Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 09:45
Behavioral task
behavioral1
Sample
e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe
-
Size
81KB
-
MD5
d53da58204c8b5a79a7095497f705bd5
-
SHA1
3bfc90e1ca4f7f68bfd70b7448c8b790e64d2895
-
SHA256
e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7
-
SHA512
77a35d37a47a65b583980c98fd59cabdb88c5ab3650a42e57c9da42f478dfeaa6bb35d3de9624660b4bd4774700d602e0ac9646f88c6b50c44984f56d137e032
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzx8/p7kepA:xhOmTsF93UYfwC6GIout03LzGF6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2200-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1688-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1756-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/584-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/368-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/524-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1032-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2332-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1036-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1148-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1424-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-297-0x0000000077580000-0x000000007769F000-memory.dmp family_blackmoon behavioral1/memory/2468-298-0x00000000776A0000-0x000000007779A000-memory.dmp family_blackmoon behavioral1/memory/2580-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1384-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-360-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2912-368-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/3056-381-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2912-388-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2708-395-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2708-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/864-509-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1620-548-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-626-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2848-644-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2280-718-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/964-767-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2532-871-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2804-894-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1196-986-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2268-988-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1036-1043-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2304-1106-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2732-1173-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1688 dnvlj.exe 1756 tdxjpnf.exe 2104 bprtxx.exe 368 xprdnvv.exe 584 fpxtt.exe 2892 dnhhhh.exe 2804 tfrfv.exe 2840 tdthnn.exe 2948 rdppnj.exe 2844 rxxnld.exe 2708 jrfddbn.exe 524 hntflb.exe 2568 pnrjhtt.exe 2644 lfpht.exe 1032 pdbfnl.exe 2332 xjfpxd.exe 2064 fhjrd.exe 2636 ptrvdn.exe 2396 ptxjbb.exe 2484 nrrhjpx.exe 2772 rddxbv.exe 2124 fjjrj.exe 1788 xffvltf.exe 1784 jxhfl.exe 1036 rtdhvt.exe 1148 jxxjb.exe 1424 dxtlh.exe 1100 trjvd.exe 2400 nttrt.exe 2460 jjrfp.exe 2456 hbndj.exe 2452 txnrtj.exe 2468 fpprp.exe 2076 ptjjfnl.exe 1384 frbph.exe 1576 frfdp.exe 2068 nxjhnbt.exe 2228 vtjndvj.exe 584 nnrjff.exe 2872 bdlfvn.exe 3056 dnxhr.exe 2912 pnpdttr.exe 2928 rbnplvj.exe 2868 vrpfbr.exe 2324 htfvn.exe 2708 flvdnl.exe 2032 npnhjh.exe 2736 lxrvnl.exe 2340 dhvvtnl.exe 1196 vvptt.exe 1948 pbvlvv.exe 1644 bvdhdjr.exe 1636 lxtld.exe 2064 hflrbrj.exe 2264 jxdjnt.exe 2100 dfbjbf.exe 880 thhdbn.exe 2484 jjvxxfn.exe 776 fjpbj.exe 1064 jlffjfl.exe 1552 tvbtv.exe 1324 vhbbrfj.exe 236 bhffrf.exe 864 rvhnbhv.exe -
resource yara_rule behavioral1/memory/2200-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000e000000012267-6.dat upx behavioral1/memory/2200-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1688-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000016d64-19.dat upx behavioral1/files/0x0008000000016d69-26.dat upx behavioral1/memory/2104-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1756-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/368-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016fc9-36.dat upx behavioral1/files/0x0007000000016fe5-45.dat upx behavioral1/memory/584-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/368-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000170f8-55.dat upx behavioral1/memory/2892-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001756e-66.dat upx behavioral1/memory/2804-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b3-74.dat upx behavioral1/memory/2804-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b5-81.dat upx behavioral1/files/0x00050000000195b7-91.dat upx behavioral1/memory/2948-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2844-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2708-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195bb-103.dat upx behavioral1/files/0x0009000000016d3f-110.dat upx behavioral1/memory/2708-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195bd-120.dat upx behavioral1/memory/524-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c1-129.dat upx behavioral1/files/0x00050000000195c3-136.dat upx behavioral1/memory/2644-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1032-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c5-147.dat upx behavioral1/memory/2332-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2064-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c6-156.dat upx behavioral1/files/0x00050000000195c7-164.dat upx behavioral1/memory/2636-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960c-174.dat upx behavioral1/files/0x0005000000019643-183.dat upx behavioral1/memory/2484-191-0x00000000003C0000-0x00000000003E7000-memory.dmp upx behavioral1/files/0x000500000001975a-193.dat upx behavioral1/memory/2484-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019761-201.dat upx behavioral1/memory/2124-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000197fd-210.dat upx behavioral1/files/0x0005000000019820-218.dat upx behavioral1/files/0x000500000001998d-226.dat upx behavioral1/memory/1036-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf5-234.dat upx behavioral1/files/0x0005000000019bf6-241.dat upx behavioral1/memory/1148-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1424-247-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf9-252.dat upx behavioral1/memory/1100-260-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c3c-261.dat upx behavioral1/memory/2400-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d61-270.dat upx behavioral1/memory/2456-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d62-278.dat upx behavioral1/files/0x0005000000019d6d-287.dat upx behavioral1/memory/2468-295-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2468-297-0x0000000077580000-0x000000007769F000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbhfjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbrjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trndhnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljtfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdppnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvfpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbflvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbfvxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jftfbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrvxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npdhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhvbttp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtplph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjfjdrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlthjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prhjrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vthdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljlnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbpnfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvrlldv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvvfxvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfxbhhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbxxth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpplrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdfltf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpbxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drrprdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnjrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2200 wrote to memory of 1688 2200 e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe 30 PID 2200 wrote to memory of 1688 2200 e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe 30 PID 2200 wrote to memory of 1688 2200 e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe 30 PID 2200 wrote to memory of 1688 2200 e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe 30 PID 1688 wrote to memory of 1756 1688 dnvlj.exe 31 PID 1688 wrote to memory of 1756 1688 dnvlj.exe 31 PID 1688 wrote to memory of 1756 1688 dnvlj.exe 31 PID 1688 wrote to memory of 1756 1688 dnvlj.exe 31 PID 1756 wrote to memory of 2104 1756 tdxjpnf.exe 32 PID 1756 wrote to memory of 2104 1756 tdxjpnf.exe 32 PID 1756 wrote to memory of 2104 1756 tdxjpnf.exe 32 PID 1756 wrote to memory of 2104 1756 tdxjpnf.exe 32 PID 2104 wrote to memory of 368 2104 bprtxx.exe 33 PID 2104 wrote to memory of 368 2104 bprtxx.exe 33 PID 2104 wrote to memory of 368 2104 bprtxx.exe 33 PID 2104 wrote to memory of 368 2104 bprtxx.exe 33 PID 368 wrote to memory of 584 368 xprdnvv.exe 34 PID 368 wrote to memory of 584 368 xprdnvv.exe 34 PID 368 wrote to memory of 584 368 xprdnvv.exe 34 PID 368 wrote to memory of 584 368 xprdnvv.exe 34 PID 584 wrote to memory of 2892 584 fpxtt.exe 35 PID 584 wrote to memory of 2892 584 fpxtt.exe 35 PID 584 wrote to memory of 2892 584 fpxtt.exe 35 PID 584 wrote to memory of 2892 584 fpxtt.exe 35 PID 2892 wrote to memory of 2804 2892 dnhhhh.exe 36 PID 2892 wrote to memory of 2804 2892 dnhhhh.exe 36 PID 2892 wrote to memory of 2804 2892 dnhhhh.exe 36 PID 2892 wrote to memory of 2804 2892 dnhhhh.exe 36 PID 2804 wrote to memory of 2840 2804 tfrfv.exe 37 PID 2804 wrote to memory of 2840 2804 tfrfv.exe 37 PID 2804 wrote to memory of 2840 2804 tfrfv.exe 37 PID 2804 wrote to memory of 2840 2804 tfrfv.exe 37 PID 2840 wrote to memory of 2948 2840 tdthnn.exe 38 PID 2840 wrote to memory of 2948 2840 tdthnn.exe 38 PID 2840 wrote to memory of 2948 2840 tdthnn.exe 38 PID 2840 wrote to memory of 2948 2840 tdthnn.exe 38 PID 2948 wrote to memory of 2844 2948 rdppnj.exe 39 PID 2948 wrote to memory of 2844 2948 rdppnj.exe 39 PID 2948 wrote to memory of 2844 2948 rdppnj.exe 39 PID 2948 wrote to memory of 2844 2948 rdppnj.exe 39 PID 2844 wrote to memory of 2708 2844 rxxnld.exe 40 PID 2844 wrote to memory of 2708 2844 rxxnld.exe 40 PID 2844 wrote to memory of 2708 2844 rxxnld.exe 40 PID 2844 wrote to memory of 2708 2844 rxxnld.exe 40 PID 2708 wrote to memory of 524 2708 jrfddbn.exe 41 PID 2708 wrote to memory of 524 2708 jrfddbn.exe 41 PID 2708 wrote to memory of 524 2708 jrfddbn.exe 41 PID 2708 wrote to memory of 524 2708 jrfddbn.exe 41 PID 524 wrote to memory of 2568 524 hntflb.exe 42 PID 524 wrote to memory of 2568 524 hntflb.exe 42 PID 524 wrote to memory of 2568 524 hntflb.exe 42 PID 524 wrote to memory of 2568 524 hntflb.exe 42 PID 2568 wrote to memory of 2644 2568 pnrjhtt.exe 43 PID 2568 wrote to memory of 2644 2568 pnrjhtt.exe 43 PID 2568 wrote to memory of 2644 2568 pnrjhtt.exe 43 PID 2568 wrote to memory of 2644 2568 pnrjhtt.exe 43 PID 2644 wrote to memory of 1032 2644 lfpht.exe 44 PID 2644 wrote to memory of 1032 2644 lfpht.exe 44 PID 2644 wrote to memory of 1032 2644 lfpht.exe 44 PID 2644 wrote to memory of 1032 2644 lfpht.exe 44 PID 1032 wrote to memory of 2332 1032 pdbfnl.exe 45 PID 1032 wrote to memory of 2332 1032 pdbfnl.exe 45 PID 1032 wrote to memory of 2332 1032 pdbfnl.exe 45 PID 1032 wrote to memory of 2332 1032 pdbfnl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe"C:\Users\Admin\AppData\Local\Temp\e2918f34222ace0e9b2a193999aca99bfba8fc1d2b4c12dad2963f7e460f73d7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\dnvlj.exec:\dnvlj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\tdxjpnf.exec:\tdxjpnf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\bprtxx.exec:\bprtxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\xprdnvv.exec:\xprdnvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\fpxtt.exec:\fpxtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:584 -
\??\c:\dnhhhh.exec:\dnhhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\tfrfv.exec:\tfrfv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\tdthnn.exec:\tdthnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rdppnj.exec:\rdppnj.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\rxxnld.exec:\rxxnld.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\jrfddbn.exec:\jrfddbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\hntflb.exec:\hntflb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:524 -
\??\c:\pnrjhtt.exec:\pnrjhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\lfpht.exec:\lfpht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\pdbfnl.exec:\pdbfnl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\xjfpxd.exec:\xjfpxd.exe17⤵
- Executes dropped EXE
PID:2332 -
\??\c:\fhjrd.exec:\fhjrd.exe18⤵
- Executes dropped EXE
PID:2064 -
\??\c:\ptrvdn.exec:\ptrvdn.exe19⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ptxjbb.exec:\ptxjbb.exe20⤵
- Executes dropped EXE
PID:2396 -
\??\c:\nrrhjpx.exec:\nrrhjpx.exe21⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rddxbv.exec:\rddxbv.exe22⤵
- Executes dropped EXE
PID:2772 -
\??\c:\fjjrj.exec:\fjjrj.exe23⤵
- Executes dropped EXE
PID:2124 -
\??\c:\xffvltf.exec:\xffvltf.exe24⤵
- Executes dropped EXE
PID:1788 -
\??\c:\jxhfl.exec:\jxhfl.exe25⤵
- Executes dropped EXE
PID:1784 -
\??\c:\rtdhvt.exec:\rtdhvt.exe26⤵
- Executes dropped EXE
PID:1036 -
\??\c:\jxxjb.exec:\jxxjb.exe27⤵
- Executes dropped EXE
PID:1148 -
\??\c:\dxtlh.exec:\dxtlh.exe28⤵
- Executes dropped EXE
PID:1424 -
\??\c:\trjvd.exec:\trjvd.exe29⤵
- Executes dropped EXE
PID:1100 -
\??\c:\nttrt.exec:\nttrt.exe30⤵
- Executes dropped EXE
PID:2400 -
\??\c:\jjrfp.exec:\jjrfp.exe31⤵
- Executes dropped EXE
PID:2460 -
\??\c:\hbndj.exec:\hbndj.exe32⤵
- Executes dropped EXE
PID:2456 -
\??\c:\txnrtj.exec:\txnrtj.exe33⤵
- Executes dropped EXE
PID:2452 -
\??\c:\fpprp.exec:\fpprp.exe34⤵
- Executes dropped EXE
PID:2468 -
\??\c:\dfnhvj.exec:\dfnhvj.exe35⤵PID:2580
-
\??\c:\ptjjfnl.exec:\ptjjfnl.exe36⤵
- Executes dropped EXE
PID:2076 -
\??\c:\frbph.exec:\frbph.exe37⤵
- Executes dropped EXE
PID:1384 -
\??\c:\frfdp.exec:\frfdp.exe38⤵
- Executes dropped EXE
PID:1576 -
\??\c:\nxjhnbt.exec:\nxjhnbt.exe39⤵
- Executes dropped EXE
PID:2068 -
\??\c:\vtjndvj.exec:\vtjndvj.exe40⤵
- Executes dropped EXE
PID:2228 -
\??\c:\nnrjff.exec:\nnrjff.exe41⤵
- Executes dropped EXE
PID:584 -
\??\c:\bdlfvn.exec:\bdlfvn.exe42⤵
- Executes dropped EXE
PID:2872 -
\??\c:\dnxhr.exec:\dnxhr.exe43⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pnpdttr.exec:\pnpdttr.exe44⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rbnplvj.exec:\rbnplvj.exe45⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vrpfbr.exec:\vrpfbr.exe46⤵
- Executes dropped EXE
PID:2868 -
\??\c:\htfvn.exec:\htfvn.exe47⤵
- Executes dropped EXE
PID:2324 -
\??\c:\flvdnl.exec:\flvdnl.exe48⤵
- Executes dropped EXE
PID:2708 -
\??\c:\npnhjh.exec:\npnhjh.exe49⤵
- Executes dropped EXE
PID:2032 -
\??\c:\lxrvnl.exec:\lxrvnl.exe50⤵
- Executes dropped EXE
PID:2736 -
\??\c:\dhvvtnl.exec:\dhvvtnl.exe51⤵
- Executes dropped EXE
PID:2340 -
\??\c:\vvptt.exec:\vvptt.exe52⤵
- Executes dropped EXE
PID:1196 -
\??\c:\pbvlvv.exec:\pbvlvv.exe53⤵
- Executes dropped EXE
PID:1948 -
\??\c:\bvdhdjr.exec:\bvdhdjr.exe54⤵
- Executes dropped EXE
PID:1644 -
\??\c:\lxtld.exec:\lxtld.exe55⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hflrbrj.exec:\hflrbrj.exe56⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jxdjnt.exec:\jxdjnt.exe57⤵
- Executes dropped EXE
PID:2264 -
\??\c:\dfbjbf.exec:\dfbjbf.exe58⤵
- Executes dropped EXE
PID:2100 -
\??\c:\thhdbn.exec:\thhdbn.exe59⤵
- Executes dropped EXE
PID:880 -
\??\c:\jjvxxfn.exec:\jjvxxfn.exe60⤵
- Executes dropped EXE
PID:2484 -
\??\c:\fjpbj.exec:\fjpbj.exe61⤵
- Executes dropped EXE
PID:776 -
\??\c:\jlffjfl.exec:\jlffjfl.exe62⤵
- Executes dropped EXE
PID:1064 -
\??\c:\tvbtv.exec:\tvbtv.exe63⤵
- Executes dropped EXE
PID:1552 -
\??\c:\vhbbrfj.exec:\vhbbrfj.exe64⤵
- Executes dropped EXE
PID:1324 -
\??\c:\bhffrf.exec:\bhffrf.exe65⤵
- Executes dropped EXE
PID:236 -
\??\c:\rvhnbhv.exec:\rvhnbhv.exe66⤵
- Executes dropped EXE
PID:864 -
\??\c:\ptlhrrt.exec:\ptlhrrt.exe67⤵PID:296
-
\??\c:\pxtpd.exec:\pxtpd.exe68⤵PID:1556
-
\??\c:\ltbdrl.exec:\ltbdrl.exe69⤵PID:1912
-
\??\c:\jthvftf.exec:\jthvftf.exe70⤵PID:3060
-
\??\c:\thtjdth.exec:\thtjdth.exe71⤵PID:2556
-
\??\c:\xtxbf.exec:\xtxbf.exe72⤵PID:1620
-
\??\c:\trhlh.exec:\trhlh.exe73⤵PID:2460
-
\??\c:\vthdjd.exec:\vthdjd.exe74⤵PID:2612
-
\??\c:\fjffr.exec:\fjffr.exe75⤵PID:2404
-
\??\c:\lltnnx.exec:\lltnnx.exe76⤵PID:2384
-
\??\c:\brflvbf.exec:\brflvbf.exe77⤵PID:1104
-
\??\c:\flxfl.exec:\flxfl.exe78⤵PID:1756
-
\??\c:\xflrrj.exec:\xflrrj.exe79⤵PID:2632
-
\??\c:\hxdrbx.exec:\hxdrbx.exe80⤵PID:2140
-
\??\c:\tfbnf.exec:\tfbnf.exe81⤵PID:2768
-
\??\c:\nrrnh.exec:\nrrnh.exe82⤵PID:516
-
\??\c:\pphnl.exec:\pphnl.exe83⤵PID:2888
-
\??\c:\jbjvv.exec:\jbjvv.exe84⤵PID:2892
-
\??\c:\xxxltnv.exec:\xxxltnv.exe85⤵PID:2936
-
\??\c:\hnpfpl.exec:\hnpfpl.exe86⤵PID:2932
-
\??\c:\rjhbdxr.exec:\rjhbdxr.exe87⤵PID:2848
-
\??\c:\dhhhnx.exec:\dhhhnx.exe88⤵PID:2692
-
\??\c:\dxxff.exec:\dxxff.exe89⤵PID:2844
-
\??\c:\rdfbv.exec:\rdfbv.exe90⤵PID:1960
-
\??\c:\npdjb.exec:\npdjb.exe91⤵PID:524
-
\??\c:\tdrtppx.exec:\tdrtppx.exe92⤵PID:2972
-
\??\c:\dvbbfn.exec:\dvbbfn.exe93⤵PID:2736
-
\??\c:\vthdh.exec:\vthdh.exe94⤵
- System Location Discovery: System Language Discovery
PID:1456 -
\??\c:\hnbbxj.exec:\hnbbxj.exe95⤵PID:2644
-
\??\c:\dlbnx.exec:\dlbnx.exe96⤵PID:1948
-
\??\c:\nxvxf.exec:\nxvxf.exe97⤵PID:2988
-
\??\c:\rtvxv.exec:\rtvxv.exe98⤵PID:2252
-
\??\c:\hfbfj.exec:\hfbfj.exe99⤵PID:2280
-
\??\c:\lvrvr.exec:\lvrvr.exe100⤵PID:2264
-
\??\c:\xdftntr.exec:\xdftntr.exe101⤵PID:1344
-
\??\c:\dhlnxpf.exec:\dhlnxpf.exe102⤵PID:108
-
\??\c:\rvjrbvf.exec:\rvjrbvf.exe103⤵PID:1352
-
\??\c:\jlfvfh.exec:\jlfvfh.exe104⤵PID:1752
-
\??\c:\vpdfprv.exec:\vpdfprv.exe105⤵PID:1616
-
\??\c:\fpfpd.exec:\fpfpd.exe106⤵PID:964
-
\??\c:\rvptxxt.exec:\rvptxxt.exe107⤵PID:2088
-
\??\c:\pxdpn.exec:\pxdpn.exe108⤵PID:908
-
\??\c:\hphvdnd.exec:\hphvdnd.exe109⤵PID:1088
-
\??\c:\xfdpr.exec:\xfdpr.exe110⤵PID:2072
-
\??\c:\drdxt.exec:\drdxt.exe111⤵PID:1892
-
\??\c:\nrxxhl.exec:\nrxxhl.exe112⤵PID:1672
-
\??\c:\rltjpd.exec:\rltjpd.exe113⤵PID:1092
-
\??\c:\rtlrv.exec:\rtlrv.exe114⤵PID:2432
-
\??\c:\dhrvxtt.exec:\dhrvxtt.exe115⤵PID:2492
-
\??\c:\rjhxpd.exec:\rjhxpd.exe116⤵PID:2096
-
\??\c:\thpdln.exec:\thpdln.exe117⤵PID:2604
-
\??\c:\rvvfnrb.exec:\rvvfnrb.exe118⤵PID:2388
-
\??\c:\dntnr.exec:\dntnr.exe119⤵PID:2372
-
\??\c:\hntrrlp.exec:\hntrrlp.exe120⤵PID:1592
-
\??\c:\bjpnth.exec:\bjpnth.exe121⤵PID:2864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-