Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22/11/2024, 01:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe
-
Size
453KB
-
MD5
f0669a0ecc6efac4e3159d57b9ce7ee9
-
SHA1
6e9abbd2a5e52fb8dd8023332cc7f593c2bf6798
-
SHA256
926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5
-
SHA512
3b46cfe494247febf41d5d9edd315ab01e0081eb21a7d678e44378a10434eae33d53b35295d481cf9ccae7cd32fa497f9869be5dbc974339d88eb48e01bcdaf0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2044-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-123-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1152-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/796-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-234-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1248-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/272-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/924-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/660-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-461-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2332-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-509-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1528-539-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/864-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-623-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2076-653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-745-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3036-764-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2224-772-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-807-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-806-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2584 jlxnph.exe 2620 lxxpttr.exe 2448 bpphr.exe 2440 bvlxn.exe 2792 tbxdpbf.exe 2904 xbnrx.exe 2932 bxhlpjt.exe 2196 fffhf.exe 2700 nnnfd.exe 1664 rbtbr.exe 1676 vhndn.exe 2636 trlnbj.exe 1648 lttvx.exe 1152 vnftv.exe 796 vxnfx.exe 1780 jlxlfl.exe 2012 rhhbhjj.exe 1956 drdthx.exe 2996 dpfbxv.exe 2516 ptfjbl.exe 2384 lptlfxv.exe 2404 rftjphr.exe 2180 vhvbpf.exe 1748 btxlrhf.exe 800 xvrjjj.exe 2624 lxxnr.exe 1728 ftxht.exe 888 xrjpr.exe 864 jlfdt.exe 1248 btlfrrd.exe 272 btdpdvj.exe 2476 jtrtv.exe 1624 xxfdrb.exe 768 lhfrppr.exe 2104 fdtjtl.exe 2584 rppnfp.exe 2492 ldtvrd.exe 2424 dxtll.exe 2176 tddbpj.exe 2908 hxrppph.exe 2780 xfbbn.exe 2512 nnrtn.exe 2876 hdfjvbr.exe 2692 thhpjd.exe 2652 jhhlf.exe 2728 tllpffd.exe 1664 xddxbt.exe 1804 vbplj.exe 1984 jpnhnpd.exe 924 nfntfb.exe 1920 lljvlln.exe 2080 ffjrtn.exe 2884 rdjfr.exe 660 pfdtvbl.exe 2000 nhntl.exe 1948 rlxxn.exe 2868 vrdhf.exe 2856 vlhnrd.exe 2996 vbxrjxf.exe 2332 jxvpnl.exe 3040 vbjnnb.exe 2404 tlpvdx.exe 3016 prvhp.exe 1252 hpnjrbf.exe -
resource yara_rule behavioral1/memory/2584-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/272-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/660-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-509-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/960-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-539-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/864-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-772-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1124-786-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-793-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-807-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-815-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/648-823-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrpbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trbvhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnnxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plfjfbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdvhxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jljptrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltpfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfjvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trhpvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrhnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pftrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhxbrvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfhnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvprhpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phrnff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjxtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brdpvvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dttfnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fljnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnrxhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrvln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2044 wrote to memory of 2584 2044 926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe 30 PID 2044 wrote to memory of 2584 2044 926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe 30 PID 2044 wrote to memory of 2584 2044 926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe 30 PID 2044 wrote to memory of 2584 2044 926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe 30 PID 2584 wrote to memory of 2620 2584 jlxnph.exe 31 PID 2584 wrote to memory of 2620 2584 jlxnph.exe 31 PID 2584 wrote to memory of 2620 2584 jlxnph.exe 31 PID 2584 wrote to memory of 2620 2584 jlxnph.exe 31 PID 2620 wrote to memory of 2448 2620 lxxpttr.exe 32 PID 2620 wrote to memory of 2448 2620 lxxpttr.exe 32 PID 2620 wrote to memory of 2448 2620 lxxpttr.exe 32 PID 2620 wrote to memory of 2448 2620 lxxpttr.exe 32 PID 2448 wrote to memory of 2440 2448 bpphr.exe 33 PID 2448 wrote to memory of 2440 2448 bpphr.exe 33 PID 2448 wrote to memory of 2440 2448 bpphr.exe 33 PID 2448 wrote to memory of 2440 2448 bpphr.exe 33 PID 2440 wrote to memory of 2792 2440 bvlxn.exe 34 PID 2440 wrote to memory of 2792 2440 bvlxn.exe 34 PID 2440 wrote to memory of 2792 2440 bvlxn.exe 34 PID 2440 wrote to memory of 2792 2440 bvlxn.exe 34 PID 2792 wrote to memory of 2904 2792 tbxdpbf.exe 35 PID 2792 wrote to memory of 2904 2792 tbxdpbf.exe 35 PID 2792 wrote to memory of 2904 2792 tbxdpbf.exe 35 PID 2792 wrote to memory of 2904 2792 tbxdpbf.exe 35 PID 2904 wrote to memory of 2932 2904 xbnrx.exe 36 PID 2904 wrote to memory of 2932 2904 xbnrx.exe 36 PID 2904 wrote to memory of 2932 2904 xbnrx.exe 36 PID 2904 wrote to memory of 2932 2904 xbnrx.exe 36 PID 2932 wrote to memory of 2196 2932 bxhlpjt.exe 37 PID 2932 wrote to memory of 2196 2932 bxhlpjt.exe 37 PID 2932 wrote to memory of 2196 2932 bxhlpjt.exe 37 PID 2932 wrote to memory of 2196 2932 bxhlpjt.exe 37 PID 2196 wrote to memory of 2700 2196 fffhf.exe 38 PID 2196 wrote to memory of 2700 2196 fffhf.exe 38 PID 2196 wrote to memory of 2700 2196 fffhf.exe 38 PID 2196 wrote to memory of 2700 2196 fffhf.exe 38 PID 2700 wrote to memory of 1664 2700 nnnfd.exe 39 PID 2700 wrote to memory of 1664 2700 nnnfd.exe 39 PID 2700 wrote to memory of 1664 2700 nnnfd.exe 39 PID 2700 wrote to memory of 1664 2700 nnnfd.exe 39 PID 1664 wrote to memory of 1676 1664 rbtbr.exe 40 PID 1664 wrote to memory of 1676 1664 rbtbr.exe 40 PID 1664 wrote to memory of 1676 1664 rbtbr.exe 40 PID 1664 wrote to memory of 1676 1664 rbtbr.exe 40 PID 1676 wrote to memory of 2636 1676 vhndn.exe 41 PID 1676 wrote to memory of 2636 1676 vhndn.exe 41 PID 1676 wrote to memory of 2636 1676 vhndn.exe 41 PID 1676 wrote to memory of 2636 1676 vhndn.exe 41 PID 2636 wrote to memory of 1648 2636 trlnbj.exe 42 PID 2636 wrote to memory of 1648 2636 trlnbj.exe 42 PID 2636 wrote to memory of 1648 2636 trlnbj.exe 42 PID 2636 wrote to memory of 1648 2636 trlnbj.exe 42 PID 1648 wrote to memory of 1152 1648 lttvx.exe 43 PID 1648 wrote to memory of 1152 1648 lttvx.exe 43 PID 1648 wrote to memory of 1152 1648 lttvx.exe 43 PID 1648 wrote to memory of 1152 1648 lttvx.exe 43 PID 1152 wrote to memory of 796 1152 vnftv.exe 44 PID 1152 wrote to memory of 796 1152 vnftv.exe 44 PID 1152 wrote to memory of 796 1152 vnftv.exe 44 PID 1152 wrote to memory of 796 1152 vnftv.exe 44 PID 796 wrote to memory of 1780 796 vxnfx.exe 45 PID 796 wrote to memory of 1780 796 vxnfx.exe 45 PID 796 wrote to memory of 1780 796 vxnfx.exe 45 PID 796 wrote to memory of 1780 796 vxnfx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe"C:\Users\Admin\AppData\Local\Temp\926847c64bbe37f6f2dd316ed6339a8dcebb78cbadb7a8828cb1ff068dc2f8e5.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\jlxnph.exec:\jlxnph.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\lxxpttr.exec:\lxxpttr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\bpphr.exec:\bpphr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\bvlxn.exec:\bvlxn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\tbxdpbf.exec:\tbxdpbf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\xbnrx.exec:\xbnrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\bxhlpjt.exec:\bxhlpjt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\fffhf.exec:\fffhf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\nnnfd.exec:\nnnfd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\rbtbr.exec:\rbtbr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\vhndn.exec:\vhndn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\trlnbj.exec:\trlnbj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\lttvx.exec:\lttvx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\vnftv.exec:\vnftv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\vxnfx.exec:\vxnfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\jlxlfl.exec:\jlxlfl.exe17⤵
- Executes dropped EXE
PID:1780 -
\??\c:\rhhbhjj.exec:\rhhbhjj.exe18⤵
- Executes dropped EXE
PID:2012 -
\??\c:\drdthx.exec:\drdthx.exe19⤵
- Executes dropped EXE
PID:1956 -
\??\c:\dpfbxv.exec:\dpfbxv.exe20⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ptfjbl.exec:\ptfjbl.exe21⤵
- Executes dropped EXE
PID:2516 -
\??\c:\lptlfxv.exec:\lptlfxv.exe22⤵
- Executes dropped EXE
PID:2384 -
\??\c:\rftjphr.exec:\rftjphr.exe23⤵
- Executes dropped EXE
PID:2404 -
\??\c:\vhvbpf.exec:\vhvbpf.exe24⤵
- Executes dropped EXE
PID:2180 -
\??\c:\btxlrhf.exec:\btxlrhf.exe25⤵
- Executes dropped EXE
PID:1748 -
\??\c:\xvrjjj.exec:\xvrjjj.exe26⤵
- Executes dropped EXE
PID:800 -
\??\c:\lxxnr.exec:\lxxnr.exe27⤵
- Executes dropped EXE
PID:2624 -
\??\c:\ftxht.exec:\ftxht.exe28⤵
- Executes dropped EXE
PID:1728 -
\??\c:\xrjpr.exec:\xrjpr.exe29⤵
- Executes dropped EXE
PID:888 -
\??\c:\jlfdt.exec:\jlfdt.exe30⤵
- Executes dropped EXE
PID:864 -
\??\c:\btlfrrd.exec:\btlfrrd.exe31⤵
- Executes dropped EXE
PID:1248 -
\??\c:\btdpdvj.exec:\btdpdvj.exe32⤵
- Executes dropped EXE
PID:272 -
\??\c:\jtrtv.exec:\jtrtv.exe33⤵
- Executes dropped EXE
PID:2476 -
\??\c:\xxfdrb.exec:\xxfdrb.exe34⤵
- Executes dropped EXE
PID:1624 -
\??\c:\lhfrppr.exec:\lhfrppr.exe35⤵
- Executes dropped EXE
PID:768 -
\??\c:\fdtjtl.exec:\fdtjtl.exe36⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rppnfp.exec:\rppnfp.exe37⤵
- Executes dropped EXE
PID:2584 -
\??\c:\ldtvrd.exec:\ldtvrd.exe38⤵
- Executes dropped EXE
PID:2492 -
\??\c:\dxtll.exec:\dxtll.exe39⤵
- Executes dropped EXE
PID:2424 -
\??\c:\tddbpj.exec:\tddbpj.exe40⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hxrppph.exec:\hxrppph.exe41⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xfbbn.exec:\xfbbn.exe42⤵
- Executes dropped EXE
PID:2780 -
\??\c:\nnrtn.exec:\nnrtn.exe43⤵
- Executes dropped EXE
PID:2512 -
\??\c:\hdfjvbr.exec:\hdfjvbr.exe44⤵
- Executes dropped EXE
PID:2876 -
\??\c:\thhpjd.exec:\thhpjd.exe45⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jhhlf.exec:\jhhlf.exe46⤵
- Executes dropped EXE
PID:2652 -
\??\c:\tllpffd.exec:\tllpffd.exe47⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xddxbt.exec:\xddxbt.exe48⤵
- Executes dropped EXE
PID:1664 -
\??\c:\vbplj.exec:\vbplj.exe49⤵
- Executes dropped EXE
PID:1804 -
\??\c:\jpnhnpd.exec:\jpnhnpd.exe50⤵
- Executes dropped EXE
PID:1984 -
\??\c:\nfntfb.exec:\nfntfb.exe51⤵
- Executes dropped EXE
PID:924 -
\??\c:\lljvlln.exec:\lljvlln.exe52⤵
- Executes dropped EXE
PID:1920 -
\??\c:\ffjrtn.exec:\ffjrtn.exe53⤵
- Executes dropped EXE
PID:2080 -
\??\c:\rdjfr.exec:\rdjfr.exe54⤵
- Executes dropped EXE
PID:2884 -
\??\c:\pfdtvbl.exec:\pfdtvbl.exe55⤵
- Executes dropped EXE
PID:660 -
\??\c:\nhntl.exec:\nhntl.exe56⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rlxxn.exec:\rlxxn.exe57⤵
- Executes dropped EXE
PID:1948 -
\??\c:\vrdhf.exec:\vrdhf.exe58⤵
- Executes dropped EXE
PID:2868 -
\??\c:\vlhnrd.exec:\vlhnrd.exe59⤵
- Executes dropped EXE
PID:2856 -
\??\c:\vbxrjxf.exec:\vbxrjxf.exe60⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jxvpnl.exec:\jxvpnl.exe61⤵
- Executes dropped EXE
PID:2332 -
\??\c:\vbjnnb.exec:\vbjnnb.exe62⤵
- Executes dropped EXE
PID:3040 -
\??\c:\tlpvdx.exec:\tlpvdx.exe63⤵
- Executes dropped EXE
PID:2404 -
\??\c:\prvhp.exec:\prvhp.exe64⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hpnjrbf.exec:\hpnjrbf.exe65⤵
- Executes dropped EXE
PID:1252 -
\??\c:\jblvxtv.exec:\jblvxtv.exe66⤵PID:960
-
\??\c:\fjrhdd.exec:\fjrhdd.exe67⤵PID:3012
-
\??\c:\nxnvt.exec:\nxnvt.exe68⤵PID:2428
-
\??\c:\bpltrnj.exec:\bpltrnj.exe69⤵PID:1528
-
\??\c:\rvjppt.exec:\rvjppt.exe70⤵PID:1556
-
\??\c:\vvldf.exec:\vvldf.exe71⤵PID:1500
-
\??\c:\frtflt.exec:\frtflt.exe72⤵PID:864
-
\??\c:\rlbxh.exec:\rlbxh.exe73⤵PID:2276
-
\??\c:\pffjvrb.exec:\pffjvrb.exe74⤵PID:2304
-
\??\c:\ddrbfrl.exec:\ddrbfrl.exe75⤵PID:1852
-
\??\c:\tfffht.exec:\tfffht.exe76⤵PID:2036
-
\??\c:\nvjlb.exec:\nvjlb.exe77⤵PID:2128
-
\??\c:\rvpxv.exec:\rvpxv.exe78⤵PID:1568
-
\??\c:\rxnht.exec:\rxnht.exe79⤵PID:2984
-
\??\c:\pvdbr.exec:\pvdbr.exe80⤵PID:1980
-
\??\c:\blpxdh.exec:\blpxdh.exe81⤵PID:2092
-
\??\c:\rhnfttf.exec:\rhnfttf.exe82⤵PID:2528
-
\??\c:\nhfhhjf.exec:\nhfhhjf.exe83⤵PID:2784
-
\??\c:\tvprhpl.exec:\tvprhpl.exe84⤵
- System Location Discovery: System Language Discovery
PID:2908 -
\??\c:\phrnff.exec:\phrnff.exe85⤵
- System Location Discovery: System Language Discovery
PID:1300 -
\??\c:\ptllhvl.exec:\ptllhvl.exe86⤵PID:2076
-
\??\c:\bxvltj.exec:\bxvltj.exe87⤵PID:2680
-
\??\c:\xfdfvtt.exec:\xfdfvtt.exe88⤵PID:2876
-
\??\c:\hfbbx.exec:\hfbbx.exe89⤵PID:2816
-
\??\c:\vrlnb.exec:\vrlnb.exe90⤵PID:2664
-
\??\c:\bndrnv.exec:\bndrnv.exe91⤵PID:2716
-
\??\c:\xtndbrf.exec:\xtndbrf.exe92⤵PID:2344
-
\??\c:\dbpxf.exec:\dbpxf.exe93⤵PID:1036
-
\??\c:\bblhxp.exec:\bblhxp.exe94⤵PID:932
-
\??\c:\rrhfhbr.exec:\rrhfhbr.exe95⤵PID:2032
-
\??\c:\tdnbh.exec:\tdnbh.exe96⤵PID:1716
-
\??\c:\flxbrlt.exec:\flxbrlt.exe97⤵PID:1608
-
\??\c:\xtdlfr.exec:\xtdlfr.exe98⤵PID:1944
-
\??\c:\nthhbxf.exec:\nthhbxf.exe99⤵PID:3044
-
\??\c:\xvfbf.exec:\xvfbf.exe100⤵PID:3052
-
\??\c:\fprtf.exec:\fprtf.exe101⤵PID:3020
-
\??\c:\plfjfbp.exec:\plfjfbp.exe102⤵
- System Location Discovery: System Language Discovery
PID:2324 -
\??\c:\pfdrl.exec:\pfdrl.exe103⤵PID:3036
-
\??\c:\phdhxx.exec:\phdhxx.exe104⤵PID:2224
-
\??\c:\jltnvn.exec:\jltnvn.exe105⤵PID:2132
-
\??\c:\xnttdn.exec:\xnttdn.exe106⤵PID:616
-
\??\c:\rbtvrdr.exec:\rbtvrdr.exe107⤵PID:1124
-
\??\c:\htbtjpj.exec:\htbtjpj.exe108⤵PID:1004
-
\??\c:\hnhjl.exec:\hnhjl.exe109⤵PID:2624
-
\??\c:\dnjhj.exec:\dnjhj.exe110⤵PID:1044
-
\??\c:\tlhvlj.exec:\tlhvlj.exe111⤵PID:1364
-
\??\c:\pndhhv.exec:\pndhhv.exe112⤵PID:648
-
\??\c:\rfrndp.exec:\rfrndp.exe113⤵PID:1500
-
\??\c:\tjffr.exec:\tjffr.exe114⤵PID:2260
-
\??\c:\vjxtt.exec:\vjxtt.exe115⤵
- System Location Discovery: System Language Discovery
PID:2060 -
\??\c:\tfbnld.exec:\tfbnld.exe116⤵PID:2488
-
\??\c:\xrvhjhl.exec:\xrvhjhl.exe117⤵PID:1852
-
\??\c:\jbnvbfd.exec:\jbnvbfd.exe118⤵PID:2036
-
\??\c:\hnfbd.exec:\hnfbd.exe119⤵PID:1284
-
\??\c:\ptlhnx.exec:\ptlhnx.exe120⤵PID:1568
-
\??\c:\txtxt.exec:\txtxt.exe121⤵PID:2984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-