Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20/11/2024, 00:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
74e5ab4b8ff04c0d072239fb73756e2e8bc33d3bdc3fdbc654897c7831470c82.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
74e5ab4b8ff04c0d072239fb73756e2e8bc33d3bdc3fdbc654897c7831470c82.exe
-
Size
453KB
-
MD5
bbe31385d99e814b600ddd4270855f23
-
SHA1
1a63aba1061bb0a082e9ec9ce5fbb806883f0376
-
SHA256
74e5ab4b8ff04c0d072239fb73756e2e8bc33d3bdc3fdbc654897c7831470c82
-
SHA512
d942c75dc38dc3753477141fa63e6e0c6e50dbcf414ba9923e6568e4f709fbc4af048a140ab20d3020ce1896e39cf6b4b1c767e58d4e729d9b92e7b7f910c426
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeb:q7Tc2NYHUrAwfMp3CDb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/1852-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-230-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/840-229-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2096-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-324-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2028-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-377-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2404-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-477-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/680-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-554-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1600-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-624-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2784-640-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-704-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-871-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2316 lxtnb.exe 2028 ttdbvp.exe 2888 vbdpvpt.exe 2868 jpnnvf.exe 2676 pvjrdxj.exe 2904 vtnvb.exe 2728 ntttt.exe 2400 dbfhb.exe 2636 fxbjxrp.exe 2020 lbhrftp.exe 2584 jphdlbh.exe 2960 nffjrb.exe 3028 bhlbjbd.exe 2920 fhvrf.exe 2016 hljrjjp.exe 1800 vtbpx.exe 264 rbnlrhh.exe 1572 pfjpjlr.exe 2412 npndjx.exe 2416 vdfxl.exe 2468 jfjhr.exe 1252 trbbvfn.exe 2984 vjnnbp.exe 840 vvnbfr.exe 1868 tpdfdfj.exe 2096 jfnxx.exe 1796 dtdxh.exe 2244 dxvtpvf.exe 1716 dhldl.exe 2500 ddhdflp.exe 2516 jjnnbl.exe 2060 rfpvlnr.exe 860 hvfppd.exe 1900 hrdjtth.exe 2940 hrvvpjn.exe 2308 nnxhxjb.exe 1760 tftbxpf.exe 2028 vrvdrn.exe 3064 lvvhl.exe 2884 fblxj.exe 1076 hbnthvn.exe 2816 xfnbjd.exe 2676 fnxxph.exe 2904 pvbfv.exe 2708 xjxvxnl.exe 2404 rpxxp.exe 1780 dbddfb.exe 1376 nlxnl.exe 552 xjbnf.exe 2392 xhhbrnt.exe 2388 bbfldf.exe 2980 rprplr.exe 3028 vvfxn.exe 1656 xhlfjv.exe 2004 plnjjbn.exe 1092 dxnnntl.exe 2104 jjphlph.exe 2176 ltjfph.exe 3060 vxtphx.exe 1156 jjfthb.exe 2452 tllplfb.exe 1608 lxvlrf.exe 2436 fnnlv.exe 680 vldrjrr.exe -
resource yara_rule behavioral1/memory/1852-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-466-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2104-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-684-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/1612-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-744-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-820-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/372-833-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-884-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-893-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfxvnjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvfdlnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tblfjhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjlbjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfvnnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrbxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfhfbvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvnvlvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndphlfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plhrph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnhjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlhhjlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfndt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjnnbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrljvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpvlpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjjbxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prvlbhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhdjbdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbvvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bppjbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frjpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdpvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlfbxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnjrrjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74e5ab4b8ff04c0d072239fb73756e2e8bc33d3bdc3fdbc654897c7831470c82.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhvbdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvnrdlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpphxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjtdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxvvlvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnvppr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjbnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjvhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxhnvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1852 wrote to memory of 2316 1852 74e5ab4b8ff04c0d072239fb73756e2e8bc33d3bdc3fdbc654897c7831470c82.exe 30 PID 1852 wrote to memory of 2316 1852 74e5ab4b8ff04c0d072239fb73756e2e8bc33d3bdc3fdbc654897c7831470c82.exe 30 PID 1852 wrote to memory of 2316 1852 74e5ab4b8ff04c0d072239fb73756e2e8bc33d3bdc3fdbc654897c7831470c82.exe 30 PID 1852 wrote to memory of 2316 1852 74e5ab4b8ff04c0d072239fb73756e2e8bc33d3bdc3fdbc654897c7831470c82.exe 30 PID 2316 wrote to memory of 2028 2316 lxtnb.exe 31 PID 2316 wrote to memory of 2028 2316 lxtnb.exe 31 PID 2316 wrote to memory of 2028 2316 lxtnb.exe 31 PID 2316 wrote to memory of 2028 2316 lxtnb.exe 31 PID 2028 wrote to memory of 2888 2028 ttdbvp.exe 32 PID 2028 wrote to memory of 2888 2028 ttdbvp.exe 32 PID 2028 wrote to memory of 2888 2028 ttdbvp.exe 32 PID 2028 wrote to memory of 2888 2028 ttdbvp.exe 32 PID 2888 wrote to memory of 2868 2888 vbdpvpt.exe 33 PID 2888 wrote to memory of 2868 2888 vbdpvpt.exe 33 PID 2888 wrote to memory of 2868 2888 vbdpvpt.exe 33 PID 2888 wrote to memory of 2868 2888 vbdpvpt.exe 33 PID 2868 wrote to memory of 2676 2868 jpnnvf.exe 34 PID 2868 wrote to memory of 2676 2868 jpnnvf.exe 34 PID 2868 wrote to memory of 2676 2868 jpnnvf.exe 34 PID 2868 wrote to memory of 2676 2868 jpnnvf.exe 34 PID 2676 wrote to memory of 2904 2676 pvjrdxj.exe 35 PID 2676 wrote to memory of 2904 2676 pvjrdxj.exe 35 PID 2676 wrote to memory of 2904 2676 pvjrdxj.exe 35 PID 2676 wrote to memory of 2904 2676 pvjrdxj.exe 35 PID 2904 wrote to memory of 2728 2904 vtnvb.exe 36 PID 2904 wrote to memory of 2728 2904 vtnvb.exe 36 PID 2904 wrote to memory of 2728 2904 vtnvb.exe 36 PID 2904 wrote to memory of 2728 2904 vtnvb.exe 36 PID 2728 wrote to memory of 2400 2728 ntttt.exe 37 PID 2728 wrote to memory of 2400 2728 ntttt.exe 37 PID 2728 wrote to memory of 2400 2728 ntttt.exe 37 PID 2728 wrote to memory of 2400 2728 ntttt.exe 37 PID 2400 wrote to memory of 2636 2400 dbfhb.exe 38 PID 2400 wrote to memory of 2636 2400 dbfhb.exe 38 PID 2400 wrote to memory of 2636 2400 dbfhb.exe 38 PID 2400 wrote to memory of 2636 2400 dbfhb.exe 38 PID 2636 wrote to memory of 2020 2636 fxbjxrp.exe 39 PID 2636 wrote to memory of 2020 2636 fxbjxrp.exe 39 PID 2636 wrote to memory of 2020 2636 fxbjxrp.exe 39 PID 2636 wrote to memory of 2020 2636 fxbjxrp.exe 39 PID 2020 wrote to memory of 2584 2020 lbhrftp.exe 40 PID 2020 wrote to memory of 2584 2020 lbhrftp.exe 40 PID 2020 wrote to memory of 2584 2020 lbhrftp.exe 40 PID 2020 wrote to memory of 2584 2020 lbhrftp.exe 40 PID 2584 wrote to memory of 2960 2584 jphdlbh.exe 41 PID 2584 wrote to memory of 2960 2584 jphdlbh.exe 41 PID 2584 wrote to memory of 2960 2584 jphdlbh.exe 41 PID 2584 wrote to memory of 2960 2584 jphdlbh.exe 41 PID 2960 wrote to memory of 3028 2960 nffjrb.exe 42 PID 2960 wrote to memory of 3028 2960 nffjrb.exe 42 PID 2960 wrote to memory of 3028 2960 nffjrb.exe 42 PID 2960 wrote to memory of 3028 2960 nffjrb.exe 42 PID 3028 wrote to memory of 2920 3028 bhlbjbd.exe 43 PID 3028 wrote to memory of 2920 3028 bhlbjbd.exe 43 PID 3028 wrote to memory of 2920 3028 bhlbjbd.exe 43 PID 3028 wrote to memory of 2920 3028 bhlbjbd.exe 43 PID 2920 wrote to memory of 2016 2920 fhvrf.exe 44 PID 2920 wrote to memory of 2016 2920 fhvrf.exe 44 PID 2920 wrote to memory of 2016 2920 fhvrf.exe 44 PID 2920 wrote to memory of 2016 2920 fhvrf.exe 44 PID 2016 wrote to memory of 1800 2016 hljrjjp.exe 45 PID 2016 wrote to memory of 1800 2016 hljrjjp.exe 45 PID 2016 wrote to memory of 1800 2016 hljrjjp.exe 45 PID 2016 wrote to memory of 1800 2016 hljrjjp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\74e5ab4b8ff04c0d072239fb73756e2e8bc33d3bdc3fdbc654897c7831470c82.exe"C:\Users\Admin\AppData\Local\Temp\74e5ab4b8ff04c0d072239fb73756e2e8bc33d3bdc3fdbc654897c7831470c82.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\lxtnb.exec:\lxtnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\ttdbvp.exec:\ttdbvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\vbdpvpt.exec:\vbdpvpt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\jpnnvf.exec:\jpnnvf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\pvjrdxj.exec:\pvjrdxj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\vtnvb.exec:\vtnvb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\ntttt.exec:\ntttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\dbfhb.exec:\dbfhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\fxbjxrp.exec:\fxbjxrp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\lbhrftp.exec:\lbhrftp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\jphdlbh.exec:\jphdlbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\nffjrb.exec:\nffjrb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\bhlbjbd.exec:\bhlbjbd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\fhvrf.exec:\fhvrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\hljrjjp.exec:\hljrjjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\vtbpx.exec:\vtbpx.exe17⤵
- Executes dropped EXE
PID:1800 -
\??\c:\rbnlrhh.exec:\rbnlrhh.exe18⤵
- Executes dropped EXE
PID:264 -
\??\c:\pfjpjlr.exec:\pfjpjlr.exe19⤵
- Executes dropped EXE
PID:1572 -
\??\c:\npndjx.exec:\npndjx.exe20⤵
- Executes dropped EXE
PID:2412 -
\??\c:\vdfxl.exec:\vdfxl.exe21⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jfjhr.exec:\jfjhr.exe22⤵
- Executes dropped EXE
PID:2468 -
\??\c:\trbbvfn.exec:\trbbvfn.exe23⤵
- Executes dropped EXE
PID:1252 -
\??\c:\vjnnbp.exec:\vjnnbp.exe24⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vvnbfr.exec:\vvnbfr.exe25⤵
- Executes dropped EXE
PID:840 -
\??\c:\tpdfdfj.exec:\tpdfdfj.exe26⤵
- Executes dropped EXE
PID:1868 -
\??\c:\jfnxx.exec:\jfnxx.exe27⤵
- Executes dropped EXE
PID:2096 -
\??\c:\dtdxh.exec:\dtdxh.exe28⤵
- Executes dropped EXE
PID:1796 -
\??\c:\dxvtpvf.exec:\dxvtpvf.exe29⤵
- Executes dropped EXE
PID:2244 -
\??\c:\dhldl.exec:\dhldl.exe30⤵
- Executes dropped EXE
PID:1716 -
\??\c:\ddhdflp.exec:\ddhdflp.exe31⤵
- Executes dropped EXE
PID:2500 -
\??\c:\jjnnbl.exec:\jjnnbl.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2516 -
\??\c:\rfpvlnr.exec:\rfpvlnr.exe33⤵
- Executes dropped EXE
PID:2060 -
\??\c:\hvfppd.exec:\hvfppd.exe34⤵
- Executes dropped EXE
PID:860 -
\??\c:\hrdjtth.exec:\hrdjtth.exe35⤵
- Executes dropped EXE
PID:1900 -
\??\c:\hrvvpjn.exec:\hrvvpjn.exe36⤵
- Executes dropped EXE
PID:2940 -
\??\c:\nnxhxjb.exec:\nnxhxjb.exe37⤵
- Executes dropped EXE
PID:2308 -
\??\c:\tftbxpf.exec:\tftbxpf.exe38⤵
- Executes dropped EXE
PID:1760 -
\??\c:\vrvdrn.exec:\vrvdrn.exe39⤵
- Executes dropped EXE
PID:2028 -
\??\c:\lvvhl.exec:\lvvhl.exe40⤵
- Executes dropped EXE
PID:3064 -
\??\c:\fblxj.exec:\fblxj.exe41⤵
- Executes dropped EXE
PID:2884 -
\??\c:\hbnthvn.exec:\hbnthvn.exe42⤵
- Executes dropped EXE
PID:1076 -
\??\c:\xfnbjd.exec:\xfnbjd.exe43⤵
- Executes dropped EXE
PID:2816 -
\??\c:\fnxxph.exec:\fnxxph.exe44⤵
- Executes dropped EXE
PID:2676 -
\??\c:\pvbfv.exec:\pvbfv.exe45⤵
- Executes dropped EXE
PID:2904 -
\??\c:\xjxvxnl.exec:\xjxvxnl.exe46⤵
- Executes dropped EXE
PID:2708 -
\??\c:\rpxxp.exec:\rpxxp.exe47⤵
- Executes dropped EXE
PID:2404 -
\??\c:\dbddfb.exec:\dbddfb.exe48⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nlxnl.exec:\nlxnl.exe49⤵
- Executes dropped EXE
PID:1376 -
\??\c:\xjbnf.exec:\xjbnf.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:552 -
\??\c:\xhhbrnt.exec:\xhhbrnt.exe51⤵
- Executes dropped EXE
PID:2392 -
\??\c:\bbfldf.exec:\bbfldf.exe52⤵
- Executes dropped EXE
PID:2388 -
\??\c:\rprplr.exec:\rprplr.exe53⤵
- Executes dropped EXE
PID:2980 -
\??\c:\vvfxn.exec:\vvfxn.exe54⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xhlfjv.exec:\xhlfjv.exe55⤵
- Executes dropped EXE
PID:1656 -
\??\c:\plnjjbn.exec:\plnjjbn.exe56⤵
- Executes dropped EXE
PID:2004 -
\??\c:\dxnnntl.exec:\dxnnntl.exe57⤵
- Executes dropped EXE
PID:1092 -
\??\c:\jjphlph.exec:\jjphlph.exe58⤵
- Executes dropped EXE
PID:2104 -
\??\c:\ltjfph.exec:\ltjfph.exe59⤵
- Executes dropped EXE
PID:2176 -
\??\c:\vxtphx.exec:\vxtphx.exe60⤵
- Executes dropped EXE
PID:3060 -
\??\c:\jjfthb.exec:\jjfthb.exe61⤵
- Executes dropped EXE
PID:1156 -
\??\c:\tllplfb.exec:\tllplfb.exe62⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lxvlrf.exec:\lxvlrf.exe63⤵
- Executes dropped EXE
PID:1608 -
\??\c:\fnnlv.exec:\fnnlv.exe64⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vldrjrr.exec:\vldrjrr.exe65⤵
- Executes dropped EXE
PID:680 -
\??\c:\jrvdt.exec:\jrvdt.exe66⤵PID:1904
-
\??\c:\rjdnxv.exec:\rjdnxv.exe67⤵PID:1300
-
\??\c:\vxhvtn.exec:\vxhvtn.exe68⤵PID:1316
-
\??\c:\frfptj.exec:\frfptj.exe69⤵PID:2100
-
\??\c:\xfrtbf.exec:\xfrtbf.exe70⤵PID:2088
-
\??\c:\rjvpj.exec:\rjvpj.exe71⤵PID:1492
-
\??\c:\ntrlvn.exec:\ntrlvn.exe72⤵PID:744
-
\??\c:\pxnbld.exec:\pxnbld.exe73⤵PID:2524
-
\??\c:\rpfnpr.exec:\rpfnpr.exe74⤵PID:1312
-
\??\c:\flvdl.exec:\flvdl.exe75⤵PID:1632
-
\??\c:\ddlpvn.exec:\ddlpvn.exe76⤵PID:544
-
\??\c:\xfptx.exec:\xfptx.exe77⤵PID:2536
-
\??\c:\pvfhvxf.exec:\pvfhvxf.exe78⤵PID:1672
-
\??\c:\tdtnb.exec:\tdtnb.exe79⤵PID:3040
-
\??\c:\nvplxfb.exec:\nvplxfb.exe80⤵PID:1564
-
\??\c:\nnbdvf.exec:\nnbdvf.exe81⤵PID:1600
-
\??\c:\fbrpvhp.exec:\fbrpvhp.exe82⤵PID:2780
-
\??\c:\vlffjrv.exec:\vlffjrv.exe83⤵PID:2928
-
\??\c:\rtdtr.exec:\rtdtr.exe84⤵PID:2784
-
\??\c:\frvth.exec:\frvth.exe85⤵PID:2888
-
\??\c:\htrhtfn.exec:\htrhtfn.exe86⤵PID:2752
-
\??\c:\jvnrj.exec:\jvnrj.exe87⤵PID:3024
-
\??\c:\dhblhhx.exec:\dhblhhx.exe88⤵PID:2772
-
\??\c:\nrvnxf.exec:\nrvnxf.exe89⤵PID:2680
-
\??\c:\hntnv.exec:\hntnv.exe90⤵PID:2320
-
\??\c:\rdfbhjd.exec:\rdfbhjd.exe91⤵PID:2632
-
\??\c:\hbpjpb.exec:\hbpjpb.exe92⤵PID:2224
-
\??\c:\hfnnh.exec:\hfnnh.exe93⤵PID:1780
-
\??\c:\vvvftp.exec:\vvvftp.exe94⤵PID:1612
-
\??\c:\lrtdht.exec:\lrtdht.exe95⤵PID:2912
-
\??\c:\bprtl.exec:\bprtl.exe96⤵PID:2908
-
\??\c:\tjblpp.exec:\tjblpp.exe97⤵PID:2388
-
\??\c:\pvrfxr.exec:\pvrfxr.exe98⤵PID:2952
-
\??\c:\ftfht.exec:\ftfht.exe99⤵PID:3028
-
\??\c:\lvtrrn.exec:\lvtrrn.exe100⤵PID:2568
-
\??\c:\rnhndjh.exec:\rnhndjh.exe101⤵PID:2236
-
\??\c:\lpxpd.exec:\lpxpd.exe102⤵PID:2144
-
\??\c:\xffbj.exec:\xffbj.exe103⤵PID:912
-
\??\c:\nvxlxtp.exec:\nvxlxtp.exe104⤵PID:2168
-
\??\c:\ffpxp.exec:\ffpxp.exe105⤵PID:2560
-
\??\c:\xhvjhrr.exec:\xhvjhrr.exe106⤵PID:2124
-
\??\c:\tdxrd.exec:\tdxrd.exe107⤵PID:1732
-
\??\c:\vlbff.exec:\vlbff.exe108⤵PID:936
-
\??\c:\hjfxf.exec:\hjfxf.exe109⤵PID:112
-
\??\c:\lhrfpx.exec:\lhrfpx.exe110⤵PID:2492
-
\??\c:\tjlfxp.exec:\tjlfxp.exe111⤵PID:1456
-
\??\c:\fnxdjb.exec:\fnxdjb.exe112⤵PID:660
-
\??\c:\dnfxbjd.exec:\dnfxbjd.exe113⤵PID:1580
-
\??\c:\xhhxvhf.exec:\xhhxvhf.exe114⤵PID:1520
-
\??\c:\hphbpr.exec:\hphbpr.exe115⤵PID:372
-
\??\c:\ppvblh.exec:\ppvblh.exe116⤵PID:2520
-
\??\c:\ffrxtx.exec:\ffrxtx.exe117⤵PID:612
-
\??\c:\djnvfnd.exec:\djnvfnd.exe118⤵PID:2188
-
\??\c:\rprlh.exec:\rprlh.exe119⤵PID:2512
-
\??\c:\dvrvjf.exec:\dvrvjf.exe120⤵PID:1916
-
\??\c:\hbrvd.exec:\hbrvd.exe121⤵PID:1668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-