Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 04:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe
-
Size
455KB
-
MD5
baf0de87168f5f8e4372bcd13873d8bf
-
SHA1
42ff17385708196ce129cc9802157220a8a5cdd5
-
SHA256
da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b
-
SHA512
de818867d5b440aee664e80c1524ecb01942da951be3114d1de4a1fd793fdff3325407ccabcd057c6f0c2351b6e9a3548e9eba326a8f46bf8fef1c88b82fbfda
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRy:q7Tc2NYHUrAwfMp3CDRy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2172-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-43-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2184-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-62-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2600-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/272-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-360-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2296-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-700-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1756-755-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/944-802-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1728-809-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-816-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/928-828-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/552-830-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-1089-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/1600-1098-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1944-1097-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2216 lpvhpf.exe 2984 nfdfhdp.exe 2872 tblnrj.exe 2136 vnlbd.exe 2184 jjprdt.exe 3004 jjxdrjh.exe 2600 xxvrhj.exe 2696 fjhxvpx.exe 2080 bnrbrp.exe 1736 thllbvf.exe 2816 dfdhth.exe 2704 jnbdf.exe 3040 xndvbjf.exe 2300 fjvdv.exe 892 tlpxfhf.exe 1248 bjprhb.exe 1240 ddhhhnd.exe 1980 ltvlvh.exe 2192 rnhbndv.exe 2328 rbbll.exe 2200 jvhtfhv.exe 1392 jbnpxxj.exe 808 vhfxdtl.exe 1596 rjhddrp.exe 1300 fpjxbfb.exe 1784 dbhljth.exe 1556 fdxdx.exe 1652 jtxht.exe 540 lljjp.exe 912 pxhlpp.exe 2388 tlxxx.exe 272 hnlvrl.exe 1968 ptnnr.exe 864 xnpdph.exe 2424 hlbnfpf.exe 1672 fvbbh.exe 2976 fhldrh.exe 2096 djthdtt.exe 2848 pvdfbv.exe 2912 ptdvftn.exe 2744 plpvn.exe 2184 lhbnrjf.exe 2296 vbttfbd.exe 2268 nhxrb.exe 2564 pbdthhv.exe 872 jpnnl.exe 2812 dpbht.exe 752 nhptxp.exe 2308 jpjbrn.exe 2964 nphrd.exe 2900 pbvnl.exe 2280 ttprl.exe 2892 tdtplr.exe 1952 bfdvr.exe 2504 thlht.exe 1812 txvnvnn.exe 1820 xxdvx.exe 840 vrptxl.exe 1980 tthpl.exe 2144 vxrfv.exe 2604 bphrddn.exe 2160 rxrph.exe 560 jtvhh.exe 1036 rhnjf.exe -
resource yara_rule behavioral1/memory/2172-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/272-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-413-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2280-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-700-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1756-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-809-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-816-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/552-830-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-843-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-846-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2524-890-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-981-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-1052-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-1117-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfhtndv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjjlpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffldhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvhfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntdvpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bljtfdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hllpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nblffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtrpvdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txpfbhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlljvpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhrxdlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hltjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pljvhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdrrvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldlnfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxjfjlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dblrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxbnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bptblrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plnlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nplfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhnnjxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfbdnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxftrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdrhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tljdfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrnxjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlpblhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxrfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thrjjrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlpxfhh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2216 2172 da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe 29 PID 2172 wrote to memory of 2216 2172 da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe 29 PID 2172 wrote to memory of 2216 2172 da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe 29 PID 2172 wrote to memory of 2216 2172 da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe 29 PID 2216 wrote to memory of 2984 2216 lpvhpf.exe 30 PID 2216 wrote to memory of 2984 2216 lpvhpf.exe 30 PID 2216 wrote to memory of 2984 2216 lpvhpf.exe 30 PID 2216 wrote to memory of 2984 2216 lpvhpf.exe 30 PID 2984 wrote to memory of 2872 2984 nfdfhdp.exe 31 PID 2984 wrote to memory of 2872 2984 nfdfhdp.exe 31 PID 2984 wrote to memory of 2872 2984 nfdfhdp.exe 31 PID 2984 wrote to memory of 2872 2984 nfdfhdp.exe 31 PID 2872 wrote to memory of 2136 2872 tblnrj.exe 32 PID 2872 wrote to memory of 2136 2872 tblnrj.exe 32 PID 2872 wrote to memory of 2136 2872 tblnrj.exe 32 PID 2872 wrote to memory of 2136 2872 tblnrj.exe 32 PID 2136 wrote to memory of 2184 2136 vnlbd.exe 33 PID 2136 wrote to memory of 2184 2136 vnlbd.exe 33 PID 2136 wrote to memory of 2184 2136 vnlbd.exe 33 PID 2136 wrote to memory of 2184 2136 vnlbd.exe 33 PID 2184 wrote to memory of 3004 2184 jjprdt.exe 34 PID 2184 wrote to memory of 3004 2184 jjprdt.exe 34 PID 2184 wrote to memory of 3004 2184 jjprdt.exe 34 PID 2184 wrote to memory of 3004 2184 jjprdt.exe 34 PID 3004 wrote to memory of 2600 3004 jjxdrjh.exe 35 PID 3004 wrote to memory of 2600 3004 jjxdrjh.exe 35 PID 3004 wrote to memory of 2600 3004 jjxdrjh.exe 35 PID 3004 wrote to memory of 2600 3004 jjxdrjh.exe 35 PID 2600 wrote to memory of 2696 2600 xxvrhj.exe 36 PID 2600 wrote to memory of 2696 2600 xxvrhj.exe 36 PID 2600 wrote to memory of 2696 2600 xxvrhj.exe 36 PID 2600 wrote to memory of 2696 2600 xxvrhj.exe 36 PID 2696 wrote to memory of 2080 2696 fjhxvpx.exe 37 PID 2696 wrote to memory of 2080 2696 fjhxvpx.exe 37 PID 2696 wrote to memory of 2080 2696 fjhxvpx.exe 37 PID 2696 wrote to memory of 2080 2696 fjhxvpx.exe 37 PID 2080 wrote to memory of 1736 2080 bnrbrp.exe 38 PID 2080 wrote to memory of 1736 2080 bnrbrp.exe 38 PID 2080 wrote to memory of 1736 2080 bnrbrp.exe 38 PID 2080 wrote to memory of 1736 2080 bnrbrp.exe 38 PID 1736 wrote to memory of 2816 1736 thllbvf.exe 39 PID 1736 wrote to memory of 2816 1736 thllbvf.exe 39 PID 1736 wrote to memory of 2816 1736 thllbvf.exe 39 PID 1736 wrote to memory of 2816 1736 thllbvf.exe 39 PID 2816 wrote to memory of 2704 2816 dfdhth.exe 40 PID 2816 wrote to memory of 2704 2816 dfdhth.exe 40 PID 2816 wrote to memory of 2704 2816 dfdhth.exe 40 PID 2816 wrote to memory of 2704 2816 dfdhth.exe 40 PID 2704 wrote to memory of 3040 2704 jnbdf.exe 41 PID 2704 wrote to memory of 3040 2704 jnbdf.exe 41 PID 2704 wrote to memory of 3040 2704 jnbdf.exe 41 PID 2704 wrote to memory of 3040 2704 jnbdf.exe 41 PID 3040 wrote to memory of 2300 3040 xndvbjf.exe 42 PID 3040 wrote to memory of 2300 3040 xndvbjf.exe 42 PID 3040 wrote to memory of 2300 3040 xndvbjf.exe 42 PID 3040 wrote to memory of 2300 3040 xndvbjf.exe 42 PID 2300 wrote to memory of 892 2300 fjvdv.exe 43 PID 2300 wrote to memory of 892 2300 fjvdv.exe 43 PID 2300 wrote to memory of 892 2300 fjvdv.exe 43 PID 2300 wrote to memory of 892 2300 fjvdv.exe 43 PID 892 wrote to memory of 1248 892 tlpxfhf.exe 44 PID 892 wrote to memory of 1248 892 tlpxfhf.exe 44 PID 892 wrote to memory of 1248 892 tlpxfhf.exe 44 PID 892 wrote to memory of 1248 892 tlpxfhf.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe"C:\Users\Admin\AppData\Local\Temp\da977cb1e3afd4d56f0e49ef978bfb02cda2fe9cee04b112d6e049acb6dc5f2b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\lpvhpf.exec:\lpvhpf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\nfdfhdp.exec:\nfdfhdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\tblnrj.exec:\tblnrj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\vnlbd.exec:\vnlbd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\jjprdt.exec:\jjprdt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\jjxdrjh.exec:\jjxdrjh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\xxvrhj.exec:\xxvrhj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\fjhxvpx.exec:\fjhxvpx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\bnrbrp.exec:\bnrbrp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\thllbvf.exec:\thllbvf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\dfdhth.exec:\dfdhth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\jnbdf.exec:\jnbdf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\xndvbjf.exec:\xndvbjf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\fjvdv.exec:\fjvdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\tlpxfhf.exec:\tlpxfhf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\bjprhb.exec:\bjprhb.exe17⤵
- Executes dropped EXE
PID:1248 -
\??\c:\ddhhhnd.exec:\ddhhhnd.exe18⤵
- Executes dropped EXE
PID:1240 -
\??\c:\ltvlvh.exec:\ltvlvh.exe19⤵
- Executes dropped EXE
PID:1980 -
\??\c:\rnhbndv.exec:\rnhbndv.exe20⤵
- Executes dropped EXE
PID:2192 -
\??\c:\rbbll.exec:\rbbll.exe21⤵
- Executes dropped EXE
PID:2328 -
\??\c:\jvhtfhv.exec:\jvhtfhv.exe22⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jbnpxxj.exec:\jbnpxxj.exe23⤵
- Executes dropped EXE
PID:1392 -
\??\c:\vhfxdtl.exec:\vhfxdtl.exe24⤵
- Executes dropped EXE
PID:808 -
\??\c:\rjhddrp.exec:\rjhddrp.exe25⤵
- Executes dropped EXE
PID:1596 -
\??\c:\fpjxbfb.exec:\fpjxbfb.exe26⤵
- Executes dropped EXE
PID:1300 -
\??\c:\dbhljth.exec:\dbhljth.exe27⤵
- Executes dropped EXE
PID:1784 -
\??\c:\fdxdx.exec:\fdxdx.exe28⤵
- Executes dropped EXE
PID:1556 -
\??\c:\jtxht.exec:\jtxht.exe29⤵
- Executes dropped EXE
PID:1652 -
\??\c:\lljjp.exec:\lljjp.exe30⤵
- Executes dropped EXE
PID:540 -
\??\c:\pxhlpp.exec:\pxhlpp.exe31⤵
- Executes dropped EXE
PID:912 -
\??\c:\tlxxx.exec:\tlxxx.exe32⤵
- Executes dropped EXE
PID:2388 -
\??\c:\hnlvrl.exec:\hnlvrl.exe33⤵
- Executes dropped EXE
PID:272 -
\??\c:\ptnnr.exec:\ptnnr.exe34⤵
- Executes dropped EXE
PID:1968 -
\??\c:\xnpdph.exec:\xnpdph.exe35⤵
- Executes dropped EXE
PID:864 -
\??\c:\hlbnfpf.exec:\hlbnfpf.exe36⤵
- Executes dropped EXE
PID:2424 -
\??\c:\fvbbh.exec:\fvbbh.exe37⤵
- Executes dropped EXE
PID:1672 -
\??\c:\fhldrh.exec:\fhldrh.exe38⤵
- Executes dropped EXE
PID:2976 -
\??\c:\djthdtt.exec:\djthdtt.exe39⤵
- Executes dropped EXE
PID:2096 -
\??\c:\pvdfbv.exec:\pvdfbv.exe40⤵
- Executes dropped EXE
PID:2848 -
\??\c:\ptdvftn.exec:\ptdvftn.exe41⤵
- Executes dropped EXE
PID:2912 -
\??\c:\plpvn.exec:\plpvn.exe42⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lhbnrjf.exec:\lhbnrjf.exe43⤵
- Executes dropped EXE
PID:2184 -
\??\c:\vbttfbd.exec:\vbttfbd.exe44⤵
- Executes dropped EXE
PID:2296 -
\??\c:\nhxrb.exec:\nhxrb.exe45⤵
- Executes dropped EXE
PID:2268 -
\??\c:\pbdthhv.exec:\pbdthhv.exe46⤵
- Executes dropped EXE
PID:2564 -
\??\c:\jpnnl.exec:\jpnnl.exe47⤵
- Executes dropped EXE
PID:872 -
\??\c:\dpbht.exec:\dpbht.exe48⤵
- Executes dropped EXE
PID:2812 -
\??\c:\nhptxp.exec:\nhptxp.exe49⤵
- Executes dropped EXE
PID:752 -
\??\c:\jpjbrn.exec:\jpjbrn.exe50⤵
- Executes dropped EXE
PID:2308 -
\??\c:\nphrd.exec:\nphrd.exe51⤵
- Executes dropped EXE
PID:2964 -
\??\c:\pbvnl.exec:\pbvnl.exe52⤵
- Executes dropped EXE
PID:2900 -
\??\c:\ttprl.exec:\ttprl.exe53⤵
- Executes dropped EXE
PID:2280 -
\??\c:\tdtplr.exec:\tdtplr.exe54⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bfdvr.exec:\bfdvr.exe55⤵
- Executes dropped EXE
PID:1952 -
\??\c:\thlht.exec:\thlht.exe56⤵
- Executes dropped EXE
PID:2504 -
\??\c:\txvnvnn.exec:\txvnvnn.exe57⤵
- Executes dropped EXE
PID:1812 -
\??\c:\xxdvx.exec:\xxdvx.exe58⤵
- Executes dropped EXE
PID:1820 -
\??\c:\vrptxl.exec:\vrptxl.exe59⤵
- Executes dropped EXE
PID:840 -
\??\c:\tthpl.exec:\tthpl.exe60⤵
- Executes dropped EXE
PID:1980 -
\??\c:\vxrfv.exec:\vxrfv.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2144 -
\??\c:\bphrddn.exec:\bphrddn.exe62⤵
- Executes dropped EXE
PID:2604 -
\??\c:\rxrph.exec:\rxrph.exe63⤵
- Executes dropped EXE
PID:2160 -
\??\c:\jtvhh.exec:\jtvhh.exe64⤵
- Executes dropped EXE
PID:560 -
\??\c:\rhnjf.exec:\rhnjf.exe65⤵
- Executes dropped EXE
PID:1036 -
\??\c:\jfvpfrh.exec:\jfvpfrh.exe66⤵PID:944
-
\??\c:\tlhnf.exec:\tlhnf.exe67⤵PID:1148
-
\??\c:\bvrbbbj.exec:\bvrbbbj.exe68⤵PID:976
-
\??\c:\lbrpvv.exec:\lbrpvv.exe69⤵PID:1300
-
\??\c:\hbbppx.exec:\hbbppx.exe70⤵PID:1512
-
\??\c:\rnhhj.exec:\rnhhj.exe71⤵PID:552
-
\??\c:\pnjffpn.exec:\pnjffpn.exe72⤵PID:1656
-
\??\c:\pbnlhnb.exec:\pbnlhnb.exe73⤵PID:1700
-
\??\c:\vlhdxdn.exec:\vlhdxdn.exe74⤵PID:916
-
\??\c:\bxrxb.exec:\bxrxb.exe75⤵PID:2012
-
\??\c:\txldl.exec:\txldl.exe76⤵PID:1504
-
\??\c:\bdbbjd.exec:\bdbbjd.exe77⤵PID:2388
-
\??\c:\nffbnf.exec:\nffbnf.exe78⤵PID:2392
-
\??\c:\fxrfd.exec:\fxrfd.exe79⤵PID:868
-
\??\c:\hftnvb.exec:\hftnvb.exe80⤵PID:2172
-
\??\c:\rvjdr.exec:\rvjdr.exe81⤵PID:1572
-
\??\c:\bxtrhbh.exec:\bxtrhbh.exe82⤵PID:2860
-
\??\c:\pldphxx.exec:\pldphxx.exe83⤵PID:2968
-
\??\c:\xjnfx.exec:\xjnfx.exe84⤵PID:2840
-
\??\c:\rrxnrv.exec:\rrxnrv.exe85⤵PID:2876
-
\??\c:\nxxphpn.exec:\nxxphpn.exe86⤵PID:1528
-
\??\c:\jtltn.exec:\jtltn.exe87⤵PID:2620
-
\??\c:\xnhdhd.exec:\xnhdhd.exe88⤵PID:2712
-
\??\c:\fljtl.exec:\fljtl.exe89⤵PID:2792
-
\??\c:\hvrltxp.exec:\hvrltxp.exe90⤵PID:2788
-
\??\c:\rrlhd.exec:\rrlhd.exe91⤵PID:1576
-
\??\c:\jhltjxl.exec:\jhltjxl.exe92⤵PID:1616
-
\??\c:\xvfhhrf.exec:\xvfhhrf.exe93⤵PID:1580
-
\??\c:\dlttrrj.exec:\dlttrrj.exe94⤵PID:2312
-
\??\c:\dlpdh.exec:\dlpdh.exe95⤵PID:1736
-
\??\c:\btfnfd.exec:\btfnfd.exe96⤵PID:2956
-
\??\c:\vrxjpv.exec:\vrxjpv.exe97⤵PID:2916
-
\??\c:\xltrpdt.exec:\xltrpdt.exe98⤵PID:856
-
\??\c:\hnnfjl.exec:\hnnfjl.exe99⤵PID:2940
-
\??\c:\hlbfvr.exec:\hlbfvr.exe100⤵PID:2092
-
\??\c:\fljdftt.exec:\fljdftt.exe101⤵PID:892
-
\??\c:\btxfp.exec:\btxfp.exe102⤵PID:836
-
\??\c:\lbxjl.exec:\lbxjl.exe103⤵PID:2124
-
\??\c:\rtphx.exec:\rtphx.exe104⤵PID:1756
-
\??\c:\jthjlpr.exec:\jthjlpr.exe105⤵PID:2104
-
\??\c:\hjnfhd.exec:\hjnfhd.exe106⤵PID:2520
-
\??\c:\pthld.exec:\pthld.exe107⤵PID:2336
-
\??\c:\fjbtt.exec:\fjbtt.exe108⤵PID:1944
-
\??\c:\fbrxlxf.exec:\fbrxlxf.exe109⤵PID:528
-
\??\c:\rrllbt.exec:\rrllbt.exe110⤵PID:2580
-
\??\c:\brvvtd.exec:\brvvtd.exe111⤵PID:944
-
\??\c:\vfvbdj.exec:\vfvbdj.exe112⤵PID:1728
-
\??\c:\tljdfb.exec:\tljdfb.exe113⤵
- System Location Discovery: System Language Discovery
PID:2540 -
\??\c:\ftxxd.exec:\ftxxd.exe114⤵PID:1300
-
\??\c:\lpbpvbf.exec:\lpbpvbf.exe115⤵PID:928
-
\??\c:\tltrhr.exec:\tltrhr.exe116⤵PID:552
-
\??\c:\bdplvp.exec:\bdplvp.exe117⤵PID:1848
-
\??\c:\npxrhx.exec:\npxrhx.exe118⤵PID:540
-
\??\c:\vfphr.exec:\vfphr.exe119⤵PID:1676
-
\??\c:\ljrvvb.exec:\ljrvvb.exe120⤵PID:2652
-
\??\c:\fhrxdlh.exec:\fhrxdlh.exe121⤵
- System Location Discovery: System Language Discovery
PID:520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-