Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 04:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d14de40115da15ffcd435ea4ec1f61b69e345cdfd045116c9d98eebcb19baf80.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d14de40115da15ffcd435ea4ec1f61b69e345cdfd045116c9d98eebcb19baf80.exe
-
Size
347KB
-
MD5
849115485b803d6cd85407de8ae64755
-
SHA1
4b93fc4d51de75147ad88bfeff96f20ab84661b2
-
SHA256
d14de40115da15ffcd435ea4ec1f61b69e345cdfd045116c9d98eebcb19baf80
-
SHA512
e8056abec41ea8b0c7d54acd178e6cd0de5e3ef6f3144c73c0118b43cbccd4ac4bacaee125e13264a69f1c72281350b370ef860e63ddb0ca7dc6fd83461f7085
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAo:l7TcbWXZshJX2VGdo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/1988-13-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2884-10-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2920-23-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2920-29-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/3036-41-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2668-49-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2788-53-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2520-68-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/2520-69-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2588-78-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2424-87-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1964-91-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2424-89-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1844-100-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2860-141-0x00000000003C0000-0x00000000003E8000-memory.dmp family_blackmoon behavioral1/memory/2452-145-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/332-169-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2860-142-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1512-178-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1744-231-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/976-228-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1348-251-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1348-250-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1288-268-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1732-259-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1048-280-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1704-277-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1512-209-0x00000000002B0000-0x00000000002D8000-memory.dmp family_blackmoon behavioral1/memory/1720-208-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2056-197-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/2056-196-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2908-313-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2704-124-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1804-366-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2168-400-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1844-407-0x00000000003C0000-0x00000000003E8000-memory.dmp family_blackmoon behavioral1/memory/2444-421-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2252-445-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/916-461-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/916-460-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/748-475-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2504-482-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1960-526-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1292-580-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1324-655-0x00000000002B0000-0x00000000002D8000-memory.dmp family_blackmoon behavioral1/memory/2844-671-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2528-679-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2528-678-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2196-687-0x00000000002C0000-0x00000000002E8000-memory.dmp family_blackmoon behavioral1/memory/2356-700-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2488-707-0x00000000002A0000-0x00000000002C8000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1988 brfvxpr.exe 2920 jfhlrt.exe 3036 ljrfp.exe 2668 bjbvlh.exe 2788 jtlrfr.exe 2520 rtbndd.exe 2588 tpbdvt.exe 2424 jjnrrv.exe 1964 jbbvn.exe 1844 pdjdxb.exe 1716 ndtlb.exe 2704 llflx.exe 2300 jlprl.exe 2860 fdlhpn.exe 2452 dhljtb.exe 916 hpfpfh.exe 332 pnrtrnf.exe 1512 vrhxp.exe 2064 vnvnb.exe 2056 xlrjf.exe 1720 rdlft.exe 1788 rfnnj.exe 976 fnjfprb.exe 1744 prjtv.exe 1348 lrrbx.exe 1732 xhhdh.exe 1288 dvpxlf.exe 1704 jfndlpv.exe 1048 vrfnvbv.exe 1040 dhnvnj.exe 1564 bjvrx.exe 2908 bfhjrfv.exe 2896 jhpph.exe 2900 vhdbt.exe 2952 fnnvvd.exe 2672 xlfnjbt.exe 3052 lfjdd.exe 2940 vdfdht.exe 580 xfbxpb.exe 2208 hbtdhnd.exe 1804 fnhht.exe 1856 rtrvrf.exe 1092 hhbhf.exe 2424 hrpnxxp.exe 2168 drhdvp.exe 1844 hvxtvp.exe 2132 ldxtbf.exe 2444 nfrrxnx.exe 2396 frbbv.exe 2324 vfjjd.exe 2312 pjnjjnv.exe 2252 pdvdn.exe 1508 jhbfd.exe 916 bljrt.exe 2160 hhltpjx.exe 748 vpbrvhf.exe 2504 fthhjf.exe 1408 vxfljv.exe 2056 rxnvp.exe 1784 pfbfpx.exe 564 xrftbt.exe 1436 phtvxtf.exe 856 ttnpftf.exe 1960 rjblf.exe -
resource yara_rule behavioral1/memory/1988-13-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2884-10-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2920-23-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3036-41-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2668-49-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2788-53-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2520-60-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2520-69-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2588-78-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1964-91-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2424-89-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1844-100-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2452-145-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/332-169-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2860-142-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1512-178-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1788-210-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1744-231-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/976-228-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1348-250-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1288-268-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1732-259-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1048-280-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1704-277-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1348-241-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1720-208-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2056-196-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2908-313-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2704-124-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/580-356-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/1804-366-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1092-379-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2168-393-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2444-421-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/916-461-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/748-475-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1728-533-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2388-581-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2840-619-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2844-671-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndnvnbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnpftf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvtlpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvnphj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fppltt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdbpjnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhhjlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfpvjbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjnjjnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxpbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frbvfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lptvdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjbln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvnjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfndlpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntfhhbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flnpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfjpnjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nptffp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxbvxdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnbvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjnrrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plhrhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptdbjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnfhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvlhh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2884 wrote to memory of 1988 2884 d14de40115da15ffcd435ea4ec1f61b69e345cdfd045116c9d98eebcb19baf80.exe 30 PID 2884 wrote to memory of 1988 2884 d14de40115da15ffcd435ea4ec1f61b69e345cdfd045116c9d98eebcb19baf80.exe 30 PID 2884 wrote to memory of 1988 2884 d14de40115da15ffcd435ea4ec1f61b69e345cdfd045116c9d98eebcb19baf80.exe 30 PID 2884 wrote to memory of 1988 2884 d14de40115da15ffcd435ea4ec1f61b69e345cdfd045116c9d98eebcb19baf80.exe 30 PID 1988 wrote to memory of 2920 1988 brfvxpr.exe 31 PID 1988 wrote to memory of 2920 1988 brfvxpr.exe 31 PID 1988 wrote to memory of 2920 1988 brfvxpr.exe 31 PID 1988 wrote to memory of 2920 1988 brfvxpr.exe 31 PID 2920 wrote to memory of 3036 2920 jfhlrt.exe 32 PID 2920 wrote to memory of 3036 2920 jfhlrt.exe 32 PID 2920 wrote to memory of 3036 2920 jfhlrt.exe 32 PID 2920 wrote to memory of 3036 2920 jfhlrt.exe 32 PID 3036 wrote to memory of 2668 3036 ljrfp.exe 33 PID 3036 wrote to memory of 2668 3036 ljrfp.exe 33 PID 3036 wrote to memory of 2668 3036 ljrfp.exe 33 PID 3036 wrote to memory of 2668 3036 ljrfp.exe 33 PID 2668 wrote to memory of 2788 2668 bjbvlh.exe 34 PID 2668 wrote to memory of 2788 2668 bjbvlh.exe 34 PID 2668 wrote to memory of 2788 2668 bjbvlh.exe 34 PID 2668 wrote to memory of 2788 2668 bjbvlh.exe 34 PID 2788 wrote to memory of 2520 2788 jtlrfr.exe 35 PID 2788 wrote to memory of 2520 2788 jtlrfr.exe 35 PID 2788 wrote to memory of 2520 2788 jtlrfr.exe 35 PID 2788 wrote to memory of 2520 2788 jtlrfr.exe 35 PID 2520 wrote to memory of 2588 2520 rtbndd.exe 36 PID 2520 wrote to memory of 2588 2520 rtbndd.exe 36 PID 2520 wrote to memory of 2588 2520 rtbndd.exe 36 PID 2520 wrote to memory of 2588 2520 rtbndd.exe 36 PID 2588 wrote to memory of 2424 2588 tpbdvt.exe 37 PID 2588 wrote to memory of 2424 2588 tpbdvt.exe 37 PID 2588 wrote to memory of 2424 2588 tpbdvt.exe 37 PID 2588 wrote to memory of 2424 2588 tpbdvt.exe 37 PID 2424 wrote to memory of 1964 2424 jjnrrv.exe 38 PID 2424 wrote to memory of 1964 2424 jjnrrv.exe 38 PID 2424 wrote to memory of 1964 2424 jjnrrv.exe 38 PID 2424 wrote to memory of 1964 2424 jjnrrv.exe 38 PID 1964 wrote to memory of 1844 1964 jbbvn.exe 39 PID 1964 wrote to memory of 1844 1964 jbbvn.exe 39 PID 1964 wrote to memory of 1844 1964 jbbvn.exe 39 PID 1964 wrote to memory of 1844 1964 jbbvn.exe 39 PID 1844 wrote to memory of 1716 1844 pdjdxb.exe 40 PID 1844 wrote to memory of 1716 1844 pdjdxb.exe 40 PID 1844 wrote to memory of 1716 1844 pdjdxb.exe 40 PID 1844 wrote to memory of 1716 1844 pdjdxb.exe 40 PID 1716 wrote to memory of 2704 1716 ndtlb.exe 41 PID 1716 wrote to memory of 2704 1716 ndtlb.exe 41 PID 1716 wrote to memory of 2704 1716 ndtlb.exe 41 PID 1716 wrote to memory of 2704 1716 ndtlb.exe 41 PID 2704 wrote to memory of 2300 2704 llflx.exe 42 PID 2704 wrote to memory of 2300 2704 llflx.exe 42 PID 2704 wrote to memory of 2300 2704 llflx.exe 42 PID 2704 wrote to memory of 2300 2704 llflx.exe 42 PID 2300 wrote to memory of 2860 2300 jlprl.exe 43 PID 2300 wrote to memory of 2860 2300 jlprl.exe 43 PID 2300 wrote to memory of 2860 2300 jlprl.exe 43 PID 2300 wrote to memory of 2860 2300 jlprl.exe 43 PID 2860 wrote to memory of 2452 2860 fdlhpn.exe 44 PID 2860 wrote to memory of 2452 2860 fdlhpn.exe 44 PID 2860 wrote to memory of 2452 2860 fdlhpn.exe 44 PID 2860 wrote to memory of 2452 2860 fdlhpn.exe 44 PID 2452 wrote to memory of 916 2452 dhljtb.exe 45 PID 2452 wrote to memory of 916 2452 dhljtb.exe 45 PID 2452 wrote to memory of 916 2452 dhljtb.exe 45 PID 2452 wrote to memory of 916 2452 dhljtb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d14de40115da15ffcd435ea4ec1f61b69e345cdfd045116c9d98eebcb19baf80.exe"C:\Users\Admin\AppData\Local\Temp\d14de40115da15ffcd435ea4ec1f61b69e345cdfd045116c9d98eebcb19baf80.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\brfvxpr.exec:\brfvxpr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\jfhlrt.exec:\jfhlrt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\ljrfp.exec:\ljrfp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\bjbvlh.exec:\bjbvlh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\jtlrfr.exec:\jtlrfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\rtbndd.exec:\rtbndd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\tpbdvt.exec:\tpbdvt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\jjnrrv.exec:\jjnrrv.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\jbbvn.exec:\jbbvn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\pdjdxb.exec:\pdjdxb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\ndtlb.exec:\ndtlb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\llflx.exec:\llflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\jlprl.exec:\jlprl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\fdlhpn.exec:\fdlhpn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\dhljtb.exec:\dhljtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\hpfpfh.exec:\hpfpfh.exe17⤵
- Executes dropped EXE
PID:916 -
\??\c:\pnrtrnf.exec:\pnrtrnf.exe18⤵
- Executes dropped EXE
PID:332 -
\??\c:\vrhxp.exec:\vrhxp.exe19⤵
- Executes dropped EXE
PID:1512 -
\??\c:\vnvnb.exec:\vnvnb.exe20⤵
- Executes dropped EXE
PID:2064 -
\??\c:\xlrjf.exec:\xlrjf.exe21⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rdlft.exec:\rdlft.exe22⤵
- Executes dropped EXE
PID:1720 -
\??\c:\rfnnj.exec:\rfnnj.exe23⤵
- Executes dropped EXE
PID:1788 -
\??\c:\fnjfprb.exec:\fnjfprb.exe24⤵
- Executes dropped EXE
PID:976 -
\??\c:\prjtv.exec:\prjtv.exe25⤵
- Executes dropped EXE
PID:1744 -
\??\c:\lrrbx.exec:\lrrbx.exe26⤵
- Executes dropped EXE
PID:1348 -
\??\c:\xhhdh.exec:\xhhdh.exe27⤵
- Executes dropped EXE
PID:1732 -
\??\c:\dvpxlf.exec:\dvpxlf.exe28⤵
- Executes dropped EXE
PID:1288 -
\??\c:\jfndlpv.exec:\jfndlpv.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1704 -
\??\c:\vrfnvbv.exec:\vrfnvbv.exe30⤵
- Executes dropped EXE
PID:1048 -
\??\c:\dhnvnj.exec:\dhnvnj.exe31⤵
- Executes dropped EXE
PID:1040 -
\??\c:\bjvrx.exec:\bjvrx.exe32⤵
- Executes dropped EXE
PID:1564 -
\??\c:\bfhjrfv.exec:\bfhjrfv.exe33⤵
- Executes dropped EXE
PID:2908 -
\??\c:\jhpph.exec:\jhpph.exe34⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vhdbt.exec:\vhdbt.exe35⤵
- Executes dropped EXE
PID:2900 -
\??\c:\fnnvvd.exec:\fnnvvd.exe36⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xlfnjbt.exec:\xlfnjbt.exe37⤵
- Executes dropped EXE
PID:2672 -
\??\c:\lfjdd.exec:\lfjdd.exe38⤵
- Executes dropped EXE
PID:3052 -
\??\c:\vdfdht.exec:\vdfdht.exe39⤵
- Executes dropped EXE
PID:2940 -
\??\c:\xfbxpb.exec:\xfbxpb.exe40⤵
- Executes dropped EXE
PID:580 -
\??\c:\hbtdhnd.exec:\hbtdhnd.exe41⤵
- Executes dropped EXE
PID:2208 -
\??\c:\fnhht.exec:\fnhht.exe42⤵
- Executes dropped EXE
PID:1804 -
\??\c:\rtrvrf.exec:\rtrvrf.exe43⤵
- Executes dropped EXE
PID:1856 -
\??\c:\hhbhf.exec:\hhbhf.exe44⤵
- Executes dropped EXE
PID:1092 -
\??\c:\hrpnxxp.exec:\hrpnxxp.exe45⤵
- Executes dropped EXE
PID:2424 -
\??\c:\drhdvp.exec:\drhdvp.exe46⤵
- Executes dropped EXE
PID:2168 -
\??\c:\hvxtvp.exec:\hvxtvp.exe47⤵
- Executes dropped EXE
PID:1844 -
\??\c:\ldxtbf.exec:\ldxtbf.exe48⤵
- Executes dropped EXE
PID:2132 -
\??\c:\nfrrxnx.exec:\nfrrxnx.exe49⤵
- Executes dropped EXE
PID:2444 -
\??\c:\frbbv.exec:\frbbv.exe50⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vfjjd.exec:\vfjjd.exe51⤵
- Executes dropped EXE
PID:2324 -
\??\c:\pjnjjnv.exec:\pjnjjnv.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2312 -
\??\c:\pdvdn.exec:\pdvdn.exe53⤵
- Executes dropped EXE
PID:2252 -
\??\c:\jhbfd.exec:\jhbfd.exe54⤵
- Executes dropped EXE
PID:1508 -
\??\c:\bljrt.exec:\bljrt.exe55⤵
- Executes dropped EXE
PID:916 -
\??\c:\hhltpjx.exec:\hhltpjx.exe56⤵
- Executes dropped EXE
PID:2160 -
\??\c:\vpbrvhf.exec:\vpbrvhf.exe57⤵
- Executes dropped EXE
PID:748 -
\??\c:\fthhjf.exec:\fthhjf.exe58⤵
- Executes dropped EXE
PID:2504 -
\??\c:\vxfljv.exec:\vxfljv.exe59⤵
- Executes dropped EXE
PID:1408 -
\??\c:\rxnvp.exec:\rxnvp.exe60⤵
- Executes dropped EXE
PID:2056 -
\??\c:\pfbfpx.exec:\pfbfpx.exe61⤵
- Executes dropped EXE
PID:1784 -
\??\c:\xrftbt.exec:\xrftbt.exe62⤵
- Executes dropped EXE
PID:564 -
\??\c:\phtvxtf.exec:\phtvxtf.exe63⤵
- Executes dropped EXE
PID:1436 -
\??\c:\ttnpftf.exec:\ttnpftf.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:856 -
\??\c:\rjblf.exec:\rjblf.exe65⤵
- Executes dropped EXE
PID:1960 -
\??\c:\rfhlrfb.exec:\rfhlrfb.exe66⤵PID:1552
-
\??\c:\djndln.exec:\djndln.exe67⤵PID:1728
-
\??\c:\vjpjj.exec:\vjpjj.exe68⤵PID:2600
-
\??\c:\fdvjvr.exec:\fdvjvr.exe69⤵PID:1632
-
\??\c:\fpvvl.exec:\fpvvl.exe70⤵PID:3024
-
\??\c:\nlvdd.exec:\nlvdd.exe71⤵PID:2340
-
\??\c:\lpfvvb.exec:\lpfvvb.exe72⤵PID:1980
-
\??\c:\tfxrfn.exec:\tfxrfn.exe73⤵PID:1292
-
\??\c:\rljhld.exec:\rljhld.exe74⤵PID:2388
-
\??\c:\vhxpbb.exec:\vhxpbb.exe75⤵PID:2892
-
\??\c:\vjrbd.exec:\vjrbd.exe76⤵PID:2796
-
\??\c:\xdxfhp.exec:\xdxfhp.exe77⤵PID:2792
-
\??\c:\rllnjd.exec:\rllnjd.exe78⤵PID:1616
-
\??\c:\prvrnpp.exec:\prvrnpp.exe79⤵PID:1604
-
\??\c:\hjhjbt.exec:\hjhjbt.exe80⤵PID:2840
-
\??\c:\dnnhjr.exec:\dnnhjr.exe81⤵PID:2680
-
\??\c:\djfnttp.exec:\djfnttp.exe82⤵PID:2716
-
\??\c:\lfplb.exec:\lfplb.exe83⤵PID:2724
-
\??\c:\hppbvvl.exec:\hppbvvl.exe84⤵PID:396
-
\??\c:\rjvpln.exec:\rjvpln.exe85⤵PID:1324
-
\??\c:\fldnrbj.exec:\fldnrbj.exe86⤵PID:1132
-
\??\c:\bvrnnn.exec:\bvrnnn.exe87⤵PID:2844
-
\??\c:\xxtjrxn.exec:\xxtjrxn.exe88⤵PID:2528
-
\??\c:\rdbjjv.exec:\rdbjjv.exe89⤵PID:2196
-
\??\c:\rhllp.exec:\rhllp.exe90⤵PID:2164
-
\??\c:\tbvrnnh.exec:\tbvrnnh.exe91⤵PID:2356
-
\??\c:\vjnvlrh.exec:\vjnvlrh.exe92⤵PID:2488
-
\??\c:\rppljhp.exec:\rppljhp.exe93⤵PID:2980
-
\??\c:\xvrndfr.exec:\xvrndfr.exe94⤵PID:2764
-
\??\c:\txtdhnt.exec:\txtdhnt.exe95⤵PID:2996
-
\??\c:\nrffx.exec:\nrffx.exe96⤵PID:2452
-
\??\c:\nhjhtlx.exec:\nhjhtlx.exe97⤵PID:2344
-
\??\c:\fphbbv.exec:\fphbbv.exe98⤵PID:1392
-
\??\c:\pfltflb.exec:\pfltflb.exe99⤵PID:916
-
\??\c:\xbbfj.exec:\xbbfj.exe100⤵PID:1316
-
\??\c:\hvhvn.exec:\hvhvn.exe101⤵PID:1440
-
\??\c:\tbvlpbp.exec:\tbvlpbp.exe102⤵PID:2428
-
\??\c:\lbjnldx.exec:\lbjnldx.exe103⤵PID:1096
-
\??\c:\lnftbv.exec:\lnftbv.exe104⤵PID:1848
-
\??\c:\hnnrb.exec:\hnnrb.exe105⤵PID:960
-
\??\c:\jrbtl.exec:\jrbtl.exe106⤵PID:1624
-
\??\c:\frlnp.exec:\frlnp.exe107⤵PID:912
-
\??\c:\xtpdd.exec:\xtpdd.exe108⤵PID:2560
-
\??\c:\prnppdl.exec:\prnppdl.exe109⤵PID:1312
-
\??\c:\xvjfnn.exec:\xvjfnn.exe110⤵PID:2036
-
\??\c:\pfrnj.exec:\pfrnj.exe111⤵PID:2328
-
\??\c:\tbfdbfx.exec:\tbfdbfx.exe112⤵PID:2992
-
\??\c:\nrfln.exec:\nrfln.exe113⤵PID:1636
-
\??\c:\rhfdxbt.exec:\rhfdxbt.exe114⤵PID:2276
-
\??\c:\hxbvxdd.exec:\hxbvxdd.exe115⤵
- System Location Discovery: System Language Discovery
PID:1028 -
\??\c:\ndfrtnx.exec:\ndfrtnx.exe116⤵PID:1980
-
\??\c:\hthvlb.exec:\hthvlb.exe117⤵PID:884
-
\??\c:\lxbdxx.exec:\lxbdxx.exe118⤵PID:2748
-
\??\c:\djtjbrx.exec:\djtjbrx.exe119⤵PID:2820
-
\??\c:\lhthh.exec:\lhthh.exe120⤵PID:584
-
\??\c:\hrrhpn.exec:\hrrhpn.exe121⤵PID:2852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-