Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 18:16
Behavioral task
behavioral1
Sample
375bd19dc3703e65bf67bf9b3e0825f9599aaac92288a24addc691db5c008b38.exe
Resource
win7-20241010-en
General
-
Target
375bd19dc3703e65bf67bf9b3e0825f9599aaac92288a24addc691db5c008b38.exe
-
Size
61KB
-
MD5
a9b1f3ca5d3acddd7dde1424ac09bcfe
-
SHA1
8276bd88b686c54884ef5e9a5ae5dd132be0ef4b
-
SHA256
375bd19dc3703e65bf67bf9b3e0825f9599aaac92288a24addc691db5c008b38
-
SHA512
1f0c7e05152f929b79ae6475cba2b3de35df58d4d411ac84c27fc39ba5f442fd53326b207fb1d6174fbcbf7ec59547829d64c752b9de8b56f98717e103cec02a
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNlIQldWAw:khOmTsF93UYfwC6GIoutpYcvldWAw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
Processes:
resource yara_rule behavioral1/memory/1736-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/760-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-74-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2824-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2132-116-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2132-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-126-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1496-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2240-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-192-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2472-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1812-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1788-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-391-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/668-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1540-521-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1540-541-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2288-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-623-0x0000000000280000-0x00000000002A7000-memory.dmp family_blackmoon behavioral1/memory/2968-630-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-649-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2196-730-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/556-735-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2408-763-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/888-846-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1224-866-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2856-948-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2536-955-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-1011-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2656-1027-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/680-1038-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1004-1081-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2968-1182-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2972-1196-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
njlndhh.exehdftt.exefllht.exevrhfvt.exetxnvt.exejfxhfn.exeltppj.exehjvfxt.exexvdvt.exexbvhbxf.exepdxnbd.exettjlnrt.exeflvjpvp.exevbfjpfn.exehlnffxj.exenjblrvx.exedljvtbh.exepfrxnv.exenlbdl.exevpdvf.exexdnjxlv.exetrpbv.exethphnn.exehthffbn.exednjrbpj.exexnhft.exehdfrffx.exejphxb.exedhvrnv.exejjxbfnl.exepjdnnrp.exetnpll.exejllvf.exetbfjfjr.exehvvvfxt.exevrntn.exedlvbdt.exevhvhhbb.exetrvpd.exelpvfdr.exedhdntd.exejprtjj.exebjnbffb.exexvbprp.exefvftxxx.exedpttvhf.exejrnvhn.exevjrbr.exepjvrt.exenhdhxl.exepxrpj.exebxtbf.exedtbvdh.exebthlrjn.exejhdlv.exelbjpjj.exetnhtnj.exedxnhr.exerbrddp.exebxdpv.exexpldxvx.exepfxlnr.exetntvxp.exeldjlbf.exepid process 760 njlndhh.exe 2184 hdftt.exe 2912 fllht.exe 2324 vrhfvt.exe 3012 txnvt.exe 2896 jfxhfn.exe 2944 ltppj.exe 2824 hjvfxt.exe 2856 xvdvt.exe 2788 xbvhbxf.exe 2904 pdxnbd.exe 2132 ttjlnrt.exe 2340 flvjpvp.exe 1496 vbfjpfn.exe 1408 hlnffxj.exe 696 njblrvx.exe 588 dljvtbh.exe 2240 pfrxnv.exe 520 nlbdl.exe 1964 vpdvf.exe 2472 xdnjxlv.exe 1992 trpbv.exe 2468 thphnn.exe 1812 hthffbn.exe 1788 dnjrbpj.exe 2532 xnhft.exe 2072 hdfrffx.exe 2704 jphxb.exe 2808 dhvrnv.exe 1808 jjxbfnl.exe 1928 pjdnnrp.exe 1256 tnpll.exe 2224 jllvf.exe 2424 tbfjfjr.exe 584 hvvvfxt.exe 3068 vrntn.exe 1588 dlvbdt.exe 2004 vhvhhbb.exe 2940 trvpd.exe 2152 lpvfdr.exe 2836 dhdntd.exe 3016 jprtjj.exe 2820 bjnbffb.exe 2516 xvbprp.exe 2484 fvftxxx.exe 2536 dpttvhf.exe 1988 jrnvhn.exe 3056 vjrbr.exe 668 pjvrt.exe 2860 nhdhxl.exe 1836 pxrpj.exe 1352 bxtbf.exe 2028 dtbvdh.exe 1548 bthlrjn.exe 1168 jhdlv.exe 2292 lbjpjj.exe 2052 tnhtnj.exe 2384 dxnhr.exe 520 rbrddp.exe 2176 bxdpv.exe 2228 xpldxvx.exe 856 pfxlnr.exe 2700 tntvxp.exe 1800 ldjlbf.exe -
Processes:
resource yara_rule behavioral1/memory/1736-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1736-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\njlndhh.exe upx behavioral1/memory/760-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2184-30-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fllht.exe upx behavioral1/memory/2912-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vrhfvt.exe upx \??\c:\hdftt.exe upx C:\txnvt.exe upx behavioral1/memory/2324-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2324-45-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/3012-49-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jfxhfn.exe upx behavioral1/memory/2896-65-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ltppj.exe upx behavioral1/memory/2944-76-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hjvfxt.exe upx C:\xvdvt.exe upx behavioral1/memory/2824-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2856-93-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xbvhbxf.exe upx behavioral1/memory/2904-105-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pdxnbd.exe upx C:\ttjlnrt.exe upx behavioral1/memory/2132-120-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\flvjpvp.exe upx behavioral1/memory/2340-123-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vbfjpfn.exe upx behavioral1/memory/1496-139-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hlnffxj.exe upx C:\njblrvx.exe upx C:\dljvtbh.exe upx C:\pfrxnv.exe upx behavioral1/memory/2240-174-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nlbdl.exe upx C:\vpdvf.exe upx behavioral1/memory/1964-191-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xdnjxlv.exe upx behavioral1/memory/2472-202-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\trpbv.exe upx behavioral1/memory/1992-209-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2468-212-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thphnn.exe upx C:\hthffbn.exe upx behavioral1/memory/2468-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1812-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1812-230-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dnjrbpj.exe upx behavioral1/memory/1788-240-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xnhft.exe upx behavioral1/memory/2532-249-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hdfrffx.exe upx behavioral1/memory/2072-250-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jphxb.exe upx behavioral1/memory/2808-268-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2704-267-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dhvrnv.exe upx behavioral1/memory/2808-275-0x00000000005C0000-0x00000000005E7000-memory.dmp upx behavioral1/memory/2808-277-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjxbfnl.exe upx C:\pjdnnrp.exe upx C:\tnpll.exe upx behavioral1/memory/2004-333-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ftxjvv.exethpflnv.exefnbdxph.exelrfvbnt.exevfxtn.exejbfbfn.exexppplrf.exedlflrfr.exervhdpxp.exejhbbdr.exebvhfjd.exevjtnd.exebxbntt.exejttxnp.exebdtlrfd.exetnpll.exexpfhphd.exehdftt.exebrpvrrn.exetfxpnfd.exephnbdd.exehttnrln.exedtbtvtf.exehlxlj.exeblxld.exejnvhb.exevlbdl.exedxvhljr.exefrbvl.exehrhrtr.exenfdxb.exedbhpjbv.exehxllfxp.exeffblh.exedhfhxj.exetddfvb.exetphnvp.exevrjrp.exedjhvtvf.exexvhrvhv.exehvbnd.exevrlnff.exedjttdrv.exertlbv.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftxjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thpflnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnbdxph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfvbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfxtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbfbfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xppplrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlflrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvhdpxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhbbdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvhfjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjtnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jttxnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdtlrfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnpll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpfhphd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdftt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brpvrrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfxpnfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phnbdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnrln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtbtvtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlxlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blxld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnvhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlbdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxvhljr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frbvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrhrtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfdxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbhpjbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxllfxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffblh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhfhxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tddfvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tphnvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrjrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djhvtvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvhrvhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvbnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrlnff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djttdrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtlbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
375bd19dc3703e65bf67bf9b3e0825f9599aaac92288a24addc691db5c008b38.exenjlndhh.exehdftt.exefllht.exevrhfvt.exetxnvt.exejfxhfn.exeltppj.exehjvfxt.exexvdvt.exexbvhbxf.exepdxnbd.exettjlnrt.exeflvjpvp.exevbfjpfn.exehlnffxj.exedescription pid process target process PID 1736 wrote to memory of 760 1736 375bd19dc3703e65bf67bf9b3e0825f9599aaac92288a24addc691db5c008b38.exe njlndhh.exe PID 1736 wrote to memory of 760 1736 375bd19dc3703e65bf67bf9b3e0825f9599aaac92288a24addc691db5c008b38.exe njlndhh.exe PID 1736 wrote to memory of 760 1736 375bd19dc3703e65bf67bf9b3e0825f9599aaac92288a24addc691db5c008b38.exe njlndhh.exe PID 1736 wrote to memory of 760 1736 375bd19dc3703e65bf67bf9b3e0825f9599aaac92288a24addc691db5c008b38.exe njlndhh.exe PID 760 wrote to memory of 2184 760 njlndhh.exe hdftt.exe PID 760 wrote to memory of 2184 760 njlndhh.exe hdftt.exe PID 760 wrote to memory of 2184 760 njlndhh.exe hdftt.exe PID 760 wrote to memory of 2184 760 njlndhh.exe hdftt.exe PID 2184 wrote to memory of 2912 2184 hdftt.exe fllht.exe PID 2184 wrote to memory of 2912 2184 hdftt.exe fllht.exe PID 2184 wrote to memory of 2912 2184 hdftt.exe fllht.exe PID 2184 wrote to memory of 2912 2184 hdftt.exe fllht.exe PID 2912 wrote to memory of 2324 2912 fllht.exe vrhfvt.exe PID 2912 wrote to memory of 2324 2912 fllht.exe vrhfvt.exe PID 2912 wrote to memory of 2324 2912 fllht.exe vrhfvt.exe PID 2912 wrote to memory of 2324 2912 fllht.exe vrhfvt.exe PID 2324 wrote to memory of 3012 2324 vrhfvt.exe txnvt.exe PID 2324 wrote to memory of 3012 2324 vrhfvt.exe txnvt.exe PID 2324 wrote to memory of 3012 2324 vrhfvt.exe txnvt.exe PID 2324 wrote to memory of 3012 2324 vrhfvt.exe txnvt.exe PID 3012 wrote to memory of 2896 3012 txnvt.exe jfxhfn.exe PID 3012 wrote to memory of 2896 3012 txnvt.exe jfxhfn.exe PID 3012 wrote to memory of 2896 3012 txnvt.exe jfxhfn.exe PID 3012 wrote to memory of 2896 3012 txnvt.exe jfxhfn.exe PID 2896 wrote to memory of 2944 2896 jfxhfn.exe ltppj.exe PID 2896 wrote to memory of 2944 2896 jfxhfn.exe ltppj.exe PID 2896 wrote to memory of 2944 2896 jfxhfn.exe ltppj.exe PID 2896 wrote to memory of 2944 2896 jfxhfn.exe ltppj.exe PID 2944 wrote to memory of 2824 2944 ltppj.exe hjvfxt.exe PID 2944 wrote to memory of 2824 2944 ltppj.exe hjvfxt.exe PID 2944 wrote to memory of 2824 2944 ltppj.exe hjvfxt.exe PID 2944 wrote to memory of 2824 2944 ltppj.exe hjvfxt.exe PID 2824 wrote to memory of 2856 2824 hjvfxt.exe xvdvt.exe PID 2824 wrote to memory of 2856 2824 hjvfxt.exe xvdvt.exe PID 2824 wrote to memory of 2856 2824 hjvfxt.exe xvdvt.exe PID 2824 wrote to memory of 2856 2824 hjvfxt.exe xvdvt.exe PID 2856 wrote to memory of 2788 2856 xvdvt.exe xbvhbxf.exe PID 2856 wrote to memory of 2788 2856 xvdvt.exe xbvhbxf.exe PID 2856 wrote to memory of 2788 2856 xvdvt.exe xbvhbxf.exe PID 2856 wrote to memory of 2788 2856 xvdvt.exe xbvhbxf.exe PID 2788 wrote to memory of 2904 2788 xbvhbxf.exe pdxnbd.exe PID 2788 wrote to memory of 2904 2788 xbvhbxf.exe pdxnbd.exe PID 2788 wrote to memory of 2904 2788 xbvhbxf.exe pdxnbd.exe PID 2788 wrote to memory of 2904 2788 xbvhbxf.exe pdxnbd.exe PID 2904 wrote to memory of 2132 2904 pdxnbd.exe ttjlnrt.exe PID 2904 wrote to memory of 2132 2904 pdxnbd.exe ttjlnrt.exe PID 2904 wrote to memory of 2132 2904 pdxnbd.exe ttjlnrt.exe PID 2904 wrote to memory of 2132 2904 pdxnbd.exe ttjlnrt.exe PID 2132 wrote to memory of 2340 2132 ttjlnrt.exe flvjpvp.exe PID 2132 wrote to memory of 2340 2132 ttjlnrt.exe flvjpvp.exe PID 2132 wrote to memory of 2340 2132 ttjlnrt.exe flvjpvp.exe PID 2132 wrote to memory of 2340 2132 ttjlnrt.exe flvjpvp.exe PID 2340 wrote to memory of 1496 2340 flvjpvp.exe vbfjpfn.exe PID 2340 wrote to memory of 1496 2340 flvjpvp.exe vbfjpfn.exe PID 2340 wrote to memory of 1496 2340 flvjpvp.exe vbfjpfn.exe PID 2340 wrote to memory of 1496 2340 flvjpvp.exe vbfjpfn.exe PID 1496 wrote to memory of 1408 1496 vbfjpfn.exe hlnffxj.exe PID 1496 wrote to memory of 1408 1496 vbfjpfn.exe hlnffxj.exe PID 1496 wrote to memory of 1408 1496 vbfjpfn.exe hlnffxj.exe PID 1496 wrote to memory of 1408 1496 vbfjpfn.exe hlnffxj.exe PID 1408 wrote to memory of 696 1408 hlnffxj.exe njblrvx.exe PID 1408 wrote to memory of 696 1408 hlnffxj.exe njblrvx.exe PID 1408 wrote to memory of 696 1408 hlnffxj.exe njblrvx.exe PID 1408 wrote to memory of 696 1408 hlnffxj.exe njblrvx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\375bd19dc3703e65bf67bf9b3e0825f9599aaac92288a24addc691db5c008b38.exe"C:\Users\Admin\AppData\Local\Temp\375bd19dc3703e65bf67bf9b3e0825f9599aaac92288a24addc691db5c008b38.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\njlndhh.exec:\njlndhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\hdftt.exec:\hdftt.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\fllht.exec:\fllht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\vrhfvt.exec:\vrhfvt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\txnvt.exec:\txnvt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\jfxhfn.exec:\jfxhfn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\ltppj.exec:\ltppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\hjvfxt.exec:\hjvfxt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\xvdvt.exec:\xvdvt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\xbvhbxf.exec:\xbvhbxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\pdxnbd.exec:\pdxnbd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\ttjlnrt.exec:\ttjlnrt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\flvjpvp.exec:\flvjpvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\vbfjpfn.exec:\vbfjpfn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\hlnffxj.exec:\hlnffxj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\njblrvx.exec:\njblrvx.exe17⤵
- Executes dropped EXE
PID:696 -
\??\c:\dljvtbh.exec:\dljvtbh.exe18⤵
- Executes dropped EXE
PID:588 -
\??\c:\pfrxnv.exec:\pfrxnv.exe19⤵
- Executes dropped EXE
PID:2240 -
\??\c:\nlbdl.exec:\nlbdl.exe20⤵
- Executes dropped EXE
PID:520 -
\??\c:\vpdvf.exec:\vpdvf.exe21⤵
- Executes dropped EXE
PID:1964 -
\??\c:\xdnjxlv.exec:\xdnjxlv.exe22⤵
- Executes dropped EXE
PID:2472 -
\??\c:\trpbv.exec:\trpbv.exe23⤵
- Executes dropped EXE
PID:1992 -
\??\c:\thphnn.exec:\thphnn.exe24⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hthffbn.exec:\hthffbn.exe25⤵
- Executes dropped EXE
PID:1812 -
\??\c:\dnjrbpj.exec:\dnjrbpj.exe26⤵
- Executes dropped EXE
PID:1788 -
\??\c:\xnhft.exec:\xnhft.exe27⤵
- Executes dropped EXE
PID:2532 -
\??\c:\hdfrffx.exec:\hdfrffx.exe28⤵
- Executes dropped EXE
PID:2072 -
\??\c:\jphxb.exec:\jphxb.exe29⤵
- Executes dropped EXE
PID:2704 -
\??\c:\dhvrnv.exec:\dhvrnv.exe30⤵
- Executes dropped EXE
PID:2808 -
\??\c:\jjxbfnl.exec:\jjxbfnl.exe31⤵
- Executes dropped EXE
PID:1808 -
\??\c:\pjdnnrp.exec:\pjdnnrp.exe32⤵
- Executes dropped EXE
PID:1928 -
\??\c:\tnpll.exec:\tnpll.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1256 -
\??\c:\jllvf.exec:\jllvf.exe34⤵
- Executes dropped EXE
PID:2224 -
\??\c:\tbfjfjr.exec:\tbfjfjr.exe35⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hvvvfxt.exec:\hvvvfxt.exe36⤵
- Executes dropped EXE
PID:584 -
\??\c:\vrntn.exec:\vrntn.exe37⤵
- Executes dropped EXE
PID:3068 -
\??\c:\dlvbdt.exec:\dlvbdt.exe38⤵
- Executes dropped EXE
PID:1588 -
\??\c:\vhvhhbb.exec:\vhvhhbb.exe39⤵
- Executes dropped EXE
PID:2004 -
\??\c:\trvpd.exec:\trvpd.exe40⤵
- Executes dropped EXE
PID:2940 -
\??\c:\lpvfdr.exec:\lpvfdr.exe41⤵
- Executes dropped EXE
PID:2152 -
\??\c:\dhdntd.exec:\dhdntd.exe42⤵
- Executes dropped EXE
PID:2836 -
\??\c:\jprtjj.exec:\jprtjj.exe43⤵
- Executes dropped EXE
PID:3016 -
\??\c:\bjnbffb.exec:\bjnbffb.exe44⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xvbprp.exec:\xvbprp.exe45⤵
- Executes dropped EXE
PID:2516 -
\??\c:\fvftxxx.exec:\fvftxxx.exe46⤵
- Executes dropped EXE
PID:2484 -
\??\c:\dpttvhf.exec:\dpttvhf.exe47⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jrnvhn.exec:\jrnvhn.exe48⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vjrbr.exec:\vjrbr.exe49⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pjvrt.exec:\pjvrt.exe50⤵
- Executes dropped EXE
PID:668 -
\??\c:\nhdhxl.exec:\nhdhxl.exe51⤵
- Executes dropped EXE
PID:2860 -
\??\c:\pxrpj.exec:\pxrpj.exe52⤵
- Executes dropped EXE
PID:1836 -
\??\c:\bxtbf.exec:\bxtbf.exe53⤵
- Executes dropped EXE
PID:1352 -
\??\c:\dtbvdh.exec:\dtbvdh.exe54⤵
- Executes dropped EXE
PID:2028 -
\??\c:\bthlrjn.exec:\bthlrjn.exe55⤵
- Executes dropped EXE
PID:1548 -
\??\c:\jhdlv.exec:\jhdlv.exe56⤵
- Executes dropped EXE
PID:1168 -
\??\c:\lbjpjj.exec:\lbjpjj.exe57⤵
- Executes dropped EXE
PID:2292 -
\??\c:\tnhtnj.exec:\tnhtnj.exe58⤵
- Executes dropped EXE
PID:2052 -
\??\c:\dxnhr.exec:\dxnhr.exe59⤵
- Executes dropped EXE
PID:2384 -
\??\c:\rbrddp.exec:\rbrddp.exe60⤵
- Executes dropped EXE
PID:520 -
\??\c:\bxdpv.exec:\bxdpv.exe61⤵
- Executes dropped EXE
PID:2176 -
\??\c:\xpldxvx.exec:\xpldxvx.exe62⤵
- Executes dropped EXE
PID:2228 -
\??\c:\pfxlnr.exec:\pfxlnr.exe63⤵
- Executes dropped EXE
PID:856 -
\??\c:\tntvxp.exec:\tntvxp.exe64⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ldjlbf.exec:\ldjlbf.exe65⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xhdnjvv.exec:\xhdnjvv.exe66⤵PID:960
-
\??\c:\tddhjvr.exec:\tddhjvr.exe67⤵PID:1540
-
\??\c:\vfvtpd.exec:\vfvtpd.exe68⤵PID:2264
-
\??\c:\lnvtdx.exec:\lnvtdx.exe69⤵PID:1764
-
\??\c:\nlvjnrf.exec:\nlvjnrf.exe70⤵PID:1204
-
\??\c:\rnnfnh.exec:\rnnfnh.exe71⤵PID:2096
-
\??\c:\tlxlj.exec:\tlxlj.exe72⤵PID:276
-
\??\c:\dhfhld.exec:\dhfhld.exe73⤵PID:1976
-
\??\c:\lndrbn.exec:\lndrbn.exe74⤵PID:1528
-
\??\c:\tvhvrt.exec:\tvhvrt.exe75⤵PID:1720
-
\??\c:\hjdbxhb.exec:\hjdbxhb.exe76⤵PID:2288
-
\??\c:\fdttb.exec:\fdttb.exe77⤵PID:1256
-
\??\c:\lxbfxn.exec:\lxbfxn.exe78⤵PID:2224
-
\??\c:\jjpfx.exec:\jjpfx.exe79⤵PID:2960
-
\??\c:\pvrdj.exec:\pvrdj.exe80⤵PID:2040
-
\??\c:\fxpbvd.exec:\fxpbvd.exe81⤵PID:1616
-
\??\c:\frfxdh.exec:\frfxdh.exe82⤵PID:1624
-
\??\c:\hltftjl.exec:\hltftjl.exe83⤵PID:2180
-
\??\c:\rbphb.exec:\rbphb.exe84⤵PID:2968
-
\??\c:\dnvtxln.exec:\dnvtxln.exe85⤵PID:2844
-
\??\c:\jxhbrtb.exec:\jxhbrtb.exe86⤵PID:1804
-
\??\c:\brpvrrn.exec:\brpvrrn.exe87⤵
- System Location Discovery: System Language Discovery
PID:3016 -
\??\c:\jlfrp.exec:\jlfrp.exe88⤵PID:2840
-
\??\c:\tphnvp.exec:\tphnvp.exe89⤵
- System Location Discovery: System Language Discovery
PID:2272 -
\??\c:\ndfbl.exec:\ndfbl.exe90⤵PID:2484
-
\??\c:\ndfxjhv.exec:\ndfxjhv.exe91⤵PID:2536
-
\??\c:\rnpfr.exec:\rnpfr.exe92⤵PID:1444
-
\??\c:\rnjvf.exec:\rnjvf.exe93⤵PID:3024
-
\??\c:\httnrln.exec:\httnrln.exe94⤵
- System Location Discovery: System Language Discovery
PID:1500 -
\??\c:\vrfjjvr.exec:\vrfjjvr.exe95⤵PID:2860
-
\??\c:\rnnvjbj.exec:\rnnvjbj.exe96⤵PID:2120
-
\??\c:\fbpnttr.exec:\fbpnttr.exe97⤵PID:2088
-
\??\c:\nrdhnv.exec:\nrdhnv.exe98⤵PID:2028
-
\??\c:\dhhfpth.exec:\dhhfpth.exe99⤵PID:1348
-
\??\c:\ffblh.exec:\ffblh.exe100⤵
- System Location Discovery: System Language Discovery
PID:2196 -
\??\c:\bhrxfbb.exec:\bhrxfbb.exe101⤵PID:556
-
\??\c:\pffrh.exec:\pffrh.exe102⤵PID:3008
-
\??\c:\vvvlvnp.exec:\vvvlvnp.exe103⤵PID:2436
-
\??\c:\ltjbxrh.exec:\ltjbxrh.exe104⤵PID:1644
-
\??\c:\xhbjllt.exec:\xhbjllt.exe105⤵PID:2408
-
\??\c:\hnpfp.exec:\hnpfp.exe106⤵PID:912
-
\??\c:\fffxtf.exec:\fffxtf.exe107⤵PID:1868
-
\??\c:\jtfrth.exec:\jtfrth.exe108⤵PID:2776
-
\??\c:\jdptblt.exec:\jdptblt.exe109⤵PID:1600
-
\??\c:\hrbdnj.exec:\hrbdnj.exe110⤵PID:2544
-
\??\c:\nxnfv.exec:\nxnfv.exe111⤵PID:1004
-
\??\c:\htfrx.exec:\htfrx.exe112⤵PID:2576
-
\??\c:\tbfdtdn.exec:\tbfdtdn.exe113⤵PID:1088
-
\??\c:\rblfjxh.exec:\rblfjxh.exe114⤵PID:2628
-
\??\c:\nxnhdt.exec:\nxnhdt.exe115⤵PID:2892
-
\??\c:\hxlxvr.exec:\hxlxvr.exe116⤵PID:2808
-
\??\c:\hjlvl.exec:\hjlvl.exe117⤵PID:2392
-
\??\c:\trdtvjt.exec:\trdtvjt.exe118⤵PID:888
-
\??\c:\tnndh.exec:\tnndh.exe119⤵PID:2432
-
\??\c:\vlbdl.exec:\vlbdl.exe120⤵
- System Location Discovery: System Language Discovery
PID:1236 -
\??\c:\rvjjt.exec:\rvjjt.exe121⤵PID:2900
-
\??\c:\jnvxhl.exec:\jnvxhl.exe122⤵PID:1224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-