Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 19:23
Static task
static1
Behavioral task
behavioral1
Sample
07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe
Resource
win7-20241010-en
General
-
Target
07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe
-
Size
454KB
-
MD5
9bdb9371d4f5c81e0ef03e158e84187a
-
SHA1
141c1d690291866191ac63c41781e05f2c9c5b8e
-
SHA256
07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd
-
SHA512
0d245da98d0686a80f3b988a64b56828bf7bb164c2e6ec3ea025affa7fdeb7b148f7964eb3ab8bc77896d419bece48d37e470fc67fea749b9c0a396743c57121
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbecr:q7Tc2NYHUrAwfMp3CDm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/2888-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-36-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2956-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-116-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2356-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-188-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1784-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-555-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2436-568-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1048-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-807-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rvpbxf.exedlnxbpf.exedvthb.exerjhlx.exetvtdh.exehtrdr.exedhnrr.exexjtrhrf.exepbvvt.exebhvnlrv.exedxfpd.exerbrxd.exedvrrdph.exelhnlpp.exepdhrpn.exedhbphv.exehpnxx.exetbxpvxp.exevhjxpb.exeplfftp.exetbpvf.exerhhvb.exenlvhv.exehxphl.exevbjvfrn.exeljnvbjx.exerxrlxx.exepfxvd.exetvxbxx.exefxfjfv.exehhxxdd.exetxfbxpv.exefhtxn.exevdxhxj.exevvdpbp.exerjjjht.exerbnlpbh.exerpvhp.exedtxll.exexfrjd.exepdlffp.exexhbnr.exefrvlrdh.exedhhpd.exeljxrdhj.exebphxrx.exehxnvhd.exeprnvpvh.exedbtxvx.exehxfdb.exerlvlr.exehfhnffb.exehvndrnt.exehtpxh.exevbnllfv.exevtpljr.exenvvvfn.exenrfrnph.exedhfjhbl.exehldnb.exentxbd.exefvxtpx.exenbhrtl.exehpdnr.exepid Process 2952 rvpbxf.exe 2800 dlnxbpf.exe 2956 dvthb.exe 2172 rjhlx.exe 2732 tvtdh.exe 2208 htrdr.exe 2004 dhnrr.exe 2424 xjtrhrf.exe 2844 pbvvt.exe 2164 bhvnlrv.exe 2132 dxfpd.exe 2356 rbrxd.exe 2324 dvrrdph.exe 3004 lhnlpp.exe 2632 pdhrpn.exe 916 dhbphv.exe 332 hpnxx.exe 1512 tbxpvxp.exe 2064 vhjxpb.exe 2284 plfftp.exe 1784 tbpvf.exe 1868 rhhvb.exe 912 nlvhv.exe 1960 hxphl.exe 1352 vbjvfrn.exe 2008 ljnvbjx.exe 1728 rxrlxx.exe 1288 pfxvd.exe 3024 tvxbxx.exe 680 fxfjfv.exe 2492 hhxxdd.exe 884 txfbxpv.exe 2508 fhtxn.exe 2824 vdxhxj.exe 1612 vvdpbp.exe 2776 rjjjht.exe 2700 rbnlpbh.exe 2500 rpvhp.exe 1240 dtxll.exe 2804 xfrjd.exe 2904 pdlffp.exe 876 xhbnr.exe 2024 frvlrdh.exe 1132 dhhpd.exe 952 ljxrdhj.exe 2480 bphxrx.exe 2472 hxnvhd.exe 1304 prnvpvh.exe 2132 dbtxvx.exe 2300 hxfdb.exe 2980 rlvlr.exe 2764 hfhnffb.exe 2252 hvndrnt.exe 716 htpxh.exe 1104 vbnllfv.exe 1932 vtpljr.exe 1316 nvvvfn.exe 2504 nrfrnph.exe 2428 dhfjhbl.exe 2056 hldnb.exe 1096 ntxbd.exe 2096 fvxtpx.exe 976 nbhrtl.exe 1568 hpdnr.exe -
Processes:
resource yara_rule behavioral1/memory/2888-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/716-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-568-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1048-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-740-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-759-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-800-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
frpxdjp.exebdfdf.exevnjhxf.exerjjvnbd.exehxphl.exehvddbtx.exexlhxtfj.exejtxrn.exejphjn.exedndfn.exefhdbprx.exebphxrx.exetjtxxjl.exethbjjv.exevrvtrp.exehldjppb.exejlhvtrn.exejljtnv.exerbnlpbh.exerrdhfp.exehrdvn.exehnlnhvh.exenjbvpdh.exehvvhxt.exehhlhv.exetvxxh.exebrvlx.exejhhld.exepxdvp.exetvndnf.exeldphn.exejhjffdd.exepbjhfrr.exetfvvrvx.exerjhjj.exebjfbt.exehltnbl.exertrjplv.exevldxfxr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frpxdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdfdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnjhxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjjvnbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxphl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvddbtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlhxtfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtxrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jphjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dndfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhdbprx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bphxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjtxxjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrvtrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hldjppb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlhvtrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jljtnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbnlpbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrdhfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrdvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnlnhvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njbvpdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvvhxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhlhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvxxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brvlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhhld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvndnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldphn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhjffdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbjhfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfvvrvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjhjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjfbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hltnbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtrjplv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vldxfxr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exervpbxf.exedlnxbpf.exedvthb.exerjhlx.exetvtdh.exehtrdr.exedhnrr.exexjtrhrf.exepbvvt.exebhvnlrv.exedxfpd.exerbrxd.exedvrrdph.exelhnlpp.exepdhrpn.exedescription pid Process procid_target PID 2888 wrote to memory of 2952 2888 07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe 30 PID 2888 wrote to memory of 2952 2888 07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe 30 PID 2888 wrote to memory of 2952 2888 07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe 30 PID 2888 wrote to memory of 2952 2888 07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe 30 PID 2952 wrote to memory of 2800 2952 rvpbxf.exe 31 PID 2952 wrote to memory of 2800 2952 rvpbxf.exe 31 PID 2952 wrote to memory of 2800 2952 rvpbxf.exe 31 PID 2952 wrote to memory of 2800 2952 rvpbxf.exe 31 PID 2800 wrote to memory of 2956 2800 dlnxbpf.exe 32 PID 2800 wrote to memory of 2956 2800 dlnxbpf.exe 32 PID 2800 wrote to memory of 2956 2800 dlnxbpf.exe 32 PID 2800 wrote to memory of 2956 2800 dlnxbpf.exe 32 PID 2956 wrote to memory of 2172 2956 dvthb.exe 33 PID 2956 wrote to memory of 2172 2956 dvthb.exe 33 PID 2956 wrote to memory of 2172 2956 dvthb.exe 33 PID 2956 wrote to memory of 2172 2956 dvthb.exe 33 PID 2172 wrote to memory of 2732 2172 rjhlx.exe 34 PID 2172 wrote to memory of 2732 2172 rjhlx.exe 34 PID 2172 wrote to memory of 2732 2172 rjhlx.exe 34 PID 2172 wrote to memory of 2732 2172 rjhlx.exe 34 PID 2732 wrote to memory of 2208 2732 tvtdh.exe 35 PID 2732 wrote to memory of 2208 2732 tvtdh.exe 35 PID 2732 wrote to memory of 2208 2732 tvtdh.exe 35 PID 2732 wrote to memory of 2208 2732 tvtdh.exe 35 PID 2208 wrote to memory of 2004 2208 htrdr.exe 36 PID 2208 wrote to memory of 2004 2208 htrdr.exe 36 PID 2208 wrote to memory of 2004 2208 htrdr.exe 36 PID 2208 wrote to memory of 2004 2208 htrdr.exe 36 PID 2004 wrote to memory of 2424 2004 dhnrr.exe 37 PID 2004 wrote to memory of 2424 2004 dhnrr.exe 37 PID 2004 wrote to memory of 2424 2004 dhnrr.exe 37 PID 2004 wrote to memory of 2424 2004 dhnrr.exe 37 PID 2424 wrote to memory of 2844 2424 xjtrhrf.exe 38 PID 2424 wrote to memory of 2844 2424 xjtrhrf.exe 38 PID 2424 wrote to memory of 2844 2424 xjtrhrf.exe 38 PID 2424 wrote to memory of 2844 2424 xjtrhrf.exe 38 PID 2844 wrote to memory of 2164 2844 pbvvt.exe 39 PID 2844 wrote to memory of 2164 2844 pbvvt.exe 39 PID 2844 wrote to memory of 2164 2844 pbvvt.exe 39 PID 2844 wrote to memory of 2164 2844 pbvvt.exe 39 PID 2164 wrote to memory of 2132 2164 bhvnlrv.exe 40 PID 2164 wrote to memory of 2132 2164 bhvnlrv.exe 40 PID 2164 wrote to memory of 2132 2164 bhvnlrv.exe 40 PID 2164 wrote to memory of 2132 2164 bhvnlrv.exe 40 PID 2132 wrote to memory of 2356 2132 dxfpd.exe 41 PID 2132 wrote to memory of 2356 2132 dxfpd.exe 41 PID 2132 wrote to memory of 2356 2132 dxfpd.exe 41 PID 2132 wrote to memory of 2356 2132 dxfpd.exe 41 PID 2356 wrote to memory of 2324 2356 rbrxd.exe 42 PID 2356 wrote to memory of 2324 2356 rbrxd.exe 42 PID 2356 wrote to memory of 2324 2356 rbrxd.exe 42 PID 2356 wrote to memory of 2324 2356 rbrxd.exe 42 PID 2324 wrote to memory of 3004 2324 dvrrdph.exe 43 PID 2324 wrote to memory of 3004 2324 dvrrdph.exe 43 PID 2324 wrote to memory of 3004 2324 dvrrdph.exe 43 PID 2324 wrote to memory of 3004 2324 dvrrdph.exe 43 PID 3004 wrote to memory of 2632 3004 lhnlpp.exe 44 PID 3004 wrote to memory of 2632 3004 lhnlpp.exe 44 PID 3004 wrote to memory of 2632 3004 lhnlpp.exe 44 PID 3004 wrote to memory of 2632 3004 lhnlpp.exe 44 PID 2632 wrote to memory of 916 2632 pdhrpn.exe 45 PID 2632 wrote to memory of 916 2632 pdhrpn.exe 45 PID 2632 wrote to memory of 916 2632 pdhrpn.exe 45 PID 2632 wrote to memory of 916 2632 pdhrpn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe"C:\Users\Admin\AppData\Local\Temp\07bde9f23ecbe291e0a6ecd5b43f7fbd34088f99cad95eb6a38480537fffe2cd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\rvpbxf.exec:\rvpbxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\dlnxbpf.exec:\dlnxbpf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\dvthb.exec:\dvthb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\rjhlx.exec:\rjhlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\tvtdh.exec:\tvtdh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\htrdr.exec:\htrdr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\dhnrr.exec:\dhnrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\xjtrhrf.exec:\xjtrhrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\pbvvt.exec:\pbvvt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\bhvnlrv.exec:\bhvnlrv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\dxfpd.exec:\dxfpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\rbrxd.exec:\rbrxd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\dvrrdph.exec:\dvrrdph.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\lhnlpp.exec:\lhnlpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\pdhrpn.exec:\pdhrpn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\dhbphv.exec:\dhbphv.exe17⤵
- Executes dropped EXE
PID:916 -
\??\c:\hpnxx.exec:\hpnxx.exe18⤵
- Executes dropped EXE
PID:332 -
\??\c:\tbxpvxp.exec:\tbxpvxp.exe19⤵
- Executes dropped EXE
PID:1512 -
\??\c:\vhjxpb.exec:\vhjxpb.exe20⤵
- Executes dropped EXE
PID:2064 -
\??\c:\plfftp.exec:\plfftp.exe21⤵
- Executes dropped EXE
PID:2284 -
\??\c:\tbpvf.exec:\tbpvf.exe22⤵
- Executes dropped EXE
PID:1784 -
\??\c:\rhhvb.exec:\rhhvb.exe23⤵
- Executes dropped EXE
PID:1868 -
\??\c:\nlvhv.exec:\nlvhv.exe24⤵
- Executes dropped EXE
PID:912 -
\??\c:\hxphl.exec:\hxphl.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1960 -
\??\c:\vbjvfrn.exec:\vbjvfrn.exe26⤵
- Executes dropped EXE
PID:1352 -
\??\c:\ljnvbjx.exec:\ljnvbjx.exe27⤵
- Executes dropped EXE
PID:2008 -
\??\c:\rxrlxx.exec:\rxrlxx.exe28⤵
- Executes dropped EXE
PID:1728 -
\??\c:\pfxvd.exec:\pfxvd.exe29⤵
- Executes dropped EXE
PID:1288 -
\??\c:\tvxbxx.exec:\tvxbxx.exe30⤵
- Executes dropped EXE
PID:3024 -
\??\c:\fxfjfv.exec:\fxfjfv.exe31⤵
- Executes dropped EXE
PID:680 -
\??\c:\hhxxdd.exec:\hhxxdd.exe32⤵
- Executes dropped EXE
PID:2492 -
\??\c:\txfbxpv.exec:\txfbxpv.exe33⤵
- Executes dropped EXE
PID:884 -
\??\c:\fhtxn.exec:\fhtxn.exe34⤵
- Executes dropped EXE
PID:2508 -
\??\c:\vdxhxj.exec:\vdxhxj.exe35⤵
- Executes dropped EXE
PID:2824 -
\??\c:\vvdpbp.exec:\vvdpbp.exe36⤵
- Executes dropped EXE
PID:1612 -
\??\c:\rjjjht.exec:\rjjjht.exe37⤵
- Executes dropped EXE
PID:2776 -
\??\c:\rbnlpbh.exec:\rbnlpbh.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2700 -
\??\c:\rpvhp.exec:\rpvhp.exe39⤵
- Executes dropped EXE
PID:2500 -
\??\c:\dtxll.exec:\dtxll.exe40⤵
- Executes dropped EXE
PID:1240 -
\??\c:\xfrjd.exec:\xfrjd.exe41⤵
- Executes dropped EXE
PID:2804 -
\??\c:\pdlffp.exec:\pdlffp.exe42⤵
- Executes dropped EXE
PID:2904 -
\??\c:\xhbnr.exec:\xhbnr.exe43⤵
- Executes dropped EXE
PID:876 -
\??\c:\frvlrdh.exec:\frvlrdh.exe44⤵
- Executes dropped EXE
PID:2024 -
\??\c:\dhhpd.exec:\dhhpd.exe45⤵
- Executes dropped EXE
PID:1132 -
\??\c:\ljxrdhj.exec:\ljxrdhj.exe46⤵
- Executes dropped EXE
PID:952 -
\??\c:\bphxrx.exec:\bphxrx.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2480 -
\??\c:\hxnvhd.exec:\hxnvhd.exe48⤵
- Executes dropped EXE
PID:2472 -
\??\c:\prnvpvh.exec:\prnvpvh.exe49⤵
- Executes dropped EXE
PID:1304 -
\??\c:\dbtxvx.exec:\dbtxvx.exe50⤵
- Executes dropped EXE
PID:2132 -
\??\c:\hxfdb.exec:\hxfdb.exe51⤵
- Executes dropped EXE
PID:2300 -
\??\c:\rlvlr.exec:\rlvlr.exe52⤵
- Executes dropped EXE
PID:2980 -
\??\c:\hfhnffb.exec:\hfhnffb.exe53⤵
- Executes dropped EXE
PID:2764 -
\??\c:\hvndrnt.exec:\hvndrnt.exe54⤵
- Executes dropped EXE
PID:2252 -
\??\c:\htpxh.exec:\htpxh.exe55⤵
- Executes dropped EXE
PID:716 -
\??\c:\vbnllfv.exec:\vbnllfv.exe56⤵
- Executes dropped EXE
PID:1104 -
\??\c:\vtpljr.exec:\vtpljr.exe57⤵
- Executes dropped EXE
PID:1932 -
\??\c:\nvvvfn.exec:\nvvvfn.exe58⤵
- Executes dropped EXE
PID:1316 -
\??\c:\nrfrnph.exec:\nrfrnph.exe59⤵
- Executes dropped EXE
PID:2504 -
\??\c:\dhfjhbl.exec:\dhfjhbl.exe60⤵
- Executes dropped EXE
PID:2428 -
\??\c:\hldnb.exec:\hldnb.exe61⤵
- Executes dropped EXE
PID:2056 -
\??\c:\ntxbd.exec:\ntxbd.exe62⤵
- Executes dropped EXE
PID:1096 -
\??\c:\fvxtpx.exec:\fvxtpx.exe63⤵
- Executes dropped EXE
PID:2096 -
\??\c:\nbhrtl.exec:\nbhrtl.exe64⤵
- Executes dropped EXE
PID:976 -
\??\c:\hpdnr.exec:\hpdnr.exe65⤵
- Executes dropped EXE
PID:1568 -
\??\c:\lthhnp.exec:\lthhnp.exe66⤵PID:1960
-
\??\c:\dltvhb.exec:\dltvhb.exe67⤵PID:2204
-
\??\c:\ttvrdn.exec:\ttvrdn.exe68⤵PID:2328
-
\??\c:\xxlpr.exec:\xxlpr.exe69⤵PID:1684
-
\??\c:\bjrfvrr.exec:\bjrfvrr.exe70⤵PID:1632
-
\??\c:\jvhpjjh.exec:\jvhpjjh.exe71⤵PID:1812
-
\??\c:\jljbtr.exec:\jljbtr.exe72⤵PID:2436
-
\??\c:\pbjhfrr.exec:\pbjhfrr.exe73⤵
- System Location Discovery: System Language Discovery
PID:1048 -
\??\c:\ntrnfx.exec:\ntrnfx.exe74⤵PID:1040
-
\??\c:\tndtpxr.exec:\tndtpxr.exe75⤵PID:1828
-
\??\c:\vhfnbrd.exec:\vhfnbrd.exe76⤵PID:2948
-
\??\c:\fdtbpb.exec:\fdtbpb.exe77⤵PID:2508
-
\??\c:\pjtvjvp.exec:\pjtvjvp.exe78⤵PID:2088
-
\??\c:\nhndth.exec:\nhndth.exe79⤵PID:1612
-
\??\c:\vbtpnh.exec:\vbtpnh.exe80⤵PID:788
-
\??\c:\tvndnf.exec:\tvndnf.exe81⤵
- System Location Discovery: System Language Discovery
PID:2944 -
\??\c:\hjbnt.exec:\hjbnt.exe82⤵PID:2864
-
\??\c:\jrlhbrd.exec:\jrlhbrd.exe83⤵PID:2712
-
\??\c:\tfxrvd.exec:\tfxrvd.exe84⤵PID:2732
-
\??\c:\bntpxnl.exec:\bntpxnl.exe85⤵PID:2148
-
\??\c:\bvhhf.exec:\bvhhf.exe86⤵PID:2000
-
\??\c:\lpbxrdn.exec:\lpbxrdn.exe87⤵PID:1324
-
\??\c:\dxdlpl.exec:\dxdlpl.exe88⤵PID:1060
-
\??\c:\jfvlf.exec:\jfvlf.exe89⤵PID:2528
-
\??\c:\xpjvbl.exec:\xpjvbl.exe90⤵PID:600
-
\??\c:\tnpnh.exec:\tnpnh.exe91⤵PID:2352
-
\??\c:\ffprx.exec:\ffprx.exe92⤵PID:1584
-
\??\c:\dfxln.exec:\dfxln.exe93⤵PID:2400
-
\??\c:\tjvxx.exec:\tjvxx.exe94⤵PID:2996
-
\??\c:\rxrnl.exec:\rxrnl.exe95⤵PID:2260
-
\??\c:\bjfbt.exec:\bjfbt.exe96⤵
- System Location Discovery: System Language Discovery
PID:2448 -
\??\c:\xnfrv.exec:\xnfrv.exe97⤵PID:3068
-
\??\c:\bnhnpv.exec:\bnhnpv.exe98⤵PID:2252
-
\??\c:\hlllvvl.exec:\hlllvvl.exe99⤵PID:916
-
\??\c:\jbhvlxp.exec:\jbhvlxp.exe100⤵PID:2460
-
\??\c:\rnffnd.exec:\rnffnd.exe101⤵PID:1148
-
\??\c:\pxvjlx.exec:\pxvjlx.exe102⤵PID:2380
-
\??\c:\nbxlplx.exec:\nbxlplx.exe103⤵PID:2504
-
\??\c:\dvftbx.exec:\dvftbx.exe104⤵PID:1360
-
\??\c:\tdflh.exec:\tdflh.exe105⤵PID:2284
-
\??\c:\lfxtd.exec:\lfxtd.exe106⤵PID:1848
-
\??\c:\plhjn.exec:\plhjn.exe107⤵PID:2096
-
\??\c:\fvbvbj.exec:\fvbvbj.exe108⤵PID:564
-
\??\c:\fpjxjnn.exec:\fpjxjnn.exe109⤵PID:1568
-
\??\c:\hrlrj.exec:\hrlrj.exe110⤵PID:1776
-
\??\c:\xbdhp.exec:\xbdhp.exe111⤵PID:2008
-
\??\c:\tddrt.exec:\tddrt.exe112⤵PID:2244
-
\??\c:\fftxdlh.exec:\fftxdlh.exe113⤵PID:900
-
\??\c:\dnxvp.exec:\dnxvp.exe114⤵PID:2364
-
\??\c:\nxtvdpj.exec:\nxtvdpj.exe115⤵PID:1288
-
\??\c:\hbvlrx.exec:\hbvlrx.exe116⤵PID:2436
-
\??\c:\jphjn.exec:\jphjn.exe117⤵
- System Location Discovery: System Language Discovery
PID:1564 -
\??\c:\txhxxdn.exec:\txhxxdn.exe118⤵PID:2140
-
\??\c:\rrtlr.exec:\rrtlr.exe119⤵PID:2792
-
\??\c:\vfnlnrp.exec:\vfnlnrp.exe120⤵PID:1604
-
\??\c:\rvdbtlt.exec:\rvdbtlt.exe121⤵PID:2508
-
\??\c:\ttpldh.exec:\ttpldh.exe122⤵PID:2796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-