Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22/11/2024, 05:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe
-
Size
453KB
-
MD5
c5d9399bdf4980b8ad641ab5d17d8a98
-
SHA1
50035fa797db18a83cabb3911c7394f0ca052c36
-
SHA256
efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e
-
SHA512
30347dd145554dd1aed8a09b584542ea8b06e94ca8c7ef36fadd4793531f1fcbb95318e7a9974445e951b068e9b8e0eaf7393a6dad00c78da7b40edb9c77383a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetX:q7Tc2NYHUrAwfMp3CDtX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2528-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1336-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/644-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1204-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-248-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2484-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-268-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2296-276-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1688-305-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/604-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-326-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2880-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/436-438-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2300-455-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/368-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/368-490-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2108-515-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1772-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-561-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2972-618-0x0000000000280000-0x00000000002AA000-memory.dmp family_blackmoon behavioral1/memory/2988-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-711-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2860-733-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3048 rbdnd.exe 2916 ptjpl.exe 3012 lndhtf.exe 568 jtbrnpb.exe 2804 jhjdvdb.exe 2816 bdjxrth.exe 1336 fldlrdn.exe 644 rnrbl.exe 2452 vvhrvnd.exe 1720 tnjldjx.exe 2276 ltxxntb.exe 1928 ljrftp.exe 1956 rtnpxh.exe 1148 xdtlbd.exe 2328 fjhnd.exe 1800 pljlx.exe 1872 ldffrnj.exe 2412 xxlvlrd.exe 1204 rjjxp.exe 2440 jrtnhtl.exe 2492 vbfnxfd.exe 864 jpnhnh.exe 1104 lfldl.exe 2460 rvhbbp.exe 592 njbtndt.exe 2484 njdvv.exe 1544 nvlftl.exe 2296 xtvpj.exe 2604 rpxdn.exe 1568 jblhl.exe 1688 bnflv.exe 2528 hvvdlb.exe 604 fnlnj.exe 2924 bfdntl.exe 2880 rjjvbp.exe 2904 rbdvb.exe 2124 brjvftr.exe 2144 brrpt.exe 2824 jjlpnl.exe 2800 jrtdln.exe 2552 ttbvl.exe 836 hppdr.exe 2748 bplbj.exe 1700 ltjnfph.exe 1468 dvbllxh.exe 1720 fdbnrlj.exe 436 drvfh.exe 2416 rjhbjb.exe 2832 ldjrx.exe 2480 brdvpl.exe 1628 tfrvjj.exe 2448 rrfxldv.exe 2300 nxvtnt.exe 272 nnjtl.exe 368 rxfxvdj.exe 2408 fpdfn.exe 2376 fnhntf.exe 2232 dfnxhp.exe 2068 ljvtl.exe 892 xtdbbb.exe 1636 hrpjnrt.exe 2108 jbftrn.exe 2140 brtdtth.exe 2204 nttrjfp.exe -
resource yara_rule behavioral1/memory/2528-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-65-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2816-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/644-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-455-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/368-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-618-0x0000000000280000-0x00000000002AA000-memory.dmp upx behavioral1/memory/2988-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-710-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njttdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhhxfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtnvbdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prxvfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpxdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjldr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtlnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbjlvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxphvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfjfnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbfnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njbtndt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrnvrft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxbvdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drpplt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvlvfvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxvtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxfhjvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltbxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhhfhtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxtdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txjrnxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvnbvld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxdpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhtfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnlnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnvrjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrljf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 3048 2528 efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe 30 PID 2528 wrote to memory of 3048 2528 efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe 30 PID 2528 wrote to memory of 3048 2528 efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe 30 PID 2528 wrote to memory of 3048 2528 efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe 30 PID 3048 wrote to memory of 2916 3048 rbdnd.exe 31 PID 3048 wrote to memory of 2916 3048 rbdnd.exe 31 PID 3048 wrote to memory of 2916 3048 rbdnd.exe 31 PID 3048 wrote to memory of 2916 3048 rbdnd.exe 31 PID 2916 wrote to memory of 3012 2916 ptjpl.exe 32 PID 2916 wrote to memory of 3012 2916 ptjpl.exe 32 PID 2916 wrote to memory of 3012 2916 ptjpl.exe 32 PID 2916 wrote to memory of 3012 2916 ptjpl.exe 32 PID 3012 wrote to memory of 568 3012 lndhtf.exe 33 PID 3012 wrote to memory of 568 3012 lndhtf.exe 33 PID 3012 wrote to memory of 568 3012 lndhtf.exe 33 PID 3012 wrote to memory of 568 3012 lndhtf.exe 33 PID 568 wrote to memory of 2804 568 jtbrnpb.exe 34 PID 568 wrote to memory of 2804 568 jtbrnpb.exe 34 PID 568 wrote to memory of 2804 568 jtbrnpb.exe 34 PID 568 wrote to memory of 2804 568 jtbrnpb.exe 34 PID 2804 wrote to memory of 2816 2804 jhjdvdb.exe 35 PID 2804 wrote to memory of 2816 2804 jhjdvdb.exe 35 PID 2804 wrote to memory of 2816 2804 jhjdvdb.exe 35 PID 2804 wrote to memory of 2816 2804 jhjdvdb.exe 35 PID 2816 wrote to memory of 1336 2816 bdjxrth.exe 36 PID 2816 wrote to memory of 1336 2816 bdjxrth.exe 36 PID 2816 wrote to memory of 1336 2816 bdjxrth.exe 36 PID 2816 wrote to memory of 1336 2816 bdjxrth.exe 36 PID 1336 wrote to memory of 644 1336 fldlrdn.exe 37 PID 1336 wrote to memory of 644 1336 fldlrdn.exe 37 PID 1336 wrote to memory of 644 1336 fldlrdn.exe 37 PID 1336 wrote to memory of 644 1336 fldlrdn.exe 37 PID 644 wrote to memory of 2452 644 rnrbl.exe 38 PID 644 wrote to memory of 2452 644 rnrbl.exe 38 PID 644 wrote to memory of 2452 644 rnrbl.exe 38 PID 644 wrote to memory of 2452 644 rnrbl.exe 38 PID 2452 wrote to memory of 1720 2452 vvhrvnd.exe 39 PID 2452 wrote to memory of 1720 2452 vvhrvnd.exe 39 PID 2452 wrote to memory of 1720 2452 vvhrvnd.exe 39 PID 2452 wrote to memory of 1720 2452 vvhrvnd.exe 39 PID 1720 wrote to memory of 2276 1720 tnjldjx.exe 40 PID 1720 wrote to memory of 2276 1720 tnjldjx.exe 40 PID 1720 wrote to memory of 2276 1720 tnjldjx.exe 40 PID 1720 wrote to memory of 2276 1720 tnjldjx.exe 40 PID 2276 wrote to memory of 1928 2276 ltxxntb.exe 41 PID 2276 wrote to memory of 1928 2276 ltxxntb.exe 41 PID 2276 wrote to memory of 1928 2276 ltxxntb.exe 41 PID 2276 wrote to memory of 1928 2276 ltxxntb.exe 41 PID 1928 wrote to memory of 1956 1928 ljrftp.exe 42 PID 1928 wrote to memory of 1956 1928 ljrftp.exe 42 PID 1928 wrote to memory of 1956 1928 ljrftp.exe 42 PID 1928 wrote to memory of 1956 1928 ljrftp.exe 42 PID 1956 wrote to memory of 1148 1956 rtnpxh.exe 43 PID 1956 wrote to memory of 1148 1956 rtnpxh.exe 43 PID 1956 wrote to memory of 1148 1956 rtnpxh.exe 43 PID 1956 wrote to memory of 1148 1956 rtnpxh.exe 43 PID 1148 wrote to memory of 2328 1148 xdtlbd.exe 44 PID 1148 wrote to memory of 2328 1148 xdtlbd.exe 44 PID 1148 wrote to memory of 2328 1148 xdtlbd.exe 44 PID 1148 wrote to memory of 2328 1148 xdtlbd.exe 44 PID 2328 wrote to memory of 1800 2328 fjhnd.exe 45 PID 2328 wrote to memory of 1800 2328 fjhnd.exe 45 PID 2328 wrote to memory of 1800 2328 fjhnd.exe 45 PID 2328 wrote to memory of 1800 2328 fjhnd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe"C:\Users\Admin\AppData\Local\Temp\efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\rbdnd.exec:\rbdnd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\ptjpl.exec:\ptjpl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\lndhtf.exec:\lndhtf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\jtbrnpb.exec:\jtbrnpb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\jhjdvdb.exec:\jhjdvdb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\bdjxrth.exec:\bdjxrth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\fldlrdn.exec:\fldlrdn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\rnrbl.exec:\rnrbl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\vvhrvnd.exec:\vvhrvnd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\tnjldjx.exec:\tnjldjx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\ltxxntb.exec:\ltxxntb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\ljrftp.exec:\ljrftp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\rtnpxh.exec:\rtnpxh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\xdtlbd.exec:\xdtlbd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\fjhnd.exec:\fjhnd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\pljlx.exec:\pljlx.exe17⤵
- Executes dropped EXE
PID:1800 -
\??\c:\ldffrnj.exec:\ldffrnj.exe18⤵
- Executes dropped EXE
PID:1872 -
\??\c:\xxlvlrd.exec:\xxlvlrd.exe19⤵
- Executes dropped EXE
PID:2412 -
\??\c:\rjjxp.exec:\rjjxp.exe20⤵
- Executes dropped EXE
PID:1204 -
\??\c:\jrtnhtl.exec:\jrtnhtl.exe21⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vbfnxfd.exec:\vbfnxfd.exe22⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jpnhnh.exec:\jpnhnh.exe23⤵
- Executes dropped EXE
PID:864 -
\??\c:\lfldl.exec:\lfldl.exe24⤵
- Executes dropped EXE
PID:1104 -
\??\c:\rvhbbp.exec:\rvhbbp.exe25⤵
- Executes dropped EXE
PID:2460 -
\??\c:\njbtndt.exec:\njbtndt.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:592 -
\??\c:\njdvv.exec:\njdvv.exe27⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nvlftl.exec:\nvlftl.exe28⤵
- Executes dropped EXE
PID:1544 -
\??\c:\xtvpj.exec:\xtvpj.exe29⤵
- Executes dropped EXE
PID:2296 -
\??\c:\rpxdn.exec:\rpxdn.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2604 -
\??\c:\jblhl.exec:\jblhl.exe31⤵
- Executes dropped EXE
PID:1568 -
\??\c:\bnflv.exec:\bnflv.exe32⤵
- Executes dropped EXE
PID:1688 -
\??\c:\hvvdlb.exec:\hvvdlb.exe33⤵
- Executes dropped EXE
PID:2528 -
\??\c:\fnlnj.exec:\fnlnj.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:604 -
\??\c:\bfdntl.exec:\bfdntl.exe35⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rjjvbp.exec:\rjjvbp.exe36⤵
- Executes dropped EXE
PID:2880 -
\??\c:\rbdvb.exec:\rbdvb.exe37⤵
- Executes dropped EXE
PID:2904 -
\??\c:\brjvftr.exec:\brjvftr.exe38⤵
- Executes dropped EXE
PID:2124 -
\??\c:\brrpt.exec:\brrpt.exe39⤵
- Executes dropped EXE
PID:2144 -
\??\c:\jjlpnl.exec:\jjlpnl.exe40⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jrtdln.exec:\jrtdln.exe41⤵
- Executes dropped EXE
PID:2800 -
\??\c:\ttbvl.exec:\ttbvl.exe42⤵
- Executes dropped EXE
PID:2552 -
\??\c:\hppdr.exec:\hppdr.exe43⤵
- Executes dropped EXE
PID:836 -
\??\c:\bplbj.exec:\bplbj.exe44⤵
- Executes dropped EXE
PID:2748 -
\??\c:\ltjnfph.exec:\ltjnfph.exe45⤵
- Executes dropped EXE
PID:1700 -
\??\c:\dvbllxh.exec:\dvbllxh.exe46⤵
- Executes dropped EXE
PID:1468 -
\??\c:\fdbnrlj.exec:\fdbnrlj.exe47⤵
- Executes dropped EXE
PID:1720 -
\??\c:\drvfh.exec:\drvfh.exe48⤵
- Executes dropped EXE
PID:436 -
\??\c:\rjhbjb.exec:\rjhbjb.exe49⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ldjrx.exec:\ldjrx.exe50⤵
- Executes dropped EXE
PID:2832 -
\??\c:\brdvpl.exec:\brdvpl.exe51⤵
- Executes dropped EXE
PID:2480 -
\??\c:\tfrvjj.exec:\tfrvjj.exe52⤵
- Executes dropped EXE
PID:1628 -
\??\c:\rrfxldv.exec:\rrfxldv.exe53⤵
- Executes dropped EXE
PID:2448 -
\??\c:\nxvtnt.exec:\nxvtnt.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2300 -
\??\c:\nnjtl.exec:\nnjtl.exe55⤵
- Executes dropped EXE
PID:272 -
\??\c:\rxfxvdj.exec:\rxfxvdj.exe56⤵
- Executes dropped EXE
PID:368 -
\??\c:\fpdfn.exec:\fpdfn.exe57⤵
- Executes dropped EXE
PID:2408 -
\??\c:\fnhntf.exec:\fnhntf.exe58⤵
- Executes dropped EXE
PID:2376 -
\??\c:\dfnxhp.exec:\dfnxhp.exe59⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ljvtl.exec:\ljvtl.exe60⤵
- Executes dropped EXE
PID:2068 -
\??\c:\xtdbbb.exec:\xtdbbb.exe61⤵
- Executes dropped EXE
PID:892 -
\??\c:\hrpjnrt.exec:\hrpjnrt.exe62⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jbftrn.exec:\jbftrn.exe63⤵
- Executes dropped EXE
PID:2108 -
\??\c:\brtdtth.exec:\brtdtth.exe64⤵
- Executes dropped EXE
PID:2140 -
\??\c:\nttrjfp.exec:\nttrjfp.exe65⤵
- Executes dropped EXE
PID:2204 -
\??\c:\dvnxddt.exec:\dvnxddt.exe66⤵PID:1052
-
\??\c:\jptfd.exec:\jptfd.exe67⤵PID:1772
-
\??\c:\lnlhh.exec:\lnlhh.exe68⤵PID:1936
-
\??\c:\trrbf.exec:\trrbf.exe69⤵PID:108
-
\??\c:\dlvxt.exec:\dlvxt.exe70⤵PID:1300
-
\??\c:\ppxfptl.exec:\ppxfptl.exe71⤵PID:2296
-
\??\c:\fllnbf.exec:\fllnbf.exe72⤵PID:2604
-
\??\c:\ptdrx.exec:\ptdrx.exe73⤵PID:2716
-
\??\c:\dvvhn.exec:\dvvhn.exe74⤵
- System Location Discovery: System Language Discovery
PID:2120 -
\??\c:\dffrfhx.exec:\dffrfhx.exe75⤵PID:1692
-
\??\c:\dfpjdjb.exec:\dfpjdjb.exe76⤵PID:2916
-
\??\c:\nhjjxd.exec:\nhjjxd.exe77⤵PID:2984
-
\??\c:\fjjjpr.exec:\fjjjpr.exe78⤵PID:2864
-
\??\c:\ddrxbnx.exec:\ddrxbnx.exe79⤵PID:2972
-
\??\c:\vlrbp.exec:\vlrbp.exe80⤵PID:2988
-
\??\c:\ldxnlfh.exec:\ldxnlfh.exe81⤵PID:1620
-
\??\c:\vdrlh.exec:\vdrlh.exe82⤵PID:3016
-
\??\c:\xrnrnr.exec:\xrnrnr.exe83⤵PID:2808
-
\??\c:\bfjfr.exec:\bfjfr.exe84⤵PID:2824
-
\??\c:\hlpfdlp.exec:\hlpfdlp.exe85⤵PID:2564
-
\??\c:\xprfr.exec:\xprfr.exe86⤵PID:2500
-
\??\c:\bfxrpbx.exec:\bfxrpbx.exe87⤵PID:836
-
\??\c:\lhfdj.exec:\lhfdj.exe88⤵PID:2476
-
\??\c:\nxjxbjt.exec:\nxjxbjt.exe89⤵PID:860
-
\??\c:\hthph.exec:\hthph.exe90⤵PID:2252
-
\??\c:\jjnpfnh.exec:\jjnpfnh.exe91⤵PID:2136
-
\??\c:\ltxrvhb.exec:\ltxrvhb.exe92⤵PID:1656
-
\??\c:\jlfntl.exec:\jlfntl.exe93⤵PID:2860
-
\??\c:\xbbpvv.exec:\xbbpvv.exe94⤵PID:980
-
\??\c:\nhfhb.exec:\nhfhb.exe95⤵PID:2368
-
\??\c:\dfxvr.exec:\dfxvr.exe96⤵PID:696
-
\??\c:\lhrvhd.exec:\lhrvhd.exe97⤵PID:384
-
\??\c:\dhvrdr.exec:\dhvrdr.exe98⤵PID:1768
-
\??\c:\pdnfrj.exec:\pdnfrj.exe99⤵PID:2180
-
\??\c:\rfhxnnl.exec:\rfhxnnl.exe100⤵PID:1524
-
\??\c:\tlrtp.exec:\tlrtp.exe101⤵PID:2148
-
\??\c:\jptdpvl.exec:\jptdpvl.exe102⤵PID:976
-
\??\c:\dxfpbld.exec:\dxfpbld.exe103⤵PID:1972
-
\??\c:\lrrxhfb.exec:\lrrxhfb.exe104⤵PID:2360
-
\??\c:\rnhtb.exec:\rnhtb.exe105⤵PID:1804
-
\??\c:\rffplx.exec:\rffplx.exe106⤵PID:720
-
\??\c:\jvnvvvf.exec:\jvnvvvf.exe107⤵PID:1104
-
\??\c:\lrfjlnt.exec:\lrfjlnt.exe108⤵PID:2460
-
\??\c:\tdvprnt.exec:\tdvprnt.exe109⤵PID:1284
-
\??\c:\fjdddjj.exec:\fjdddjj.exe110⤵PID:456
-
\??\c:\rbhdxtr.exec:\rbhdxtr.exe111⤵PID:2028
-
\??\c:\ffppv.exec:\ffppv.exe112⤵PID:1172
-
\??\c:\xfbvx.exec:\xfbvx.exe113⤵PID:1736
-
\??\c:\jxbjtjb.exec:\jxbjtjb.exe114⤵PID:2172
-
\??\c:\hjvtv.exec:\hjvtv.exe115⤵PID:1040
-
\??\c:\hpfhdn.exec:\hpfhdn.exe116⤵PID:2604
-
\??\c:\bxxpvp.exec:\bxxpvp.exe117⤵PID:2560
-
\??\c:\brpdn.exec:\brpdn.exe118⤵PID:3048
-
\??\c:\xjndf.exec:\xjndf.exe119⤵PID:2528
-
\??\c:\vfvtbf.exec:\vfvtbf.exe120⤵PID:1476
-
\??\c:\vjjhxf.exec:\vjjhxf.exe121⤵PID:2924
-
\??\c:\rvhjvdb.exec:\rvhjvdb.exe122⤵PID:2980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-