2524
-
\??\c:\vjdvd.exec:\vjdvd.exe77⤵PID:2916
-
\??\c:\frxrxlf.exec:\frxrxlf.exe78⤵PID:2732
-
\??\c:\9xfrrlr.exec:\9xfrrlr.exe79⤵PID:2880
-
\??\c:\7hbbbt.exec:\7hbbbt.exe80⤵PID:2736
-
\??\c:\jvdjj.exec:\jvdjj.exe81⤵PID:2716
-
\??\c:\9dpjj.exec:\9dpjj.exe82⤵PID:2792
-
\??\c:\5lxfxlf.exec:\5lxfxlf.exe83⤵PID:2744
-
\??\c:\flrlfxx.exec:\flrlfxx.exe84⤵PID:2808
-
\??\c:\htbbbt.exec:\htbbbt.exe85⤵PID:2596
-
\??\c:\vvvjd.exec:\vvvjd.exe86⤵PID:2204
-
\??\c:\pjpjd.exec:\pjpjd.exe87⤵PID:2180
-
\??\c:\1ffflll.exec:\1ffflll.exe88⤵PID:1916
-
\??\c:\nbnbtt.exec:\nbnbtt.exe89⤵PID:1912
-
\??\c:\7hhbnb.exec:\7hhbnb.exe90⤵PID:776
-
\??\c:\1ddpj.exec:\1ddpj.exe91⤵PID:768
-
\??\c:\xrlfxrx.exec:\xrlfxrx.exe92⤵PID:1984
-
\??\c:\rflflfx.exec:\rflflfx.exe93⤵PID:2000
-
\??\c:\hbhnbt.exec:\hbhnbt.exe94⤵PID:1488
-
\??\c:\pdjjj.exec:\pdjjj.exe95⤵PID:1900
-
\??\c:\jvvpj.exec:\jvvpj.exe96⤵PID:2796
-
\??\c:\7xfxxrx.exec:\7xfxxrx.exe97⤵PID:2804
-
\??\c:\fxlrrrx.exec:\fxlrrrx.exe98⤵PID:2868
-
\??\c:\hhthtt.exec:\hhthtt.exe99⤵PID:380
-
\??\c:\bnbtnh.exec:\bnbtnh.exe100⤵PID:1840
-
\??\c:\dvjjp.exec:\dvjjp.exe101⤵PID:2496
-
\??\c:\lxxfxrx.exec:\lxxfxrx.exe102⤵PID:1500
-
\??\c:\1thntt.exec:\1thntt.exe103⤵PID:2568
-
\??\c:\dpvpj.exec:\dpvpj.exe104⤵PID:840
-
\??\c:\5jvpv.exec:\5jvpv.exe105⤵PID:1516
-
\??\c:\lxfrrlr.exec:\lxfrrlr.exe106⤵PID:2012
-
\??\c:\btbbth.exec:\btbbth.exe107⤵PID:780
-
\??\c:\hbhhtt.exec:\hbhhtt.exe108⤵PID:1532
-
\??\c:\jddvv.exec:\jddvv.exe109⤵PID:796
-
\??\c:\pjdvd.exec:\pjdvd.exe110⤵PID:2268
-
\??\c:\9fllxrx.exec:\9fllxrx.exe111⤵PID:2404
-
\??\c:\frflrxx.exec:\frflrxx.exe112⤵PID:316
-
\??\c:\hhnbtn.exec:\hhnbtn.exe113⤵PID:904
-
\??\c:\vpvdp.exec:\vpvdp.exe114⤵PID:2356
-
\??\c:\9ddjp.exec:\9ddjp.exe115⤵PID:3000
-
\??\c:\3lxrxrr.exec:\3lxrxrr.exe116⤵PID:1588
-
\??\c:\bbhthh.exec:\bbhthh.exe117⤵PID:2260
-
\??\c:\bthntb.exec:\bthntb.exe118⤵PID:852
-
\??\c:\dpdpv.exec:\dpdpv.exe119⤵PID:2524
-
\??\c:\rflxrfl.exec:\rflxrfl.exe120⤵PID:2916
-
\??\c:\fxlfffl.exec:\fxlfffl.exe121⤵PID:2976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-