Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 15:25
Behavioral task
behavioral1
Sample
5f0392511bf35913c85739b65649e260N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
5f0392511bf35913c85739b65649e260N.exe
-
Size
77KB
-
MD5
5f0392511bf35913c85739b65649e260
-
SHA1
f9dca2731e2bc73cae9019a7fe6c6b8b6087ed10
-
SHA256
0a59a63545203da2d7b064db3b6cb05c34530061088ebaa4a0327aca60b42f89
-
SHA512
887887db1411c7ae14f0d715a9ae930182f7995d7e6318782504fd45e32ba65e537b8cdb04b652a003b8827d1d62b4304dd04c10356b6e236e173edfc01b7e06
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNYWkeu3zLoYNyAN4MFmJyaH:khOmTsF93UYfwC6GIoutpYKkeu3gYNyT
Malware Config
Signatures
-
Detect Blackmoon payload 59 IoCs
resource yara_rule behavioral1/memory/588-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-21-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1960-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-35-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2788-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-41-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2696-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-66-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2600-64-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3068-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2036-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1164-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2152-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1660-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1856-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1856-290-0x0000000001B50000-0x0000000001B77000-memory.dmp family_blackmoon behavioral1/memory/588-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2040-311-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2040-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-337-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2696-343-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2696-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-371-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/652-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/756-440-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/756-460-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2136-472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1384-479-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1688-484-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/2984-629-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-636-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-643-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-657-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2004-799-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1556-813-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2080-827-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2272-841-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2744-927-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1916-982-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1832-1025-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2060-1076-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1964-1083-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1772-1111-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2504-1141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-1158-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2636-1177-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1804-1190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2540 rrdtj.exe 1960 xjldrrh.exe 2788 fbxprnt.exe 2696 blpjbrd.exe 2984 vdphv.exe 2600 hhpdxl.exe 2892 pxhrvxb.exe 3068 fpbxjp.exe 2064 hbprbrf.exe 2036 tvpnpjj.exe 1620 tfxrppj.exe 1672 fhxbtf.exe 2748 btjdh.exe 2196 lvxlld.exe 756 nxjhp.exe 1164 jxvlhnl.exe 1764 xphppht.exe 2112 pjxth.exe 1832 jhnbjh.exe 2320 plnph.exe 2152 xxpxh.exe 700 llphblv.exe 1840 drlhfx.exe 2292 frjjtb.exe 1660 hdrpxv.exe 2020 lltjx.exe 3052 hplpvbl.exe 1856 xtbdh.exe 2992 tddplbp.exe 2924 hjnvbhp.exe 1772 tbxrhp.exe 2524 dnpjdvd.exe 588 pldlxd.exe 2040 lbjxvpv.exe 1604 dpfbx.exe 2852 ndvtl.exe 2780 tpttf.exe 2868 btltn.exe 2696 lrlfbxl.exe 2744 nntpld.exe 2860 xvhbp.exe 2580 dhxjvf.exe 2596 dxdhdxb.exe 2084 fldtj.exe 2244 dbvth.exe 652 phdjf.exe 2464 pdtppt.exe 868 hpbvf.exe 2904 hptnlt.exe 3044 fndbnvd.exe 2400 hntlb.exe 2196 hnhdphd.exe 756 lhlhdth.exe 1480 fhfhb.exe 1764 nrjxhrh.exe 2184 dpfpfd.exe 2316 ftxvpx.exe 2136 vvpdh.exe 1384 pndxd.exe 1688 pprlb.exe 316 xtvlfp.exe 1728 dndfnbx.exe 2408 tlhdnl.exe 1552 xhphpx.exe -
resource yara_rule behavioral1/memory/588-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/588-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000e000000012262-8.dat upx behavioral1/memory/2540-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x002e000000018671-18.dat upx behavioral1/files/0x00070000000186bb-25.dat upx behavioral1/memory/1960-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2788-35-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2788-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186c2-36.dat upx behavioral1/memory/2696-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2984-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001870b-45.dat upx behavioral1/files/0x0005000000018710-58.dat upx behavioral1/memory/2984-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2600-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2892-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018725-69.dat upx behavioral1/files/0x0008000000018ab4-77.dat upx behavioral1/memory/3068-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018afc-85.dat upx behavioral1/files/0x0006000000018cde-94.dat upx behavioral1/files/0x0005000000018f9e-101.dat upx behavioral1/memory/2036-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fa2-109.dat upx behavioral1/memory/2748-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x002e00000001867e-121.dat upx behavioral1/files/0x0005000000018fb0-128.dat upx behavioral1/memory/2196-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fba-137.dat upx behavioral1/files/0x0005000000018fc2-145.dat upx behavioral1/files/0x0005000000018fc4-154.dat upx behavioral1/memory/1164-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1764-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fc7-163.dat upx behavioral1/memory/2112-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fca-172.dat upx behavioral1/memory/2320-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fcd-180.dat upx behavioral1/files/0x0005000000018fe2-190.dat upx behavioral1/memory/2152-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018ffa-198.dat upx behavioral1/memory/700-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001901a-208.dat upx behavioral1/memory/1840-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019028-217.dat upx behavioral1/files/0x000500000001903d-225.dat upx behavioral1/memory/2292-224-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1660-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019044-235.dat upx behavioral1/memory/2020-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001904d-245.dat upx behavioral1/files/0x0005000000019074-253.dat upx behavioral1/files/0x000400000001915a-262.dat upx behavioral1/memory/1856-261-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000400000001919b-270.dat upx behavioral1/memory/2924-278-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00040000000191b3-279.dat upx behavioral1/files/0x00040000000191bb-289.dat upx behavioral1/memory/2524-288-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2040-304-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/588-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2040-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2696-345-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrvbrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbxrdjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dldtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdxnvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lltrxjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnnxdfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plhpjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjtdxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndbhjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnttvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llphblv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxpxnft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrntd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjpft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdvxhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvvjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxxhxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtrpflv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fftlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htptf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjtnrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnbdtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfbnpbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdrpptp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtfvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jphvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfhxlvj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 588 wrote to memory of 2540 588 5f0392511bf35913c85739b65649e260N.exe 30 PID 588 wrote to memory of 2540 588 5f0392511bf35913c85739b65649e260N.exe 30 PID 588 wrote to memory of 2540 588 5f0392511bf35913c85739b65649e260N.exe 30 PID 588 wrote to memory of 2540 588 5f0392511bf35913c85739b65649e260N.exe 30 PID 2540 wrote to memory of 1960 2540 rrdtj.exe 31 PID 2540 wrote to memory of 1960 2540 rrdtj.exe 31 PID 2540 wrote to memory of 1960 2540 rrdtj.exe 31 PID 2540 wrote to memory of 1960 2540 rrdtj.exe 31 PID 1960 wrote to memory of 2788 1960 xjldrrh.exe 32 PID 1960 wrote to memory of 2788 1960 xjldrrh.exe 32 PID 1960 wrote to memory of 2788 1960 xjldrrh.exe 32 PID 1960 wrote to memory of 2788 1960 xjldrrh.exe 32 PID 2788 wrote to memory of 2696 2788 fbxprnt.exe 33 PID 2788 wrote to memory of 2696 2788 fbxprnt.exe 33 PID 2788 wrote to memory of 2696 2788 fbxprnt.exe 33 PID 2788 wrote to memory of 2696 2788 fbxprnt.exe 33 PID 2696 wrote to memory of 2984 2696 blpjbrd.exe 34 PID 2696 wrote to memory of 2984 2696 blpjbrd.exe 34 PID 2696 wrote to memory of 2984 2696 blpjbrd.exe 34 PID 2696 wrote to memory of 2984 2696 blpjbrd.exe 34 PID 2984 wrote to memory of 2600 2984 vdphv.exe 35 PID 2984 wrote to memory of 2600 2984 vdphv.exe 35 PID 2984 wrote to memory of 2600 2984 vdphv.exe 35 PID 2984 wrote to memory of 2600 2984 vdphv.exe 35 PID 2600 wrote to memory of 2892 2600 hhpdxl.exe 36 PID 2600 wrote to memory of 2892 2600 hhpdxl.exe 36 PID 2600 wrote to memory of 2892 2600 hhpdxl.exe 36 PID 2600 wrote to memory of 2892 2600 hhpdxl.exe 36 PID 2892 wrote to memory of 3068 2892 pxhrvxb.exe 37 PID 2892 wrote to memory of 3068 2892 pxhrvxb.exe 37 PID 2892 wrote to memory of 3068 2892 pxhrvxb.exe 37 PID 2892 wrote to memory of 3068 2892 pxhrvxb.exe 37 PID 3068 wrote to memory of 2064 3068 fpbxjp.exe 38 PID 3068 wrote to memory of 2064 3068 fpbxjp.exe 38 PID 3068 wrote to memory of 2064 3068 fpbxjp.exe 38 PID 3068 wrote to memory of 2064 3068 fpbxjp.exe 38 PID 2064 wrote to memory of 2036 2064 hbprbrf.exe 39 PID 2064 wrote to memory of 2036 2064 hbprbrf.exe 39 PID 2064 wrote to memory of 2036 2064 hbprbrf.exe 39 PID 2064 wrote to memory of 2036 2064 hbprbrf.exe 39 PID 2036 wrote to memory of 1620 2036 tvpnpjj.exe 40 PID 2036 wrote to memory of 1620 2036 tvpnpjj.exe 40 PID 2036 wrote to memory of 1620 2036 tvpnpjj.exe 40 PID 2036 wrote to memory of 1620 2036 tvpnpjj.exe 40 PID 1620 wrote to memory of 1672 1620 tfxrppj.exe 41 PID 1620 wrote to memory of 1672 1620 tfxrppj.exe 41 PID 1620 wrote to memory of 1672 1620 tfxrppj.exe 41 PID 1620 wrote to memory of 1672 1620 tfxrppj.exe 41 PID 1672 wrote to memory of 2748 1672 fhxbtf.exe 42 PID 1672 wrote to memory of 2748 1672 fhxbtf.exe 42 PID 1672 wrote to memory of 2748 1672 fhxbtf.exe 42 PID 1672 wrote to memory of 2748 1672 fhxbtf.exe 42 PID 2748 wrote to memory of 2196 2748 btjdh.exe 43 PID 2748 wrote to memory of 2196 2748 btjdh.exe 43 PID 2748 wrote to memory of 2196 2748 btjdh.exe 43 PID 2748 wrote to memory of 2196 2748 btjdh.exe 43 PID 2196 wrote to memory of 756 2196 lvxlld.exe 44 PID 2196 wrote to memory of 756 2196 lvxlld.exe 44 PID 2196 wrote to memory of 756 2196 lvxlld.exe 44 PID 2196 wrote to memory of 756 2196 lvxlld.exe 44 PID 756 wrote to memory of 1164 756 nxjhp.exe 45 PID 756 wrote to memory of 1164 756 nxjhp.exe 45 PID 756 wrote to memory of 1164 756 nxjhp.exe 45 PID 756 wrote to memory of 1164 756 nxjhp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f0392511bf35913c85739b65649e260N.exe"C:\Users\Admin\AppData\Local\Temp\5f0392511bf35913c85739b65649e260N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\rrdtj.exec:\rrdtj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\xjldrrh.exec:\xjldrrh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\fbxprnt.exec:\fbxprnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\blpjbrd.exec:\blpjbrd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\vdphv.exec:\vdphv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\hhpdxl.exec:\hhpdxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\pxhrvxb.exec:\pxhrvxb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\fpbxjp.exec:\fpbxjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\hbprbrf.exec:\hbprbrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\tvpnpjj.exec:\tvpnpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\tfxrppj.exec:\tfxrppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\fhxbtf.exec:\fhxbtf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\btjdh.exec:\btjdh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\lvxlld.exec:\lvxlld.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\nxjhp.exec:\nxjhp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\jxvlhnl.exec:\jxvlhnl.exe17⤵
- Executes dropped EXE
PID:1164 -
\??\c:\xphppht.exec:\xphppht.exe18⤵
- Executes dropped EXE
PID:1764 -
\??\c:\pjxth.exec:\pjxth.exe19⤵
- Executes dropped EXE
PID:2112 -
\??\c:\jhnbjh.exec:\jhnbjh.exe20⤵
- Executes dropped EXE
PID:1832 -
\??\c:\plnph.exec:\plnph.exe21⤵
- Executes dropped EXE
PID:2320 -
\??\c:\xxpxh.exec:\xxpxh.exe22⤵
- Executes dropped EXE
PID:2152 -
\??\c:\llphblv.exec:\llphblv.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:700 -
\??\c:\drlhfx.exec:\drlhfx.exe24⤵
- Executes dropped EXE
PID:1840 -
\??\c:\frjjtb.exec:\frjjtb.exe25⤵
- Executes dropped EXE
PID:2292 -
\??\c:\hdrpxv.exec:\hdrpxv.exe26⤵
- Executes dropped EXE
PID:1660 -
\??\c:\lltjx.exec:\lltjx.exe27⤵
- Executes dropped EXE
PID:2020 -
\??\c:\hplpvbl.exec:\hplpvbl.exe28⤵
- Executes dropped EXE
PID:3052 -
\??\c:\xtbdh.exec:\xtbdh.exe29⤵
- Executes dropped EXE
PID:1856 -
\??\c:\tddplbp.exec:\tddplbp.exe30⤵
- Executes dropped EXE
PID:2992 -
\??\c:\hjnvbhp.exec:\hjnvbhp.exe31⤵
- Executes dropped EXE
PID:2924 -
\??\c:\tbxrhp.exec:\tbxrhp.exe32⤵
- Executes dropped EXE
PID:1772 -
\??\c:\dnpjdvd.exec:\dnpjdvd.exe33⤵
- Executes dropped EXE
PID:2524 -
\??\c:\pldlxd.exec:\pldlxd.exe34⤵
- Executes dropped EXE
PID:588 -
\??\c:\lbjxvpv.exec:\lbjxvpv.exe35⤵
- Executes dropped EXE
PID:2040 -
\??\c:\dpfbx.exec:\dpfbx.exe36⤵
- Executes dropped EXE
PID:1604 -
\??\c:\ndvtl.exec:\ndvtl.exe37⤵
- Executes dropped EXE
PID:2852 -
\??\c:\tpttf.exec:\tpttf.exe38⤵
- Executes dropped EXE
PID:2780 -
\??\c:\btltn.exec:\btltn.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\lrlfbxl.exec:\lrlfbxl.exe40⤵
- Executes dropped EXE
PID:2696 -
\??\c:\nntpld.exec:\nntpld.exe41⤵
- Executes dropped EXE
PID:2744 -
\??\c:\xvhbp.exec:\xvhbp.exe42⤵
- Executes dropped EXE
PID:2860 -
\??\c:\dhxjvf.exec:\dhxjvf.exe43⤵
- Executes dropped EXE
PID:2580 -
\??\c:\dxdhdxb.exec:\dxdhdxb.exe44⤵
- Executes dropped EXE
PID:2596 -
\??\c:\fldtj.exec:\fldtj.exe45⤵
- Executes dropped EXE
PID:2084 -
\??\c:\dbvth.exec:\dbvth.exe46⤵
- Executes dropped EXE
PID:2244 -
\??\c:\phdjf.exec:\phdjf.exe47⤵
- Executes dropped EXE
PID:652 -
\??\c:\pdtppt.exec:\pdtppt.exe48⤵
- Executes dropped EXE
PID:2464 -
\??\c:\hpbvf.exec:\hpbvf.exe49⤵
- Executes dropped EXE
PID:868 -
\??\c:\hptnlt.exec:\hptnlt.exe50⤵
- Executes dropped EXE
PID:2904 -
\??\c:\fndbnvd.exec:\fndbnvd.exe51⤵
- Executes dropped EXE
PID:3044 -
\??\c:\hntlb.exec:\hntlb.exe52⤵
- Executes dropped EXE
PID:2400 -
\??\c:\hnhdphd.exec:\hnhdphd.exe53⤵
- Executes dropped EXE
PID:2196 -
\??\c:\lhlhdth.exec:\lhlhdth.exe54⤵
- Executes dropped EXE
PID:756 -
\??\c:\fhfhb.exec:\fhfhb.exe55⤵
- Executes dropped EXE
PID:1480 -
\??\c:\nrjxhrh.exec:\nrjxhrh.exe56⤵
- Executes dropped EXE
PID:1764 -
\??\c:\dpfpfd.exec:\dpfpfd.exe57⤵
- Executes dropped EXE
PID:2184 -
\??\c:\ftxvpx.exec:\ftxvpx.exe58⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vvpdh.exec:\vvpdh.exe59⤵
- Executes dropped EXE
PID:2136 -
\??\c:\pndxd.exec:\pndxd.exe60⤵
- Executes dropped EXE
PID:1384 -
\??\c:\pprlb.exec:\pprlb.exe61⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xtvlfp.exec:\xtvlfp.exe62⤵
- Executes dropped EXE
PID:316 -
\??\c:\dndfnbx.exec:\dndfnbx.exe63⤵
- Executes dropped EXE
PID:1728 -
\??\c:\tlhdnl.exec:\tlhdnl.exe64⤵
- Executes dropped EXE
PID:2408 -
\??\c:\xhphpx.exec:\xhphpx.exe65⤵
- Executes dropped EXE
PID:1552 -
\??\c:\lbrxbrt.exec:\lbrxbrt.exe66⤵PID:2156
-
\??\c:\bhdjndx.exec:\bhdjndx.exe67⤵PID:2060
-
\??\c:\rffbb.exec:\rffbb.exe68⤵PID:2052
-
\??\c:\bdttvpf.exec:\bdttvpf.exe69⤵PID:1492
-
\??\c:\ltvpj.exec:\ltvpj.exe70⤵PID:1644
-
\??\c:\hxvhx.exec:\hxvhx.exe71⤵PID:1932
-
\??\c:\fhnpj.exec:\fhnpj.exe72⤵PID:2656
-
\??\c:\pxhnnx.exec:\pxhnnx.exe73⤵PID:1376
-
\??\c:\bvbbtnf.exec:\bvbbtnf.exe74⤵PID:668
-
\??\c:\dhntrt.exec:\dhntrt.exe75⤵PID:1316
-
\??\c:\rtvnbj.exec:\rtvnbj.exe76⤵PID:2252
-
\??\c:\dhrvhx.exec:\dhrvhx.exe77⤵PID:2668
-
\??\c:\txxvt.exec:\txxvt.exe78⤵PID:2928
-
\??\c:\ttvpjlh.exec:\ttvpjlh.exe79⤵PID:2092
-
\??\c:\nthvpl.exec:\nthvpl.exe80⤵PID:2784
-
\??\c:\vxdvb.exec:\vxdvb.exe81⤵PID:2376
-
\??\c:\phvdf.exec:\phvdf.exe82⤵PID:2872
-
\??\c:\ldjhr.exec:\ldjhr.exe83⤵PID:2804
-
\??\c:\xxpxnft.exec:\xxpxnft.exe84⤵
- System Location Discovery: System Language Discovery
PID:2984 -
\??\c:\ddbvtdh.exec:\ddbvtdh.exe85⤵PID:2632
-
\??\c:\fhfpr.exec:\fhfpr.exe86⤵PID:2120
-
\??\c:\ndbhjh.exec:\ndbhjh.exe87⤵
- System Location Discovery: System Language Discovery
PID:2896 -
\??\c:\pfvvdvl.exec:\pfvvdvl.exe88⤵PID:2560
-
\??\c:\hxbjbfd.exec:\hxbjbfd.exe89⤵PID:1032
-
\??\c:\rtpjdnj.exec:\rtpjdnj.exe90⤵PID:392
-
\??\c:\rxldth.exec:\rxldth.exe91⤵PID:2444
-
\??\c:\lnntpl.exec:\lnntpl.exe92⤵PID:1204
-
\??\c:\xlxdx.exec:\xlxdx.exe93⤵PID:3064
-
\??\c:\fbtrnl.exec:\fbtrnl.exe94⤵PID:2904
-
\??\c:\bfbjt.exec:\bfbjt.exe95⤵PID:112
-
\??\c:\djfpvd.exec:\djfpvd.exe96⤵PID:2400
-
\??\c:\lnxbht.exec:\lnxbht.exe97⤵PID:3008
-
\??\c:\vllfb.exec:\vllfb.exe98⤵PID:556
-
\??\c:\fdnnfv.exec:\fdnnfv.exe99⤵PID:564
-
\??\c:\nxxftv.exec:\nxxftv.exe100⤵PID:1668
-
\??\c:\vxddjh.exec:\vxddjh.exe101⤵PID:2416
-
\??\c:\fnrfxtt.exec:\fnrfxtt.exe102⤵PID:1832
-
\??\c:\rxhdp.exec:\rxhdp.exe103⤵PID:1792
-
\??\c:\hfftjtx.exec:\hfftjtx.exe104⤵PID:1872
-
\??\c:\dlphd.exec:\dlphd.exe105⤵PID:964
-
\??\c:\jxnxvpr.exec:\jxnxvpr.exe106⤵PID:808
-
\??\c:\tfnxt.exec:\tfnxt.exe107⤵PID:1840
-
\??\c:\pptvrv.exec:\pptvrv.exe108⤵PID:2468
-
\??\c:\ptvnp.exec:\ptvnp.exe109⤵PID:1276
-
\??\c:\lfpdr.exec:\lfpdr.exe110⤵PID:1556
-
\??\c:\xjtvhjr.exec:\xjtvhjr.exe111⤵PID:2004
-
\??\c:\pjhxjlh.exec:\pjhxjlh.exe112⤵PID:632
-
\??\c:\xrjhjj.exec:\xrjhjj.exe113⤵PID:828
-
\??\c:\vhnhf.exec:\vhnhf.exe114⤵PID:1856
-
\??\c:\btffdpv.exec:\btffdpv.exe115⤵PID:2080
-
\??\c:\lltrxjh.exec:\lltrxjh.exe116⤵
- System Location Discovery: System Language Discovery
PID:1720 -
\??\c:\lhvrbhx.exec:\lhvrbhx.exe117⤵PID:2272
-
\??\c:\plnxf.exec:\plnxf.exe118⤵PID:2500
-
\??\c:\pvdfrph.exec:\pvdfrph.exe119⤵PID:2256
-
\??\c:\jbtdlhp.exec:\jbtdlhp.exe120⤵PID:2508
-
\??\c:\bhxdr.exec:\bhxdr.exe121⤵PID:2040
-
\??\c:\hljvr.exec:\hljvr.exe122⤵PID:2724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-