Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 14:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe
-
Size
456KB
-
MD5
7c3a20d643b7797d5ab2d655627224f0
-
SHA1
674cb1d4fc82d94e6c4fbc5cd451f264b4904689
-
SHA256
d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3c
-
SHA512
5674523a6cfde5042cab35d9f0faa90c0a17aa3b701cbdc25709487cb95b45a0c44818d29726eec73731d7a8f293a5460de1b3c1127c2d41d64ad984b6c623c1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR5:q7Tc2NYHUrAwfMp3CDR5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2660-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-82-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2592-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/540-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/436-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1400-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/972-259-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2164-261-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2164-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-335-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2824-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-378-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2100-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-489-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2128-537-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2128-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-553-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1656-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-695-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3008 bndvd.exe 2448 pblbht.exe 2932 xhbbr.exe 2720 dtlxttt.exe 2904 dnjjvl.exe 1048 vbtldf.exe 2784 pdbbpjl.exe 2592 jlxlvp.exe 2304 xvtlndx.exe 2808 xvjpj.exe 2092 nxbpr.exe 2500 jnbjpf.exe 2888 dhddvfp.exe 540 vdprf.exe 1400 fhbxvh.exe 436 rvvtvv.exe 800 bxxxftj.exe 1536 nrxltt.exe 1524 vflpbt.exe 2672 httdvb.exe 2212 lvnxnjf.exe 1968 hpffd.exe 952 bjdnhbv.exe 972 fhlrhp.exe 2032 btlxtfr.exe 1944 ndfpfpj.exe 2164 dhpjxp.exe 2020 xnnrj.exe 1656 jdbnpdf.exe 2280 nrbvjrt.exe 332 jvrnrbf.exe 1700 rjntdnv.exe 2660 hdxjprn.exe 316 vptjlff.exe 2296 fdpdtrj.exe 1044 hxftb.exe 2920 ljjltd.exe 2932 hrvtdbn.exe 2848 jbbbvhp.exe 2824 fdppf.exe 2760 pvnjdx.exe 2616 brjhhbn.exe 2196 fdbvj.exe 1676 vthtvb.exe 2100 nhnnxd.exe 2808 dvrrd.exe 1136 llbxvxp.exe 2320 djrbhfv.exe 3036 bprbhr.exe 2064 jbbvbv.exe 2968 pjlvd.exe 2024 rxlvnvd.exe 2900 djlhfrx.exe 2348 vrdjhhp.exe 1704 vhlnnb.exe 2204 vjlnfv.exe 2236 txlhlpl.exe 1524 vvlpv.exe 2428 pfxfvp.exe 1776 jnbjbf.exe 612 vlxpn.exe 660 txftpfd.exe 952 ppnrj.exe 1052 vfrlrl.exe -
resource yara_rule behavioral1/memory/3008-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/436-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/972-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-271-0x00000000001C0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/2020-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/660-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-537-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2128-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-745-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdxjprn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hndtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rthfjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpfrhfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfttprl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbpjrnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dljvnpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpnrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxxxftj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lthljxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxfddf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvnft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnvvbdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbbxdbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdbxrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvdhhtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjvnxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djrhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnvrhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtvdht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhjtblt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfldjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhtnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpvbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvlrrvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvnrfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjbvpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnvblx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvphb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txnhpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvhff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drrdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brfhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plrvfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvfbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhfhlnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjdbbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtvbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpbpfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlpfxhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffdbhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pblbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlvnlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfrbdjr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2660 wrote to memory of 3008 2660 d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe 29 PID 2660 wrote to memory of 3008 2660 d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe 29 PID 2660 wrote to memory of 3008 2660 d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe 29 PID 2660 wrote to memory of 3008 2660 d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe 29 PID 3008 wrote to memory of 2448 3008 bndvd.exe 30 PID 3008 wrote to memory of 2448 3008 bndvd.exe 30 PID 3008 wrote to memory of 2448 3008 bndvd.exe 30 PID 3008 wrote to memory of 2448 3008 bndvd.exe 30 PID 2448 wrote to memory of 2932 2448 pblbht.exe 31 PID 2448 wrote to memory of 2932 2448 pblbht.exe 31 PID 2448 wrote to memory of 2932 2448 pblbht.exe 31 PID 2448 wrote to memory of 2932 2448 pblbht.exe 31 PID 2932 wrote to memory of 2720 2932 xhbbr.exe 32 PID 2932 wrote to memory of 2720 2932 xhbbr.exe 32 PID 2932 wrote to memory of 2720 2932 xhbbr.exe 32 PID 2932 wrote to memory of 2720 2932 xhbbr.exe 32 PID 2720 wrote to memory of 2904 2720 dtlxttt.exe 33 PID 2720 wrote to memory of 2904 2720 dtlxttt.exe 33 PID 2720 wrote to memory of 2904 2720 dtlxttt.exe 33 PID 2720 wrote to memory of 2904 2720 dtlxttt.exe 33 PID 2904 wrote to memory of 1048 2904 dnjjvl.exe 34 PID 2904 wrote to memory of 1048 2904 dnjjvl.exe 34 PID 2904 wrote to memory of 1048 2904 dnjjvl.exe 34 PID 2904 wrote to memory of 1048 2904 dnjjvl.exe 34 PID 1048 wrote to memory of 2784 1048 vbtldf.exe 35 PID 1048 wrote to memory of 2784 1048 vbtldf.exe 35 PID 1048 wrote to memory of 2784 1048 vbtldf.exe 35 PID 1048 wrote to memory of 2784 1048 vbtldf.exe 35 PID 2784 wrote to memory of 2592 2784 pdbbpjl.exe 36 PID 2784 wrote to memory of 2592 2784 pdbbpjl.exe 36 PID 2784 wrote to memory of 2592 2784 pdbbpjl.exe 36 PID 2784 wrote to memory of 2592 2784 pdbbpjl.exe 36 PID 2592 wrote to memory of 2304 2592 jlxlvp.exe 37 PID 2592 wrote to memory of 2304 2592 jlxlvp.exe 37 PID 2592 wrote to memory of 2304 2592 jlxlvp.exe 37 PID 2592 wrote to memory of 2304 2592 jlxlvp.exe 37 PID 2304 wrote to memory of 2808 2304 xvtlndx.exe 38 PID 2304 wrote to memory of 2808 2304 xvtlndx.exe 38 PID 2304 wrote to memory of 2808 2304 xvtlndx.exe 38 PID 2304 wrote to memory of 2808 2304 xvtlndx.exe 38 PID 2808 wrote to memory of 2092 2808 xvjpj.exe 39 PID 2808 wrote to memory of 2092 2808 xvjpj.exe 39 PID 2808 wrote to memory of 2092 2808 xvjpj.exe 39 PID 2808 wrote to memory of 2092 2808 xvjpj.exe 39 PID 2092 wrote to memory of 2500 2092 nxbpr.exe 40 PID 2092 wrote to memory of 2500 2092 nxbpr.exe 40 PID 2092 wrote to memory of 2500 2092 nxbpr.exe 40 PID 2092 wrote to memory of 2500 2092 nxbpr.exe 40 PID 2500 wrote to memory of 2888 2500 jnbjpf.exe 41 PID 2500 wrote to memory of 2888 2500 jnbjpf.exe 41 PID 2500 wrote to memory of 2888 2500 jnbjpf.exe 41 PID 2500 wrote to memory of 2888 2500 jnbjpf.exe 41 PID 2888 wrote to memory of 540 2888 dhddvfp.exe 42 PID 2888 wrote to memory of 540 2888 dhddvfp.exe 42 PID 2888 wrote to memory of 540 2888 dhddvfp.exe 42 PID 2888 wrote to memory of 540 2888 dhddvfp.exe 42 PID 540 wrote to memory of 1400 540 vdprf.exe 43 PID 540 wrote to memory of 1400 540 vdprf.exe 43 PID 540 wrote to memory of 1400 540 vdprf.exe 43 PID 540 wrote to memory of 1400 540 vdprf.exe 43 PID 1400 wrote to memory of 436 1400 fhbxvh.exe 44 PID 1400 wrote to memory of 436 1400 fhbxvh.exe 44 PID 1400 wrote to memory of 436 1400 fhbxvh.exe 44 PID 1400 wrote to memory of 436 1400 fhbxvh.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe"C:\Users\Admin\AppData\Local\Temp\d53e7791e8a7bba73cbbc2cb6377384e1d12df423a9527ed6ca8d205dbadea3cN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\bndvd.exec:\bndvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\pblbht.exec:\pblbht.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\xhbbr.exec:\xhbbr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\dtlxttt.exec:\dtlxttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\dnjjvl.exec:\dnjjvl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\vbtldf.exec:\vbtldf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\pdbbpjl.exec:\pdbbpjl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\jlxlvp.exec:\jlxlvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\xvtlndx.exec:\xvtlndx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\xvjpj.exec:\xvjpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\nxbpr.exec:\nxbpr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\jnbjpf.exec:\jnbjpf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\dhddvfp.exec:\dhddvfp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\vdprf.exec:\vdprf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\fhbxvh.exec:\fhbxvh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\rvvtvv.exec:\rvvtvv.exe17⤵
- Executes dropped EXE
PID:436 -
\??\c:\bxxxftj.exec:\bxxxftj.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:800 -
\??\c:\nrxltt.exec:\nrxltt.exe19⤵
- Executes dropped EXE
PID:1536 -
\??\c:\vflpbt.exec:\vflpbt.exe20⤵
- Executes dropped EXE
PID:1524 -
\??\c:\httdvb.exec:\httdvb.exe21⤵
- Executes dropped EXE
PID:2672 -
\??\c:\lvnxnjf.exec:\lvnxnjf.exe22⤵
- Executes dropped EXE
PID:2212 -
\??\c:\hpffd.exec:\hpffd.exe23⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bjdnhbv.exec:\bjdnhbv.exe24⤵
- Executes dropped EXE
PID:952 -
\??\c:\fhlrhp.exec:\fhlrhp.exe25⤵
- Executes dropped EXE
PID:972 -
\??\c:\btlxtfr.exec:\btlxtfr.exe26⤵
- Executes dropped EXE
PID:2032 -
\??\c:\ndfpfpj.exec:\ndfpfpj.exe27⤵
- Executes dropped EXE
PID:1944 -
\??\c:\dhpjxp.exec:\dhpjxp.exe28⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xnnrj.exec:\xnnrj.exe29⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jdbnpdf.exec:\jdbnpdf.exe30⤵
- Executes dropped EXE
PID:1656 -
\??\c:\nrbvjrt.exec:\nrbvjrt.exe31⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jvrnrbf.exec:\jvrnrbf.exe32⤵
- Executes dropped EXE
PID:332 -
\??\c:\rjntdnv.exec:\rjntdnv.exe33⤵
- Executes dropped EXE
PID:1700 -
\??\c:\hdxjprn.exec:\hdxjprn.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2660 -
\??\c:\vptjlff.exec:\vptjlff.exe35⤵
- Executes dropped EXE
PID:316 -
\??\c:\fdpdtrj.exec:\fdpdtrj.exe36⤵
- Executes dropped EXE
PID:2296 -
\??\c:\hxftb.exec:\hxftb.exe37⤵
- Executes dropped EXE
PID:1044 -
\??\c:\ljjltd.exec:\ljjltd.exe38⤵
- Executes dropped EXE
PID:2920 -
\??\c:\hrvtdbn.exec:\hrvtdbn.exe39⤵
- Executes dropped EXE
PID:2932 -
\??\c:\jbbbvhp.exec:\jbbbvhp.exe40⤵
- Executes dropped EXE
PID:2848 -
\??\c:\fdppf.exec:\fdppf.exe41⤵
- Executes dropped EXE
PID:2824 -
\??\c:\pvnjdx.exec:\pvnjdx.exe42⤵
- Executes dropped EXE
PID:2760 -
\??\c:\brjhhbn.exec:\brjhhbn.exe43⤵
- Executes dropped EXE
PID:2616 -
\??\c:\fdbvj.exec:\fdbvj.exe44⤵
- Executes dropped EXE
PID:2196 -
\??\c:\vthtvb.exec:\vthtvb.exe45⤵
- Executes dropped EXE
PID:1676 -
\??\c:\nhnnxd.exec:\nhnnxd.exe46⤵
- Executes dropped EXE
PID:2100 -
\??\c:\dvrrd.exec:\dvrrd.exe47⤵
- Executes dropped EXE
PID:2808 -
\??\c:\llbxvxp.exec:\llbxvxp.exe48⤵
- Executes dropped EXE
PID:1136 -
\??\c:\djrbhfv.exec:\djrbhfv.exe49⤵
- Executes dropped EXE
PID:2320 -
\??\c:\bprbhr.exec:\bprbhr.exe50⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jbbvbv.exec:\jbbvbv.exe51⤵
- Executes dropped EXE
PID:2064 -
\??\c:\pjlvd.exec:\pjlvd.exe52⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rxlvnvd.exec:\rxlvnvd.exe53⤵
- Executes dropped EXE
PID:2024 -
\??\c:\djlhfrx.exec:\djlhfrx.exe54⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vrdjhhp.exec:\vrdjhhp.exe55⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vhlnnb.exec:\vhlnnb.exe56⤵
- Executes dropped EXE
PID:1704 -
\??\c:\vjlnfv.exec:\vjlnfv.exe57⤵
- Executes dropped EXE
PID:2204 -
\??\c:\txlhlpl.exec:\txlhlpl.exe58⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vvlpv.exec:\vvlpv.exe59⤵
- Executes dropped EXE
PID:1524 -
\??\c:\pfxfvp.exec:\pfxfvp.exe60⤵
- Executes dropped EXE
PID:2428 -
\??\c:\jnbjbf.exec:\jnbjbf.exe61⤵
- Executes dropped EXE
PID:1776 -
\??\c:\vlxpn.exec:\vlxpn.exe62⤵
- Executes dropped EXE
PID:612 -
\??\c:\txftpfd.exec:\txftpfd.exe63⤵
- Executes dropped EXE
PID:660 -
\??\c:\ppnrj.exec:\ppnrj.exe64⤵
- Executes dropped EXE
PID:952 -
\??\c:\vfrlrl.exec:\vfrlrl.exe65⤵
- Executes dropped EXE
PID:1052 -
\??\c:\fftrht.exec:\fftrht.exe66⤵PID:2128
-
\??\c:\jljpr.exec:\jljpr.exe67⤵PID:1456
-
\??\c:\bndnrxh.exec:\bndnrxh.exe68⤵PID:2688
-
\??\c:\jhlvrp.exec:\jhlvrp.exe69⤵PID:2000
-
\??\c:\vltnl.exec:\vltnl.exe70⤵PID:1756
-
\??\c:\hdpjhd.exec:\hdpjhd.exe71⤵PID:2020
-
\??\c:\pxrtb.exec:\pxrtb.exe72⤵PID:1656
-
\??\c:\rrffr.exec:\rrffr.exe73⤵PID:2648
-
\??\c:\htfhbjh.exec:\htfhbjh.exe74⤵PID:1752
-
\??\c:\xxvrdf.exec:\xxvrdf.exe75⤵PID:1540
-
\??\c:\njfrnjd.exec:\njfrnjd.exe76⤵PID:1736
-
\??\c:\jnhnvtt.exec:\jnhnvtt.exe77⤵PID:2388
-
\??\c:\vrddl.exec:\vrddl.exe78⤵PID:316
-
\??\c:\vbhpn.exec:\vbhpn.exe79⤵PID:2184
-
\??\c:\tnnpv.exec:\tnnpv.exe80⤵PID:2912
-
\??\c:\xdtvtd.exec:\xdtvtd.exe81⤵PID:2456
-
\??\c:\blnrhh.exec:\blnrhh.exe82⤵PID:3000
-
\??\c:\vlvnlr.exec:\vlvnlr.exe83⤵
- System Location Discovery: System Language Discovery
PID:2756 -
\??\c:\rhbtv.exec:\rhbtv.exe84⤵PID:2904
-
\??\c:\ltfbl.exec:\ltfbl.exe85⤵PID:2824
-
\??\c:\rrfnn.exec:\rrfnn.exe86⤵PID:2760
-
\??\c:\vrfrx.exec:\vrfrx.exe87⤵PID:2772
-
\??\c:\xddxjd.exec:\xddxjd.exe88⤵PID:900
-
\??\c:\brbhrd.exec:\brbhrd.exe89⤵PID:1676
-
\??\c:\dtvjrx.exec:\dtvjrx.exe90⤵PID:1584
-
\??\c:\bfvfpxl.exec:\bfvfpxl.exe91⤵PID:2108
-
\??\c:\tltdjxd.exec:\tltdjxd.exe92⤵PID:2800
-
\??\c:\jhtfb.exec:\jhtfb.exe93⤵PID:3020
-
\??\c:\thftd.exec:\thftd.exe94⤵PID:2200
-
\??\c:\bvxphf.exec:\bvxphf.exe95⤵PID:2300
-
\??\c:\pftfh.exec:\pftfh.exe96⤵PID:2972
-
\??\c:\ptfnn.exec:\ptfnn.exe97⤵PID:2152
-
\??\c:\rhjxpx.exec:\rhjxpx.exe98⤵PID:584
-
\??\c:\tfnfrdj.exec:\tfnfrdj.exe99⤵PID:2348
-
\??\c:\nbjxnn.exec:\nbjxnn.exe100⤵PID:2232
-
\??\c:\xfndrh.exec:\xfndrh.exe101⤵PID:2424
-
\??\c:\frvbb.exec:\frvbb.exe102⤵PID:2396
-
\??\c:\pdfdpf.exec:\pdfdpf.exe103⤵PID:2080
-
\??\c:\vtxxfj.exec:\vtxxfj.exe104⤵PID:976
-
\??\c:\jfldjj.exec:\jfldjj.exe105⤵
- System Location Discovery: System Language Discovery
PID:1124 -
\??\c:\fjthb.exec:\fjthb.exe106⤵PID:2168
-
\??\c:\xhhdpd.exec:\xhhdpd.exe107⤵PID:2516
-
\??\c:\tbbhhpt.exec:\tbbhhpt.exe108⤵PID:1644
-
\??\c:\lxtbtl.exec:\lxtbtl.exe109⤵PID:1244
-
\??\c:\bnlddvn.exec:\bnlddvn.exe110⤵PID:388
-
\??\c:\jlnjj.exec:\jlnjj.exe111⤵PID:696
-
\??\c:\lnbxv.exec:\lnbxv.exe112⤵PID:1624
-
\??\c:\phtvbv.exec:\phtvbv.exe113⤵PID:2008
-
\??\c:\nhlxnnt.exec:\nhlxnnt.exe114⤵PID:1772
-
\??\c:\tplvnj.exec:\tplvnj.exe115⤵PID:2392
-
\??\c:\ltbvv.exec:\ltbvv.exe116⤵PID:1964
-
\??\c:\dbnlrl.exec:\dbnlrl.exe117⤵PID:2964
-
\??\c:\vfbbbl.exec:\vfbbbl.exe118⤵PID:1748
-
\??\c:\phlhbj.exec:\phlhbj.exe119⤵PID:1752
-
\??\c:\rlxnn.exec:\rlxnn.exe120⤵PID:1540
-
\??\c:\nbdxjnv.exec:\nbdxjnv.exe121⤵PID:3012
-
\??\c:\pnrfff.exec:\pnrfff.exe122⤵PID:2388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-