Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 18:16
Behavioral task
behavioral1
Sample
375bd19dc3703e65bf67bf9b3e0825f9599aaac92288a24addc691db5c008b38.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
375bd19dc3703e65bf67bf9b3e0825f9599aaac92288a24addc691db5c008b38.exe
-
Size
61KB
-
MD5
a9b1f3ca5d3acddd7dde1424ac09bcfe
-
SHA1
8276bd88b686c54884ef5e9a5ae5dd132be0ef4b
-
SHA256
375bd19dc3703e65bf67bf9b3e0825f9599aaac92288a24addc691db5c008b38
-
SHA512
1f0c7e05152f929b79ae6475cba2b3de35df58d4d411ac84c27fc39ba5f442fd53326b207fb1d6174fbcbf7ec59547829d64c752b9de8b56f98717e103cec02a
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNlIQldWAw:khOmTsF93UYfwC6GIoutpYcvldWAw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/1736-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/760-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-74-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2824-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2132-116-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2132-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-126-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1496-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2240-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-192-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2472-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1812-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1788-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-391-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/668-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1540-521-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1540-541-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2288-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-623-0x0000000000280000-0x00000000002A7000-memory.dmp family_blackmoon behavioral1/memory/2968-630-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-649-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2196-730-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/556-735-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2408-763-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/888-846-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1224-866-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2856-948-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2536-955-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-1011-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2656-1027-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/680-1038-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1004-1081-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2968-1182-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2972-1196-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 760 njlndhh.exe 2184 hdftt.exe 2912 fllht.exe 2324 vrhfvt.exe 3012 txnvt.exe 2896 jfxhfn.exe 2944 ltppj.exe 2824 hjvfxt.exe 2856 xvdvt.exe 2788 xbvhbxf.exe 2904 pdxnbd.exe 2132 ttjlnrt.exe 2340 flvjpvp.exe 1496 vbfjpfn.exe 1408 hlnffxj.exe 696 njblrvx.exe 588 dljvtbh.exe 2240 pfrxnv.exe 520 nlbdl.exe 1964 vpdvf.exe 2472 xdnjxlv.exe 1992 trpbv.exe 2468 thphnn.exe 1812 hthffbn.exe 1788 dnjrbpj.exe 2532 xnhft.exe 2072 hdfrffx.exe 2704 jphxb.exe 2808 dhvrnv.exe 1808 jjxbfnl.exe 1928 pjdnnrp.exe 1256 tnpll.exe 2224 jllvf.exe 2424 tbfjfjr.exe 584 hvvvfxt.exe 3068 vrntn.exe 1588 dlvbdt.exe 2004 vhvhhbb.exe 2940 trvpd.exe 2152 lpvfdr.exe 2836 dhdntd.exe 3016 jprtjj.exe 2820 bjnbffb.exe 2516 xvbprp.exe 2484 fvftxxx.exe 2536 dpttvhf.exe 1988 jrnvhn.exe 3056 vjrbr.exe 668 pjvrt.exe 2860 nhdhxl.exe 1836 pxrpj.exe 1352 bxtbf.exe 2028 dtbvdh.exe 1548 bthlrjn.exe 1168 jhdlv.exe 2292 lbjpjj.exe 2052 tnhtnj.exe 2384 dxnhr.exe 520 rbrddp.exe 2176 bxdpv.exe 2228 xpldxvx.exe 856 pfxlnr.exe 2700 tntvxp.exe 1800 ldjlbf.exe -
resource yara_rule behavioral1/memory/1736-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1736-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000012266-9.dat upx behavioral1/memory/760-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2184-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d0c-25.dat upx behavioral1/memory/2912-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d1c-36.dat upx behavioral1/files/0x0008000000016cf0-19.dat upx behavioral1/files/0x000a000000016d2c-46.dat upx behavioral1/memory/2324-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2324-45-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/3012-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d3f-57.dat upx behavioral1/memory/2896-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0002000000018334-66.dat upx behavioral1/memory/2944-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ef-75.dat upx behavioral1/files/0x000500000001950f-85.dat upx behavioral1/memory/2824-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2856-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000016cab-94.dat upx behavioral1/memory/2904-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019515-103.dat upx behavioral1/files/0x0005000000019547-110.dat upx behavioral1/memory/2132-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001957c-121.dat upx behavioral1/memory/2340-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a7-131.dat upx behavioral1/memory/1496-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a9-141.dat upx behavioral1/files/0x00050000000195ab-149.dat upx behavioral1/files/0x00050000000195ad-157.dat upx behavioral1/files/0x00050000000195af-165.dat upx behavioral1/memory/2240-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b1-175.dat upx behavioral1/files/0x00050000000195b3-183.dat upx behavioral1/memory/1964-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b5-193.dat upx behavioral1/memory/2472-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b7-201.dat upx behavioral1/memory/1992-209-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2468-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195bb-211.dat upx behavioral1/files/0x00050000000195bd-220.dat upx behavioral1/memory/2468-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1812-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1812-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c1-231.dat upx behavioral1/memory/1788-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c3-239.dat upx behavioral1/memory/2532-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c5-248.dat upx behavioral1/memory/2072-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c6-258.dat upx behavioral1/memory/2808-268-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2704-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c7-266.dat upx behavioral1/memory/2808-275-0x00000000005C0000-0x00000000005E7000-memory.dmp upx behavioral1/memory/2808-277-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960c-278.dat upx behavioral1/files/0x0005000000019643-286.dat upx behavioral1/files/0x000500000001975a-294.dat upx behavioral1/memory/2004-333-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftxjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thpflnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnbdxph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfvbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfxtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbfbfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xppplrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlflrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvhdpxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhbbdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvhfjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjtnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jttxnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdtlrfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnpll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpfhphd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdftt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brpvrrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfxpnfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phnbdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnrln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtbtvtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlxlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blxld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnvhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlbdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxvhljr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frbvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrhrtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfdxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbhpjbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxllfxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffblh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhfhxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tddfvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tphnvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrjrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djhvtvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvhrvhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvbnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrlnff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djttdrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtlbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1736 wrote to memory of 760 1736 375bd19dc3703e65bf67bf9b3e0825f9599aaac92288a24addc691db5c008b38.exe 30 PID 1736 wrote to memory of 760 1736 375bd19dc3703e65bf67bf9b3e0825f9599aaac92288a24addc691db5c008b38.exe 30 PID 1736 wrote to memory of 760 1736 375bd19dc3703e65bf67bf9b3e0825f9599aaac92288a24addc691db5c008b38.exe 30 PID 1736 wrote to memory of 760 1736 375bd19dc3703e65bf67bf9b3e0825f9599aaac92288a24addc691db5c008b38.exe 30 PID 760 wrote to memory of 2184 760 njlndhh.exe 31 PID 760 wrote to memory of 2184 760 njlndhh.exe 31 PID 760 wrote to memory of 2184 760 njlndhh.exe 31 PID 760 wrote to memory of 2184 760 njlndhh.exe 31 PID 2184 wrote to memory of 2912 2184 hdftt.exe 32 PID 2184 wrote to memory of 2912 2184 hdftt.exe 32 PID 2184 wrote to memory of 2912 2184 hdftt.exe 32 PID 2184 wrote to memory of 2912 2184 hdftt.exe 32 PID 2912 wrote to memory of 2324 2912 fllht.exe 33 PID 2912 wrote to memory of 2324 2912 fllht.exe 33 PID 2912 wrote to memory of 2324 2912 fllht.exe 33 PID 2912 wrote to memory of 2324 2912 fllht.exe 33 PID 2324 wrote to memory of 3012 2324 vrhfvt.exe 34 PID 2324 wrote to memory of 3012 2324 vrhfvt.exe 34 PID 2324 wrote to memory of 3012 2324 vrhfvt.exe 34 PID 2324 wrote to memory of 3012 2324 vrhfvt.exe 34 PID 3012 wrote to memory of 2896 3012 txnvt.exe 35 PID 3012 wrote to memory of 2896 3012 txnvt.exe 35 PID 3012 wrote to memory of 2896 3012 txnvt.exe 35 PID 3012 wrote to memory of 2896 3012 txnvt.exe 35 PID 2896 wrote to memory of 2944 2896 jfxhfn.exe 36 PID 2896 wrote to memory of 2944 2896 jfxhfn.exe 36 PID 2896 wrote to memory of 2944 2896 jfxhfn.exe 36 PID 2896 wrote to memory of 2944 2896 jfxhfn.exe 36 PID 2944 wrote to memory of 2824 2944 ltppj.exe 37 PID 2944 wrote to memory of 2824 2944 ltppj.exe 37 PID 2944 wrote to memory of 2824 2944 ltppj.exe 37 PID 2944 wrote to memory of 2824 2944 ltppj.exe 37 PID 2824 wrote to memory of 2856 2824 hjvfxt.exe 38 PID 2824 wrote to memory of 2856 2824 hjvfxt.exe 38 PID 2824 wrote to memory of 2856 2824 hjvfxt.exe 38 PID 2824 wrote to memory of 2856 2824 hjvfxt.exe 38 PID 2856 wrote to memory of 2788 2856 xvdvt.exe 39 PID 2856 wrote to memory of 2788 2856 xvdvt.exe 39 PID 2856 wrote to memory of 2788 2856 xvdvt.exe 39 PID 2856 wrote to memory of 2788 2856 xvdvt.exe 39 PID 2788 wrote to memory of 2904 2788 xbvhbxf.exe 40 PID 2788 wrote to memory of 2904 2788 xbvhbxf.exe 40 PID 2788 wrote to memory of 2904 2788 xbvhbxf.exe 40 PID 2788 wrote to memory of 2904 2788 xbvhbxf.exe 40 PID 2904 wrote to memory of 2132 2904 pdxnbd.exe 41 PID 2904 wrote to memory of 2132 2904 pdxnbd.exe 41 PID 2904 wrote to memory of 2132 2904 pdxnbd.exe 41 PID 2904 wrote to memory of 2132 2904 pdxnbd.exe 41 PID 2132 wrote to memory of 2340 2132 ttjlnrt.exe 42 PID 2132 wrote to memory of 2340 2132 ttjlnrt.exe 42 PID 2132 wrote to memory of 2340 2132 ttjlnrt.exe 42 PID 2132 wrote to memory of 2340 2132 ttjlnrt.exe 42 PID 2340 wrote to memory of 1496 2340 flvjpvp.exe 43 PID 2340 wrote to memory of 1496 2340 flvjpvp.exe 43 PID 2340 wrote to memory of 1496 2340 flvjpvp.exe 43 PID 2340 wrote to memory of 1496 2340 flvjpvp.exe 43 PID 1496 wrote to memory of 1408 1496 vbfjpfn.exe 44 PID 1496 wrote to memory of 1408 1496 vbfjpfn.exe 44 PID 1496 wrote to memory of 1408 1496 vbfjpfn.exe 44 PID 1496 wrote to memory of 1408 1496 vbfjpfn.exe 44 PID 1408 wrote to memory of 696 1408 hlnffxj.exe 45 PID 1408 wrote to memory of 696 1408 hlnffxj.exe 45 PID 1408 wrote to memory of 696 1408 hlnffxj.exe 45 PID 1408 wrote to memory of 696 1408 hlnffxj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\375bd19dc3703e65bf67bf9b3e0825f9599aaac92288a24addc691db5c008b38.exe"C:\Users\Admin\AppData\Local\Temp\375bd19dc3703e65bf67bf9b3e0825f9599aaac92288a24addc691db5c008b38.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\njlndhh.exec:\njlndhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\hdftt.exec:\hdftt.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\fllht.exec:\fllht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\vrhfvt.exec:\vrhfvt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\txnvt.exec:\txnvt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\jfxhfn.exec:\jfxhfn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\ltppj.exec:\ltppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\hjvfxt.exec:\hjvfxt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\xvdvt.exec:\xvdvt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\xbvhbxf.exec:\xbvhbxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\pdxnbd.exec:\pdxnbd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\ttjlnrt.exec:\ttjlnrt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\flvjpvp.exec:\flvjpvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\vbfjpfn.exec:\vbfjpfn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\hlnffxj.exec:\hlnffxj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\njblrvx.exec:\njblrvx.exe17⤵
- Executes dropped EXE
PID:696 -
\??\c:\dljvtbh.exec:\dljvtbh.exe18⤵
- Executes dropped EXE
PID:588 -
\??\c:\pfrxnv.exec:\pfrxnv.exe19⤵
- Executes dropped EXE
PID:2240 -
\??\c:\nlbdl.exec:\nlbdl.exe20⤵
- Executes dropped EXE
PID:520 -
\??\c:\vpdvf.exec:\vpdvf.exe21⤵
- Executes dropped EXE
PID:1964 -
\??\c:\xdnjxlv.exec:\xdnjxlv.exe22⤵
- Executes dropped EXE
PID:2472 -
\??\c:\trpbv.exec:\trpbv.exe23⤵
- Executes dropped EXE
PID:1992 -
\??\c:\thphnn.exec:\thphnn.exe24⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hthffbn.exec:\hthffbn.exe25⤵
- Executes dropped EXE
PID:1812 -
\??\c:\dnjrbpj.exec:\dnjrbpj.exe26⤵
- Executes dropped EXE
PID:1788 -
\??\c:\xnhft.exec:\xnhft.exe27⤵
- Executes dropped EXE
PID:2532 -
\??\c:\hdfrffx.exec:\hdfrffx.exe28⤵
- Executes dropped EXE
PID:2072 -
\??\c:\jphxb.exec:\jphxb.exe29⤵
- Executes dropped EXE
PID:2704 -
\??\c:\dhvrnv.exec:\dhvrnv.exe30⤵
- Executes dropped EXE
PID:2808 -
\??\c:\jjxbfnl.exec:\jjxbfnl.exe31⤵
- Executes dropped EXE
PID:1808 -
\??\c:\pjdnnrp.exec:\pjdnnrp.exe32⤵
- Executes dropped EXE
PID:1928 -
\??\c:\tnpll.exec:\tnpll.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1256 -
\??\c:\jllvf.exec:\jllvf.exe34⤵
- Executes dropped EXE
PID:2224 -
\??\c:\tbfjfjr.exec:\tbfjfjr.exe35⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hvvvfxt.exec:\hvvvfxt.exe36⤵
- Executes dropped EXE
PID:584 -
\??\c:\vrntn.exec:\vrntn.exe37⤵
- Executes dropped EXE
PID:3068 -
\??\c:\dlvbdt.exec:\dlvbdt.exe38⤵
- Executes dropped EXE
PID:1588 -
\??\c:\vhvhhbb.exec:\vhvhhbb.exe39⤵
- Executes dropped EXE
PID:2004 -
\??\c:\trvpd.exec:\trvpd.exe40⤵
- Executes dropped EXE
PID:2940 -
\??\c:\lpvfdr.exec:\lpvfdr.exe41⤵
- Executes dropped EXE
PID:2152 -
\??\c:\dhdntd.exec:\dhdntd.exe42⤵
- Executes dropped EXE
PID:2836 -
\??\c:\jprtjj.exec:\jprtjj.exe43⤵
- Executes dropped EXE
PID:3016 -
\??\c:\bjnbffb.exec:\bjnbffb.exe44⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xvbprp.exec:\xvbprp.exe45⤵
- Executes dropped EXE
PID:2516 -
\??\c:\fvftxxx.exec:\fvftxxx.exe46⤵
- Executes dropped EXE
PID:2484 -
\??\c:\dpttvhf.exec:\dpttvhf.exe47⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jrnvhn.exec:\jrnvhn.exe48⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vjrbr.exec:\vjrbr.exe49⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pjvrt.exec:\pjvrt.exe50⤵
- Executes dropped EXE
PID:668 -
\??\c:\nhdhxl.exec:\nhdhxl.exe51⤵
- Executes dropped EXE
PID:2860 -
\??\c:\pxrpj.exec:\pxrpj.exe52⤵
- Executes dropped EXE
PID:1836 -
\??\c:\bxtbf.exec:\bxtbf.exe53⤵
- Executes dropped EXE
PID:1352 -
\??\c:\dtbvdh.exec:\dtbvdh.exe54⤵
- Executes dropped EXE
PID:2028 -
\??\c:\bthlrjn.exec:\bthlrjn.exe55⤵
- Executes dropped EXE
PID:1548 -
\??\c:\jhdlv.exec:\jhdlv.exe56⤵
- Executes dropped EXE
PID:1168 -
\??\c:\lbjpjj.exec:\lbjpjj.exe57⤵
- Executes dropped EXE
PID:2292 -
\??\c:\tnhtnj.exec:\tnhtnj.exe58⤵
- Executes dropped EXE
PID:2052 -
\??\c:\dxnhr.exec:\dxnhr.exe59⤵
- Executes dropped EXE
PID:2384 -
\??\c:\rbrddp.exec:\rbrddp.exe60⤵
- Executes dropped EXE
PID:520 -
\??\c:\bxdpv.exec:\bxdpv.exe61⤵
- Executes dropped EXE
PID:2176 -
\??\c:\xpldxvx.exec:\xpldxvx.exe62⤵
- Executes dropped EXE
PID:2228 -
\??\c:\pfxlnr.exec:\pfxlnr.exe63⤵
- Executes dropped EXE
PID:856 -
\??\c:\tntvxp.exec:\tntvxp.exe64⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ldjlbf.exec:\ldjlbf.exe65⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xhdnjvv.exec:\xhdnjvv.exe66⤵PID:960
-
\??\c:\tddhjvr.exec:\tddhjvr.exe67⤵PID:1540
-
\??\c:\vfvtpd.exec:\vfvtpd.exe68⤵PID:2264
-
\??\c:\lnvtdx.exec:\lnvtdx.exe69⤵PID:1764
-
\??\c:\nlvjnrf.exec:\nlvjnrf.exe70⤵PID:1204
-
\??\c:\rnnfnh.exec:\rnnfnh.exe71⤵PID:2096
-
\??\c:\tlxlj.exec:\tlxlj.exe72⤵PID:276
-
\??\c:\dhfhld.exec:\dhfhld.exe73⤵PID:1976
-
\??\c:\lndrbn.exec:\lndrbn.exe74⤵PID:1528
-
\??\c:\tvhvrt.exec:\tvhvrt.exe75⤵PID:1720
-
\??\c:\hjdbxhb.exec:\hjdbxhb.exe76⤵PID:2288
-
\??\c:\fdttb.exec:\fdttb.exe77⤵PID:1256
-
\??\c:\lxbfxn.exec:\lxbfxn.exe78⤵PID:2224
-
\??\c:\jjpfx.exec:\jjpfx.exe79⤵PID:2960
-
\??\c:\pvrdj.exec:\pvrdj.exe80⤵PID:2040
-
\??\c:\fxpbvd.exec:\fxpbvd.exe81⤵PID:1616
-
\??\c:\frfxdh.exec:\frfxdh.exe82⤵PID:1624
-
\??\c:\hltftjl.exec:\hltftjl.exe83⤵PID:2180
-
\??\c:\rbphb.exec:\rbphb.exe84⤵PID:2968
-
\??\c:\dnvtxln.exec:\dnvtxln.exe85⤵PID:2844
-
\??\c:\jxhbrtb.exec:\jxhbrtb.exe86⤵PID:1804
-
\??\c:\brpvrrn.exec:\brpvrrn.exe87⤵
- System Location Discovery: System Language Discovery
PID:3016 -
\??\c:\jlfrp.exec:\jlfrp.exe88⤵PID:2840
-
\??\c:\tphnvp.exec:\tphnvp.exe89⤵
- System Location Discovery: System Language Discovery
PID:2272 -
\??\c:\ndfbl.exec:\ndfbl.exe90⤵PID:2484
-
\??\c:\ndfxjhv.exec:\ndfxjhv.exe91⤵PID:2536
-
\??\c:\rnpfr.exec:\rnpfr.exe92⤵PID:1444
-
\??\c:\rnjvf.exec:\rnjvf.exe93⤵PID:3024
-
\??\c:\httnrln.exec:\httnrln.exe94⤵
- System Location Discovery: System Language Discovery
PID:1500 -
\??\c:\vrfjjvr.exec:\vrfjjvr.exe95⤵PID:2860
-
\??\c:\rnnvjbj.exec:\rnnvjbj.exe96⤵PID:2120
-
\??\c:\fbpnttr.exec:\fbpnttr.exe97⤵PID:2088
-
\??\c:\nrdhnv.exec:\nrdhnv.exe98⤵PID:2028
-
\??\c:\dhhfpth.exec:\dhhfpth.exe99⤵PID:1348
-
\??\c:\ffblh.exec:\ffblh.exe100⤵
- System Location Discovery: System Language Discovery
PID:2196 -
\??\c:\bhrxfbb.exec:\bhrxfbb.exe101⤵PID:556
-
\??\c:\pffrh.exec:\pffrh.exe102⤵PID:3008
-
\??\c:\vvvlvnp.exec:\vvvlvnp.exe103⤵PID:2436
-
\??\c:\ltjbxrh.exec:\ltjbxrh.exe104⤵PID:1644
-
\??\c:\xhbjllt.exec:\xhbjllt.exe105⤵PID:2408
-
\??\c:\hnpfp.exec:\hnpfp.exe106⤵PID:912
-
\??\c:\fffxtf.exec:\fffxtf.exe107⤵PID:1868
-
\??\c:\jtfrth.exec:\jtfrth.exe108⤵PID:2776
-
\??\c:\jdptblt.exec:\jdptblt.exe109⤵PID:1600
-
\??\c:\hrbdnj.exec:\hrbdnj.exe110⤵PID:2544
-
\??\c:\nxnfv.exec:\nxnfv.exe111⤵PID:1004
-
\??\c:\htfrx.exec:\htfrx.exe112⤵PID:2576
-
\??\c:\tbfdtdn.exec:\tbfdtdn.exe113⤵PID:1088
-
\??\c:\rblfjxh.exec:\rblfjxh.exe114⤵PID:2628
-
\??\c:\nxnhdt.exec:\nxnhdt.exe115⤵PID:2892
-
\??\c:\hxlxvr.exec:\hxlxvr.exe116⤵PID:2808
-
\??\c:\hjlvl.exec:\hjlvl.exe117⤵PID:2392
-
\??\c:\trdtvjt.exec:\trdtvjt.exe118⤵PID:888
-
\??\c:\tnndh.exec:\tnndh.exe119⤵PID:2432
-
\??\c:\vlbdl.exec:\vlbdl.exe120⤵
- System Location Discovery: System Language Discovery
PID:1236 -
\??\c:\rvjjt.exec:\rvjjt.exe121⤵PID:2900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-