Analysis
-
max time kernel
121s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
30-10-2024 15:08
Behavioral task
behavioral1
Sample
e5625c489c1e0bf709ed0520213100249eae350169b291faf8d1554b0f0e2a6fN.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
120 seconds
General
-
Target
e5625c489c1e0bf709ed0520213100249eae350169b291faf8d1554b0f0e2a6fN.exe
-
Size
3.7MB
-
MD5
e43ed5e8cbf3fc1c2be1cfd902a42610
-
SHA1
3c8127f9e677b7a290948b1710d185969959b493
-
SHA256
e5625c489c1e0bf709ed0520213100249eae350169b291faf8d1554b0f0e2a6f
-
SHA512
85196882da91d9904abd981761fe10ab13ad3cb0c15e452dad0fcee6e5b59b693139714dcc4dc8b7caf4583a5959742176c91b1447f5e15258f7f30702baff59
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98g:U6XLq/qPPslzKx/dJg1ErmNj
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2772-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2144-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2152-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3000-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1676-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/520-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1348-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1560-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1560-232-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2076-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1540-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1464-551-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-558-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-630-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-629-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1976-637-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1676-645-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-657-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/552-815-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-842-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/904-1032-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1540-1070-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/560-1167-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2412-1185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 2816 dfxnbfj.exe 2824 vhbfhrh.exe 2144 ttbnjv.exe 2848 dpbvjfx.exe 2660 jbttnr.exe 2152 fxprnp.exe 2196 lhrnf.exe 3000 jhvxrhn.exe 1676 htndt.exe 2184 vnjftb.exe 3016 bxvdh.exe 2720 bppplv.exe 2956 dxvhp.exe 2528 xfbjb.exe 2292 vttfjh.exe 588 dbphf.exe 520 vxrrhpx.exe 2056 bxnptjb.exe 2504 rfbhbrh.exe 2084 rxtbhj.exe 1612 xttjbf.exe 1348 dvrrhtl.exe 2024 vjlnn.exe 936 tjnhld.exe 1560 lrhjfbf.exe 2076 ldxhhln.exe 1740 jhhbxdj.exe 1508 tnvjr.exe 2016 vrbflxn.exe 848 ltrbtlr.exe 2556 bvxpl.exe 1700 rtftnhr.exe 1568 xxlpdvr.exe 2772 jvrrphp.exe 2888 xtprd.exe 2696 jnlvrd.exe 2684 bvxxrp.exe 2716 xjjdxhn.exe 2724 bjvdptv.exe 636 pdrvh.exe 1932 ppbdx.exe 1056 bpblpp.exe 3012 bhnpl.exe 2276 jhvllb.exe 2204 bnplx.exe 1988 lvnpr.exe 2952 xpbdfv.exe 2944 xbbdn.exe 2956 jtfdxl.exe 2304 bdfhrjj.exe 2760 vfnrbr.exe 2000 pxnlfln.exe 932 tlllx.exe 2488 bpjhrtj.exe 2248 rxftld.exe 1804 ftpvrxr.exe 2112 hhhbfbd.exe 2312 tflxvbh.exe 2084 fdxpnfv.exe 2564 xbjnf.exe 2552 rtjvn.exe 1076 jbvpfn.exe 1964 lnffptx.exe 1552 lnjtpj.exe -
resource yara_rule behavioral1/memory/2772-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000012266-7.dat upx behavioral1/memory/2816-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2772-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000195c6-16.dat upx behavioral1/memory/2816-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001960c-30.dat upx behavioral1/memory/2144-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x002a0000000195bd-38.dat upx behavioral1/memory/2848-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019643-46.dat upx behavioral1/files/0x000600000001975a-56.dat upx behavioral1/memory/2660-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2660-55-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2152-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000197fd-67.dat upx behavioral1/files/0x000600000001a03c-77.dat upx behavioral1/memory/3000-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a480-85.dat upx behavioral1/memory/3000-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1676-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a482-94.dat upx behavioral1/memory/2184-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a484-105.dat upx behavioral1/files/0x000500000001a486-114.dat upx behavioral1/memory/3000-113-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001a488-123.dat upx behavioral1/memory/2720-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2528-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a48a-131.dat upx behavioral1/files/0x000500000001a48d-141.dat upx behavioral1/memory/2528-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a48f-149.dat upx behavioral1/memory/2292-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/520-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a491-158.dat upx behavioral1/files/0x000500000001a493-167.dat upx behavioral1/memory/2056-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a499-177.dat upx behavioral1/files/0x000500000001a49a-184.dat upx behavioral1/memory/1612-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a49e-193.dat upx behavioral1/files/0x000500000001a49f-201.dat upx behavioral1/memory/1348-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4a1-211.dat upx behavioral1/memory/2024-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4a2-219.dat upx behavioral1/memory/1560-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4a9-228.dat upx behavioral1/files/0x000500000001a4ab-237.dat upx behavioral1/files/0x000500000001a4ac-246.dat upx behavioral1/memory/2076-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4ad-255.dat upx behavioral1/files/0x000500000001a4b4-263.dat upx behavioral1/files/0x000500000001a4ba-271.dat upx behavioral1/files/0x000500000001a4bf-279.dat upx behavioral1/memory/2556-280-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1700-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4ff-288.dat upx behavioral1/memory/2772-302-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-309-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2696-322-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2716-335-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnrnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thpjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnplx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbjnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnbhjbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbtbtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxnlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhrhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfhlnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbfbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjhpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnxxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blfbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xphbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtxhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljddtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjxhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tflxvbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxhlrtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdxhhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvjxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfjnfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trlrldh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxvdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnfpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbpfrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxbfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnltp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pllrhfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtfjrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhxjtfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tltlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtbbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppbjnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prvhfdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvrxrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftpvrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trlbpnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbrjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvlxjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpxbbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlthr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvfbpxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxftld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prfphrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvbhjtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpbjrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvljd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxjpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhthr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnllpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjlbrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhvllb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhjdpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpxbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfxvnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjrjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvxpl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2816 2772 e5625c489c1e0bf709ed0520213100249eae350169b291faf8d1554b0f0e2a6fN.exe 30 PID 2772 wrote to memory of 2816 2772 e5625c489c1e0bf709ed0520213100249eae350169b291faf8d1554b0f0e2a6fN.exe 30 PID 2772 wrote to memory of 2816 2772 e5625c489c1e0bf709ed0520213100249eae350169b291faf8d1554b0f0e2a6fN.exe 30 PID 2772 wrote to memory of 2816 2772 e5625c489c1e0bf709ed0520213100249eae350169b291faf8d1554b0f0e2a6fN.exe 30 PID 2816 wrote to memory of 2824 2816 dfxnbfj.exe 31 PID 2816 wrote to memory of 2824 2816 dfxnbfj.exe 31 PID 2816 wrote to memory of 2824 2816 dfxnbfj.exe 31 PID 2816 wrote to memory of 2824 2816 dfxnbfj.exe 31 PID 2824 wrote to memory of 2144 2824 vhbfhrh.exe 32 PID 2824 wrote to memory of 2144 2824 vhbfhrh.exe 32 PID 2824 wrote to memory of 2144 2824 vhbfhrh.exe 32 PID 2824 wrote to memory of 2144 2824 vhbfhrh.exe 32 PID 2144 wrote to memory of 2848 2144 ttbnjv.exe 33 PID 2144 wrote to memory of 2848 2144 ttbnjv.exe 33 PID 2144 wrote to memory of 2848 2144 ttbnjv.exe 33 PID 2144 wrote to memory of 2848 2144 ttbnjv.exe 33 PID 2848 wrote to memory of 2660 2848 dpbvjfx.exe 34 PID 2848 wrote to memory of 2660 2848 dpbvjfx.exe 34 PID 2848 wrote to memory of 2660 2848 dpbvjfx.exe 34 PID 2848 wrote to memory of 2660 2848 dpbvjfx.exe 34 PID 2660 wrote to memory of 2152 2660 jbttnr.exe 35 PID 2660 wrote to memory of 2152 2660 jbttnr.exe 35 PID 2660 wrote to memory of 2152 2660 jbttnr.exe 35 PID 2660 wrote to memory of 2152 2660 jbttnr.exe 35 PID 2152 wrote to memory of 2196 2152 fxprnp.exe 36 PID 2152 wrote to memory of 2196 2152 fxprnp.exe 36 PID 2152 wrote to memory of 2196 2152 fxprnp.exe 36 PID 2152 wrote to memory of 2196 2152 fxprnp.exe 36 PID 2196 wrote to memory of 3000 2196 lhrnf.exe 37 PID 2196 wrote to memory of 3000 2196 lhrnf.exe 37 PID 2196 wrote to memory of 3000 2196 lhrnf.exe 37 PID 2196 wrote to memory of 3000 2196 lhrnf.exe 37 PID 3000 wrote to memory of 1676 3000 jhvxrhn.exe 38 PID 3000 wrote to memory of 1676 3000 jhvxrhn.exe 38 PID 3000 wrote to memory of 1676 3000 jhvxrhn.exe 38 PID 3000 wrote to memory of 1676 3000 jhvxrhn.exe 38 PID 1676 wrote to memory of 2184 1676 htndt.exe 39 PID 1676 wrote to memory of 2184 1676 htndt.exe 39 PID 1676 wrote to memory of 2184 1676 htndt.exe 39 PID 1676 wrote to memory of 2184 1676 htndt.exe 39 PID 2184 wrote to memory of 3016 2184 vnjftb.exe 40 PID 2184 wrote to memory of 3016 2184 vnjftb.exe 40 PID 2184 wrote to memory of 3016 2184 vnjftb.exe 40 PID 2184 wrote to memory of 3016 2184 vnjftb.exe 40 PID 3016 wrote to memory of 2720 3016 bxvdh.exe 41 PID 3016 wrote to memory of 2720 3016 bxvdh.exe 41 PID 3016 wrote to memory of 2720 3016 bxvdh.exe 41 PID 3016 wrote to memory of 2720 3016 bxvdh.exe 41 PID 2720 wrote to memory of 2956 2720 bppplv.exe 78 PID 2720 wrote to memory of 2956 2720 bppplv.exe 78 PID 2720 wrote to memory of 2956 2720 bppplv.exe 78 PID 2720 wrote to memory of 2956 2720 bppplv.exe 78 PID 2956 wrote to memory of 2528 2956 dxvhp.exe 43 PID 2956 wrote to memory of 2528 2956 dxvhp.exe 43 PID 2956 wrote to memory of 2528 2956 dxvhp.exe 43 PID 2956 wrote to memory of 2528 2956 dxvhp.exe 43 PID 2528 wrote to memory of 2292 2528 xfbjb.exe 44 PID 2528 wrote to memory of 2292 2528 xfbjb.exe 44 PID 2528 wrote to memory of 2292 2528 xfbjb.exe 44 PID 2528 wrote to memory of 2292 2528 xfbjb.exe 44 PID 2292 wrote to memory of 588 2292 vttfjh.exe 45 PID 2292 wrote to memory of 588 2292 vttfjh.exe 45 PID 2292 wrote to memory of 588 2292 vttfjh.exe 45 PID 2292 wrote to memory of 588 2292 vttfjh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5625c489c1e0bf709ed0520213100249eae350169b291faf8d1554b0f0e2a6fN.exe"C:\Users\Admin\AppData\Local\Temp\e5625c489c1e0bf709ed0520213100249eae350169b291faf8d1554b0f0e2a6fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\dfxnbfj.exec:\dfxnbfj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\vhbfhrh.exec:\vhbfhrh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\ttbnjv.exec:\ttbnjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\dpbvjfx.exec:\dpbvjfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\jbttnr.exec:\jbttnr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\fxprnp.exec:\fxprnp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\lhrnf.exec:\lhrnf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\jhvxrhn.exec:\jhvxrhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\htndt.exec:\htndt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\vnjftb.exec:\vnjftb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\bxvdh.exec:\bxvdh.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\bppplv.exec:\bppplv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\dxvhp.exec:\dxvhp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\xfbjb.exec:\xfbjb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\vttfjh.exec:\vttfjh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\dbphf.exec:\dbphf.exe17⤵
- Executes dropped EXE
PID:588 -
\??\c:\vxrrhpx.exec:\vxrrhpx.exe18⤵
- Executes dropped EXE
PID:520 -
\??\c:\bxnptjb.exec:\bxnptjb.exe19⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rfbhbrh.exec:\rfbhbrh.exe20⤵
- Executes dropped EXE
PID:2504 -
\??\c:\rxtbhj.exec:\rxtbhj.exe21⤵
- Executes dropped EXE
PID:2084 -
\??\c:\xttjbf.exec:\xttjbf.exe22⤵
- Executes dropped EXE
PID:1612 -
\??\c:\dvrrhtl.exec:\dvrrhtl.exe23⤵
- Executes dropped EXE
PID:1348 -
\??\c:\vjlnn.exec:\vjlnn.exe24⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tjnhld.exec:\tjnhld.exe25⤵
- Executes dropped EXE
PID:936 -
\??\c:\lrhjfbf.exec:\lrhjfbf.exe26⤵
- Executes dropped EXE
PID:1560 -
\??\c:\ldxhhln.exec:\ldxhhln.exe27⤵
- Executes dropped EXE
PID:2076 -
\??\c:\jhhbxdj.exec:\jhhbxdj.exe28⤵
- Executes dropped EXE
PID:1740 -
\??\c:\tnvjr.exec:\tnvjr.exe29⤵
- Executes dropped EXE
PID:1508 -
\??\c:\vrbflxn.exec:\vrbflxn.exe30⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ltrbtlr.exec:\ltrbtlr.exe31⤵
- Executes dropped EXE
PID:848 -
\??\c:\bvxpl.exec:\bvxpl.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2556 -
\??\c:\rtftnhr.exec:\rtftnhr.exe33⤵
- Executes dropped EXE
PID:1700 -
\??\c:\xxlpdvr.exec:\xxlpdvr.exe34⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jvrrphp.exec:\jvrrphp.exe35⤵
- Executes dropped EXE
PID:2772 -
\??\c:\xtprd.exec:\xtprd.exe36⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jnlvrd.exec:\jnlvrd.exe37⤵
- Executes dropped EXE
PID:2696 -
\??\c:\bvxxrp.exec:\bvxxrp.exe38⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xjjdxhn.exec:\xjjdxhn.exe39⤵
- Executes dropped EXE
PID:2716 -
\??\c:\bjvdptv.exec:\bjvdptv.exe40⤵
- Executes dropped EXE
PID:2724 -
\??\c:\pdrvh.exec:\pdrvh.exe41⤵
- Executes dropped EXE
PID:636 -
\??\c:\ppbdx.exec:\ppbdx.exe42⤵
- Executes dropped EXE
PID:1932 -
\??\c:\bpblpp.exec:\bpblpp.exe43⤵
- Executes dropped EXE
PID:1056 -
\??\c:\bhnpl.exec:\bhnpl.exe44⤵
- Executes dropped EXE
PID:3012 -
\??\c:\jhvllb.exec:\jhvllb.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2276 -
\??\c:\bnplx.exec:\bnplx.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2204 -
\??\c:\lvnpr.exec:\lvnpr.exe47⤵
- Executes dropped EXE
PID:1988 -
\??\c:\xpbdfv.exec:\xpbdfv.exe48⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xbbdn.exec:\xbbdn.exe49⤵
- Executes dropped EXE
PID:2944 -
\??\c:\jtfdxl.exec:\jtfdxl.exe50⤵
- Executes dropped EXE
PID:2956 -
\??\c:\bdfhrjj.exec:\bdfhrjj.exe51⤵
- Executes dropped EXE
PID:2304 -
\??\c:\vfnrbr.exec:\vfnrbr.exe52⤵
- Executes dropped EXE
PID:2760 -
\??\c:\pxnlfln.exec:\pxnlfln.exe53⤵
- Executes dropped EXE
PID:2000 -
\??\c:\tlllx.exec:\tlllx.exe54⤵
- Executes dropped EXE
PID:932 -
\??\c:\bpjhrtj.exec:\bpjhrtj.exe55⤵
- Executes dropped EXE
PID:2488 -
\??\c:\rxftld.exec:\rxftld.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2248 -
\??\c:\ftpvrxr.exec:\ftpvrxr.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1804 -
\??\c:\hhhbfbd.exec:\hhhbfbd.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2112 -
\??\c:\tflxvbh.exec:\tflxvbh.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2312 -
\??\c:\fdxpnfv.exec:\fdxpnfv.exe60⤵
- Executes dropped EXE
PID:2084 -
\??\c:\xbjnf.exec:\xbjnf.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2564 -
\??\c:\rtjvn.exec:\rtjvn.exe62⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jbvpfn.exec:\jbvpfn.exe63⤵
- Executes dropped EXE
PID:1076 -
\??\c:\lnffptx.exec:\lnffptx.exe64⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lnjtpj.exec:\lnjtpj.exe65⤵
- Executes dropped EXE
PID:1552 -
\??\c:\hnllvtn.exec:\hnllvtn.exe66⤵PID:1540
-
\??\c:\xpltxl.exec:\xpltxl.exe67⤵PID:860
-
\??\c:\rnnvpp.exec:\rnnvpp.exe68⤵PID:1744
-
\??\c:\rnxtft.exec:\rnxtft.exe69⤵PID:568
-
\??\c:\rxvvdvd.exec:\rxvvdvd.exe70⤵PID:536
-
\??\c:\ftfdf.exec:\ftfdf.exe71⤵PID:1752
-
\??\c:\fbthxj.exec:\fbthxj.exe72⤵PID:1464
-
\??\c:\fnrrx.exec:\fnrrx.exe73⤵PID:112
-
\??\c:\hpxbv.exec:\hpxbv.exe74⤵PID:3052
-
\??\c:\pnbfv.exec:\pnbfv.exe75⤵PID:2808
-
\??\c:\tthhxrt.exec:\tthhxrt.exe76⤵PID:2928
-
\??\c:\xdtbdnb.exec:\xdtbdnb.exe77⤵PID:2896
-
\??\c:\nljjf.exec:\nljjf.exe78⤵PID:2820
-
\??\c:\rrnxvxb.exec:\rrnxvxb.exe79⤵PID:2696
-
\??\c:\xvjhr.exec:\xvjhr.exe80⤵PID:2684
-
\??\c:\bxhlrtd.exec:\bxhlrtd.exe81⤵
- System Location Discovery: System Language Discovery
PID:560 -
\??\c:\njxprh.exec:\njxprh.exe82⤵PID:2856
-
\??\c:\dhrffn.exec:\dhrffn.exe83⤵PID:784
-
\??\c:\hbhrdfr.exec:\hbhrdfr.exe84⤵PID:1100
-
\??\c:\pbhtn.exec:\pbhtn.exe85⤵PID:1976
-
\??\c:\fdtpx.exec:\fdtpx.exe86⤵PID:1676
-
\??\c:\lrfvl.exec:\lrfvl.exe87⤵PID:2616
-
\??\c:\jbjtb.exec:\jbjtb.exe88⤵PID:1728
-
\??\c:\fvhbb.exec:\fvhbb.exe89⤵
- System Location Discovery: System Language Discovery
PID:2496 -
\??\c:\prfphrd.exec:\prfphrd.exe90⤵
- System Location Discovery: System Language Discovery
PID:1872 -
\??\c:\ntvlf.exec:\ntvlf.exe91⤵PID:2944
-
\??\c:\jjhpv.exec:\jjhpv.exe92⤵
- System Location Discovery: System Language Discovery
PID:2992 -
\??\c:\vjxhx.exec:\vjxhx.exe93⤵PID:1020
-
\??\c:\bhftllr.exec:\bhftllr.exe94⤵PID:428
-
\??\c:\ththjr.exec:\ththjr.exe95⤵PID:436
-
\??\c:\pbljbjl.exec:\pbljbjl.exe96⤵PID:2640
-
\??\c:\fpxlt.exec:\fpxlt.exe97⤵PID:1708
-
\??\c:\hbfnpb.exec:\hbfnpb.exe98⤵PID:2488
-
\??\c:\fdxhhf.exec:\fdxhhf.exe99⤵
- System Location Discovery: System Language Discovery
PID:2172 -
\??\c:\rpfjjnn.exec:\rpfjjnn.exe100⤵PID:1956
-
\??\c:\vhhnt.exec:\vhhnt.exe101⤵PID:2924
-
\??\c:\fvdnxf.exec:\fvdnxf.exe102⤵PID:3044
-
\??\c:\tltntt.exec:\tltntt.exe103⤵PID:768
-
\??\c:\vfrhldt.exec:\vfrhldt.exe104⤵PID:956
-
\??\c:\hjdxbv.exec:\hjdxbv.exe105⤵PID:1348
-
\??\c:\blhfhp.exec:\blhfhp.exe106⤵PID:692
-
\??\c:\rlrfxr.exec:\rlrfxr.exe107⤵
- System Location Discovery: System Language Discovery
PID:976 -
\??\c:\nrbrtt.exec:\nrbrtt.exe108⤵PID:800
-
\??\c:\xnxxj.exec:\xnxxj.exe109⤵
- System Location Discovery: System Language Discovery
PID:2336 -
\??\c:\pffnjdd.exec:\pffnjdd.exe110⤵PID:2580
-
\??\c:\vjtltt.exec:\vjtltt.exe111⤵PID:2572
-
\??\c:\lxnxt.exec:\lxnxt.exe112⤵PID:2612
-
\??\c:\ljrjj.exec:\ljrjj.exe113⤵PID:2416
-
\??\c:\fbtvlj.exec:\fbtvlj.exe114⤵PID:552
-
\??\c:\fjvbf.exec:\fjvbf.exe115⤵PID:616
-
\??\c:\tnnhhlh.exec:\tnnhhlh.exe116⤵PID:2104
-
\??\c:\drdbj.exec:\drdbj.exe117⤵PID:2224
-
\??\c:\pvlfbd.exec:\pvlfbd.exe118⤵PID:2904
-
\??\c:\vfphrx.exec:\vfphrx.exe119⤵PID:2560
-
\??\c:\lnnpf.exec:\lnnpf.exe120⤵PID:1724
-
\??\c:\blfbb.exec:\blfbb.exe121⤵
- System Location Discovery: System Language Discovery
PID:2796 -
\??\c:\pdxjvn.exec:\pdxjvn.exe122⤵PID:2780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-