Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25-08-2024 10:29
Behavioral task
behavioral1
Sample
7d74bbe1c3fe59e1793b46572deabfb0N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
7d74bbe1c3fe59e1793b46572deabfb0N.exe
-
Size
165KB
-
MD5
7d74bbe1c3fe59e1793b46572deabfb0
-
SHA1
c304e3ac244403ed33f83ef302ee7e39114c185f
-
SHA256
b28326c5b180d3c21df0a0df2ddaa6b133fe53a9bb31d0493e773149e85c68b7
-
SHA512
bd52ea10840eb321b0efb1f05e7d2981f679ad29515d87034fc70c27d8ea5b4fbbd1a199203b1d783299d3c441956b11ec67ca1a078a5c94a7ef3104a1b472d7
-
SSDEEP
3072:xhOmTsF93UYfwC6GIout0fmCiiiXAQ5lpBoGYwNNhu0CzhKPJFt:xcm4FmowdHoSgWrXF5lpKGYV0wh6Jj
Malware Config
Signatures
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/1292-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1836-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-66-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2768-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-74-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2996-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1120-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/736-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/736-125-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2520-141-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2520-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2328-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1944-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1944-201-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1800-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/912-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1280-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1560-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2352-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-408-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1228-414-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2524-504-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2516-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1004-528-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2252-539-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1988-652-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-679-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1740-706-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2092-732-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1560-855-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2716-865-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2376-943-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2316-952-0x00000000001C0000-0x00000000001E7000-memory.dmp family_blackmoon behavioral1/memory/1180-960-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2292 rrfxjx.exe 1836 xtjdd.exe 2712 xxjdxb.exe 2816 rjrfvn.exe 2056 vrjlf.exe 2760 rddjfp.exe 2768 vtfjx.exe 2612 rxvbh.exe 2632 lrvnxxx.exe 2996 xfbtfxv.exe 2840 tvpttt.exe 1120 dptphlp.exe 564 lhhvpxv.exe 736 bnrxl.exe 2644 ltfht.exe 2520 dlxfhhp.exe 1492 fljrtb.exe 1296 nxthb.exe 2180 pvhttrf.exe 2324 bvlrh.exe 2328 xpfdtr.exe 3032 lbbjlhr.exe 1648 jjfvbrr.exe 1944 ddttxrn.exe 476 ltfxldt.exe 2164 djfjlx.exe 108 hdblbhp.exe 1480 dljrl.exe 1800 jjpdf.exe 912 lfbtnlv.exe 328 dfljdn.exe 1724 njrvf.exe 1280 txnvfnj.exe 2216 rjtnjt.exe 2104 ttlvt.exe 3048 xtblrbt.exe 2120 xdjlff.exe 2308 fxppj.exe 2292 tntfbd.exe 2648 rjbvf.exe 1560 nvvjxrr.exe 2696 dxbplrp.exe 2804 fjpdl.exe 2564 pbnjtp.exe 2352 xnrxn.exe 2656 dpdjhd.exe 2752 vlrftp.exe 2724 fxvhx.exe 2576 nrxhbfb.exe 2972 hjjdrrn.exe 2632 llbhh.exe 2832 vfpntn.exe 2440 xtnhv.exe 1536 drpjfvf.exe 1984 vtlvx.exe 1812 jntdpl.exe 2624 ljnnrvf.exe 1228 rjbdv.exe 2852 jbjpptx.exe 1180 rrnnbh.exe 2304 rnxtrff.exe 1368 rpfjnlx.exe 2000 jhvprb.exe 1972 jflrtdt.exe -
resource yara_rule behavioral1/memory/1292-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000e00000001270c-8.dat upx behavioral1/memory/1292-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d4d-15.dat upx behavioral1/memory/2292-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1836-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d58-25.dat upx behavioral1/files/0x0007000000016d60-31.dat upx behavioral1/memory/2816-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2712-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2816-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000016d6c-40.dat upx behavioral1/files/0x0003000000017801-48.dat upx behavioral1/memory/2056-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2760-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000018b4d-57.dat upx behavioral1/files/0x0005000000018f90-67.dat upx behavioral1/memory/2768-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018f94-75.dat upx behavioral1/memory/2632-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2612-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0015000000016ceb-84.dat upx behavioral1/files/0x0005000000018f98-91.dat upx behavioral1/memory/2996-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1120-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2840-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018f9a-103.dat upx behavioral1/memory/1120-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018f9c-111.dat upx behavioral1/files/0x0005000000018f9e-117.dat upx behavioral1/memory/736-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fa0-124.dat upx behavioral1/memory/2520-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fa2-133.dat upx behavioral1/memory/2520-141-0x0000000000430000-0x0000000000457000-memory.dmp upx behavioral1/files/0x0005000000018fa6-144.dat upx behavioral1/memory/2520-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018faa-150.dat upx behavioral1/files/0x0005000000018fac-157.dat upx behavioral1/memory/2180-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fb0-165.dat upx behavioral1/files/0x0005000000018fb4-172.dat upx behavioral1/memory/2328-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fb5-180.dat upx behavioral1/files/0x0005000000018fb6-188.dat upx behavioral1/files/0x0005000000018fb8-194.dat upx behavioral1/memory/1944-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fb9-203.dat upx behavioral1/files/0x0005000000018fba-211.dat upx behavioral1/files/0x0005000000018fc1-218.dat upx behavioral1/files/0x0005000000018fc2-225.dat upx behavioral1/files/0x0005000000018fcb-233.dat upx behavioral1/files/0x0005000000018fcd-241.dat upx behavioral1/memory/1800-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fe2-250.dat upx behavioral1/memory/912-248-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fe4-256.dat upx behavioral1/memory/1280-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1280-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2216-276-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3048-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2648-308-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1560-309-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1560-316-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnffhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtbdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdbbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbntp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnfnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jntdpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhvprb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlbvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrvbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhpffrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrdrpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dffjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnxvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvltpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnfpbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbdtvbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjlnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlbvdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nptnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnrxfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlllxvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfbtnlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfjlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxdtvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrvnxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpfdtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjvhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1292 wrote to memory of 2292 1292 7d74bbe1c3fe59e1793b46572deabfb0N.exe 30 PID 1292 wrote to memory of 2292 1292 7d74bbe1c3fe59e1793b46572deabfb0N.exe 30 PID 1292 wrote to memory of 2292 1292 7d74bbe1c3fe59e1793b46572deabfb0N.exe 30 PID 1292 wrote to memory of 2292 1292 7d74bbe1c3fe59e1793b46572deabfb0N.exe 30 PID 2292 wrote to memory of 1836 2292 rrfxjx.exe 31 PID 2292 wrote to memory of 1836 2292 rrfxjx.exe 31 PID 2292 wrote to memory of 1836 2292 rrfxjx.exe 31 PID 2292 wrote to memory of 1836 2292 rrfxjx.exe 31 PID 1836 wrote to memory of 2712 1836 xtjdd.exe 32 PID 1836 wrote to memory of 2712 1836 xtjdd.exe 32 PID 1836 wrote to memory of 2712 1836 xtjdd.exe 32 PID 1836 wrote to memory of 2712 1836 xtjdd.exe 32 PID 2712 wrote to memory of 2816 2712 xxjdxb.exe 33 PID 2712 wrote to memory of 2816 2712 xxjdxb.exe 33 PID 2712 wrote to memory of 2816 2712 xxjdxb.exe 33 PID 2712 wrote to memory of 2816 2712 xxjdxb.exe 33 PID 2816 wrote to memory of 2056 2816 rjrfvn.exe 34 PID 2816 wrote to memory of 2056 2816 rjrfvn.exe 34 PID 2816 wrote to memory of 2056 2816 rjrfvn.exe 34 PID 2816 wrote to memory of 2056 2816 rjrfvn.exe 34 PID 2056 wrote to memory of 2760 2056 vrjlf.exe 35 PID 2056 wrote to memory of 2760 2056 vrjlf.exe 35 PID 2056 wrote to memory of 2760 2056 vrjlf.exe 35 PID 2056 wrote to memory of 2760 2056 vrjlf.exe 35 PID 2760 wrote to memory of 2768 2760 rddjfp.exe 36 PID 2760 wrote to memory of 2768 2760 rddjfp.exe 36 PID 2760 wrote to memory of 2768 2760 rddjfp.exe 36 PID 2760 wrote to memory of 2768 2760 rddjfp.exe 36 PID 2768 wrote to memory of 2612 2768 vtfjx.exe 37 PID 2768 wrote to memory of 2612 2768 vtfjx.exe 37 PID 2768 wrote to memory of 2612 2768 vtfjx.exe 37 PID 2768 wrote to memory of 2612 2768 vtfjx.exe 37 PID 2612 wrote to memory of 2632 2612 rxvbh.exe 38 PID 2612 wrote to memory of 2632 2612 rxvbh.exe 38 PID 2612 wrote to memory of 2632 2612 rxvbh.exe 38 PID 2612 wrote to memory of 2632 2612 rxvbh.exe 38 PID 2632 wrote to memory of 2996 2632 lrvnxxx.exe 39 PID 2632 wrote to memory of 2996 2632 lrvnxxx.exe 39 PID 2632 wrote to memory of 2996 2632 lrvnxxx.exe 39 PID 2632 wrote to memory of 2996 2632 lrvnxxx.exe 39 PID 2996 wrote to memory of 2840 2996 xfbtfxv.exe 40 PID 2996 wrote to memory of 2840 2996 xfbtfxv.exe 40 PID 2996 wrote to memory of 2840 2996 xfbtfxv.exe 40 PID 2996 wrote to memory of 2840 2996 xfbtfxv.exe 40 PID 2840 wrote to memory of 1120 2840 tvpttt.exe 41 PID 2840 wrote to memory of 1120 2840 tvpttt.exe 41 PID 2840 wrote to memory of 1120 2840 tvpttt.exe 41 PID 2840 wrote to memory of 1120 2840 tvpttt.exe 41 PID 1120 wrote to memory of 564 1120 dptphlp.exe 42 PID 1120 wrote to memory of 564 1120 dptphlp.exe 42 PID 1120 wrote to memory of 564 1120 dptphlp.exe 42 PID 1120 wrote to memory of 564 1120 dptphlp.exe 42 PID 564 wrote to memory of 736 564 lhhvpxv.exe 43 PID 564 wrote to memory of 736 564 lhhvpxv.exe 43 PID 564 wrote to memory of 736 564 lhhvpxv.exe 43 PID 564 wrote to memory of 736 564 lhhvpxv.exe 43 PID 736 wrote to memory of 2644 736 bnrxl.exe 44 PID 736 wrote to memory of 2644 736 bnrxl.exe 44 PID 736 wrote to memory of 2644 736 bnrxl.exe 44 PID 736 wrote to memory of 2644 736 bnrxl.exe 44 PID 2644 wrote to memory of 2520 2644 ltfht.exe 45 PID 2644 wrote to memory of 2520 2644 ltfht.exe 45 PID 2644 wrote to memory of 2520 2644 ltfht.exe 45 PID 2644 wrote to memory of 2520 2644 ltfht.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d74bbe1c3fe59e1793b46572deabfb0N.exe"C:\Users\Admin\AppData\Local\Temp\7d74bbe1c3fe59e1793b46572deabfb0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\rrfxjx.exec:\rrfxjx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\xtjdd.exec:\xtjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\xxjdxb.exec:\xxjdxb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\rjrfvn.exec:\rjrfvn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\vrjlf.exec:\vrjlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\rddjfp.exec:\rddjfp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\vtfjx.exec:\vtfjx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\rxvbh.exec:\rxvbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\lrvnxxx.exec:\lrvnxxx.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\xfbtfxv.exec:\xfbtfxv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\tvpttt.exec:\tvpttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\dptphlp.exec:\dptphlp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\lhhvpxv.exec:\lhhvpxv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\bnrxl.exec:\bnrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\ltfht.exec:\ltfht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\dlxfhhp.exec:\dlxfhhp.exe17⤵
- Executes dropped EXE
PID:2520 -
\??\c:\fljrtb.exec:\fljrtb.exe18⤵
- Executes dropped EXE
PID:1492 -
\??\c:\nxthb.exec:\nxthb.exe19⤵
- Executes dropped EXE
PID:1296 -
\??\c:\pvhttrf.exec:\pvhttrf.exe20⤵
- Executes dropped EXE
PID:2180 -
\??\c:\bvlrh.exec:\bvlrh.exe21⤵
- Executes dropped EXE
PID:2324 -
\??\c:\xpfdtr.exec:\xpfdtr.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2328 -
\??\c:\lbbjlhr.exec:\lbbjlhr.exe23⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jjfvbrr.exec:\jjfvbrr.exe24⤵
- Executes dropped EXE
PID:1648 -
\??\c:\ddttxrn.exec:\ddttxrn.exe25⤵
- Executes dropped EXE
PID:1944 -
\??\c:\ltfxldt.exec:\ltfxldt.exe26⤵
- Executes dropped EXE
PID:476 -
\??\c:\djfjlx.exec:\djfjlx.exe27⤵
- Executes dropped EXE
PID:2164 -
\??\c:\hdblbhp.exec:\hdblbhp.exe28⤵
- Executes dropped EXE
PID:108 -
\??\c:\dljrl.exec:\dljrl.exe29⤵
- Executes dropped EXE
PID:1480 -
\??\c:\jjpdf.exec:\jjpdf.exe30⤵
- Executes dropped EXE
PID:1800 -
\??\c:\lfbtnlv.exec:\lfbtnlv.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:912 -
\??\c:\dfljdn.exec:\dfljdn.exe32⤵
- Executes dropped EXE
PID:328 -
\??\c:\njrvf.exec:\njrvf.exe33⤵
- Executes dropped EXE
PID:1724 -
\??\c:\txnvfnj.exec:\txnvfnj.exe34⤵
- Executes dropped EXE
PID:1280 -
\??\c:\rjtnjt.exec:\rjtnjt.exe35⤵
- Executes dropped EXE
PID:2216 -
\??\c:\ttlvt.exec:\ttlvt.exe36⤵
- Executes dropped EXE
PID:2104 -
\??\c:\xtblrbt.exec:\xtblrbt.exe37⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xdjlff.exec:\xdjlff.exe38⤵
- Executes dropped EXE
PID:2120 -
\??\c:\fxppj.exec:\fxppj.exe39⤵
- Executes dropped EXE
PID:2308 -
\??\c:\tntfbd.exec:\tntfbd.exe40⤵
- Executes dropped EXE
PID:2292 -
\??\c:\rjbvf.exec:\rjbvf.exe41⤵
- Executes dropped EXE
PID:2648 -
\??\c:\nvvjxrr.exec:\nvvjxrr.exe42⤵
- Executes dropped EXE
PID:1560 -
\??\c:\dxbplrp.exec:\dxbplrp.exe43⤵
- Executes dropped EXE
PID:2696 -
\??\c:\fjpdl.exec:\fjpdl.exe44⤵
- Executes dropped EXE
PID:2804 -
\??\c:\pbnjtp.exec:\pbnjtp.exe45⤵
- Executes dropped EXE
PID:2564 -
\??\c:\xnrxn.exec:\xnrxn.exe46⤵
- Executes dropped EXE
PID:2352 -
\??\c:\dpdjhd.exec:\dpdjhd.exe47⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vlrftp.exec:\vlrftp.exe48⤵
- Executes dropped EXE
PID:2752 -
\??\c:\fxvhx.exec:\fxvhx.exe49⤵
- Executes dropped EXE
PID:2724 -
\??\c:\nrxhbfb.exec:\nrxhbfb.exe50⤵
- Executes dropped EXE
PID:2576 -
\??\c:\hjjdrrn.exec:\hjjdrrn.exe51⤵
- Executes dropped EXE
PID:2972 -
\??\c:\llbhh.exec:\llbhh.exe52⤵
- Executes dropped EXE
PID:2632 -
\??\c:\vfpntn.exec:\vfpntn.exe53⤵
- Executes dropped EXE
PID:2832 -
\??\c:\xtnhv.exec:\xtnhv.exe54⤵
- Executes dropped EXE
PID:2440 -
\??\c:\drpjfvf.exec:\drpjfvf.exe55⤵
- Executes dropped EXE
PID:1536 -
\??\c:\vtlvx.exec:\vtlvx.exe56⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jntdpl.exec:\jntdpl.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1812 -
\??\c:\ljnnrvf.exec:\ljnnrvf.exe58⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rjbdv.exec:\rjbdv.exe59⤵
- Executes dropped EXE
PID:1228 -
\??\c:\jbjpptx.exec:\jbjpptx.exe60⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rrnnbh.exec:\rrnnbh.exe61⤵
- Executes dropped EXE
PID:1180 -
\??\c:\rnxtrff.exec:\rnxtrff.exe62⤵
- Executes dropped EXE
PID:2304 -
\??\c:\rpfjnlx.exec:\rpfjnlx.exe63⤵
- Executes dropped EXE
PID:1368 -
\??\c:\jhvprb.exec:\jhvprb.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2000 -
\??\c:\jflrtdt.exec:\jflrtdt.exe65⤵
- Executes dropped EXE
PID:1972 -
\??\c:\nljjxdp.exec:\nljjxdp.exe66⤵PID:1488
-
\??\c:\jvvjt.exec:\jvvjt.exe67⤵PID:2172
-
\??\c:\ffjnbfn.exec:\ffjnbfn.exe68⤵PID:2188
-
\??\c:\xnjpb.exec:\xnjpb.exe69⤵PID:3044
-
\??\c:\rdbjt.exec:\rdbjt.exe70⤵PID:2344
-
\??\c:\fxrjv.exec:\fxrjv.exe71⤵PID:2896
-
\??\c:\dfjjt.exec:\dfjjt.exe72⤵PID:2464
-
\??\c:\hbbrvvd.exec:\hbbrvvd.exe73⤵PID:1908
-
\??\c:\vdhbvrv.exec:\vdhbvrv.exe74⤵PID:2960
-
\??\c:\rhdnh.exec:\rhdnh.exe75⤵PID:2524
-
\??\c:\prvhfl.exec:\prvhfl.exe76⤵PID:1788
-
\??\c:\jnpdbxf.exec:\jnpdbxf.exe77⤵PID:2404
-
\??\c:\pbrddx.exec:\pbrddx.exe78⤵PID:2516
-
\??\c:\jdnhxh.exec:\jdnhxh.exe79⤵PID:1004
-
\??\c:\vfjvt.exec:\vfjvt.exe80⤵PID:328
-
\??\c:\rrxfv.exec:\rrxfv.exe81⤵PID:2252
-
\??\c:\rplfn.exec:\rplfn.exe82⤵PID:2228
-
\??\c:\vhfdpd.exec:\vhfdpd.exe83⤵PID:2216
-
\??\c:\jnblldp.exec:\jnblldp.exe84⤵PID:2508
-
\??\c:\hrtxlhd.exec:\hrtxlhd.exe85⤵PID:2128
-
\??\c:\fvrnbd.exec:\fvrnbd.exe86⤵PID:744
-
\??\c:\xfdtpl.exec:\xfdtpl.exe87⤵PID:3056
-
\??\c:\vjprdd.exec:\vjprdd.exe88⤵PID:1264
-
\??\c:\xbfnjpf.exec:\xbfnjpf.exe89⤵PID:2784
-
\??\c:\phtdpt.exec:\phtdpt.exe90⤵PID:2788
-
\??\c:\vjvvr.exec:\vjvvr.exe91⤵PID:2712
-
\??\c:\nrxhln.exec:\nrxhln.exe92⤵PID:2660
-
\??\c:\bxpjtfp.exec:\bxpjtfp.exe93⤵PID:2820
-
\??\c:\jvpvbbl.exec:\jvpvbbl.exe94⤵PID:2564
-
\??\c:\bxfhn.exec:\bxfhn.exe95⤵PID:2760
-
\??\c:\pbvdx.exec:\pbvdx.exe96⤵PID:2876
-
\??\c:\vnfhj.exec:\vnfhj.exe97⤵PID:2580
-
\??\c:\lbvnhl.exec:\lbvnhl.exe98⤵PID:2724
-
\??\c:\ftlxtpl.exec:\ftlxtpl.exe99⤵PID:2608
-
\??\c:\xflhvvx.exec:\xflhvvx.exe100⤵PID:2984
-
\??\c:\bnrrldt.exec:\bnrrldt.exe101⤵PID:928
-
\??\c:\jnbvnfj.exec:\jnbvnfj.exe102⤵PID:1988
-
\??\c:\ftxbh.exec:\ftxbh.exe103⤵PID:2376
-
\??\c:\pdfbrdd.exec:\pdfbrdd.exe104⤵PID:1380
-
\??\c:\lbvpn.exec:\lbvpn.exe105⤵PID:2956
-
\??\c:\dnftlj.exec:\dnftlj.exe106⤵PID:564
-
\??\c:\rrpvj.exec:\rrpvj.exe107⤵PID:2748
-
\??\c:\plnjd.exec:\plnjd.exe108⤵PID:2848
-
\??\c:\xppjtjr.exec:\xppjtjr.exe109⤵PID:1592
-
\??\c:\vfddn.exec:\vfddn.exe110⤵PID:2520
-
\??\c:\jdpbffb.exec:\jdpbffb.exe111⤵PID:580
-
\??\c:\dvffp.exec:\dvffp.exe112⤵PID:1740
-
\??\c:\bnffvx.exec:\bnffvx.exe113⤵PID:1732
-
\??\c:\dtffxj.exec:\dtffxj.exe114⤵PID:2072
-
\??\c:\fjtrhv.exec:\fjtrhv.exe115⤵PID:1364
-
\??\c:\nfdprpb.exec:\nfdprpb.exe116⤵PID:2740
-
\??\c:\vdhrrfl.exec:\vdhrrfl.exe117⤵PID:2092
-
\??\c:\rrrvvb.exec:\rrrvvb.exe118⤵PID:1344
-
\??\c:\rvbdfn.exec:\rvbdfn.exe119⤵PID:2004
-
\??\c:\pljjb.exec:\pljjb.exe120⤵PID:1944
-
\??\c:\xlhhp.exec:\xlhhp.exe121⤵PID:2896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-