Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19/11/2024, 14:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f1f650e6703aa708fd6895c31a51e51523fe928c7df0195555a3ed65be527feb.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
f1f650e6703aa708fd6895c31a51e51523fe928c7df0195555a3ed65be527feb.exe
-
Size
453KB
-
MD5
fc18693d8c9069d3f11a088d359bd2c9
-
SHA1
6414abfe85dfcc7775bc1f2ae3758b1500aa48ce
-
SHA256
f1f650e6703aa708fd6895c31a51e51523fe928c7df0195555a3ed65be527feb
-
SHA512
3af699d3ab912a3adc8750515dfd096aaa202851012f68aaa82c75dff744cd720b413110ea19171402d04021200c0ebe8489fb72df54c7423e625859f56ea14a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbelE:q7Tc2NYHUrAwfMp3CDK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2548-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1392-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/960-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-230-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1788-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-290-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1040-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1336-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-383-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1472-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-751-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-817-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-876-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2956 ptvnpnp.exe 2880 rnfpvfp.exe 3008 pvnpjb.exe 3020 ntllt.exe 2964 vhpfrv.exe 2908 bdhlftb.exe 2892 nxtpn.exe 2544 xblxhfl.exe 1388 xrxxj.exe 1700 tlhhrx.exe 1468 bbhbb.exe 1392 jjrjrn.exe 1276 ltflfv.exe 2872 pjjfrr.exe 3052 nphjxh.exe 2448 pddbbpv.exe 284 dnjdlph.exe 1872 jxrpd.exe 2164 hbptf.exe 2432 rvxlft.exe 2256 fdbjvhj.exe 960 rdvrx.exe 1972 rbbjf.exe 2584 vnjbxj.exe 1924 xlfhh.exe 1788 bnbnh.exe 596 vnvpjj.exe 1772 nffbdxd.exe 2028 dpbbp.exe 2296 nbndhbv.exe 2764 bfbjvf.exe 1040 rnvjd.exe 1320 btrbnr.exe 1692 ljjxh.exe 1476 hlfphnd.exe 1576 tdbht.exe 2984 vxhrfd.exe 568 lxrlpbr.exe 3056 hnflvnj.exe 636 rpvflfv.exe 2964 pdnnd.exe 2992 tfhjl.exe 1336 lthpxtl.exe 2540 hhdtvxb.exe 1652 hprxll.exe 1996 hxjdb.exe 1472 hvxtnrb.exe 2324 rtfrnbb.exe 2252 vllbbph.exe 2416 tnhrh.exe 1656 ltxlbl.exe 2832 hxfvbv.exe 3024 pjxdtt.exe 2000 fftnbf.exe 580 fpnhx.exe 2380 bjttphj.exe 2180 prjftbx.exe 2408 rxdbp.exe 1260 hnnrll.exe 2632 pfrrd.exe 2384 xbxpltj.exe 1876 hhdxbp.exe 2444 ndjbpb.exe 1104 dblfd.exe -
resource yara_rule behavioral1/memory/2548-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-360-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/1336-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-817-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-876-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/436-960-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-999-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-1027-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjphv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxfxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbtptr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjbttrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlfphnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjlprp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhbfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjffft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tldfnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjxxlrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djtdvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jthnjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptrnlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txvrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhrlxnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrtttjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrdfldp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvxrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpbrbrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lthrbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnlrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbhjphn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfrxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhvjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhhfpxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpbrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbjhbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffpbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdblxrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvfdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtvvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhvbnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxrhvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hppnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxvln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvrbxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpvxdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflttpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhdjfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpptdvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdvxxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drhbhfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlvnvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljlrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plvll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnbjlrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnhbnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxxlbt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2956 2548 f1f650e6703aa708fd6895c31a51e51523fe928c7df0195555a3ed65be527feb.exe 30 PID 2548 wrote to memory of 2956 2548 f1f650e6703aa708fd6895c31a51e51523fe928c7df0195555a3ed65be527feb.exe 30 PID 2548 wrote to memory of 2956 2548 f1f650e6703aa708fd6895c31a51e51523fe928c7df0195555a3ed65be527feb.exe 30 PID 2548 wrote to memory of 2956 2548 f1f650e6703aa708fd6895c31a51e51523fe928c7df0195555a3ed65be527feb.exe 30 PID 2956 wrote to memory of 2880 2956 ptvnpnp.exe 31 PID 2956 wrote to memory of 2880 2956 ptvnpnp.exe 31 PID 2956 wrote to memory of 2880 2956 ptvnpnp.exe 31 PID 2956 wrote to memory of 2880 2956 ptvnpnp.exe 31 PID 2880 wrote to memory of 3008 2880 rnfpvfp.exe 32 PID 2880 wrote to memory of 3008 2880 rnfpvfp.exe 32 PID 2880 wrote to memory of 3008 2880 rnfpvfp.exe 32 PID 2880 wrote to memory of 3008 2880 rnfpvfp.exe 32 PID 3008 wrote to memory of 3020 3008 pvnpjb.exe 33 PID 3008 wrote to memory of 3020 3008 pvnpjb.exe 33 PID 3008 wrote to memory of 3020 3008 pvnpjb.exe 33 PID 3008 wrote to memory of 3020 3008 pvnpjb.exe 33 PID 3020 wrote to memory of 2964 3020 ntllt.exe 34 PID 3020 wrote to memory of 2964 3020 ntllt.exe 34 PID 3020 wrote to memory of 2964 3020 ntllt.exe 34 PID 3020 wrote to memory of 2964 3020 ntllt.exe 34 PID 2964 wrote to memory of 2908 2964 vhpfrv.exe 35 PID 2964 wrote to memory of 2908 2964 vhpfrv.exe 35 PID 2964 wrote to memory of 2908 2964 vhpfrv.exe 35 PID 2964 wrote to memory of 2908 2964 vhpfrv.exe 35 PID 2908 wrote to memory of 2892 2908 bdhlftb.exe 36 PID 2908 wrote to memory of 2892 2908 bdhlftb.exe 36 PID 2908 wrote to memory of 2892 2908 bdhlftb.exe 36 PID 2908 wrote to memory of 2892 2908 bdhlftb.exe 36 PID 2892 wrote to memory of 2544 2892 nxtpn.exe 37 PID 2892 wrote to memory of 2544 2892 nxtpn.exe 37 PID 2892 wrote to memory of 2544 2892 nxtpn.exe 37 PID 2892 wrote to memory of 2544 2892 nxtpn.exe 37 PID 2544 wrote to memory of 1388 2544 xblxhfl.exe 38 PID 2544 wrote to memory of 1388 2544 xblxhfl.exe 38 PID 2544 wrote to memory of 1388 2544 xblxhfl.exe 38 PID 2544 wrote to memory of 1388 2544 xblxhfl.exe 38 PID 1388 wrote to memory of 1700 1388 xrxxj.exe 39 PID 1388 wrote to memory of 1700 1388 xrxxj.exe 39 PID 1388 wrote to memory of 1700 1388 xrxxj.exe 39 PID 1388 wrote to memory of 1700 1388 xrxxj.exe 39 PID 1700 wrote to memory of 1468 1700 tlhhrx.exe 40 PID 1700 wrote to memory of 1468 1700 tlhhrx.exe 40 PID 1700 wrote to memory of 1468 1700 tlhhrx.exe 40 PID 1700 wrote to memory of 1468 1700 tlhhrx.exe 40 PID 1468 wrote to memory of 1392 1468 bbhbb.exe 41 PID 1468 wrote to memory of 1392 1468 bbhbb.exe 41 PID 1468 wrote to memory of 1392 1468 bbhbb.exe 41 PID 1468 wrote to memory of 1392 1468 bbhbb.exe 41 PID 1392 wrote to memory of 1276 1392 jjrjrn.exe 42 PID 1392 wrote to memory of 1276 1392 jjrjrn.exe 42 PID 1392 wrote to memory of 1276 1392 jjrjrn.exe 42 PID 1392 wrote to memory of 1276 1392 jjrjrn.exe 42 PID 1276 wrote to memory of 2872 1276 ltflfv.exe 43 PID 1276 wrote to memory of 2872 1276 ltflfv.exe 43 PID 1276 wrote to memory of 2872 1276 ltflfv.exe 43 PID 1276 wrote to memory of 2872 1276 ltflfv.exe 43 PID 2872 wrote to memory of 3052 2872 pjjfrr.exe 44 PID 2872 wrote to memory of 3052 2872 pjjfrr.exe 44 PID 2872 wrote to memory of 3052 2872 pjjfrr.exe 44 PID 2872 wrote to memory of 3052 2872 pjjfrr.exe 44 PID 3052 wrote to memory of 2448 3052 nphjxh.exe 45 PID 3052 wrote to memory of 2448 3052 nphjxh.exe 45 PID 3052 wrote to memory of 2448 3052 nphjxh.exe 45 PID 3052 wrote to memory of 2448 3052 nphjxh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1f650e6703aa708fd6895c31a51e51523fe928c7df0195555a3ed65be527feb.exe"C:\Users\Admin\AppData\Local\Temp\f1f650e6703aa708fd6895c31a51e51523fe928c7df0195555a3ed65be527feb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\ptvnpnp.exec:\ptvnpnp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\rnfpvfp.exec:\rnfpvfp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\pvnpjb.exec:\pvnpjb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\ntllt.exec:\ntllt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\vhpfrv.exec:\vhpfrv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\bdhlftb.exec:\bdhlftb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\nxtpn.exec:\nxtpn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\xblxhfl.exec:\xblxhfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\xrxxj.exec:\xrxxj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\tlhhrx.exec:\tlhhrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\bbhbb.exec:\bbhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\jjrjrn.exec:\jjrjrn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\ltflfv.exec:\ltflfv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\pjjfrr.exec:\pjjfrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\nphjxh.exec:\nphjxh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\pddbbpv.exec:\pddbbpv.exe17⤵
- Executes dropped EXE
PID:2448 -
\??\c:\dnjdlph.exec:\dnjdlph.exe18⤵
- Executes dropped EXE
PID:284 -
\??\c:\jxrpd.exec:\jxrpd.exe19⤵
- Executes dropped EXE
PID:1872 -
\??\c:\hbptf.exec:\hbptf.exe20⤵
- Executes dropped EXE
PID:2164 -
\??\c:\rvxlft.exec:\rvxlft.exe21⤵
- Executes dropped EXE
PID:2432 -
\??\c:\fdbjvhj.exec:\fdbjvhj.exe22⤵
- Executes dropped EXE
PID:2256 -
\??\c:\rdvrx.exec:\rdvrx.exe23⤵
- Executes dropped EXE
PID:960 -
\??\c:\rbbjf.exec:\rbbjf.exe24⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vnjbxj.exec:\vnjbxj.exe25⤵
- Executes dropped EXE
PID:2584 -
\??\c:\xlfhh.exec:\xlfhh.exe26⤵
- Executes dropped EXE
PID:1924 -
\??\c:\bnbnh.exec:\bnbnh.exe27⤵
- Executes dropped EXE
PID:1788 -
\??\c:\vnvpjj.exec:\vnvpjj.exe28⤵
- Executes dropped EXE
PID:596 -
\??\c:\nffbdxd.exec:\nffbdxd.exe29⤵
- Executes dropped EXE
PID:1772 -
\??\c:\dpbbp.exec:\dpbbp.exe30⤵
- Executes dropped EXE
PID:2028 -
\??\c:\nbndhbv.exec:\nbndhbv.exe31⤵
- Executes dropped EXE
PID:2296 -
\??\c:\bfbjvf.exec:\bfbjvf.exe32⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rnvjd.exec:\rnvjd.exe33⤵
- Executes dropped EXE
PID:1040 -
\??\c:\btrbnr.exec:\btrbnr.exe34⤵
- Executes dropped EXE
PID:1320 -
\??\c:\ljjxh.exec:\ljjxh.exe35⤵
- Executes dropped EXE
PID:1692 -
\??\c:\hlfphnd.exec:\hlfphnd.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1476 -
\??\c:\tdbht.exec:\tdbht.exe37⤵
- Executes dropped EXE
PID:1576 -
\??\c:\vxhrfd.exec:\vxhrfd.exe38⤵
- Executes dropped EXE
PID:2984 -
\??\c:\lxrlpbr.exec:\lxrlpbr.exe39⤵
- Executes dropped EXE
PID:568 -
\??\c:\hnflvnj.exec:\hnflvnj.exe40⤵
- Executes dropped EXE
PID:3056 -
\??\c:\rpvflfv.exec:\rpvflfv.exe41⤵
- Executes dropped EXE
PID:636 -
\??\c:\pdnnd.exec:\pdnnd.exe42⤵
- Executes dropped EXE
PID:2964 -
\??\c:\tfhjl.exec:\tfhjl.exe43⤵
- Executes dropped EXE
PID:2992 -
\??\c:\lthpxtl.exec:\lthpxtl.exe44⤵
- Executes dropped EXE
PID:1336 -
\??\c:\hhdtvxb.exec:\hhdtvxb.exe45⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hprxll.exec:\hprxll.exe46⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hxjdb.exec:\hxjdb.exe47⤵
- Executes dropped EXE
PID:1996 -
\??\c:\hvxtnrb.exec:\hvxtnrb.exe48⤵
- Executes dropped EXE
PID:1472 -
\??\c:\rtfrnbb.exec:\rtfrnbb.exe49⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vllbbph.exec:\vllbbph.exe50⤵
- Executes dropped EXE
PID:2252 -
\??\c:\tnhrh.exec:\tnhrh.exe51⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ltxlbl.exec:\ltxlbl.exe52⤵
- Executes dropped EXE
PID:1656 -
\??\c:\hxfvbv.exec:\hxfvbv.exe53⤵
- Executes dropped EXE
PID:2832 -
\??\c:\pjxdtt.exec:\pjxdtt.exe54⤵
- Executes dropped EXE
PID:3024 -
\??\c:\fftnbf.exec:\fftnbf.exe55⤵
- Executes dropped EXE
PID:2000 -
\??\c:\fpnhx.exec:\fpnhx.exe56⤵
- Executes dropped EXE
PID:580 -
\??\c:\bjttphj.exec:\bjttphj.exe57⤵
- Executes dropped EXE
PID:2380 -
\??\c:\prjftbx.exec:\prjftbx.exe58⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rxdbp.exec:\rxdbp.exe59⤵
- Executes dropped EXE
PID:2408 -
\??\c:\hnnrll.exec:\hnnrll.exe60⤵
- Executes dropped EXE
PID:1260 -
\??\c:\pfrrd.exec:\pfrrd.exe61⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xbxpltj.exec:\xbxpltj.exe62⤵
- Executes dropped EXE
PID:2384 -
\??\c:\hhdxbp.exec:\hhdxbp.exe63⤵
- Executes dropped EXE
PID:1876 -
\??\c:\ndjbpb.exec:\ndjbpb.exe64⤵
- Executes dropped EXE
PID:2444 -
\??\c:\dblfd.exec:\dblfd.exe65⤵
- Executes dropped EXE
PID:1104 -
\??\c:\vlrbxb.exec:\vlrbxb.exe66⤵PID:2572
-
\??\c:\vfvrpj.exec:\vfvrpj.exe67⤵PID:1492
-
\??\c:\jlpnv.exec:\jlpnv.exe68⤵PID:1052
-
\??\c:\tvvfn.exec:\tvvfn.exe69⤵PID:1284
-
\??\c:\pjtxrpl.exec:\pjtxrpl.exe70⤵PID:1936
-
\??\c:\bdpdvv.exec:\bdpdvv.exe71⤵
- System Location Discovery: System Language Discovery
PID:1004 -
\??\c:\tfpdp.exec:\tfpdp.exe72⤵PID:1236
-
\??\c:\xrlblpv.exec:\xrlblpv.exe73⤵PID:2296
-
\??\c:\pbjhbv.exec:\pbjhbv.exe74⤵
- System Location Discovery: System Language Discovery
PID:1752 -
\??\c:\drvhn.exec:\drvhn.exe75⤵PID:1688
-
\??\c:\fbbdn.exec:\fbbdn.exe76⤵PID:2012
-
\??\c:\bvrdfh.exec:\bvrdfh.exe77⤵PID:2396
-
\??\c:\hlrbbxj.exec:\hlrbbxj.exe78⤵PID:2864
-
\??\c:\dfbrp.exec:\dfbrp.exe79⤵PID:1608
-
\??\c:\pvlvx.exec:\pvlvx.exe80⤵PID:1576
-
\??\c:\rfhvv.exec:\rfhvv.exe81⤵PID:2984
-
\??\c:\hpldvx.exec:\hpldvx.exe82⤵PID:2932
-
\??\c:\nvbfn.exec:\nvbfn.exe83⤵PID:3000
-
\??\c:\nxtrn.exec:\nxtrn.exe84⤵PID:2804
-
\??\c:\bbfjpxd.exec:\bbfjpxd.exe85⤵PID:536
-
\??\c:\drbjh.exec:\drbjh.exe86⤵PID:2056
-
\??\c:\bhthjhp.exec:\bhthjhp.exe87⤵PID:2364
-
\??\c:\tbbjvn.exec:\tbbjvn.exe88⤵PID:2740
-
\??\c:\lpjrjnr.exec:\lpjrjnr.exe89⤵PID:2476
-
\??\c:\trflx.exec:\trflx.exe90⤵PID:860
-
\??\c:\fjvnvxn.exec:\fjvnvxn.exe91⤵PID:1996
-
\??\c:\pdrfnnr.exec:\pdrfnnr.exe92⤵PID:932
-
\??\c:\nbnbbnf.exec:\nbnbbnf.exe93⤵PID:2324
-
\??\c:\hnrpfxf.exec:\hnrpfxf.exe94⤵PID:1944
-
\??\c:\jxxlbt.exec:\jxxlbt.exe95⤵
- System Location Discovery: System Language Discovery
PID:1120 -
\??\c:\ndrprd.exec:\ndrprd.exe96⤵PID:3068
-
\??\c:\dpflhhv.exec:\dpflhhv.exe97⤵PID:2084
-
\??\c:\xhxbl.exec:\xhxbl.exe98⤵PID:2024
-
\??\c:\bhtbpjl.exec:\bhtbpjl.exe99⤵PID:384
-
\??\c:\nhrbpjl.exec:\nhrbpjl.exe100⤵PID:2372
-
\??\c:\lnhtp.exec:\lnhtp.exe101⤵PID:368
-
\??\c:\lpddj.exec:\lpddj.exe102⤵PID:2504
-
\??\c:\pbnhxr.exec:\pbnhxr.exe103⤵PID:2148
-
\??\c:\hxrxbbj.exec:\hxrxbbj.exe104⤵PID:2176
-
\??\c:\nvvrfv.exec:\nvvrfv.exe105⤵PID:2052
-
\??\c:\pljtvv.exec:\pljtvv.exe106⤵PID:2220
-
\??\c:\bdhxv.exec:\bdhxv.exe107⤵PID:864
-
\??\c:\dpvvb.exec:\dpvvb.exe108⤵PID:2768
-
\??\c:\vjtbf.exec:\vjtbf.exe109⤵PID:1348
-
\??\c:\lxpjf.exec:\lxpjf.exe110⤵PID:1508
-
\??\c:\fbptn.exec:\fbptn.exe111⤵PID:880
-
\??\c:\tbfbxt.exec:\tbfbxt.exe112⤵PID:2484
-
\??\c:\jrrht.exec:\jrrht.exe113⤵PID:2060
-
\??\c:\ntrlh.exec:\ntrlh.exe114⤵PID:1772
-
\??\c:\dvtjl.exec:\dvtjl.exe115⤵PID:2516
-
\??\c:\hvpvr.exec:\hvpvr.exe116⤵PID:1736
-
\??\c:\rfpdpvn.exec:\rfpdpvn.exe117⤵PID:704
-
\??\c:\njdvf.exec:\njdvf.exe118⤵PID:1808
-
\??\c:\flfnxhf.exec:\flfnxhf.exe119⤵PID:2388
-
\??\c:\nfjllh.exec:\nfjllh.exe120⤵PID:1272
-
\??\c:\jrhrjnh.exec:\jrhrjnh.exe121⤵PID:2920
-
\??\c:\jnxdvf.exec:\jnxdvf.exe122⤵PID:2968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-