Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
14-10-2024 04:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e03d638ccfe2285a3481de749d7d56fb5469d6bac1a08afe249d36210b62ce44.exe
Resource
win7-20241010-en
windows7-x64
6 signatures
150 seconds
General
-
Target
e03d638ccfe2285a3481de749d7d56fb5469d6bac1a08afe249d36210b62ce44.exe
-
Size
332KB
-
MD5
57976d55a73b7c031f9e165cbfc63932
-
SHA1
455aaf237c1c048962248fd3f44b88f6d94544d1
-
SHA256
e03d638ccfe2285a3481de749d7d56fb5469d6bac1a08afe249d36210b62ce44
-
SHA512
d386da94bd1dba99efdf2c6bb4114ab9b6ccc3e0aca8b435e0ef8fdaa7ef68c211d79cae899dae4c9f153af0c822c21487bd9736340a701557177fc876cd0071
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPh/:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTv
Malware Config
Signatures
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2772-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-58-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2616-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/632-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-127-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1140-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/528-218-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2092-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/292-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-316-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2864-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-339-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2756-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-338-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2748-348-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2620-375-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1920-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1292-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1180-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-672-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1928-692-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1484-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-725-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2468-775-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/680-809-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-816-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2556-829-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1800-876-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2728-899-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2780-920-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2848 fdblv.exe 2780 vndftrd.exe 3064 nrnnvt.exe 3032 dvjjprj.exe 2804 vjbrrb.exe 1980 njlpb.exe 2616 jfnbf.exe 632 blldxxr.exe 2224 bnhvp.exe 760 flvtft.exe 3012 jlbfthb.exe 1492 vxnphh.exe 1140 rpxttr.exe 3036 xnhnvjl.exe 2404 hllfr.exe 320 ntllrbl.exe 264 hjxjtxf.exe 2160 bxprljd.exe 1184 jddvnx.exe 2132 hdnjp.exe 2444 vrbprdj.exe 528 rvjrlvj.exe 848 xfdvbj.exe 1508 pjlrph.exe 2536 dfjljv.exe 2092 pvlthh.exe 788 fpthjt.exe 908 tnpfvdd.exe 1304 ltfnnvb.exe 2104 xtrrh.exe 2300 vxvjhr.exe 1504 nptjft.exe 292 phhjrn.exe 1600 jhblvl.exe 2864 dtprdxv.exe 2912 bhtfbt.exe 2756 vnjxdnt.exe 2748 flfnfp.exe 2824 ndltp.exe 2652 bjljn.exe 2680 pdflprx.exe 2620 djrlpr.exe 2940 vxtdxhp.exe 2324 bjxrpp.exe 1920 bjdfjf.exe 1680 fpnfx.exe 2604 ljflb.exe 2080 nnllph.exe 980 rnnvlf.exe 1480 lbnbxv.exe 2892 btxvdfn.exe 2956 jxtllbx.exe 1120 tthlbx.exe 1388 jrhvr.exe 1916 ljjvj.exe 320 rbpjf.exe 520 bbdldx.exe 2168 fxnpptv.exe 2396 thbnvnp.exe 2508 nvxdttj.exe 2192 drjbhr.exe 2384 ndxvx.exe 2064 htdnbl.exe 952 dxtdxrb.exe -
resource yara_rule behavioral1/memory/2772-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1140-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1140-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/292-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-809-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-900-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttrhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjvlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndrpfnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvtfbpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blnpld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfrvjfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtntrrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfjpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxnvhrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrjvbjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrppfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnbthv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttrrvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbdbprr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndhntl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbjxfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnhvvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndjnlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpdvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbjdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvfbnfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljxxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhtjjhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxhnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttvtdfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2848 2772 e03d638ccfe2285a3481de749d7d56fb5469d6bac1a08afe249d36210b62ce44.exe 30 PID 2772 wrote to memory of 2848 2772 e03d638ccfe2285a3481de749d7d56fb5469d6bac1a08afe249d36210b62ce44.exe 30 PID 2772 wrote to memory of 2848 2772 e03d638ccfe2285a3481de749d7d56fb5469d6bac1a08afe249d36210b62ce44.exe 30 PID 2772 wrote to memory of 2848 2772 e03d638ccfe2285a3481de749d7d56fb5469d6bac1a08afe249d36210b62ce44.exe 30 PID 2848 wrote to memory of 2780 2848 fdblv.exe 31 PID 2848 wrote to memory of 2780 2848 fdblv.exe 31 PID 2848 wrote to memory of 2780 2848 fdblv.exe 31 PID 2848 wrote to memory of 2780 2848 fdblv.exe 31 PID 2780 wrote to memory of 3064 2780 vndftrd.exe 32 PID 2780 wrote to memory of 3064 2780 vndftrd.exe 32 PID 2780 wrote to memory of 3064 2780 vndftrd.exe 32 PID 2780 wrote to memory of 3064 2780 vndftrd.exe 32 PID 3064 wrote to memory of 3032 3064 nrnnvt.exe 33 PID 3064 wrote to memory of 3032 3064 nrnnvt.exe 33 PID 3064 wrote to memory of 3032 3064 nrnnvt.exe 33 PID 3064 wrote to memory of 3032 3064 nrnnvt.exe 33 PID 3032 wrote to memory of 2804 3032 dvjjprj.exe 34 PID 3032 wrote to memory of 2804 3032 dvjjprj.exe 34 PID 3032 wrote to memory of 2804 3032 dvjjprj.exe 34 PID 3032 wrote to memory of 2804 3032 dvjjprj.exe 34 PID 2804 wrote to memory of 1980 2804 vjbrrb.exe 35 PID 2804 wrote to memory of 1980 2804 vjbrrb.exe 35 PID 2804 wrote to memory of 1980 2804 vjbrrb.exe 35 PID 2804 wrote to memory of 1980 2804 vjbrrb.exe 35 PID 1980 wrote to memory of 2616 1980 njlpb.exe 36 PID 1980 wrote to memory of 2616 1980 njlpb.exe 36 PID 1980 wrote to memory of 2616 1980 njlpb.exe 36 PID 1980 wrote to memory of 2616 1980 njlpb.exe 36 PID 2616 wrote to memory of 632 2616 jfnbf.exe 37 PID 2616 wrote to memory of 632 2616 jfnbf.exe 37 PID 2616 wrote to memory of 632 2616 jfnbf.exe 37 PID 2616 wrote to memory of 632 2616 jfnbf.exe 37 PID 632 wrote to memory of 2224 632 blldxxr.exe 38 PID 632 wrote to memory of 2224 632 blldxxr.exe 38 PID 632 wrote to memory of 2224 632 blldxxr.exe 38 PID 632 wrote to memory of 2224 632 blldxxr.exe 38 PID 2224 wrote to memory of 760 2224 bnhvp.exe 39 PID 2224 wrote to memory of 760 2224 bnhvp.exe 39 PID 2224 wrote to memory of 760 2224 bnhvp.exe 39 PID 2224 wrote to memory of 760 2224 bnhvp.exe 39 PID 760 wrote to memory of 3012 760 flvtft.exe 40 PID 760 wrote to memory of 3012 760 flvtft.exe 40 PID 760 wrote to memory of 3012 760 flvtft.exe 40 PID 760 wrote to memory of 3012 760 flvtft.exe 40 PID 3012 wrote to memory of 1492 3012 jlbfthb.exe 41 PID 3012 wrote to memory of 1492 3012 jlbfthb.exe 41 PID 3012 wrote to memory of 1492 3012 jlbfthb.exe 41 PID 3012 wrote to memory of 1492 3012 jlbfthb.exe 41 PID 1492 wrote to memory of 1140 1492 vxnphh.exe 42 PID 1492 wrote to memory of 1140 1492 vxnphh.exe 42 PID 1492 wrote to memory of 1140 1492 vxnphh.exe 42 PID 1492 wrote to memory of 1140 1492 vxnphh.exe 42 PID 1140 wrote to memory of 3036 1140 rpxttr.exe 43 PID 1140 wrote to memory of 3036 1140 rpxttr.exe 43 PID 1140 wrote to memory of 3036 1140 rpxttr.exe 43 PID 1140 wrote to memory of 3036 1140 rpxttr.exe 43 PID 3036 wrote to memory of 2404 3036 xnhnvjl.exe 44 PID 3036 wrote to memory of 2404 3036 xnhnvjl.exe 44 PID 3036 wrote to memory of 2404 3036 xnhnvjl.exe 44 PID 3036 wrote to memory of 2404 3036 xnhnvjl.exe 44 PID 2404 wrote to memory of 320 2404 hllfr.exe 45 PID 2404 wrote to memory of 320 2404 hllfr.exe 45 PID 2404 wrote to memory of 320 2404 hllfr.exe 45 PID 2404 wrote to memory of 320 2404 hllfr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e03d638ccfe2285a3481de749d7d56fb5469d6bac1a08afe249d36210b62ce44.exe"C:\Users\Admin\AppData\Local\Temp\e03d638ccfe2285a3481de749d7d56fb5469d6bac1a08afe249d36210b62ce44.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\fdblv.exec:\fdblv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\vndftrd.exec:\vndftrd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\nrnnvt.exec:\nrnnvt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\dvjjprj.exec:\dvjjprj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\vjbrrb.exec:\vjbrrb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\njlpb.exec:\njlpb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\jfnbf.exec:\jfnbf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\blldxxr.exec:\blldxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\bnhvp.exec:\bnhvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\flvtft.exec:\flvtft.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\jlbfthb.exec:\jlbfthb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\vxnphh.exec:\vxnphh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\rpxttr.exec:\rpxttr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\xnhnvjl.exec:\xnhnvjl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\hllfr.exec:\hllfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\ntllrbl.exec:\ntllrbl.exe17⤵
- Executes dropped EXE
PID:320 -
\??\c:\hjxjtxf.exec:\hjxjtxf.exe18⤵
- Executes dropped EXE
PID:264 -
\??\c:\bxprljd.exec:\bxprljd.exe19⤵
- Executes dropped EXE
PID:2160 -
\??\c:\jddvnx.exec:\jddvnx.exe20⤵
- Executes dropped EXE
PID:1184 -
\??\c:\hdnjp.exec:\hdnjp.exe21⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vrbprdj.exec:\vrbprdj.exe22⤵
- Executes dropped EXE
PID:2444 -
\??\c:\rvjrlvj.exec:\rvjrlvj.exe23⤵
- Executes dropped EXE
PID:528 -
\??\c:\xfdvbj.exec:\xfdvbj.exe24⤵
- Executes dropped EXE
PID:848 -
\??\c:\pjlrph.exec:\pjlrph.exe25⤵
- Executes dropped EXE
PID:1508 -
\??\c:\dfjljv.exec:\dfjljv.exe26⤵
- Executes dropped EXE
PID:2536 -
\??\c:\pvlthh.exec:\pvlthh.exe27⤵
- Executes dropped EXE
PID:2092 -
\??\c:\fpthjt.exec:\fpthjt.exe28⤵
- Executes dropped EXE
PID:788 -
\??\c:\tnpfvdd.exec:\tnpfvdd.exe29⤵
- Executes dropped EXE
PID:908 -
\??\c:\ltfnnvb.exec:\ltfnnvb.exe30⤵
- Executes dropped EXE
PID:1304 -
\??\c:\xtrrh.exec:\xtrrh.exe31⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vxvjhr.exec:\vxvjhr.exe32⤵
- Executes dropped EXE
PID:2300 -
\??\c:\nptjft.exec:\nptjft.exe33⤵
- Executes dropped EXE
PID:1504 -
\??\c:\phhjrn.exec:\phhjrn.exe34⤵
- Executes dropped EXE
PID:292 -
\??\c:\jhblvl.exec:\jhblvl.exe35⤵
- Executes dropped EXE
PID:1600 -
\??\c:\dtprdxv.exec:\dtprdxv.exe36⤵
- Executes dropped EXE
PID:2864 -
\??\c:\bhtfbt.exec:\bhtfbt.exe37⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vnjxdnt.exec:\vnjxdnt.exe38⤵
- Executes dropped EXE
PID:2756 -
\??\c:\flfnfp.exec:\flfnfp.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\ndltp.exec:\ndltp.exe40⤵
- Executes dropped EXE
PID:2824 -
\??\c:\bjljn.exec:\bjljn.exe41⤵
- Executes dropped EXE
PID:2652 -
\??\c:\pdflprx.exec:\pdflprx.exe42⤵
- Executes dropped EXE
PID:2680 -
\??\c:\djrlpr.exec:\djrlpr.exe43⤵
- Executes dropped EXE
PID:2620 -
\??\c:\vxtdxhp.exec:\vxtdxhp.exe44⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bjxrpp.exec:\bjxrpp.exe45⤵
- Executes dropped EXE
PID:2324 -
\??\c:\bjdfjf.exec:\bjdfjf.exe46⤵
- Executes dropped EXE
PID:1920 -
\??\c:\fpnfx.exec:\fpnfx.exe47⤵
- Executes dropped EXE
PID:1680 -
\??\c:\ljflb.exec:\ljflb.exe48⤵
- Executes dropped EXE
PID:2604 -
\??\c:\nnllph.exec:\nnllph.exe49⤵
- Executes dropped EXE
PID:2080 -
\??\c:\rnnvlf.exec:\rnnvlf.exe50⤵
- Executes dropped EXE
PID:980 -
\??\c:\lbnbxv.exec:\lbnbxv.exe51⤵
- Executes dropped EXE
PID:1480 -
\??\c:\btxvdfn.exec:\btxvdfn.exe52⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jxtllbx.exec:\jxtllbx.exe53⤵
- Executes dropped EXE
PID:2956 -
\??\c:\tthlbx.exec:\tthlbx.exe54⤵
- Executes dropped EXE
PID:1120 -
\??\c:\jrhvr.exec:\jrhvr.exe55⤵
- Executes dropped EXE
PID:1388 -
\??\c:\ljjvj.exec:\ljjvj.exe56⤵
- Executes dropped EXE
PID:1916 -
\??\c:\rbpjf.exec:\rbpjf.exe57⤵
- Executes dropped EXE
PID:320 -
\??\c:\bbdldx.exec:\bbdldx.exe58⤵
- Executes dropped EXE
PID:520 -
\??\c:\fxnpptv.exec:\fxnpptv.exe59⤵
- Executes dropped EXE
PID:2168 -
\??\c:\thbnvnp.exec:\thbnvnp.exe60⤵
- Executes dropped EXE
PID:2396 -
\??\c:\nvxdttj.exec:\nvxdttj.exe61⤵
- Executes dropped EXE
PID:2508 -
\??\c:\drjbhr.exec:\drjbhr.exe62⤵
- Executes dropped EXE
PID:2192 -
\??\c:\ndxvx.exec:\ndxvx.exe63⤵
- Executes dropped EXE
PID:2384 -
\??\c:\htdnbl.exec:\htdnbl.exe64⤵
- Executes dropped EXE
PID:2064 -
\??\c:\dxtdxrb.exec:\dxtdxrb.exe65⤵
- Executes dropped EXE
PID:952 -
\??\c:\dphlj.exec:\dphlj.exe66⤵PID:1868
-
\??\c:\jxdxhn.exec:\jxdxhn.exe67⤵PID:1812
-
\??\c:\xtntrrj.exec:\xtntrrj.exe68⤵
- System Location Discovery: System Language Discovery
PID:648 -
\??\c:\prjvf.exec:\prjvf.exe69⤵PID:1292
-
\??\c:\fvdlj.exec:\fvdlj.exe70⤵PID:640
-
\??\c:\xbvfx.exec:\xbvfx.exe71⤵PID:564
-
\??\c:\hxtrp.exec:\hxtrp.exe72⤵PID:1804
-
\??\c:\ndxbd.exec:\ndxbd.exe73⤵PID:2308
-
\??\c:\jblpllj.exec:\jblpllj.exe74⤵PID:2720
-
\??\c:\vlvxt.exec:\vlvxt.exe75⤵PID:2104
-
\??\c:\frhdr.exec:\frhdr.exe76⤵PID:1856
-
\??\c:\jhxbdh.exec:\jhxbdh.exe77⤵PID:2304
-
\??\c:\nntvj.exec:\nntvj.exe78⤵PID:2776
-
\??\c:\hffvr.exec:\hffvr.exe79⤵PID:1596
-
\??\c:\xdfvv.exec:\xdfvv.exe80⤵PID:2848
-
\??\c:\nvrhvtf.exec:\nvrhvtf.exe81⤵PID:2764
-
\??\c:\fdfjrj.exec:\fdfjrj.exe82⤵PID:2912
-
\??\c:\drjbn.exec:\drjbn.exe83⤵PID:2756
-
\??\c:\xppvpl.exec:\xppvpl.exe84⤵PID:2744
-
\??\c:\xprdp.exec:\xprdp.exe85⤵PID:2648
-
\??\c:\tvfxp.exec:\tvfxp.exe86⤵PID:2708
-
\??\c:\bvplldb.exec:\bvplldb.exe87⤵PID:2580
-
\??\c:\jbvxxph.exec:\jbvxxph.exe88⤵PID:1980
-
\??\c:\dnnpxvl.exec:\dnnpxvl.exe89⤵PID:1180
-
\??\c:\jnhbhr.exec:\jnhbhr.exe90⤵PID:2020
-
\??\c:\vnrrtv.exec:\vnrrtv.exe91⤵PID:2820
-
\??\c:\ntldfpr.exec:\ntldfpr.exe92⤵PID:1928
-
\??\c:\nnnpj.exec:\nnnpj.exe93⤵PID:1236
-
\??\c:\pffbtf.exec:\pffbtf.exe94⤵PID:592
-
\??\c:\rbpjb.exec:\rbpjb.exe95⤵PID:1484
-
\??\c:\ttthhf.exec:\ttthhf.exe96⤵PID:1492
-
\??\c:\tlpdtj.exec:\tlpdtj.exe97⤵PID:2920
-
\??\c:\jfljdvt.exec:\jfljdvt.exe98⤵PID:2964
-
\??\c:\fvtbp.exec:\fvtbp.exe99⤵PID:2284
-
\??\c:\ltrxjfh.exec:\ltrxjfh.exe100⤵PID:1776
-
\??\c:\rdfdr.exec:\rdfdr.exe101⤵PID:2136
-
\??\c:\xhhbv.exec:\xhhbv.exe102⤵PID:1904
-
\??\c:\frtjh.exec:\frtjh.exe103⤵PID:2156
-
\??\c:\fbbpnr.exec:\fbbpnr.exe104⤵PID:1300
-
\??\c:\jrltr.exec:\jrltr.exe105⤵PID:2468
-
\??\c:\tjnpp.exec:\tjnpp.exe106⤵PID:2072
-
\??\c:\lxvth.exec:\lxvth.exe107⤵PID:956
-
\??\c:\fvbjrr.exec:\fvbjrr.exe108⤵PID:2532
-
\??\c:\jrbtt.exec:\jrbtt.exe109⤵PID:528
-
\??\c:\pddpbvf.exec:\pddpbvf.exe110⤵PID:680
-
\??\c:\tffhtr.exec:\tffhtr.exe111⤵PID:536
-
\??\c:\ftpbh.exec:\ftpbh.exe112⤵PID:1844
-
\??\c:\nfpllv.exec:\nfpllv.exe113⤵PID:2556
-
\??\c:\fftfn.exec:\fftfn.exe114⤵PID:1768
-
\??\c:\xvjxvjb.exec:\xvjxvjb.exe115⤵PID:1780
-
\??\c:\vhpjnd.exec:\vhpjnd.exe116⤵PID:788
-
\??\c:\tnhjlj.exec:\tnhjlj.exe117⤵PID:1800
-
\??\c:\hbrdxj.exec:\hbrdxj.exe118⤵PID:1304
-
\??\c:\fhvbht.exec:\fhvbht.exe119⤵PID:1848
-
\??\c:\tlfnd.exec:\tlfnd.exe120⤵PID:1816
-
\??\c:\ldbxv.exec:\ldbxv.exe121⤵PID:2728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-