Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2024 19:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
40f7e8ca2e7095ceab3b9b5e54ea6ab4652ebb7120d53e267f42d2826ed85ac0.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
40f7e8ca2e7095ceab3b9b5e54ea6ab4652ebb7120d53e267f42d2826ed85ac0.exe
-
Size
453KB
-
MD5
39b141b964ebc93208d4a64703609546
-
SHA1
8de3eb382f5d4d4a857a0d9dbdf9775b8d52e60c
-
SHA256
40f7e8ca2e7095ceab3b9b5e54ea6ab4652ebb7120d53e267f42d2826ed85ac0
-
SHA512
d3e660f7d3e23653a9c7014990f3b227dc17c5aa079086f680228b63fc0be5b15d8f50afe1a419e3b99dccf2b862ca9e72f288764904eeec3ec926fe3f531dd0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet:q7Tc2NYHUrAwfMp3CDt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4820-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1248-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/888-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1944-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/516-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/768-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/908-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2092-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2180-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2516-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/100-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1184-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/632-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3900-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1012-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1112-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-749-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4252-1065-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-1424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1248 rlxrxxl.exe 888 nhhbtn.exe 3676 7ddvd.exe 4964 xrrlfxl.exe 1944 jvjdv.exe 2768 ttttnn.exe 864 7lrlllr.exe 1188 vpdpj.exe 2756 ddddv.exe 5104 5ddvp.exe 516 hnbtnh.exe 768 9dvpv.exe 3508 flxlrxr.exe 4104 fllfxxr.exe 3520 5bbnhb.exe 4412 bthbbb.exe 4712 xrfxfll.exe 2764 jjdjd.exe 3540 1bhhtt.exe 1160 vjjdv.exe 2120 nhnbtn.exe 2452 5ffxxfx.exe 908 lffxrlf.exe 4856 pddvv.exe 3144 rffxrfx.exe 1708 lflffff.exe 5036 jvjdd.exe 4008 hbtnhb.exe 4400 3xfxrlf.exe 3548 bbhbhh.exe 4432 7tnhbt.exe 4992 ppvpv.exe 2236 pdjdv.exe 4272 tbhtnn.exe 1456 ddjjd.exe 4684 lffxrlf.exe 5068 hhnhbt.exe 1752 1nnhbb.exe 1816 jjddv.exe 1864 xfxrlrl.exe 4588 nntnhh.exe 2240 jddvp.exe 3388 xrxrfxf.exe 4316 tbhhhb.exe 3252 pjvpv.exe 3912 rrlxrfr.exe 2760 9llfrrf.exe 1736 bbnhbt.exe 2092 vjjjd.exe 1980 fxllllr.exe 2064 hbhhhh.exe 2180 pjjdp.exe 1624 dpvjv.exe 2768 9llfxlf.exe 1672 nhbnhb.exe 4228 vppvv.exe 1676 3xfxrrr.exe 2516 nbtnbh.exe 3696 vpvpj.exe 3260 rlllfll.exe 4520 tthbhb.exe 1820 vdpjd.exe 3508 fxxlfxr.exe 3236 9tbtnh.exe -
resource yara_rule behavioral2/memory/4820-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1248-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/888-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/516-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/768-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/908-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1816-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2092-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2180-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2516-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/100-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1184-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/632-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3900-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1112-646-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rfflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtnn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4820 wrote to memory of 1248 4820 40f7e8ca2e7095ceab3b9b5e54ea6ab4652ebb7120d53e267f42d2826ed85ac0.exe 84 PID 4820 wrote to memory of 1248 4820 40f7e8ca2e7095ceab3b9b5e54ea6ab4652ebb7120d53e267f42d2826ed85ac0.exe 84 PID 4820 wrote to memory of 1248 4820 40f7e8ca2e7095ceab3b9b5e54ea6ab4652ebb7120d53e267f42d2826ed85ac0.exe 84 PID 1248 wrote to memory of 888 1248 rlxrxxl.exe 85 PID 1248 wrote to memory of 888 1248 rlxrxxl.exe 85 PID 1248 wrote to memory of 888 1248 rlxrxxl.exe 85 PID 888 wrote to memory of 3676 888 nhhbtn.exe 86 PID 888 wrote to memory of 3676 888 nhhbtn.exe 86 PID 888 wrote to memory of 3676 888 nhhbtn.exe 86 PID 3676 wrote to memory of 4964 3676 7ddvd.exe 87 PID 3676 wrote to memory of 4964 3676 7ddvd.exe 87 PID 3676 wrote to memory of 4964 3676 7ddvd.exe 87 PID 4964 wrote to memory of 1944 4964 xrrlfxl.exe 88 PID 4964 wrote to memory of 1944 4964 xrrlfxl.exe 88 PID 4964 wrote to memory of 1944 4964 xrrlfxl.exe 88 PID 1944 wrote to memory of 2768 1944 jvjdv.exe 89 PID 1944 wrote to memory of 2768 1944 jvjdv.exe 89 PID 1944 wrote to memory of 2768 1944 jvjdv.exe 89 PID 2768 wrote to memory of 864 2768 ttttnn.exe 90 PID 2768 wrote to memory of 864 2768 ttttnn.exe 90 PID 2768 wrote to memory of 864 2768 ttttnn.exe 90 PID 864 wrote to memory of 1188 864 7lrlllr.exe 91 PID 864 wrote to memory of 1188 864 7lrlllr.exe 91 PID 864 wrote to memory of 1188 864 7lrlllr.exe 91 PID 1188 wrote to memory of 2756 1188 vpdpj.exe 92 PID 1188 wrote to memory of 2756 1188 vpdpj.exe 92 PID 1188 wrote to memory of 2756 1188 vpdpj.exe 92 PID 2756 wrote to memory of 5104 2756 ddddv.exe 93 PID 2756 wrote to memory of 5104 2756 ddddv.exe 93 PID 2756 wrote to memory of 5104 2756 ddddv.exe 93 PID 5104 wrote to memory of 516 5104 5ddvp.exe 94 PID 5104 wrote to memory of 516 5104 5ddvp.exe 94 PID 5104 wrote to memory of 516 5104 5ddvp.exe 94 PID 516 wrote to memory of 768 516 hnbtnh.exe 95 PID 516 wrote to memory of 768 516 hnbtnh.exe 95 PID 516 wrote to memory of 768 516 hnbtnh.exe 95 PID 768 wrote to memory of 3508 768 9dvpv.exe 96 PID 768 wrote to memory of 3508 768 9dvpv.exe 96 PID 768 wrote to memory of 3508 768 9dvpv.exe 96 PID 3508 wrote to memory of 4104 3508 flxlrxr.exe 97 PID 3508 wrote to memory of 4104 3508 flxlrxr.exe 97 PID 3508 wrote to memory of 4104 3508 flxlrxr.exe 97 PID 4104 wrote to memory of 3520 4104 fllfxxr.exe 98 PID 4104 wrote to memory of 3520 4104 fllfxxr.exe 98 PID 4104 wrote to memory of 3520 4104 fllfxxr.exe 98 PID 3520 wrote to memory of 4412 3520 5bbnhb.exe 99 PID 3520 wrote to memory of 4412 3520 5bbnhb.exe 99 PID 3520 wrote to memory of 4412 3520 5bbnhb.exe 99 PID 4412 wrote to memory of 4712 4412 bthbbb.exe 100 PID 4412 wrote to memory of 4712 4412 bthbbb.exe 100 PID 4412 wrote to memory of 4712 4412 bthbbb.exe 100 PID 4712 wrote to memory of 2764 4712 xrfxfll.exe 101 PID 4712 wrote to memory of 2764 4712 xrfxfll.exe 101 PID 4712 wrote to memory of 2764 4712 xrfxfll.exe 101 PID 2764 wrote to memory of 3540 2764 jjdjd.exe 102 PID 2764 wrote to memory of 3540 2764 jjdjd.exe 102 PID 2764 wrote to memory of 3540 2764 jjdjd.exe 102 PID 3540 wrote to memory of 1160 3540 1bhhtt.exe 103 PID 3540 wrote to memory of 1160 3540 1bhhtt.exe 103 PID 3540 wrote to memory of 1160 3540 1bhhtt.exe 103 PID 1160 wrote to memory of 2120 1160 vjjdv.exe 104 PID 1160 wrote to memory of 2120 1160 vjjdv.exe 104 PID 1160 wrote to memory of 2120 1160 vjjdv.exe 104 PID 2120 wrote to memory of 2452 2120 nhnbtn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\40f7e8ca2e7095ceab3b9b5e54ea6ab4652ebb7120d53e267f42d2826ed85ac0.exe"C:\Users\Admin\AppData\Local\Temp\40f7e8ca2e7095ceab3b9b5e54ea6ab4652ebb7120d53e267f42d2826ed85ac0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\rlxrxxl.exec:\rlxrxxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\nhhbtn.exec:\nhhbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\7ddvd.exec:\7ddvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\xrrlfxl.exec:\xrrlfxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\jvjdv.exec:\jvjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\ttttnn.exec:\ttttnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\7lrlllr.exec:\7lrlllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\vpdpj.exec:\vpdpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\ddddv.exec:\ddddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\5ddvp.exec:\5ddvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\hnbtnh.exec:\hnbtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\9dvpv.exec:\9dvpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\flxlrxr.exec:\flxlrxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\fllfxxr.exec:\fllfxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\5bbnhb.exec:\5bbnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\bthbbb.exec:\bthbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\xrfxfll.exec:\xrfxfll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\jjdjd.exec:\jjdjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\1bhhtt.exec:\1bhhtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\vjjdv.exec:\vjjdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\nhnbtn.exec:\nhnbtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\5ffxxfx.exec:\5ffxxfx.exe23⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lffxrlf.exec:\lffxrlf.exe24⤵
- Executes dropped EXE
PID:908 -
\??\c:\pddvv.exec:\pddvv.exe25⤵
- Executes dropped EXE
PID:4856 -
\??\c:\rffxrfx.exec:\rffxrfx.exe26⤵
- Executes dropped EXE
PID:3144 -
\??\c:\lflffff.exec:\lflffff.exe27⤵
- Executes dropped EXE
PID:1708 -
\??\c:\jvjdd.exec:\jvjdd.exe28⤵
- Executes dropped EXE
PID:5036 -
\??\c:\hbtnhb.exec:\hbtnhb.exe29⤵
- Executes dropped EXE
PID:4008 -
\??\c:\3xfxrlf.exec:\3xfxrlf.exe30⤵
- Executes dropped EXE
PID:4400 -
\??\c:\bbhbhh.exec:\bbhbhh.exe31⤵
- Executes dropped EXE
PID:3548 -
\??\c:\7tnhbt.exec:\7tnhbt.exe32⤵
- Executes dropped EXE
PID:4432 -
\??\c:\ppvpv.exec:\ppvpv.exe33⤵
- Executes dropped EXE
PID:4992 -
\??\c:\pdjdv.exec:\pdjdv.exe34⤵
- Executes dropped EXE
PID:2236 -
\??\c:\tbhtnn.exec:\tbhtnn.exe35⤵
- Executes dropped EXE
PID:4272 -
\??\c:\ddjjd.exec:\ddjjd.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1456 -
\??\c:\lffxrlf.exec:\lffxrlf.exe37⤵
- Executes dropped EXE
PID:4684 -
\??\c:\hhnhbt.exec:\hhnhbt.exe38⤵
- Executes dropped EXE
PID:5068 -
\??\c:\1nnhbb.exec:\1nnhbb.exe39⤵
- Executes dropped EXE
PID:1752 -
\??\c:\jjddv.exec:\jjddv.exe40⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xfxrlrl.exec:\xfxrlrl.exe41⤵
- Executes dropped EXE
PID:1864 -
\??\c:\nntnhh.exec:\nntnhh.exe42⤵
- Executes dropped EXE
PID:4588 -
\??\c:\jddvp.exec:\jddvp.exe43⤵
- Executes dropped EXE
PID:2240 -
\??\c:\xrxrfxf.exec:\xrxrfxf.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3388 -
\??\c:\tbhhhb.exec:\tbhhhb.exe45⤵
- Executes dropped EXE
PID:4316 -
\??\c:\pjvpv.exec:\pjvpv.exe46⤵
- Executes dropped EXE
PID:3252 -
\??\c:\rrlxrfr.exec:\rrlxrfr.exe47⤵
- Executes dropped EXE
PID:3912 -
\??\c:\9llfrrf.exec:\9llfrrf.exe48⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bbnhbt.exec:\bbnhbt.exe49⤵
- Executes dropped EXE
PID:1736 -
\??\c:\vjjjd.exec:\vjjjd.exe50⤵
- Executes dropped EXE
PID:2092 -
\??\c:\fxllllr.exec:\fxllllr.exe51⤵
- Executes dropped EXE
PID:1980 -
\??\c:\hbhhhh.exec:\hbhhhh.exe52⤵
- Executes dropped EXE
PID:2064 -
\??\c:\pjjdp.exec:\pjjdp.exe53⤵
- Executes dropped EXE
PID:2180 -
\??\c:\dpvjv.exec:\dpvjv.exe54⤵
- Executes dropped EXE
PID:1624 -
\??\c:\9llfxlf.exec:\9llfxlf.exe55⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nhbnhb.exec:\nhbnhb.exe56⤵
- Executes dropped EXE
PID:1672 -
\??\c:\vppvv.exec:\vppvv.exe57⤵
- Executes dropped EXE
PID:4228 -
\??\c:\3xfxrrr.exec:\3xfxrrr.exe58⤵
- Executes dropped EXE
PID:1676 -
\??\c:\nbtnbh.exec:\nbtnbh.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2516 -
\??\c:\vpvpj.exec:\vpvpj.exe60⤵
- Executes dropped EXE
PID:3696 -
\??\c:\rlllfll.exec:\rlllfll.exe61⤵
- Executes dropped EXE
PID:3260 -
\??\c:\tthbhb.exec:\tthbhb.exe62⤵
- Executes dropped EXE
PID:4520 -
\??\c:\vdpjd.exec:\vdpjd.exe63⤵
- Executes dropped EXE
PID:1820 -
\??\c:\fxxlfxr.exec:\fxxlfxr.exe64⤵
- Executes dropped EXE
PID:3508 -
\??\c:\9tbtnh.exec:\9tbtnh.exe65⤵
- Executes dropped EXE
PID:3236 -
\??\c:\htbtnh.exec:\htbtnh.exe66⤵PID:344
-
\??\c:\jvvpj.exec:\jvvpj.exe67⤵PID:1956
-
\??\c:\rxxlfxr.exec:\rxxlfxr.exe68⤵PID:376
-
\??\c:\nhbtnh.exec:\nhbtnh.exe69⤵PID:3852
-
\??\c:\vpdpv.exec:\vpdpv.exe70⤵PID:2276
-
\??\c:\rxffxxx.exec:\rxffxxx.exe71⤵PID:100
-
\??\c:\ntnhbt.exec:\ntnhbt.exe72⤵PID:4388
-
\??\c:\bbhbtn.exec:\bbhbtn.exe73⤵PID:2088
-
\??\c:\3djpj.exec:\3djpj.exe74⤵PID:2016
-
\??\c:\fxrrlfr.exec:\fxrrlfr.exe75⤵PID:1160
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe76⤵PID:1908
-
\??\c:\btbttn.exec:\btbttn.exe77⤵PID:3216
-
\??\c:\jvdpj.exec:\jvdpj.exe78⤵PID:1696
-
\??\c:\lfxfxxr.exec:\lfxfxxr.exe79⤵PID:4092
-
\??\c:\tntnhh.exec:\tntnhh.exe80⤵PID:1184
-
\??\c:\1pddp.exec:\1pddp.exe81⤵PID:2960
-
\??\c:\lrfflrf.exec:\lrfflrf.exe82⤵PID:3700
-
\??\c:\bbnhth.exec:\bbnhth.exe83⤵PID:1708
-
\??\c:\vvvpp.exec:\vvvpp.exe84⤵PID:3376
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe85⤵PID:2720
-
\??\c:\jvdpj.exec:\jvdpj.exe86⤵PID:1792
-
\??\c:\llrrxxr.exec:\llrrxxr.exe87⤵
- System Location Discovery: System Language Discovery
PID:3052 -
\??\c:\llxflrx.exec:\llxflrx.exe88⤵PID:2084
-
\??\c:\5ddpp.exec:\5ddpp.exe89⤵PID:1000
-
\??\c:\llxrlrf.exec:\llxrlrf.exe90⤵PID:4864
-
\??\c:\xrrlffx.exec:\xrrlffx.exe91⤵PID:1580
-
\??\c:\dvpjd.exec:\dvpjd.exe92⤵PID:3600
-
\??\c:\jpvvp.exec:\jpvvp.exe93⤵PID:632
-
\??\c:\rlffxrl.exec:\rlffxrl.exe94⤵PID:4752
-
\??\c:\tbhbtn.exec:\tbhbtn.exe95⤵PID:1260
-
\??\c:\ddddv.exec:\ddddv.exe96⤵PID:1752
-
\??\c:\5jjdv.exec:\5jjdv.exe97⤵PID:1268
-
\??\c:\1ffffll.exec:\1ffffll.exe98⤵PID:2284
-
\??\c:\thhbtb.exec:\thhbtb.exe99⤵PID:3928
-
\??\c:\hhbttn.exec:\hhbttn.exe100⤵PID:4656
-
\??\c:\vpppv.exec:\vpppv.exe101⤵PID:4296
-
\??\c:\xfrlfxr.exec:\xfrlfxr.exe102⤵PID:4364
-
\??\c:\rlxrrrl.exec:\rlxrrrl.exe103⤵PID:4612
-
\??\c:\5nbnbb.exec:\5nbnbb.exe104⤵PID:1544
-
\??\c:\vjppj.exec:\vjppj.exe105⤵PID:2128
-
\??\c:\frxlllf.exec:\frxlllf.exe106⤵PID:2032
-
\??\c:\9btnhn.exec:\9btnhn.exe107⤵
- System Location Discovery: System Language Discovery
PID:1736 -
\??\c:\5pdvv.exec:\5pdvv.exe108⤵PID:3436
-
\??\c:\pdpjd.exec:\pdpjd.exe109⤵PID:3612
-
\??\c:\rxlxlxr.exec:\rxlxlxr.exe110⤵PID:384
-
\??\c:\httnhb.exec:\httnhb.exe111⤵PID:3900
-
\??\c:\lxxflxf.exec:\lxxflxf.exe112⤵PID:4844
-
\??\c:\lllfxxx.exec:\lllfxxx.exe113⤵PID:2920
-
\??\c:\hbnntn.exec:\hbnntn.exe114⤵PID:1152
-
\??\c:\dvvpj.exec:\dvvpj.exe115⤵PID:4152
-
\??\c:\lxfllff.exec:\lxfllff.exe116⤵PID:2116
-
\??\c:\pjddv.exec:\pjddv.exe117⤵PID:1676
-
\??\c:\lllfxxr.exec:\lllfxxr.exe118⤵PID:4484
-
\??\c:\7rrllrl.exec:\7rrllrl.exe119⤵PID:2984
-
\??\c:\hbnhbb.exec:\hbnhbb.exe120⤵PID:3324
-
\??\c:\vpjpj.exec:\vpjpj.exe121⤵PID:768
-
\??\c:\fxxrlll.exec:\fxxrlll.exe122⤵PID:4540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-