Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24/07/2024, 00:19
Behavioral task
behavioral1
Sample
91f0ef372d99748d24a4c8abcf6c55705ba37ecae6a3f5a05a277789d85c5689.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
General
-
Target
91f0ef372d99748d24a4c8abcf6c55705ba37ecae6a3f5a05a277789d85c5689.exe
-
Size
97KB
-
MD5
c8dd2de9de02be15cb92e19c4784696b
-
SHA1
ec779af1992fb8f8ae339260ea4a7b86752c9623
-
SHA256
91f0ef372d99748d24a4c8abcf6c55705ba37ecae6a3f5a05a277789d85c5689
-
SHA512
6a06ed02a504efa443b3da4248faae187a183dd1aa0b75e58ee48a7235afc7fc6143435406401d858cf10a6bddc1f6327915d1693ebee11e45bce492474fa812
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutyaVszyKd+XqQPdf5NS1:9cm4FmowdHoSyAszBd+aQNS1
Malware Config
Signatures
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2732-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-45-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2732-51-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2584-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-123-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1456-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2096-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1456-129-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2916-168-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2256-172-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2916-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-208-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2256-211-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1952-228-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1780-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1388-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-476-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2228-483-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1124-559-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2160-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-361-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2696-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/884-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1440-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/872-572-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1936-588-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2716-595-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-618-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2156-623-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2604-630-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1704-636-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1768-696-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1760-799-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-831-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2824 lhttbpr.exe 2800 tltrhxx.exe 2744 vtjdvjh.exe 2612 hjdtl.exe 2584 llxjhv.exe 2008 jjnxbr.exe 3044 fhhdd.exe 2548 frhdvn.exe 1440 frnrnx.exe 2220 rdvrr.exe 2572 lvbxfx.exe 2916 xdpjxjx.exe 1456 pldlphr.exe 2096 tdnhjf.exe 2128 hrnhxl.exe 520 ljpbpn.exe 2256 thpbt.exe 2056 nhjxvrb.exe 2288 lbpjrxj.exe 1688 ljtpbv.exe 2208 nfntj.exe 884 fjljfj.exe 1952 phljpr.exe 1780 hvpdp.exe 1388 vlrnxdv.exe 1536 txnrj.exe 624 pbdxrj.exe 2452 lbjhd.exe 692 ffrpj.exe 1112 btntjv.exe 1672 pxfhjp.exe 2332 ndnvpj.exe 2708 brpxh.exe 2780 dptffj.exe 2796 jjjjv.exe 2768 fjrxj.exe 2840 bdhrnll.exe 2600 vrxftll.exe 3036 xjthhpl.exe 2696 xntxd.exe 2892 rjtbnfj.exe 1052 lpnlxl.exe 2548 fhdlhdt.exe 1964 tfvvhv.exe 2160 jftftn.exe 1712 hdxrr.exe 2936 rbftp.exe 2916 jnflh.exe 1196 pnvvn.exe 1100 trrpjpp.exe 2092 nlftb.exe 1336 rjjrplx.exe 2248 xjvhpn.exe 2112 xlfvpf.exe 2184 blbdnj.exe 2240 hrpbbr.exe 2120 pdjvnj.exe 2228 rttnpxb.exe 2180 rbhhl.exe 2088 xtpvhn.exe 556 xxnxp.exe 980 bxjjvrb.exe 1516 nbtpj.exe 1952 hjrhnfb.exe -
resource yara_rule behavioral1/memory/2732-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000016d58-5.dat upx behavioral1/files/0x00070000000177da-17.dat upx behavioral1/memory/2824-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0003000000017801-25.dat upx behavioral1/memory/2744-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2612-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000186b7-46.dat upx behavioral1/memory/2612-45-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2008-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3044-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018d48-65.dat upx behavioral1/files/0x00070000000186bb-58.dat upx behavioral1/memory/2584-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000185e6-38.dat upx behavioral1/memory/3044-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fac-73.dat upx behavioral1/files/0x0005000000018fb0-84.dat upx behavioral1/memory/2548-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2612-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2744-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fb5-102.dat upx behavioral1/memory/2572-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2916-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fb8-124.dat upx behavioral1/memory/1456-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000e000000016d90-135.dat upx behavioral1/memory/1456-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2128-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fb9-144.dat upx behavioral1/files/0x0005000000018fba-155.dat upx behavioral1/memory/2128-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fc1-163.dat upx behavioral1/memory/2096-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fc2-175.dat upx behavioral1/memory/2916-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fb6-115.dat upx behavioral1/memory/2572-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2220-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2056-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fcb-183.dat upx behavioral1/files/0x0005000000018fcd-192.dat upx behavioral1/files/0x0005000000018fe2-201.dat upx behavioral1/files/0x0005000000018fe4-209.dat upx behavioral1/memory/2208-208-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019078-221.dat upx behavioral1/files/0x0004000000019206-230.dat upx behavioral1/files/0x00040000000192a8-240.dat upx behavioral1/memory/1780-239-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00040000000192ad-248.dat upx behavioral1/memory/1388-247-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0004000000019380-257.dat upx behavioral1/files/0x0004000000019461-272.dat upx behavioral1/files/0x0004000000019485-282.dat upx behavioral1/files/0x0005000000019571-297.dat upx behavioral1/memory/2708-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3036-345-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2892-369-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2548-382-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2112-456-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2184-463-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2228-483-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1516-513-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1124-559-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlhddbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfftth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvhrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bplffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxnxnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdhrlnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlftb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljjrxnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjxrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjbjbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdvtpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhpnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjtnvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjpdjrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhvfhvh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2824 2732 91f0ef372d99748d24a4c8abcf6c55705ba37ecae6a3f5a05a277789d85c5689.exe 30 PID 2732 wrote to memory of 2824 2732 91f0ef372d99748d24a4c8abcf6c55705ba37ecae6a3f5a05a277789d85c5689.exe 30 PID 2732 wrote to memory of 2824 2732 91f0ef372d99748d24a4c8abcf6c55705ba37ecae6a3f5a05a277789d85c5689.exe 30 PID 2732 wrote to memory of 2824 2732 91f0ef372d99748d24a4c8abcf6c55705ba37ecae6a3f5a05a277789d85c5689.exe 30 PID 2824 wrote to memory of 2800 2824 lhttbpr.exe 31 PID 2824 wrote to memory of 2800 2824 lhttbpr.exe 31 PID 2824 wrote to memory of 2800 2824 lhttbpr.exe 31 PID 2824 wrote to memory of 2800 2824 lhttbpr.exe 31 PID 2800 wrote to memory of 2744 2800 tltrhxx.exe 32 PID 2800 wrote to memory of 2744 2800 tltrhxx.exe 32 PID 2800 wrote to memory of 2744 2800 tltrhxx.exe 32 PID 2800 wrote to memory of 2744 2800 tltrhxx.exe 32 PID 2744 wrote to memory of 2612 2744 vtjdvjh.exe 33 PID 2744 wrote to memory of 2612 2744 vtjdvjh.exe 33 PID 2744 wrote to memory of 2612 2744 vtjdvjh.exe 33 PID 2744 wrote to memory of 2612 2744 vtjdvjh.exe 33 PID 2612 wrote to memory of 2584 2612 hjdtl.exe 34 PID 2612 wrote to memory of 2584 2612 hjdtl.exe 34 PID 2612 wrote to memory of 2584 2612 hjdtl.exe 34 PID 2612 wrote to memory of 2584 2612 hjdtl.exe 34 PID 2584 wrote to memory of 2008 2584 llxjhv.exe 35 PID 2584 wrote to memory of 2008 2584 llxjhv.exe 35 PID 2584 wrote to memory of 2008 2584 llxjhv.exe 35 PID 2584 wrote to memory of 2008 2584 llxjhv.exe 35 PID 2008 wrote to memory of 3044 2008 jjnxbr.exe 36 PID 2008 wrote to memory of 3044 2008 jjnxbr.exe 36 PID 2008 wrote to memory of 3044 2008 jjnxbr.exe 36 PID 2008 wrote to memory of 3044 2008 jjnxbr.exe 36 PID 3044 wrote to memory of 2548 3044 fhhdd.exe 72 PID 3044 wrote to memory of 2548 3044 fhhdd.exe 72 PID 3044 wrote to memory of 2548 3044 fhhdd.exe 72 PID 3044 wrote to memory of 2548 3044 fhhdd.exe 72 PID 2548 wrote to memory of 1440 2548 frhdvn.exe 38 PID 2548 wrote to memory of 1440 2548 frhdvn.exe 38 PID 2548 wrote to memory of 1440 2548 frhdvn.exe 38 PID 2548 wrote to memory of 1440 2548 frhdvn.exe 38 PID 1440 wrote to memory of 2220 1440 frnrnx.exe 116 PID 1440 wrote to memory of 2220 1440 frnrnx.exe 116 PID 1440 wrote to memory of 2220 1440 frnrnx.exe 116 PID 1440 wrote to memory of 2220 1440 frnrnx.exe 116 PID 2220 wrote to memory of 2572 2220 rdvrr.exe 117 PID 2220 wrote to memory of 2572 2220 rdvrr.exe 117 PID 2220 wrote to memory of 2572 2220 rdvrr.exe 117 PID 2220 wrote to memory of 2572 2220 rdvrr.exe 117 PID 2572 wrote to memory of 2916 2572 lvbxfx.exe 77 PID 2572 wrote to memory of 2916 2572 lvbxfx.exe 77 PID 2572 wrote to memory of 2916 2572 lvbxfx.exe 77 PID 2572 wrote to memory of 2916 2572 lvbxfx.exe 77 PID 2916 wrote to memory of 1456 2916 xdpjxjx.exe 42 PID 2916 wrote to memory of 1456 2916 xdpjxjx.exe 42 PID 2916 wrote to memory of 1456 2916 xdpjxjx.exe 42 PID 2916 wrote to memory of 1456 2916 xdpjxjx.exe 42 PID 1456 wrote to memory of 2096 1456 pldlphr.exe 43 PID 1456 wrote to memory of 2096 1456 pldlphr.exe 43 PID 1456 wrote to memory of 2096 1456 pldlphr.exe 43 PID 1456 wrote to memory of 2096 1456 pldlphr.exe 43 PID 2096 wrote to memory of 2128 2096 tdnhjf.exe 123 PID 2096 wrote to memory of 2128 2096 tdnhjf.exe 123 PID 2096 wrote to memory of 2128 2096 tdnhjf.exe 123 PID 2096 wrote to memory of 2128 2096 tdnhjf.exe 123 PID 2128 wrote to memory of 520 2128 hrnhxl.exe 45 PID 2128 wrote to memory of 520 2128 hrnhxl.exe 45 PID 2128 wrote to memory of 520 2128 hrnhxl.exe 45 PID 2128 wrote to memory of 520 2128 hrnhxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\91f0ef372d99748d24a4c8abcf6c55705ba37ecae6a3f5a05a277789d85c5689.exe"C:\Users\Admin\AppData\Local\Temp\91f0ef372d99748d24a4c8abcf6c55705ba37ecae6a3f5a05a277789d85c5689.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\lhttbpr.exec:\lhttbpr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\tltrhxx.exec:\tltrhxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\vtjdvjh.exec:\vtjdvjh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\hjdtl.exec:\hjdtl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\llxjhv.exec:\llxjhv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\jjnxbr.exec:\jjnxbr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\fhhdd.exec:\fhhdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\frhdvn.exec:\frhdvn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\frnrnx.exec:\frnrnx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\rdvrr.exec:\rdvrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\lvbxfx.exec:\lvbxfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\xdpjxjx.exec:\xdpjxjx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\pldlphr.exec:\pldlphr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\tdnhjf.exec:\tdnhjf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\hrnhxl.exec:\hrnhxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\ljpbpn.exec:\ljpbpn.exe17⤵
- Executes dropped EXE
PID:520 -
\??\c:\thpbt.exec:\thpbt.exe18⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nhjxvrb.exec:\nhjxvrb.exe19⤵
- Executes dropped EXE
PID:2056 -
\??\c:\lbpjrxj.exec:\lbpjrxj.exe20⤵
- Executes dropped EXE
PID:2288 -
\??\c:\ljtpbv.exec:\ljtpbv.exe21⤵
- Executes dropped EXE
PID:1688 -
\??\c:\nfntj.exec:\nfntj.exe22⤵
- Executes dropped EXE
PID:2208 -
\??\c:\fjljfj.exec:\fjljfj.exe23⤵
- Executes dropped EXE
PID:884 -
\??\c:\phljpr.exec:\phljpr.exe24⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hvpdp.exec:\hvpdp.exe25⤵
- Executes dropped EXE
PID:1780 -
\??\c:\vlrnxdv.exec:\vlrnxdv.exe26⤵
- Executes dropped EXE
PID:1388 -
\??\c:\txnrj.exec:\txnrj.exe27⤵
- Executes dropped EXE
PID:1536 -
\??\c:\pbdxrj.exec:\pbdxrj.exe28⤵
- Executes dropped EXE
PID:624 -
\??\c:\lbjhd.exec:\lbjhd.exe29⤵
- Executes dropped EXE
PID:2452 -
\??\c:\ffrpj.exec:\ffrpj.exe30⤵
- Executes dropped EXE
PID:692 -
\??\c:\btntjv.exec:\btntjv.exe31⤵
- Executes dropped EXE
PID:1112 -
\??\c:\pxfhjp.exec:\pxfhjp.exe32⤵
- Executes dropped EXE
PID:1672 -
\??\c:\ndnvpj.exec:\ndnvpj.exe33⤵
- Executes dropped EXE
PID:2332 -
\??\c:\brpxh.exec:\brpxh.exe34⤵
- Executes dropped EXE
PID:2708 -
\??\c:\dptffj.exec:\dptffj.exe35⤵
- Executes dropped EXE
PID:2780 -
\??\c:\jjjjv.exec:\jjjjv.exe36⤵
- Executes dropped EXE
PID:2796 -
\??\c:\fjrxj.exec:\fjrxj.exe37⤵
- Executes dropped EXE
PID:2768 -
\??\c:\bdhrnll.exec:\bdhrnll.exe38⤵
- Executes dropped EXE
PID:2840 -
\??\c:\vrxftll.exec:\vrxftll.exe39⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xjthhpl.exec:\xjthhpl.exe40⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xntxd.exec:\xntxd.exe41⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rjtbnfj.exec:\rjtbnfj.exe42⤵
- Executes dropped EXE
PID:2892 -
\??\c:\lpnlxl.exec:\lpnlxl.exe43⤵
- Executes dropped EXE
PID:1052 -
\??\c:\fhdlhdt.exec:\fhdlhdt.exe44⤵
- Executes dropped EXE
PID:2548 -
\??\c:\tfvvhv.exec:\tfvvhv.exe45⤵
- Executes dropped EXE
PID:1964 -
\??\c:\jftftn.exec:\jftftn.exe46⤵
- Executes dropped EXE
PID:2160 -
\??\c:\hdxrr.exec:\hdxrr.exe47⤵
- Executes dropped EXE
PID:1712 -
\??\c:\rbftp.exec:\rbftp.exe48⤵
- Executes dropped EXE
PID:2936 -
\??\c:\jnflh.exec:\jnflh.exe49⤵
- Executes dropped EXE
PID:2916 -
\??\c:\pnvvn.exec:\pnvvn.exe50⤵
- Executes dropped EXE
PID:1196 -
\??\c:\trrpjpp.exec:\trrpjpp.exe51⤵
- Executes dropped EXE
PID:1100 -
\??\c:\nlftb.exec:\nlftb.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2092 -
\??\c:\rjjrplx.exec:\rjjrplx.exe53⤵
- Executes dropped EXE
PID:1336 -
\??\c:\xjvhpn.exec:\xjvhpn.exe54⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xlfvpf.exec:\xlfvpf.exe55⤵
- Executes dropped EXE
PID:2112 -
\??\c:\blbdnj.exec:\blbdnj.exe56⤵
- Executes dropped EXE
PID:2184 -
\??\c:\hrpbbr.exec:\hrpbbr.exe57⤵
- Executes dropped EXE
PID:2240 -
\??\c:\pdjvnj.exec:\pdjvnj.exe58⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rttnpxb.exec:\rttnpxb.exe59⤵
- Executes dropped EXE
PID:2228 -
\??\c:\rbhhl.exec:\rbhhl.exe60⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xtpvhn.exec:\xtpvhn.exe61⤵
- Executes dropped EXE
PID:2088 -
\??\c:\xxnxp.exec:\xxnxp.exe62⤵
- Executes dropped EXE
PID:556 -
\??\c:\bxjjvrb.exec:\bxjjvrb.exe63⤵
- Executes dropped EXE
PID:980 -
\??\c:\nbtpj.exec:\nbtpj.exe64⤵
- Executes dropped EXE
PID:1516 -
\??\c:\hjrhnfb.exec:\hjrhnfb.exe65⤵
- Executes dropped EXE
PID:1952 -
\??\c:\brprb.exec:\brprb.exe66⤵PID:1960
-
\??\c:\jjltn.exec:\jjltn.exe67⤵PID:868
-
\??\c:\hjphbf.exec:\hjphbf.exe68⤵PID:1228
-
\??\c:\jvtfnv.exec:\jvtfnv.exe69⤵PID:2444
-
\??\c:\hhpnblp.exec:\hhpnblp.exe70⤵PID:1944
-
\??\c:\ldlxbh.exec:\ldlxbh.exe71⤵PID:1124
-
\??\c:\jphrhfv.exec:\jphrhfv.exe72⤵PID:2344
-
\??\c:\xldfd.exec:\xldfd.exe73⤵PID:872
-
\??\c:\pjbrjp.exec:\pjbrjp.exe74⤵PID:3052
-
\??\c:\ntbnv.exec:\ntbnv.exe75⤵PID:1936
-
\??\c:\rxdbj.exec:\rxdbj.exe76⤵PID:2716
-
\??\c:\jdrtnn.exec:\jdrtnn.exe77⤵PID:2740
-
\??\c:\tnjhppr.exec:\tnjhppr.exe78⤵PID:2052
-
\??\c:\xrxphj.exec:\xrxphj.exe79⤵PID:2772
-
\??\c:\plbtn.exec:\plbtn.exe80⤵PID:2156
-
\??\c:\bxtff.exec:\bxtff.exe81⤵PID:2604
-
\??\c:\jhvjv.exec:\jhvjv.exe82⤵PID:1704
-
\??\c:\fjjxtt.exec:\fjjxtt.exe83⤵PID:2564
-
\??\c:\hnxdxjh.exec:\hnxdxjh.exe84⤵PID:2956
-
\??\c:\ldfrl.exec:\ldfrl.exe85⤵PID:572
-
\??\c:\rtpnrxf.exec:\rtpnrxf.exe86⤵PID:652
-
\??\c:\rvhddf.exec:\rvhddf.exe87⤵PID:2108
-
\??\c:\rllfn.exec:\rllfn.exe88⤵PID:2220
-
\??\c:\jdthttb.exec:\jdthttb.exe89⤵PID:2572
-
\??\c:\ndpfdnn.exec:\ndpfdnn.exe90⤵PID:2408
-
\??\c:\trhfdv.exec:\trhfdv.exe91⤵PID:1768
-
\??\c:\rphbt.exec:\rphbt.exe92⤵PID:2420
-
\??\c:\flxlfv.exec:\flxlfv.exe93⤵PID:2348
-
\??\c:\txnjt.exec:\txnjt.exe94⤵PID:2396
-
\??\c:\rvnnx.exec:\rvnnx.exe95⤵PID:2128
-
\??\c:\rfnhdfb.exec:\rfnhdfb.exe96⤵PID:2040
-
\??\c:\ftlfj.exec:\ftlfj.exe97⤵PID:1464
-
\??\c:\dxlvtfb.exec:\dxlvtfb.exe98⤵PID:2112
-
\??\c:\hphpjj.exec:\hphpjj.exe99⤵PID:2184
-
\??\c:\njdjdb.exec:\njdjdb.exe100⤵PID:2240
-
\??\c:\bfrbnt.exec:\bfrbnt.exe101⤵PID:2376
-
\??\c:\pphdr.exec:\pphdr.exe102⤵PID:2228
-
\??\c:\fttbn.exec:\fttbn.exe103⤵PID:1108
-
\??\c:\xnpjvhl.exec:\xnpjvhl.exe104⤵PID:384
-
\??\c:\thxtrx.exec:\thxtrx.exe105⤵PID:884
-
\??\c:\bxtltf.exec:\bxtltf.exe106⤵PID:1640
-
\??\c:\vnfflpd.exec:\vnfflpd.exe107⤵PID:1760
-
\??\c:\bvlnvr.exec:\bvlnvr.exe108⤵PID:1132
-
\??\c:\xdvbvl.exec:\xdvbvl.exe109⤵PID:1736
-
\??\c:\lrbtlj.exec:\lrbtlj.exe110⤵PID:2324
-
\??\c:\pfdfjhd.exec:\pfdfjhd.exe111⤵PID:2224
-
\??\c:\jbldnjt.exec:\jbldnjt.exe112⤵PID:2996
-
\??\c:\xbpbbv.exec:\xbpbbv.exe113⤵PID:3000
-
\??\c:\bjxbbtn.exec:\bjxbbtn.exe114⤵PID:1296
-
\??\c:\hvrttpb.exec:\hvrttpb.exe115⤵PID:1112
-
\??\c:\jpvfvtx.exec:\jpvfvtx.exe116⤵PID:676
-
\??\c:\rbthl.exec:\rbthl.exe117⤵PID:2884
-
\??\c:\jnrvdfb.exec:\jnrvdfb.exe118⤵PID:2816
-
\??\c:\rvlftn.exec:\rvlftn.exe119⤵PID:2708
-
\??\c:\jrfbd.exec:\jrfbd.exe120⤵PID:2808
-
\??\c:\fhdfvt.exec:\fhdfvt.exe121⤵PID:2672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-