Analysis
-
max time kernel
120s -
max time network
15s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 03:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8c35093c4c1da7b935eadc924e7d4fd2914131774ba6d2fa0e71aeaee65bc51aN.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
8c35093c4c1da7b935eadc924e7d4fd2914131774ba6d2fa0e71aeaee65bc51aN.exe
-
Size
452KB
-
MD5
f2b2cef7fffe44e4b96bc20883a0c280
-
SHA1
26c24cb4e944023c1dd676813df174a9c4f1a502
-
SHA256
8c35093c4c1da7b935eadc924e7d4fd2914131774ba6d2fa0e71aeaee65bc51a
-
SHA512
2ee4578ca489305f25298d570fe84b76ffe2393cac60de0bd341674dbfde050dea41a9a8fe539ac488422ed0003e1a5276ad450189589028f8704445937e4690
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeD:q7Tc2NYHUrAwfMp3CDD
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2876-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/516-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/428-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-125-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2856-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/540-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-173-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2220-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-294-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1288-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-336-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2900-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-386-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2296-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1216-492-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2296-499-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/336-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-527-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2060-526-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1708-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-571-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2528-579-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2832-597-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2764-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-682-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/752-689-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1564-697-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2236-737-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2976 rtbdp.exe 2704 rxfnd.exe 2900 lfpvtnf.exe 2744 lprph.exe 2580 vbbnthj.exe 2556 bftlv.exe 516 jptxb.exe 2120 nfhtx.exe 1832 dbvphxx.exe 428 pxjhpf.exe 836 pjvnt.exe 2156 txllnlt.exe 2856 pnfpvh.exe 1488 nnhvvr.exe 1376 phpbl.exe 2076 bndfbln.exe 540 flrdl.exe 2296 tvpxt.exe 2220 bxvbv.exe 1044 nbvlr.exe 2060 pvpdlv.exe 2924 hbpbd.exe 832 hrdhxlh.exe 756 dpfxp.exe 1968 phxdbhr.exe 1344 dhlpr.exe 2996 vnbvnp.exe 2284 bdvpjtv.exe 2036 xjhbpr.exe 1872 dpnpnj.exe 2160 xbxhpr.exe 1972 vllljvl.exe 1620 vhbhxt.exe 1288 nxhppd.exe 2088 prjbl.exe 2684 vrhbj.exe 1580 pdpntj.exe 2772 hxfrlv.exe 2316 lthptlt.exe 2900 vxhnlrn.exe 1916 rjbvd.exe 2320 tprbpvx.exe 2576 rthnthv.exe 2556 nxdxphp.exe 2628 hjlrrnf.exe 2536 jntpbfv.exe 2540 ltpvjn.exe 1744 llnvtb.exe 2736 hvjvvft.exe 2112 txhxhtv.exe 2356 tndjfhj.exe 2544 rdhhtvl.exe 2856 bdfvxjt.exe 2104 xhvpld.exe 1376 jdhrhv.exe 1932 rfxdx.exe 1368 rdffdt.exe 1756 rhdph.exe 2296 hfphdxd.exe 2248 vhdjv.exe 1216 thjtrjl.exe 1372 ppxxv.exe 2060 flpltr.exe 1740 vvntvb.exe -
resource yara_rule behavioral1/memory/2876-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/516-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/428-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-114-0x00000000001C0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/2856-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-597-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2764-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-815-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-860-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drnnxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtrxfjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdhrhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftnxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfxnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnlxhvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dntxprf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhfrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txbdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txpxdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptfrxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhrprf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhbdhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnlhdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfpdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtthxbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfrtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhvxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvtrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjxtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfdlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpfdnvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnrfprt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtrxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldxdnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpprh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvhhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlrjtrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lprph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtrtln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtjtbhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvlhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrpdrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldpdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndxnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjxhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfndlln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjtrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btvlt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2976 2876 8c35093c4c1da7b935eadc924e7d4fd2914131774ba6d2fa0e71aeaee65bc51aN.exe 30 PID 2876 wrote to memory of 2976 2876 8c35093c4c1da7b935eadc924e7d4fd2914131774ba6d2fa0e71aeaee65bc51aN.exe 30 PID 2876 wrote to memory of 2976 2876 8c35093c4c1da7b935eadc924e7d4fd2914131774ba6d2fa0e71aeaee65bc51aN.exe 30 PID 2876 wrote to memory of 2976 2876 8c35093c4c1da7b935eadc924e7d4fd2914131774ba6d2fa0e71aeaee65bc51aN.exe 30 PID 2976 wrote to memory of 2704 2976 rtbdp.exe 31 PID 2976 wrote to memory of 2704 2976 rtbdp.exe 31 PID 2976 wrote to memory of 2704 2976 rtbdp.exe 31 PID 2976 wrote to memory of 2704 2976 rtbdp.exe 31 PID 2704 wrote to memory of 2900 2704 rxfnd.exe 32 PID 2704 wrote to memory of 2900 2704 rxfnd.exe 32 PID 2704 wrote to memory of 2900 2704 rxfnd.exe 32 PID 2704 wrote to memory of 2900 2704 rxfnd.exe 32 PID 2900 wrote to memory of 2744 2900 lfpvtnf.exe 33 PID 2900 wrote to memory of 2744 2900 lfpvtnf.exe 33 PID 2900 wrote to memory of 2744 2900 lfpvtnf.exe 33 PID 2900 wrote to memory of 2744 2900 lfpvtnf.exe 33 PID 2744 wrote to memory of 2580 2744 lprph.exe 34 PID 2744 wrote to memory of 2580 2744 lprph.exe 34 PID 2744 wrote to memory of 2580 2744 lprph.exe 34 PID 2744 wrote to memory of 2580 2744 lprph.exe 34 PID 2580 wrote to memory of 2556 2580 vbbnthj.exe 35 PID 2580 wrote to memory of 2556 2580 vbbnthj.exe 35 PID 2580 wrote to memory of 2556 2580 vbbnthj.exe 35 PID 2580 wrote to memory of 2556 2580 vbbnthj.exe 35 PID 2556 wrote to memory of 516 2556 bftlv.exe 36 PID 2556 wrote to memory of 516 2556 bftlv.exe 36 PID 2556 wrote to memory of 516 2556 bftlv.exe 36 PID 2556 wrote to memory of 516 2556 bftlv.exe 36 PID 516 wrote to memory of 2120 516 jptxb.exe 37 PID 516 wrote to memory of 2120 516 jptxb.exe 37 PID 516 wrote to memory of 2120 516 jptxb.exe 37 PID 516 wrote to memory of 2120 516 jptxb.exe 37 PID 2120 wrote to memory of 1832 2120 nfhtx.exe 38 PID 2120 wrote to memory of 1832 2120 nfhtx.exe 38 PID 2120 wrote to memory of 1832 2120 nfhtx.exe 38 PID 2120 wrote to memory of 1832 2120 nfhtx.exe 38 PID 1832 wrote to memory of 428 1832 dbvphxx.exe 39 PID 1832 wrote to memory of 428 1832 dbvphxx.exe 39 PID 1832 wrote to memory of 428 1832 dbvphxx.exe 39 PID 1832 wrote to memory of 428 1832 dbvphxx.exe 39 PID 428 wrote to memory of 836 428 pxjhpf.exe 40 PID 428 wrote to memory of 836 428 pxjhpf.exe 40 PID 428 wrote to memory of 836 428 pxjhpf.exe 40 PID 428 wrote to memory of 836 428 pxjhpf.exe 40 PID 836 wrote to memory of 2156 836 pjvnt.exe 41 PID 836 wrote to memory of 2156 836 pjvnt.exe 41 PID 836 wrote to memory of 2156 836 pjvnt.exe 41 PID 836 wrote to memory of 2156 836 pjvnt.exe 41 PID 2156 wrote to memory of 2856 2156 txllnlt.exe 42 PID 2156 wrote to memory of 2856 2156 txllnlt.exe 42 PID 2156 wrote to memory of 2856 2156 txllnlt.exe 42 PID 2156 wrote to memory of 2856 2156 txllnlt.exe 42 PID 2856 wrote to memory of 1488 2856 pnfpvh.exe 43 PID 2856 wrote to memory of 1488 2856 pnfpvh.exe 43 PID 2856 wrote to memory of 1488 2856 pnfpvh.exe 43 PID 2856 wrote to memory of 1488 2856 pnfpvh.exe 43 PID 1488 wrote to memory of 1376 1488 nnhvvr.exe 44 PID 1488 wrote to memory of 1376 1488 nnhvvr.exe 44 PID 1488 wrote to memory of 1376 1488 nnhvvr.exe 44 PID 1488 wrote to memory of 1376 1488 nnhvvr.exe 44 PID 1376 wrote to memory of 2076 1376 phpbl.exe 45 PID 1376 wrote to memory of 2076 1376 phpbl.exe 45 PID 1376 wrote to memory of 2076 1376 phpbl.exe 45 PID 1376 wrote to memory of 2076 1376 phpbl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c35093c4c1da7b935eadc924e7d4fd2914131774ba6d2fa0e71aeaee65bc51aN.exe"C:\Users\Admin\AppData\Local\Temp\8c35093c4c1da7b935eadc924e7d4fd2914131774ba6d2fa0e71aeaee65bc51aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\rtbdp.exec:\rtbdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\rxfnd.exec:\rxfnd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\lfpvtnf.exec:\lfpvtnf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\lprph.exec:\lprph.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\vbbnthj.exec:\vbbnthj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\bftlv.exec:\bftlv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\jptxb.exec:\jptxb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\nfhtx.exec:\nfhtx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\dbvphxx.exec:\dbvphxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\pxjhpf.exec:\pxjhpf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\pjvnt.exec:\pjvnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\txllnlt.exec:\txllnlt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\pnfpvh.exec:\pnfpvh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\nnhvvr.exec:\nnhvvr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\phpbl.exec:\phpbl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\bndfbln.exec:\bndfbln.exe17⤵
- Executes dropped EXE
PID:2076 -
\??\c:\flrdl.exec:\flrdl.exe18⤵
- Executes dropped EXE
PID:540 -
\??\c:\tvpxt.exec:\tvpxt.exe19⤵
- Executes dropped EXE
PID:2296 -
\??\c:\bxvbv.exec:\bxvbv.exe20⤵
- Executes dropped EXE
PID:2220 -
\??\c:\nbvlr.exec:\nbvlr.exe21⤵
- Executes dropped EXE
PID:1044 -
\??\c:\pvpdlv.exec:\pvpdlv.exe22⤵
- Executes dropped EXE
PID:2060 -
\??\c:\hbpbd.exec:\hbpbd.exe23⤵
- Executes dropped EXE
PID:2924 -
\??\c:\hrdhxlh.exec:\hrdhxlh.exe24⤵
- Executes dropped EXE
PID:832 -
\??\c:\dpfxp.exec:\dpfxp.exe25⤵
- Executes dropped EXE
PID:756 -
\??\c:\phxdbhr.exec:\phxdbhr.exe26⤵
- Executes dropped EXE
PID:1968 -
\??\c:\dhlpr.exec:\dhlpr.exe27⤵
- Executes dropped EXE
PID:1344 -
\??\c:\vnbvnp.exec:\vnbvnp.exe28⤵
- Executes dropped EXE
PID:2996 -
\??\c:\bdvpjtv.exec:\bdvpjtv.exe29⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xjhbpr.exec:\xjhbpr.exe30⤵
- Executes dropped EXE
PID:2036 -
\??\c:\dpnpnj.exec:\dpnpnj.exe31⤵
- Executes dropped EXE
PID:1872 -
\??\c:\xbxhpr.exec:\xbxhpr.exe32⤵
- Executes dropped EXE
PID:2160 -
\??\c:\vllljvl.exec:\vllljvl.exe33⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vhbhxt.exec:\vhbhxt.exe34⤵
- Executes dropped EXE
PID:1620 -
\??\c:\nxhppd.exec:\nxhppd.exe35⤵
- Executes dropped EXE
PID:1288 -
\??\c:\prjbl.exec:\prjbl.exe36⤵
- Executes dropped EXE
PID:2088 -
\??\c:\vrhbj.exec:\vrhbj.exe37⤵
- Executes dropped EXE
PID:2684 -
\??\c:\pdpntj.exec:\pdpntj.exe38⤵
- Executes dropped EXE
PID:1580 -
\??\c:\hxfrlv.exec:\hxfrlv.exe39⤵
- Executes dropped EXE
PID:2772 -
\??\c:\lthptlt.exec:\lthptlt.exe40⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vxhnlrn.exec:\vxhnlrn.exe41⤵
- Executes dropped EXE
PID:2900 -
\??\c:\rjbvd.exec:\rjbvd.exe42⤵
- Executes dropped EXE
PID:1916 -
\??\c:\tprbpvx.exec:\tprbpvx.exe43⤵
- Executes dropped EXE
PID:2320 -
\??\c:\rthnthv.exec:\rthnthv.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\nxdxphp.exec:\nxdxphp.exe45⤵
- Executes dropped EXE
PID:2556 -
\??\c:\hjlrrnf.exec:\hjlrrnf.exe46⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jntpbfv.exec:\jntpbfv.exe47⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ltpvjn.exec:\ltpvjn.exe48⤵
- Executes dropped EXE
PID:2540 -
\??\c:\llnvtb.exec:\llnvtb.exe49⤵
- Executes dropped EXE
PID:1744 -
\??\c:\hvjvvft.exec:\hvjvvft.exe50⤵
- Executes dropped EXE
PID:2736 -
\??\c:\txhxhtv.exec:\txhxhtv.exe51⤵
- Executes dropped EXE
PID:2112 -
\??\c:\tndjfhj.exec:\tndjfhj.exe52⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rdhhtvl.exec:\rdhhtvl.exe53⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bdfvxjt.exec:\bdfvxjt.exe54⤵
- Executes dropped EXE
PID:2856 -
\??\c:\xhvpld.exec:\xhvpld.exe55⤵
- Executes dropped EXE
PID:2104 -
\??\c:\jdhrhv.exec:\jdhrhv.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1376 -
\??\c:\rfxdx.exec:\rfxdx.exe57⤵
- Executes dropped EXE
PID:1932 -
\??\c:\rdffdt.exec:\rdffdt.exe58⤵
- Executes dropped EXE
PID:1368 -
\??\c:\rhdph.exec:\rhdph.exe59⤵
- Executes dropped EXE
PID:1756 -
\??\c:\hfphdxd.exec:\hfphdxd.exe60⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vhdjv.exec:\vhdjv.exe61⤵
- Executes dropped EXE
PID:2248 -
\??\c:\thjtrjl.exec:\thjtrjl.exe62⤵
- Executes dropped EXE
PID:1216 -
\??\c:\ppxxv.exec:\ppxxv.exe63⤵
- Executes dropped EXE
PID:1372 -
\??\c:\flpltr.exec:\flpltr.exe64⤵
- Executes dropped EXE
PID:2060 -
\??\c:\vvntvb.exec:\vvntvb.exe65⤵
- Executes dropped EXE
PID:1740 -
\??\c:\pbhbnrp.exec:\pbhbnrp.exe66⤵PID:336
-
\??\c:\thtrtln.exec:\thtrtln.exe67⤵
- System Location Discovery: System Language Discovery
PID:2440 -
\??\c:\nprppdf.exec:\nprppdf.exe68⤵PID:2304
-
\??\c:\pllhhpn.exec:\pllhhpn.exe69⤵PID:1476
-
\??\c:\pbtvp.exec:\pbtvp.exe70⤵PID:1344
-
\??\c:\dhjpxpf.exec:\dhjpxpf.exe71⤵PID:1936
-
\??\c:\brblp.exec:\brblp.exe72⤵PID:1708
-
\??\c:\phdrlxr.exec:\phdrlxr.exe73⤵PID:2204
-
\??\c:\thnrxh.exec:\thnrxh.exe74⤵PID:2388
-
\??\c:\tdnpp.exec:\tdnpp.exe75⤵PID:2528
-
\??\c:\nxrtvhx.exec:\nxrtvhx.exe76⤵PID:2364
-
\??\c:\jhvhdv.exec:\jhvhdv.exe77⤵PID:1988
-
\??\c:\hbxtd.exec:\hbxtd.exe78⤵PID:2832
-
\??\c:\hdddxhh.exec:\hdddxhh.exe79⤵PID:1808
-
\??\c:\nxlrj.exec:\nxlrj.exe80⤵PID:2648
-
\??\c:\nrppd.exec:\nrppd.exe81⤵PID:2764
-
\??\c:\jjnjxfv.exec:\jjnjxfv.exe82⤵PID:1624
-
\??\c:\trtnhbx.exec:\trtnhbx.exe83⤵PID:2664
-
\??\c:\rtthxbx.exec:\rtthxbx.exe84⤵
- System Location Discovery: System Language Discovery
PID:2672 -
\??\c:\bxlnv.exec:\bxlnv.exe85⤵PID:2244
-
\??\c:\vhnrnfv.exec:\vhnrnfv.exe86⤵PID:2788
-
\??\c:\vhnxlj.exec:\vhnxlj.exe87⤵PID:2572
-
\??\c:\pdtxhnv.exec:\pdtxhnv.exe88⤵PID:2600
-
\??\c:\fvvnj.exec:\fvvnj.exe89⤵PID:2956
-
\??\c:\jrpbxv.exec:\jrpbxv.exe90⤵PID:2960
-
\??\c:\tjjpjp.exec:\tjjpjp.exe91⤵PID:752
-
\??\c:\vrprf.exec:\vrprf.exe92⤵PID:1564
-
\??\c:\jlrrht.exec:\jlrrht.exe93⤵PID:1244
-
\??\c:\ljbrfn.exec:\ljbrfn.exe94⤵PID:2736
-
\??\c:\tfnhvh.exec:\tfnhvh.exe95⤵PID:836
-
\??\c:\rvnht.exec:\rvnht.exe96⤵PID:2156
-
\??\c:\hvvdtrx.exec:\hvvdtrx.exe97⤵PID:548
-
\??\c:\xjpnrvf.exec:\xjpnrvf.exe98⤵PID:2236
-
\??\c:\tpjvnfh.exec:\tpjvnfh.exe99⤵PID:2468
-
\??\c:\frfppjh.exec:\frfppjh.exe100⤵PID:1376
-
\??\c:\vplvnh.exec:\vplvnh.exe101⤵PID:1932
-
\??\c:\hrfnjht.exec:\hrfnjht.exe102⤵PID:1696
-
\??\c:\hjnhb.exec:\hjnhb.exe103⤵PID:1756
-
\??\c:\dhljrv.exec:\dhljrv.exe104⤵PID:2176
-
\??\c:\nxtfj.exec:\nxtfj.exe105⤵PID:1100
-
\??\c:\ttljnpl.exec:\ttljnpl.exe106⤵PID:3060
-
\??\c:\xprdr.exec:\xprdr.exe107⤵PID:3036
-
\??\c:\vlrnv.exec:\vlrnv.exe108⤵PID:1628
-
\??\c:\hnhvdpd.exec:\hnhvdpd.exe109⤵PID:2052
-
\??\c:\dpjpprh.exec:\dpjpprh.exe110⤵
- System Location Discovery: System Language Discovery
PID:1084 -
\??\c:\fxpxt.exec:\fxpxt.exe111⤵PID:1036
-
\??\c:\plxln.exec:\plxln.exe112⤵PID:1680
-
\??\c:\lxvfrx.exec:\lxvfrx.exe113⤵PID:1460
-
\??\c:\rlpjjl.exec:\rlpjjl.exe114⤵PID:2996
-
\??\c:\dlhdnn.exec:\dlhdnn.exe115⤵PID:1764
-
\??\c:\fpbfjrt.exec:\fpbfjrt.exe116⤵PID:1020
-
\??\c:\xvvfx.exec:\xvvfx.exe117⤵PID:2124
-
\??\c:\ldfbt.exec:\ldfbt.exe118⤵PID:564
-
\??\c:\xvjbfx.exec:\xvjbfx.exe119⤵PID:2928
-
\??\c:\pxpbv.exec:\pxpbv.exe120⤵PID:2160
-
\??\c:\hthbnx.exec:\hthbnx.exe121⤵PID:2212
-
\??\c:\jbxphd.exec:\jbxphd.exe122⤵PID:2288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-