Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
16/12/2024, 19:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ff212ce7adc3189da6212f480209f772f66620262e1ff4deb629b38b21e3ecc9N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
ff212ce7adc3189da6212f480209f772f66620262e1ff4deb629b38b21e3ecc9N.exe
-
Size
454KB
-
MD5
a353ce60578898a933f161208dc25a50
-
SHA1
67d7ad5ce1885bc1ad0783580721d5ec3f3546e0
-
SHA256
ff212ce7adc3189da6212f480209f772f66620262e1ff4deb629b38b21e3ecc9
-
SHA512
1fde0995cfaf22c4724a9065439fa85c918709bb770af6012e0759d7cc14eb8c0f418a99e2577a4c84a21fd30a8b271dc3207edb79443fdfd29a42e0b85a047a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1:q7Tc2NYHUrAwfMp3CD1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/3040-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-107-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1484-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/628-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-141-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1484-140-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2872-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-194-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2508-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/748-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1336-291-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/3028-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-392-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1804-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-515-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1768-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-530-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2312-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-574-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2388-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1668 tppnt.exe 2704 bblfp.exe 2740 lxlpjb.exe 2764 nnnnn.exe 2988 ftfjdx.exe 2908 jjjvbv.exe 2800 bxnbjf.exe 1648 lnxvl.exe 1652 nfvrv.exe 1484 bnvfbtl.exe 2036 jpnpdfl.exe 628 djptbd.exe 2944 xbxnpx.exe 2872 pdbhpn.exe 1500 hhjpd.exe 1844 phldhld.exe 1132 txjvl.exe 2432 rrxhddt.exe 1164 ljvhp.exe 860 ljxrljj.exe 2508 rbfdbh.exe 1744 tlhpdf.exe 1508 htnpfhn.exe 2460 rfnjv.exe 748 nhdvbtr.exe 1800 xdfpxv.exe 2056 jllbfd.exe 1528 hltjfxt.exe 800 rvrbbb.exe 1336 bpfph.exe 3028 rxrvptp.exe 1792 jnnhnv.exe 2980 nftlb.exe 1688 lfxbdn.exe 2244 hfpll.exe 2704 ddxhhxh.exe 2880 bfhvhnx.exe 2736 trthl.exe 2892 vhjdl.exe 2972 djnftrh.exe 2404 txpblj.exe 2624 tpbrfh.exe 3068 hrrjj.exe 2352 lnlrh.exe 1804 vrpldhn.exe 2272 nlvtp.exe 1752 hphlplf.exe 2516 jrrvhjt.exe 628 rxtjxvl.exe 2788 fjtrrp.exe 940 xrtlf.exe 2872 hhvbj.exe 1588 nrttpd.exe 3016 flnjjpd.exe 2440 dlfnjv.exe 2444 pxdrltp.exe 2140 pnlfhn.exe 1644 tbhhdt.exe 1380 xnrvjnd.exe 980 vfbfj.exe 316 xnxjp.exe 1744 bjjxpnl.exe 2132 fprnjr.exe 1768 dbnhbtl.exe -
resource yara_rule behavioral1/memory/3040-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1164-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/748-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/748-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-751-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdxhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxrft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlnjbfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhrxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpxjjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xppfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlhrfht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frtllxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhdrjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjdjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rphvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtnfxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjrbfhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdbjrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbxjtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxplbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdpbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbxnpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjrxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnvlxjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptbrdll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtrntln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfpljrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxtfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfhvhnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbvnff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptnjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtpfdtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjrrjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trvjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxhddt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljdnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhxnvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjvpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrttpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfnbrpv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 1668 3040 ff212ce7adc3189da6212f480209f772f66620262e1ff4deb629b38b21e3ecc9N.exe 30 PID 3040 wrote to memory of 1668 3040 ff212ce7adc3189da6212f480209f772f66620262e1ff4deb629b38b21e3ecc9N.exe 30 PID 3040 wrote to memory of 1668 3040 ff212ce7adc3189da6212f480209f772f66620262e1ff4deb629b38b21e3ecc9N.exe 30 PID 3040 wrote to memory of 1668 3040 ff212ce7adc3189da6212f480209f772f66620262e1ff4deb629b38b21e3ecc9N.exe 30 PID 1668 wrote to memory of 2704 1668 tppnt.exe 31 PID 1668 wrote to memory of 2704 1668 tppnt.exe 31 PID 1668 wrote to memory of 2704 1668 tppnt.exe 31 PID 1668 wrote to memory of 2704 1668 tppnt.exe 31 PID 2704 wrote to memory of 2740 2704 bblfp.exe 32 PID 2704 wrote to memory of 2740 2704 bblfp.exe 32 PID 2704 wrote to memory of 2740 2704 bblfp.exe 32 PID 2704 wrote to memory of 2740 2704 bblfp.exe 32 PID 2740 wrote to memory of 2764 2740 lxlpjb.exe 33 PID 2740 wrote to memory of 2764 2740 lxlpjb.exe 33 PID 2740 wrote to memory of 2764 2740 lxlpjb.exe 33 PID 2740 wrote to memory of 2764 2740 lxlpjb.exe 33 PID 2764 wrote to memory of 2988 2764 nnnnn.exe 34 PID 2764 wrote to memory of 2988 2764 nnnnn.exe 34 PID 2764 wrote to memory of 2988 2764 nnnnn.exe 34 PID 2764 wrote to memory of 2988 2764 nnnnn.exe 34 PID 2988 wrote to memory of 2908 2988 ftfjdx.exe 35 PID 2988 wrote to memory of 2908 2988 ftfjdx.exe 35 PID 2988 wrote to memory of 2908 2988 ftfjdx.exe 35 PID 2988 wrote to memory of 2908 2988 ftfjdx.exe 35 PID 2908 wrote to memory of 2800 2908 jjjvbv.exe 36 PID 2908 wrote to memory of 2800 2908 jjjvbv.exe 36 PID 2908 wrote to memory of 2800 2908 jjjvbv.exe 36 PID 2908 wrote to memory of 2800 2908 jjjvbv.exe 36 PID 2800 wrote to memory of 1648 2800 bxnbjf.exe 37 PID 2800 wrote to memory of 1648 2800 bxnbjf.exe 37 PID 2800 wrote to memory of 1648 2800 bxnbjf.exe 37 PID 2800 wrote to memory of 1648 2800 bxnbjf.exe 37 PID 1648 wrote to memory of 1652 1648 lnxvl.exe 38 PID 1648 wrote to memory of 1652 1648 lnxvl.exe 38 PID 1648 wrote to memory of 1652 1648 lnxvl.exe 38 PID 1648 wrote to memory of 1652 1648 lnxvl.exe 38 PID 1652 wrote to memory of 1484 1652 nfvrv.exe 39 PID 1652 wrote to memory of 1484 1652 nfvrv.exe 39 PID 1652 wrote to memory of 1484 1652 nfvrv.exe 39 PID 1652 wrote to memory of 1484 1652 nfvrv.exe 39 PID 1484 wrote to memory of 2036 1484 bnvfbtl.exe 40 PID 1484 wrote to memory of 2036 1484 bnvfbtl.exe 40 PID 1484 wrote to memory of 2036 1484 bnvfbtl.exe 40 PID 1484 wrote to memory of 2036 1484 bnvfbtl.exe 40 PID 2036 wrote to memory of 628 2036 jpnpdfl.exe 41 PID 2036 wrote to memory of 628 2036 jpnpdfl.exe 41 PID 2036 wrote to memory of 628 2036 jpnpdfl.exe 41 PID 2036 wrote to memory of 628 2036 jpnpdfl.exe 41 PID 628 wrote to memory of 2944 628 djptbd.exe 42 PID 628 wrote to memory of 2944 628 djptbd.exe 42 PID 628 wrote to memory of 2944 628 djptbd.exe 42 PID 628 wrote to memory of 2944 628 djptbd.exe 42 PID 2944 wrote to memory of 2872 2944 xbxnpx.exe 43 PID 2944 wrote to memory of 2872 2944 xbxnpx.exe 43 PID 2944 wrote to memory of 2872 2944 xbxnpx.exe 43 PID 2944 wrote to memory of 2872 2944 xbxnpx.exe 43 PID 2872 wrote to memory of 1500 2872 pdbhpn.exe 44 PID 2872 wrote to memory of 1500 2872 pdbhpn.exe 44 PID 2872 wrote to memory of 1500 2872 pdbhpn.exe 44 PID 2872 wrote to memory of 1500 2872 pdbhpn.exe 44 PID 1500 wrote to memory of 1844 1500 hhjpd.exe 45 PID 1500 wrote to memory of 1844 1500 hhjpd.exe 45 PID 1500 wrote to memory of 1844 1500 hhjpd.exe 45 PID 1500 wrote to memory of 1844 1500 hhjpd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff212ce7adc3189da6212f480209f772f66620262e1ff4deb629b38b21e3ecc9N.exe"C:\Users\Admin\AppData\Local\Temp\ff212ce7adc3189da6212f480209f772f66620262e1ff4deb629b38b21e3ecc9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\tppnt.exec:\tppnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\bblfp.exec:\bblfp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\lxlpjb.exec:\lxlpjb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\nnnnn.exec:\nnnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\ftfjdx.exec:\ftfjdx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\jjjvbv.exec:\jjjvbv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\bxnbjf.exec:\bxnbjf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\lnxvl.exec:\lnxvl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\nfvrv.exec:\nfvrv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\bnvfbtl.exec:\bnvfbtl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\jpnpdfl.exec:\jpnpdfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\djptbd.exec:\djptbd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\xbxnpx.exec:\xbxnpx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\pdbhpn.exec:\pdbhpn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\hhjpd.exec:\hhjpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\phldhld.exec:\phldhld.exe17⤵
- Executes dropped EXE
PID:1844 -
\??\c:\txjvl.exec:\txjvl.exe18⤵
- Executes dropped EXE
PID:1132 -
\??\c:\rrxhddt.exec:\rrxhddt.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2432 -
\??\c:\ljvhp.exec:\ljvhp.exe20⤵
- Executes dropped EXE
PID:1164 -
\??\c:\ljxrljj.exec:\ljxrljj.exe21⤵
- Executes dropped EXE
PID:860 -
\??\c:\rbfdbh.exec:\rbfdbh.exe22⤵
- Executes dropped EXE
PID:2508 -
\??\c:\tlhpdf.exec:\tlhpdf.exe23⤵
- Executes dropped EXE
PID:1744 -
\??\c:\htnpfhn.exec:\htnpfhn.exe24⤵
- Executes dropped EXE
PID:1508 -
\??\c:\rfnjv.exec:\rfnjv.exe25⤵
- Executes dropped EXE
PID:2460 -
\??\c:\nhdvbtr.exec:\nhdvbtr.exe26⤵
- Executes dropped EXE
PID:748 -
\??\c:\xdfpxv.exec:\xdfpxv.exe27⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jllbfd.exec:\jllbfd.exe28⤵
- Executes dropped EXE
PID:2056 -
\??\c:\hltjfxt.exec:\hltjfxt.exe29⤵
- Executes dropped EXE
PID:1528 -
\??\c:\rvrbbb.exec:\rvrbbb.exe30⤵
- Executes dropped EXE
PID:800 -
\??\c:\bpfph.exec:\bpfph.exe31⤵
- Executes dropped EXE
PID:1336 -
\??\c:\rxrvptp.exec:\rxrvptp.exe32⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jnnhnv.exec:\jnnhnv.exe33⤵
- Executes dropped EXE
PID:1792 -
\??\c:\nftlb.exec:\nftlb.exe34⤵
- Executes dropped EXE
PID:2980 -
\??\c:\lfxbdn.exec:\lfxbdn.exe35⤵
- Executes dropped EXE
PID:1688 -
\??\c:\hfpll.exec:\hfpll.exe36⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ddxhhxh.exec:\ddxhhxh.exe37⤵
- Executes dropped EXE
PID:2704 -
\??\c:\bfhvhnx.exec:\bfhvhnx.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2880 -
\??\c:\trthl.exec:\trthl.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\vhjdl.exec:\vhjdl.exe40⤵
- Executes dropped EXE
PID:2892 -
\??\c:\djnftrh.exec:\djnftrh.exe41⤵
- Executes dropped EXE
PID:2972 -
\??\c:\txpblj.exec:\txpblj.exe42⤵
- Executes dropped EXE
PID:2404 -
\??\c:\tpbrfh.exec:\tpbrfh.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\hrrjj.exec:\hrrjj.exe44⤵
- Executes dropped EXE
PID:3068 -
\??\c:\lnlrh.exec:\lnlrh.exe45⤵
- Executes dropped EXE
PID:2352 -
\??\c:\vrpldhn.exec:\vrpldhn.exe46⤵
- Executes dropped EXE
PID:1804 -
\??\c:\nlvtp.exec:\nlvtp.exe47⤵
- Executes dropped EXE
PID:2272 -
\??\c:\hphlplf.exec:\hphlplf.exe48⤵
- Executes dropped EXE
PID:1752 -
\??\c:\jrrvhjt.exec:\jrrvhjt.exe49⤵
- Executes dropped EXE
PID:2516 -
\??\c:\rxtjxvl.exec:\rxtjxvl.exe50⤵
- Executes dropped EXE
PID:628 -
\??\c:\fjtrrp.exec:\fjtrrp.exe51⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xrtlf.exec:\xrtlf.exe52⤵
- Executes dropped EXE
PID:940 -
\??\c:\hhvbj.exec:\hhvbj.exe53⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nrttpd.exec:\nrttpd.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1588 -
\??\c:\flnjjpd.exec:\flnjjpd.exe55⤵
- Executes dropped EXE
PID:3016 -
\??\c:\dlfnjv.exec:\dlfnjv.exe56⤵
- Executes dropped EXE
PID:2440 -
\??\c:\pxdrltp.exec:\pxdrltp.exe57⤵
- Executes dropped EXE
PID:2444 -
\??\c:\pnlfhn.exec:\pnlfhn.exe58⤵
- Executes dropped EXE
PID:2140 -
\??\c:\tbhhdt.exec:\tbhhdt.exe59⤵
- Executes dropped EXE
PID:1644 -
\??\c:\xnrvjnd.exec:\xnrvjnd.exe60⤵
- Executes dropped EXE
PID:1380 -
\??\c:\vfbfj.exec:\vfbfj.exe61⤵
- Executes dropped EXE
PID:980 -
\??\c:\xnxjp.exec:\xnxjp.exe62⤵
- Executes dropped EXE
PID:316 -
\??\c:\bjjxpnl.exec:\bjjxpnl.exe63⤵
- Executes dropped EXE
PID:1744 -
\??\c:\fprnjr.exec:\fprnjr.exe64⤵
- Executes dropped EXE
PID:2132 -
\??\c:\dbnhbtl.exec:\dbnhbtl.exe65⤵
- Executes dropped EXE
PID:1768 -
\??\c:\prpbp.exec:\prpbp.exe66⤵PID:2152
-
\??\c:\dxvlr.exec:\dxvlr.exe67⤵PID:1060
-
\??\c:\lrphbf.exec:\lrphbf.exe68⤵PID:2312
-
\??\c:\jrljh.exec:\jrljh.exe69⤵PID:3000
-
\??\c:\nhrtnt.exec:\nhrtnt.exe70⤵PID:2476
-
\??\c:\ljthxl.exec:\ljthxl.exe71⤵PID:1040
-
\??\c:\xttjpx.exec:\xttjpx.exe72⤵PID:548
-
\??\c:\vdddpn.exec:\vdddpn.exe73⤵PID:1808
-
\??\c:\vbbddnh.exec:\vbbddnh.exe74⤵PID:3040
-
\??\c:\rxjlvtp.exec:\rxjlvtp.exe75⤵PID:1580
-
\??\c:\hvhhbb.exec:\hvhhbb.exe76⤵PID:2216
-
\??\c:\vbrnrlj.exec:\vbrnrlj.exe77⤵PID:2904
-
\??\c:\drrnpjv.exec:\drrnpjv.exe78⤵PID:2388
-
\??\c:\dfhhrd.exec:\dfhhrd.exe79⤵PID:2828
-
\??\c:\lbtfdfr.exec:\lbtfdfr.exe80⤵PID:2880
-
\??\c:\dpbxvr.exec:\dpbxvr.exe81⤵PID:2744
-
\??\c:\lbxxnx.exec:\lbxxnx.exe82⤵PID:2988
-
\??\c:\hdrff.exec:\hdrff.exe83⤵PID:2820
-
\??\c:\bdnhl.exec:\bdnhl.exe84⤵PID:2712
-
\??\c:\dlptxx.exec:\dlptxx.exe85⤵PID:2644
-
\??\c:\rrjvrjx.exec:\rrjvrjx.exe86⤵PID:1300
-
\??\c:\rdpdphr.exec:\rdpdphr.exe87⤵PID:1100
-
\??\c:\bnnjdb.exec:\bnnjdb.exe88⤵PID:588
-
\??\c:\jlpdt.exec:\jlpdt.exe89⤵PID:1720
-
\??\c:\rfxddj.exec:\rfxddj.exe90⤵PID:2032
-
\??\c:\hdjjdh.exec:\hdjjdh.exe91⤵PID:1492
-
\??\c:\dntrr.exec:\dntrr.exe92⤵PID:236
-
\??\c:\fdhndrd.exec:\fdhndrd.exe93⤵PID:1724
-
\??\c:\jdbnx.exec:\jdbnx.exe94⤵PID:2944
-
\??\c:\fphtpvd.exec:\fphtpvd.exe95⤵PID:1264
-
\??\c:\btjtr.exec:\btjtr.exe96⤵PID:692
-
\??\c:\rhlnlbr.exec:\rhlnlbr.exe97⤵PID:2872
-
\??\c:\nlxjdht.exec:\nlxjdht.exe98⤵PID:3008
-
\??\c:\lnfbxt.exec:\lnfbxt.exe99⤵PID:2428
-
\??\c:\jjhfjd.exec:\jjhfjd.exe100⤵PID:2440
-
\??\c:\pbndhpt.exec:\pbndhpt.exe101⤵PID:856
-
\??\c:\dltrlf.exec:\dltrlf.exe102⤵PID:2588
-
\??\c:\ndfpjdl.exec:\ndfpjdl.exe103⤵PID:2144
-
\??\c:\xvbfvl.exec:\xvbfvl.exe104⤵PID:1396
-
\??\c:\lthvxn.exec:\lthvxn.exe105⤵PID:980
-
\??\c:\tlxthxx.exec:\tlxthxx.exe106⤵PID:316
-
\??\c:\xfpljrf.exec:\xfpljrf.exe107⤵
- System Location Discovery: System Language Discovery
PID:1744 -
\??\c:\jtbrrth.exec:\jtbrrth.exe108⤵PID:1856
-
\??\c:\fbhdnf.exec:\fbhdnf.exe109⤵PID:1768
-
\??\c:\hvnxlt.exec:\hvnxlt.exe110⤵PID:1556
-
\??\c:\bxhblt.exec:\bxhblt.exe111⤵PID:2220
-
\??\c:\rxxdb.exec:\rxxdb.exe112⤵PID:2300
-
\??\c:\nlffxv.exec:\nlffxv.exe113⤵PID:1932
-
\??\c:\rtdtbj.exec:\rtdtbj.exe114⤵PID:2044
-
\??\c:\jvbtfxb.exec:\jvbtfxb.exe115⤵PID:1488
-
\??\c:\tpxxn.exec:\tpxxn.exe116⤵PID:696
-
\??\c:\jxtbxp.exec:\jxtbxp.exe117⤵PID:2304
-
\??\c:\nrrnp.exec:\nrrnp.exe118⤵PID:3044
-
\??\c:\rdhdft.exec:\rdhdft.exe119⤵PID:3040
-
\??\c:\dpldpj.exec:\dpldpj.exe120⤵PID:2072
-
\??\c:\dxlxd.exec:\dxlxd.exe121⤵PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-