Analysis
-
max time kernel
151s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 22:35
Behavioral task
behavioral1
Sample
3318a8da6ee4ff29b69ceba44a02cb8e1db123a6a866b48a5aa9bb808e97b582.exe
Resource
win7-20241010-en
General
-
Target
3318a8da6ee4ff29b69ceba44a02cb8e1db123a6a866b48a5aa9bb808e97b582.exe
-
Size
334KB
-
MD5
0300135ee0ae4dee9f7e5ce6970d70ef
-
SHA1
4cac0bd04268dd18ed8073616a6412cebaa75185
-
SHA256
3318a8da6ee4ff29b69ceba44a02cb8e1db123a6a866b48a5aa9bb808e97b582
-
SHA512
8936023e21166dff7efa5df699b0db77c551b3c4d7a22d8a22b92850d17a109ec97fed3eedd0668015160e231e194785f6eaefb4063f1aa6a83029b845b043f2
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeRi:R4wFHoSHYHUrAwfMp3CDRi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
Processes:
resource yara_rule behavioral1/memory/2124-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-62-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2592-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-83-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2812-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2252-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2204-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2076-183-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2620-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/288-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-132-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2176-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-113-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/832-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1516-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1020-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2424-444-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2424-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1124-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1124-478-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/972-487-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/1052-502-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2128-508-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2128-527-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2144-579-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2872-612-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2872-630-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2196-636-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2568-699-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jbdnfx.exednphlp.exefthpj.exexllpl.exerbbxv.exednnhrl.exejhhrn.exebfvlt.exetrvpp.exedpjft.exexjnrvbt.exenffnl.exenptvj.exedtlrvfx.exelllrl.exebjdhj.exehptttlf.exerltljlt.exelxvjl.exendtph.exerddhrfj.exedxlfh.exevbdfb.exexvjbpnd.exejpllfjn.exebjnfhtb.exexprnp.exefpnhxhj.exejflhpnn.exeljjvjhx.exerjxxp.exenbhhf.exedbfnvxv.exerhrdj.exedxpphf.exevjldb.exepbttl.exedbxjrb.exenfhvnt.exejjvdr.exehdvnf.exebxhlfvn.exelvdhdf.exehblnv.exedrtnxxf.exetdrpn.exelfnbxhp.exehvhbt.exerpdxh.exehljxd.exerjhbpr.exevjblxhb.exejdxdph.exepdpdbfr.exevhfdll.exenlrddn.exerlhdjhn.exejxdhxnf.exexxftjf.exepbvpjf.exejdrhpvx.exepjtfj.exehrhdr.exetrptrtr.exepid Process 3012 jbdnfx.exe 2816 dnphlp.exe 2948 fthpj.exe 2836 xllpl.exe 2636 rbbxv.exe 2756 dnnhrl.exe 2768 jhhrn.exe 2592 bfvlt.exe 2812 trvpp.exe 2252 dpjft.exe 832 xjnrvbt.exe 1100 nffnl.exe 3020 nptvj.exe 2176 dtlrvfx.exe 2952 lllrl.exe 2024 bjdhj.exe 2896 hptttlf.exe 1612 rltljlt.exe 2204 lxvjl.exe 2076 ndtph.exe 2492 rddhrfj.exe 2056 dxlfh.exe 1716 vbdfb.exe 2620 xvjbpnd.exe 1644 jpllfjn.exe 2420 bjnfhtb.exe 288 xprnp.exe 1816 fpnhxhj.exe 1396 jflhpnn.exe 948 ljjvjhx.exe 1756 rjxxp.exe 2392 nbhhf.exe 1632 dbfnvxv.exe 2964 rhrdj.exe 876 dxpphf.exe 2256 vjldb.exe 1516 pbttl.exe 2856 dbxjrb.exe 1708 nfhvnt.exe 2984 jjvdr.exe 2316 hdvnf.exe 2992 bxhlfvn.exe 2828 lvdhdf.exe 2748 hblnv.exe 2784 drtnxxf.exe 2876 tdrpn.exe 2600 lfnbxhp.exe 2304 hvhbt.exe 2588 rpdxh.exe 2508 hljxd.exe 2252 rjhbpr.exe 1136 vjblxhb.exe 2956 jdxdph.exe 3064 pdpdbfr.exe 2116 vhfdll.exe 1020 nlrddn.exe 3028 rlhdjhn.exe 2952 jxdhxnf.exe 584 xxftjf.exe 2896 pbvpjf.exe 2764 jdrhpvx.exe 2424 pjtfj.exe 800 hrhdr.exe 1296 trptrtr.exe -
Processes:
resource yara_rule behavioral1/memory/2124-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a00000001225c-5.dat upx behavioral1/memory/2124-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000018b05-16.dat upx behavioral1/memory/2816-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b50-25.dat upx behavioral1/files/0x0007000000018b54-33.dat upx behavioral1/memory/2948-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b59-42.dat upx behavioral1/memory/2836-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000018b71-53.dat upx behavioral1/memory/2756-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b89-64.dat upx behavioral1/files/0x000500000001975a-71.dat upx behavioral1/files/0x0005000000019761-79.dat upx behavioral1/memory/2592-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2812-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0003000000018334-89.dat upx behavioral1/memory/2252-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000197fd-98.dat upx behavioral1/files/0x0005000000019820-107.dat upx behavioral1/files/0x000500000001998d-117.dat upx behavioral1/memory/3020-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf6-134.dat upx behavioral1/files/0x0005000000019bf9-141.dat upx behavioral1/files/0x0005000000019d61-160.dat upx behavioral1/files/0x0005000000019d62-169.dat upx behavioral1/memory/2204-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2204-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d6d-177.dat upx behavioral1/files/0x0005000000019e92-184.dat upx behavioral1/files/0x0005000000019fd4-192.dat upx behavioral1/files/0x0005000000019fdd-200.dat upx behavioral1/files/0x000500000001a03c-206.dat upx behavioral1/files/0x000500000001a049-214.dat upx behavioral1/memory/2620-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a0b6-221.dat upx behavioral1/files/0x000500000001a309-230.dat upx behavioral1/memory/2420-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2492-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1612-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a3ab-239.dat upx behavioral1/files/0x000500000001a3f6-245.dat upx behavioral1/memory/288-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a3f8-252.dat upx behavioral1/files/0x000500000001a3fd-260.dat upx behavioral1/files/0x000500000001a400-267.dat upx behavioral1/memory/2392-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1632-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2896-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c3c-150.dat upx behavioral1/memory/2952-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2176-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf5-125.dat upx behavioral1/memory/3020-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1100-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/832-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/832-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/876-285-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
pjjltfj.exexdxhbp.exettvhf.exerrpjnn.exefhnbd.exehnbrr.exebjhvnfd.exehlfdt.exebnbxb.exetdhvfdl.exevltnx.exehhrhn.exeptpnhfh.exenjprx.exexprnp.exenrlfhl.exedftfl.exexjnrvbt.exerjxpb.exellnjv.exefthnxx.exexbndn.exedpfnvf.exefrprpfb.exevnlnnr.exebxlnhrl.exevjdtvhv.exenhbxrn.exeftrhp.exejftjj.exervrfb.exetbxfr.exefrbhrh.exebxfjxfl.exehpltnv.exexvbjbl.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjltfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdxhbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttvhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrpjnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhnbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjhvnfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlfdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdhvfdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vltnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhrhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptpnhfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njprx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xprnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrlfhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dftfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjnrvbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjxpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llnjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fthnxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbndn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpfnvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frprpfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnlnnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxlnhrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdtvhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbxrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftrhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jftjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvrfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frbhrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxfjxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpltnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvbjbl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3318a8da6ee4ff29b69ceba44a02cb8e1db123a6a866b48a5aa9bb808e97b582.exejbdnfx.exednphlp.exefthpj.exexllpl.exerbbxv.exednnhrl.exejhhrn.exebfvlt.exetrvpp.exedpjft.exexjnrvbt.exenffnl.exenptvj.exedtlrvfx.exelllrl.exedescription pid Process procid_target PID 2124 wrote to memory of 3012 2124 3318a8da6ee4ff29b69ceba44a02cb8e1db123a6a866b48a5aa9bb808e97b582.exe 29 PID 2124 wrote to memory of 3012 2124 3318a8da6ee4ff29b69ceba44a02cb8e1db123a6a866b48a5aa9bb808e97b582.exe 29 PID 2124 wrote to memory of 3012 2124 3318a8da6ee4ff29b69ceba44a02cb8e1db123a6a866b48a5aa9bb808e97b582.exe 29 PID 2124 wrote to memory of 3012 2124 3318a8da6ee4ff29b69ceba44a02cb8e1db123a6a866b48a5aa9bb808e97b582.exe 29 PID 3012 wrote to memory of 2816 3012 jbdnfx.exe 30 PID 3012 wrote to memory of 2816 3012 jbdnfx.exe 30 PID 3012 wrote to memory of 2816 3012 jbdnfx.exe 30 PID 3012 wrote to memory of 2816 3012 jbdnfx.exe 30 PID 2816 wrote to memory of 2948 2816 dnphlp.exe 31 PID 2816 wrote to memory of 2948 2816 dnphlp.exe 31 PID 2816 wrote to memory of 2948 2816 dnphlp.exe 31 PID 2816 wrote to memory of 2948 2816 dnphlp.exe 31 PID 2948 wrote to memory of 2836 2948 fthpj.exe 32 PID 2948 wrote to memory of 2836 2948 fthpj.exe 32 PID 2948 wrote to memory of 2836 2948 fthpj.exe 32 PID 2948 wrote to memory of 2836 2948 fthpj.exe 32 PID 2836 wrote to memory of 2636 2836 xllpl.exe 33 PID 2836 wrote to memory of 2636 2836 xllpl.exe 33 PID 2836 wrote to memory of 2636 2836 xllpl.exe 33 PID 2836 wrote to memory of 2636 2836 xllpl.exe 33 PID 2636 wrote to memory of 2756 2636 rbbxv.exe 34 PID 2636 wrote to memory of 2756 2636 rbbxv.exe 34 PID 2636 wrote to memory of 2756 2636 rbbxv.exe 34 PID 2636 wrote to memory of 2756 2636 rbbxv.exe 34 PID 2756 wrote to memory of 2768 2756 dnnhrl.exe 35 PID 2756 wrote to memory of 2768 2756 dnnhrl.exe 35 PID 2756 wrote to memory of 2768 2756 dnnhrl.exe 35 PID 2756 wrote to memory of 2768 2756 dnnhrl.exe 35 PID 2768 wrote to memory of 2592 2768 jhhrn.exe 36 PID 2768 wrote to memory of 2592 2768 jhhrn.exe 36 PID 2768 wrote to memory of 2592 2768 jhhrn.exe 36 PID 2768 wrote to memory of 2592 2768 jhhrn.exe 36 PID 2592 wrote to memory of 2812 2592 bfvlt.exe 37 PID 2592 wrote to memory of 2812 2592 bfvlt.exe 37 PID 2592 wrote to memory of 2812 2592 bfvlt.exe 37 PID 2592 wrote to memory of 2812 2592 bfvlt.exe 37 PID 2812 wrote to memory of 2252 2812 trvpp.exe 38 PID 2812 wrote to memory of 2252 2812 trvpp.exe 38 PID 2812 wrote to memory of 2252 2812 trvpp.exe 38 PID 2812 wrote to memory of 2252 2812 trvpp.exe 38 PID 2252 wrote to memory of 832 2252 dpjft.exe 39 PID 2252 wrote to memory of 832 2252 dpjft.exe 39 PID 2252 wrote to memory of 832 2252 dpjft.exe 39 PID 2252 wrote to memory of 832 2252 dpjft.exe 39 PID 832 wrote to memory of 1100 832 xjnrvbt.exe 40 PID 832 wrote to memory of 1100 832 xjnrvbt.exe 40 PID 832 wrote to memory of 1100 832 xjnrvbt.exe 40 PID 832 wrote to memory of 1100 832 xjnrvbt.exe 40 PID 1100 wrote to memory of 3020 1100 nffnl.exe 41 PID 1100 wrote to memory of 3020 1100 nffnl.exe 41 PID 1100 wrote to memory of 3020 1100 nffnl.exe 41 PID 1100 wrote to memory of 3020 1100 nffnl.exe 41 PID 3020 wrote to memory of 2176 3020 nptvj.exe 42 PID 3020 wrote to memory of 2176 3020 nptvj.exe 42 PID 3020 wrote to memory of 2176 3020 nptvj.exe 42 PID 3020 wrote to memory of 2176 3020 nptvj.exe 42 PID 2176 wrote to memory of 2952 2176 dtlrvfx.exe 43 PID 2176 wrote to memory of 2952 2176 dtlrvfx.exe 43 PID 2176 wrote to memory of 2952 2176 dtlrvfx.exe 43 PID 2176 wrote to memory of 2952 2176 dtlrvfx.exe 43 PID 2952 wrote to memory of 2024 2952 lllrl.exe 44 PID 2952 wrote to memory of 2024 2952 lllrl.exe 44 PID 2952 wrote to memory of 2024 2952 lllrl.exe 44 PID 2952 wrote to memory of 2024 2952 lllrl.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\3318a8da6ee4ff29b69ceba44a02cb8e1db123a6a866b48a5aa9bb808e97b582.exe"C:\Users\Admin\AppData\Local\Temp\3318a8da6ee4ff29b69ceba44a02cb8e1db123a6a866b48a5aa9bb808e97b582.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\jbdnfx.exec:\jbdnfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\dnphlp.exec:\dnphlp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\fthpj.exec:\fthpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\xllpl.exec:\xllpl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\rbbxv.exec:\rbbxv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\dnnhrl.exec:\dnnhrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\jhhrn.exec:\jhhrn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\bfvlt.exec:\bfvlt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\trvpp.exec:\trvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\dpjft.exec:\dpjft.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\xjnrvbt.exec:\xjnrvbt.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\nffnl.exec:\nffnl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\nptvj.exec:\nptvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\dtlrvfx.exec:\dtlrvfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\lllrl.exec:\lllrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\bjdhj.exec:\bjdhj.exe17⤵
- Executes dropped EXE
PID:2024 -
\??\c:\hptttlf.exec:\hptttlf.exe18⤵
- Executes dropped EXE
PID:2896 -
\??\c:\rltljlt.exec:\rltljlt.exe19⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lxvjl.exec:\lxvjl.exe20⤵
- Executes dropped EXE
PID:2204 -
\??\c:\ndtph.exec:\ndtph.exe21⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rddhrfj.exec:\rddhrfj.exe22⤵
- Executes dropped EXE
PID:2492 -
\??\c:\dxlfh.exec:\dxlfh.exe23⤵
- Executes dropped EXE
PID:2056 -
\??\c:\vbdfb.exec:\vbdfb.exe24⤵
- Executes dropped EXE
PID:1716 -
\??\c:\xvjbpnd.exec:\xvjbpnd.exe25⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jpllfjn.exec:\jpllfjn.exe26⤵
- Executes dropped EXE
PID:1644 -
\??\c:\bjnfhtb.exec:\bjnfhtb.exe27⤵
- Executes dropped EXE
PID:2420 -
\??\c:\xprnp.exec:\xprnp.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:288 -
\??\c:\fpnhxhj.exec:\fpnhxhj.exe29⤵
- Executes dropped EXE
PID:1816 -
\??\c:\jflhpnn.exec:\jflhpnn.exe30⤵
- Executes dropped EXE
PID:1396 -
\??\c:\ljjvjhx.exec:\ljjvjhx.exe31⤵
- Executes dropped EXE
PID:948 -
\??\c:\rjxxp.exec:\rjxxp.exe32⤵
- Executes dropped EXE
PID:1756 -
\??\c:\nbhhf.exec:\nbhhf.exe33⤵
- Executes dropped EXE
PID:2392 -
\??\c:\dbfnvxv.exec:\dbfnvxv.exe34⤵
- Executes dropped EXE
PID:1632 -
\??\c:\rhrdj.exec:\rhrdj.exe35⤵
- Executes dropped EXE
PID:2964 -
\??\c:\dxpphf.exec:\dxpphf.exe36⤵
- Executes dropped EXE
PID:876 -
\??\c:\vjldb.exec:\vjldb.exe37⤵
- Executes dropped EXE
PID:2256 -
\??\c:\pbttl.exec:\pbttl.exe38⤵
- Executes dropped EXE
PID:1516 -
\??\c:\dbxjrb.exec:\dbxjrb.exe39⤵
- Executes dropped EXE
PID:2856 -
\??\c:\nfhvnt.exec:\nfhvnt.exe40⤵
- Executes dropped EXE
PID:1708 -
\??\c:\jjvdr.exec:\jjvdr.exe41⤵
- Executes dropped EXE
PID:2984 -
\??\c:\hdvnf.exec:\hdvnf.exe42⤵
- Executes dropped EXE
PID:2316 -
\??\c:\bxhlfvn.exec:\bxhlfvn.exe43⤵
- Executes dropped EXE
PID:2992 -
\??\c:\lvdhdf.exec:\lvdhdf.exe44⤵
- Executes dropped EXE
PID:2828 -
\??\c:\hblnv.exec:\hblnv.exe45⤵
- Executes dropped EXE
PID:2748 -
\??\c:\drtnxxf.exec:\drtnxxf.exe46⤵
- Executes dropped EXE
PID:2784 -
\??\c:\tdrpn.exec:\tdrpn.exe47⤵
- Executes dropped EXE
PID:2876 -
\??\c:\lfnbxhp.exec:\lfnbxhp.exe48⤵
- Executes dropped EXE
PID:2600 -
\??\c:\hvhbt.exec:\hvhbt.exe49⤵
- Executes dropped EXE
PID:2304 -
\??\c:\rpdxh.exec:\rpdxh.exe50⤵
- Executes dropped EXE
PID:2588 -
\??\c:\hljxd.exec:\hljxd.exe51⤵
- Executes dropped EXE
PID:2508 -
\??\c:\rjhbpr.exec:\rjhbpr.exe52⤵
- Executes dropped EXE
PID:2252 -
\??\c:\vjblxhb.exec:\vjblxhb.exe53⤵
- Executes dropped EXE
PID:1136 -
\??\c:\jdxdph.exec:\jdxdph.exe54⤵
- Executes dropped EXE
PID:2956 -
\??\c:\pdpdbfr.exec:\pdpdbfr.exe55⤵
- Executes dropped EXE
PID:3064 -
\??\c:\vhfdll.exec:\vhfdll.exe56⤵
- Executes dropped EXE
PID:2116 -
\??\c:\nlrddn.exec:\nlrddn.exe57⤵
- Executes dropped EXE
PID:1020 -
\??\c:\rlhdjhn.exec:\rlhdjhn.exe58⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jxdhxnf.exec:\jxdhxnf.exe59⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xxftjf.exec:\xxftjf.exe60⤵
- Executes dropped EXE
PID:584 -
\??\c:\pbvpjf.exec:\pbvpjf.exe61⤵
- Executes dropped EXE
PID:2896 -
\??\c:\jdrhpvx.exec:\jdrhpvx.exe62⤵
- Executes dropped EXE
PID:2764 -
\??\c:\pjtfj.exec:\pjtfj.exe63⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hrhdr.exec:\hrhdr.exe64⤵
- Executes dropped EXE
PID:800 -
\??\c:\trptrtr.exec:\trptrtr.exe65⤵
- Executes dropped EXE
PID:1296 -
\??\c:\xjdrbx.exec:\xjdrbx.exe66⤵PID:592
-
\??\c:\nbbpdvp.exec:\nbbpdvp.exe67⤵PID:2212
-
\??\c:\jhdhp.exec:\jhdhp.exe68⤵PID:2432
-
\??\c:\ntvvxn.exec:\ntvvxn.exe69⤵PID:1124
-
\??\c:\hjnpbjr.exec:\hjnpbjr.exe70⤵PID:2684
-
\??\c:\hvrfxf.exec:\hvrfxf.exe71⤵PID:972
-
\??\c:\hpjpfbn.exec:\hpjpfbn.exe72⤵PID:1776
-
\??\c:\npfpbxj.exec:\npfpbxj.exe73⤵PID:1052
-
\??\c:\xrjjtx.exec:\xrjjtx.exe74⤵PID:2128
-
\??\c:\txxfjx.exec:\txxfjx.exe75⤵PID:680
-
\??\c:\bnnlp.exec:\bnnlp.exe76⤵PID:640
-
\??\c:\jftjj.exec:\jftjj.exe77⤵
- System Location Discovery: System Language Discovery
PID:2444 -
\??\c:\dtpjvh.exec:\dtpjvh.exe78⤵PID:2284
-
\??\c:\xplnd.exec:\xplnd.exe79⤵PID:948
-
\??\c:\jbhfjr.exec:\jbhfjr.exe80⤵PID:1756
-
\??\c:\jjrhxnl.exec:\jjrhxnl.exe81⤵PID:2376
-
\??\c:\vpfnh.exec:\vpfnh.exe82⤵PID:2648
-
\??\c:\nrlfhl.exec:\nrlfhl.exe83⤵
- System Location Discovery: System Language Discovery
PID:2384 -
\??\c:\xjjrb.exec:\xjjrb.exe84⤵PID:316
-
\??\c:\dprnfv.exec:\dprnfv.exe85⤵PID:2892
-
\??\c:\rvfhtrj.exec:\rvfhtrj.exe86⤵PID:1620
-
\??\c:\nrntx.exec:\nrntx.exe87⤵PID:2144
-
\??\c:\dvxnjp.exec:\dvxnjp.exe88⤵PID:2856
-
\??\c:\ltlflx.exec:\ltlflx.exe89⤵PID:1600
-
\??\c:\dtrttr.exec:\dtrttr.exe90⤵PID:2988
-
\??\c:\rdvvhv.exec:\rdvvhv.exe91⤵PID:2456
-
\??\c:\pplhv.exec:\pplhv.exe92⤵PID:2572
-
\??\c:\phpfvhd.exec:\phpfvhd.exe93⤵PID:2872
-
\??\c:\bjpbf.exec:\bjpbf.exe94⤵PID:1048
-
\??\c:\dtjrx.exec:\dtjrx.exe95⤵PID:2832
-
\??\c:\llnjv.exec:\llnjv.exe96⤵
- System Location Discovery: System Language Discovery
PID:2768 -
\??\c:\hvxrbv.exec:\hvxrbv.exe97⤵PID:2196
-
\??\c:\prvrbv.exec:\prvrbv.exe98⤵PID:3008
-
\??\c:\npxxn.exec:\npxxn.exe99⤵PID:2732
-
\??\c:\vppfhtd.exec:\vppfhtd.exe100⤵PID:2508
-
\??\c:\vdnxrxv.exec:\vdnxrxv.exe101⤵PID:2092
-
\??\c:\rxhnblb.exec:\rxhnblb.exe102⤵PID:2612
-
\??\c:\hplhfdv.exec:\hplhfdv.exe103⤵PID:1100
-
\??\c:\xjhtbb.exec:\xjhtbb.exe104⤵PID:3064
-
\??\c:\fxvhx.exec:\fxvhx.exe105⤵PID:2116
-
\??\c:\rhpdhxp.exec:\rhpdhxp.exe106⤵PID:1020
-
\??\c:\hpblbb.exec:\hpblbb.exe107⤵PID:1400
-
\??\c:\pjfhtf.exec:\pjfhtf.exe108⤵PID:2568
-
\??\c:\vbvfxb.exec:\vbvfxb.exe109⤵PID:1096
-
\??\c:\xtdjd.exec:\xtdjd.exe110⤵PID:2188
-
\??\c:\hjxdt.exec:\hjxdt.exe111⤵PID:1728
-
\??\c:\ttddnrx.exec:\ttddnrx.exe112⤵PID:2488
-
\??\c:\vhrfpp.exec:\vhrfpp.exe113⤵PID:3060
-
\??\c:\ljppxx.exec:\ljppxx.exe114⤵PID:2004
-
\??\c:\ndjxb.exec:\ndjxb.exe115⤵PID:2076
-
\??\c:\xlldhrt.exec:\xlldhrt.exe116⤵PID:1812
-
\??\c:\xdppbp.exec:\xdppbp.exe117⤵PID:2056
-
\??\c:\bpftndh.exec:\bpftndh.exe118⤵PID:1716
-
\??\c:\vjxvphd.exec:\vjxvphd.exe119⤵PID:2012
-
\??\c:\prlrvb.exec:\prlrvb.exe120⤵PID:340
-
\??\c:\pvhthr.exec:\pvhthr.exe121⤵PID:2032
-
\??\c:\jlrlv.exec:\jlrlv.exe122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-