Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 21:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe
-
Size
332KB
-
MD5
c627dddffa7434e42384fbb2b307622c
-
SHA1
526fd0d28ae693bd9813ebbed46a5bfe297efac1
-
SHA256
30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0
-
SHA512
3eb5903d056bddfdaf2e1dc693137b1b17bdd7401f0df856da09403aeb19ded80cd3aaa145369e3f7bb0a193d608cd58d70508cfd7c2eabc2e902a32dab720f6
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhP:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2548-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-56-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1048-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-79-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1836-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-114-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/784-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-132-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2000-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/548-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-219-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1104-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-358-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/932-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-403-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1528-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-464-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2260-476-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2200-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-517-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1932-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-607-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-621-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1468-695-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/284-736-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1524-741-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2896-896-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1156-939-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2956 xbfxb.exe 2912 pjnjfj.exe 3008 pnxtl.exe 2904 rnjrrbt.exe 1048 jnnptnr.exe 2908 xvvhldp.exe 2780 frbnlrx.exe 2508 vnrldvb.exe 1836 rjjpf.exe 1528 frnbhhh.exe 2352 xjxnb.exe 784 thjlj.exe 1952 jrbrbrp.exe 2212 pvfbf.exe 3024 hlfbh.exe 2000 xjpbbhh.exe 548 nxftxl.exe 2436 fllpr.exe 2400 ljjth.exe 2248 pptrbb.exe 2220 pddnl.exe 2200 htfrvtd.exe 2692 nfdbrtf.exe 1104 nbdrx.exe 1704 jbdvr.exe 880 nttnnb.exe 2484 hnpfdvx.exe 1544 nxfxl.exe 1300 fffrbnl.exe 1688 jfjrx.exe 2608 bxvhp.exe 1808 vvdhp.exe 2488 tdxdhl.exe 2956 ndtfnt.exe 1608 rrtpn.exe 2984 hprxh.exe 2896 vtttfpj.exe 3056 rbhvj.exe 3060 lrvnj.exe 2884 fxbjvv.exe 804 fvtvjd.exe 2844 tplbhf.exe 836 njbnnt.exe 2508 vrrdj.exe 1044 ljfrhh.exe 932 ptpdj.exe 1528 npjvnhj.exe 1392 vlxxnjp.exe 1276 hvttxld.exe 944 tdbrpnv.exe 1952 htbbbtd.exe 2300 jthnjpv.exe 1712 pbdpn.exe 284 drnjrb.exe 1768 xprfjx.exe 2420 dhbrbl.exe 2408 lvtvp.exe 2260 lrpphh.exe 2440 xxbdt.exe 1876 thtxjnp.exe 1972 ldxpl.exe 2200 bdhvbpt.exe 2016 hndxh.exe 2140 phbbjjv.exe -
resource yara_rule behavioral1/memory/2548-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-358-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/932-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-911-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-919-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-932-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-939-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbnxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txvbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjrhdbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbvbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pphnhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrbnxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjjpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnljhpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttxjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhlvblr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvfvbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvjnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhlrftr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxjnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pptrbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjjfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blnhxfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnprjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrxbrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjpnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnrtflb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdpbbrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfppr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdbrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llpxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frprlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtbpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjlttj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njdtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpfxxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnjbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbrltth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnrfn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2956 2548 30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe 30 PID 2548 wrote to memory of 2956 2548 30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe 30 PID 2548 wrote to memory of 2956 2548 30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe 30 PID 2548 wrote to memory of 2956 2548 30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe 30 PID 2956 wrote to memory of 2912 2956 xbfxb.exe 31 PID 2956 wrote to memory of 2912 2956 xbfxb.exe 31 PID 2956 wrote to memory of 2912 2956 xbfxb.exe 31 PID 2956 wrote to memory of 2912 2956 xbfxb.exe 31 PID 2912 wrote to memory of 3008 2912 pjnjfj.exe 32 PID 2912 wrote to memory of 3008 2912 pjnjfj.exe 32 PID 2912 wrote to memory of 3008 2912 pjnjfj.exe 32 PID 2912 wrote to memory of 3008 2912 pjnjfj.exe 32 PID 3008 wrote to memory of 2904 3008 pnxtl.exe 33 PID 3008 wrote to memory of 2904 3008 pnxtl.exe 33 PID 3008 wrote to memory of 2904 3008 pnxtl.exe 33 PID 3008 wrote to memory of 2904 3008 pnxtl.exe 33 PID 2904 wrote to memory of 1048 2904 rnjrrbt.exe 34 PID 2904 wrote to memory of 1048 2904 rnjrrbt.exe 34 PID 2904 wrote to memory of 1048 2904 rnjrrbt.exe 34 PID 2904 wrote to memory of 1048 2904 rnjrrbt.exe 34 PID 1048 wrote to memory of 2908 1048 jnnptnr.exe 35 PID 1048 wrote to memory of 2908 1048 jnnptnr.exe 35 PID 1048 wrote to memory of 2908 1048 jnnptnr.exe 35 PID 1048 wrote to memory of 2908 1048 jnnptnr.exe 35 PID 2908 wrote to memory of 2780 2908 xvvhldp.exe 36 PID 2908 wrote to memory of 2780 2908 xvvhldp.exe 36 PID 2908 wrote to memory of 2780 2908 xvvhldp.exe 36 PID 2908 wrote to memory of 2780 2908 xvvhldp.exe 36 PID 2780 wrote to memory of 2508 2780 frbnlrx.exe 37 PID 2780 wrote to memory of 2508 2780 frbnlrx.exe 37 PID 2780 wrote to memory of 2508 2780 frbnlrx.exe 37 PID 2780 wrote to memory of 2508 2780 frbnlrx.exe 37 PID 2508 wrote to memory of 1836 2508 vnrldvb.exe 38 PID 2508 wrote to memory of 1836 2508 vnrldvb.exe 38 PID 2508 wrote to memory of 1836 2508 vnrldvb.exe 38 PID 2508 wrote to memory of 1836 2508 vnrldvb.exe 38 PID 1836 wrote to memory of 1528 1836 rjjpf.exe 39 PID 1836 wrote to memory of 1528 1836 rjjpf.exe 39 PID 1836 wrote to memory of 1528 1836 rjjpf.exe 39 PID 1836 wrote to memory of 1528 1836 rjjpf.exe 39 PID 1528 wrote to memory of 2352 1528 frnbhhh.exe 40 PID 1528 wrote to memory of 2352 1528 frnbhhh.exe 40 PID 1528 wrote to memory of 2352 1528 frnbhhh.exe 40 PID 1528 wrote to memory of 2352 1528 frnbhhh.exe 40 PID 2352 wrote to memory of 784 2352 xjxnb.exe 41 PID 2352 wrote to memory of 784 2352 xjxnb.exe 41 PID 2352 wrote to memory of 784 2352 xjxnb.exe 41 PID 2352 wrote to memory of 784 2352 xjxnb.exe 41 PID 784 wrote to memory of 1952 784 thjlj.exe 42 PID 784 wrote to memory of 1952 784 thjlj.exe 42 PID 784 wrote to memory of 1952 784 thjlj.exe 42 PID 784 wrote to memory of 1952 784 thjlj.exe 42 PID 1952 wrote to memory of 2212 1952 jrbrbrp.exe 43 PID 1952 wrote to memory of 2212 1952 jrbrbrp.exe 43 PID 1952 wrote to memory of 2212 1952 jrbrbrp.exe 43 PID 1952 wrote to memory of 2212 1952 jrbrbrp.exe 43 PID 2212 wrote to memory of 3024 2212 pvfbf.exe 44 PID 2212 wrote to memory of 3024 2212 pvfbf.exe 44 PID 2212 wrote to memory of 3024 2212 pvfbf.exe 44 PID 2212 wrote to memory of 3024 2212 pvfbf.exe 44 PID 3024 wrote to memory of 2000 3024 hlfbh.exe 45 PID 3024 wrote to memory of 2000 3024 hlfbh.exe 45 PID 3024 wrote to memory of 2000 3024 hlfbh.exe 45 PID 3024 wrote to memory of 2000 3024 hlfbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe"C:\Users\Admin\AppData\Local\Temp\30e9c6b33b971b438c0b3db5ea0964fc7d1cab9c2131294e18591b5540b38aa0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\xbfxb.exec:\xbfxb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\pjnjfj.exec:\pjnjfj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\pnxtl.exec:\pnxtl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\rnjrrbt.exec:\rnjrrbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\jnnptnr.exec:\jnnptnr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\xvvhldp.exec:\xvvhldp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\frbnlrx.exec:\frbnlrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\vnrldvb.exec:\vnrldvb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\rjjpf.exec:\rjjpf.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\frnbhhh.exec:\frnbhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\xjxnb.exec:\xjxnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\thjlj.exec:\thjlj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\jrbrbrp.exec:\jrbrbrp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\pvfbf.exec:\pvfbf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\hlfbh.exec:\hlfbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\xjpbbhh.exec:\xjpbbhh.exe17⤵
- Executes dropped EXE
PID:2000 -
\??\c:\nxftxl.exec:\nxftxl.exe18⤵
- Executes dropped EXE
PID:548 -
\??\c:\fllpr.exec:\fllpr.exe19⤵
- Executes dropped EXE
PID:2436 -
\??\c:\ljjth.exec:\ljjth.exe20⤵
- Executes dropped EXE
PID:2400 -
\??\c:\pptrbb.exec:\pptrbb.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2248 -
\??\c:\pddnl.exec:\pddnl.exe22⤵
- Executes dropped EXE
PID:2220 -
\??\c:\htfrvtd.exec:\htfrvtd.exe23⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nfdbrtf.exec:\nfdbrtf.exe24⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nbdrx.exec:\nbdrx.exe25⤵
- Executes dropped EXE
PID:1104 -
\??\c:\jbdvr.exec:\jbdvr.exe26⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nttnnb.exec:\nttnnb.exe27⤵
- Executes dropped EXE
PID:880 -
\??\c:\hnpfdvx.exec:\hnpfdvx.exe28⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nxfxl.exec:\nxfxl.exe29⤵
- Executes dropped EXE
PID:1544 -
\??\c:\fffrbnl.exec:\fffrbnl.exe30⤵
- Executes dropped EXE
PID:1300 -
\??\c:\jfjrx.exec:\jfjrx.exe31⤵
- Executes dropped EXE
PID:1688 -
\??\c:\bxvhp.exec:\bxvhp.exe32⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vvdhp.exec:\vvdhp.exe33⤵
- Executes dropped EXE
PID:1808 -
\??\c:\tdxdhl.exec:\tdxdhl.exe34⤵
- Executes dropped EXE
PID:2488 -
\??\c:\ndtfnt.exec:\ndtfnt.exe35⤵
- Executes dropped EXE
PID:2956 -
\??\c:\rrtpn.exec:\rrtpn.exe36⤵
- Executes dropped EXE
PID:1608 -
\??\c:\hprxh.exec:\hprxh.exe37⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vtttfpj.exec:\vtttfpj.exe38⤵
- Executes dropped EXE
PID:2896 -
\??\c:\rbhvj.exec:\rbhvj.exe39⤵
- Executes dropped EXE
PID:3056 -
\??\c:\lrvnj.exec:\lrvnj.exe40⤵
- Executes dropped EXE
PID:3060 -
\??\c:\fxbjvv.exec:\fxbjvv.exe41⤵
- Executes dropped EXE
PID:2884 -
\??\c:\fvtvjd.exec:\fvtvjd.exe42⤵
- Executes dropped EXE
PID:804 -
\??\c:\tplbhf.exec:\tplbhf.exe43⤵
- Executes dropped EXE
PID:2844 -
\??\c:\njbnnt.exec:\njbnnt.exe44⤵
- Executes dropped EXE
PID:836 -
\??\c:\vrrdj.exec:\vrrdj.exe45⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ljfrhh.exec:\ljfrhh.exe46⤵
- Executes dropped EXE
PID:1044 -
\??\c:\ptpdj.exec:\ptpdj.exe47⤵
- Executes dropped EXE
PID:932 -
\??\c:\npjvnhj.exec:\npjvnhj.exe48⤵
- Executes dropped EXE
PID:1528 -
\??\c:\vlxxnjp.exec:\vlxxnjp.exe49⤵
- Executes dropped EXE
PID:1392 -
\??\c:\hvttxld.exec:\hvttxld.exe50⤵
- Executes dropped EXE
PID:1276 -
\??\c:\tdbrpnv.exec:\tdbrpnv.exe51⤵
- Executes dropped EXE
PID:944 -
\??\c:\htbbbtd.exec:\htbbbtd.exe52⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jthnjpv.exec:\jthnjpv.exe53⤵
- Executes dropped EXE
PID:2300 -
\??\c:\pbdpn.exec:\pbdpn.exe54⤵
- Executes dropped EXE
PID:1712 -
\??\c:\drnjrb.exec:\drnjrb.exe55⤵
- Executes dropped EXE
PID:284 -
\??\c:\xprfjx.exec:\xprfjx.exe56⤵
- Executes dropped EXE
PID:1768 -
\??\c:\dhbrbl.exec:\dhbrbl.exe57⤵
- Executes dropped EXE
PID:2420 -
\??\c:\lvtvp.exec:\lvtvp.exe58⤵
- Executes dropped EXE
PID:2408 -
\??\c:\lrpphh.exec:\lrpphh.exe59⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xxbdt.exec:\xxbdt.exe60⤵
- Executes dropped EXE
PID:2440 -
\??\c:\thtxjnp.exec:\thtxjnp.exe61⤵
- Executes dropped EXE
PID:1876 -
\??\c:\ldxpl.exec:\ldxpl.exe62⤵
- Executes dropped EXE
PID:1972 -
\??\c:\bdhvbpt.exec:\bdhvbpt.exe63⤵
- Executes dropped EXE
PID:2200 -
\??\c:\hndxh.exec:\hndxh.exe64⤵
- Executes dropped EXE
PID:2016 -
\??\c:\phbbjjv.exec:\phbbjjv.exe65⤵
- Executes dropped EXE
PID:2140 -
\??\c:\dfdnf.exec:\dfdnf.exe66⤵PID:1508
-
\??\c:\phrltn.exec:\phrltn.exe67⤵PID:1932
-
\??\c:\jhdxtnv.exec:\jhdxtnv.exe68⤵PID:1772
-
\??\c:\jjlttj.exec:\jjlttj.exe69⤵
- System Location Discovery: System Language Discovery
PID:2484 -
\??\c:\rblxv.exec:\rblxv.exe70⤵PID:1060
-
\??\c:\lbxjtfb.exec:\lbxjtfb.exe71⤵PID:1736
-
\??\c:\bdjxbjb.exec:\bdjxbjb.exe72⤵PID:1328
-
\??\c:\jnxjvph.exec:\jnxjvph.exe73⤵PID:2580
-
\??\c:\pvrftrj.exec:\pvrftrj.exe74⤵PID:1680
-
\??\c:\flfdl.exec:\flfdl.exe75⤵PID:2012
-
\??\c:\pdnvrbh.exec:\pdnvrbh.exe76⤵PID:1272
-
\??\c:\hdxdvl.exec:\hdxdvl.exe77⤵PID:2488
-
\??\c:\thhxxn.exec:\thhxxn.exe78⤵PID:1616
-
\??\c:\frxvfj.exec:\frxvfj.exe79⤵PID:1608
-
\??\c:\dbjhx.exec:\dbjhx.exe80⤵PID:3020
-
\??\c:\vdnlf.exec:\vdnlf.exe81⤵PID:2996
-
\??\c:\bffphf.exec:\bffphf.exe82⤵PID:2888
-
\??\c:\thfpvfj.exec:\thfpvfj.exe83⤵PID:2964
-
\??\c:\xhlrftr.exec:\xhlrftr.exe84⤵
- System Location Discovery: System Language Discovery
PID:2944 -
\??\c:\jnfbpxt.exec:\jnfbpxt.exe85⤵PID:2908
-
\??\c:\npjllr.exec:\npjllr.exe86⤵PID:2364
-
\??\c:\hvlbhp.exec:\hvlbhp.exe87⤵PID:1388
-
\??\c:\drpdjr.exec:\drpdjr.exe88⤵PID:1652
-
\??\c:\hllxttd.exec:\hllxttd.exe89⤵PID:1920
-
\??\c:\jjdfhpx.exec:\jjdfhpx.exe90⤵PID:1468
-
\??\c:\dlbfpj.exec:\dlbfpj.exe91⤵PID:2948
-
\??\c:\xlrtxhb.exec:\xlrtxhb.exe92⤵PID:316
-
\??\c:\dvbnb.exec:\dvbnb.exe93⤵PID:1956
-
\??\c:\jlldv.exec:\jlldv.exe94⤵PID:2872
-
\??\c:\tbxdbt.exec:\tbxdbt.exe95⤵PID:944
-
\??\c:\thbnxf.exec:\thbnxf.exe96⤵
- System Location Discovery: System Language Discovery
PID:2084 -
\??\c:\djlvtl.exec:\djlvtl.exe97⤵PID:2300
-
\??\c:\rnxbld.exec:\rnxbld.exe98⤵PID:760
-
\??\c:\djjpjf.exec:\djjpjf.exe99⤵PID:284
-
\??\c:\bhrtr.exec:\bhrtr.exe100⤵PID:1524
-
\??\c:\npxvpf.exec:\npxvpf.exe101⤵PID:2176
-
\??\c:\ptvdr.exec:\ptvdr.exe102⤵PID:2232
-
\??\c:\dbvjtb.exec:\dbvjtb.exe103⤵PID:2468
-
\??\c:\njjjdl.exec:\njjjdl.exe104⤵PID:2188
-
\??\c:\ffhfr.exec:\ffhfr.exe105⤵PID:2168
-
\??\c:\jdxbb.exec:\jdxbb.exe106⤵PID:1972
-
\??\c:\thfrrf.exec:\thfrrf.exe107⤵PID:720
-
\??\c:\hrrnjp.exec:\hrrnjp.exe108⤵PID:2016
-
\??\c:\fttnvj.exec:\fttnvj.exe109⤵PID:1100
-
\??\c:\jnljhpj.exec:\jnljhpj.exe110⤵
- System Location Discovery: System Language Discovery
PID:1280 -
\??\c:\jphhn.exec:\jphhn.exe111⤵PID:1932
-
\??\c:\btdjn.exec:\btdjn.exe112⤵PID:1436
-
\??\c:\fxvfjd.exec:\fxvfjd.exe113⤵PID:108
-
\??\c:\prxhrn.exec:\prxhrn.exe114⤵PID:1676
-
\??\c:\lbvbvj.exec:\lbvbvj.exe115⤵PID:1300
-
\??\c:\nvpxrt.exec:\nvpxrt.exe116⤵PID:940
-
\??\c:\ttblpdh.exec:\ttblpdh.exe117⤵PID:772
-
\??\c:\llpxr.exec:\llpxr.exe118⤵
- System Location Discovery: System Language Discovery
PID:2560 -
\??\c:\bttpxrr.exec:\bttpxrr.exe119⤵PID:2620
-
\??\c:\jffnjjn.exec:\jffnjjn.exe120⤵PID:2548
-
\??\c:\bffvj.exec:\bffvj.exe121⤵PID:2968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-