Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 21:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
40c7abfaf5573114bee3deb16500c3cbee7e05bdf71b679648136f5f88f2f388N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
40c7abfaf5573114bee3deb16500c3cbee7e05bdf71b679648136f5f88f2f388N.exe
-
Size
453KB
-
MD5
0a3ba0890e8533ca41eea453d826a3d0
-
SHA1
21072709d92bbc895c69dc3cb3b83506d572ea7c
-
SHA256
40c7abfaf5573114bee3deb16500c3cbee7e05bdf71b679648136f5f88f2f388
-
SHA512
c97733b2471528ac10ac7d0ec37adccc73ad7c6ae1fc070f534cd40e22112dc8e5bf9dca93b250f053f203f1e5b521c09de331a5474ca60dcd1358fc41a95538
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe2:q7Tc2NYHUrAwfMp3CD2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2172-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1236-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1328-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4244-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1412-791-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-798-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-850-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-966-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-1021-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-1933-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1236 bnntnb.exe 2172 dpjpd.exe 3716 rlxrffx.exe 4332 thnnhh.exe 3184 fxxlffx.exe 2120 pdjvd.exe 1980 bntnbt.exe 2388 xxrllff.exe 4648 dvvdp.exe 1684 lffrffl.exe 2600 bhnnnt.exe 2816 thbnbt.exe 3132 dvppj.exe 3692 9rxxrrl.exe 3032 rlxrrxf.exe 2396 tntbbn.exe 1580 vjvvd.exe 2400 lfffxxx.exe 1328 btnnhh.exe 2456 lxllfll.exe 2124 dvvjd.exe 3488 9lrfxxr.exe 1736 xfrffxr.exe 2300 jjvdp.exe 4064 lflllxr.exe 3396 ppjpd.exe 4460 rxrrxxx.exe 4156 xffrrrx.exe 4552 pjvpj.exe 4420 fllffff.exe 4244 jdppp.exe 3196 7djjd.exe 4296 bbnntt.exe 5056 3jvpd.exe 4712 1ffxffl.exe 1952 5tnhbt.exe 4204 7hhhhn.exe 3984 fxffxff.exe 2616 nnnhtb.exe 4840 jvjdd.exe 228 ddvvd.exe 3496 5frllxf.exe 1692 bthnbb.exe 3472 vvjjd.exe 4664 dvvvp.exe 1076 fflflll.exe 4560 nnbbhh.exe 4112 vvvpj.exe 3936 xlrrlrx.exe 4976 rfrllll.exe 728 hhhhbb.exe 5000 3jvpv.exe 4588 vpjdj.exe 4008 lffxxrl.exe 4412 3hnbtb.exe 4684 ddddd.exe 3184 djppd.exe 4792 rllfxrf.exe 2020 pdppv.exe 3352 pddvp.exe 5016 lxxlfxf.exe 1160 1ntnhh.exe 3424 7jdvv.exe 456 flxlfrl.exe -
resource yara_rule behavioral2/memory/1236-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1236-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4244-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1816-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1412-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-798-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-850-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-854-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-966-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3968 wrote to memory of 1236 3968 40c7abfaf5573114bee3deb16500c3cbee7e05bdf71b679648136f5f88f2f388N.exe 83 PID 3968 wrote to memory of 1236 3968 40c7abfaf5573114bee3deb16500c3cbee7e05bdf71b679648136f5f88f2f388N.exe 83 PID 3968 wrote to memory of 1236 3968 40c7abfaf5573114bee3deb16500c3cbee7e05bdf71b679648136f5f88f2f388N.exe 83 PID 1236 wrote to memory of 2172 1236 bnntnb.exe 84 PID 1236 wrote to memory of 2172 1236 bnntnb.exe 84 PID 1236 wrote to memory of 2172 1236 bnntnb.exe 84 PID 2172 wrote to memory of 3716 2172 dpjpd.exe 85 PID 2172 wrote to memory of 3716 2172 dpjpd.exe 85 PID 2172 wrote to memory of 3716 2172 dpjpd.exe 85 PID 3716 wrote to memory of 4332 3716 rlxrffx.exe 86 PID 3716 wrote to memory of 4332 3716 rlxrffx.exe 86 PID 3716 wrote to memory of 4332 3716 rlxrffx.exe 86 PID 4332 wrote to memory of 3184 4332 thnnhh.exe 87 PID 4332 wrote to memory of 3184 4332 thnnhh.exe 87 PID 4332 wrote to memory of 3184 4332 thnnhh.exe 87 PID 3184 wrote to memory of 2120 3184 fxxlffx.exe 88 PID 3184 wrote to memory of 2120 3184 fxxlffx.exe 88 PID 3184 wrote to memory of 2120 3184 fxxlffx.exe 88 PID 2120 wrote to memory of 1980 2120 pdjvd.exe 89 PID 2120 wrote to memory of 1980 2120 pdjvd.exe 89 PID 2120 wrote to memory of 1980 2120 pdjvd.exe 89 PID 1980 wrote to memory of 2388 1980 bntnbt.exe 90 PID 1980 wrote to memory of 2388 1980 bntnbt.exe 90 PID 1980 wrote to memory of 2388 1980 bntnbt.exe 90 PID 2388 wrote to memory of 4648 2388 xxrllff.exe 91 PID 2388 wrote to memory of 4648 2388 xxrllff.exe 91 PID 2388 wrote to memory of 4648 2388 xxrllff.exe 91 PID 4648 wrote to memory of 1684 4648 dvvdp.exe 92 PID 4648 wrote to memory of 1684 4648 dvvdp.exe 92 PID 4648 wrote to memory of 1684 4648 dvvdp.exe 92 PID 1684 wrote to memory of 2600 1684 lffrffl.exe 93 PID 1684 wrote to memory of 2600 1684 lffrffl.exe 93 PID 1684 wrote to memory of 2600 1684 lffrffl.exe 93 PID 2600 wrote to memory of 2816 2600 bhnnnt.exe 94 PID 2600 wrote to memory of 2816 2600 bhnnnt.exe 94 PID 2600 wrote to memory of 2816 2600 bhnnnt.exe 94 PID 2816 wrote to memory of 3132 2816 thbnbt.exe 95 PID 2816 wrote to memory of 3132 2816 thbnbt.exe 95 PID 2816 wrote to memory of 3132 2816 thbnbt.exe 95 PID 3132 wrote to memory of 3692 3132 dvppj.exe 96 PID 3132 wrote to memory of 3692 3132 dvppj.exe 96 PID 3132 wrote to memory of 3692 3132 dvppj.exe 96 PID 3692 wrote to memory of 3032 3692 9rxxrrl.exe 97 PID 3692 wrote to memory of 3032 3692 9rxxrrl.exe 97 PID 3692 wrote to memory of 3032 3692 9rxxrrl.exe 97 PID 3032 wrote to memory of 2396 3032 rlxrrxf.exe 98 PID 3032 wrote to memory of 2396 3032 rlxrrxf.exe 98 PID 3032 wrote to memory of 2396 3032 rlxrrxf.exe 98 PID 2396 wrote to memory of 1580 2396 tntbbn.exe 99 PID 2396 wrote to memory of 1580 2396 tntbbn.exe 99 PID 2396 wrote to memory of 1580 2396 tntbbn.exe 99 PID 1580 wrote to memory of 2400 1580 vjvvd.exe 100 PID 1580 wrote to memory of 2400 1580 vjvvd.exe 100 PID 1580 wrote to memory of 2400 1580 vjvvd.exe 100 PID 2400 wrote to memory of 1328 2400 lfffxxx.exe 101 PID 2400 wrote to memory of 1328 2400 lfffxxx.exe 101 PID 2400 wrote to memory of 1328 2400 lfffxxx.exe 101 PID 1328 wrote to memory of 2456 1328 btnnhh.exe 102 PID 1328 wrote to memory of 2456 1328 btnnhh.exe 102 PID 1328 wrote to memory of 2456 1328 btnnhh.exe 102 PID 2456 wrote to memory of 2124 2456 lxllfll.exe 103 PID 2456 wrote to memory of 2124 2456 lxllfll.exe 103 PID 2456 wrote to memory of 2124 2456 lxllfll.exe 103 PID 2124 wrote to memory of 3488 2124 dvvjd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\40c7abfaf5573114bee3deb16500c3cbee7e05bdf71b679648136f5f88f2f388N.exe"C:\Users\Admin\AppData\Local\Temp\40c7abfaf5573114bee3deb16500c3cbee7e05bdf71b679648136f5f88f2f388N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\bnntnb.exec:\bnntnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\dpjpd.exec:\dpjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\rlxrffx.exec:\rlxrffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\thnnhh.exec:\thnnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\fxxlffx.exec:\fxxlffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\pdjvd.exec:\pdjvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\bntnbt.exec:\bntnbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\xxrllff.exec:\xxrllff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\dvvdp.exec:\dvvdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\lffrffl.exec:\lffrffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\bhnnnt.exec:\bhnnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\thbnbt.exec:\thbnbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\dvppj.exec:\dvppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\9rxxrrl.exec:\9rxxrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\rlxrrxf.exec:\rlxrrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\tntbbn.exec:\tntbbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\vjvvd.exec:\vjvvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\lfffxxx.exec:\lfffxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\btnnhh.exec:\btnnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\lxllfll.exec:\lxllfll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\dvvjd.exec:\dvvjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\9lrfxxr.exec:\9lrfxxr.exe23⤵
- Executes dropped EXE
PID:3488 -
\??\c:\xfrffxr.exec:\xfrffxr.exe24⤵
- Executes dropped EXE
PID:1736 -
\??\c:\jjvdp.exec:\jjvdp.exe25⤵
- Executes dropped EXE
PID:2300 -
\??\c:\lflllxr.exec:\lflllxr.exe26⤵
- Executes dropped EXE
PID:4064 -
\??\c:\ppjpd.exec:\ppjpd.exe27⤵
- Executes dropped EXE
PID:3396 -
\??\c:\rxrrxxx.exec:\rxrrxxx.exe28⤵
- Executes dropped EXE
PID:4460 -
\??\c:\xffrrrx.exec:\xffrrrx.exe29⤵
- Executes dropped EXE
PID:4156 -
\??\c:\pjvpj.exec:\pjvpj.exe30⤵
- Executes dropped EXE
PID:4552 -
\??\c:\fllffff.exec:\fllffff.exe31⤵
- Executes dropped EXE
PID:4420 -
\??\c:\jdppp.exec:\jdppp.exe32⤵
- Executes dropped EXE
PID:4244 -
\??\c:\7djjd.exec:\7djjd.exe33⤵
- Executes dropped EXE
PID:3196 -
\??\c:\bbnntt.exec:\bbnntt.exe34⤵
- Executes dropped EXE
PID:4296 -
\??\c:\3jvpd.exec:\3jvpd.exe35⤵
- Executes dropped EXE
PID:5056 -
\??\c:\1ffxffl.exec:\1ffxffl.exe36⤵
- Executes dropped EXE
PID:4712 -
\??\c:\5tnhbt.exec:\5tnhbt.exe37⤵
- Executes dropped EXE
PID:1952 -
\??\c:\7hhhhn.exec:\7hhhhn.exe38⤵
- Executes dropped EXE
PID:4204 -
\??\c:\fxffxff.exec:\fxffxff.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3984 -
\??\c:\nnnhtb.exec:\nnnhtb.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jvjdd.exec:\jvjdd.exe41⤵
- Executes dropped EXE
PID:4840 -
\??\c:\ddvvd.exec:\ddvvd.exe42⤵
- Executes dropped EXE
PID:228 -
\??\c:\5frllxf.exec:\5frllxf.exe43⤵
- Executes dropped EXE
PID:3496 -
\??\c:\bthnbb.exec:\bthnbb.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1692 -
\??\c:\vvjjd.exec:\vvjjd.exe45⤵
- Executes dropped EXE
PID:3472 -
\??\c:\dvvvp.exec:\dvvvp.exe46⤵
- Executes dropped EXE
PID:4664 -
\??\c:\fflflll.exec:\fflflll.exe47⤵
- Executes dropped EXE
PID:1076 -
\??\c:\nnbbhh.exec:\nnbbhh.exe48⤵
- Executes dropped EXE
PID:4560 -
\??\c:\vvvpj.exec:\vvvpj.exe49⤵
- Executes dropped EXE
PID:4112 -
\??\c:\xlrrlrx.exec:\xlrrlrx.exe50⤵
- Executes dropped EXE
PID:3936 -
\??\c:\rfrllll.exec:\rfrllll.exe51⤵
- Executes dropped EXE
PID:4976 -
\??\c:\hhhhbb.exec:\hhhhbb.exe52⤵
- Executes dropped EXE
PID:728 -
\??\c:\3jvpv.exec:\3jvpv.exe53⤵
- Executes dropped EXE
PID:5000 -
\??\c:\vpjdj.exec:\vpjdj.exe54⤵
- Executes dropped EXE
PID:4588 -
\??\c:\lffxxrl.exec:\lffxxrl.exe55⤵
- Executes dropped EXE
PID:4008 -
\??\c:\3hnbtb.exec:\3hnbtb.exe56⤵
- Executes dropped EXE
PID:4412 -
\??\c:\ddddd.exec:\ddddd.exe57⤵
- Executes dropped EXE
PID:4684 -
\??\c:\djppd.exec:\djppd.exe58⤵
- Executes dropped EXE
PID:3184 -
\??\c:\rllfxrf.exec:\rllfxrf.exe59⤵
- Executes dropped EXE
PID:4792 -
\??\c:\pdppv.exec:\pdppv.exe60⤵
- Executes dropped EXE
PID:2020 -
\??\c:\pddvp.exec:\pddvp.exe61⤵
- Executes dropped EXE
PID:3352 -
\??\c:\lxxlfxf.exec:\lxxlfxf.exe62⤵
- Executes dropped EXE
PID:5016 -
\??\c:\1ntnhh.exec:\1ntnhh.exe63⤵
- Executes dropped EXE
PID:1160 -
\??\c:\7jdvv.exec:\7jdvv.exe64⤵
- Executes dropped EXE
PID:3424 -
\??\c:\flxlfrl.exec:\flxlfrl.exe65⤵
- Executes dropped EXE
PID:456 -
\??\c:\bttnnn.exec:\bttnnn.exe66⤵PID:1816
-
\??\c:\vpvpp.exec:\vpvpp.exe67⤵PID:2376
-
\??\c:\rfxxxff.exec:\rfxxxff.exe68⤵PID:3100
-
\??\c:\9nhhhb.exec:\9nhhhb.exe69⤵PID:1792
-
\??\c:\3htnhn.exec:\3htnhn.exe70⤵PID:4960
-
\??\c:\dddvj.exec:\dddvj.exe71⤵PID:536
-
\??\c:\3lfxrrr.exec:\3lfxrrr.exe72⤵PID:4328
-
\??\c:\9bnhbn.exec:\9bnhbn.exe73⤵PID:2924
-
\??\c:\ntnhbb.exec:\ntnhbb.exe74⤵PID:4288
-
\??\c:\pjjdv.exec:\pjjdv.exe75⤵PID:2876
-
\??\c:\lrxxlll.exec:\lrxxlll.exe76⤵PID:4696
-
\??\c:\nbhbtt.exec:\nbhbtt.exe77⤵PID:2936
-
\??\c:\bbtnnt.exec:\bbtnnt.exe78⤵PID:1948
-
\??\c:\5jjdv.exec:\5jjdv.exe79⤵PID:1836
-
\??\c:\rxlfffx.exec:\rxlfffx.exe80⤵PID:1276
-
\??\c:\thhbtn.exec:\thhbtn.exe81⤵PID:2096
-
\??\c:\nbbbtb.exec:\nbbbtb.exe82⤵PID:1020
-
\??\c:\dpdjv.exec:\dpdjv.exe83⤵PID:3288
-
\??\c:\rllffff.exec:\rllffff.exe84⤵PID:956
-
\??\c:\rffrllf.exec:\rffrllf.exe85⤵PID:1696
-
\??\c:\tnbtbt.exec:\tnbtbt.exe86⤵PID:4844
-
\??\c:\9jpjd.exec:\9jpjd.exe87⤵PID:3988
-
\??\c:\7lrxfxr.exec:\7lrxfxr.exe88⤵PID:4068
-
\??\c:\bbtnhh.exec:\bbtnhh.exe89⤵PID:4576
-
\??\c:\vjvpj.exec:\vjvpj.exe90⤵PID:5088
-
\??\c:\lfffxrl.exec:\lfffxrl.exe91⤵PID:3500
-
\??\c:\ttbttt.exec:\ttbttt.exe92⤵PID:1688
-
\??\c:\jpvpd.exec:\jpvpd.exe93⤵PID:1412
-
\??\c:\9jpjp.exec:\9jpjp.exe94⤵PID:3036
-
\??\c:\llrxrrl.exec:\llrxrrl.exe95⤵PID:3196
-
\??\c:\hhbbtn.exec:\hhbbtn.exe96⤵PID:4432
-
\??\c:\pjjdp.exec:\pjjdp.exe97⤵PID:2940
-
\??\c:\9jjdp.exec:\9jjdp.exe98⤵PID:3360
-
\??\c:\xrrlffx.exec:\xrrlffx.exe99⤵PID:2692
-
\??\c:\nntbtt.exec:\nntbtt.exe100⤵
- System Location Discovery: System Language Discovery
PID:5060 -
\??\c:\7ppdv.exec:\7ppdv.exe101⤵PID:2200
-
\??\c:\lfxlfxl.exec:\lfxlfxl.exe102⤵PID:908
-
\??\c:\5flfrxr.exec:\5flfrxr.exe103⤵PID:4500
-
\??\c:\7hhbtt.exec:\7hhbtt.exe104⤵PID:3816
-
\??\c:\vpdvv.exec:\vpdvv.exe105⤵PID:1892
-
\??\c:\xrrlffx.exec:\xrrlffx.exe106⤵PID:1240
-
\??\c:\fllfxxr.exec:\fllfxxr.exe107⤵PID:2116
-
\??\c:\tttntn.exec:\tttntn.exe108⤵PID:3660
-
\??\c:\7djdv.exec:\7djdv.exe109⤵PID:4664
-
\??\c:\lxlfxrl.exec:\lxlfxrl.exe110⤵PID:1076
-
\??\c:\bbhbtb.exec:\bbhbtb.exe111⤵PID:3460
-
\??\c:\ppvpj.exec:\ppvpj.exe112⤵PID:3552
-
\??\c:\fxlfllx.exec:\fxlfllx.exe113⤵PID:3936
-
\??\c:\bhbbtt.exec:\bhbbtt.exe114⤵PID:4976
-
\??\c:\jvjjd.exec:\jvjjd.exe115⤵PID:3248
-
\??\c:\pvdpj.exec:\pvdpj.exe116⤵PID:5000
-
\??\c:\3lrlfff.exec:\3lrlfff.exe117⤵PID:3476
-
\??\c:\9bbttn.exec:\9bbttn.exe118⤵PID:4008
-
\??\c:\9vdvp.exec:\9vdvp.exe119⤵PID:2028
-
\??\c:\pdjdd.exec:\pdjdd.exe120⤵PID:4684
-
\??\c:\xrxrllf.exec:\xrxrllf.exe121⤵PID:3184
-
\??\c:\nhhbtn.exec:\nhhbtn.exe122⤵PID:3980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-