Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 14:28
Static task
static1
Behavioral task
behavioral1
Sample
d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe
Resource
win7-20241010-en
General
-
Target
d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe
-
Size
456KB
-
MD5
7c3a20d643b7797d5ab2d655627224f0
-
SHA1
674cb1d4fc82d94e6c4fbc5cd451f264b4904689
-
SHA256
d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3c
-
SHA512
5674523a6cfde5042cab35d9f0faa90c0a17aa3b701cbdc25709487cb95b45a0c44818d29726eec73731d7a8f293a5460de1b3c1127c2d41d64ad984b6c623c1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR5:q7Tc2NYHUrAwfMp3CDR5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
Processes:
resource yara_rule behavioral1/memory/2660-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-82-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2592-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/540-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/436-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1400-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/972-259-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2164-261-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2164-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-335-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2824-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-378-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2100-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-489-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2128-537-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2128-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-553-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1656-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-695-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bndvd.exepblbht.exexhbbr.exedtlxttt.exednjjvl.exevbtldf.exepdbbpjl.exejlxlvp.exexvtlndx.exexvjpj.exenxbpr.exejnbjpf.exedhddvfp.exevdprf.exefhbxvh.exervvtvv.exebxxxftj.exenrxltt.exevflpbt.exehttdvb.exelvnxnjf.exehpffd.exebjdnhbv.exefhlrhp.exebtlxtfr.exendfpfpj.exedhpjxp.exexnnrj.exejdbnpdf.exenrbvjrt.exejvrnrbf.exerjntdnv.exehdxjprn.exevptjlff.exefdpdtrj.exehxftb.exeljjltd.exehrvtdbn.exejbbbvhp.exefdppf.exepvnjdx.exebrjhhbn.exefdbvj.exevthtvb.exenhnnxd.exedvrrd.exellbxvxp.exedjrbhfv.exebprbhr.exejbbvbv.exepjlvd.exerxlvnvd.exedjlhfrx.exevrdjhhp.exevhlnnb.exevjlnfv.exetxlhlpl.exevvlpv.exepfxfvp.exejnbjbf.exevlxpn.exetxftpfd.exeppnrj.exevfrlrl.exepid process 3008 bndvd.exe 2448 pblbht.exe 2932 xhbbr.exe 2720 dtlxttt.exe 2904 dnjjvl.exe 1048 vbtldf.exe 2784 pdbbpjl.exe 2592 jlxlvp.exe 2304 xvtlndx.exe 2808 xvjpj.exe 2092 nxbpr.exe 2500 jnbjpf.exe 2888 dhddvfp.exe 540 vdprf.exe 1400 fhbxvh.exe 436 rvvtvv.exe 800 bxxxftj.exe 1536 nrxltt.exe 1524 vflpbt.exe 2672 httdvb.exe 2212 lvnxnjf.exe 1968 hpffd.exe 952 bjdnhbv.exe 972 fhlrhp.exe 2032 btlxtfr.exe 1944 ndfpfpj.exe 2164 dhpjxp.exe 2020 xnnrj.exe 1656 jdbnpdf.exe 2280 nrbvjrt.exe 332 jvrnrbf.exe 1700 rjntdnv.exe 2660 hdxjprn.exe 316 vptjlff.exe 2296 fdpdtrj.exe 1044 hxftb.exe 2920 ljjltd.exe 2932 hrvtdbn.exe 2848 jbbbvhp.exe 2824 fdppf.exe 2760 pvnjdx.exe 2616 brjhhbn.exe 2196 fdbvj.exe 1676 vthtvb.exe 2100 nhnnxd.exe 2808 dvrrd.exe 1136 llbxvxp.exe 2320 djrbhfv.exe 3036 bprbhr.exe 2064 jbbvbv.exe 2968 pjlvd.exe 2024 rxlvnvd.exe 2900 djlhfrx.exe 2348 vrdjhhp.exe 1704 vhlnnb.exe 2204 vjlnfv.exe 2236 txlhlpl.exe 1524 vvlpv.exe 2428 pfxfvp.exe 1776 jnbjbf.exe 612 vlxpn.exe 660 txftpfd.exe 952 ppnrj.exe 1052 vfrlrl.exe -
Processes:
resource yara_rule behavioral1/memory/3008-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/436-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/972-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-271-0x00000000001C0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/2020-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/660-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-537-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2128-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-745-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
hdxjprn.exehndtp.exerthfjn.exefpfrhfp.exetfttprl.exejbpjrnb.exedljvnpp.exepdpnrj.exebxxxftj.exelthljxx.exehxfddf.exefvnft.exelnvvbdd.exefbbxdbd.exerdbxrb.exefvdhhtj.exedpvnt.exebjvnxlx.exedjrhj.exexnvrhf.exevtvdht.exebhjtblt.exejfldjj.exefhtnp.exerpvbh.exerxjdd.exed53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exebvlrrvr.exervnrfj.exefjbvpr.exepnvblx.exehvphb.exetxnhpj.exetvhff.exedrrdh.exebrfhl.exeplrvfr.exexvfbl.exehhfhlnt.exebjdbbx.exejtvbl.exebpbpfl.exedlpfxhn.exeffdbhr.exexxjdp.exepblbht.exevlvnlr.exetfrbdjr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdxjprn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hndtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rthfjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpfrhfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfttprl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbpjrnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dljvnpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpnrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxxxftj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lthljxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxfddf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvnft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnvvbdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbbxdbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdbxrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvdhhtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjvnxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djrhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnvrhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtvdht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhjtblt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfldjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhtnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpvbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvlrrvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvnrfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjbvpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnvblx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvphb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txnhpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvhff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drrdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brfhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plrvfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvfbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhfhlnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjdbbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtvbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpbpfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlpfxhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffdbhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pblbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlvnlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfrbdjr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exebndvd.exepblbht.exexhbbr.exedtlxttt.exednjjvl.exevbtldf.exepdbbpjl.exejlxlvp.exexvtlndx.exexvjpj.exenxbpr.exejnbjpf.exedhddvfp.exevdprf.exefhbxvh.exedescription pid process target process PID 2660 wrote to memory of 3008 2660 d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe bndvd.exe PID 2660 wrote to memory of 3008 2660 d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe bndvd.exe PID 2660 wrote to memory of 3008 2660 d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe bndvd.exe PID 2660 wrote to memory of 3008 2660 d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe bndvd.exe PID 3008 wrote to memory of 2448 3008 bndvd.exe pblbht.exe PID 3008 wrote to memory of 2448 3008 bndvd.exe pblbht.exe PID 3008 wrote to memory of 2448 3008 bndvd.exe pblbht.exe PID 3008 wrote to memory of 2448 3008 bndvd.exe pblbht.exe PID 2448 wrote to memory of 2932 2448 pblbht.exe xhbbr.exe PID 2448 wrote to memory of 2932 2448 pblbht.exe xhbbr.exe PID 2448 wrote to memory of 2932 2448 pblbht.exe xhbbr.exe PID 2448 wrote to memory of 2932 2448 pblbht.exe xhbbr.exe PID 2932 wrote to memory of 2720 2932 xhbbr.exe dtlxttt.exe PID 2932 wrote to memory of 2720 2932 xhbbr.exe dtlxttt.exe PID 2932 wrote to memory of 2720 2932 xhbbr.exe dtlxttt.exe PID 2932 wrote to memory of 2720 2932 xhbbr.exe dtlxttt.exe PID 2720 wrote to memory of 2904 2720 dtlxttt.exe dnjjvl.exe PID 2720 wrote to memory of 2904 2720 dtlxttt.exe dnjjvl.exe PID 2720 wrote to memory of 2904 2720 dtlxttt.exe dnjjvl.exe PID 2720 wrote to memory of 2904 2720 dtlxttt.exe dnjjvl.exe PID 2904 wrote to memory of 1048 2904 dnjjvl.exe vbtldf.exe PID 2904 wrote to memory of 1048 2904 dnjjvl.exe vbtldf.exe PID 2904 wrote to memory of 1048 2904 dnjjvl.exe vbtldf.exe PID 2904 wrote to memory of 1048 2904 dnjjvl.exe vbtldf.exe PID 1048 wrote to memory of 2784 1048 vbtldf.exe pdbbpjl.exe PID 1048 wrote to memory of 2784 1048 vbtldf.exe pdbbpjl.exe PID 1048 wrote to memory of 2784 1048 vbtldf.exe pdbbpjl.exe PID 1048 wrote to memory of 2784 1048 vbtldf.exe pdbbpjl.exe PID 2784 wrote to memory of 2592 2784 pdbbpjl.exe jlxlvp.exe PID 2784 wrote to memory of 2592 2784 pdbbpjl.exe jlxlvp.exe PID 2784 wrote to memory of 2592 2784 pdbbpjl.exe jlxlvp.exe PID 2784 wrote to memory of 2592 2784 pdbbpjl.exe jlxlvp.exe PID 2592 wrote to memory of 2304 2592 jlxlvp.exe xvtlndx.exe PID 2592 wrote to memory of 2304 2592 jlxlvp.exe xvtlndx.exe PID 2592 wrote to memory of 2304 2592 jlxlvp.exe xvtlndx.exe PID 2592 wrote to memory of 2304 2592 jlxlvp.exe xvtlndx.exe PID 2304 wrote to memory of 2808 2304 xvtlndx.exe xvjpj.exe PID 2304 wrote to memory of 2808 2304 xvtlndx.exe xvjpj.exe PID 2304 wrote to memory of 2808 2304 xvtlndx.exe xvjpj.exe PID 2304 wrote to memory of 2808 2304 xvtlndx.exe xvjpj.exe PID 2808 wrote to memory of 2092 2808 xvjpj.exe nxbpr.exe PID 2808 wrote to memory of 2092 2808 xvjpj.exe nxbpr.exe PID 2808 wrote to memory of 2092 2808 xvjpj.exe nxbpr.exe PID 2808 wrote to memory of 2092 2808 xvjpj.exe nxbpr.exe PID 2092 wrote to memory of 2500 2092 nxbpr.exe jnbjpf.exe PID 2092 wrote to memory of 2500 2092 nxbpr.exe jnbjpf.exe PID 2092 wrote to memory of 2500 2092 nxbpr.exe jnbjpf.exe PID 2092 wrote to memory of 2500 2092 nxbpr.exe jnbjpf.exe PID 2500 wrote to memory of 2888 2500 jnbjpf.exe dhddvfp.exe PID 2500 wrote to memory of 2888 2500 jnbjpf.exe dhddvfp.exe PID 2500 wrote to memory of 2888 2500 jnbjpf.exe dhddvfp.exe PID 2500 wrote to memory of 2888 2500 jnbjpf.exe dhddvfp.exe PID 2888 wrote to memory of 540 2888 dhddvfp.exe vdprf.exe PID 2888 wrote to memory of 540 2888 dhddvfp.exe vdprf.exe PID 2888 wrote to memory of 540 2888 dhddvfp.exe vdprf.exe PID 2888 wrote to memory of 540 2888 dhddvfp.exe vdprf.exe PID 540 wrote to memory of 1400 540 vdprf.exe fhbxvh.exe PID 540 wrote to memory of 1400 540 vdprf.exe fhbxvh.exe PID 540 wrote to memory of 1400 540 vdprf.exe fhbxvh.exe PID 540 wrote to memory of 1400 540 vdprf.exe fhbxvh.exe PID 1400 wrote to memory of 436 1400 fhbxvh.exe rvvtvv.exe PID 1400 wrote to memory of 436 1400 fhbxvh.exe rvvtvv.exe PID 1400 wrote to memory of 436 1400 fhbxvh.exe rvvtvv.exe PID 1400 wrote to memory of 436 1400 fhbxvh.exe rvvtvv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe"C:\Users\Admin\AppData\Local\Temp\d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\bndvd.exec:\bndvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\pblbht.exec:\pblbht.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\xhbbr.exec:\xhbbr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\dtlxttt.exec:\dtlxttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\dnjjvl.exec:\dnjjvl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\vbtldf.exec:\vbtldf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\pdbbpjl.exec:\pdbbpjl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\jlxlvp.exec:\jlxlvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\xvtlndx.exec:\xvtlndx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\xvjpj.exec:\xvjpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\nxbpr.exec:\nxbpr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\jnbjpf.exec:\jnbjpf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\dhddvfp.exec:\dhddvfp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\vdprf.exec:\vdprf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\fhbxvh.exec:\fhbxvh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\rvvtvv.exec:\rvvtvv.exe17⤵
- Executes dropped EXE
PID:436 -
\??\c:\bxxxftj.exec:\bxxxftj.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:800 -
\??\c:\nrxltt.exec:\nrxltt.exe19⤵
- Executes dropped EXE
PID:1536 -
\??\c:\vflpbt.exec:\vflpbt.exe20⤵
- Executes dropped EXE
PID:1524 -
\??\c:\httdvb.exec:\httdvb.exe21⤵
- Executes dropped EXE
PID:2672 -
\??\c:\lvnxnjf.exec:\lvnxnjf.exe22⤵
- Executes dropped EXE
PID:2212 -
\??\c:\hpffd.exec:\hpffd.exe23⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bjdnhbv.exec:\bjdnhbv.exe24⤵
- Executes dropped EXE
PID:952 -
\??\c:\fhlrhp.exec:\fhlrhp.exe25⤵
- Executes dropped EXE
PID:972 -
\??\c:\btlxtfr.exec:\btlxtfr.exe26⤵
- Executes dropped EXE
PID:2032 -
\??\c:\ndfpfpj.exec:\ndfpfpj.exe27⤵
- Executes dropped EXE
PID:1944 -
\??\c:\dhpjxp.exec:\dhpjxp.exe28⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xnnrj.exec:\xnnrj.exe29⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jdbnpdf.exec:\jdbnpdf.exe30⤵
- Executes dropped EXE
PID:1656 -
\??\c:\nrbvjrt.exec:\nrbvjrt.exe31⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jvrnrbf.exec:\jvrnrbf.exe32⤵
- Executes dropped EXE
PID:332 -
\??\c:\rjntdnv.exec:\rjntdnv.exe33⤵
- Executes dropped EXE
PID:1700 -
\??\c:\hdxjprn.exec:\hdxjprn.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2660 -
\??\c:\vptjlff.exec:\vptjlff.exe35⤵
- Executes dropped EXE
PID:316 -
\??\c:\fdpdtrj.exec:\fdpdtrj.exe36⤵
- Executes dropped EXE
PID:2296 -
\??\c:\hxftb.exec:\hxftb.exe37⤵
- Executes dropped EXE
PID:1044 -
\??\c:\ljjltd.exec:\ljjltd.exe38⤵
- Executes dropped EXE
PID:2920 -
\??\c:\hrvtdbn.exec:\hrvtdbn.exe39⤵
- Executes dropped EXE
PID:2932 -
\??\c:\jbbbvhp.exec:\jbbbvhp.exe40⤵
- Executes dropped EXE
PID:2848 -
\??\c:\fdppf.exec:\fdppf.exe41⤵
- Executes dropped EXE
PID:2824 -
\??\c:\pvnjdx.exec:\pvnjdx.exe42⤵
- Executes dropped EXE
PID:2760 -
\??\c:\brjhhbn.exec:\brjhhbn.exe43⤵
- Executes dropped EXE
PID:2616 -
\??\c:\fdbvj.exec:\fdbvj.exe44⤵
- Executes dropped EXE
PID:2196 -
\??\c:\vthtvb.exec:\vthtvb.exe45⤵
- Executes dropped EXE
PID:1676 -
\??\c:\nhnnxd.exec:\nhnnxd.exe46⤵
- Executes dropped EXE
PID:2100 -
\??\c:\dvrrd.exec:\dvrrd.exe47⤵
- Executes dropped EXE
PID:2808 -
\??\c:\llbxvxp.exec:\llbxvxp.exe48⤵
- Executes dropped EXE
PID:1136 -
\??\c:\djrbhfv.exec:\djrbhfv.exe49⤵
- Executes dropped EXE
PID:2320 -
\??\c:\bprbhr.exec:\bprbhr.exe50⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jbbvbv.exec:\jbbvbv.exe51⤵
- Executes dropped EXE
PID:2064 -
\??\c:\pjlvd.exec:\pjlvd.exe52⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rxlvnvd.exec:\rxlvnvd.exe53⤵
- Executes dropped EXE
PID:2024 -
\??\c:\djlhfrx.exec:\djlhfrx.exe54⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vrdjhhp.exec:\vrdjhhp.exe55⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vhlnnb.exec:\vhlnnb.exe56⤵
- Executes dropped EXE
PID:1704 -
\??\c:\vjlnfv.exec:\vjlnfv.exe57⤵
- Executes dropped EXE
PID:2204 -
\??\c:\txlhlpl.exec:\txlhlpl.exe58⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vvlpv.exec:\vvlpv.exe59⤵
- Executes dropped EXE
PID:1524 -
\??\c:\pfxfvp.exec:\pfxfvp.exe60⤵
- Executes dropped EXE
PID:2428 -
\??\c:\jnbjbf.exec:\jnbjbf.exe61⤵
- Executes dropped EXE
PID:1776 -
\??\c:\vlxpn.exec:\vlxpn.exe62⤵
- Executes dropped EXE
PID:612 -
\??\c:\txftpfd.exec:\txftpfd.exe63⤵
- Executes dropped EXE
PID:660 -
\??\c:\ppnrj.exec:\ppnrj.exe64⤵
- Executes dropped EXE
PID:952 -
\??\c:\vfrlrl.exec:\vfrlrl.exe65⤵
- Executes dropped EXE
PID:1052 -
\??\c:\fftrht.exec:\fftrht.exe66⤵PID:2128
-
\??\c:\jljpr.exec:\jljpr.exe67⤵PID:1456
-
\??\c:\bndnrxh.exec:\bndnrxh.exe68⤵PID:2688
-
\??\c:\jhlvrp.exec:\jhlvrp.exe69⤵PID:2000
-
\??\c:\vltnl.exec:\vltnl.exe70⤵PID:1756
-
\??\c:\hdpjhd.exec:\hdpjhd.exe71⤵PID:2020
-
\??\c:\pxrtb.exec:\pxrtb.exe72⤵PID:1656
-
\??\c:\rrffr.exec:\rrffr.exe73⤵PID:2648
-
\??\c:\htfhbjh.exec:\htfhbjh.exe74⤵PID:1752
-
\??\c:\xxvrdf.exec:\xxvrdf.exe75⤵PID:1540
-
\??\c:\njfrnjd.exec:\njfrnjd.exe76⤵PID:1736
-
\??\c:\jnhnvtt.exec:\jnhnvtt.exe77⤵PID:2388
-
\??\c:\vrddl.exec:\vrddl.exe78⤵PID:316
-
\??\c:\vbhpn.exec:\vbhpn.exe79⤵PID:2184
-
\??\c:\tnnpv.exec:\tnnpv.exe80⤵PID:2912
-
\??\c:\xdtvtd.exec:\xdtvtd.exe81⤵PID:2456
-
\??\c:\blnrhh.exec:\blnrhh.exe82⤵PID:3000
-
\??\c:\vlvnlr.exec:\vlvnlr.exe83⤵
- System Location Discovery: System Language Discovery
PID:2756 -
\??\c:\rhbtv.exec:\rhbtv.exe84⤵PID:2904
-
\??\c:\ltfbl.exec:\ltfbl.exe85⤵PID:2824
-
\??\c:\rrfnn.exec:\rrfnn.exe86⤵PID:2760
-
\??\c:\vrfrx.exec:\vrfrx.exe87⤵PID:2772
-
\??\c:\xddxjd.exec:\xddxjd.exe88⤵PID:900
-
\??\c:\brbhrd.exec:\brbhrd.exe89⤵PID:1676
-
\??\c:\dtvjrx.exec:\dtvjrx.exe90⤵PID:1584
-
\??\c:\bfvfpxl.exec:\bfvfpxl.exe91⤵PID:2108
-
\??\c:\tltdjxd.exec:\tltdjxd.exe92⤵PID:2800
-
\??\c:\jhtfb.exec:\jhtfb.exe93⤵PID:3020
-
\??\c:\thftd.exec:\thftd.exe94⤵PID:2200
-
\??\c:\bvxphf.exec:\bvxphf.exe95⤵PID:2300
-
\??\c:\pftfh.exec:\pftfh.exe96⤵PID:2972
-
\??\c:\ptfnn.exec:\ptfnn.exe97⤵PID:2152
-
\??\c:\rhjxpx.exec:\rhjxpx.exe98⤵PID:584
-
\??\c:\tfnfrdj.exec:\tfnfrdj.exe99⤵PID:2348
-
\??\c:\nbjxnn.exec:\nbjxnn.exe100⤵PID:2232
-
\??\c:\xfndrh.exec:\xfndrh.exe101⤵PID:2424
-
\??\c:\frvbb.exec:\frvbb.exe102⤵PID:2396
-
\??\c:\pdfdpf.exec:\pdfdpf.exe103⤵PID:2080
-
\??\c:\vtxxfj.exec:\vtxxfj.exe104⤵PID:976
-
\??\c:\jfldjj.exec:\jfldjj.exe105⤵
- System Location Discovery: System Language Discovery
PID:1124 -
\??\c:\fjthb.exec:\fjthb.exe106⤵PID:2168
-
\??\c:\xhhdpd.exec:\xhhdpd.exe107⤵PID:2516
-
\??\c:\tbbhhpt.exec:\tbbhhpt.exe108⤵PID:1644
-
\??\c:\lxtbtl.exec:\lxtbtl.exe109⤵PID:1244
-
\??\c:\bnlddvn.exec:\bnlddvn.exe110⤵PID:388
-
\??\c:\jlnjj.exec:\jlnjj.exe111⤵PID:696
-
\??\c:\lnbxv.exec:\lnbxv.exe112⤵PID:1624
-
\??\c:\phtvbv.exec:\phtvbv.exe113⤵PID:2008
-
\??\c:\nhlxnnt.exec:\nhlxnnt.exe114⤵PID:1772
-
\??\c:\tplvnj.exec:\tplvnj.exe115⤵PID:2392
-
\??\c:\ltbvv.exec:\ltbvv.exe116⤵PID:1964
-
\??\c:\dbnlrl.exec:\dbnlrl.exe117⤵PID:2964
-
\??\c:\vfbbbl.exec:\vfbbbl.exe118⤵PID:1748
-
\??\c:\phlhbj.exec:\phlhbj.exe119⤵PID:1752
-
\??\c:\rlxnn.exec:\rlxnn.exe120⤵PID:1540
-
\??\c:\nbdxjnv.exec:\nbdxjnv.exe121⤵PID:3012
-
\??\c:\pnrfff.exec:\pnrfff.exe122⤵PID:2388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-