Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 21:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
40036d1adfa4dcfbf468b95482aaa4777e5c6653c3f0480e7fc54d83b7a86e95.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
40036d1adfa4dcfbf468b95482aaa4777e5c6653c3f0480e7fc54d83b7a86e95.exe
-
Size
453KB
-
MD5
5cde33f2b270e7cfbe6dfbdc742d1f93
-
SHA1
1d29beac7294a36f66c8d7f3e7659da0ca2c85dc
-
SHA256
40036d1adfa4dcfbf468b95482aaa4777e5c6653c3f0480e7fc54d83b7a86e95
-
SHA512
c5cf8b4ac5b1c6956c27a6f2bad1cc0707ab00bd78744bde8992bc85d1088726387c97a1719204d0d2c7f2e3ff8d30e9f2309dc61c20d5ca6012292aeb9b65be
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeX:q7Tc2NYHUrAwfMp3CDX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3124-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2564-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2272-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3428-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1088-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/784-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1240-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1256-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4312-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1848-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/940-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3656-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1572-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-787-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-909-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-1115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4408 pvdvv.exe 1200 tnnbnt.exe 3992 vjjvp.exe 1824 xrllfxx.exe 4224 bbbnhh.exe 3960 xxffffl.exe 3340 nbbtnh.exe 5028 9rxlffx.exe 4784 jddvp.exe 2564 bbbtnn.exe 4236 dpvpj.exe 1520 hbbnht.exe 2960 jdjvd.exe 4132 rrffrrl.exe 5084 7dddv.exe 4920 7ttnhh.exe 1288 rlfflfl.exe 4980 xlrlxfl.exe 2628 bnttnh.exe 2272 vjvjd.exe 2552 xfxrrrl.exe 3428 dvvvp.exe 3720 dvvpd.exe 1928 3ffxlfx.exe 1088 vjpjd.exe 1620 jjppp.exe 784 bnnhbb.exe 2824 vjvpj.exe 4420 tnnnhb.exe 548 1ppjd.exe 3192 pvdvv.exe 2160 rxflffx.exe 3800 pdjdd.exe 1632 flrlfxr.exe 4840 bbbnhh.exe 1788 bbtttb.exe 1492 jvdvv.exe 2464 rxxfxff.exe 3164 lxfxrfr.exe 3832 tnbttn.exe 2916 vpddv.exe 2728 lrrfxxx.exe 4200 bhnhtt.exe 408 5bhhbb.exe 8 5vpjd.exe 4956 frxxrll.exe 1240 tnhbtt.exe 2872 ddvpp.exe 3984 vppjd.exe 3532 rlfxrrx.exe 2608 nhhbtt.exe 1080 jvddv.exe 1092 xlfxxrx.exe 4144 bbbhhh.exe 1256 hhtbnh.exe 940 dddvp.exe 4084 lffxrlf.exe 1552 hbhbbt.exe 1328 3hhbnn.exe 4532 jddvj.exe 5028 rrxxrlf.exe 1404 tbhbtt.exe 1868 hnbtnn.exe 2292 jddvp.exe -
resource yara_rule behavioral2/memory/3124-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2272-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3428-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1088-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/784-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1256-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4312-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1848-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/940-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3656-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1572-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-909-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3124 wrote to memory of 4408 3124 40036d1adfa4dcfbf468b95482aaa4777e5c6653c3f0480e7fc54d83b7a86e95.exe 84 PID 3124 wrote to memory of 4408 3124 40036d1adfa4dcfbf468b95482aaa4777e5c6653c3f0480e7fc54d83b7a86e95.exe 84 PID 3124 wrote to memory of 4408 3124 40036d1adfa4dcfbf468b95482aaa4777e5c6653c3f0480e7fc54d83b7a86e95.exe 84 PID 4408 wrote to memory of 1200 4408 pvdvv.exe 85 PID 4408 wrote to memory of 1200 4408 pvdvv.exe 85 PID 4408 wrote to memory of 1200 4408 pvdvv.exe 85 PID 1200 wrote to memory of 3992 1200 tnnbnt.exe 86 PID 1200 wrote to memory of 3992 1200 tnnbnt.exe 86 PID 1200 wrote to memory of 3992 1200 tnnbnt.exe 86 PID 3992 wrote to memory of 1824 3992 vjjvp.exe 87 PID 3992 wrote to memory of 1824 3992 vjjvp.exe 87 PID 3992 wrote to memory of 1824 3992 vjjvp.exe 87 PID 1824 wrote to memory of 4224 1824 xrllfxx.exe 88 PID 1824 wrote to memory of 4224 1824 xrllfxx.exe 88 PID 1824 wrote to memory of 4224 1824 xrllfxx.exe 88 PID 4224 wrote to memory of 3960 4224 bbbnhh.exe 89 PID 4224 wrote to memory of 3960 4224 bbbnhh.exe 89 PID 4224 wrote to memory of 3960 4224 bbbnhh.exe 89 PID 3960 wrote to memory of 3340 3960 xxffffl.exe 90 PID 3960 wrote to memory of 3340 3960 xxffffl.exe 90 PID 3960 wrote to memory of 3340 3960 xxffffl.exe 90 PID 3340 wrote to memory of 5028 3340 nbbtnh.exe 91 PID 3340 wrote to memory of 5028 3340 nbbtnh.exe 91 PID 3340 wrote to memory of 5028 3340 nbbtnh.exe 91 PID 5028 wrote to memory of 4784 5028 9rxlffx.exe 92 PID 5028 wrote to memory of 4784 5028 9rxlffx.exe 92 PID 5028 wrote to memory of 4784 5028 9rxlffx.exe 92 PID 4784 wrote to memory of 2564 4784 jddvp.exe 93 PID 4784 wrote to memory of 2564 4784 jddvp.exe 93 PID 4784 wrote to memory of 2564 4784 jddvp.exe 93 PID 2564 wrote to memory of 4236 2564 bbbtnn.exe 94 PID 2564 wrote to memory of 4236 2564 bbbtnn.exe 94 PID 2564 wrote to memory of 4236 2564 bbbtnn.exe 94 PID 4236 wrote to memory of 1520 4236 dpvpj.exe 95 PID 4236 wrote to memory of 1520 4236 dpvpj.exe 95 PID 4236 wrote to memory of 1520 4236 dpvpj.exe 95 PID 1520 wrote to memory of 2960 1520 hbbnht.exe 96 PID 1520 wrote to memory of 2960 1520 hbbnht.exe 96 PID 1520 wrote to memory of 2960 1520 hbbnht.exe 96 PID 2960 wrote to memory of 4132 2960 jdjvd.exe 97 PID 2960 wrote to memory of 4132 2960 jdjvd.exe 97 PID 2960 wrote to memory of 4132 2960 jdjvd.exe 97 PID 4132 wrote to memory of 5084 4132 rrffrrl.exe 98 PID 4132 wrote to memory of 5084 4132 rrffrrl.exe 98 PID 4132 wrote to memory of 5084 4132 rrffrrl.exe 98 PID 5084 wrote to memory of 4920 5084 7dddv.exe 99 PID 5084 wrote to memory of 4920 5084 7dddv.exe 99 PID 5084 wrote to memory of 4920 5084 7dddv.exe 99 PID 4920 wrote to memory of 1288 4920 7ttnhh.exe 100 PID 4920 wrote to memory of 1288 4920 7ttnhh.exe 100 PID 4920 wrote to memory of 1288 4920 7ttnhh.exe 100 PID 1288 wrote to memory of 4980 1288 rlfflfl.exe 101 PID 1288 wrote to memory of 4980 1288 rlfflfl.exe 101 PID 1288 wrote to memory of 4980 1288 rlfflfl.exe 101 PID 4980 wrote to memory of 2628 4980 xlrlxfl.exe 102 PID 4980 wrote to memory of 2628 4980 xlrlxfl.exe 102 PID 4980 wrote to memory of 2628 4980 xlrlxfl.exe 102 PID 2628 wrote to memory of 2272 2628 bnttnh.exe 103 PID 2628 wrote to memory of 2272 2628 bnttnh.exe 103 PID 2628 wrote to memory of 2272 2628 bnttnh.exe 103 PID 2272 wrote to memory of 2552 2272 vjvjd.exe 104 PID 2272 wrote to memory of 2552 2272 vjvjd.exe 104 PID 2272 wrote to memory of 2552 2272 vjvjd.exe 104 PID 2552 wrote to memory of 3428 2552 xfxrrrl.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\40036d1adfa4dcfbf468b95482aaa4777e5c6653c3f0480e7fc54d83b7a86e95.exe"C:\Users\Admin\AppData\Local\Temp\40036d1adfa4dcfbf468b95482aaa4777e5c6653c3f0480e7fc54d83b7a86e95.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\pvdvv.exec:\pvdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\tnnbnt.exec:\tnnbnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\vjjvp.exec:\vjjvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\xrllfxx.exec:\xrllfxx.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\bbbnhh.exec:\bbbnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\xxffffl.exec:\xxffffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\nbbtnh.exec:\nbbtnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\9rxlffx.exec:\9rxlffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\jddvp.exec:\jddvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\bbbtnn.exec:\bbbtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\dpvpj.exec:\dpvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\hbbnht.exec:\hbbnht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\jdjvd.exec:\jdjvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\rrffrrl.exec:\rrffrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\7dddv.exec:\7dddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\7ttnhh.exec:\7ttnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\rlfflfl.exec:\rlfflfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\xlrlxfl.exec:\xlrlxfl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\bnttnh.exec:\bnttnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\vjvjd.exec:\vjvjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\xfxrrrl.exec:\xfxrrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\dvvvp.exec:\dvvvp.exe23⤵
- Executes dropped EXE
PID:3428 -
\??\c:\dvvpd.exec:\dvvpd.exe24⤵
- Executes dropped EXE
PID:3720 -
\??\c:\3ffxlfx.exec:\3ffxlfx.exe25⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vjpjd.exec:\vjpjd.exe26⤵
- Executes dropped EXE
PID:1088 -
\??\c:\jjppp.exec:\jjppp.exe27⤵
- Executes dropped EXE
PID:1620 -
\??\c:\bnnhbb.exec:\bnnhbb.exe28⤵
- Executes dropped EXE
PID:784 -
\??\c:\vjvpj.exec:\vjvpj.exe29⤵
- Executes dropped EXE
PID:2824 -
\??\c:\tnnnhb.exec:\tnnnhb.exe30⤵
- Executes dropped EXE
PID:4420 -
\??\c:\1ppjd.exec:\1ppjd.exe31⤵
- Executes dropped EXE
PID:548 -
\??\c:\pvdvv.exec:\pvdvv.exe32⤵
- Executes dropped EXE
PID:3192 -
\??\c:\rxflffx.exec:\rxflffx.exe33⤵
- Executes dropped EXE
PID:2160 -
\??\c:\pdjdd.exec:\pdjdd.exe34⤵
- Executes dropped EXE
PID:3800 -
\??\c:\flrlfxr.exec:\flrlfxr.exe35⤵
- Executes dropped EXE
PID:1632 -
\??\c:\bbbnhh.exec:\bbbnhh.exe36⤵
- Executes dropped EXE
PID:4840 -
\??\c:\bbtttb.exec:\bbtttb.exe37⤵
- Executes dropped EXE
PID:1788 -
\??\c:\jvdvv.exec:\jvdvv.exe38⤵
- Executes dropped EXE
PID:1492 -
\??\c:\rxxfxff.exec:\rxxfxff.exe39⤵
- Executes dropped EXE
PID:2464 -
\??\c:\lxfxrfr.exec:\lxfxrfr.exe40⤵
- Executes dropped EXE
PID:3164 -
\??\c:\tnbttn.exec:\tnbttn.exe41⤵
- Executes dropped EXE
PID:3832 -
\??\c:\vpddv.exec:\vpddv.exe42⤵
- Executes dropped EXE
PID:2916 -
\??\c:\lrrfxxx.exec:\lrrfxxx.exe43⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bhnhtt.exec:\bhnhtt.exe44⤵
- Executes dropped EXE
PID:4200 -
\??\c:\5bhhbb.exec:\5bhhbb.exe45⤵
- Executes dropped EXE
PID:408 -
\??\c:\5vpjd.exec:\5vpjd.exe46⤵
- Executes dropped EXE
PID:8 -
\??\c:\frxxrll.exec:\frxxrll.exe47⤵
- Executes dropped EXE
PID:4956 -
\??\c:\tnhbtt.exec:\tnhbtt.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1240 -
\??\c:\ddvpp.exec:\ddvpp.exe49⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vppjd.exec:\vppjd.exe50⤵
- Executes dropped EXE
PID:3984 -
\??\c:\rlfxrrx.exec:\rlfxrrx.exe51⤵
- Executes dropped EXE
PID:3532 -
\??\c:\nhhbtt.exec:\nhhbtt.exe52⤵
- Executes dropped EXE
PID:2608 -
\??\c:\jvddv.exec:\jvddv.exe53⤵
- Executes dropped EXE
PID:1080 -
\??\c:\xlfxxrx.exec:\xlfxxrx.exe54⤵
- Executes dropped EXE
PID:1092 -
\??\c:\bbbhhh.exec:\bbbhhh.exe55⤵
- Executes dropped EXE
PID:4144 -
\??\c:\hhtbnh.exec:\hhtbnh.exe56⤵
- Executes dropped EXE
PID:1256 -
\??\c:\dddvp.exec:\dddvp.exe57⤵
- Executes dropped EXE
PID:940 -
\??\c:\lffxrlf.exec:\lffxrlf.exe58⤵
- Executes dropped EXE
PID:4084 -
\??\c:\hbhbbt.exec:\hbhbbt.exe59⤵
- Executes dropped EXE
PID:1552 -
\??\c:\3hhbnn.exec:\3hhbnn.exe60⤵
- Executes dropped EXE
PID:1328 -
\??\c:\jddvj.exec:\jddvj.exe61⤵
- Executes dropped EXE
PID:4532 -
\??\c:\rrxxrlf.exec:\rrxxrlf.exe62⤵
- Executes dropped EXE
PID:5028 -
\??\c:\tbhbtt.exec:\tbhbtt.exe63⤵
- Executes dropped EXE
PID:1404 -
\??\c:\hnbtnn.exec:\hnbtnn.exe64⤵
- Executes dropped EXE
PID:1868 -
\??\c:\jddvp.exec:\jddvp.exe65⤵
- Executes dropped EXE
PID:2292 -
\??\c:\fxfrlfx.exec:\fxfrlfx.exe66⤵PID:4236
-
\??\c:\tnhbbb.exec:\tnhbbb.exe67⤵PID:1520
-
\??\c:\jvddp.exec:\jvddp.exe68⤵PID:2960
-
\??\c:\xrfxxxl.exec:\xrfxxxl.exe69⤵PID:1408
-
\??\c:\bnttbt.exec:\bnttbt.exe70⤵PID:4132
-
\??\c:\ttnhhh.exec:\ttnhhh.exe71⤵PID:2776
-
\??\c:\3pdpj.exec:\3pdpj.exe72⤵PID:4312
-
\??\c:\rxlfxrr.exec:\rxlfxrr.exe73⤵PID:4740
-
\??\c:\bbnhbh.exec:\bbnhbh.exe74⤵PID:704
-
\??\c:\vvjjv.exec:\vvjjv.exe75⤵PID:4980
-
\??\c:\rfrrrxx.exec:\rfrrrxx.exe76⤵PID:3136
-
\??\c:\flffrrf.exec:\flffrrf.exe77⤵PID:2828
-
\??\c:\hnnbtt.exec:\hnnbtt.exe78⤵PID:4832
-
\??\c:\7jjdv.exec:\7jjdv.exe79⤵PID:4544
-
\??\c:\lfrflfx.exec:\lfrflfx.exe80⤵PID:4392
-
\??\c:\3bnhhh.exec:\3bnhhh.exe81⤵PID:4996
-
\??\c:\ntbttb.exec:\ntbttb.exe82⤵PID:3728
-
\??\c:\pvjdv.exec:\pvjdv.exe83⤵PID:800
-
\??\c:\xrrlffx.exec:\xrrlffx.exe84⤵PID:3720
-
\??\c:\ntbtnn.exec:\ntbtnn.exe85⤵PID:3148
-
\??\c:\vvvpj.exec:\vvvpj.exe86⤵PID:4664
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe87⤵PID:1848
-
\??\c:\ntnhtt.exec:\ntnhtt.exe88⤵PID:1920
-
\??\c:\7ppjd.exec:\7ppjd.exe89⤵PID:876
-
\??\c:\9flfxxr.exec:\9flfxxr.exe90⤵PID:1280
-
\??\c:\tbhbbb.exec:\tbhbbb.exe91⤵PID:4064
-
\??\c:\jjvvd.exec:\jjvvd.exe92⤵PID:4800
-
\??\c:\rflfxrl.exec:\rflfxrl.exe93⤵PID:2856
-
\??\c:\nhnhbb.exec:\nhnhbb.exe94⤵PID:1572
-
\??\c:\bbnhhh.exec:\bbnhhh.exe95⤵PID:3652
-
\??\c:\jpdvd.exec:\jpdvd.exe96⤵PID:1168
-
\??\c:\fxrrllf.exec:\fxrrllf.exe97⤵
- System Location Discovery: System Language Discovery
PID:3800 -
\??\c:\flfxllf.exec:\flfxllf.exe98⤵PID:1632
-
\??\c:\bbnhhb.exec:\bbnhhb.exe99⤵PID:1176
-
\??\c:\dvpjd.exec:\dvpjd.exe100⤵
- System Location Discovery: System Language Discovery
PID:1788 -
\??\c:\xlxrlfx.exec:\xlxrlfx.exe101⤵PID:1480
-
\??\c:\bbbbnn.exec:\bbbbnn.exe102⤵PID:796
-
\??\c:\jpvpd.exec:\jpvpd.exe103⤵PID:3164
-
\??\c:\jdjdp.exec:\jdjdp.exe104⤵PID:2868
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe105⤵PID:2916
-
\??\c:\bttntn.exec:\bttntn.exe106⤵PID:2488
-
\??\c:\dddvv.exec:\dddvv.exe107⤵PID:4880
-
\??\c:\lflxrlf.exec:\lflxrlf.exe108⤵PID:4868
-
\??\c:\rffxfxx.exec:\rffxfxx.exe109⤵PID:8
-
\??\c:\5bbbhh.exec:\5bbbhh.exe110⤵PID:4428
-
\??\c:\jpvpp.exec:\jpvpp.exe111⤵PID:1860
-
\??\c:\jdvvv.exec:\jdvvv.exe112⤵PID:5008
-
\??\c:\3lxrlfx.exec:\3lxrlfx.exe113⤵PID:3984
-
\??\c:\nhhhhn.exec:\nhhhhn.exe114⤵PID:2136
-
\??\c:\1hbttt.exec:\1hbttt.exe115⤵PID:1752
-
\??\c:\dvpvp.exec:\dvpvp.exe116⤵PID:744
-
\??\c:\lrxrrrl.exec:\lrxrrrl.exe117⤵PID:1092
-
\??\c:\nnntbt.exec:\nnntbt.exe118⤵PID:4140
-
\??\c:\3ttnhh.exec:\3ttnhh.exe119⤵
- System Location Discovery: System Language Discovery
PID:1660 -
\??\c:\9dvvj.exec:\9dvvj.exe120⤵PID:940
-
\??\c:\xfxlxfx.exec:\xfxlxfx.exe121⤵PID:1476
-
\??\c:\7nnnnn.exec:\7nnnnn.exe122⤵PID:3196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-