Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/11/2024, 05:05
Behavioral task
behavioral1
Sample
86731cd5a98fec9a8932f54f116f528e225b82597bf7a787aaeeef6f1e553539N.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
86731cd5a98fec9a8932f54f116f528e225b82597bf7a787aaeeef6f1e553539N.exe
-
Size
90KB
-
MD5
7c91480a9e4740e4be8b02ae03cca360
-
SHA1
c934634f916c44cf4176bb66557e505d0034a0cc
-
SHA256
86731cd5a98fec9a8932f54f116f528e225b82597bf7a787aaeeef6f1e553539
-
SHA512
a28ccafa97f2cd484cb8befcc834b121c5e3f431f339b2368466fd5a6a381354d074bc396e65acbe54da5e5d4314f6d4d7c4af329dfeac7bedac693732f43ae6
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8yaVskCzYBbKd+XsWgADUOj2YUW+S436CA:9hOmTsF93UYfwC6GIoutyaVszyKd+XY+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2236-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2384-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-36-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2236-35-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2848-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-89-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2632-92-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2632-91-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2708-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2012-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/588-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1860-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/936-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-306-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2248-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1664-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1376-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-412-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1016-425-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1748-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-433-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1924-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1780-472-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1628-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-525-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-544-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1276-613-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-651-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-657-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2768-666-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1348-687-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-694-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1788-708-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1020-740-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/336-748-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-921-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-928-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2216-974-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-1005-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2384 fvxfnn.exe 2544 bbddtbj.exe 2816 xlndpbv.exe 2100 vfxnpv.exe 2856 bvjjfp.exe 2836 rpnhrft.exe 2848 jnvpn.exe 2768 bjdddbl.exe 2632 rbptl.exe 2708 hftlnbd.exe 2212 dvxnnh.exe 2980 hdjdp.exe 1924 pbbxxbj.exe 2012 lxrrrv.exe 1644 jvxttpn.exe 1020 bpdvphb.exe 2700 ppvpnj.exe 1968 ddjpfdl.exe 2500 tdhrn.exe 2328 hnfvh.exe 2340 dljfbd.exe 2084 vpdvddh.exe 1736 tfrfh.exe 588 rttrr.exe 1860 vnhxdh.exe 2120 btvpxv.exe 1892 dfdvb.exe 936 rjjtbd.exe 1612 fhlbjff.exe 2292 hdtrlhf.exe 1148 pnldd.exe 888 hjbjrj.exe 2248 lltjvbv.exe 2540 ljpjhd.exe 2592 tdjhtnt.exe 2372 tnffht.exe 1576 rnfphj.exe 276 ffpbtbh.exe 1664 vjhhtb.exe 2772 nthbxjp.exe 2764 nrbxh.exe 2660 rpbnt.exe 2916 tnbjfl.exe 2992 lppjb.exe 2628 xpbvjb.exe 2676 ddjbfj.exe 648 nhfxfxp.exe 1376 hlrhlt.exe 1696 xrdddx.exe 1800 llpbv.exe 1016 lfvnp.exe 1748 jvtdd.exe 1924 btxrr.exe 2000 fjbfl.exe 2608 flffhp.exe 2684 lfhhdx.exe 1932 xtvpnh.exe 1780 pbfnfj.exe 1952 lpthrjn.exe 1628 nfnttxd.exe 432 lnxxt.exe 1916 txrxxxh.exe 3048 btlpf.exe 912 hdhlrp.exe -
resource yara_rule behavioral1/memory/2236-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000012263-5.dat upx behavioral1/memory/2236-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000186b7-17.dat upx behavioral1/memory/2384-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2544-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000186c3-27.dat upx behavioral1/memory/2816-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b28-38.dat upx behavioral1/memory/2100-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b54-56.dat upx behavioral1/files/0x0009000000018b59-64.dat upx behavioral1/memory/2848-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2836-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b50-47.dat upx behavioral1/files/0x0008000000018b64-74.dat upx behavioral1/files/0x0006000000019489-82.dat upx behavioral1/memory/2768-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019643-95.dat upx behavioral1/memory/2708-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2708-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001975a-104.dat upx behavioral1/files/0x0005000000019761-110.dat upx behavioral1/memory/2212-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2980-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000197fd-122.dat upx behavioral1/memory/2980-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2012-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019820-134.dat upx behavioral1/memory/2012-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001998d-142.dat upx behavioral1/files/0x00150000000170f8-151.dat upx behavioral1/files/0x0005000000019bf5-159.dat upx behavioral1/files/0x0005000000019bf6-166.dat upx behavioral1/memory/1968-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2700-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf9-180.dat upx behavioral1/memory/1968-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d61-196.dat upx behavioral1/files/0x0005000000019c3c-189.dat upx behavioral1/memory/2328-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d62-206.dat upx behavioral1/files/0x0005000000019d6d-213.dat upx behavioral1/memory/1736-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019e92-222.dat upx behavioral1/files/0x0005000000019fd4-232.dat upx behavioral1/memory/588-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1736-223-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1860-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019fdd-242.dat upx behavioral1/files/0x000500000001a03c-249.dat upx behavioral1/files/0x000500000001a049-257.dat upx behavioral1/files/0x000500000001a0b6-266.dat upx behavioral1/memory/936-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a309-276.dat upx behavioral1/memory/1612-275-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a3ab-283.dat upx behavioral1/files/0x000500000001a3f6-292.dat upx behavioral1/memory/2248-306-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2248-307-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2592-314-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1664-339-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2372-348-0x00000000001C0000-0x00000000001E7000-memory.dmp upx behavioral1/memory/2772-347-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjhhdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pptnhjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfvdvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hblfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbbvlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtdhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txjprft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fthlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjtnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drxrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpblfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhhbxjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvrbpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llpbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thrxbtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpdvphb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhxdhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdfhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvblh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfjbxhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjjhbbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllrdht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpphbtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njptxnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjddxbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvfvvvb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2384 2236 86731cd5a98fec9a8932f54f116f528e225b82597bf7a787aaeeef6f1e553539N.exe 29 PID 2236 wrote to memory of 2384 2236 86731cd5a98fec9a8932f54f116f528e225b82597bf7a787aaeeef6f1e553539N.exe 29 PID 2236 wrote to memory of 2384 2236 86731cd5a98fec9a8932f54f116f528e225b82597bf7a787aaeeef6f1e553539N.exe 29 PID 2236 wrote to memory of 2384 2236 86731cd5a98fec9a8932f54f116f528e225b82597bf7a787aaeeef6f1e553539N.exe 29 PID 2384 wrote to memory of 2544 2384 fvxfnn.exe 30 PID 2384 wrote to memory of 2544 2384 fvxfnn.exe 30 PID 2384 wrote to memory of 2544 2384 fvxfnn.exe 30 PID 2384 wrote to memory of 2544 2384 fvxfnn.exe 30 PID 2544 wrote to memory of 2816 2544 bbddtbj.exe 31 PID 2544 wrote to memory of 2816 2544 bbddtbj.exe 31 PID 2544 wrote to memory of 2816 2544 bbddtbj.exe 31 PID 2544 wrote to memory of 2816 2544 bbddtbj.exe 31 PID 2816 wrote to memory of 2100 2816 xlndpbv.exe 32 PID 2816 wrote to memory of 2100 2816 xlndpbv.exe 32 PID 2816 wrote to memory of 2100 2816 xlndpbv.exe 32 PID 2816 wrote to memory of 2100 2816 xlndpbv.exe 32 PID 2100 wrote to memory of 2856 2100 vfxnpv.exe 33 PID 2100 wrote to memory of 2856 2100 vfxnpv.exe 33 PID 2100 wrote to memory of 2856 2100 vfxnpv.exe 33 PID 2100 wrote to memory of 2856 2100 vfxnpv.exe 33 PID 2856 wrote to memory of 2836 2856 bvjjfp.exe 34 PID 2856 wrote to memory of 2836 2856 bvjjfp.exe 34 PID 2856 wrote to memory of 2836 2856 bvjjfp.exe 34 PID 2856 wrote to memory of 2836 2856 bvjjfp.exe 34 PID 2836 wrote to memory of 2848 2836 rpnhrft.exe 35 PID 2836 wrote to memory of 2848 2836 rpnhrft.exe 35 PID 2836 wrote to memory of 2848 2836 rpnhrft.exe 35 PID 2836 wrote to memory of 2848 2836 rpnhrft.exe 35 PID 2848 wrote to memory of 2768 2848 jnvpn.exe 36 PID 2848 wrote to memory of 2768 2848 jnvpn.exe 36 PID 2848 wrote to memory of 2768 2848 jnvpn.exe 36 PID 2848 wrote to memory of 2768 2848 jnvpn.exe 36 PID 2768 wrote to memory of 2632 2768 bjdddbl.exe 37 PID 2768 wrote to memory of 2632 2768 bjdddbl.exe 37 PID 2768 wrote to memory of 2632 2768 bjdddbl.exe 37 PID 2768 wrote to memory of 2632 2768 bjdddbl.exe 37 PID 2632 wrote to memory of 2708 2632 rbptl.exe 38 PID 2632 wrote to memory of 2708 2632 rbptl.exe 38 PID 2632 wrote to memory of 2708 2632 rbptl.exe 38 PID 2632 wrote to memory of 2708 2632 rbptl.exe 38 PID 2708 wrote to memory of 2212 2708 hftlnbd.exe 39 PID 2708 wrote to memory of 2212 2708 hftlnbd.exe 39 PID 2708 wrote to memory of 2212 2708 hftlnbd.exe 39 PID 2708 wrote to memory of 2212 2708 hftlnbd.exe 39 PID 2212 wrote to memory of 2980 2212 dvxnnh.exe 40 PID 2212 wrote to memory of 2980 2212 dvxnnh.exe 40 PID 2212 wrote to memory of 2980 2212 dvxnnh.exe 40 PID 2212 wrote to memory of 2980 2212 dvxnnh.exe 40 PID 2980 wrote to memory of 1924 2980 hdjdp.exe 41 PID 2980 wrote to memory of 1924 2980 hdjdp.exe 41 PID 2980 wrote to memory of 1924 2980 hdjdp.exe 41 PID 2980 wrote to memory of 1924 2980 hdjdp.exe 41 PID 1924 wrote to memory of 2012 1924 pbbxxbj.exe 42 PID 1924 wrote to memory of 2012 1924 pbbxxbj.exe 42 PID 1924 wrote to memory of 2012 1924 pbbxxbj.exe 42 PID 1924 wrote to memory of 2012 1924 pbbxxbj.exe 42 PID 2012 wrote to memory of 1644 2012 lxrrrv.exe 43 PID 2012 wrote to memory of 1644 2012 lxrrrv.exe 43 PID 2012 wrote to memory of 1644 2012 lxrrrv.exe 43 PID 2012 wrote to memory of 1644 2012 lxrrrv.exe 43 PID 1644 wrote to memory of 1020 1644 jvxttpn.exe 44 PID 1644 wrote to memory of 1020 1644 jvxttpn.exe 44 PID 1644 wrote to memory of 1020 1644 jvxttpn.exe 44 PID 1644 wrote to memory of 1020 1644 jvxttpn.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\86731cd5a98fec9a8932f54f116f528e225b82597bf7a787aaeeef6f1e553539N.exe"C:\Users\Admin\AppData\Local\Temp\86731cd5a98fec9a8932f54f116f528e225b82597bf7a787aaeeef6f1e553539N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\fvxfnn.exec:\fvxfnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\bbddtbj.exec:\bbddtbj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\xlndpbv.exec:\xlndpbv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\vfxnpv.exec:\vfxnpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\bvjjfp.exec:\bvjjfp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\rpnhrft.exec:\rpnhrft.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\jnvpn.exec:\jnvpn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\bjdddbl.exec:\bjdddbl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\rbptl.exec:\rbptl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\hftlnbd.exec:\hftlnbd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\dvxnnh.exec:\dvxnnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\hdjdp.exec:\hdjdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\pbbxxbj.exec:\pbbxxbj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\lxrrrv.exec:\lxrrrv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\jvxttpn.exec:\jvxttpn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\bpdvphb.exec:\bpdvphb.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1020 -
\??\c:\ppvpnj.exec:\ppvpnj.exe18⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ddjpfdl.exec:\ddjpfdl.exe19⤵
- Executes dropped EXE
PID:1968 -
\??\c:\tdhrn.exec:\tdhrn.exe20⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hnfvh.exec:\hnfvh.exe21⤵
- Executes dropped EXE
PID:2328 -
\??\c:\dljfbd.exec:\dljfbd.exe22⤵
- Executes dropped EXE
PID:2340 -
\??\c:\vpdvddh.exec:\vpdvddh.exe23⤵
- Executes dropped EXE
PID:2084 -
\??\c:\tfrfh.exec:\tfrfh.exe24⤵
- Executes dropped EXE
PID:1736 -
\??\c:\rttrr.exec:\rttrr.exe25⤵
- Executes dropped EXE
PID:588 -
\??\c:\vnhxdh.exec:\vnhxdh.exe26⤵
- Executes dropped EXE
PID:1860 -
\??\c:\btvpxv.exec:\btvpxv.exe27⤵
- Executes dropped EXE
PID:2120 -
\??\c:\dfdvb.exec:\dfdvb.exe28⤵
- Executes dropped EXE
PID:1892 -
\??\c:\rjjtbd.exec:\rjjtbd.exe29⤵
- Executes dropped EXE
PID:936 -
\??\c:\fhlbjff.exec:\fhlbjff.exe30⤵
- Executes dropped EXE
PID:1612 -
\??\c:\hdtrlhf.exec:\hdtrlhf.exe31⤵
- Executes dropped EXE
PID:2292 -
\??\c:\pnldd.exec:\pnldd.exe32⤵
- Executes dropped EXE
PID:1148 -
\??\c:\hjbjrj.exec:\hjbjrj.exe33⤵
- Executes dropped EXE
PID:888 -
\??\c:\lltjvbv.exec:\lltjvbv.exe34⤵
- Executes dropped EXE
PID:2248 -
\??\c:\ljpjhd.exec:\ljpjhd.exe35⤵
- Executes dropped EXE
PID:2540 -
\??\c:\tdjhtnt.exec:\tdjhtnt.exe36⤵
- Executes dropped EXE
PID:2592 -
\??\c:\tnffht.exec:\tnffht.exe37⤵
- Executes dropped EXE
PID:2372 -
\??\c:\rnfphj.exec:\rnfphj.exe38⤵
- Executes dropped EXE
PID:1576 -
\??\c:\ffpbtbh.exec:\ffpbtbh.exe39⤵
- Executes dropped EXE
PID:276 -
\??\c:\vjhhtb.exec:\vjhhtb.exe40⤵
- Executes dropped EXE
PID:1664 -
\??\c:\nthbxjp.exec:\nthbxjp.exe41⤵
- Executes dropped EXE
PID:2772 -
\??\c:\nrbxh.exec:\nrbxh.exe42⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rpbnt.exec:\rpbnt.exe43⤵
- Executes dropped EXE
PID:2660 -
\??\c:\tnbjfl.exec:\tnbjfl.exe44⤵
- Executes dropped EXE
PID:2916 -
\??\c:\lppjb.exec:\lppjb.exe45⤵
- Executes dropped EXE
PID:2992 -
\??\c:\xpbvjb.exec:\xpbvjb.exe46⤵
- Executes dropped EXE
PID:2628 -
\??\c:\ddjbfj.exec:\ddjbfj.exe47⤵
- Executes dropped EXE
PID:2676 -
\??\c:\nhfxfxp.exec:\nhfxfxp.exe48⤵
- Executes dropped EXE
PID:648 -
\??\c:\hlrhlt.exec:\hlrhlt.exe49⤵
- Executes dropped EXE
PID:1376 -
\??\c:\xrdddx.exec:\xrdddx.exe50⤵
- Executes dropped EXE
PID:1696 -
\??\c:\llpbv.exec:\llpbv.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1800 -
\??\c:\lfvnp.exec:\lfvnp.exe52⤵
- Executes dropped EXE
PID:1016 -
\??\c:\jvtdd.exec:\jvtdd.exe53⤵
- Executes dropped EXE
PID:1748 -
\??\c:\btxrr.exec:\btxrr.exe54⤵
- Executes dropped EXE
PID:1924 -
\??\c:\fjbfl.exec:\fjbfl.exe55⤵
- Executes dropped EXE
PID:2000 -
\??\c:\flffhp.exec:\flffhp.exe56⤵
- Executes dropped EXE
PID:2608 -
\??\c:\lfhhdx.exec:\lfhhdx.exe57⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xtvpnh.exec:\xtvpnh.exe58⤵
- Executes dropped EXE
PID:1932 -
\??\c:\pbfnfj.exec:\pbfnfj.exe59⤵
- Executes dropped EXE
PID:1780 -
\??\c:\lpthrjn.exec:\lpthrjn.exe60⤵
- Executes dropped EXE
PID:1952 -
\??\c:\nfnttxd.exec:\nfnttxd.exe61⤵
- Executes dropped EXE
PID:1628 -
\??\c:\lnxxt.exec:\lnxxt.exe62⤵
- Executes dropped EXE
PID:432 -
\??\c:\txrxxxh.exec:\txrxxxh.exe63⤵
- Executes dropped EXE
PID:1916 -
\??\c:\btlpf.exec:\btlpf.exe64⤵
- Executes dropped EXE
PID:3048 -
\??\c:\hdhlrp.exec:\hdhlrp.exe65⤵
- Executes dropped EXE
PID:912 -
\??\c:\hblfn.exec:\hblfn.exe66⤵
- System Location Discovery: System Language Discovery
PID:2520 -
\??\c:\bllxt.exec:\bllxt.exe67⤵PID:2312
-
\??\c:\xflvjx.exec:\xflvjx.exe68⤵PID:2492
-
\??\c:\jrpxdb.exec:\jrpxdb.exe69⤵PID:1548
-
\??\c:\pdxnjhj.exec:\pdxnjhj.exe70⤵PID:2120
-
\??\c:\txjprft.exec:\txjprft.exe71⤵
- System Location Discovery: System Language Discovery
PID:2164 -
\??\c:\xnvrvtd.exec:\xnvrvtd.exe72⤵PID:2072
-
\??\c:\jvnht.exec:\jvnht.exe73⤵
- System Location Discovery: System Language Discovery
PID:2016 -
\??\c:\tdfhb.exec:\tdfhb.exe74⤵
- System Location Discovery: System Language Discovery
PID:1364 -
\??\c:\tjnpntb.exec:\tjnpntb.exe75⤵PID:2392
-
\??\c:\nplbft.exec:\nplbft.exe76⤵PID:1524
-
\??\c:\hjtnj.exec:\hjtnj.exe77⤵PID:2276
-
\??\c:\jrvhjnr.exec:\jrvhjnr.exe78⤵PID:1740
-
\??\c:\xtdhx.exec:\xtdhx.exe79⤵
- System Location Discovery: System Language Discovery
PID:2260 -
\??\c:\nxjjv.exec:\nxjjv.exe80⤵PID:2940
-
\??\c:\vtfhfvt.exec:\vtfhfvt.exe81⤵PID:1276
-
\??\c:\pttvlfv.exec:\pttvlfv.exe82⤵PID:1600
-
\??\c:\lnhrn.exec:\lnhrn.exe83⤵PID:2780
-
\??\c:\hlvbhjh.exec:\hlvbhjh.exe84⤵PID:2776
-
\??\c:\pprfvpd.exec:\pprfvpd.exe85⤵PID:2772
-
\??\c:\plxtpvh.exec:\plxtpvh.exe86⤵PID:3036
-
\??\c:\njdxlb.exec:\njdxlb.exe87⤵PID:2976
-
\??\c:\jbnbnj.exec:\jbnbnj.exe88⤵PID:2832
-
\??\c:\jtpxv.exec:\jtpxv.exe89⤵PID:2768
-
\??\c:\nvblh.exec:\nvblh.exe90⤵
- System Location Discovery: System Language Discovery
PID:2652 -
\??\c:\brvphnj.exec:\brvphnj.exe91⤵PID:2692
-
\??\c:\bjbhp.exec:\bjbhp.exe92⤵PID:1348
-
\??\c:\jplnhdr.exec:\jplnhdr.exe93⤵PID:2228
-
\??\c:\vvhxhhd.exec:\vvhxhhd.exe94⤵PID:2212
-
\??\c:\lpftnnr.exec:\lpftnnr.exe95⤵PID:1788
-
\??\c:\ddrpln.exec:\ddrpln.exe96⤵PID:1732
-
\??\c:\hlltft.exec:\hlltft.exe97⤵PID:1748
-
\??\c:\htnbtb.exec:\htnbtb.exe98⤵PID:1912
-
\??\c:\xdtdrp.exec:\xdtdrp.exe99⤵PID:1884
-
\??\c:\npdbl.exec:\npdbl.exe100⤵PID:1020
-
\??\c:\vhvpxx.exec:\vhvpxx.exe101⤵PID:336
-
\??\c:\vfbjhpv.exec:\vfbjhpv.exe102⤵PID:2700
-
\??\c:\lnvhtxl.exec:\lnvhtxl.exe103⤵PID:1936
-
\??\c:\pnvjt.exec:\pnvjt.exe104⤵PID:1964
-
\??\c:\jxtjnxn.exec:\jxtjnxn.exe105⤵PID:2096
-
\??\c:\xrrlnl.exec:\xrrlnl.exe106⤵PID:432
-
\??\c:\vxxxtjl.exec:\vxxxtjl.exe107⤵PID:2084
-
\??\c:\hrptb.exec:\hrptb.exe108⤵PID:3048
-
\??\c:\xlvnpb.exec:\xlvnpb.exe109⤵PID:912
-
\??\c:\lvvpjbt.exec:\lvvpjbt.exe110⤵PID:288
-
\??\c:\htdvl.exec:\htdvl.exe111⤵PID:2104
-
\??\c:\pvjdjh.exec:\pvjdjh.exe112⤵PID:1860
-
\??\c:\xppbxrn.exec:\xppbxrn.exe113⤵PID:1548
-
\??\c:\hflrjdt.exec:\hflrjdt.exe114⤵PID:2120
-
\??\c:\hxxhfjp.exec:\hxxhfjp.exe115⤵PID:1960
-
\??\c:\pdhftt.exec:\pdhftt.exe116⤵PID:2604
-
\??\c:\jhjndp.exec:\jhjndp.exe117⤵PID:2308
-
\??\c:\ptldbfd.exec:\ptldbfd.exe118⤵PID:360
-
\??\c:\bttftj.exec:\bttftj.exe119⤵PID:1008
-
\??\c:\pjdbd.exec:\pjdbd.exe120⤵PID:888
-
\??\c:\llpphtl.exec:\llpphtl.exe121⤵PID:876
-
\??\c:\vhjflt.exec:\vhjflt.exe122⤵PID:2256
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-