Analysis
-
max time kernel
151s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/11/2024, 22:59
Behavioral task
behavioral1
Sample
6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe
-
Size
306KB
-
MD5
743a751909e914873f686bcc7bbbe352
-
SHA1
9f51f9f603b2aabcb04c6dfcfa6df130712e5fe3
-
SHA256
6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6
-
SHA512
d1f147d9b26c74b16d17a459c4727cca3f0bb201c25fab0d5e4ef45bad92a231f2c87e8fdfd8af8cf8b511894dff1344e2afbe4b83995c163fd3f41291af24c6
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOFltH4t+IDvSXrh5g8hZVMWhi:y4wFHoS3eFp3IDvSbh5nPVdi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2368-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1740-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1224-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/984-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1264-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1500-130-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1500-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1108-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-152-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2088-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1304-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/556-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-218-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2776-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1796-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1744-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/544-280-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2140-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/544-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/888-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2036-331-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2836-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3036-443-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1764-539-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-546-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-547-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-611-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2452-771-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/544-869-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2024-896-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3040-903-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-940-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/608-1001-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1644-1074-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1792-1125-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/760-1160-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2368 ljntb.exe 1224 vllxrn.exe 2128 jblnprl.exe 3060 vfdvvl.exe 3044 xvxjpbb.exe 2848 dnfrt.exe 2800 ndpxb.exe 2516 vhvfhn.exe 2380 ftdtxb.exe 984 vdpxdnp.exe 1264 rhhfjlj.exe 3056 lfnjb.exe 2316 vrxvbdv.exe 1500 vtvph.exe 1108 rhbndp.exe 2088 nvhnpvb.exe 1028 jvxpvh.exe 1304 xhvhlb.exe 556 rjtdv.exe 2124 bllxlj.exe 2436 nfvtjrj.exe 2200 dfldlb.exe 856 hvphlvl.exe 2776 xlfhjvv.exe 1796 ttvrhb.exe 2544 xhpfr.exe 2208 nttpfjv.exe 1744 hpthh.exe 576 hvttffh.exe 544 rvfvd.exe 2140 hnvfp.exe 888 nltht.exe 2612 vxtlrvj.exe 2364 jhnpvr.exe 1616 rrntx.exe 2184 rphbfrn.exe 2036 rjvxh.exe 2020 vbptbp.exe 2496 xltbp.exe 3060 tnbbplj.exe 2836 lbffl.exe 2920 vnlpl.exe 2828 pvfdr.exe 2872 hvflfv.exe 1552 jfdbphh.exe 1084 nlffj.exe 2260 nrpvfrn.exe 2360 rtjft.exe 1516 lfftbv.exe 2664 dbrvp.exe 1952 bbfbdl.exe 1836 hfpdrxh.exe 1324 jndppx.exe 3036 bptxbv.exe 1548 vlpplpf.exe 1028 pbdjxrl.exe 2216 vdnjvt.exe 2060 vrdxd.exe 2308 ddttnnn.exe 2456 pfdfdtd.exe 1644 lbjllr.exe 624 ldhnt.exe 680 fprnp.exe 768 hnlpbj.exe -
resource yara_rule behavioral1/memory/1740-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2368-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000012266-8.dat upx behavioral1/memory/1224-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0017000000016c92-16.dat upx behavioral1/memory/1740-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1224-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016cf0-25.dat upx behavioral1/memory/2128-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d0c-36.dat upx behavioral1/memory/3060-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000016d2c-45.dat upx behavioral1/files/0x000b000000016cab-55.dat upx behavioral1/memory/3044-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d3f-62.dat upx behavioral1/memory/2800-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0002000000018334-71.dat upx behavioral1/files/0x00050000000194ef-79.dat upx behavioral1/memory/2380-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001950f-89.dat upx behavioral1/files/0x0005000000019515-97.dat upx behavioral1/memory/984-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1264-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019547-107.dat upx behavioral1/files/0x000500000001957c-115.dat upx behavioral1/memory/2316-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2316-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a7-125.dat upx behavioral1/files/0x00050000000195a9-135.dat upx behavioral1/memory/1108-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1500-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195ab-145.dat upx behavioral1/memory/1108-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195ad-153.dat upx behavioral1/memory/2088-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195af-162.dat upx behavioral1/memory/1304-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/556-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b1-172.dat upx behavioral1/memory/556-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b3-182.dat upx behavioral1/files/0x00050000000195b5-190.dat upx behavioral1/files/0x00050000000195b7-200.dat upx behavioral1/memory/2436-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195bb-208.dat upx behavioral1/memory/2200-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195bd-217.dat upx behavioral1/memory/2776-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1796-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c1-229.dat upx behavioral1/files/0x00050000000195c3-237.dat upx behavioral1/files/0x00050000000195c5-245.dat upx behavioral1/files/0x00050000000195c6-255.dat upx behavioral1/memory/2208-254-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2208-253-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1744-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c7-264.dat upx behavioral1/files/0x000500000001960c-272.dat upx behavioral1/memory/2140-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001975a-291.dat upx behavioral1/files/0x0005000000019643-283.dat upx behavioral1/memory/544-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/888-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2612-301-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfdbvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndpxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltlnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdtvvlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtvph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfblvfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlrvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjltn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxlnfxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvhlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxtvftb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfhntj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxvnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjvdhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvjvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlfldl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtpjhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhjljdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbdjrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrnnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnljffn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxvnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdtbxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trtnt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2368 1740 6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe 30 PID 1740 wrote to memory of 2368 1740 6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe 30 PID 1740 wrote to memory of 2368 1740 6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe 30 PID 1740 wrote to memory of 2368 1740 6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe 30 PID 2368 wrote to memory of 1224 2368 ljntb.exe 31 PID 2368 wrote to memory of 1224 2368 ljntb.exe 31 PID 2368 wrote to memory of 1224 2368 ljntb.exe 31 PID 2368 wrote to memory of 1224 2368 ljntb.exe 31 PID 1224 wrote to memory of 2128 1224 vllxrn.exe 32 PID 1224 wrote to memory of 2128 1224 vllxrn.exe 32 PID 1224 wrote to memory of 2128 1224 vllxrn.exe 32 PID 1224 wrote to memory of 2128 1224 vllxrn.exe 32 PID 2128 wrote to memory of 3060 2128 jblnprl.exe 33 PID 2128 wrote to memory of 3060 2128 jblnprl.exe 33 PID 2128 wrote to memory of 3060 2128 jblnprl.exe 33 PID 2128 wrote to memory of 3060 2128 jblnprl.exe 33 PID 3060 wrote to memory of 3044 3060 vfdvvl.exe 34 PID 3060 wrote to memory of 3044 3060 vfdvvl.exe 34 PID 3060 wrote to memory of 3044 3060 vfdvvl.exe 34 PID 3060 wrote to memory of 3044 3060 vfdvvl.exe 34 PID 3044 wrote to memory of 2848 3044 xvxjpbb.exe 35 PID 3044 wrote to memory of 2848 3044 xvxjpbb.exe 35 PID 3044 wrote to memory of 2848 3044 xvxjpbb.exe 35 PID 3044 wrote to memory of 2848 3044 xvxjpbb.exe 35 PID 2848 wrote to memory of 2800 2848 dnfrt.exe 36 PID 2848 wrote to memory of 2800 2848 dnfrt.exe 36 PID 2848 wrote to memory of 2800 2848 dnfrt.exe 36 PID 2848 wrote to memory of 2800 2848 dnfrt.exe 36 PID 2800 wrote to memory of 2516 2800 ndpxb.exe 37 PID 2800 wrote to memory of 2516 2800 ndpxb.exe 37 PID 2800 wrote to memory of 2516 2800 ndpxb.exe 37 PID 2800 wrote to memory of 2516 2800 ndpxb.exe 37 PID 2516 wrote to memory of 2380 2516 vhvfhn.exe 38 PID 2516 wrote to memory of 2380 2516 vhvfhn.exe 38 PID 2516 wrote to memory of 2380 2516 vhvfhn.exe 38 PID 2516 wrote to memory of 2380 2516 vhvfhn.exe 38 PID 2380 wrote to memory of 984 2380 ftdtxb.exe 39 PID 2380 wrote to memory of 984 2380 ftdtxb.exe 39 PID 2380 wrote to memory of 984 2380 ftdtxb.exe 39 PID 2380 wrote to memory of 984 2380 ftdtxb.exe 39 PID 984 wrote to memory of 1264 984 vdpxdnp.exe 40 PID 984 wrote to memory of 1264 984 vdpxdnp.exe 40 PID 984 wrote to memory of 1264 984 vdpxdnp.exe 40 PID 984 wrote to memory of 1264 984 vdpxdnp.exe 40 PID 1264 wrote to memory of 3056 1264 rhhfjlj.exe 41 PID 1264 wrote to memory of 3056 1264 rhhfjlj.exe 41 PID 1264 wrote to memory of 3056 1264 rhhfjlj.exe 41 PID 1264 wrote to memory of 3056 1264 rhhfjlj.exe 41 PID 3056 wrote to memory of 2316 3056 lfnjb.exe 42 PID 3056 wrote to memory of 2316 3056 lfnjb.exe 42 PID 3056 wrote to memory of 2316 3056 lfnjb.exe 42 PID 3056 wrote to memory of 2316 3056 lfnjb.exe 42 PID 2316 wrote to memory of 1500 2316 vrxvbdv.exe 43 PID 2316 wrote to memory of 1500 2316 vrxvbdv.exe 43 PID 2316 wrote to memory of 1500 2316 vrxvbdv.exe 43 PID 2316 wrote to memory of 1500 2316 vrxvbdv.exe 43 PID 1500 wrote to memory of 1108 1500 vtvph.exe 44 PID 1500 wrote to memory of 1108 1500 vtvph.exe 44 PID 1500 wrote to memory of 1108 1500 vtvph.exe 44 PID 1500 wrote to memory of 1108 1500 vtvph.exe 44 PID 1108 wrote to memory of 2088 1108 rhbndp.exe 45 PID 1108 wrote to memory of 2088 1108 rhbndp.exe 45 PID 1108 wrote to memory of 2088 1108 rhbndp.exe 45 PID 1108 wrote to memory of 2088 1108 rhbndp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe"C:\Users\Admin\AppData\Local\Temp\6095f803c25f93ee9d5593d52bff7a821764bb82d98e1c56f84a792f8d5e41d6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\ljntb.exec:\ljntb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\vllxrn.exec:\vllxrn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\jblnprl.exec:\jblnprl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\vfdvvl.exec:\vfdvvl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\xvxjpbb.exec:\xvxjpbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\dnfrt.exec:\dnfrt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\ndpxb.exec:\ndpxb.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\vhvfhn.exec:\vhvfhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\ftdtxb.exec:\ftdtxb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\vdpxdnp.exec:\vdpxdnp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\rhhfjlj.exec:\rhhfjlj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\lfnjb.exec:\lfnjb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\vrxvbdv.exec:\vrxvbdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\vtvph.exec:\vtvph.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\rhbndp.exec:\rhbndp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\nvhnpvb.exec:\nvhnpvb.exe17⤵
- Executes dropped EXE
PID:2088 -
\??\c:\jvxpvh.exec:\jvxpvh.exe18⤵
- Executes dropped EXE
PID:1028 -
\??\c:\xhvhlb.exec:\xhvhlb.exe19⤵
- Executes dropped EXE
PID:1304 -
\??\c:\rjtdv.exec:\rjtdv.exe20⤵
- Executes dropped EXE
PID:556 -
\??\c:\bllxlj.exec:\bllxlj.exe21⤵
- Executes dropped EXE
PID:2124 -
\??\c:\nfvtjrj.exec:\nfvtjrj.exe22⤵
- Executes dropped EXE
PID:2436 -
\??\c:\dfldlb.exec:\dfldlb.exe23⤵
- Executes dropped EXE
PID:2200 -
\??\c:\hvphlvl.exec:\hvphlvl.exe24⤵
- Executes dropped EXE
PID:856 -
\??\c:\xlfhjvv.exec:\xlfhjvv.exe25⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ttvrhb.exec:\ttvrhb.exe26⤵
- Executes dropped EXE
PID:1796 -
\??\c:\xhpfr.exec:\xhpfr.exe27⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nttpfjv.exec:\nttpfjv.exe28⤵
- Executes dropped EXE
PID:2208 -
\??\c:\hpthh.exec:\hpthh.exe29⤵
- Executes dropped EXE
PID:1744 -
\??\c:\hvttffh.exec:\hvttffh.exe30⤵
- Executes dropped EXE
PID:576 -
\??\c:\rvfvd.exec:\rvfvd.exe31⤵
- Executes dropped EXE
PID:544 -
\??\c:\hnvfp.exec:\hnvfp.exe32⤵
- Executes dropped EXE
PID:2140 -
\??\c:\nltht.exec:\nltht.exe33⤵
- Executes dropped EXE
PID:888 -
\??\c:\vxtlrvj.exec:\vxtlrvj.exe34⤵
- Executes dropped EXE
PID:2612 -
\??\c:\jhnpvr.exec:\jhnpvr.exe35⤵
- Executes dropped EXE
PID:2364 -
\??\c:\rrntx.exec:\rrntx.exe36⤵
- Executes dropped EXE
PID:1616 -
\??\c:\rphbfrn.exec:\rphbfrn.exe37⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rjvxh.exec:\rjvxh.exe38⤵
- Executes dropped EXE
PID:2036 -
\??\c:\vbptbp.exec:\vbptbp.exe39⤵
- Executes dropped EXE
PID:2020 -
\??\c:\xltbp.exec:\xltbp.exe40⤵
- Executes dropped EXE
PID:2496 -
\??\c:\tnbbplj.exec:\tnbbplj.exe41⤵
- Executes dropped EXE
PID:3060 -
\??\c:\lbffl.exec:\lbffl.exe42⤵
- Executes dropped EXE
PID:2836 -
\??\c:\vnlpl.exec:\vnlpl.exe43⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pvfdr.exec:\pvfdr.exe44⤵
- Executes dropped EXE
PID:2828 -
\??\c:\hvflfv.exec:\hvflfv.exe45⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jfdbphh.exec:\jfdbphh.exe46⤵
- Executes dropped EXE
PID:1552 -
\??\c:\nlffj.exec:\nlffj.exe47⤵
- Executes dropped EXE
PID:1084 -
\??\c:\nrpvfrn.exec:\nrpvfrn.exe48⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rtjft.exec:\rtjft.exe49⤵
- Executes dropped EXE
PID:2360 -
\??\c:\lfftbv.exec:\lfftbv.exe50⤵
- Executes dropped EXE
PID:1516 -
\??\c:\dbrvp.exec:\dbrvp.exe51⤵
- Executes dropped EXE
PID:2664 -
\??\c:\bbfbdl.exec:\bbfbdl.exe52⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hfpdrxh.exec:\hfpdrxh.exe53⤵
- Executes dropped EXE
PID:1836 -
\??\c:\jndppx.exec:\jndppx.exe54⤵
- Executes dropped EXE
PID:1324 -
\??\c:\bptxbv.exec:\bptxbv.exe55⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vlpplpf.exec:\vlpplpf.exe56⤵
- Executes dropped EXE
PID:1548 -
\??\c:\pbdjxrl.exec:\pbdjxrl.exe57⤵
- Executes dropped EXE
PID:1028 -
\??\c:\vdnjvt.exec:\vdnjvt.exe58⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vrdxd.exec:\vrdxd.exe59⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ddttnnn.exec:\ddttnnn.exe60⤵
- Executes dropped EXE
PID:2308 -
\??\c:\pfdfdtd.exec:\pfdfdtd.exe61⤵
- Executes dropped EXE
PID:2456 -
\??\c:\lbjllr.exec:\lbjllr.exe62⤵
- Executes dropped EXE
PID:1644 -
\??\c:\ldhnt.exec:\ldhnt.exe63⤵
- Executes dropped EXE
PID:624 -
\??\c:\fprnp.exec:\fprnp.exe64⤵
- Executes dropped EXE
PID:680 -
\??\c:\hnlpbj.exec:\hnlpbj.exe65⤵
- Executes dropped EXE
PID:768 -
\??\c:\trfxf.exec:\trfxf.exe66⤵PID:1800
-
\??\c:\nbfdlh.exec:\nbfdlh.exe67⤵PID:1208
-
\??\c:\bdjvxhf.exec:\bdjvxhf.exe68⤵PID:1796
-
\??\c:\ftpnpdb.exec:\ftpnpdb.exe69⤵PID:2300
-
\??\c:\bpfhppn.exec:\bpfhppn.exe70⤵PID:1764
-
\??\c:\xtxvt.exec:\xtxvt.exe71⤵PID:2208
-
\??\c:\nhjvvd.exec:\nhjvvd.exe72⤵
- System Location Discovery: System Language Discovery
PID:2056 -
\??\c:\rxbtr.exec:\rxbtr.exe73⤵PID:952
-
\??\c:\rnbrn.exec:\rnbrn.exe74⤵PID:932
-
\??\c:\hrbnl.exec:\hrbnl.exe75⤵PID:1524
-
\??\c:\rxpnvpj.exec:\rxpnvpj.exe76⤵PID:2652
-
\??\c:\xplvr.exec:\xplvr.exe77⤵PID:1256
-
\??\c:\lnpbxt.exec:\lnpbxt.exe78⤵PID:2900
-
\??\c:\rfddt.exec:\rfddt.exe79⤵PID:2596
-
\??\c:\hppfvfx.exec:\hppfvfx.exe80⤵PID:872
-
\??\c:\txntnbb.exec:\txntnbb.exe81⤵PID:2420
-
\??\c:\dpdxpj.exec:\dpdxpj.exe82⤵PID:2160
-
\??\c:\vfnfd.exec:\vfnfd.exe83⤵PID:2816
-
\??\c:\hrxrphv.exec:\hrxrphv.exe84⤵PID:2152
-
\??\c:\dbhjphr.exec:\dbhjphr.exe85⤵PID:1592
-
\??\c:\vrxjjf.exec:\vrxjjf.exe86⤵PID:2016
-
\??\c:\nnvlfl.exec:\nnvlfl.exe87⤵PID:2848
-
\??\c:\xptjt.exec:\xptjt.exe88⤵PID:2564
-
\??\c:\rnnln.exec:\rnnln.exe89⤵PID:2484
-
\??\c:\jfhlrf.exec:\jfhlrf.exe90⤵PID:2872
-
\??\c:\tplrrpp.exec:\tplrrpp.exe91⤵PID:3004
-
\??\c:\rxdvflv.exec:\rxdvflv.exe92⤵PID:1084
-
\??\c:\vlxhhj.exec:\vlxhhj.exe93⤵PID:2260
-
\??\c:\ldphnd.exec:\ldphnd.exe94⤵PID:1264
-
\??\c:\dvhphrb.exec:\dvhphrb.exe95⤵PID:1436
-
\??\c:\bfjjdr.exec:\bfjjdr.exe96⤵PID:1660
-
\??\c:\rtpnhf.exec:\rtpnhf.exe97⤵PID:2344
-
\??\c:\ljjtd.exec:\ljjtd.exe98⤵PID:452
-
\??\c:\phjbv.exec:\phjbv.exe99⤵PID:2356
-
\??\c:\nhvtlxx.exec:\nhvtlxx.exe100⤵PID:2524
-
\??\c:\npfhppf.exec:\npfhppf.exe101⤵PID:1348
-
\??\c:\rthrjl.exec:\rthrjl.exe102⤵PID:1760
-
\??\c:\njfbb.exec:\njfbb.exe103⤵PID:2052
-
\??\c:\djlvbfj.exec:\djlvbfj.exe104⤵PID:520
-
\??\c:\txrnhv.exec:\txrnhv.exe105⤵PID:2476
-
\??\c:\btdnrh.exec:\btdnrh.exe106⤵PID:2428
-
\??\c:\bffrtnh.exec:\bffrtnh.exe107⤵PID:2452
-
\??\c:\tflpl.exec:\tflpl.exe108⤵PID:1992
-
\??\c:\blrlh.exec:\blrlh.exe109⤵PID:820
-
\??\c:\fnljffn.exec:\fnljffn.exe110⤵
- System Location Discovery: System Language Discovery
PID:2148 -
\??\c:\vnfdlx.exec:\vnfdlx.exe111⤵PID:2776
-
\??\c:\vvbnht.exec:\vvbnht.exe112⤵PID:960
-
\??\c:\njlrfx.exec:\njlrfx.exe113⤵PID:1972
-
\??\c:\vljnv.exec:\vljnv.exe114⤵PID:2544
-
\??\c:\nrnpnnp.exec:\nrnpnnp.exe115⤵PID:1308
-
\??\c:\dhvnxf.exec:\dhvnxf.exe116⤵PID:632
-
\??\c:\pvbnlh.exec:\pvbnlh.exe117⤵PID:1512
-
\??\c:\bhfxhj.exec:\bhfxhj.exe118⤵PID:2588
-
\??\c:\vllhlx.exec:\vllhlx.exe119⤵PID:544
-
\??\c:\rvlrn.exec:\rvlrn.exe120⤵PID:2624
-
\??\c:\xlnnh.exec:\xlnnh.exe121⤵PID:2044
-
\??\c:\vpjtfvp.exec:\vpjtfvp.exe122⤵PID:760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-