Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 03:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe
-
Size
333KB
-
MD5
03aafbcad47f175b49a9f4f1df0dd63a
-
SHA1
aeda57fa3ab1098bc00297adb1bf9be06bf37e21
-
SHA256
cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700
-
SHA512
fa8e5ada0db2a5c0b1dc01c57f9701be216942ec6f80a1a751d44d712f6e5d693caa197092e7d6595f45a0ddea49a3ea3f09cb06632619ea123be39cd7eef0e1
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhC:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 60 IoCs
resource yara_rule behavioral1/memory/2184-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-65-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2720-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-122-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1684-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/868-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/700-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1392-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-269-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1896-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-352-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2788-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-415-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1372-414-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3024-422-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3024-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-462-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2244-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-504-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2612-517-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1812-537-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2636-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/924-563-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2868-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-618-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2856-621-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3012-631-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2660-647-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2288-679-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2412-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-712-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2024-721-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/520-775-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1680-795-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-801-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/784-814-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2344-816-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-820-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1588-830-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2140-863-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/996-876-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2920-882-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2820-890-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2832-908-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2776 bhjbjj.exe 2820 btjlrjj.exe 2936 vhfpjnj.exe 2908 lhndj.exe 2716 vbjpf.exe 2732 bdjdbp.exe 2720 jxlhpr.exe 1500 jjlvbbf.exe 2216 dbxdhr.exe 2412 drfrh.exe 628 pdvfb.exe 1684 nvfdb.exe 3020 ldxndf.exe 2628 ptlptpt.exe 868 jxvtdf.exe 700 nvdllld.exe 2368 lbjdrh.exe 2384 xdlnb.exe 2356 fbpvbxh.exe 2548 blvld.exe 956 pvfhtx.exe 2320 vpnrlxl.exe 1472 vdhnxhj.exe 1960 lddbb.exe 1392 rxbhhjp.exe 2044 bntbjx.exe 1548 ljtrvnx.exe 1816 tpxptt.exe 2312 vljrhn.exe 1004 bdtxxl.exe 2664 pfdnbl.exe 1768 nnlxl.exe 1896 vtbbxd.exe 2772 tfbbjp.exe 2860 bvljdfb.exe 2888 lbjjrvj.exe 2704 bdjpv.exe 2308 lbfpl.exe 3012 btjfnt.exe 2896 lnxhj.exe 2660 ddpjtn.exe 2788 nfvxvxf.exe 2076 bjdndj.exe 1236 lltvdt.exe 2644 rbxrx.exe 1036 tbhlrd.exe 2852 fjhprlh.exe 2652 fnpntd.exe 2412 jnfpvh.exe 1372 jhjtflv.exe 3024 vbfjd.exe 1948 vhrjrh.exe 2372 nprfn.exe 2020 lbbbtr.exe 760 plxndpb.exe 1084 lrvptbf.exe 2392 dfdhrlj.exe 3056 bxlnln.exe 1648 nvthbh.exe 2540 lbfnhx.exe 2200 vltpnvb.exe 2244 lhtfl.exe 2400 lpvvnx.exe 2016 dlplft.exe -
resource yara_rule behavioral1/memory/2184-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/520-768-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-795-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-816-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-863-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdptj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvnhlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbjrpll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltplvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nffrdpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dffxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhhdxdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtflp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxtxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnffvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhpnrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvdxdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrvrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpxdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptlptpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtrfvxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhphlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnfnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlnbdxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhlth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlbfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lphvbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjdflhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdrph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtfppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvlbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nprjnhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xntfjbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blfxbfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prfvxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrbrrvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfttjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pftpbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnnvpxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txjfjhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txftr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blrdnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2776 2184 cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe 30 PID 2184 wrote to memory of 2776 2184 cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe 30 PID 2184 wrote to memory of 2776 2184 cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe 30 PID 2184 wrote to memory of 2776 2184 cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe 30 PID 2776 wrote to memory of 2820 2776 bhjbjj.exe 31 PID 2776 wrote to memory of 2820 2776 bhjbjj.exe 31 PID 2776 wrote to memory of 2820 2776 bhjbjj.exe 31 PID 2776 wrote to memory of 2820 2776 bhjbjj.exe 31 PID 2820 wrote to memory of 2936 2820 btjlrjj.exe 32 PID 2820 wrote to memory of 2936 2820 btjlrjj.exe 32 PID 2820 wrote to memory of 2936 2820 btjlrjj.exe 32 PID 2820 wrote to memory of 2936 2820 btjlrjj.exe 32 PID 2936 wrote to memory of 2908 2936 vhfpjnj.exe 33 PID 2936 wrote to memory of 2908 2936 vhfpjnj.exe 33 PID 2936 wrote to memory of 2908 2936 vhfpjnj.exe 33 PID 2936 wrote to memory of 2908 2936 vhfpjnj.exe 33 PID 2908 wrote to memory of 2716 2908 lhndj.exe 34 PID 2908 wrote to memory of 2716 2908 lhndj.exe 34 PID 2908 wrote to memory of 2716 2908 lhndj.exe 34 PID 2908 wrote to memory of 2716 2908 lhndj.exe 34 PID 2716 wrote to memory of 2732 2716 vbjpf.exe 35 PID 2716 wrote to memory of 2732 2716 vbjpf.exe 35 PID 2716 wrote to memory of 2732 2716 vbjpf.exe 35 PID 2716 wrote to memory of 2732 2716 vbjpf.exe 35 PID 2732 wrote to memory of 2720 2732 bdjdbp.exe 36 PID 2732 wrote to memory of 2720 2732 bdjdbp.exe 36 PID 2732 wrote to memory of 2720 2732 bdjdbp.exe 36 PID 2732 wrote to memory of 2720 2732 bdjdbp.exe 36 PID 2720 wrote to memory of 1500 2720 jxlhpr.exe 37 PID 2720 wrote to memory of 1500 2720 jxlhpr.exe 37 PID 2720 wrote to memory of 1500 2720 jxlhpr.exe 37 PID 2720 wrote to memory of 1500 2720 jxlhpr.exe 37 PID 1500 wrote to memory of 2216 1500 jjlvbbf.exe 38 PID 1500 wrote to memory of 2216 1500 jjlvbbf.exe 38 PID 1500 wrote to memory of 2216 1500 jjlvbbf.exe 38 PID 1500 wrote to memory of 2216 1500 jjlvbbf.exe 38 PID 2216 wrote to memory of 2412 2216 dbxdhr.exe 39 PID 2216 wrote to memory of 2412 2216 dbxdhr.exe 39 PID 2216 wrote to memory of 2412 2216 dbxdhr.exe 39 PID 2216 wrote to memory of 2412 2216 dbxdhr.exe 39 PID 2412 wrote to memory of 628 2412 drfrh.exe 40 PID 2412 wrote to memory of 628 2412 drfrh.exe 40 PID 2412 wrote to memory of 628 2412 drfrh.exe 40 PID 2412 wrote to memory of 628 2412 drfrh.exe 40 PID 628 wrote to memory of 1684 628 pdvfb.exe 41 PID 628 wrote to memory of 1684 628 pdvfb.exe 41 PID 628 wrote to memory of 1684 628 pdvfb.exe 41 PID 628 wrote to memory of 1684 628 pdvfb.exe 41 PID 1684 wrote to memory of 3020 1684 nvfdb.exe 42 PID 1684 wrote to memory of 3020 1684 nvfdb.exe 42 PID 1684 wrote to memory of 3020 1684 nvfdb.exe 42 PID 1684 wrote to memory of 3020 1684 nvfdb.exe 42 PID 3020 wrote to memory of 2628 3020 ldxndf.exe 43 PID 3020 wrote to memory of 2628 3020 ldxndf.exe 43 PID 3020 wrote to memory of 2628 3020 ldxndf.exe 43 PID 3020 wrote to memory of 2628 3020 ldxndf.exe 43 PID 2628 wrote to memory of 868 2628 ptlptpt.exe 44 PID 2628 wrote to memory of 868 2628 ptlptpt.exe 44 PID 2628 wrote to memory of 868 2628 ptlptpt.exe 44 PID 2628 wrote to memory of 868 2628 ptlptpt.exe 44 PID 868 wrote to memory of 700 868 jxvtdf.exe 45 PID 868 wrote to memory of 700 868 jxvtdf.exe 45 PID 868 wrote to memory of 700 868 jxvtdf.exe 45 PID 868 wrote to memory of 700 868 jxvtdf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe"C:\Users\Admin\AppData\Local\Temp\cc48bc0249581e997422831adbf14edd56e351d61b2589241d25dfa0db592700.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\bhjbjj.exec:\bhjbjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\btjlrjj.exec:\btjlrjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\vhfpjnj.exec:\vhfpjnj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\lhndj.exec:\lhndj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\vbjpf.exec:\vbjpf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\bdjdbp.exec:\bdjdbp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\jxlhpr.exec:\jxlhpr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\jjlvbbf.exec:\jjlvbbf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\dbxdhr.exec:\dbxdhr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\drfrh.exec:\drfrh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\pdvfb.exec:\pdvfb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\nvfdb.exec:\nvfdb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\ldxndf.exec:\ldxndf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\ptlptpt.exec:\ptlptpt.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\jxvtdf.exec:\jxvtdf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\nvdllld.exec:\nvdllld.exe17⤵
- Executes dropped EXE
PID:700 -
\??\c:\lbjdrh.exec:\lbjdrh.exe18⤵
- Executes dropped EXE
PID:2368 -
\??\c:\xdlnb.exec:\xdlnb.exe19⤵
- Executes dropped EXE
PID:2384 -
\??\c:\fbpvbxh.exec:\fbpvbxh.exe20⤵
- Executes dropped EXE
PID:2356 -
\??\c:\blvld.exec:\blvld.exe21⤵
- Executes dropped EXE
PID:2548 -
\??\c:\pvfhtx.exec:\pvfhtx.exe22⤵
- Executes dropped EXE
PID:956 -
\??\c:\vpnrlxl.exec:\vpnrlxl.exe23⤵
- Executes dropped EXE
PID:2320 -
\??\c:\vdhnxhj.exec:\vdhnxhj.exe24⤵
- Executes dropped EXE
PID:1472 -
\??\c:\lddbb.exec:\lddbb.exe25⤵
- Executes dropped EXE
PID:1960 -
\??\c:\rxbhhjp.exec:\rxbhhjp.exe26⤵
- Executes dropped EXE
PID:1392 -
\??\c:\bntbjx.exec:\bntbjx.exe27⤵
- Executes dropped EXE
PID:2044 -
\??\c:\ljtrvnx.exec:\ljtrvnx.exe28⤵
- Executes dropped EXE
PID:1548 -
\??\c:\tpxptt.exec:\tpxptt.exe29⤵
- Executes dropped EXE
PID:1816 -
\??\c:\vljrhn.exec:\vljrhn.exe30⤵
- Executes dropped EXE
PID:2312 -
\??\c:\bdtxxl.exec:\bdtxxl.exe31⤵
- Executes dropped EXE
PID:1004 -
\??\c:\pfdnbl.exec:\pfdnbl.exe32⤵
- Executes dropped EXE
PID:2664 -
\??\c:\nnlxl.exec:\nnlxl.exe33⤵
- Executes dropped EXE
PID:1768 -
\??\c:\vtbbxd.exec:\vtbbxd.exe34⤵
- Executes dropped EXE
PID:1896 -
\??\c:\tfbbjp.exec:\tfbbjp.exe35⤵
- Executes dropped EXE
PID:2772 -
\??\c:\bvljdfb.exec:\bvljdfb.exe36⤵
- Executes dropped EXE
PID:2860 -
\??\c:\lbjjrvj.exec:\lbjjrvj.exe37⤵
- Executes dropped EXE
PID:2888 -
\??\c:\bdjpv.exec:\bdjpv.exe38⤵
- Executes dropped EXE
PID:2704 -
\??\c:\lbfpl.exec:\lbfpl.exe39⤵
- Executes dropped EXE
PID:2308 -
\??\c:\btjfnt.exec:\btjfnt.exe40⤵
- Executes dropped EXE
PID:3012 -
\??\c:\lnxhj.exec:\lnxhj.exe41⤵
- Executes dropped EXE
PID:2896 -
\??\c:\ddpjtn.exec:\ddpjtn.exe42⤵
- Executes dropped EXE
PID:2660 -
\??\c:\nfvxvxf.exec:\nfvxvxf.exe43⤵
- Executes dropped EXE
PID:2788 -
\??\c:\bjdndj.exec:\bjdndj.exe44⤵
- Executes dropped EXE
PID:2076 -
\??\c:\lltvdt.exec:\lltvdt.exe45⤵
- Executes dropped EXE
PID:1236 -
\??\c:\rbxrx.exec:\rbxrx.exe46⤵
- Executes dropped EXE
PID:2644 -
\??\c:\tbhlrd.exec:\tbhlrd.exe47⤵
- Executes dropped EXE
PID:1036 -
\??\c:\fjhprlh.exec:\fjhprlh.exe48⤵
- Executes dropped EXE
PID:2852 -
\??\c:\fnpntd.exec:\fnpntd.exe49⤵
- Executes dropped EXE
PID:2652 -
\??\c:\jnfpvh.exec:\jnfpvh.exe50⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jhjtflv.exec:\jhjtflv.exe51⤵
- Executes dropped EXE
PID:1372 -
\??\c:\vbfjd.exec:\vbfjd.exe52⤵
- Executes dropped EXE
PID:3024 -
\??\c:\vhrjrh.exec:\vhrjrh.exe53⤵
- Executes dropped EXE
PID:1948 -
\??\c:\nprfn.exec:\nprfn.exe54⤵
- Executes dropped EXE
PID:2372 -
\??\c:\lbbbtr.exec:\lbbbtr.exe55⤵
- Executes dropped EXE
PID:2020 -
\??\c:\plxndpb.exec:\plxndpb.exe56⤵
- Executes dropped EXE
PID:760 -
\??\c:\lrvptbf.exec:\lrvptbf.exe57⤵
- Executes dropped EXE
PID:1084 -
\??\c:\dfdhrlj.exec:\dfdhrlj.exe58⤵
- Executes dropped EXE
PID:2392 -
\??\c:\bxlnln.exec:\bxlnln.exe59⤵
- Executes dropped EXE
PID:3056 -
\??\c:\nvthbh.exec:\nvthbh.exe60⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lbfnhx.exec:\lbfnhx.exe61⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vltpnvb.exec:\vltpnvb.exe62⤵
- Executes dropped EXE
PID:2200 -
\??\c:\lhtfl.exec:\lhtfl.exe63⤵
- Executes dropped EXE
PID:2244 -
\??\c:\lpvvnx.exec:\lpvvnx.exe64⤵
- Executes dropped EXE
PID:2400 -
\??\c:\dlplft.exec:\dlplft.exe65⤵
- Executes dropped EXE
PID:2016 -
\??\c:\vfvfn.exec:\vfvfn.exe66⤵PID:2612
-
\??\c:\tvfpp.exec:\tvfpp.exe67⤵PID:1800
-
\??\c:\bjthnj.exec:\bjthnj.exe68⤵PID:568
-
\??\c:\vtpnhlr.exec:\vtpnhlr.exe69⤵PID:1812
-
\??\c:\hllbfp.exec:\hllbfp.exe70⤵PID:324
-
\??\c:\bhfhxl.exec:\bhfhxl.exe71⤵PID:1204
-
\??\c:\hplprhh.exec:\hplprhh.exe72⤵PID:2636
-
\??\c:\hpddn.exec:\hpddn.exe73⤵PID:924
-
\??\c:\tfbrrrn.exec:\tfbrrrn.exe74⤵PID:664
-
\??\c:\vjjhfb.exec:\vjjhfb.exe75⤵PID:2664
-
\??\c:\nhtdbtb.exec:\nhtdbtb.exe76⤵PID:2508
-
\??\c:\hblhddx.exec:\hblhddx.exe77⤵PID:2796
-
\??\c:\hntft.exec:\hntft.exe78⤵PID:2816
-
\??\c:\vlxxlfh.exec:\vlxxlfh.exe79⤵PID:2868
-
\??\c:\ftblffp.exec:\ftblffp.exe80⤵PID:2912
-
\??\c:\jdxfxd.exec:\jdxfxd.exe81⤵PID:2904
-
\??\c:\jpnnlt.exec:\jpnnlt.exe82⤵PID:2856
-
\??\c:\pdprn.exec:\pdprn.exe83⤵PID:3012
-
\??\c:\jnvpld.exec:\jnvpld.exe84⤵PID:2700
-
\??\c:\rtrhr.exec:\rtrhr.exe85⤵PID:2660
-
\??\c:\xnnrf.exec:\xnnrf.exe86⤵PID:1420
-
\??\c:\vlvpn.exec:\vlvpn.exe87⤵PID:2288
-
\??\c:\prvhj.exec:\prvhj.exe88⤵PID:912
-
\??\c:\hlplxh.exec:\hlplxh.exe89⤵PID:2408
-
\??\c:\jjjhn.exec:\jjjhn.exe90⤵PID:2216
-
\??\c:\vvrbfh.exec:\vvrbfh.exe91⤵PID:1924
-
\??\c:\vjhvdxp.exec:\vjhvdxp.exe92⤵PID:2952
-
\??\c:\dtfrprx.exec:\dtfrprx.exe93⤵PID:2412
-
\??\c:\ppltbr.exec:\ppltbr.exe94⤵PID:3000
-
\??\c:\pvxfljt.exec:\pvxfljt.exe95⤵PID:2984
-
\??\c:\dhttlpt.exec:\dhttlpt.exe96⤵PID:2132
-
\??\c:\bttjb.exec:\bttjb.exe97⤵PID:2024
-
\??\c:\pbvvtd.exec:\pbvvtd.exe98⤵PID:264
-
\??\c:\phbth.exec:\phbth.exe99⤵PID:760
-
\??\c:\xtrbtt.exec:\xtrbtt.exe100⤵PID:2528
-
\??\c:\bvhph.exec:\bvhph.exe101⤵PID:2360
-
\??\c:\dnlpj.exec:\dnlpj.exe102⤵PID:2384
-
\??\c:\pnlxn.exec:\pnlxn.exe103⤵PID:1144
-
\??\c:\nhrhvlt.exec:\nhrhvlt.exe104⤵PID:1060
-
\??\c:\xjbdx.exec:\xjbdx.exe105⤵PID:520
-
\??\c:\xllpbhd.exec:\xllpbhd.exe106⤵PID:2632
-
\??\c:\lphvbb.exec:\lphvbb.exe107⤵
- System Location Discovery: System Language Discovery
PID:1592 -
\??\c:\hbxrvh.exec:\hbxrvh.exe108⤵PID:1680
-
\??\c:\pdjxr.exec:\pdjxr.exe109⤵PID:2552
-
\??\c:\jflxrnn.exec:\jflxrnn.exe110⤵PID:364
-
\??\c:\tjtbp.exec:\tjtbp.exe111⤵PID:784
-
\??\c:\ntvvbjj.exec:\ntvvbjj.exe112⤵PID:2344
-
\??\c:\prddpdp.exec:\prddpdp.exe113⤵PID:1588
-
\??\c:\jjhll.exec:\jjhll.exe114⤵PID:2336
-
\??\c:\vxjtp.exec:\vxjtp.exe115⤵PID:1876
-
\??\c:\hvvlb.exec:\hvvlb.exe116⤵PID:2604
-
\??\c:\jntfltx.exec:\jntfltx.exe117⤵PID:996
-
\??\c:\lpltt.exec:\lpltt.exe118⤵PID:2140
-
\??\c:\tnfhjf.exec:\tnfhjf.exe119⤵PID:2500
-
\??\c:\drxlrr.exec:\drxlrr.exe120⤵PID:2812
-
\??\c:\lprhvjf.exec:\lprhvjf.exe121⤵PID:2920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-