Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
02/11/2024, 22:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
848a9f145d6634b8b415ba22653f468ba9e7356f825b94787a28fb475f763060N.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
848a9f145d6634b8b415ba22653f468ba9e7356f825b94787a28fb475f763060N.exe
-
Size
454KB
-
MD5
8d8de69063556a9aff9805d2c76c4a00
-
SHA1
d382fe74d04b26ce27676847b69bf3e2c74f2233
-
SHA256
848a9f145d6634b8b415ba22653f468ba9e7356f825b94787a28fb475f763060
-
SHA512
ed4486182abc5f94412bbe443ea5982c982cfaa701b4a1be892ab87bd2b297d514ce124dc959c2da5e9b2cf4e244053f9a1b2377b3dc6c0d48c07b0de8955ac0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeP:q7Tc2NYHUrAwfMp3CDP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2596-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-46-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/568-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-99-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2024-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-134-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2296-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-165-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1976-163-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2500-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-229-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1572-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1168-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-318-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2876-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-575-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2676-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-603-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2968-616-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2616-641-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/1744-654-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2912-664-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-662-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2912-672-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/592-679-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2472 xfbpx.exe 2976 dtxtp.exe 2324 nnxrd.exe 2864 jppjnrh.exe 2168 hxljf.exe 2804 nbxbh.exe 2436 tpplnp.exe 2928 jvbpj.exe 568 xbrlv.exe 2024 xthldh.exe 1532 rfltd.exe 3036 dlfdf.exe 2444 xhrlx.exe 2808 rfnldfl.exe 2296 jvndjnx.exe 2932 tvjxtrx.exe 1976 fhbnvd.exe 2260 bpdrn.exe 2500 lbxxpvh.exe 2300 jhtjxd.exe 908 lfxbl.exe 980 pjpphdl.exe 2428 lvxfplf.exe 1724 ddxrh.exe 1572 hdfxd.exe 1836 xhnvbt.exe 1084 flrpjxf.exe 2668 pljnbt.exe 2396 dbtnfv.exe 2676 rjtdbv.exe 1168 rvhrltx.exe 964 pjphbj.exe 2840 flxplhp.exe 1584 ftvxxn.exe 2876 hlhdpf.exe 2948 fftjb.exe 3008 nvtdddt.exe 2984 pnhpr.exe 2772 tdjtl.exe 1824 rrpxp.exe 2916 hpjtj.exe 2800 frfdjj.exe 868 nvxfx.exe 592 hrlplxb.exe 944 lrttl.exe 1684 rtnfx.exe 2348 pdpvtr.exe 2196 vddhp.exe 3056 pndnn.exe 2788 xdjfpf.exe 1968 xfbbdx.exe 3060 lpjpt.exe 2516 hhbnp.exe 2704 xbtpxh.exe 612 bllrtdn.exe 1776 nvljdn.exe 2460 vptrx.exe 2280 bjtlhxl.exe 2124 jlhnfl.exe 1072 hnlbn.exe 2432 jrvprxn.exe 1992 rjxfp.exe 2084 flbxd.exe 900 frpxvl.exe -
resource yara_rule behavioral1/memory/2596-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1168-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-663-0x0000000001C50000-0x0000000001C7A000-memory.dmp upx behavioral1/memory/2444-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-750-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfnpfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlbrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvnpfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbnrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfpfvrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdpdfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlnvxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxrljth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phhrdrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlvbhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbvldhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjtjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbpdfbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhhpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvvfjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffbfbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlfdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjlbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdxxhvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjlhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flthvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxnhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhbnvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndtdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbxxvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnjxrvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfhrjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjlbxrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhjdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvvxndt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpflj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhdvrft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dprdhvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlltbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfdtlhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlrbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvtdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbvln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2596 wrote to memory of 2472 2596 848a9f145d6634b8b415ba22653f468ba9e7356f825b94787a28fb475f763060N.exe 29 PID 2596 wrote to memory of 2472 2596 848a9f145d6634b8b415ba22653f468ba9e7356f825b94787a28fb475f763060N.exe 29 PID 2596 wrote to memory of 2472 2596 848a9f145d6634b8b415ba22653f468ba9e7356f825b94787a28fb475f763060N.exe 29 PID 2596 wrote to memory of 2472 2596 848a9f145d6634b8b415ba22653f468ba9e7356f825b94787a28fb475f763060N.exe 29 PID 2472 wrote to memory of 2976 2472 xfbpx.exe 30 PID 2472 wrote to memory of 2976 2472 xfbpx.exe 30 PID 2472 wrote to memory of 2976 2472 xfbpx.exe 30 PID 2472 wrote to memory of 2976 2472 xfbpx.exe 30 PID 2976 wrote to memory of 2324 2976 dtxtp.exe 31 PID 2976 wrote to memory of 2324 2976 dtxtp.exe 31 PID 2976 wrote to memory of 2324 2976 dtxtp.exe 31 PID 2976 wrote to memory of 2324 2976 dtxtp.exe 31 PID 2324 wrote to memory of 2864 2324 nnxrd.exe 32 PID 2324 wrote to memory of 2864 2324 nnxrd.exe 32 PID 2324 wrote to memory of 2864 2324 nnxrd.exe 32 PID 2324 wrote to memory of 2864 2324 nnxrd.exe 32 PID 2864 wrote to memory of 2168 2864 jppjnrh.exe 33 PID 2864 wrote to memory of 2168 2864 jppjnrh.exe 33 PID 2864 wrote to memory of 2168 2864 jppjnrh.exe 33 PID 2864 wrote to memory of 2168 2864 jppjnrh.exe 33 PID 2168 wrote to memory of 2804 2168 hxljf.exe 34 PID 2168 wrote to memory of 2804 2168 hxljf.exe 34 PID 2168 wrote to memory of 2804 2168 hxljf.exe 34 PID 2168 wrote to memory of 2804 2168 hxljf.exe 34 PID 2804 wrote to memory of 2436 2804 nbxbh.exe 35 PID 2804 wrote to memory of 2436 2804 nbxbh.exe 35 PID 2804 wrote to memory of 2436 2804 nbxbh.exe 35 PID 2804 wrote to memory of 2436 2804 nbxbh.exe 35 PID 2436 wrote to memory of 2928 2436 tpplnp.exe 36 PID 2436 wrote to memory of 2928 2436 tpplnp.exe 36 PID 2436 wrote to memory of 2928 2436 tpplnp.exe 36 PID 2436 wrote to memory of 2928 2436 tpplnp.exe 36 PID 2928 wrote to memory of 568 2928 jvbpj.exe 37 PID 2928 wrote to memory of 568 2928 jvbpj.exe 37 PID 2928 wrote to memory of 568 2928 jvbpj.exe 37 PID 2928 wrote to memory of 568 2928 jvbpj.exe 37 PID 568 wrote to memory of 2024 568 xbrlv.exe 38 PID 568 wrote to memory of 2024 568 xbrlv.exe 38 PID 568 wrote to memory of 2024 568 xbrlv.exe 38 PID 568 wrote to memory of 2024 568 xbrlv.exe 38 PID 2024 wrote to memory of 1532 2024 xthldh.exe 39 PID 2024 wrote to memory of 1532 2024 xthldh.exe 39 PID 2024 wrote to memory of 1532 2024 xthldh.exe 39 PID 2024 wrote to memory of 1532 2024 xthldh.exe 39 PID 1532 wrote to memory of 3036 1532 rfltd.exe 40 PID 1532 wrote to memory of 3036 1532 rfltd.exe 40 PID 1532 wrote to memory of 3036 1532 rfltd.exe 40 PID 1532 wrote to memory of 3036 1532 rfltd.exe 40 PID 3036 wrote to memory of 2444 3036 dlfdf.exe 41 PID 3036 wrote to memory of 2444 3036 dlfdf.exe 41 PID 3036 wrote to memory of 2444 3036 dlfdf.exe 41 PID 3036 wrote to memory of 2444 3036 dlfdf.exe 41 PID 2444 wrote to memory of 2808 2444 xhrlx.exe 42 PID 2444 wrote to memory of 2808 2444 xhrlx.exe 42 PID 2444 wrote to memory of 2808 2444 xhrlx.exe 42 PID 2444 wrote to memory of 2808 2444 xhrlx.exe 42 PID 2808 wrote to memory of 2296 2808 rfnldfl.exe 43 PID 2808 wrote to memory of 2296 2808 rfnldfl.exe 43 PID 2808 wrote to memory of 2296 2808 rfnldfl.exe 43 PID 2808 wrote to memory of 2296 2808 rfnldfl.exe 43 PID 2296 wrote to memory of 2932 2296 jvndjnx.exe 44 PID 2296 wrote to memory of 2932 2296 jvndjnx.exe 44 PID 2296 wrote to memory of 2932 2296 jvndjnx.exe 44 PID 2296 wrote to memory of 2932 2296 jvndjnx.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\848a9f145d6634b8b415ba22653f468ba9e7356f825b94787a28fb475f763060N.exe"C:\Users\Admin\AppData\Local\Temp\848a9f145d6634b8b415ba22653f468ba9e7356f825b94787a28fb475f763060N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\xfbpx.exec:\xfbpx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\dtxtp.exec:\dtxtp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\nnxrd.exec:\nnxrd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\jppjnrh.exec:\jppjnrh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\hxljf.exec:\hxljf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\nbxbh.exec:\nbxbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\tpplnp.exec:\tpplnp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\jvbpj.exec:\jvbpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\xbrlv.exec:\xbrlv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\xthldh.exec:\xthldh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\rfltd.exec:\rfltd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\dlfdf.exec:\dlfdf.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\xhrlx.exec:\xhrlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\rfnldfl.exec:\rfnldfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\jvndjnx.exec:\jvndjnx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\tvjxtrx.exec:\tvjxtrx.exe17⤵
- Executes dropped EXE
PID:2932 -
\??\c:\fhbnvd.exec:\fhbnvd.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1976 -
\??\c:\bpdrn.exec:\bpdrn.exe19⤵
- Executes dropped EXE
PID:2260 -
\??\c:\lbxxpvh.exec:\lbxxpvh.exe20⤵
- Executes dropped EXE
PID:2500 -
\??\c:\jhtjxd.exec:\jhtjxd.exe21⤵
- Executes dropped EXE
PID:2300 -
\??\c:\lfxbl.exec:\lfxbl.exe22⤵
- Executes dropped EXE
PID:908 -
\??\c:\pjpphdl.exec:\pjpphdl.exe23⤵
- Executes dropped EXE
PID:980 -
\??\c:\lvxfplf.exec:\lvxfplf.exe24⤵
- Executes dropped EXE
PID:2428 -
\??\c:\ddxrh.exec:\ddxrh.exe25⤵
- Executes dropped EXE
PID:1724 -
\??\c:\hdfxd.exec:\hdfxd.exe26⤵
- Executes dropped EXE
PID:1572 -
\??\c:\xhnvbt.exec:\xhnvbt.exe27⤵
- Executes dropped EXE
PID:1836 -
\??\c:\flrpjxf.exec:\flrpjxf.exe28⤵
- Executes dropped EXE
PID:1084 -
\??\c:\pljnbt.exec:\pljnbt.exe29⤵
- Executes dropped EXE
PID:2668 -
\??\c:\dbtnfv.exec:\dbtnfv.exe30⤵
- Executes dropped EXE
PID:2396 -
\??\c:\rjtdbv.exec:\rjtdbv.exe31⤵
- Executes dropped EXE
PID:2676 -
\??\c:\rvhrltx.exec:\rvhrltx.exe32⤵
- Executes dropped EXE
PID:1168 -
\??\c:\pjphbj.exec:\pjphbj.exe33⤵
- Executes dropped EXE
PID:964 -
\??\c:\flxplhp.exec:\flxplhp.exe34⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ftvxxn.exec:\ftvxxn.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\hlhdpf.exec:\hlhdpf.exe36⤵
- Executes dropped EXE
PID:2876 -
\??\c:\fftjb.exec:\fftjb.exe37⤵
- Executes dropped EXE
PID:2948 -
\??\c:\nvtdddt.exec:\nvtdddt.exe38⤵
- Executes dropped EXE
PID:3008 -
\??\c:\pnhpr.exec:\pnhpr.exe39⤵
- Executes dropped EXE
PID:2984 -
\??\c:\tdjtl.exec:\tdjtl.exe40⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rrpxp.exec:\rrpxp.exe41⤵
- Executes dropped EXE
PID:1824 -
\??\c:\hpjtj.exec:\hpjtj.exe42⤵
- Executes dropped EXE
PID:2916 -
\??\c:\frfdjj.exec:\frfdjj.exe43⤵
- Executes dropped EXE
PID:2800 -
\??\c:\nvxfx.exec:\nvxfx.exe44⤵
- Executes dropped EXE
PID:868 -
\??\c:\hrlplxb.exec:\hrlplxb.exe45⤵
- Executes dropped EXE
PID:592 -
\??\c:\lrttl.exec:\lrttl.exe46⤵
- Executes dropped EXE
PID:944 -
\??\c:\rtnfx.exec:\rtnfx.exe47⤵
- Executes dropped EXE
PID:1684 -
\??\c:\pdpvtr.exec:\pdpvtr.exe48⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vddhp.exec:\vddhp.exe49⤵
- Executes dropped EXE
PID:2196 -
\??\c:\pndnn.exec:\pndnn.exe50⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xdjfpf.exec:\xdjfpf.exe51⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xfbbdx.exec:\xfbbdx.exe52⤵
- Executes dropped EXE
PID:1968 -
\??\c:\lpjpt.exec:\lpjpt.exe53⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hhbnp.exec:\hhbnp.exe54⤵
- Executes dropped EXE
PID:2516 -
\??\c:\xbtpxh.exec:\xbtpxh.exe55⤵
- Executes dropped EXE
PID:2704 -
\??\c:\bllrtdn.exec:\bllrtdn.exe56⤵
- Executes dropped EXE
PID:612 -
\??\c:\nvljdn.exec:\nvljdn.exe57⤵
- Executes dropped EXE
PID:1776 -
\??\c:\vptrx.exec:\vptrx.exe58⤵
- Executes dropped EXE
PID:2460 -
\??\c:\bjtlhxl.exec:\bjtlhxl.exe59⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jlhnfl.exec:\jlhnfl.exe60⤵
- Executes dropped EXE
PID:2124 -
\??\c:\hnlbn.exec:\hnlbn.exe61⤵
- Executes dropped EXE
PID:1072 -
\??\c:\jrvprxn.exec:\jrvprxn.exe62⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rjxfp.exec:\rjxfp.exe63⤵
- Executes dropped EXE
PID:1992 -
\??\c:\flbxd.exec:\flbxd.exe64⤵
- Executes dropped EXE
PID:2084 -
\??\c:\frpxvl.exec:\frpxvl.exe65⤵
- Executes dropped EXE
PID:900 -
\??\c:\rvxprj.exec:\rvxprj.exe66⤵PID:524
-
\??\c:\fdvrdb.exec:\fdvrdb.exe67⤵PID:2388
-
\??\c:\tlbxbf.exec:\tlbxbf.exe68⤵PID:1680
-
\??\c:\pvjtnbj.exec:\pvjtnbj.exe69⤵PID:1132
-
\??\c:\vlrfnx.exec:\vlrfnx.exe70⤵PID:1768
-
\??\c:\ltxnpvv.exec:\ltxnpvv.exe71⤵PID:2316
-
\??\c:\lrprt.exec:\lrprt.exe72⤵PID:2268
-
\??\c:\bntrdn.exec:\bntrdn.exe73⤵PID:1664
-
\??\c:\ppvbxxv.exec:\ppvbxxv.exe74⤵PID:2676
-
\??\c:\ptrxxf.exec:\ptrxxf.exe75⤵PID:928
-
\??\c:\ppjbtb.exec:\ppjbtb.exe76⤵PID:1780
-
\??\c:\nxhlrxd.exec:\nxhlrxd.exe77⤵PID:1608
-
\??\c:\dbxnpj.exec:\dbxnpj.exe78⤵PID:2472
-
\??\c:\ddllh.exec:\ddllh.exe79⤵PID:2968
-
\??\c:\fpdpttf.exec:\fpdpttf.exe80⤵PID:2880
-
\??\c:\jhhhnr.exec:\jhhhnr.exe81⤵PID:3012
-
\??\c:\vdppx.exec:\vdppx.exe82⤵PID:2176
-
\??\c:\tvfddd.exec:\tvfddd.exe83⤵PID:2616
-
\??\c:\xdfdj.exec:\xdfdj.exe84⤵PID:2744
-
\??\c:\lrdbh.exec:\lrdbh.exe85⤵PID:1744
-
\??\c:\thjhrht.exec:\thjhrht.exe86⤵PID:2320
-
\??\c:\rdtppfd.exec:\rdtppfd.exe87⤵PID:2912
-
\??\c:\vtltpnt.exec:\vtltpnt.exe88⤵PID:592
-
\??\c:\rxppffj.exec:\rxppffj.exe89⤵PID:1140
-
\??\c:\fhhvxn.exec:\fhhvxn.exe90⤵PID:2092
-
\??\c:\xlltbb.exec:\xlltbb.exe91⤵
- System Location Discovery: System Language Discovery
PID:1144 -
\??\c:\fxbldpp.exec:\fxbldpp.exe92⤵PID:2192
-
\??\c:\hfhrjj.exec:\hfhrjj.exe93⤵
- System Location Discovery: System Language Discovery
PID:2104 -
\??\c:\xdhnr.exec:\xdhnr.exe94⤵PID:2444
-
\??\c:\xhtphbb.exec:\xhtphbb.exe95⤵PID:2408
-
\??\c:\dfjjbn.exec:\dfjjbn.exe96⤵PID:2656
-
\??\c:\xdhbhpb.exec:\xdhbhpb.exe97⤵PID:2152
-
\??\c:\dvxnpt.exec:\dvxnpt.exe98⤵PID:1108
-
\??\c:\bbfvvl.exec:\bbfvvl.exe99⤵PID:2264
-
\??\c:\vddtxbh.exec:\vddtxbh.exe100⤵PID:2260
-
\??\c:\hnppv.exec:\hnppv.exe101⤵
- System Location Discovery: System Language Discovery
PID:2272 -
\??\c:\ddrrr.exec:\ddrrr.exe102⤵PID:2276
-
\??\c:\frhbvn.exec:\frhbvn.exe103⤵PID:2424
-
\??\c:\vbtxt.exec:\vbtxt.exe104⤵PID:1540
-
\??\c:\hlttddn.exec:\hlttddn.exe105⤵PID:2160
-
\??\c:\phpvb.exec:\phpvb.exe106⤵PID:1992
-
\??\c:\nvvvdhr.exec:\nvvvdhr.exe107⤵PID:2084
-
\??\c:\rvbhb.exec:\rvbhb.exe108⤵PID:900
-
\??\c:\jfjplbf.exec:\jfjplbf.exe109⤵PID:1284
-
\??\c:\xrbjj.exec:\xrbjj.exe110⤵PID:1836
-
\??\c:\ffrlnhr.exec:\ffrlnhr.exe111⤵PID:1680
-
\??\c:\bhnhj.exec:\bhnhj.exe112⤵PID:1384
-
\??\c:\hlntt.exec:\hlntt.exe113⤵PID:2028
-
\??\c:\jrjbl.exec:\jrjbl.exe114⤵PID:2400
-
\??\c:\rdnhdt.exec:\rdnhdt.exe115⤵PID:1700
-
\??\c:\pltttxl.exec:\pltttxl.exe116⤵PID:1156
-
\??\c:\jhjntrp.exec:\jhjntrp.exe117⤵PID:1720
-
\??\c:\nfdllbd.exec:\nfdllbd.exe118⤵PID:664
-
\??\c:\xvrpnld.exec:\xvrpnld.exe119⤵PID:2584
-
\??\c:\hhthd.exec:\hhthd.exe120⤵
- System Location Discovery: System Language Discovery
PID:2628 -
\??\c:\lbpdfbv.exec:\lbpdfbv.exe121⤵
- System Location Discovery: System Language Discovery
PID:2960 -
\??\c:\tfthnhh.exec:\tfthnhh.exe122⤵PID:2324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-