Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 06:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
40b1539773c07e50d55df097e1c2aa555aad8501d1252ec88ecc55fef2afcb14.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
40b1539773c07e50d55df097e1c2aa555aad8501d1252ec88ecc55fef2afcb14.exe
-
Size
453KB
-
MD5
f7c7677aea13b955ac9b92850c70e7ea
-
SHA1
d93dc45442005380b4747915175509277dd4ce2a
-
SHA256
40b1539773c07e50d55df097e1c2aa555aad8501d1252ec88ecc55fef2afcb14
-
SHA512
135bc00ac2d6e20757cd8981d64877124c4ff798a96e60c025603af8b0f9c62eec5cd5a23e596aa1d8c4fffc91fa881919b48d9b6fe108a67d3cbd8527cebb96
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbev:q7Tc2NYHUrAwfMp3CDv
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/2756-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-75-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/968-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/968-94-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2648-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-123-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2796-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-243-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/872-269-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2364-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-480-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1252-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-505-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/916-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/712-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-735-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-730-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2444-742-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1748-756-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2464-759-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1340-782-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1840-793-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1280-808-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-833-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-846-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2804-874-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2640-897-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/880-961-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2016-1049-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2772-1068-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/872-1080-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2772-1089-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1652-1140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2828 bbtnhb.exe 2616 vvvvv.exe 2644 bbtbnt.exe 2696 nhbhtt.exe 2604 djvjd.exe 2320 xxrxlrf.exe 2168 9vdjv.exe 796 1rlxffx.exe 968 pjvvj.exe 2648 pdjvj.exe 2064 bhbbth.exe 2796 3jjvj.exe 1976 nnhthh.exe 2668 5xrrflx.exe 1960 hbttbn.exe 2280 3vppv.exe 2432 bthhnt.exe 2572 5jdjp.exe 2268 9rlxxrx.exe 1596 jpjpp.exe 284 ffflrxl.exe 2412 btbhbb.exe 704 pjppv.exe 2772 nbnnbt.exe 1320 hnbnbn.exe 872 vvjdv.exe 236 rlxflxl.exe 2308 nthnbb.exe 1628 3vddp.exe 716 1xlrfrx.exe 2208 1bttbh.exe 1900 9rlfrxl.exe 2364 bbnbhn.exe 1552 dpvdp.exe 2756 fxrlxxx.exe 2916 xxrxxfr.exe 2616 5bnnnt.exe 1644 dpvdp.exe 2964 xxrxfrl.exe 2656 nhttnt.exe 2620 hbnnbb.exe 340 vvvpj.exe 2236 1frrrfl.exe 1000 ttnttb.exe 796 5bhhnn.exe 652 ddpjv.exe 2068 fxlrxxl.exe 880 lfrxffr.exe 2040 tnhhhn.exe 2704 dvpvd.exe 776 lfflxfl.exe 2880 frrxllx.exe 1584 9hbhhn.exe 2468 1vjjv.exe 2588 dddpj.exe 3016 7fxflrx.exe 2480 tnnbhh.exe 2296 nnnbnt.exe 1748 1ddpp.exe 2464 ddvdj.exe 1124 9fxlrxf.exe 296 tthhbn.exe 1232 3bthhn.exe 1252 dvpdj.exe -
resource yara_rule behavioral1/memory/2756-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/968-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-653-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/712-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-756-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1280-808-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-833-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-904-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-1075-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-1121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-1140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-1159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-1190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-1203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-1261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-1290-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2828 2756 40b1539773c07e50d55df097e1c2aa555aad8501d1252ec88ecc55fef2afcb14.exe 30 PID 2756 wrote to memory of 2828 2756 40b1539773c07e50d55df097e1c2aa555aad8501d1252ec88ecc55fef2afcb14.exe 30 PID 2756 wrote to memory of 2828 2756 40b1539773c07e50d55df097e1c2aa555aad8501d1252ec88ecc55fef2afcb14.exe 30 PID 2756 wrote to memory of 2828 2756 40b1539773c07e50d55df097e1c2aa555aad8501d1252ec88ecc55fef2afcb14.exe 30 PID 2828 wrote to memory of 2616 2828 bbtnhb.exe 31 PID 2828 wrote to memory of 2616 2828 bbtnhb.exe 31 PID 2828 wrote to memory of 2616 2828 bbtnhb.exe 31 PID 2828 wrote to memory of 2616 2828 bbtnhb.exe 31 PID 2616 wrote to memory of 2644 2616 vvvvv.exe 32 PID 2616 wrote to memory of 2644 2616 vvvvv.exe 32 PID 2616 wrote to memory of 2644 2616 vvvvv.exe 32 PID 2616 wrote to memory of 2644 2616 vvvvv.exe 32 PID 2644 wrote to memory of 2696 2644 bbtbnt.exe 33 PID 2644 wrote to memory of 2696 2644 bbtbnt.exe 33 PID 2644 wrote to memory of 2696 2644 bbtbnt.exe 33 PID 2644 wrote to memory of 2696 2644 bbtbnt.exe 33 PID 2696 wrote to memory of 2604 2696 nhbhtt.exe 34 PID 2696 wrote to memory of 2604 2696 nhbhtt.exe 34 PID 2696 wrote to memory of 2604 2696 nhbhtt.exe 34 PID 2696 wrote to memory of 2604 2696 nhbhtt.exe 34 PID 2604 wrote to memory of 2320 2604 djvjd.exe 35 PID 2604 wrote to memory of 2320 2604 djvjd.exe 35 PID 2604 wrote to memory of 2320 2604 djvjd.exe 35 PID 2604 wrote to memory of 2320 2604 djvjd.exe 35 PID 2320 wrote to memory of 2168 2320 xxrxlrf.exe 36 PID 2320 wrote to memory of 2168 2320 xxrxlrf.exe 36 PID 2320 wrote to memory of 2168 2320 xxrxlrf.exe 36 PID 2320 wrote to memory of 2168 2320 xxrxlrf.exe 36 PID 2168 wrote to memory of 796 2168 9vdjv.exe 37 PID 2168 wrote to memory of 796 2168 9vdjv.exe 37 PID 2168 wrote to memory of 796 2168 9vdjv.exe 37 PID 2168 wrote to memory of 796 2168 9vdjv.exe 37 PID 796 wrote to memory of 968 796 1rlxffx.exe 38 PID 796 wrote to memory of 968 796 1rlxffx.exe 38 PID 796 wrote to memory of 968 796 1rlxffx.exe 38 PID 796 wrote to memory of 968 796 1rlxffx.exe 38 PID 968 wrote to memory of 2648 968 pjvvj.exe 39 PID 968 wrote to memory of 2648 968 pjvvj.exe 39 PID 968 wrote to memory of 2648 968 pjvvj.exe 39 PID 968 wrote to memory of 2648 968 pjvvj.exe 39 PID 2648 wrote to memory of 2064 2648 pdjvj.exe 40 PID 2648 wrote to memory of 2064 2648 pdjvj.exe 40 PID 2648 wrote to memory of 2064 2648 pdjvj.exe 40 PID 2648 wrote to memory of 2064 2648 pdjvj.exe 40 PID 2064 wrote to memory of 2796 2064 bhbbth.exe 41 PID 2064 wrote to memory of 2796 2064 bhbbth.exe 41 PID 2064 wrote to memory of 2796 2064 bhbbth.exe 41 PID 2064 wrote to memory of 2796 2064 bhbbth.exe 41 PID 2796 wrote to memory of 1976 2796 3jjvj.exe 42 PID 2796 wrote to memory of 1976 2796 3jjvj.exe 42 PID 2796 wrote to memory of 1976 2796 3jjvj.exe 42 PID 2796 wrote to memory of 1976 2796 3jjvj.exe 42 PID 1976 wrote to memory of 2668 1976 nnhthh.exe 43 PID 1976 wrote to memory of 2668 1976 nnhthh.exe 43 PID 1976 wrote to memory of 2668 1976 nnhthh.exe 43 PID 1976 wrote to memory of 2668 1976 nnhthh.exe 43 PID 2668 wrote to memory of 1960 2668 5xrrflx.exe 44 PID 2668 wrote to memory of 1960 2668 5xrrflx.exe 44 PID 2668 wrote to memory of 1960 2668 5xrrflx.exe 44 PID 2668 wrote to memory of 1960 2668 5xrrflx.exe 44 PID 1960 wrote to memory of 2280 1960 hbttbn.exe 45 PID 1960 wrote to memory of 2280 1960 hbttbn.exe 45 PID 1960 wrote to memory of 2280 1960 hbttbn.exe 45 PID 1960 wrote to memory of 2280 1960 hbttbn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\40b1539773c07e50d55df097e1c2aa555aad8501d1252ec88ecc55fef2afcb14.exe"C:\Users\Admin\AppData\Local\Temp\40b1539773c07e50d55df097e1c2aa555aad8501d1252ec88ecc55fef2afcb14.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\bbtnhb.exec:\bbtnhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\vvvvv.exec:\vvvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\bbtbnt.exec:\bbtbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\nhbhtt.exec:\nhbhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\djvjd.exec:\djvjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\9vdjv.exec:\9vdjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\1rlxffx.exec:\1rlxffx.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\pjvvj.exec:\pjvvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\pdjvj.exec:\pdjvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\bhbbth.exec:\bhbbth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\3jjvj.exec:\3jjvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\nnhthh.exec:\nnhthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\5xrrflx.exec:\5xrrflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\hbttbn.exec:\hbttbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\3vppv.exec:\3vppv.exe17⤵
- Executes dropped EXE
PID:2280 -
\??\c:\bthhnt.exec:\bthhnt.exe18⤵
- Executes dropped EXE
PID:2432 -
\??\c:\5jdjp.exec:\5jdjp.exe19⤵
- Executes dropped EXE
PID:2572 -
\??\c:\9rlxxrx.exec:\9rlxxrx.exe20⤵
- Executes dropped EXE
PID:2268 -
\??\c:\jpjpp.exec:\jpjpp.exe21⤵
- Executes dropped EXE
PID:1596 -
\??\c:\ffflrxl.exec:\ffflrxl.exe22⤵
- Executes dropped EXE
PID:284 -
\??\c:\btbhbb.exec:\btbhbb.exe23⤵
- Executes dropped EXE
PID:2412 -
\??\c:\pjppv.exec:\pjppv.exe24⤵
- Executes dropped EXE
PID:704 -
\??\c:\nbnnbt.exec:\nbnnbt.exe25⤵
- Executes dropped EXE
PID:2772 -
\??\c:\hnbnbn.exec:\hnbnbn.exe26⤵
- Executes dropped EXE
PID:1320 -
\??\c:\vvjdv.exec:\vvjdv.exe27⤵
- Executes dropped EXE
PID:872 -
\??\c:\rlxflxl.exec:\rlxflxl.exe28⤵
- Executes dropped EXE
PID:236 -
\??\c:\nthnbb.exec:\nthnbb.exe29⤵
- Executes dropped EXE
PID:2308 -
\??\c:\3vddp.exec:\3vddp.exe30⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1xlrfrx.exec:\1xlrfrx.exe31⤵
- Executes dropped EXE
PID:716 -
\??\c:\1bttbh.exec:\1bttbh.exe32⤵
- Executes dropped EXE
PID:2208 -
\??\c:\9rlfrxl.exec:\9rlfrxl.exe33⤵
- Executes dropped EXE
PID:1900 -
\??\c:\bbnbhn.exec:\bbnbhn.exe34⤵
- Executes dropped EXE
PID:2364 -
\??\c:\dpvdp.exec:\dpvdp.exe35⤵
- Executes dropped EXE
PID:1552 -
\??\c:\fxrlxxx.exec:\fxrlxxx.exe36⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xxrxxfr.exec:\xxrxxfr.exe37⤵
- Executes dropped EXE
PID:2916 -
\??\c:\5bnnnt.exec:\5bnnnt.exe38⤵
- Executes dropped EXE
PID:2616 -
\??\c:\dpvdp.exec:\dpvdp.exe39⤵
- Executes dropped EXE
PID:1644 -
\??\c:\xxrxfrl.exec:\xxrxfrl.exe40⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nhttnt.exec:\nhttnt.exe41⤵
- Executes dropped EXE
PID:2656 -
\??\c:\hbnnbb.exec:\hbnnbb.exe42⤵
- Executes dropped EXE
PID:2620 -
\??\c:\vvvpj.exec:\vvvpj.exe43⤵
- Executes dropped EXE
PID:340 -
\??\c:\1frrrfl.exec:\1frrrfl.exe44⤵
- Executes dropped EXE
PID:2236 -
\??\c:\ttnttb.exec:\ttnttb.exe45⤵
- Executes dropped EXE
PID:1000 -
\??\c:\5bhhnn.exec:\5bhhnn.exe46⤵
- Executes dropped EXE
PID:796 -
\??\c:\ddpjv.exec:\ddpjv.exe47⤵
- Executes dropped EXE
PID:652 -
\??\c:\fxlrxxl.exec:\fxlrxxl.exe48⤵
- Executes dropped EXE
PID:2068 -
\??\c:\lfrxffr.exec:\lfrxffr.exe49⤵
- Executes dropped EXE
PID:880 -
\??\c:\tnhhhn.exec:\tnhhhn.exe50⤵
- Executes dropped EXE
PID:2040 -
\??\c:\dvpvd.exec:\dvpvd.exe51⤵
- Executes dropped EXE
PID:2704 -
\??\c:\lfflxfl.exec:\lfflxfl.exe52⤵
- Executes dropped EXE
PID:776 -
\??\c:\frrxllx.exec:\frrxllx.exe53⤵
- Executes dropped EXE
PID:2880 -
\??\c:\9hbhhn.exec:\9hbhhn.exe54⤵
- Executes dropped EXE
PID:1584 -
\??\c:\1vjjv.exec:\1vjjv.exe55⤵
- Executes dropped EXE
PID:2468 -
\??\c:\dddpj.exec:\dddpj.exe56⤵
- Executes dropped EXE
PID:2588 -
\??\c:\7fxflrx.exec:\7fxflrx.exe57⤵
- Executes dropped EXE
PID:3016 -
\??\c:\tnnbhh.exec:\tnnbhh.exe58⤵
- Executes dropped EXE
PID:2480 -
\??\c:\nnnbnt.exec:\nnnbnt.exe59⤵
- Executes dropped EXE
PID:2296 -
\??\c:\1ddpp.exec:\1ddpp.exe60⤵
- Executes dropped EXE
PID:1748 -
\??\c:\ddvdj.exec:\ddvdj.exe61⤵
- Executes dropped EXE
PID:2464 -
\??\c:\9fxlrxf.exec:\9fxlrxf.exe62⤵
- Executes dropped EXE
PID:1124 -
\??\c:\tthhbn.exec:\tthhbn.exe63⤵
- Executes dropped EXE
PID:296 -
\??\c:\3bthhn.exec:\3bthhn.exe64⤵
- Executes dropped EXE
PID:1232 -
\??\c:\dvpdj.exec:\dvpdj.exe65⤵
- Executes dropped EXE
PID:1252 -
\??\c:\frrxxxl.exec:\frrxxxl.exe66⤵PID:1840
-
\??\c:\nhhhtn.exec:\nhhhtn.exe67⤵PID:1260
-
\??\c:\1hhnnt.exec:\1hhnnt.exe68⤵PID:892
-
\??\c:\vjvvd.exec:\vjvvd.exe69⤵PID:1756
-
\??\c:\dvpvv.exec:\dvpvv.exe70⤵PID:236
-
\??\c:\xrllllr.exec:\xrllllr.exe71⤵PID:2564
-
\??\c:\bthhnb.exec:\bthhnb.exe72⤵PID:1696
-
\??\c:\hhbntb.exec:\hhbntb.exe73⤵PID:1636
-
\??\c:\1ddjp.exec:\1ddjp.exe74⤵PID:3036
-
\??\c:\5xrfrrf.exec:\5xrfrrf.exe75⤵PID:1936
-
\??\c:\1hnbhh.exec:\1hnbhh.exe76⤵PID:916
-
\??\c:\hbttbh.exec:\hbttbh.exe77⤵PID:1668
-
\??\c:\ddddp.exec:\ddddp.exe78⤵PID:2904
-
\??\c:\1fllrlx.exec:\1fllrlx.exe79⤵PID:1552
-
\??\c:\9rrfrrf.exec:\9rrfrrf.exe80⤵PID:3012
-
\??\c:\3nhntb.exec:\3nhntb.exe81⤵PID:2248
-
\??\c:\7djjv.exec:\7djjv.exe82⤵PID:2744
-
\??\c:\3xlrxfl.exec:\3xlrxfl.exe83⤵PID:2632
-
\??\c:\flfrxxl.exec:\flfrxxl.exe84⤵PID:1108
-
\??\c:\bhbnbh.exec:\bhbnbh.exe85⤵PID:2608
-
\??\c:\1vjjj.exec:\1vjjj.exe86⤵PID:2680
-
\??\c:\1rxxfrf.exec:\1rxxfrf.exe87⤵PID:588
-
\??\c:\fxrflxl.exec:\fxrflxl.exe88⤵PID:1004
-
\??\c:\tthhtb.exec:\tthhtb.exe89⤵PID:528
-
\??\c:\vpdjv.exec:\vpdjv.exe90⤵PID:2676
-
\??\c:\pvvdp.exec:\pvvdp.exe91⤵PID:2028
-
\??\c:\xrffrxf.exec:\xrffrxf.exe92⤵PID:2056
-
\??\c:\bbtbhn.exec:\bbtbhn.exe93⤵PID:2968
-
\??\c:\5tthtb.exec:\5tthtb.exe94⤵PID:712
-
\??\c:\ppdjv.exec:\ppdjv.exe95⤵PID:2040
-
\??\c:\xrrfxlx.exec:\xrrfxlx.exe96⤵PID:2704
-
\??\c:\lrxflrf.exec:\lrxflrf.exe97⤵PID:2896
-
\??\c:\1nbbhh.exec:\1nbbhh.exe98⤵PID:2668
-
\??\c:\ddddj.exec:\ddddj.exe99⤵PID:2460
-
\??\c:\lrllffr.exec:\lrllffr.exe100⤵PID:1932
-
\??\c:\xxffrxr.exec:\xxffrxr.exe101⤵PID:2204
-
\??\c:\1htbht.exec:\1htbht.exe102⤵PID:2184
-
\??\c:\bnbntn.exec:\bnbntn.exe103⤵PID:2444
-
\??\c:\ddvdp.exec:\ddvdp.exe104⤵PID:2472
-
\??\c:\1lfrflr.exec:\1lfrflr.exe105⤵PID:1748
-
\??\c:\tnbbhh.exec:\tnbbhh.exe106⤵PID:2464
-
\??\c:\9nnhtt.exec:\9nnhtt.exe107⤵PID:2348
-
\??\c:\3pdvj.exec:\3pdvj.exe108⤵PID:2300
-
\??\c:\fxlxfxl.exec:\fxlxfxl.exe109⤵PID:1340
-
\??\c:\1bnntb.exec:\1bnntb.exe110⤵PID:1252
-
\??\c:\hbbhtn.exec:\hbbhtn.exe111⤵PID:1840
-
\??\c:\1dddv.exec:\1dddv.exe112⤵PID:1008
-
\??\c:\5rffrxl.exec:\5rffrxl.exe113⤵PID:892
-
\??\c:\xfxllxl.exec:\xfxllxl.exe114⤵PID:1280
-
\??\c:\nhbhtb.exec:\nhbhtb.exe115⤵PID:2308
-
\??\c:\vjddj.exec:\vjddj.exe116⤵PID:2044
-
\??\c:\jjvpv.exec:\jjvpv.exe117⤵PID:1256
-
\??\c:\fxlrxrr.exec:\fxlrxrr.exe118⤵PID:716
-
\??\c:\rrfrffr.exec:\rrfrffr.exe119⤵PID:1728
-
\??\c:\btttbh.exec:\btttbh.exe120⤵PID:2400
-
\??\c:\ppdjp.exec:\ppdjp.exe121⤵PID:916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-