Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 17:45
Behavioral task
behavioral1
Sample
59b453f73a829ef3b14d307c36f75ed4d7812f5035c358a780369d8b766ea734.exe
Resource
win7-20241010-en
General
-
Target
59b453f73a829ef3b14d307c36f75ed4d7812f5035c358a780369d8b766ea734.exe
-
Size
71KB
-
MD5
3211239658f415b2a6e14dada51fe5a5
-
SHA1
958abbc48e8099408bbcb5dbe490069639435bd4
-
SHA256
59b453f73a829ef3b14d307c36f75ed4d7812f5035c358a780369d8b766ea734
-
SHA512
9ff168e8488bd110b3d03a24858416e1d116befe32ad1294c53d421a1e3d92c97611f1ea803d29e9c5fa9c59658e451f734d3d8a8917675cd608075b0af01448
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+IJPkffW2Vl4zQ3yN:zhOmTsF93UYfwC6GIoutiTm5kfuGCN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
Processes:
resource yara_rule behavioral1/memory/2128-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2152-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-65-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2216-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1780-99-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1780-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2040-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1156-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-192-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1456-217-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1456-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/812-239-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2524-262-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/844-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/860-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1564-331-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1032-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/108-380-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2736-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1912-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1300-483-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2524-532-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2276-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1900-564-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1596-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1252-715-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2492-727-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-783-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2536-1063-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1328-1069-0x00000000773C0000-0x00000000774DF000-memory.dmp family_blackmoon behavioral1/memory/1328-10413-0x00000000773C0000-0x00000000774DF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ljptdvr.exeppfhxb.exehnfll.exedbxtdlt.exerfxhh.exehnjltb.exexdfbnd.exelnbltpt.exeprnxpxh.exelnbltdj.exelhrxb.exejlfpffb.exevlxjnjd.exetfjxlpx.exehrxnxdd.exerpvhr.exejlxjtj.exevhtbf.exedtjldnx.exeffhpdp.exejjtvvv.exevhvldvp.exeljfjvrf.exebnbvfpl.exerlpvjrb.exeltxdl.exepdltf.exejdfdtlr.exexbbdvv.exehnfbtbb.exehlrtjt.exedfrbdj.exeptpjh.exerrnjtjr.exelfrptx.exetpdrbb.exedddjph.exexvvxfbv.exenpvltnx.exexxhjd.exexhhfn.exenjtdt.exefvplxb.exedtvdfjr.exelhddn.exejdxrh.exephxdr.exevrdnbpd.exexbxnpxd.exebhtjt.exebxrtj.exepxvrbd.exebplftjx.exefpdbh.exexvfdbvp.exexxnvfl.exehrvtpd.exebhtxf.exedxntfbf.exexxvlfdv.exedpdfvp.exednnpn.exenhfdb.exehjhpld.exepid Process 2316 ljptdvr.exe 2152 ppfhxb.exe 2800 hnfll.exe 3064 dbxtdlt.exe 2768 rfxhh.exe 2828 hnjltb.exe 2816 xdfbnd.exe 2644 lnbltpt.exe 2212 prnxpxh.exe 2216 lnbltdj.exe 1780 lhrxb.exe 1748 jlfpffb.exe 2576 vlxjnjd.exe 2908 tfjxlpx.exe 3008 hrxnxdd.exe 460 rpvhr.exe 2040 jlxjtj.exe 2324 vhtbf.exe 2168 dtjldnx.exe 1156 ffhpdp.exe 2564 jjtvvv.exe 2436 vhvldvp.exe 2332 ljfjvrf.exe 812 bnbvfpl.exe 1456 rlpvjrb.exe 1972 ltxdl.exe 2088 pdltf.exe 1080 jdfdtlr.exe 2520 xbbdvv.exe 1008 hnfbtbb.exe 2524 hlrtjt.exe 844 dfrbdj.exe 928 ptpjh.exe 860 rrnjtjr.exe 2536 lfrptx.exe 1760 tpdrbb.exe 2316 dddjph.exe 2152 xvvxfbv.exe 2132 npvltnx.exe 1564 xxhjd.exe 2804 xhhfn.exe 3064 njtdt.exe 2432 fvplxb.exe 2768 dtvdfjr.exe 2788 lhddn.exe 2764 jdxrh.exe 2680 phxdr.exe 1032 vrdnbpd.exe 2700 xbxnpxd.exe 2400 bhtjt.exe 2636 bxrtj.exe 108 pxvrbd.exe 2736 bplftjx.exe 1612 fpdbh.exe 2388 xvfdbvp.exe 2908 xxnvfl.exe 2972 hrvtpd.exe 1912 bhtxf.exe 460 dxntfbf.exe 2144 xxvlfdv.exe 2040 dpdfvp.exe 2444 dnnpn.exe 1696 nhfdb.exe 2424 hjhpld.exe -
Processes:
resource yara_rule behavioral1/memory/2128-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2128-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b00000001225c-7.dat upx behavioral1/memory/2316-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001660b-16.dat upx behavioral1/files/0x0008000000016ace-24.dat upx behavioral1/memory/2152-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2800-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c10-32.dat upx behavioral1/memory/2800-31-0x0000000000430000-0x0000000000457000-memory.dmp upx behavioral1/memory/3064-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c1a-40.dat upx behavioral1/memory/2768-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c23-48.dat upx behavioral1/files/0x0008000000016fc9-57.dat upx behavioral1/memory/2828-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2212-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019480-76.dat upx behavioral1/memory/2644-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0002000000018334-68.dat upx behavioral1/memory/2816-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019489-83.dat upx behavioral1/memory/2216-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001948c-92.dat upx behavioral1/memory/2216-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019490-104.dat upx behavioral1/memory/1748-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1780-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1748-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194a3-111.dat upx behavioral1/memory/2576-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2908-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x001200000001626d-120.dat upx behavioral1/files/0x00050000000194eb-128.dat upx behavioral1/memory/2908-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3008-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ef-139.dat upx behavioral1/memory/460-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001950f-145.dat upx behavioral1/memory/2040-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019515-152.dat upx behavioral1/files/0x0005000000019547-160.dat upx behavioral1/files/0x000500000001957c-169.dat upx behavioral1/memory/2168-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1156-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a7-176.dat upx behavioral1/files/0x00050000000195a9-184.dat upx behavioral1/memory/2564-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195ab-191.dat upx behavioral1/files/0x00050000000195ad-199.dat upx behavioral1/files/0x00050000000195af-208.dat upx behavioral1/files/0x00050000000195b1-216.dat upx behavioral1/memory/1456-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b3-224.dat upx behavioral1/files/0x00050000000195b5-232.dat upx behavioral1/memory/2088-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b7-240.dat upx behavioral1/files/0x00050000000195bb-247.dat upx behavioral1/files/0x00050000000195bd-254.dat upx behavioral1/files/0x00050000000195c1-263.dat upx behavioral1/memory/844-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/860-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1032-357-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2400-363-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
hnfll.exerbtbh.exetdhjbjv.exerftndj.exepdtxfbn.exejhrrfj.exehrxnxdd.exerxbrf.exeptlrrbr.exebnxxb.exevvfpbbt.exeljptdvr.exetfljp.exeldnnhhd.exenhtbfbb.exexdhvxj.exevvtvnj.exebrplx.exelbdfrr.exexpxhr.exeddlrtnl.exevlpxrx.exettlhdt.exebjvbf.exevllnvlb.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdhjbjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rftndj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdtxfbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhrrfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrxnxdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxbrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptlrrbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnxxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvfpbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljptdvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfljp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldnnhhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbfbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdhvxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvtvnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brplx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbdfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpxhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddlrtnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlpxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttlhdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjvbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vllnvlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
59b453f73a829ef3b14d307c36f75ed4d7812f5035c358a780369d8b766ea734.exeljptdvr.exeppfhxb.exehnfll.exedbxtdlt.exerfxhh.exehnjltb.exexdfbnd.exelnbltpt.exeprnxpxh.exelnbltdj.exelhrxb.exejlfpffb.exevlxjnjd.exetfjxlpx.exehrxnxdd.exedescription pid Process procid_target PID 2128 wrote to memory of 2316 2128 59b453f73a829ef3b14d307c36f75ed4d7812f5035c358a780369d8b766ea734.exe 30 PID 2128 wrote to memory of 2316 2128 59b453f73a829ef3b14d307c36f75ed4d7812f5035c358a780369d8b766ea734.exe 30 PID 2128 wrote to memory of 2316 2128 59b453f73a829ef3b14d307c36f75ed4d7812f5035c358a780369d8b766ea734.exe 30 PID 2128 wrote to memory of 2316 2128 59b453f73a829ef3b14d307c36f75ed4d7812f5035c358a780369d8b766ea734.exe 30 PID 2316 wrote to memory of 2152 2316 ljptdvr.exe 31 PID 2316 wrote to memory of 2152 2316 ljptdvr.exe 31 PID 2316 wrote to memory of 2152 2316 ljptdvr.exe 31 PID 2316 wrote to memory of 2152 2316 ljptdvr.exe 31 PID 2152 wrote to memory of 2800 2152 ppfhxb.exe 32 PID 2152 wrote to memory of 2800 2152 ppfhxb.exe 32 PID 2152 wrote to memory of 2800 2152 ppfhxb.exe 32 PID 2152 wrote to memory of 2800 2152 ppfhxb.exe 32 PID 2800 wrote to memory of 3064 2800 hnfll.exe 33 PID 2800 wrote to memory of 3064 2800 hnfll.exe 33 PID 2800 wrote to memory of 3064 2800 hnfll.exe 33 PID 2800 wrote to memory of 3064 2800 hnfll.exe 33 PID 3064 wrote to memory of 2768 3064 dbxtdlt.exe 34 PID 3064 wrote to memory of 2768 3064 dbxtdlt.exe 34 PID 3064 wrote to memory of 2768 3064 dbxtdlt.exe 34 PID 3064 wrote to memory of 2768 3064 dbxtdlt.exe 34 PID 2768 wrote to memory of 2828 2768 rfxhh.exe 35 PID 2768 wrote to memory of 2828 2768 rfxhh.exe 35 PID 2768 wrote to memory of 2828 2768 rfxhh.exe 35 PID 2768 wrote to memory of 2828 2768 rfxhh.exe 35 PID 2828 wrote to memory of 2816 2828 hnjltb.exe 36 PID 2828 wrote to memory of 2816 2828 hnjltb.exe 36 PID 2828 wrote to memory of 2816 2828 hnjltb.exe 36 PID 2828 wrote to memory of 2816 2828 hnjltb.exe 36 PID 2816 wrote to memory of 2644 2816 xdfbnd.exe 37 PID 2816 wrote to memory of 2644 2816 xdfbnd.exe 37 PID 2816 wrote to memory of 2644 2816 xdfbnd.exe 37 PID 2816 wrote to memory of 2644 2816 xdfbnd.exe 37 PID 2644 wrote to memory of 2212 2644 lnbltpt.exe 38 PID 2644 wrote to memory of 2212 2644 lnbltpt.exe 38 PID 2644 wrote to memory of 2212 2644 lnbltpt.exe 38 PID 2644 wrote to memory of 2212 2644 lnbltpt.exe 38 PID 2212 wrote to memory of 2216 2212 prnxpxh.exe 39 PID 2212 wrote to memory of 2216 2212 prnxpxh.exe 39 PID 2212 wrote to memory of 2216 2212 prnxpxh.exe 39 PID 2212 wrote to memory of 2216 2212 prnxpxh.exe 39 PID 2216 wrote to memory of 1780 2216 lnbltdj.exe 40 PID 2216 wrote to memory of 1780 2216 lnbltdj.exe 40 PID 2216 wrote to memory of 1780 2216 lnbltdj.exe 40 PID 2216 wrote to memory of 1780 2216 lnbltdj.exe 40 PID 1780 wrote to memory of 1748 1780 lhrxb.exe 41 PID 1780 wrote to memory of 1748 1780 lhrxb.exe 41 PID 1780 wrote to memory of 1748 1780 lhrxb.exe 41 PID 1780 wrote to memory of 1748 1780 lhrxb.exe 41 PID 1748 wrote to memory of 2576 1748 jlfpffb.exe 42 PID 1748 wrote to memory of 2576 1748 jlfpffb.exe 42 PID 1748 wrote to memory of 2576 1748 jlfpffb.exe 42 PID 1748 wrote to memory of 2576 1748 jlfpffb.exe 42 PID 2576 wrote to memory of 2908 2576 vlxjnjd.exe 43 PID 2576 wrote to memory of 2908 2576 vlxjnjd.exe 43 PID 2576 wrote to memory of 2908 2576 vlxjnjd.exe 43 PID 2576 wrote to memory of 2908 2576 vlxjnjd.exe 43 PID 2908 wrote to memory of 3008 2908 tfjxlpx.exe 44 PID 2908 wrote to memory of 3008 2908 tfjxlpx.exe 44 PID 2908 wrote to memory of 3008 2908 tfjxlpx.exe 44 PID 2908 wrote to memory of 3008 2908 tfjxlpx.exe 44 PID 3008 wrote to memory of 460 3008 hrxnxdd.exe 45 PID 3008 wrote to memory of 460 3008 hrxnxdd.exe 45 PID 3008 wrote to memory of 460 3008 hrxnxdd.exe 45 PID 3008 wrote to memory of 460 3008 hrxnxdd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\59b453f73a829ef3b14d307c36f75ed4d7812f5035c358a780369d8b766ea734.exe"C:\Users\Admin\AppData\Local\Temp\59b453f73a829ef3b14d307c36f75ed4d7812f5035c358a780369d8b766ea734.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\ljptdvr.exec:\ljptdvr.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\ppfhxb.exec:\ppfhxb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\hnfll.exec:\hnfll.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\dbxtdlt.exec:\dbxtdlt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\rfxhh.exec:\rfxhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\hnjltb.exec:\hnjltb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\xdfbnd.exec:\xdfbnd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\lnbltpt.exec:\lnbltpt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\prnxpxh.exec:\prnxpxh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\lnbltdj.exec:\lnbltdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\lhrxb.exec:\lhrxb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\jlfpffb.exec:\jlfpffb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\vlxjnjd.exec:\vlxjnjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\tfjxlpx.exec:\tfjxlpx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\hrxnxdd.exec:\hrxnxdd.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\rpvhr.exec:\rpvhr.exe17⤵
- Executes dropped EXE
PID:460 -
\??\c:\jlxjtj.exec:\jlxjtj.exe18⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vhtbf.exec:\vhtbf.exe19⤵
- Executes dropped EXE
PID:2324 -
\??\c:\dtjldnx.exec:\dtjldnx.exe20⤵
- Executes dropped EXE
PID:2168 -
\??\c:\ffhpdp.exec:\ffhpdp.exe21⤵
- Executes dropped EXE
PID:1156 -
\??\c:\jjtvvv.exec:\jjtvvv.exe22⤵
- Executes dropped EXE
PID:2564 -
\??\c:\vhvldvp.exec:\vhvldvp.exe23⤵
- Executes dropped EXE
PID:2436 -
\??\c:\ljfjvrf.exec:\ljfjvrf.exe24⤵
- Executes dropped EXE
PID:2332 -
\??\c:\bnbvfpl.exec:\bnbvfpl.exe25⤵
- Executes dropped EXE
PID:812 -
\??\c:\rlpvjrb.exec:\rlpvjrb.exe26⤵
- Executes dropped EXE
PID:1456 -
\??\c:\ltxdl.exec:\ltxdl.exe27⤵
- Executes dropped EXE
PID:1972 -
\??\c:\pdltf.exec:\pdltf.exe28⤵
- Executes dropped EXE
PID:2088 -
\??\c:\jdfdtlr.exec:\jdfdtlr.exe29⤵
- Executes dropped EXE
PID:1080 -
\??\c:\xbbdvv.exec:\xbbdvv.exe30⤵
- Executes dropped EXE
PID:2520 -
\??\c:\hnfbtbb.exec:\hnfbtbb.exe31⤵
- Executes dropped EXE
PID:1008 -
\??\c:\hlrtjt.exec:\hlrtjt.exe32⤵
- Executes dropped EXE
PID:2524 -
\??\c:\dfrbdj.exec:\dfrbdj.exe33⤵
- Executes dropped EXE
PID:844 -
\??\c:\ptpjh.exec:\ptpjh.exe34⤵
- Executes dropped EXE
PID:928 -
\??\c:\rrnjtjr.exec:\rrnjtjr.exe35⤵
- Executes dropped EXE
PID:860 -
\??\c:\lfrptx.exec:\lfrptx.exe36⤵
- Executes dropped EXE
PID:2536 -
\??\c:\tpdrbb.exec:\tpdrbb.exe37⤵
- Executes dropped EXE
PID:1760 -
\??\c:\dddjph.exec:\dddjph.exe38⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xvvxfbv.exec:\xvvxfbv.exe39⤵
- Executes dropped EXE
PID:2152 -
\??\c:\npvltnx.exec:\npvltnx.exe40⤵
- Executes dropped EXE
PID:2132 -
\??\c:\xxhjd.exec:\xxhjd.exe41⤵
- Executes dropped EXE
PID:1564 -
\??\c:\xhhfn.exec:\xhhfn.exe42⤵
- Executes dropped EXE
PID:2804 -
\??\c:\njtdt.exec:\njtdt.exe43⤵
- Executes dropped EXE
PID:3064 -
\??\c:\fvplxb.exec:\fvplxb.exe44⤵
- Executes dropped EXE
PID:2432 -
\??\c:\dtvdfjr.exec:\dtvdfjr.exe45⤵
- Executes dropped EXE
PID:2768 -
\??\c:\lhddn.exec:\lhddn.exe46⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jdxrh.exec:\jdxrh.exe47⤵
- Executes dropped EXE
PID:2764 -
\??\c:\phxdr.exec:\phxdr.exe48⤵
- Executes dropped EXE
PID:2680 -
\??\c:\vrdnbpd.exec:\vrdnbpd.exe49⤵
- Executes dropped EXE
PID:1032 -
\??\c:\xbxnpxd.exec:\xbxnpxd.exe50⤵
- Executes dropped EXE
PID:2700 -
\??\c:\bhtjt.exec:\bhtjt.exe51⤵
- Executes dropped EXE
PID:2400 -
\??\c:\bxrtj.exec:\bxrtj.exe52⤵
- Executes dropped EXE
PID:2636 -
\??\c:\pxvrbd.exec:\pxvrbd.exe53⤵
- Executes dropped EXE
PID:108 -
\??\c:\bplftjx.exec:\bplftjx.exe54⤵
- Executes dropped EXE
PID:2736 -
\??\c:\fpdbh.exec:\fpdbh.exe55⤵
- Executes dropped EXE
PID:1612 -
\??\c:\xvfdbvp.exec:\xvfdbvp.exe56⤵
- Executes dropped EXE
PID:2388 -
\??\c:\xxnvfl.exec:\xxnvfl.exe57⤵
- Executes dropped EXE
PID:2908 -
\??\c:\hrvtpd.exec:\hrvtpd.exe58⤵
- Executes dropped EXE
PID:2972 -
\??\c:\bhtxf.exec:\bhtxf.exe59⤵
- Executes dropped EXE
PID:1912 -
\??\c:\dxntfbf.exec:\dxntfbf.exe60⤵
- Executes dropped EXE
PID:460 -
\??\c:\xxvlfdv.exec:\xxvlfdv.exe61⤵
- Executes dropped EXE
PID:2144 -
\??\c:\dpdfvp.exec:\dpdfvp.exe62⤵
- Executes dropped EXE
PID:2040 -
\??\c:\dnnpn.exec:\dnnpn.exe63⤵
- Executes dropped EXE
PID:2444 -
\??\c:\nhfdb.exec:\nhfdb.exe64⤵
- Executes dropped EXE
PID:1696 -
\??\c:\hjhpld.exec:\hjhpld.exe65⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jfxdjp.exec:\jfxdjp.exe66⤵PID:2148
-
\??\c:\htvtv.exec:\htvtv.exe67⤵PID:936
-
\??\c:\jjhfhl.exec:\jjhfhl.exe68⤵PID:2008
-
\??\c:\vfbvlh.exec:\vfbvlh.exe69⤵PID:680
-
\??\c:\dpbhpx.exec:\dpbhpx.exe70⤵PID:1124
-
\??\c:\fjrrr.exec:\fjrrr.exe71⤵PID:812
-
\??\c:\ddtdjpv.exec:\ddtdjpv.exe72⤵PID:1300
-
\??\c:\dthjlx.exec:\dthjlx.exe73⤵PID:2096
-
\??\c:\bjthb.exec:\bjthb.exe74⤵PID:1400
-
\??\c:\dxpvf.exec:\dxpvf.exe75⤵PID:540
-
\??\c:\bbxljfv.exec:\bbxljfv.exe76⤵PID:1692
-
\??\c:\ptxfjh.exec:\ptxfjh.exe77⤵PID:1860
-
\??\c:\rfhnvd.exec:\rfhnvd.exe78⤵PID:1716
-
\??\c:\hxxnhn.exec:\hxxnhn.exe79⤵PID:1048
-
\??\c:\hhrbj.exec:\hhrbj.exe80⤵PID:908
-
\??\c:\tfvxhd.exec:\tfvxhd.exe81⤵PID:2524
-
\??\c:\rbbjx.exec:\rbbjx.exe82⤵PID:1672
-
\??\c:\vxrll.exec:\vxrll.exe83⤵PID:2276
-
\??\c:\llfpf.exec:\llfpf.exe84⤵PID:1900
-
\??\c:\brrpb.exec:\brrpb.exe85⤵PID:2844
-
\??\c:\bjltf.exec:\bjltf.exe86⤵PID:2440
-
\??\c:\lvrhptb.exec:\lvrhptb.exe87⤵PID:2872
-
\??\c:\nnjbfl.exec:\nnjbfl.exe88⤵PID:2152
-
\??\c:\htpxfh.exec:\htpxfh.exe89⤵PID:2792
-
\??\c:\jrjff.exec:\jrjff.exe90⤵PID:1596
-
\??\c:\ndtnj.exec:\ndtnj.exe91⤵PID:2868
-
\??\c:\lbhrddj.exec:\lbhrddj.exe92⤵PID:3004
-
\??\c:\jnxtrv.exec:\jnxtrv.exe93⤵PID:2676
-
\??\c:\ffbtprl.exec:\ffbtprl.exe94⤵PID:2672
-
\??\c:\ljbnnd.exec:\ljbnnd.exe95⤵PID:2648
-
\??\c:\htjxt.exec:\htjxt.exe96⤵PID:2668
-
\??\c:\bhbxfl.exec:\bhbxfl.exe97⤵PID:2680
-
\??\c:\rbhvxpp.exec:\rbhvxpp.exe98⤵PID:2320
-
\??\c:\hnbttb.exec:\hnbttb.exe99⤵PID:1848
-
\??\c:\vfpxxbt.exec:\vfpxxbt.exe100⤵PID:2968
-
\??\c:\nplhr.exec:\nplhr.exe101⤵PID:2020
-
\??\c:\djpbxhn.exec:\djpbxhn.exe102⤵PID:1748
-
\??\c:\ffbfj.exec:\ffbfj.exe103⤵PID:2736
-
\??\c:\rltjnvj.exec:\rltjnvj.exe104⤵PID:2960
-
\??\c:\pvfxf.exec:\pvfxf.exe105⤵PID:2992
-
\??\c:\dtflvlj.exec:\dtflvlj.exe106⤵PID:2748
-
\??\c:\vldrxtl.exec:\vldrxtl.exe107⤵PID:808
-
\??\c:\ptljnt.exec:\ptljnt.exe108⤵PID:264
-
\??\c:\jjdpx.exec:\jjdpx.exe109⤵PID:2328
-
\??\c:\ffhthn.exec:\ffhthn.exe110⤵PID:2832
-
\??\c:\nnrlhlr.exec:\nnrlhlr.exe111⤵PID:2408
-
\??\c:\jhlpt.exec:\jhlpt.exe112⤵PID:2124
-
\??\c:\ddlrtnl.exec:\ddlrtnl.exe113⤵
- System Location Discovery: System Language Discovery
PID:2168 -
\??\c:\rtjrh.exec:\rtjrh.exe114⤵PID:1944
-
\??\c:\blblrf.exec:\blblrf.exe115⤵PID:1252
-
\??\c:\lfnlnt.exec:\lfnlnt.exe116⤵PID:1320
-
\??\c:\vljftl.exec:\vljftl.exe117⤵PID:2492
-
\??\c:\dhrrpbf.exec:\dhrrpbf.exe118⤵PID:1652
-
\??\c:\nltbnl.exec:\nltbnl.exe119⤵PID:2332
-
\??\c:\bpdpvj.exec:\bpdpvj.exe120⤵PID:812
-
\??\c:\jbhbvjb.exec:\jbhbvjb.exe121⤵PID:1300
-
\??\c:\fldbxlh.exec:\fldbxlh.exe122⤵PID:1972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-