Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 09:06
Behavioral task
behavioral1
Sample
c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe
-
Size
91KB
-
MD5
f66665e8915c3d3682adc114cd97f658
-
SHA1
790d90a518b13d1abd9356b21b34d84257ff9b30
-
SHA256
c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379
-
SHA512
433dff41a794073667047e34048dd625f0f2cab5757f43d17e98b65a5b188ce83cd1e94e11deaa2210c08f0187e1c9b96bb23b8f28bfedadf3d57a7b4cbbf90b
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8yaVskCzYBbKd+XsWgADUOj2YUW+S436CS:9hOmTsF93UYfwC6GIoutyaVszyKd+XYM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/2820-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2240-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1468-51-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2924-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1468-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/776-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1892-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2296-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/364-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/956-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/692-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1804-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1804-242-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2584-302-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2348-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2240-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1068-427-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1068-426-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1496-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2440-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/304-472-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1480-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-555-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1724-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-587-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3068-632-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-633-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2620-653-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2352-677-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2916-719-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/800-824-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/800-829-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2664-861-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1172-875-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2748-909-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1088-1023-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/944-1108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-1133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-1252-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2124-1274-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2600-1301-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/1136-1314-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2240 bnjppr.exe 2220 vhjdlh.exe 2968 xvjtn.exe 2344 jdhxn.exe 1468 nppnb.exe 2168 bbnfnr.exe 2924 tbphpft.exe 2812 pxhldd.exe 2708 tppddh.exe 776 dtxhnr.exe 1976 rjxldfv.exe 2840 dpnfxx.exe 1892 jnlfn.exe 2800 dftdldx.exe 2264 tvjjxrj.exe 2296 dbxdnlt.exe 364 ldflnbh.exe 2308 tltxxtd.exe 2440 lrltl.exe 1972 rbvffrr.exe 2496 rlhxnlp.exe 900 hbhpllt.exe 872 hxbfnvt.exe 956 xbdvb.exe 692 dpplfd.exe 1804 tlnnxx.exe 392 fpnnx.exe 2660 tflvp.exe 760 brfdt.exe 2692 vxvrlt.exe 2004 jxvpxl.exe 2208 bhrpd.exe 2584 nxbdx.exe 2348 lthfb.exe 2240 vjhnt.exe 2220 jprxt.exe 2980 hjxjdl.exe 2976 vjbrdx.exe 2872 tjbbb.exe 2748 xrfrnf.exe 1648 lxfrtn.exe 2852 jdhblh.exe 2912 htjfv.exe 2772 ftvvdv.exe 2580 rndpn.exe 2180 fbbbjt.exe 2256 ldlbr.exe 1312 xllxvr.exe 1636 txvptt.exe 2840 xxxdxd.exe 3004 ljdhd.exe 1068 dhxdjl.exe 2728 jrfltlb.exe 2364 lhnvv.exe 304 tpvltph.exe 1496 hdrjjv.exe 2244 jbtrrfx.exe 2836 xppxnbd.exe 2084 vtjxbj.exe 2440 bpdbxhf.exe 1972 dhxxfd.exe 2300 txfdl.exe 900 dnpnpdb.exe 1936 bnjjfh.exe -
resource yara_rule behavioral1/memory/2820-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2820-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016fc9-26.dat upx behavioral1/memory/2220-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d69-17.dat upx behavioral1/memory/2240-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000012262-9.dat upx behavioral1/memory/2968-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000170f8-35.dat upx behavioral1/files/0x000700000001756b-45.dat upx behavioral1/memory/2344-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1468-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2924-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0002000000018334-66.dat upx behavioral1/files/0x000700000001756e-58.dat upx behavioral1/memory/1468-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000186b7-74.dat upx behavioral1/files/0x000600000001932a-82.dat upx behavioral1/files/0x00050000000195bd-94.dat upx behavioral1/memory/776-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2708-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1976-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c1-103.dat upx behavioral1/files/0x00050000000195c5-121.dat upx behavioral1/memory/2840-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c3-112.dat upx behavioral1/files/0x00050000000195c6-131.dat upx behavioral1/memory/1892-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c7-140.dat upx behavioral1/memory/2800-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0012000000016d3f-150.dat upx behavioral1/memory/2264-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2296-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960c-158.dat upx behavioral1/files/0x0005000000019643-166.dat upx behavioral1/memory/364-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001975a-174.dat upx behavioral1/files/0x0005000000019761-183.dat upx behavioral1/files/0x00050000000197fd-188.dat upx behavioral1/memory/900-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019820-200.dat upx behavioral1/files/0x000500000001998d-208.dat upx behavioral1/memory/2496-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf5-216.dat upx behavioral1/files/0x0005000000019bf6-225.dat upx behavioral1/memory/956-224-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf9-235.dat upx behavioral1/memory/692-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1804-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/392-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c3c-244.dat upx behavioral1/files/0x0005000000019d61-253.dat upx behavioral1/files/0x0005000000019d62-261.dat upx behavioral1/memory/760-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d6d-269.dat upx behavioral1/memory/2692-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2004-280-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019e92-279.dat upx behavioral1/files/0x0005000000019fd4-289.dat upx behavioral1/memory/2348-309-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2240-316-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2980-324-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2976-338-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1648-351-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlhndr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bftndf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxjxlpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvtjjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bffntrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhnxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvbjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppblbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhtlpxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntdljvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxjhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjbxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdvfrph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blxfjjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntpntf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfpttrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjhrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phrxjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjrxdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddprhbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtnthhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjbrdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbbvpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtftpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnphr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnfnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdtbbbx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2820 wrote to memory of 2240 2820 c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe 30 PID 2820 wrote to memory of 2240 2820 c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe 30 PID 2820 wrote to memory of 2240 2820 c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe 30 PID 2820 wrote to memory of 2240 2820 c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe 30 PID 2240 wrote to memory of 2220 2240 bnjppr.exe 31 PID 2240 wrote to memory of 2220 2240 bnjppr.exe 31 PID 2240 wrote to memory of 2220 2240 bnjppr.exe 31 PID 2240 wrote to memory of 2220 2240 bnjppr.exe 31 PID 2220 wrote to memory of 2968 2220 vhjdlh.exe 32 PID 2220 wrote to memory of 2968 2220 vhjdlh.exe 32 PID 2220 wrote to memory of 2968 2220 vhjdlh.exe 32 PID 2220 wrote to memory of 2968 2220 vhjdlh.exe 32 PID 2968 wrote to memory of 2344 2968 xvjtn.exe 33 PID 2968 wrote to memory of 2344 2968 xvjtn.exe 33 PID 2968 wrote to memory of 2344 2968 xvjtn.exe 33 PID 2968 wrote to memory of 2344 2968 xvjtn.exe 33 PID 2344 wrote to memory of 1468 2344 jdhxn.exe 34 PID 2344 wrote to memory of 1468 2344 jdhxn.exe 34 PID 2344 wrote to memory of 1468 2344 jdhxn.exe 34 PID 2344 wrote to memory of 1468 2344 jdhxn.exe 34 PID 1468 wrote to memory of 2168 1468 nppnb.exe 35 PID 1468 wrote to memory of 2168 1468 nppnb.exe 35 PID 1468 wrote to memory of 2168 1468 nppnb.exe 35 PID 1468 wrote to memory of 2168 1468 nppnb.exe 35 PID 2168 wrote to memory of 2924 2168 bbnfnr.exe 36 PID 2168 wrote to memory of 2924 2168 bbnfnr.exe 36 PID 2168 wrote to memory of 2924 2168 bbnfnr.exe 36 PID 2168 wrote to memory of 2924 2168 bbnfnr.exe 36 PID 2924 wrote to memory of 2812 2924 tbphpft.exe 37 PID 2924 wrote to memory of 2812 2924 tbphpft.exe 37 PID 2924 wrote to memory of 2812 2924 tbphpft.exe 37 PID 2924 wrote to memory of 2812 2924 tbphpft.exe 37 PID 2812 wrote to memory of 2708 2812 pxhldd.exe 38 PID 2812 wrote to memory of 2708 2812 pxhldd.exe 38 PID 2812 wrote to memory of 2708 2812 pxhldd.exe 38 PID 2812 wrote to memory of 2708 2812 pxhldd.exe 38 PID 2708 wrote to memory of 776 2708 tppddh.exe 39 PID 2708 wrote to memory of 776 2708 tppddh.exe 39 PID 2708 wrote to memory of 776 2708 tppddh.exe 39 PID 2708 wrote to memory of 776 2708 tppddh.exe 39 PID 776 wrote to memory of 1976 776 dtxhnr.exe 40 PID 776 wrote to memory of 1976 776 dtxhnr.exe 40 PID 776 wrote to memory of 1976 776 dtxhnr.exe 40 PID 776 wrote to memory of 1976 776 dtxhnr.exe 40 PID 1976 wrote to memory of 2840 1976 rjxldfv.exe 41 PID 1976 wrote to memory of 2840 1976 rjxldfv.exe 41 PID 1976 wrote to memory of 2840 1976 rjxldfv.exe 41 PID 1976 wrote to memory of 2840 1976 rjxldfv.exe 41 PID 2840 wrote to memory of 1892 2840 dpnfxx.exe 42 PID 2840 wrote to memory of 1892 2840 dpnfxx.exe 42 PID 2840 wrote to memory of 1892 2840 dpnfxx.exe 42 PID 2840 wrote to memory of 1892 2840 dpnfxx.exe 42 PID 1892 wrote to memory of 2800 1892 jnlfn.exe 43 PID 1892 wrote to memory of 2800 1892 jnlfn.exe 43 PID 1892 wrote to memory of 2800 1892 jnlfn.exe 43 PID 1892 wrote to memory of 2800 1892 jnlfn.exe 43 PID 2800 wrote to memory of 2264 2800 dftdldx.exe 44 PID 2800 wrote to memory of 2264 2800 dftdldx.exe 44 PID 2800 wrote to memory of 2264 2800 dftdldx.exe 44 PID 2800 wrote to memory of 2264 2800 dftdldx.exe 44 PID 2264 wrote to memory of 2296 2264 tvjjxrj.exe 45 PID 2264 wrote to memory of 2296 2264 tvjjxrj.exe 45 PID 2264 wrote to memory of 2296 2264 tvjjxrj.exe 45 PID 2264 wrote to memory of 2296 2264 tvjjxrj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe"C:\Users\Admin\AppData\Local\Temp\c6c4c9e56c0e4c526e57e9229474e1a231b4037971cebb38440a0e286dd75379.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\bnjppr.exec:\bnjppr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\vhjdlh.exec:\vhjdlh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\xvjtn.exec:\xvjtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\jdhxn.exec:\jdhxn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\nppnb.exec:\nppnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\bbnfnr.exec:\bbnfnr.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\tbphpft.exec:\tbphpft.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\pxhldd.exec:\pxhldd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\tppddh.exec:\tppddh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\dtxhnr.exec:\dtxhnr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\rjxldfv.exec:\rjxldfv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\dpnfxx.exec:\dpnfxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\jnlfn.exec:\jnlfn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\dftdldx.exec:\dftdldx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\tvjjxrj.exec:\tvjjxrj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\dbxdnlt.exec:\dbxdnlt.exe17⤵
- Executes dropped EXE
PID:2296 -
\??\c:\ldflnbh.exec:\ldflnbh.exe18⤵
- Executes dropped EXE
PID:364 -
\??\c:\tltxxtd.exec:\tltxxtd.exe19⤵
- Executes dropped EXE
PID:2308 -
\??\c:\lrltl.exec:\lrltl.exe20⤵
- Executes dropped EXE
PID:2440 -
\??\c:\rbvffrr.exec:\rbvffrr.exe21⤵
- Executes dropped EXE
PID:1972 -
\??\c:\rlhxnlp.exec:\rlhxnlp.exe22⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hbhpllt.exec:\hbhpllt.exe23⤵
- Executes dropped EXE
PID:900 -
\??\c:\hxbfnvt.exec:\hxbfnvt.exe24⤵
- Executes dropped EXE
PID:872 -
\??\c:\xbdvb.exec:\xbdvb.exe25⤵
- Executes dropped EXE
PID:956 -
\??\c:\dpplfd.exec:\dpplfd.exe26⤵
- Executes dropped EXE
PID:692 -
\??\c:\tlnnxx.exec:\tlnnxx.exe27⤵
- Executes dropped EXE
PID:1804 -
\??\c:\fpnnx.exec:\fpnnx.exe28⤵
- Executes dropped EXE
PID:392 -
\??\c:\tflvp.exec:\tflvp.exe29⤵
- Executes dropped EXE
PID:2660 -
\??\c:\brfdt.exec:\brfdt.exe30⤵
- Executes dropped EXE
PID:760 -
\??\c:\vxvrlt.exec:\vxvrlt.exe31⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jxvpxl.exec:\jxvpxl.exe32⤵
- Executes dropped EXE
PID:2004 -
\??\c:\bhrpd.exec:\bhrpd.exe33⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nxbdx.exec:\nxbdx.exe34⤵
- Executes dropped EXE
PID:2584 -
\??\c:\lthfb.exec:\lthfb.exe35⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vjhnt.exec:\vjhnt.exe36⤵
- Executes dropped EXE
PID:2240 -
\??\c:\jprxt.exec:\jprxt.exe37⤵
- Executes dropped EXE
PID:2220 -
\??\c:\hjxjdl.exec:\hjxjdl.exe38⤵
- Executes dropped EXE
PID:2980 -
\??\c:\vjbrdx.exec:\vjbrdx.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2976 -
\??\c:\tjbbb.exec:\tjbbb.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\xrfrnf.exec:\xrfrnf.exe41⤵
- Executes dropped EXE
PID:2748 -
\??\c:\lxfrtn.exec:\lxfrtn.exe42⤵
- Executes dropped EXE
PID:1648 -
\??\c:\jdhblh.exec:\jdhblh.exe43⤵
- Executes dropped EXE
PID:2852 -
\??\c:\htjfv.exec:\htjfv.exe44⤵
- Executes dropped EXE
PID:2912 -
\??\c:\ftvvdv.exec:\ftvvdv.exe45⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rndpn.exec:\rndpn.exe46⤵
- Executes dropped EXE
PID:2580 -
\??\c:\fbbbjt.exec:\fbbbjt.exe47⤵
- Executes dropped EXE
PID:2180 -
\??\c:\ldlbr.exec:\ldlbr.exe48⤵
- Executes dropped EXE
PID:2256 -
\??\c:\xllxvr.exec:\xllxvr.exe49⤵
- Executes dropped EXE
PID:1312 -
\??\c:\txvptt.exec:\txvptt.exe50⤵
- Executes dropped EXE
PID:1636 -
\??\c:\xxxdxd.exec:\xxxdxd.exe51⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ljdhd.exec:\ljdhd.exe52⤵
- Executes dropped EXE
PID:3004 -
\??\c:\dhxdjl.exec:\dhxdjl.exe53⤵
- Executes dropped EXE
PID:1068 -
\??\c:\jrfltlb.exec:\jrfltlb.exe54⤵
- Executes dropped EXE
PID:2728 -
\??\c:\lhnvv.exec:\lhnvv.exe55⤵
- Executes dropped EXE
PID:2364 -
\??\c:\tpvltph.exec:\tpvltph.exe56⤵
- Executes dropped EXE
PID:304 -
\??\c:\hdrjjv.exec:\hdrjjv.exe57⤵
- Executes dropped EXE
PID:1496 -
\??\c:\jbtrrfx.exec:\jbtrrfx.exe58⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xppxnbd.exec:\xppxnbd.exe59⤵
- Executes dropped EXE
PID:2836 -
\??\c:\vtjxbj.exec:\vtjxbj.exe60⤵
- Executes dropped EXE
PID:2084 -
\??\c:\bpdbxhf.exec:\bpdbxhf.exe61⤵
- Executes dropped EXE
PID:2440 -
\??\c:\dhxxfd.exec:\dhxxfd.exe62⤵
- Executes dropped EXE
PID:1972 -
\??\c:\txfdl.exec:\txfdl.exe63⤵
- Executes dropped EXE
PID:2300 -
\??\c:\dnpnpdb.exec:\dnpnpdb.exe64⤵
- Executes dropped EXE
PID:900 -
\??\c:\bnjjfh.exec:\bnjjfh.exe65⤵
- Executes dropped EXE
PID:1936 -
\??\c:\ntjpl.exec:\ntjpl.exe66⤵PID:1480
-
\??\c:\blxjf.exec:\blxjf.exe67⤵PID:1952
-
\??\c:\tnbfjl.exec:\tnbfjl.exe68⤵PID:620
-
\??\c:\dbftxl.exec:\dbftxl.exe69⤵PID:1740
-
\??\c:\ljppld.exec:\ljppld.exe70⤵PID:2104
-
\??\c:\rrvpd.exec:\rrvpd.exe71⤵PID:392
-
\??\c:\thpbnlv.exec:\thpbnlv.exe72⤵PID:1680
-
\??\c:\bplplbj.exec:\bplplbj.exe73⤵PID:2672
-
\??\c:\btfhx.exec:\btfhx.exe74⤵PID:2692
-
\??\c:\nfhbxll.exec:\nfhbxll.exe75⤵PID:1536
-
\??\c:\npxln.exec:\npxln.exe76⤵PID:1728
-
\??\c:\bppllbf.exec:\bppllbf.exe77⤵PID:1724
-
\??\c:\bpfjf.exec:\bpfjf.exe78⤵PID:2108
-
\??\c:\jxllnhj.exec:\jxllnhj.exe79⤵PID:2276
-
\??\c:\xllrx.exec:\xllrx.exe80⤵PID:1692
-
\??\c:\dblllv.exec:\dblllv.exe81⤵PID:1592
-
\??\c:\jbbhvdp.exec:\jbbhvdp.exe82⤵PID:2996
-
\??\c:\ntblh.exec:\ntblh.exe83⤵PID:2980
-
\??\c:\vtptvbd.exec:\vtptvbd.exe84⤵PID:2948
-
\??\c:\hvjlv.exec:\hvjlv.exe85⤵PID:3068
-
\??\c:\jfhnf.exec:\jfhnf.exe86⤵PID:2764
-
\??\c:\prjbf.exec:\prjbf.exe87⤵PID:2756
-
\??\c:\tftrbf.exec:\tftrbf.exe88⤵PID:2860
-
\??\c:\hrvjtfj.exec:\hrvjtfj.exe89⤵PID:2620
-
\??\c:\btbprr.exec:\btbprr.exe90⤵PID:2452
-
\??\c:\ltrnr.exec:\ltrnr.exe91⤵PID:2596
-
\??\c:\dvvvrb.exec:\dvvvrb.exe92⤵PID:2352
-
\??\c:\jxxjjlv.exec:\jxxjjlv.exe93⤵PID:1312
-
\??\c:\ndfvb.exec:\ndfvb.exe94⤵PID:3012
-
\??\c:\bffhlb.exec:\bffhlb.exe95⤵PID:1476
-
\??\c:\thvxjh.exec:\thvxjh.exe96⤵PID:2028
-
\??\c:\jltjb.exec:\jltjb.exe97⤵PID:2148
-
\??\c:\httvn.exec:\httvn.exe98⤵PID:2076
-
\??\c:\fttjnb.exec:\fttjnb.exe99⤵PID:2916
-
\??\c:\xxlbd.exec:\xxlbd.exe100⤵
- System Location Discovery: System Language Discovery
PID:2020 -
\??\c:\rfjxhb.exec:\rfjxhb.exe101⤵PID:1828
-
\??\c:\ljrftb.exec:\ljrftb.exe102⤵PID:2280
-
\??\c:\vvfbrr.exec:\vvfbrr.exe103⤵PID:2304
-
\??\c:\djfjxt.exec:\djfjxt.exe104⤵PID:2528
-
\??\c:\dpbttjj.exec:\dpbttjj.exe105⤵PID:2704
-
\??\c:\hvvdfd.exec:\hvvdfd.exe106⤵PID:2164
-
\??\c:\jbpxv.exec:\jbpxv.exe107⤵PID:2300
-
\??\c:\hjrxdv.exec:\hjrxdv.exe108⤵
- System Location Discovery: System Language Discovery
PID:960 -
\??\c:\bdnbd.exec:\bdnbd.exe109⤵PID:872
-
\??\c:\fjdln.exec:\fjdln.exe110⤵PID:1660
-
\??\c:\nvprdj.exec:\nvprdj.exe111⤵PID:1452
-
\??\c:\rrttlfx.exec:\rrttlfx.exe112⤵PID:2668
-
\??\c:\xfvnlb.exec:\xfvnlb.exe113⤵PID:2388
-
\??\c:\hpfrbd.exec:\hpfrbd.exe114⤵PID:2204
-
\??\c:\bbvrrf.exec:\bbvrrf.exe115⤵PID:1896
-
\??\c:\vhbvnr.exec:\vhbvnr.exe116⤵PID:800
-
\??\c:\xbbjdx.exec:\xbbjdx.exe117⤵PID:2376
-
\??\c:\pldprld.exec:\pldprld.exe118⤵PID:580
-
\??\c:\dnhrdb.exec:\dnhrdb.exe119⤵PID:2680
-
\??\c:\nvnlvx.exec:\nvnlvx.exe120⤵PID:892
-
\??\c:\hxpprjp.exec:\hxpprjp.exe121⤵PID:2664
-
\??\c:\ljtrdh.exec:\ljtrdh.exe122⤵PID:2848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-