Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 00:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
642b6c52b29a090b4acef85c8c9f287394ccbe718411c3d801a0f6238c8f8d61.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
642b6c52b29a090b4acef85c8c9f287394ccbe718411c3d801a0f6238c8f8d61.exe
-
Size
453KB
-
MD5
43329281f879a335bbbfb81dae3dcc5f
-
SHA1
67ea86f7a992c3c7754e850ee448c66d57ad4d1f
-
SHA256
642b6c52b29a090b4acef85c8c9f287394ccbe718411c3d801a0f6238c8f8d61
-
SHA512
4fe6cd4b4a93fcba6581035773876557a4d9818845809fd0b8c77d22859fccc92e487e7656c017efc04f2396f7a0f47211a31cf38e3b76d6ab43c9e91f02491f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/760-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1224-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/432-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-239-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1796-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-276-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/888-300-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1736-328-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2128-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-547-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2628-554-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2116-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-606-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2840-657-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2408-782-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1524-861-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 760 rtdhv.exe 1224 hvhbvp.exe 2912 drjjtl.exe 2144 brxjd.exe 2304 njhbp.exe 2848 lhddbx.exe 2812 hplrfhv.exe 2572 bfvdhv.exe 2380 nlrtvft.exe 1988 vdrjvf.exe 2260 bpdlxv.exe 2908 tfpjt.exe 1436 rbhvhdx.exe 432 nxpvn.exe 980 pnvdrl.exe 2032 drvhlnt.exe 904 hpdhjfj.exe 1304 pntlbtb.exe 2308 lphvv.exe 2124 brjltp.exe 2404 pjjlj.exe 2328 dlnxff.exe 912 txdtrj.exe 2732 xnltr.exe 1796 vdtdl.exe 1004 nxrnjbl.exe 2204 jhrvxp.exe 1088 pjjpdp.exe 2096 rhhpbv.exe 1668 hrhbvf.exe 1524 pnvdhf.exe 888 lfrjn.exe 1736 bfxlxx.exe 1236 lvxpbb.exe 2164 bvdxv.exe 1704 lfrxb.exe 2020 nfnhv.exe 2128 lfjhjh.exe 2496 ppnvtj.exe 2924 rhfnx.exe 1804 rhfvfn.exe 2864 hjfddr.exe 2856 pdjfbv.exe 2484 jhldf.exe 264 nntjjhb.exe 1132 bdvvvx.exe 984 bljbxr.exe 1516 hpfpvr.exe 1460 flhfr.exe 1832 nbtbbt.exe 1660 djpxbd.exe 1780 vphhrxv.exe 608 fphtdpb.exe 2600 xxdxhfl.exe 2032 tjthjpv.exe 1760 ndtlbbr.exe 2216 hndfthb.exe 2060 tlfpx.exe 1424 phprllf.exe 2472 pjnvl.exe 2064 plnvnpx.exe 680 njtpbd.exe 756 rtvhn.exe 1080 dfhpb.exe -
resource yara_rule behavioral1/memory/760-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/432-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-257-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2128-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-657-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1524-861-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbdvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfbpdvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljpbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vljtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fddfnxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvdxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vphhrxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thvnnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbvrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvpjlxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnfrjxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlpfptx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfdlrxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpdlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdvpvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlprl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plhjvdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlvntvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhrbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdrpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfbdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnxnfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjrtjpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rldrbdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntvpjhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljfbxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brjltp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hphbrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjbbfhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpjjttr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvnrbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdhrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 760 2116 642b6c52b29a090b4acef85c8c9f287394ccbe718411c3d801a0f6238c8f8d61.exe 30 PID 2116 wrote to memory of 760 2116 642b6c52b29a090b4acef85c8c9f287394ccbe718411c3d801a0f6238c8f8d61.exe 30 PID 2116 wrote to memory of 760 2116 642b6c52b29a090b4acef85c8c9f287394ccbe718411c3d801a0f6238c8f8d61.exe 30 PID 2116 wrote to memory of 760 2116 642b6c52b29a090b4acef85c8c9f287394ccbe718411c3d801a0f6238c8f8d61.exe 30 PID 760 wrote to memory of 1224 760 rtdhv.exe 31 PID 760 wrote to memory of 1224 760 rtdhv.exe 31 PID 760 wrote to memory of 1224 760 rtdhv.exe 31 PID 760 wrote to memory of 1224 760 rtdhv.exe 31 PID 1224 wrote to memory of 2912 1224 hvhbvp.exe 32 PID 1224 wrote to memory of 2912 1224 hvhbvp.exe 32 PID 1224 wrote to memory of 2912 1224 hvhbvp.exe 32 PID 1224 wrote to memory of 2912 1224 hvhbvp.exe 32 PID 2912 wrote to memory of 2144 2912 drjjtl.exe 33 PID 2912 wrote to memory of 2144 2912 drjjtl.exe 33 PID 2912 wrote to memory of 2144 2912 drjjtl.exe 33 PID 2912 wrote to memory of 2144 2912 drjjtl.exe 33 PID 2144 wrote to memory of 2304 2144 brxjd.exe 34 PID 2144 wrote to memory of 2304 2144 brxjd.exe 34 PID 2144 wrote to memory of 2304 2144 brxjd.exe 34 PID 2144 wrote to memory of 2304 2144 brxjd.exe 34 PID 2304 wrote to memory of 2848 2304 njhbp.exe 35 PID 2304 wrote to memory of 2848 2304 njhbp.exe 35 PID 2304 wrote to memory of 2848 2304 njhbp.exe 35 PID 2304 wrote to memory of 2848 2304 njhbp.exe 35 PID 2848 wrote to memory of 2812 2848 lhddbx.exe 36 PID 2848 wrote to memory of 2812 2848 lhddbx.exe 36 PID 2848 wrote to memory of 2812 2848 lhddbx.exe 36 PID 2848 wrote to memory of 2812 2848 lhddbx.exe 36 PID 2812 wrote to memory of 2572 2812 hplrfhv.exe 37 PID 2812 wrote to memory of 2572 2812 hplrfhv.exe 37 PID 2812 wrote to memory of 2572 2812 hplrfhv.exe 37 PID 2812 wrote to memory of 2572 2812 hplrfhv.exe 37 PID 2572 wrote to memory of 2380 2572 bfvdhv.exe 38 PID 2572 wrote to memory of 2380 2572 bfvdhv.exe 38 PID 2572 wrote to memory of 2380 2572 bfvdhv.exe 38 PID 2572 wrote to memory of 2380 2572 bfvdhv.exe 38 PID 2380 wrote to memory of 1988 2380 nlrtvft.exe 39 PID 2380 wrote to memory of 1988 2380 nlrtvft.exe 39 PID 2380 wrote to memory of 1988 2380 nlrtvft.exe 39 PID 2380 wrote to memory of 1988 2380 nlrtvft.exe 39 PID 1988 wrote to memory of 2260 1988 vdrjvf.exe 40 PID 1988 wrote to memory of 2260 1988 vdrjvf.exe 40 PID 1988 wrote to memory of 2260 1988 vdrjvf.exe 40 PID 1988 wrote to memory of 2260 1988 vdrjvf.exe 40 PID 2260 wrote to memory of 2908 2260 bpdlxv.exe 41 PID 2260 wrote to memory of 2908 2260 bpdlxv.exe 41 PID 2260 wrote to memory of 2908 2260 bpdlxv.exe 41 PID 2260 wrote to memory of 2908 2260 bpdlxv.exe 41 PID 2908 wrote to memory of 1436 2908 tfpjt.exe 42 PID 2908 wrote to memory of 1436 2908 tfpjt.exe 42 PID 2908 wrote to memory of 1436 2908 tfpjt.exe 42 PID 2908 wrote to memory of 1436 2908 tfpjt.exe 42 PID 1436 wrote to memory of 432 1436 rbhvhdx.exe 43 PID 1436 wrote to memory of 432 1436 rbhvhdx.exe 43 PID 1436 wrote to memory of 432 1436 rbhvhdx.exe 43 PID 1436 wrote to memory of 432 1436 rbhvhdx.exe 43 PID 432 wrote to memory of 980 432 nxpvn.exe 44 PID 432 wrote to memory of 980 432 nxpvn.exe 44 PID 432 wrote to memory of 980 432 nxpvn.exe 44 PID 432 wrote to memory of 980 432 nxpvn.exe 44 PID 980 wrote to memory of 2032 980 pnvdrl.exe 45 PID 980 wrote to memory of 2032 980 pnvdrl.exe 45 PID 980 wrote to memory of 2032 980 pnvdrl.exe 45 PID 980 wrote to memory of 2032 980 pnvdrl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\642b6c52b29a090b4acef85c8c9f287394ccbe718411c3d801a0f6238c8f8d61.exe"C:\Users\Admin\AppData\Local\Temp\642b6c52b29a090b4acef85c8c9f287394ccbe718411c3d801a0f6238c8f8d61.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\rtdhv.exec:\rtdhv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\hvhbvp.exec:\hvhbvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\drjjtl.exec:\drjjtl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\brxjd.exec:\brxjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\njhbp.exec:\njhbp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\lhddbx.exec:\lhddbx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\hplrfhv.exec:\hplrfhv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\bfvdhv.exec:\bfvdhv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\nlrtvft.exec:\nlrtvft.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\vdrjvf.exec:\vdrjvf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\bpdlxv.exec:\bpdlxv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\tfpjt.exec:\tfpjt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\rbhvhdx.exec:\rbhvhdx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\nxpvn.exec:\nxpvn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\pnvdrl.exec:\pnvdrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\drvhlnt.exec:\drvhlnt.exe17⤵
- Executes dropped EXE
PID:2032 -
\??\c:\hpdhjfj.exec:\hpdhjfj.exe18⤵
- Executes dropped EXE
PID:904 -
\??\c:\pntlbtb.exec:\pntlbtb.exe19⤵
- Executes dropped EXE
PID:1304 -
\??\c:\lphvv.exec:\lphvv.exe20⤵
- Executes dropped EXE
PID:2308 -
\??\c:\brjltp.exec:\brjltp.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2124 -
\??\c:\pjjlj.exec:\pjjlj.exe22⤵
- Executes dropped EXE
PID:2404 -
\??\c:\dlnxff.exec:\dlnxff.exe23⤵
- Executes dropped EXE
PID:2328 -
\??\c:\txdtrj.exec:\txdtrj.exe24⤵
- Executes dropped EXE
PID:912 -
\??\c:\xnltr.exec:\xnltr.exe25⤵
- Executes dropped EXE
PID:2732 -
\??\c:\vdtdl.exec:\vdtdl.exe26⤵
- Executes dropped EXE
PID:1796 -
\??\c:\nxrnjbl.exec:\nxrnjbl.exe27⤵
- Executes dropped EXE
PID:1004 -
\??\c:\jhrvxp.exec:\jhrvxp.exe28⤵
- Executes dropped EXE
PID:2204 -
\??\c:\pjjpdp.exec:\pjjpdp.exe29⤵
- Executes dropped EXE
PID:1088 -
\??\c:\rhhpbv.exec:\rhhpbv.exe30⤵
- Executes dropped EXE
PID:2096 -
\??\c:\hrhbvf.exec:\hrhbvf.exe31⤵
- Executes dropped EXE
PID:1668 -
\??\c:\pnvdhf.exec:\pnvdhf.exe32⤵
- Executes dropped EXE
PID:1524 -
\??\c:\lfrjn.exec:\lfrjn.exe33⤵
- Executes dropped EXE
PID:888 -
\??\c:\bfxlxx.exec:\bfxlxx.exe34⤵
- Executes dropped EXE
PID:1736 -
\??\c:\lvxpbb.exec:\lvxpbb.exe35⤵
- Executes dropped EXE
PID:1236 -
\??\c:\bvdxv.exec:\bvdxv.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2164 -
\??\c:\lfrxb.exec:\lfrxb.exe37⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nfnhv.exec:\nfnhv.exe38⤵
- Executes dropped EXE
PID:2020 -
\??\c:\lfjhjh.exec:\lfjhjh.exe39⤵
- Executes dropped EXE
PID:2128 -
\??\c:\ppnvtj.exec:\ppnvtj.exe40⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rhfnx.exec:\rhfnx.exe41⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rhfvfn.exec:\rhfvfn.exe42⤵
- Executes dropped EXE
PID:1804 -
\??\c:\hjfddr.exec:\hjfddr.exe43⤵
- Executes dropped EXE
PID:2864 -
\??\c:\pdjfbv.exec:\pdjfbv.exe44⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jhldf.exec:\jhldf.exe45⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nntjjhb.exec:\nntjjhb.exe46⤵
- Executes dropped EXE
PID:264 -
\??\c:\bdvvvx.exec:\bdvvvx.exe47⤵
- Executes dropped EXE
PID:1132 -
\??\c:\bljbxr.exec:\bljbxr.exe48⤵
- Executes dropped EXE
PID:984 -
\??\c:\hpfpvr.exec:\hpfpvr.exe49⤵
- Executes dropped EXE
PID:1516 -
\??\c:\flhfr.exec:\flhfr.exe50⤵
- Executes dropped EXE
PID:1460 -
\??\c:\nbtbbt.exec:\nbtbbt.exe51⤵
- Executes dropped EXE
PID:1832 -
\??\c:\djpxbd.exec:\djpxbd.exe52⤵
- Executes dropped EXE
PID:1660 -
\??\c:\vphhrxv.exec:\vphhrxv.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1780 -
\??\c:\fphtdpb.exec:\fphtdpb.exe54⤵
- Executes dropped EXE
PID:608 -
\??\c:\xxdxhfl.exec:\xxdxhfl.exe55⤵
- Executes dropped EXE
PID:2600 -
\??\c:\tjthjpv.exec:\tjthjpv.exe56⤵
- Executes dropped EXE
PID:2032 -
\??\c:\ndtlbbr.exec:\ndtlbbr.exe57⤵
- Executes dropped EXE
PID:1760 -
\??\c:\hndfthb.exec:\hndfthb.exe58⤵
- Executes dropped EXE
PID:2216 -
\??\c:\tlfpx.exec:\tlfpx.exe59⤵
- Executes dropped EXE
PID:2060 -
\??\c:\phprllf.exec:\phprllf.exe60⤵
- Executes dropped EXE
PID:1424 -
\??\c:\pjnvl.exec:\pjnvl.exe61⤵
- Executes dropped EXE
PID:2472 -
\??\c:\plnvnpx.exec:\plnvnpx.exe62⤵
- Executes dropped EXE
PID:2064 -
\??\c:\njtpbd.exec:\njtpbd.exe63⤵
- Executes dropped EXE
PID:680 -
\??\c:\rtvhn.exec:\rtvhn.exe64⤵
- Executes dropped EXE
PID:756 -
\??\c:\dfhpb.exec:\dfhpb.exe65⤵
- Executes dropped EXE
PID:1080 -
\??\c:\hpfdhlv.exec:\hpfdhlv.exe66⤵PID:2732
-
\??\c:\brfxj.exec:\brfxj.exe67⤵PID:2544
-
\??\c:\hxpftlr.exec:\hxpftlr.exe68⤵PID:2532
-
\??\c:\lfvhpnj.exec:\lfvhpnj.exe69⤵PID:1308
-
\??\c:\xpbpl.exec:\xpbpl.exe70⤵PID:1744
-
\??\c:\vhxxn.exec:\vhxxn.exe71⤵PID:2628
-
\??\c:\dvvrl.exec:\dvvrl.exe72⤵PID:2388
-
\??\c:\bhrxp.exec:\bhrxp.exe73⤵PID:2172
-
\??\c:\vrbrlln.exec:\vrbrlln.exe74⤵PID:1528
-
\??\c:\lfppdp.exec:\lfppdp.exe75⤵PID:2104
-
\??\c:\vrvntl.exec:\vrvntl.exe76⤵PID:872
-
\??\c:\brfvbt.exec:\brfvbt.exe77⤵PID:2116
-
\??\c:\hfdvptn.exec:\hfdvptn.exe78⤵PID:1612
-
\??\c:\hptjtv.exec:\hptjtv.exe79⤵PID:2164
-
\??\c:\trdjvvr.exec:\trdjvvr.exe80⤵PID:2936
-
\??\c:\rnflb.exec:\rnflb.exe81⤵PID:3052
-
\??\c:\hrptndb.exec:\hrptndb.exe82⤵PID:2128
-
\??\c:\rjphnd.exec:\rjphnd.exe83⤵PID:2252
-
\??\c:\bpxhv.exec:\bpxhv.exe84⤵PID:2836
-
\??\c:\tdpxnt.exec:\tdpxnt.exe85⤵PID:2876
-
\??\c:\lrvdp.exec:\lrvdp.exe86⤵PID:2840
-
\??\c:\nrjbp.exec:\nrjbp.exe87⤵PID:2524
-
\??\c:\thvnnj.exec:\thvnnj.exe88⤵
- System Location Discovery: System Language Discovery
PID:1316 -
\??\c:\rbtttpx.exec:\rbtttpx.exe89⤵PID:3004
-
\??\c:\hbndx.exec:\hbndx.exe90⤵PID:2988
-
\??\c:\jvxrfft.exec:\jvxrfft.exe91⤵PID:984
-
\??\c:\vljtd.exec:\vljtd.exe92⤵
- System Location Discovery: System Language Discovery
PID:1516 -
\??\c:\xdjdn.exec:\xdjdn.exe93⤵PID:3024
-
\??\c:\nnbhhdp.exec:\nnbhhdp.exe94⤵PID:2740
-
\??\c:\fblnxlf.exec:\fblnxlf.exe95⤵PID:1660
-
\??\c:\vblpfjn.exec:\vblpfjn.exe96⤵PID:1780
-
\??\c:\hpxjhrx.exec:\hpxjhrx.exe97⤵PID:1028
-
\??\c:\xlldl.exec:\xlldl.exe98⤵PID:1348
-
\??\c:\hjvfp.exec:\hjvfp.exe99⤵PID:2196
-
\??\c:\fbhbr.exec:\fbhbr.exe100⤵PID:2504
-
\??\c:\xxntptj.exec:\xxntptj.exe101⤵PID:1956
-
\??\c:\xpldh.exec:\xpldh.exe102⤵PID:2176
-
\??\c:\hdxdd.exec:\hdxdd.exe103⤵PID:2452
-
\??\c:\hftfbn.exec:\hftfbn.exe104⤵PID:1992
-
\??\c:\xffpr.exec:\xffpr.exe105⤵PID:2408
-
\??\c:\vxffnxb.exec:\vxffnxb.exe106⤵PID:2148
-
\??\c:\fphjnnj.exec:\fphjnnj.exe107⤵PID:1680
-
\??\c:\vjpxnpr.exec:\vjpxnpr.exe108⤵PID:2700
-
\??\c:\xhhxjj.exec:\xhhxjj.exe109⤵PID:2732
-
\??\c:\trfnrp.exec:\trfnrp.exe110⤵PID:2544
-
\??\c:\jrnplt.exec:\jrnplt.exe111⤵PID:632
-
\??\c:\bvfjf.exec:\bvfjf.exe112⤵PID:1064
-
\??\c:\nxhnh.exec:\nxhnh.exe113⤵PID:2448
-
\??\c:\tbdhljd.exec:\tbdhljd.exe114⤵PID:2376
-
\??\c:\hvxfr.exec:\hvxfr.exe115⤵PID:2396
-
\??\c:\hxnnbht.exec:\hxnnbht.exe116⤵PID:2140
-
\??\c:\fdbtdv.exec:\fdbtdv.exe117⤵PID:1524
-
\??\c:\rrbnt.exec:\rrbnt.exe118⤵
- System Location Discovery: System Language Discovery
PID:2208 -
\??\c:\bjlpprr.exec:\bjlpprr.exe119⤵PID:2368
-
\??\c:\xxnxjxx.exec:\xxnxjxx.exe120⤵PID:2116
-
\??\c:\vvlvfn.exec:\vvlvfn.exe121⤵PID:2956
-
\??\c:\lxvhrx.exec:\lxvhrx.exe122⤵PID:2324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-