Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2024, 22:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
40629eb9f967cbae5f004b74718a2661fcb59602324765894a80352cf6ff065e.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
40629eb9f967cbae5f004b74718a2661fcb59602324765894a80352cf6ff065e.exe
-
Size
454KB
-
MD5
96530ff96d2ce7251bd65dbb87ab3b87
-
SHA1
3580642a560f5a2a3fb35b7fa980c5c8eb0da9d4
-
SHA256
40629eb9f967cbae5f004b74718a2661fcb59602324765894a80352cf6ff065e
-
SHA512
22ffda7494efe7d73c958a7fbf99aa078af0023d12a85c55dd2b51d1c87fd5d541d9c878e6e77f01e8e6fe7ca7f46e5b3b34a831ab6541088a9c93bfd46205f9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeth:q7Tc2NYHUrAwfMp3CDth
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1628-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2044-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4240-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1140-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3752-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1848-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/832-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2916-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3272-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1256-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-728-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-753-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-853-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-926-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-954-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-1049-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1628 bbhhnn.exe 2044 dddvv.exe 2136 pjpvd.exe 3796 djdvv.exe 4240 nbthbt.exe 396 ffrrxxf.exe 1216 pjvpp.exe 3196 bbnhhh.exe 4780 lxlrxrx.exe 5112 hhtntt.exe 1140 xrxxrff.exe 4816 nnhbht.exe 3120 thnnhh.exe 4620 jjjdj.exe 2336 lrfrllf.exe 3752 3tnnbt.exe 4740 ddddd.exe 1052 pppjd.exe 1004 ffrrrxx.exe 2936 bntnhb.exe 4832 vjjdv.exe 2144 7tbbtb.exe 3156 3rlfxrr.exe 4280 btbthb.exe 5068 xfrllrr.exe 2368 dvppd.exe 3680 bnnnnt.exe 1848 9djvp.exe 2540 nnhttn.exe 4300 vjjdd.exe 3168 fxxrllf.exe 2856 jdpjj.exe 764 lfxrffx.exe 3044 btthbh.exe 5116 pvvpj.exe 4456 fflflfl.exe 1492 vpjdv.exe 2464 lxlfxxx.exe 3036 fllffxr.exe 3988 nhthth.exe 1224 dvpjd.exe 2728 3lllfff.exe 1196 bnhbtn.exe 2148 jvvvp.exe 3020 xrxxfxf.exe 2768 rllfrfx.exe 3132 nnbtbh.exe 1860 lfrlfxr.exe 4056 bnttnn.exe 2528 1djdv.exe 4592 frfxllf.exe 1540 5llfxfx.exe 1824 tnbbbb.exe 1352 1pppj.exe 4644 flrlffr.exe 944 lfflffx.exe 4844 5bhttn.exe 3340 ddpjj.exe 5028 lxffxrl.exe 4324 frxxfrx.exe 1596 hbbhbb.exe 2016 5vjjd.exe 4320 dvdvp.exe 2132 xfrfxxr.exe -
resource yara_rule behavioral2/memory/1628-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2044-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2044-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4240-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1140-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3120-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3752-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1848-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/832-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3704-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3272-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1936-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1256-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-853-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5052 wrote to memory of 1628 5052 40629eb9f967cbae5f004b74718a2661fcb59602324765894a80352cf6ff065e.exe 84 PID 5052 wrote to memory of 1628 5052 40629eb9f967cbae5f004b74718a2661fcb59602324765894a80352cf6ff065e.exe 84 PID 5052 wrote to memory of 1628 5052 40629eb9f967cbae5f004b74718a2661fcb59602324765894a80352cf6ff065e.exe 84 PID 1628 wrote to memory of 2044 1628 bbhhnn.exe 85 PID 1628 wrote to memory of 2044 1628 bbhhnn.exe 85 PID 1628 wrote to memory of 2044 1628 bbhhnn.exe 85 PID 2044 wrote to memory of 2136 2044 dddvv.exe 86 PID 2044 wrote to memory of 2136 2044 dddvv.exe 86 PID 2044 wrote to memory of 2136 2044 dddvv.exe 86 PID 2136 wrote to memory of 3796 2136 pjpvd.exe 87 PID 2136 wrote to memory of 3796 2136 pjpvd.exe 87 PID 2136 wrote to memory of 3796 2136 pjpvd.exe 87 PID 3796 wrote to memory of 4240 3796 djdvv.exe 88 PID 3796 wrote to memory of 4240 3796 djdvv.exe 88 PID 3796 wrote to memory of 4240 3796 djdvv.exe 88 PID 4240 wrote to memory of 396 4240 nbthbt.exe 89 PID 4240 wrote to memory of 396 4240 nbthbt.exe 89 PID 4240 wrote to memory of 396 4240 nbthbt.exe 89 PID 396 wrote to memory of 1216 396 ffrrxxf.exe 90 PID 396 wrote to memory of 1216 396 ffrrxxf.exe 90 PID 396 wrote to memory of 1216 396 ffrrxxf.exe 90 PID 1216 wrote to memory of 3196 1216 pjvpp.exe 91 PID 1216 wrote to memory of 3196 1216 pjvpp.exe 91 PID 1216 wrote to memory of 3196 1216 pjvpp.exe 91 PID 3196 wrote to memory of 4780 3196 bbnhhh.exe 92 PID 3196 wrote to memory of 4780 3196 bbnhhh.exe 92 PID 3196 wrote to memory of 4780 3196 bbnhhh.exe 92 PID 4780 wrote to memory of 5112 4780 lxlrxrx.exe 93 PID 4780 wrote to memory of 5112 4780 lxlrxrx.exe 93 PID 4780 wrote to memory of 5112 4780 lxlrxrx.exe 93 PID 5112 wrote to memory of 1140 5112 hhtntt.exe 94 PID 5112 wrote to memory of 1140 5112 hhtntt.exe 94 PID 5112 wrote to memory of 1140 5112 hhtntt.exe 94 PID 1140 wrote to memory of 4816 1140 xrxxrff.exe 95 PID 1140 wrote to memory of 4816 1140 xrxxrff.exe 95 PID 1140 wrote to memory of 4816 1140 xrxxrff.exe 95 PID 4816 wrote to memory of 3120 4816 nnhbht.exe 96 PID 4816 wrote to memory of 3120 4816 nnhbht.exe 96 PID 4816 wrote to memory of 3120 4816 nnhbht.exe 96 PID 3120 wrote to memory of 4620 3120 thnnhh.exe 97 PID 3120 wrote to memory of 4620 3120 thnnhh.exe 97 PID 3120 wrote to memory of 4620 3120 thnnhh.exe 97 PID 4620 wrote to memory of 2336 4620 jjjdj.exe 98 PID 4620 wrote to memory of 2336 4620 jjjdj.exe 98 PID 4620 wrote to memory of 2336 4620 jjjdj.exe 98 PID 2336 wrote to memory of 3752 2336 lrfrllf.exe 99 PID 2336 wrote to memory of 3752 2336 lrfrllf.exe 99 PID 2336 wrote to memory of 3752 2336 lrfrllf.exe 99 PID 3752 wrote to memory of 4740 3752 3tnnbt.exe 100 PID 3752 wrote to memory of 4740 3752 3tnnbt.exe 100 PID 3752 wrote to memory of 4740 3752 3tnnbt.exe 100 PID 4740 wrote to memory of 1052 4740 ddddd.exe 101 PID 4740 wrote to memory of 1052 4740 ddddd.exe 101 PID 4740 wrote to memory of 1052 4740 ddddd.exe 101 PID 1052 wrote to memory of 1004 1052 pppjd.exe 102 PID 1052 wrote to memory of 1004 1052 pppjd.exe 102 PID 1052 wrote to memory of 1004 1052 pppjd.exe 102 PID 1004 wrote to memory of 2936 1004 ffrrrxx.exe 103 PID 1004 wrote to memory of 2936 1004 ffrrrxx.exe 103 PID 1004 wrote to memory of 2936 1004 ffrrrxx.exe 103 PID 2936 wrote to memory of 4832 2936 bntnhb.exe 104 PID 2936 wrote to memory of 4832 2936 bntnhb.exe 104 PID 2936 wrote to memory of 4832 2936 bntnhb.exe 104 PID 4832 wrote to memory of 2144 4832 vjjdv.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\40629eb9f967cbae5f004b74718a2661fcb59602324765894a80352cf6ff065e.exe"C:\Users\Admin\AppData\Local\Temp\40629eb9f967cbae5f004b74718a2661fcb59602324765894a80352cf6ff065e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\bbhhnn.exec:\bbhhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\dddvv.exec:\dddvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\pjpvd.exec:\pjpvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\djdvv.exec:\djdvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\nbthbt.exec:\nbthbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\ffrrxxf.exec:\ffrrxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\pjvpp.exec:\pjvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\bbnhhh.exec:\bbnhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\lxlrxrx.exec:\lxlrxrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\hhtntt.exec:\hhtntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\xrxxrff.exec:\xrxxrff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\nnhbht.exec:\nnhbht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\thnnhh.exec:\thnnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\jjjdj.exec:\jjjdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\lrfrllf.exec:\lrfrllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\3tnnbt.exec:\3tnnbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\ddddd.exec:\ddddd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\pppjd.exec:\pppjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\ffrrrxx.exec:\ffrrrxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\bntnhb.exec:\bntnhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\vjjdv.exec:\vjjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\7tbbtb.exec:\7tbbtb.exe23⤵
- Executes dropped EXE
PID:2144 -
\??\c:\3rlfxrr.exec:\3rlfxrr.exe24⤵
- Executes dropped EXE
PID:3156 -
\??\c:\btbthb.exec:\btbthb.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4280 -
\??\c:\xfrllrr.exec:\xfrllrr.exe26⤵
- Executes dropped EXE
PID:5068 -
\??\c:\dvppd.exec:\dvppd.exe27⤵
- Executes dropped EXE
PID:2368 -
\??\c:\bnnnnt.exec:\bnnnnt.exe28⤵
- Executes dropped EXE
PID:3680 -
\??\c:\9djvp.exec:\9djvp.exe29⤵
- Executes dropped EXE
PID:1848 -
\??\c:\nnhttn.exec:\nnhttn.exe30⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vjjdd.exec:\vjjdd.exe31⤵
- Executes dropped EXE
PID:4300 -
\??\c:\fxxrllf.exec:\fxxrllf.exe32⤵
- Executes dropped EXE
PID:3168 -
\??\c:\jdpjj.exec:\jdpjj.exe33⤵
- Executes dropped EXE
PID:2856 -
\??\c:\lfxrffx.exec:\lfxrffx.exe34⤵
- Executes dropped EXE
PID:764 -
\??\c:\btthbh.exec:\btthbh.exe35⤵
- Executes dropped EXE
PID:3044 -
\??\c:\pvvpj.exec:\pvvpj.exe36⤵
- Executes dropped EXE
PID:5116 -
\??\c:\fflflfl.exec:\fflflfl.exe37⤵
- Executes dropped EXE
PID:4456 -
\??\c:\vpjdv.exec:\vpjdv.exe38⤵
- Executes dropped EXE
PID:1492 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe39⤵
- Executes dropped EXE
PID:2464 -
\??\c:\fllffxr.exec:\fllffxr.exe40⤵
- Executes dropped EXE
PID:3036 -
\??\c:\nhthth.exec:\nhthth.exe41⤵
- Executes dropped EXE
PID:3988 -
\??\c:\dvpjd.exec:\dvpjd.exe42⤵
- Executes dropped EXE
PID:1224 -
\??\c:\3lllfff.exec:\3lllfff.exe43⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bnhbtn.exec:\bnhbtn.exe44⤵
- Executes dropped EXE
PID:1196 -
\??\c:\jvvvp.exec:\jvvvp.exe45⤵
- Executes dropped EXE
PID:2148 -
\??\c:\xrxxfxf.exec:\xrxxfxf.exe46⤵
- Executes dropped EXE
PID:3020 -
\??\c:\rllfrfx.exec:\rllfrfx.exe47⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nnbtbh.exec:\nnbtbh.exe48⤵
- Executes dropped EXE
PID:3132 -
\??\c:\jdvpj.exec:\jdvpj.exe49⤵PID:4476
-
\??\c:\lfrlfxr.exec:\lfrlfxr.exe50⤵
- Executes dropped EXE
PID:1860 -
\??\c:\bnttnn.exec:\bnttnn.exe51⤵
- Executes dropped EXE
PID:4056 -
\??\c:\1djdv.exec:\1djdv.exe52⤵
- Executes dropped EXE
PID:2528 -
\??\c:\frfxllf.exec:\frfxllf.exe53⤵
- Executes dropped EXE
PID:4592 -
\??\c:\5llfxfx.exec:\5llfxfx.exe54⤵
- Executes dropped EXE
PID:1540 -
\??\c:\tnbbbb.exec:\tnbbbb.exe55⤵
- Executes dropped EXE
PID:1824 -
\??\c:\1pppj.exec:\1pppj.exe56⤵
- Executes dropped EXE
PID:1352 -
\??\c:\flrlffr.exec:\flrlffr.exe57⤵
- Executes dropped EXE
PID:4644 -
\??\c:\lfflffx.exec:\lfflffx.exe58⤵
- Executes dropped EXE
PID:944 -
\??\c:\5bhttn.exec:\5bhttn.exe59⤵
- Executes dropped EXE
PID:4844 -
\??\c:\ddpjj.exec:\ddpjj.exe60⤵
- Executes dropped EXE
PID:3340 -
\??\c:\lxffxrl.exec:\lxffxrl.exe61⤵
- Executes dropped EXE
PID:5028 -
\??\c:\frxxfrx.exec:\frxxfrx.exe62⤵
- Executes dropped EXE
PID:4324 -
\??\c:\hbbhbb.exec:\hbbhbb.exe63⤵
- Executes dropped EXE
PID:1596 -
\??\c:\5vjjd.exec:\5vjjd.exe64⤵
- Executes dropped EXE
PID:2016 -
\??\c:\dvdvp.exec:\dvdvp.exe65⤵
- Executes dropped EXE
PID:4320 -
\??\c:\xfrfxxr.exec:\xfrfxxr.exe66⤵
- Executes dropped EXE
PID:2132 -
\??\c:\thbnhn.exec:\thbnhn.exe67⤵PID:1496
-
\??\c:\1vdjd.exec:\1vdjd.exe68⤵PID:3588
-
\??\c:\lxrxfff.exec:\lxrxfff.exe69⤵PID:328
-
\??\c:\rrffxrf.exec:\rrffxrf.exe70⤵PID:436
-
\??\c:\3nnhnt.exec:\3nnhnt.exe71⤵PID:3788
-
\??\c:\dvjjd.exec:\dvjjd.exe72⤵PID:832
-
\??\c:\rfrfxrf.exec:\rfrfxrf.exe73⤵PID:4920
-
\??\c:\7nbtbt.exec:\7nbtbt.exe74⤵PID:2556
-
\??\c:\jpvvp.exec:\jpvvp.exe75⤵PID:2760
-
\??\c:\lffffff.exec:\lffffff.exe76⤵PID:4740
-
\??\c:\bbbttt.exec:\bbbttt.exe77⤵PID:2828
-
\??\c:\1jjdv.exec:\1jjdv.exe78⤵PID:4572
-
\??\c:\llrrlfx.exec:\llrrlfx.exe79⤵PID:2028
-
\??\c:\xrllfxr.exec:\xrllfxr.exe80⤵PID:2936
-
\??\c:\3dvpd.exec:\3dvpd.exe81⤵PID:4032
-
\??\c:\fxlfxrr.exec:\fxlfxrr.exe82⤵PID:1440
-
\??\c:\hbbnhb.exec:\hbbnhb.exe83⤵PID:4648
-
\??\c:\tbbtnn.exec:\tbbtnn.exe84⤵PID:2168
-
\??\c:\pjvvp.exec:\pjvvp.exe85⤵PID:3008
-
\??\c:\frrrrxf.exec:\frrrrxf.exe86⤵PID:3140
-
\??\c:\5nnhtt.exec:\5nnhtt.exe87⤵
- System Location Discovery: System Language Discovery
PID:5068 -
\??\c:\jvdvp.exec:\jvdvp.exe88⤵PID:3772
-
\??\c:\lllfxxr.exec:\lllfxxr.exe89⤵PID:3332
-
\??\c:\xxllffx.exec:\xxllffx.exe90⤵PID:3568
-
\??\c:\bnnhtn.exec:\bnnhtn.exe91⤵PID:2560
-
\??\c:\frrxfxr.exec:\frrxfxr.exe92⤵PID:3704
-
\??\c:\bthhnt.exec:\bthhnt.exe93⤵PID:3708
-
\??\c:\hhthbh.exec:\hhthbh.exe94⤵PID:4300
-
\??\c:\5dpjj.exec:\5dpjj.exe95⤵PID:3168
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe96⤵PID:2096
-
\??\c:\9rrffxr.exec:\9rrffxr.exe97⤵PID:3652
-
\??\c:\7nhnnn.exec:\7nhnnn.exe98⤵PID:4760
-
\??\c:\jjddd.exec:\jjddd.exe99⤵PID:2780
-
\??\c:\xflfxfx.exec:\xflfxfx.exe100⤵PID:3540
-
\??\c:\9bhhbn.exec:\9bhhbn.exe101⤵PID:4456
-
\??\c:\jdpjj.exec:\jdpjj.exe102⤵PID:4828
-
\??\c:\dvppp.exec:\dvppp.exe103⤵PID:3832
-
\??\c:\tnhbtn.exec:\tnhbtn.exe104⤵PID:2916
-
\??\c:\jjpvv.exec:\jjpvv.exe105⤵PID:3988
-
\??\c:\lxrrxxr.exec:\lxrrxxr.exe106⤵PID:1224
-
\??\c:\ffxxxll.exec:\ffxxxll.exe107⤵PID:408
-
\??\c:\bthhnn.exec:\bthhnn.exe108⤵PID:4880
-
\??\c:\jvdvd.exec:\jvdvd.exe109⤵PID:2148
-
\??\c:\lfxrxxr.exec:\lfxrxxr.exe110⤵PID:4080
-
\??\c:\bntttt.exec:\bntttt.exe111⤵PID:2768
-
\??\c:\tnnhhh.exec:\tnnhhh.exe112⤵PID:3984
-
\??\c:\ppddv.exec:\ppddv.exe113⤵PID:4476
-
\??\c:\lfxrllf.exec:\lfxrllf.exe114⤵PID:1860
-
\??\c:\nbhbtt.exec:\nbhbtt.exe115⤵PID:4528
-
\??\c:\jdppj.exec:\jdppj.exe116⤵PID:2044
-
\??\c:\vdjdv.exec:\vdjdv.exe117⤵PID:3272
-
\??\c:\lffxrrl.exec:\lffxrrl.exe118⤵PID:4904
-
\??\c:\bbhbtn.exec:\bbhbtn.exe119⤵PID:4616
-
\??\c:\jvdjd.exec:\jvdjd.exe120⤵PID:1552
-
\??\c:\9xfrllr.exec:\9xfrllr.exe121⤵PID:4240
-
\??\c:\bbbbtb.exec:\bbbbtb.exe122⤵PID:1100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-