Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 23:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
787ba092f09ad490703adf8b68b10383220a00b520db62d85c7361495ea1e662.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
787ba092f09ad490703adf8b68b10383220a00b520db62d85c7361495ea1e662.exe
-
Size
214KB
-
MD5
e740e22ee25df2df0304096bf9d60c68
-
SHA1
98b0f11562051cd507d210511cd07e7e15e628e5
-
SHA256
787ba092f09ad490703adf8b68b10383220a00b520db62d85c7361495ea1e662
-
SHA512
cbe637beb31db413591cbc08afc7091a80521a2a5d8707785833e414fe631cfa5fedfb69c4a3b08e885cc54e0f4fd4adadf2b158384e7bddb9a8a8e6fced4f9e
-
SSDEEP
3072:ZhOm2sI93UufdC67ciEu0P5axvqdUmdznCvs7BuRoYFBg/gXVqPfSoi0yG24ePd:Zcm7ImGddXEu0ucju6/4kf724y
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
Processes:
resource yara_rule behavioral1/memory/1772-8-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2224-11-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/940-26-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/940-28-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2824-38-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1844-48-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2656-57-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2948-66-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2564-91-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/3016-118-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1092-128-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/760-137-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1936-149-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1712-159-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/588-197-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2648-207-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1064-228-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/960-252-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/1120-270-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2968-288-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2140-296-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/976-305-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1984-315-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2184-321-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2232-334-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1692-342-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1676-349-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1704-356-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2644-383-0x00000000001B0000-0x00000000001DD000-memory.dmp family_blackmoon behavioral1/memory/2864-421-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1520-440-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/1292-447-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1592-454-0x00000000002A0000-0x00000000002CD000-memory.dmp family_blackmoon behavioral1/memory/752-461-0x00000000001B0000-0x00000000001DD000-memory.dmp family_blackmoon behavioral1/memory/1592-483-0x00000000002A0000-0x00000000002CD000-memory.dmp family_blackmoon behavioral1/memory/676-526-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/2132-533-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/1796-554-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/2880-636-0x00000000003C0000-0x00000000003ED000-memory.dmp family_blackmoon behavioral1/memory/2532-683-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2512-696-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2264-815-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1556-828-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1484-841-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/1740-889-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 53 IoCs
Processes:
resource yara_rule behavioral1/memory/1772-8-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2224-11-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/940-28-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2824-29-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2824-38-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1844-39-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1844-48-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2656-57-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2948-66-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2564-91-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/3016-118-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1092-128-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/760-137-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1936-146-0x0000000000220000-0x000000000024D000-memory.dmp UPX behavioral1/memory/1936-149-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1712-150-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1712-159-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/588-189-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/588-197-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2648-198-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/3044-208-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2648-207-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1064-228-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1120-270-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2968-288-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2140-296-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1984-307-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/976-305-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1984-315-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2184-321-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2232-334-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1692-335-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1692-342-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1676-349-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2464-357-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1704-356-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1964-364-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2644-383-0x00000000001B0000-0x00000000001DD000-memory.dmp UPX behavioral1/memory/2864-421-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1292-447-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/752-461-0x00000000001B0000-0x00000000001DD000-memory.dmp UPX behavioral1/memory/1796-554-0x0000000000220000-0x000000000024D000-memory.dmp UPX behavioral1/memory/1884-605-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2728-656-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2908-670-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2532-683-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2512-696-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1240-715-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2264-808-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/2264-815-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1556-828-0x0000000000400000-0x000000000042D000-memory.dmp UPX behavioral1/memory/1720-849-0x0000000000230000-0x000000000025D000-memory.dmp UPX behavioral1/memory/1740-889-0x0000000000220000-0x000000000024D000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
Processes:
vlxhtrn.exebvtrbnf.exevrblpb.exedhrhfr.exevfdtv.exenbjfnph.exenxrfrdl.exendtpvnx.exendhtplj.exepxnpvb.exetlxxjbp.exenxrlv.exetdfxhj.exepxbfxjt.exexfnlplr.exehbxxtf.exevrpxxxn.exebbnpbx.exelfhnrb.exetfvdjxn.exeprjnfrb.exeprptvr.exedjrdhh.exervtdvx.exedrxrlj.exerhbfpl.exebxdrl.exefnttv.exefjpln.exepdbfjf.exexnrblh.exehthlf.exexdxdtt.exevvpfd.exerjllfrv.exebbltj.exebhfdt.exevhtxbtj.exelhxfplx.exentvthx.exetltnd.exeprjbfp.exehxdxd.exeldvbdh.exepltvb.exetvrrj.exexbjrpxh.exevlrtrh.exexnvlv.exehpvtfxl.exephrrtft.exetdtff.exenbpjj.exevvnbdn.exehldffv.exenvlblxb.exeprfbv.exextrthrv.exetnpptlp.exentjvdp.exevxjhr.exehjhlntj.exehbpnr.exepnlbpf.exepid process 2224 vlxhtrn.exe 940 bvtrbnf.exe 2824 vrblpb.exe 1844 dhrhfr.exe 2656 vfdtv.exe 2948 nbjfnph.exe 2584 nxrfrdl.exe 2536 ndtpvnx.exe 2564 ndhtplj.exe 2600 pxnpvb.exe 2456 tlxxjbp.exe 3016 nxrlv.exe 1092 tdfxhj.exe 760 pxbfxjt.exe 1936 xfnlplr.exe 1712 hbxxtf.exe 1588 vrpxxxn.exe 1472 bbnpbx.exe 2440 lfhnrb.exe 588 tfvdjxn.exe 2648 prjnfrb.exe 3044 prptvr.exe 1064 djrdhh.exe 1056 rvtdvx.exe 1116 drxrlj.exe 960 rhbfpl.exe 3012 bxdrl.exe 1120 fnttv.exe 2788 fjpln.exe 2968 pdbfjf.exe 2140 xnrblh.exe 976 hthlf.exe 1984 xdxdtt.exe 2184 vvpfd.exe 3020 rjllfrv.exe 2232 bbltj.exe 1692 bhfdt.exe 1676 vhtxbtj.exe 1704 lhxfplx.exe 2464 ntvthx.exe 1964 tltnd.exe 2524 prjbfp.exe 2644 hxdxd.exe 2504 ldvbdh.exe 2636 pltvb.exe 2868 tvrrj.exe 2372 xbjrpxh.exe 2492 vlrtrh.exe 2864 xnvlv.exe 2360 hpvtfxl.exe 2012 phrrtft.exe 1520 tdtff.exe 1292 nbpjj.exe 1592 vvnbdn.exe 752 hldffv.exe 1712 nvlblxb.exe 1696 prfbv.exe 1528 xtrthrv.exe 2364 tnpptlp.exe 336 ntjvdp.exe 676 vxjhr.exe 2476 hjhlntj.exe 2468 hbpnr.exe 2708 pnlbpf.exe -
Processes:
resource yara_rule behavioral1/memory/1772-8-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2224-11-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/940-28-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2824-29-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2824-38-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1844-39-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1844-48-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2656-57-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2948-66-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2564-91-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/3016-118-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1092-128-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/760-137-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1936-149-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1712-150-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1712-159-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/588-189-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/588-197-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2648-198-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/3044-208-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2648-207-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1064-228-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1120-270-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2968-288-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2140-296-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1984-307-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/976-305-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1984-315-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2184-321-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2232-334-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1692-335-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1692-342-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1676-349-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2464-357-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1704-356-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1964-364-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2864-421-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1292-447-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/752-461-0x00000000001B0000-0x00000000001DD000-memory.dmp upx behavioral1/memory/1796-554-0x0000000000220000-0x000000000024D000-memory.dmp upx behavioral1/memory/1884-605-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2824-643-0x0000000000220000-0x000000000024D000-memory.dmp upx behavioral1/memory/2728-656-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2908-670-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2532-683-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2512-696-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2364-783-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2264-808-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2264-815-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1556-828-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1740-889-0x0000000000220000-0x000000000024D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
787ba092f09ad490703adf8b68b10383220a00b520db62d85c7361495ea1e662.exevlxhtrn.exebvtrbnf.exevrblpb.exedhrhfr.exevfdtv.exenbjfnph.exenxrfrdl.exendtpvnx.exendhtplj.exepxnpvb.exetlxxjbp.exenxrlv.exetdfxhj.exepxbfxjt.exexfnlplr.exedescription pid process target process PID 1772 wrote to memory of 2224 1772 787ba092f09ad490703adf8b68b10383220a00b520db62d85c7361495ea1e662.exe vlxhtrn.exe PID 1772 wrote to memory of 2224 1772 787ba092f09ad490703adf8b68b10383220a00b520db62d85c7361495ea1e662.exe vlxhtrn.exe PID 1772 wrote to memory of 2224 1772 787ba092f09ad490703adf8b68b10383220a00b520db62d85c7361495ea1e662.exe vlxhtrn.exe PID 1772 wrote to memory of 2224 1772 787ba092f09ad490703adf8b68b10383220a00b520db62d85c7361495ea1e662.exe vlxhtrn.exe PID 2224 wrote to memory of 940 2224 vlxhtrn.exe bvtrbnf.exe PID 2224 wrote to memory of 940 2224 vlxhtrn.exe bvtrbnf.exe PID 2224 wrote to memory of 940 2224 vlxhtrn.exe bvtrbnf.exe PID 2224 wrote to memory of 940 2224 vlxhtrn.exe bvtrbnf.exe PID 940 wrote to memory of 2824 940 bvtrbnf.exe vrblpb.exe PID 940 wrote to memory of 2824 940 bvtrbnf.exe vrblpb.exe PID 940 wrote to memory of 2824 940 bvtrbnf.exe vrblpb.exe PID 940 wrote to memory of 2824 940 bvtrbnf.exe vrblpb.exe PID 2824 wrote to memory of 1844 2824 vrblpb.exe dhrhfr.exe PID 2824 wrote to memory of 1844 2824 vrblpb.exe dhrhfr.exe PID 2824 wrote to memory of 1844 2824 vrblpb.exe dhrhfr.exe PID 2824 wrote to memory of 1844 2824 vrblpb.exe dhrhfr.exe PID 1844 wrote to memory of 2656 1844 dhrhfr.exe vfdtv.exe PID 1844 wrote to memory of 2656 1844 dhrhfr.exe vfdtv.exe PID 1844 wrote to memory of 2656 1844 dhrhfr.exe vfdtv.exe PID 1844 wrote to memory of 2656 1844 dhrhfr.exe vfdtv.exe PID 2656 wrote to memory of 2948 2656 vfdtv.exe nbjfnph.exe PID 2656 wrote to memory of 2948 2656 vfdtv.exe nbjfnph.exe PID 2656 wrote to memory of 2948 2656 vfdtv.exe nbjfnph.exe PID 2656 wrote to memory of 2948 2656 vfdtv.exe nbjfnph.exe PID 2948 wrote to memory of 2584 2948 nbjfnph.exe nxrfrdl.exe PID 2948 wrote to memory of 2584 2948 nbjfnph.exe nxrfrdl.exe PID 2948 wrote to memory of 2584 2948 nbjfnph.exe nxrfrdl.exe PID 2948 wrote to memory of 2584 2948 nbjfnph.exe nxrfrdl.exe PID 2584 wrote to memory of 2536 2584 nxrfrdl.exe ndtpvnx.exe PID 2584 wrote to memory of 2536 2584 nxrfrdl.exe ndtpvnx.exe PID 2584 wrote to memory of 2536 2584 nxrfrdl.exe ndtpvnx.exe PID 2584 wrote to memory of 2536 2584 nxrfrdl.exe ndtpvnx.exe PID 2536 wrote to memory of 2564 2536 ndtpvnx.exe ndhtplj.exe PID 2536 wrote to memory of 2564 2536 ndtpvnx.exe ndhtplj.exe PID 2536 wrote to memory of 2564 2536 ndtpvnx.exe ndhtplj.exe PID 2536 wrote to memory of 2564 2536 ndtpvnx.exe ndhtplj.exe PID 2564 wrote to memory of 2600 2564 ndhtplj.exe pxnpvb.exe PID 2564 wrote to memory of 2600 2564 ndhtplj.exe pxnpvb.exe PID 2564 wrote to memory of 2600 2564 ndhtplj.exe pxnpvb.exe PID 2564 wrote to memory of 2600 2564 ndhtplj.exe pxnpvb.exe PID 2600 wrote to memory of 2456 2600 pxnpvb.exe tlxxjbp.exe PID 2600 wrote to memory of 2456 2600 pxnpvb.exe tlxxjbp.exe PID 2600 wrote to memory of 2456 2600 pxnpvb.exe tlxxjbp.exe PID 2600 wrote to memory of 2456 2600 pxnpvb.exe tlxxjbp.exe PID 2456 wrote to memory of 3016 2456 tlxxjbp.exe nxrlv.exe PID 2456 wrote to memory of 3016 2456 tlxxjbp.exe nxrlv.exe PID 2456 wrote to memory of 3016 2456 tlxxjbp.exe nxrlv.exe PID 2456 wrote to memory of 3016 2456 tlxxjbp.exe nxrlv.exe PID 3016 wrote to memory of 1092 3016 nxrlv.exe tdfxhj.exe PID 3016 wrote to memory of 1092 3016 nxrlv.exe tdfxhj.exe PID 3016 wrote to memory of 1092 3016 nxrlv.exe tdfxhj.exe PID 3016 wrote to memory of 1092 3016 nxrlv.exe tdfxhj.exe PID 1092 wrote to memory of 760 1092 tdfxhj.exe pxbfxjt.exe PID 1092 wrote to memory of 760 1092 tdfxhj.exe pxbfxjt.exe PID 1092 wrote to memory of 760 1092 tdfxhj.exe pxbfxjt.exe PID 1092 wrote to memory of 760 1092 tdfxhj.exe pxbfxjt.exe PID 760 wrote to memory of 1936 760 pxbfxjt.exe xfnlplr.exe PID 760 wrote to memory of 1936 760 pxbfxjt.exe xfnlplr.exe PID 760 wrote to memory of 1936 760 pxbfxjt.exe xfnlplr.exe PID 760 wrote to memory of 1936 760 pxbfxjt.exe xfnlplr.exe PID 1936 wrote to memory of 1712 1936 xfnlplr.exe hbxxtf.exe PID 1936 wrote to memory of 1712 1936 xfnlplr.exe hbxxtf.exe PID 1936 wrote to memory of 1712 1936 xfnlplr.exe hbxxtf.exe PID 1936 wrote to memory of 1712 1936 xfnlplr.exe hbxxtf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\787ba092f09ad490703adf8b68b10383220a00b520db62d85c7361495ea1e662.exe"C:\Users\Admin\AppData\Local\Temp\787ba092f09ad490703adf8b68b10383220a00b520db62d85c7361495ea1e662.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\vlxhtrn.exec:\vlxhtrn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bvtrbnf.exec:\bvtrbnf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vrblpb.exec:\vrblpb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dhrhfr.exec:\dhrhfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vfdtv.exec:\vfdtv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbjfnph.exec:\nbjfnph.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nxrfrdl.exec:\nxrfrdl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ndtpvnx.exec:\ndtpvnx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ndhtplj.exec:\ndhtplj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pxnpvb.exec:\pxnpvb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tlxxjbp.exec:\tlxxjbp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nxrlv.exec:\nxrlv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tdfxhj.exec:\tdfxhj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pxbfxjt.exec:\pxbfxjt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xfnlplr.exec:\xfnlplr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbxxtf.exec:\hbxxtf.exe17⤵
- Executes dropped EXE
-
\??\c:\vrpxxxn.exec:\vrpxxxn.exe18⤵
- Executes dropped EXE
-
\??\c:\bbnpbx.exec:\bbnpbx.exe19⤵
- Executes dropped EXE
-
\??\c:\lfhnrb.exec:\lfhnrb.exe20⤵
- Executes dropped EXE
-
\??\c:\tfvdjxn.exec:\tfvdjxn.exe21⤵
- Executes dropped EXE
-
\??\c:\prjnfrb.exec:\prjnfrb.exe22⤵
- Executes dropped EXE
-
\??\c:\prptvr.exec:\prptvr.exe23⤵
- Executes dropped EXE
-
\??\c:\djrdhh.exec:\djrdhh.exe24⤵
- Executes dropped EXE
-
\??\c:\rvtdvx.exec:\rvtdvx.exe25⤵
- Executes dropped EXE
-
\??\c:\drxrlj.exec:\drxrlj.exe26⤵
- Executes dropped EXE
-
\??\c:\rhbfpl.exec:\rhbfpl.exe27⤵
- Executes dropped EXE
-
\??\c:\bxdrl.exec:\bxdrl.exe28⤵
- Executes dropped EXE
-
\??\c:\fnttv.exec:\fnttv.exe29⤵
- Executes dropped EXE
-
\??\c:\fjpln.exec:\fjpln.exe30⤵
- Executes dropped EXE
-
\??\c:\pdbfjf.exec:\pdbfjf.exe31⤵
- Executes dropped EXE
-
\??\c:\xnrblh.exec:\xnrblh.exe32⤵
- Executes dropped EXE
-
\??\c:\hthlf.exec:\hthlf.exe33⤵
- Executes dropped EXE
-
\??\c:\xdxdtt.exec:\xdxdtt.exe34⤵
- Executes dropped EXE
-
\??\c:\vvpfd.exec:\vvpfd.exe35⤵
- Executes dropped EXE
-
\??\c:\rjllfrv.exec:\rjllfrv.exe36⤵
- Executes dropped EXE
-
\??\c:\bbltj.exec:\bbltj.exe37⤵
- Executes dropped EXE
-
\??\c:\bhfdt.exec:\bhfdt.exe38⤵
- Executes dropped EXE
-
\??\c:\vhtxbtj.exec:\vhtxbtj.exe39⤵
- Executes dropped EXE
-
\??\c:\lhxfplx.exec:\lhxfplx.exe40⤵
- Executes dropped EXE
-
\??\c:\ntvthx.exec:\ntvthx.exe41⤵
- Executes dropped EXE
-
\??\c:\tltnd.exec:\tltnd.exe42⤵
- Executes dropped EXE
-
\??\c:\prjbfp.exec:\prjbfp.exe43⤵
- Executes dropped EXE
-
\??\c:\hxdxd.exec:\hxdxd.exe44⤵
- Executes dropped EXE
-
\??\c:\ldvbdh.exec:\ldvbdh.exe45⤵
- Executes dropped EXE
-
\??\c:\pltvb.exec:\pltvb.exe46⤵
- Executes dropped EXE
-
\??\c:\tvrrj.exec:\tvrrj.exe47⤵
- Executes dropped EXE
-
\??\c:\xbjrpxh.exec:\xbjrpxh.exe48⤵
- Executes dropped EXE
-
\??\c:\vlrtrh.exec:\vlrtrh.exe49⤵
- Executes dropped EXE
-
\??\c:\xnvlv.exec:\xnvlv.exe50⤵
- Executes dropped EXE
-
\??\c:\hpvtfxl.exec:\hpvtfxl.exe51⤵
- Executes dropped EXE
-
\??\c:\phrrtft.exec:\phrrtft.exe52⤵
- Executes dropped EXE
-
\??\c:\tdtff.exec:\tdtff.exe53⤵
- Executes dropped EXE
-
\??\c:\nbpjj.exec:\nbpjj.exe54⤵
- Executes dropped EXE
-
\??\c:\vvnbdn.exec:\vvnbdn.exe55⤵
- Executes dropped EXE
-
\??\c:\hldffv.exec:\hldffv.exe56⤵
- Executes dropped EXE
-
\??\c:\nvlblxb.exec:\nvlblxb.exe57⤵
- Executes dropped EXE
-
\??\c:\prfbv.exec:\prfbv.exe58⤵
- Executes dropped EXE
-
\??\c:\xtrthrv.exec:\xtrthrv.exe59⤵
- Executes dropped EXE
-
\??\c:\tnpptlp.exec:\tnpptlp.exe60⤵
- Executes dropped EXE
-
\??\c:\ntjvdp.exec:\ntjvdp.exe61⤵
- Executes dropped EXE
-
\??\c:\vxjhr.exec:\vxjhr.exe62⤵
- Executes dropped EXE
-
\??\c:\hjhlntj.exec:\hjhlntj.exe63⤵
- Executes dropped EXE
-
\??\c:\hbpnr.exec:\hbpnr.exe64⤵
- Executes dropped EXE
-
\??\c:\pnlbpf.exec:\pnlbpf.exe65⤵
- Executes dropped EXE
-
\??\c:\djrfd.exec:\djrfd.exe66⤵
-
\??\c:\brnfh.exec:\brnfh.exe67⤵
-
\??\c:\jnjxft.exec:\jnjxft.exe68⤵
-
\??\c:\vthvfx.exec:\vthvfx.exe69⤵
-
\??\c:\ftdjh.exec:\ftdjh.exe70⤵
-
\??\c:\rjjtnnh.exec:\rjjtnnh.exe71⤵
-
\??\c:\dnbvh.exec:\dnbvh.exe72⤵
-
\??\c:\tlxbj.exec:\tlxbj.exe73⤵
-
\??\c:\xxjhx.exec:\xxjhx.exe74⤵
-
\??\c:\vlnpvfn.exec:\vlnpvfn.exe75⤵
-
\??\c:\bnbtv.exec:\bnbtv.exe76⤵
-
\??\c:\hbphlt.exec:\hbphlt.exe77⤵
-
\??\c:\rjfpfvb.exec:\rjfpfvb.exe78⤵
-
\??\c:\frxtllh.exec:\frxtllh.exe79⤵
-
\??\c:\bpnbnnj.exec:\bpnbnnj.exe80⤵
-
\??\c:\hrxbj.exec:\hrxbj.exe81⤵
-
\??\c:\dptnrhh.exec:\dptnrhh.exe82⤵
-
\??\c:\djxrvfn.exec:\djxrvfn.exe83⤵
-
\??\c:\dfvjj.exec:\dfvjj.exe84⤵
-
\??\c:\pbfjx.exec:\pbfjx.exe85⤵
-
\??\c:\tdrlf.exec:\tdrlf.exe86⤵
-
\??\c:\xjvjrnp.exec:\xjvjrnp.exe87⤵
-
\??\c:\trbjx.exec:\trbjx.exe88⤵
-
\??\c:\vjpjxh.exec:\vjpjxh.exe89⤵
-
\??\c:\pjjxnxl.exec:\pjjxnxl.exe90⤵
-
\??\c:\lpvhph.exec:\lpvhph.exe91⤵
-
\??\c:\pflhrvx.exec:\pflhrvx.exe92⤵
-
\??\c:\xdthfd.exec:\xdthfd.exe93⤵
-
\??\c:\rvrfrlr.exec:\rvrfrlr.exe94⤵
-
\??\c:\nxvnrt.exec:\nxvnrt.exe95⤵
-
\??\c:\bnftxfb.exec:\bnftxfb.exe96⤵
-
\??\c:\drjbv.exec:\drjbv.exe97⤵
-
\??\c:\ndntlh.exec:\ndntlh.exe98⤵
-
\??\c:\lltpv.exec:\lltpv.exe99⤵
-
\??\c:\rhpjlx.exec:\rhpjlx.exe100⤵
-
\??\c:\tdlhjtf.exec:\tdlhjtf.exe101⤵
-
\??\c:\prxff.exec:\prxff.exe102⤵
-
\??\c:\dvfddp.exec:\dvfddp.exe103⤵
-
\??\c:\phlvndn.exec:\phlvndn.exe104⤵
-
\??\c:\jrhld.exec:\jrhld.exe105⤵
-
\??\c:\nllpxhj.exec:\nllpxhj.exe106⤵
-
\??\c:\xjtdl.exec:\xjtdl.exe107⤵
-
\??\c:\ljflt.exec:\ljflt.exe108⤵
-
\??\c:\hhxvbnl.exec:\hhxvbnl.exe109⤵
-
\??\c:\xjjdblv.exec:\xjjdblv.exe110⤵
-
\??\c:\bnjpdxp.exec:\bnjpdxp.exe111⤵
-
\??\c:\hvlljbr.exec:\hvlljbr.exe112⤵
-
\??\c:\lrfxr.exec:\lrfxr.exe113⤵
-
\??\c:\vnrrfx.exec:\vnrrfx.exe114⤵
-
\??\c:\tflvptx.exec:\tflvptx.exe115⤵
-
\??\c:\fprrfxv.exec:\fprrfxv.exe116⤵
-
\??\c:\fflhfdn.exec:\fflhfdn.exe117⤵
-
\??\c:\jllbj.exec:\jllbj.exe118⤵
-
\??\c:\tndrd.exec:\tndrd.exe119⤵
-
\??\c:\vltjb.exec:\vltjb.exe120⤵
-
\??\c:\jjjnlfh.exec:\jjjnlfh.exe121⤵
-
\??\c:\drbvx.exec:\drbvx.exe122⤵
-
\??\c:\lvnhx.exec:\lvnhx.exe123⤵
-
\??\c:\vrjnhv.exec:\vrjnhv.exe124⤵
-
\??\c:\ndbnr.exec:\ndbnr.exe125⤵
-
\??\c:\vxvlv.exec:\vxvlv.exe126⤵
-
\??\c:\vxnxv.exec:\vxnxv.exe127⤵
-
\??\c:\rfvdfn.exec:\rfvdfn.exe128⤵
-
\??\c:\bffnx.exec:\bffnx.exe129⤵
-
\??\c:\jxnff.exec:\jxnff.exe130⤵
-
\??\c:\hxvllpd.exec:\hxvllpd.exe131⤵
-
\??\c:\nxtjnl.exec:\nxtjnl.exe132⤵
-
\??\c:\bhlbn.exec:\bhlbn.exe133⤵
-
\??\c:\dvlpt.exec:\dvlpt.exe134⤵
-
\??\c:\xrjlfd.exec:\xrjlfd.exe135⤵
-
\??\c:\bhhhhx.exec:\bhhhhx.exe136⤵
-
\??\c:\fbbxtbd.exec:\fbbxtbd.exe137⤵
-
\??\c:\vpjlrd.exec:\vpjlrd.exe138⤵
-
\??\c:\vxjprlh.exec:\vxjprlh.exe139⤵
-
\??\c:\tjbxljp.exec:\tjbxljp.exe140⤵
-
\??\c:\brhdhrh.exec:\brhdhrh.exe141⤵
-
\??\c:\tfbxrv.exec:\tfbxrv.exe142⤵
-
\??\c:\hnrppxn.exec:\hnrppxn.exe143⤵
-
\??\c:\xrdlrb.exec:\xrdlrb.exe144⤵
-
\??\c:\xhplxt.exec:\xhplxt.exe145⤵
-
\??\c:\pvlbb.exec:\pvlbb.exe146⤵
-
\??\c:\rxxhd.exec:\rxxhd.exe147⤵
-
\??\c:\rprdt.exec:\rprdt.exe148⤵
-
\??\c:\pjxfx.exec:\pjxfx.exe149⤵
-
\??\c:\vfdnv.exec:\vfdnv.exe150⤵
-
\??\c:\pbhjvpb.exec:\pbhjvpb.exe151⤵
-
\??\c:\vbdxbxr.exec:\vbdxbxr.exe152⤵
-
\??\c:\fxfpdj.exec:\fxfpdj.exe153⤵
-
\??\c:\tthbltb.exec:\tthbltb.exe154⤵
-
\??\c:\fnvjpff.exec:\fnvjpff.exe155⤵
-
\??\c:\rnjdjp.exec:\rnjdjp.exe156⤵
-
\??\c:\hpxxrb.exec:\hpxxrb.exe157⤵
-
\??\c:\jlrjd.exec:\jlrjd.exe158⤵
-
\??\c:\hxxhxdh.exec:\hxxhxdh.exe159⤵
-
\??\c:\drnljj.exec:\drnljj.exe160⤵
-
\??\c:\xlnntb.exec:\xlnntb.exe161⤵
-
\??\c:\ntnxrlx.exec:\ntnxrlx.exe162⤵
-
\??\c:\dhbvlf.exec:\dhbvlf.exe163⤵
-
\??\c:\pntbvbt.exec:\pntbvbt.exe164⤵
-
\??\c:\bhdfx.exec:\bhdfx.exe165⤵
-
\??\c:\fpptbp.exec:\fpptbp.exe166⤵
-
\??\c:\nfphx.exec:\nfphx.exe167⤵
-
\??\c:\vvtrdn.exec:\vvtrdn.exe168⤵
-
\??\c:\trddt.exec:\trddt.exe169⤵
-
\??\c:\lnnvd.exec:\lnnvd.exe170⤵
-
\??\c:\tffvx.exec:\tffvx.exe171⤵
-
\??\c:\dnlvffp.exec:\dnlvffp.exe172⤵
-
\??\c:\rrnxr.exec:\rrnxr.exe173⤵
-
\??\c:\tdpfnfx.exec:\tdpfnfx.exe174⤵
-
\??\c:\fdjbxvd.exec:\fdjbxvd.exe175⤵
-
\??\c:\nddvn.exec:\nddvn.exe176⤵
-
\??\c:\lvhnth.exec:\lvhnth.exe177⤵
-
\??\c:\fjptp.exec:\fjptp.exe178⤵
-
\??\c:\bxhnb.exec:\bxhnb.exe179⤵
-
\??\c:\dltltx.exec:\dltltx.exe180⤵
-
\??\c:\pfbnxb.exec:\pfbnxb.exe181⤵
-
\??\c:\pndptpf.exec:\pndptpf.exe182⤵
-
\??\c:\txfnppv.exec:\txfnppv.exe183⤵
-
\??\c:\dtfrlt.exec:\dtfrlt.exe184⤵
-
\??\c:\rhntl.exec:\rhntl.exe185⤵
-
\??\c:\nfrbl.exec:\nfrbl.exe186⤵
-
\??\c:\xpnnrxf.exec:\xpnnrxf.exe187⤵
-
\??\c:\tnvpnr.exec:\tnvpnr.exe188⤵
-
\??\c:\nnjdx.exec:\nnjdx.exe189⤵
-
\??\c:\nrndnn.exec:\nrndnn.exe190⤵
-
\??\c:\ltdpthp.exec:\ltdpthp.exe191⤵
-
\??\c:\brtnjrv.exec:\brtnjrv.exe192⤵
-
\??\c:\dhxbxd.exec:\dhxbxd.exe193⤵
-
\??\c:\vbdhd.exec:\vbdhd.exe194⤵
-
\??\c:\xlvfdb.exec:\xlvfdb.exe195⤵
-
\??\c:\jxbrh.exec:\jxbrh.exe196⤵
-
\??\c:\rvjdrf.exec:\rvjdrf.exe197⤵
-
\??\c:\vthblrr.exec:\vthblrr.exe198⤵
-
\??\c:\trpjtjd.exec:\trpjtjd.exe199⤵
-
\??\c:\tpfxr.exec:\tpfxr.exe200⤵
-
\??\c:\rpldhbd.exec:\rpldhbd.exe201⤵
-
\??\c:\jnfltn.exec:\jnfltn.exe202⤵
-
\??\c:\xjnhbvv.exec:\xjnhbvv.exe203⤵
-
\??\c:\xvrft.exec:\xvrft.exe204⤵
-
\??\c:\jnvjpr.exec:\jnvjpr.exe205⤵
-
\??\c:\rjdxfrn.exec:\rjdxfrn.exe206⤵
-
\??\c:\xbfjh.exec:\xbfjh.exe207⤵
-
\??\c:\nhhnxdf.exec:\nhhnxdf.exe208⤵
-
\??\c:\rvhnp.exec:\rvhnp.exe209⤵
-
\??\c:\jvfdl.exec:\jvfdl.exe210⤵
-
\??\c:\vdbblp.exec:\vdbblp.exe211⤵
-
\??\c:\rjjrbfr.exec:\rjjrbfr.exe212⤵
-
\??\c:\frhrf.exec:\frhrf.exe213⤵
-
\??\c:\nprhxbn.exec:\nprhxbn.exe214⤵
-
\??\c:\frrbpnn.exec:\frrbpnn.exe215⤵
-
\??\c:\dflbnfv.exec:\dflbnfv.exe216⤵
-
\??\c:\xtrnf.exec:\xtrnf.exe217⤵
-
\??\c:\ljntt.exec:\ljntt.exe218⤵
-
\??\c:\drfnrl.exec:\drfnrl.exe219⤵
-
\??\c:\dhhtbvr.exec:\dhhtbvr.exe220⤵
-
\??\c:\rnvnn.exec:\rnvnn.exe221⤵
-
\??\c:\njvfl.exec:\njvfl.exe222⤵
-
\??\c:\vhlfb.exec:\vhlfb.exe223⤵
-
\??\c:\fjfxdln.exec:\fjfxdln.exe224⤵
-
\??\c:\vbldnp.exec:\vbldnp.exe225⤵
-
\??\c:\fxxpthj.exec:\fxxpthj.exe226⤵
-
\??\c:\jvnrrjd.exec:\jvnrrjd.exe227⤵
-
\??\c:\pdjxl.exec:\pdjxl.exe228⤵
-
\??\c:\njjvpff.exec:\njjvpff.exe229⤵
-
\??\c:\xxldv.exec:\xxldv.exe230⤵
-
\??\c:\rrbxd.exec:\rrbxd.exe231⤵
-
\??\c:\dbjrbnv.exec:\dbjrbnv.exe232⤵
-
\??\c:\vfnvldr.exec:\vfnvldr.exe233⤵
-
\??\c:\hhtdn.exec:\hhtdn.exe234⤵
-
\??\c:\fphdp.exec:\fphdp.exe235⤵
-
\??\c:\rbfxn.exec:\rbfxn.exe236⤵
-
\??\c:\ddfjr.exec:\ddfjr.exe237⤵
-
\??\c:\hbndthh.exec:\hbndthh.exe238⤵
-
\??\c:\vvbtj.exec:\vvbtj.exe239⤵
-
\??\c:\vbpbprb.exec:\vbpbprb.exe240⤵
-
\??\c:\pnxbpd.exec:\pnxbpd.exe241⤵