Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 09:36
Behavioral task
behavioral1
Sample
e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe
-
Size
81KB
-
MD5
d53da58204c8b5a79a7095497f705bd5
-
SHA1
3bfc90e1ca4f7f68bfd70b7448c8b790e64d2895
-
SHA256
e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7
-
SHA512
77a35d37a47a65b583980c98fd59cabdb88c5ab3650a42e57c9da42f478dfeaa6bb35d3de9624660b4bd4774700d602e0ac9646f88c6b50c44984f56d137e032
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzx8/p7kepA:xhOmTsF93UYfwC6GIout03LzGF6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/564-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2132-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1788-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1788-97-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2624-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1940-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/560-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-187-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2340-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1020-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1020-206-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1656-218-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1732-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/852-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1540-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-290-0x0000000077910000-0x0000000077A2F000-memory.dmp family_blackmoon behavioral1/memory/2456-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-291-0x0000000077A30000-0x0000000077B2A000-memory.dmp family_blackmoon behavioral1/memory/1528-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2356-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2192-420-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1972-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/980-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/556-534-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-628-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2260-797-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2316-811-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-885-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1456-898-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-905-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1680-976-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/960-1015-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2460-1023-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1952-1042-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2644-1075-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/896-1094-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2508-1183-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2508-1182-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1972-1246-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1972-1265-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2772-1344-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2720-1431-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2768 lnbfn.exe 2832 dhjrb.exe 2864 tnhllfv.exe 2836 llvrnxb.exe 2852 xjjfnhx.exe 2888 tpxrr.exe 2708 fdflhhf.exe 2132 dnddxjh.exe 2020 htxrj.exe 1788 fxlfr.exe 2624 vbdvt.exe 1940 pbndp.exe 2264 nhfln.exe 2416 bjbhnnd.exe 580 rlptpp.exe 560 bbjfrvf.exe 2324 tpdjfpv.exe 2276 rltvr.exe 2512 nttlr.exe 2340 jjfvhjj.exe 2104 ntdvxhv.exe 1020 bllpvdr.exe 1656 vflxr.exe 1732 jldbv.exe 2644 vbthpl.exe 1480 tltpj.exe 2028 pvnlnp.exe 2308 tltpp.exe 852 xpntpvf.exe 1540 ftrbj.exe 1572 vrvhdd.exe 2560 bbrhl.exe 1528 nbvxd.exe 2472 tvfdx.exe 3052 djfxlb.exe 3048 jrtbbnh.exe 2892 rtxbbtj.exe 2884 pnhbld.exe 2788 ndvhdnt.exe 2696 dplfpjp.exe 2748 xprrr.exe 2960 nrjhtf.exe 1240 tnhprfl.exe 2148 ljrhv.exe 1768 tffln.exe 2188 jxnpbp.exe 2356 htjrxxr.exe 3000 lfxxrft.exe 836 vtnnl.exe 2192 rlpvph.exe 1972 rljhf.exe 1844 vhxdpht.exe 2496 jpdtjv.exe 2440 xvvlvj.exe 1916 pbhpnb.exe 2076 lfdpb.exe 1544 jhdrtb.exe 980 fdnhv.exe 2104 rjrvnd.exe 1848 jxrjt.exe 824 plbvtt.exe 2164 xxhxlhl.exe 888 fjxxx.exe 304 tvdvdj.exe -
resource yara_rule behavioral1/memory/564-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000012263-8.dat upx behavioral1/memory/564-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000186bb-19.dat upx behavioral1/memory/2832-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2832-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000186c3-27.dat upx behavioral1/memory/2864-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000018b05-36.dat upx behavioral1/memory/2836-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b50-43.dat upx behavioral1/memory/2852-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b54-53.dat upx behavioral1/files/0x0007000000018b59-63.dat upx behavioral1/files/0x000600000001948c-71.dat upx behavioral1/memory/2708-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001975a-80.dat upx behavioral1/memory/2132-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019761-89.dat upx behavioral1/memory/1788-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000197fd-100.dat upx behavioral1/files/0x0005000000019820-107.dat upx behavioral1/memory/2624-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1940-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x001500000001756e-117.dat upx behavioral1/memory/2264-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001998d-127.dat upx behavioral1/memory/2416-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf5-137.dat upx behavioral1/files/0x0005000000019bf6-144.dat upx behavioral1/memory/560-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf9-153.dat upx behavioral1/files/0x0005000000019c3c-161.dat upx behavioral1/memory/2324-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d61-170.dat upx behavioral1/files/0x0005000000019d62-179.dat upx behavioral1/files/0x0005000000019d6d-190.dat upx behavioral1/memory/2340-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019e92-198.dat upx behavioral1/memory/1020-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019fd4-209.dat upx behavioral1/memory/1020-206-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x0005000000019fdd-215.dat upx behavioral1/memory/1732-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a03c-227.dat upx behavioral1/memory/2644-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a049-236.dat upx behavioral1/files/0x000500000001a0b6-244.dat upx behavioral1/memory/2028-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a309-253.dat upx behavioral1/files/0x000500000001a3ab-261.dat upx behavioral1/files/0x000500000001a3f6-269.dat upx behavioral1/memory/852-270-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a3f8-279.dat upx behavioral1/memory/1540-280-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a3fd-288.dat upx behavioral1/memory/2560-290-0x0000000077910000-0x0000000077A2F000-memory.dmp upx behavioral1/memory/2456-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a404-299.dat upx behavioral1/memory/1528-306-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3048-325-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2892-332-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxfjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjhjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxfjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdddn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvbxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brhxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvnxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxbdtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtljpnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllvtrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrjxjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlhxvhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlvrntp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xljxxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thjhvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhtfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvbtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptfdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdnrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbxbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvvlvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prtjxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brxrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjjjrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lldhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbvhvlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbdfxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjfjrnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjrvnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnjrbp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 564 wrote to memory of 2768 564 e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe 30 PID 564 wrote to memory of 2768 564 e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe 30 PID 564 wrote to memory of 2768 564 e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe 30 PID 564 wrote to memory of 2768 564 e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe 30 PID 2768 wrote to memory of 2832 2768 lnbfn.exe 31 PID 2768 wrote to memory of 2832 2768 lnbfn.exe 31 PID 2768 wrote to memory of 2832 2768 lnbfn.exe 31 PID 2768 wrote to memory of 2832 2768 lnbfn.exe 31 PID 2832 wrote to memory of 2864 2832 dhjrb.exe 32 PID 2832 wrote to memory of 2864 2832 dhjrb.exe 32 PID 2832 wrote to memory of 2864 2832 dhjrb.exe 32 PID 2832 wrote to memory of 2864 2832 dhjrb.exe 32 PID 2864 wrote to memory of 2836 2864 tnhllfv.exe 33 PID 2864 wrote to memory of 2836 2864 tnhllfv.exe 33 PID 2864 wrote to memory of 2836 2864 tnhllfv.exe 33 PID 2864 wrote to memory of 2836 2864 tnhllfv.exe 33 PID 2836 wrote to memory of 2852 2836 llvrnxb.exe 34 PID 2836 wrote to memory of 2852 2836 llvrnxb.exe 34 PID 2836 wrote to memory of 2852 2836 llvrnxb.exe 34 PID 2836 wrote to memory of 2852 2836 llvrnxb.exe 34 PID 2852 wrote to memory of 2888 2852 xjjfnhx.exe 35 PID 2852 wrote to memory of 2888 2852 xjjfnhx.exe 35 PID 2852 wrote to memory of 2888 2852 xjjfnhx.exe 35 PID 2852 wrote to memory of 2888 2852 xjjfnhx.exe 35 PID 2888 wrote to memory of 2708 2888 tpxrr.exe 36 PID 2888 wrote to memory of 2708 2888 tpxrr.exe 36 PID 2888 wrote to memory of 2708 2888 tpxrr.exe 36 PID 2888 wrote to memory of 2708 2888 tpxrr.exe 36 PID 2708 wrote to memory of 2132 2708 fdflhhf.exe 37 PID 2708 wrote to memory of 2132 2708 fdflhhf.exe 37 PID 2708 wrote to memory of 2132 2708 fdflhhf.exe 37 PID 2708 wrote to memory of 2132 2708 fdflhhf.exe 37 PID 2132 wrote to memory of 2020 2132 dnddxjh.exe 38 PID 2132 wrote to memory of 2020 2132 dnddxjh.exe 38 PID 2132 wrote to memory of 2020 2132 dnddxjh.exe 38 PID 2132 wrote to memory of 2020 2132 dnddxjh.exe 38 PID 2020 wrote to memory of 1788 2020 htxrj.exe 39 PID 2020 wrote to memory of 1788 2020 htxrj.exe 39 PID 2020 wrote to memory of 1788 2020 htxrj.exe 39 PID 2020 wrote to memory of 1788 2020 htxrj.exe 39 PID 1788 wrote to memory of 2624 1788 fxlfr.exe 40 PID 1788 wrote to memory of 2624 1788 fxlfr.exe 40 PID 1788 wrote to memory of 2624 1788 fxlfr.exe 40 PID 1788 wrote to memory of 2624 1788 fxlfr.exe 40 PID 2624 wrote to memory of 1940 2624 vbdvt.exe 41 PID 2624 wrote to memory of 1940 2624 vbdvt.exe 41 PID 2624 wrote to memory of 1940 2624 vbdvt.exe 41 PID 2624 wrote to memory of 1940 2624 vbdvt.exe 41 PID 1940 wrote to memory of 2264 1940 pbndp.exe 42 PID 1940 wrote to memory of 2264 1940 pbndp.exe 42 PID 1940 wrote to memory of 2264 1940 pbndp.exe 42 PID 1940 wrote to memory of 2264 1940 pbndp.exe 42 PID 2264 wrote to memory of 2416 2264 nhfln.exe 43 PID 2264 wrote to memory of 2416 2264 nhfln.exe 43 PID 2264 wrote to memory of 2416 2264 nhfln.exe 43 PID 2264 wrote to memory of 2416 2264 nhfln.exe 43 PID 2416 wrote to memory of 580 2416 bjbhnnd.exe 44 PID 2416 wrote to memory of 580 2416 bjbhnnd.exe 44 PID 2416 wrote to memory of 580 2416 bjbhnnd.exe 44 PID 2416 wrote to memory of 580 2416 bjbhnnd.exe 44 PID 580 wrote to memory of 560 580 rlptpp.exe 45 PID 580 wrote to memory of 560 580 rlptpp.exe 45 PID 580 wrote to memory of 560 580 rlptpp.exe 45 PID 580 wrote to memory of 560 580 rlptpp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe"C:\Users\Admin\AppData\Local\Temp\e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\lnbfn.exec:\lnbfn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\dhjrb.exec:\dhjrb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\tnhllfv.exec:\tnhllfv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\llvrnxb.exec:\llvrnxb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\xjjfnhx.exec:\xjjfnhx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\tpxrr.exec:\tpxrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\fdflhhf.exec:\fdflhhf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\dnddxjh.exec:\dnddxjh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\htxrj.exec:\htxrj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\fxlfr.exec:\fxlfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\vbdvt.exec:\vbdvt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\pbndp.exec:\pbndp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\nhfln.exec:\nhfln.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\bjbhnnd.exec:\bjbhnnd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\rlptpp.exec:\rlptpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\bbjfrvf.exec:\bbjfrvf.exe17⤵
- Executes dropped EXE
PID:560 -
\??\c:\tpdjfpv.exec:\tpdjfpv.exe18⤵
- Executes dropped EXE
PID:2324 -
\??\c:\rltvr.exec:\rltvr.exe19⤵
- Executes dropped EXE
PID:2276 -
\??\c:\nttlr.exec:\nttlr.exe20⤵
- Executes dropped EXE
PID:2512 -
\??\c:\jjfvhjj.exec:\jjfvhjj.exe21⤵
- Executes dropped EXE
PID:2340 -
\??\c:\ntdvxhv.exec:\ntdvxhv.exe22⤵
- Executes dropped EXE
PID:2104 -
\??\c:\bllpvdr.exec:\bllpvdr.exe23⤵
- Executes dropped EXE
PID:1020 -
\??\c:\vflxr.exec:\vflxr.exe24⤵
- Executes dropped EXE
PID:1656 -
\??\c:\jldbv.exec:\jldbv.exe25⤵
- Executes dropped EXE
PID:1732 -
\??\c:\vbthpl.exec:\vbthpl.exe26⤵
- Executes dropped EXE
PID:2644 -
\??\c:\tltpj.exec:\tltpj.exe27⤵
- Executes dropped EXE
PID:1480 -
\??\c:\pvnlnp.exec:\pvnlnp.exe28⤵
- Executes dropped EXE
PID:2028 -
\??\c:\tltpp.exec:\tltpp.exe29⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xpntpvf.exec:\xpntpvf.exe30⤵
- Executes dropped EXE
PID:852 -
\??\c:\ftrbj.exec:\ftrbj.exe31⤵
- Executes dropped EXE
PID:1540 -
\??\c:\vrvhdd.exec:\vrvhdd.exe32⤵
- Executes dropped EXE
PID:1572 -
\??\c:\bbrhl.exec:\bbrhl.exe33⤵
- Executes dropped EXE
PID:2560 -
\??\c:\txdrv.exec:\txdrv.exe34⤵PID:2456
-
\??\c:\nbvxd.exec:\nbvxd.exe35⤵
- Executes dropped EXE
PID:1528 -
\??\c:\tvfdx.exec:\tvfdx.exe36⤵
- Executes dropped EXE
PID:2472 -
\??\c:\djfxlb.exec:\djfxlb.exe37⤵
- Executes dropped EXE
PID:3052 -
\??\c:\jrtbbnh.exec:\jrtbbnh.exe38⤵
- Executes dropped EXE
PID:3048 -
\??\c:\rtxbbtj.exec:\rtxbbtj.exe39⤵
- Executes dropped EXE
PID:2892 -
\??\c:\pnhbld.exec:\pnhbld.exe40⤵
- Executes dropped EXE
PID:2884 -
\??\c:\ndvhdnt.exec:\ndvhdnt.exe41⤵
- Executes dropped EXE
PID:2788 -
\??\c:\dplfpjp.exec:\dplfpjp.exe42⤵
- Executes dropped EXE
PID:2696 -
\??\c:\xprrr.exec:\xprrr.exe43⤵
- Executes dropped EXE
PID:2748 -
\??\c:\nrjhtf.exec:\nrjhtf.exe44⤵
- Executes dropped EXE
PID:2960 -
\??\c:\tnhprfl.exec:\tnhprfl.exe45⤵
- Executes dropped EXE
PID:1240 -
\??\c:\ljrhv.exec:\ljrhv.exe46⤵
- Executes dropped EXE
PID:2148 -
\??\c:\tffln.exec:\tffln.exe47⤵
- Executes dropped EXE
PID:1768 -
\??\c:\jxnpbp.exec:\jxnpbp.exe48⤵
- Executes dropped EXE
PID:2188 -
\??\c:\htjrxxr.exec:\htjrxxr.exe49⤵
- Executes dropped EXE
PID:2356 -
\??\c:\lfxxrft.exec:\lfxxrft.exe50⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vtnnl.exec:\vtnnl.exe51⤵
- Executes dropped EXE
PID:836 -
\??\c:\rlpvph.exec:\rlpvph.exe52⤵
- Executes dropped EXE
PID:2192 -
\??\c:\rljhf.exec:\rljhf.exe53⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vhxdpht.exec:\vhxdpht.exe54⤵
- Executes dropped EXE
PID:1844 -
\??\c:\jpdtjv.exec:\jpdtjv.exe55⤵
- Executes dropped EXE
PID:2496 -
\??\c:\xvvlvj.exec:\xvvlvj.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2440 -
\??\c:\pbhpnb.exec:\pbhpnb.exe57⤵
- Executes dropped EXE
PID:1916 -
\??\c:\lfdpb.exec:\lfdpb.exe58⤵
- Executes dropped EXE
PID:2076 -
\??\c:\jhdrtb.exec:\jhdrtb.exe59⤵
- Executes dropped EXE
PID:1544 -
\??\c:\fdnhv.exec:\fdnhv.exe60⤵
- Executes dropped EXE
PID:980 -
\??\c:\rjrvnd.exec:\rjrvnd.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2104 -
\??\c:\jxrjt.exec:\jxrjt.exe62⤵
- Executes dropped EXE
PID:1848 -
\??\c:\plbvtt.exec:\plbvtt.exe63⤵
- Executes dropped EXE
PID:824 -
\??\c:\xxhxlhl.exec:\xxhxlhl.exe64⤵
- Executes dropped EXE
PID:2164 -
\??\c:\fjxxx.exec:\fjxxx.exe65⤵
- Executes dropped EXE
PID:888 -
\??\c:\tvdvdj.exec:\tvdvdj.exe66⤵
- Executes dropped EXE
PID:304 -
\??\c:\vftlvfx.exec:\vftlvfx.exe67⤵PID:2232
-
\??\c:\nfvpjl.exec:\nfvpjl.exe68⤵PID:1608
-
\??\c:\dlrdnj.exec:\dlrdnj.exe69⤵PID:1340
-
\??\c:\nvptrj.exec:\nvptrj.exe70⤵PID:556
-
\??\c:\hbdfxn.exec:\hbdfxn.exe71⤵
- System Location Discovery: System Language Discovery
PID:2308 -
\??\c:\pfphp.exec:\pfphp.exe72⤵PID:2004
-
\??\c:\djbvtth.exec:\djbvtth.exe73⤵PID:1436
-
\??\c:\xrrfb.exec:\xrrfb.exe74⤵PID:1580
-
\??\c:\rllpbtd.exec:\rllpbtd.exe75⤵PID:2128
-
\??\c:\vlnxdh.exec:\vlnxdh.exe76⤵PID:1396
-
\??\c:\rtvprn.exec:\rtvprn.exe77⤵PID:2868
-
\??\c:\bnnfh.exec:\bnnfh.exe78⤵PID:2804
-
\??\c:\rhbrt.exec:\rhbrt.exe79⤵PID:2684
-
\??\c:\bjpjdd.exec:\bjpjdd.exe80⤵PID:2864
-
\??\c:\ljhhb.exec:\ljhhb.exe81⤵PID:3048
-
\??\c:\hlprdv.exec:\hlprdv.exe82⤵PID:2892
-
\??\c:\rrpjnhn.exec:\rrpjnhn.exe83⤵PID:2848
-
\??\c:\pbblnhj.exec:\pbblnhj.exe84⤵PID:2732
-
\??\c:\pvxbvv.exec:\pvxbvv.exe85⤵PID:2696
-
\??\c:\nbbbrpf.exec:\nbbbrpf.exe86⤵PID:2796
-
\??\c:\dllhl.exec:\dllhl.exe87⤵PID:2132
-
\??\c:\tjhjt.exec:\tjhjt.exe88⤵
- System Location Discovery: System Language Discovery
PID:2020 -
\??\c:\brjnbrr.exec:\brjnbrr.exe89⤵PID:1884
-
\??\c:\bnjftx.exec:\bnjftx.exe90⤵PID:3068
-
\??\c:\ptfdf.exec:\ptfdf.exe91⤵
- System Location Discovery: System Language Discovery
PID:2180 -
\??\c:\lrvxln.exec:\lrvxln.exe92⤵PID:3016
-
\??\c:\jplph.exec:\jplph.exe93⤵PID:2344
-
\??\c:\hnfvtfl.exec:\hnfvtfl.exe94⤵PID:3000
-
\??\c:\rvbrtp.exec:\rvbrtp.exe95⤵PID:836
-
\??\c:\brbdt.exec:\brbdt.exe96⤵PID:2192
-
\??\c:\xtbffpp.exec:\xtbffpp.exe97⤵PID:764
-
\??\c:\fxnbhpf.exec:\fxnbhpf.exe98⤵PID:2376
-
\??\c:\dtpprvx.exec:\dtpprvx.exe99⤵PID:2484
-
\??\c:\hpnxd.exec:\hpnxd.exe100⤵PID:1944
-
\??\c:\bjfjrnb.exec:\bjfjrnb.exe101⤵
- System Location Discovery: System Language Discovery
PID:1624 -
\??\c:\jhljpn.exec:\jhljpn.exe102⤵PID:1328
-
\??\c:\thbxf.exec:\thbxf.exe103⤵
- System Location Discovery: System Language Discovery
PID:1432 -
\??\c:\nbndtn.exec:\nbndtn.exe104⤵PID:980
-
\??\c:\txfvxd.exec:\txfvxd.exe105⤵PID:1996
-
\??\c:\dfbfll.exec:\dfbfll.exe106⤵PID:2136
-
\??\c:\vjdph.exec:\vjdph.exe107⤵PID:1288
-
\??\c:\ljljhn.exec:\ljljhn.exe108⤵PID:1712
-
\??\c:\bjrbtpr.exec:\bjrbtpr.exe109⤵PID:2240
-
\??\c:\jnxdxfr.exec:\jnxdxfr.exe110⤵PID:2072
-
\??\c:\vfjlxf.exec:\vfjlxf.exe111⤵PID:1304
-
\??\c:\dpxrvxv.exec:\dpxrvxv.exe112⤵PID:1048
-
\??\c:\prffhj.exec:\prffhj.exe113⤵PID:2260
-
\??\c:\ptdbjn.exec:\ptdbjn.exe114⤵PID:2528
-
\??\c:\pdxvt.exec:\pdxvt.exe115⤵PID:2316
-
\??\c:\tjrftpr.exec:\tjrftpr.exe116⤵PID:896
-
\??\c:\blxjd.exec:\blxjd.exe117⤵PID:3056
-
\??\c:\dhfnnx.exec:\dhfnnx.exe118⤵PID:2856
-
\??\c:\pvjxlht.exec:\pvjxlht.exe119⤵PID:1932
-
\??\c:\bvplrl.exec:\bvplrl.exe120⤵PID:1532
-
\??\c:\xbpxr.exec:\xbpxr.exe121⤵PID:1528
-
\??\c:\tllprf.exec:\tllprf.exe122⤵PID:2928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-