Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 13:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cec11c9b5350c3e62c4716f36a8a5f6a8774ad444e230e8544fee5daf8687b31.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
cec11c9b5350c3e62c4716f36a8a5f6a8774ad444e230e8544fee5daf8687b31.exe
-
Size
456KB
-
MD5
669a7fdaa663bd2910b413ebf632dcac
-
SHA1
92a9441d6ee37b2d30be1fde113328ecdce1c1b6
-
SHA256
cec11c9b5350c3e62c4716f36a8a5f6a8774ad444e230e8544fee5daf8687b31
-
SHA512
7a0705aef5ef878cd5f581cff54d1f041686eb944ab075a4922fee166907126ab0d9a499a35a31935b29669fd64d00a9a9583e451c6b8bb93b07443cf7150e9b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRW:q7Tc2NYHUrAwfMp3CDRW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2240-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/516-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-96-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2664-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/960-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1384-336-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2864-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-352-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2700-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-397-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2656-403-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/1032-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-441-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2776-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-466-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1788-512-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2084-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-650-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2844-657-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2120-670-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2656-689-0x0000000000280000-0x00000000002AA000-memory.dmp family_blackmoon behavioral1/memory/1028-814-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-827-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1088-828-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2744-975-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1560 vfvdfxx.exe 2076 rhnvbp.exe 2108 rvnhxj.exe 1920 ljbdnhr.exe 516 rthnbd.exe 2892 llpxtx.exe 2788 fnjbfn.exe 1528 hrxnh.exe 2868 tjhpvtp.exe 2752 xjfbb.exe 2116 hhhlft.exe 2664 jxhtv.exe 2340 bhnxbpf.exe 2780 lbfnjjl.exe 1772 xlbjdvt.exe 2996 nrlfp.exe 2004 xthjjt.exe 2960 vlrjn.exe 2636 rxbdb.exe 2396 ldfll.exe 2464 ffhnbf.exe 2772 xfbjfll.exe 1980 rjlpj.exe 960 vfrvhtn.exe 1068 jblpbt.exe 1036 vnjxfxn.exe 1716 xrltv.exe 1088 bhjddnb.exe 1820 bdpdph.exe 1912 rbjfdrf.exe 1620 bvblr.exe 288 bfflpjp.exe 1220 vthnb.exe 2060 plxflv.exe 2408 ltlrfpt.exe 2620 nxnvjt.exe 1600 jntnv.exe 1384 bttbv.exe 2864 lpvrxh.exe 1692 lxfvhnp.exe 3068 jnvrb.exe 2684 rhpvrh.exe 2896 dthtr.exe 2700 rrrrr.exe 2688 vhxnh.exe 2316 jllfxhp.exe 2656 vprffjp.exe 2496 lpphhj.exe 1032 jhbtd.exe 1456 bjvjhbb.exe 1504 hfrjpvd.exe 1128 tjdxd.exe 1488 pfvppr.exe 2776 pdfrlbb.exe 1152 pnpbbr.exe 2960 jdfnnnx.exe 2132 njvtrd.exe 2056 jnhnx.exe 1492 fddxd.exe 2276 lfbnfv.exe 2124 fpbdrhh.exe 1816 bpnvb.exe 1788 ptfrj.exe 560 dljvfh.exe -
resource yara_rule behavioral1/memory/2240-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/516-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1220-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-336-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1692-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-352-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2896-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-403-0x0000000001C70000-0x0000000001C9A000-memory.dmp upx behavioral1/memory/1032-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-512-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/820-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-777-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-827-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2784-910-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-917-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-926-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpfnll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnfpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtjrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnlfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfttbnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dldrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjlnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vprffjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbdjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrnxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnphrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddbjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnjxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhfjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rndtfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drhtjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhrhvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfpdvdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jttdrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drtjpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rldvvhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjbpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhxbvpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djrlfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfrtthl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvxhjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbvdhxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbbdhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pttxbvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brdlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhttp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjrlpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lntbx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1560 2240 cec11c9b5350c3e62c4716f36a8a5f6a8774ad444e230e8544fee5daf8687b31.exe 30 PID 2240 wrote to memory of 1560 2240 cec11c9b5350c3e62c4716f36a8a5f6a8774ad444e230e8544fee5daf8687b31.exe 30 PID 2240 wrote to memory of 1560 2240 cec11c9b5350c3e62c4716f36a8a5f6a8774ad444e230e8544fee5daf8687b31.exe 30 PID 2240 wrote to memory of 1560 2240 cec11c9b5350c3e62c4716f36a8a5f6a8774ad444e230e8544fee5daf8687b31.exe 30 PID 1560 wrote to memory of 2076 1560 vfvdfxx.exe 31 PID 1560 wrote to memory of 2076 1560 vfvdfxx.exe 31 PID 1560 wrote to memory of 2076 1560 vfvdfxx.exe 31 PID 1560 wrote to memory of 2076 1560 vfvdfxx.exe 31 PID 2076 wrote to memory of 2108 2076 rhnvbp.exe 32 PID 2076 wrote to memory of 2108 2076 rhnvbp.exe 32 PID 2076 wrote to memory of 2108 2076 rhnvbp.exe 32 PID 2076 wrote to memory of 2108 2076 rhnvbp.exe 32 PID 2108 wrote to memory of 1920 2108 rvnhxj.exe 33 PID 2108 wrote to memory of 1920 2108 rvnhxj.exe 33 PID 2108 wrote to memory of 1920 2108 rvnhxj.exe 33 PID 2108 wrote to memory of 1920 2108 rvnhxj.exe 33 PID 1920 wrote to memory of 516 1920 ljbdnhr.exe 34 PID 1920 wrote to memory of 516 1920 ljbdnhr.exe 34 PID 1920 wrote to memory of 516 1920 ljbdnhr.exe 34 PID 1920 wrote to memory of 516 1920 ljbdnhr.exe 34 PID 516 wrote to memory of 2892 516 rthnbd.exe 35 PID 516 wrote to memory of 2892 516 rthnbd.exe 35 PID 516 wrote to memory of 2892 516 rthnbd.exe 35 PID 516 wrote to memory of 2892 516 rthnbd.exe 35 PID 2892 wrote to memory of 2788 2892 llpxtx.exe 36 PID 2892 wrote to memory of 2788 2892 llpxtx.exe 36 PID 2892 wrote to memory of 2788 2892 llpxtx.exe 36 PID 2892 wrote to memory of 2788 2892 llpxtx.exe 36 PID 2788 wrote to memory of 1528 2788 fnjbfn.exe 37 PID 2788 wrote to memory of 1528 2788 fnjbfn.exe 37 PID 2788 wrote to memory of 1528 2788 fnjbfn.exe 37 PID 2788 wrote to memory of 1528 2788 fnjbfn.exe 37 PID 1528 wrote to memory of 2868 1528 hrxnh.exe 38 PID 1528 wrote to memory of 2868 1528 hrxnh.exe 38 PID 1528 wrote to memory of 2868 1528 hrxnh.exe 38 PID 1528 wrote to memory of 2868 1528 hrxnh.exe 38 PID 2868 wrote to memory of 2752 2868 tjhpvtp.exe 39 PID 2868 wrote to memory of 2752 2868 tjhpvtp.exe 39 PID 2868 wrote to memory of 2752 2868 tjhpvtp.exe 39 PID 2868 wrote to memory of 2752 2868 tjhpvtp.exe 39 PID 2752 wrote to memory of 2116 2752 xjfbb.exe 40 PID 2752 wrote to memory of 2116 2752 xjfbb.exe 40 PID 2752 wrote to memory of 2116 2752 xjfbb.exe 40 PID 2752 wrote to memory of 2116 2752 xjfbb.exe 40 PID 2116 wrote to memory of 2664 2116 hhhlft.exe 41 PID 2116 wrote to memory of 2664 2116 hhhlft.exe 41 PID 2116 wrote to memory of 2664 2116 hhhlft.exe 41 PID 2116 wrote to memory of 2664 2116 hhhlft.exe 41 PID 2664 wrote to memory of 2340 2664 jxhtv.exe 42 PID 2664 wrote to memory of 2340 2664 jxhtv.exe 42 PID 2664 wrote to memory of 2340 2664 jxhtv.exe 42 PID 2664 wrote to memory of 2340 2664 jxhtv.exe 42 PID 2340 wrote to memory of 2780 2340 bhnxbpf.exe 43 PID 2340 wrote to memory of 2780 2340 bhnxbpf.exe 43 PID 2340 wrote to memory of 2780 2340 bhnxbpf.exe 43 PID 2340 wrote to memory of 2780 2340 bhnxbpf.exe 43 PID 2780 wrote to memory of 1772 2780 lbfnjjl.exe 44 PID 2780 wrote to memory of 1772 2780 lbfnjjl.exe 44 PID 2780 wrote to memory of 1772 2780 lbfnjjl.exe 44 PID 2780 wrote to memory of 1772 2780 lbfnjjl.exe 44 PID 1772 wrote to memory of 2996 1772 xlbjdvt.exe 45 PID 1772 wrote to memory of 2996 1772 xlbjdvt.exe 45 PID 1772 wrote to memory of 2996 1772 xlbjdvt.exe 45 PID 1772 wrote to memory of 2996 1772 xlbjdvt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\cec11c9b5350c3e62c4716f36a8a5f6a8774ad444e230e8544fee5daf8687b31.exe"C:\Users\Admin\AppData\Local\Temp\cec11c9b5350c3e62c4716f36a8a5f6a8774ad444e230e8544fee5daf8687b31.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\vfvdfxx.exec:\vfvdfxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\rhnvbp.exec:\rhnvbp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\rvnhxj.exec:\rvnhxj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\ljbdnhr.exec:\ljbdnhr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\rthnbd.exec:\rthnbd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\llpxtx.exec:\llpxtx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\fnjbfn.exec:\fnjbfn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\hrxnh.exec:\hrxnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\tjhpvtp.exec:\tjhpvtp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\xjfbb.exec:\xjfbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\hhhlft.exec:\hhhlft.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\jxhtv.exec:\jxhtv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\bhnxbpf.exec:\bhnxbpf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\lbfnjjl.exec:\lbfnjjl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\xlbjdvt.exec:\xlbjdvt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\nrlfp.exec:\nrlfp.exe17⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xthjjt.exec:\xthjjt.exe18⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vlrjn.exec:\vlrjn.exe19⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rxbdb.exec:\rxbdb.exe20⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ldfll.exec:\ldfll.exe21⤵
- Executes dropped EXE
PID:2396 -
\??\c:\ffhnbf.exec:\ffhnbf.exe22⤵
- Executes dropped EXE
PID:2464 -
\??\c:\xfbjfll.exec:\xfbjfll.exe23⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rjlpj.exec:\rjlpj.exe24⤵
- Executes dropped EXE
PID:1980 -
\??\c:\vfrvhtn.exec:\vfrvhtn.exe25⤵
- Executes dropped EXE
PID:960 -
\??\c:\jblpbt.exec:\jblpbt.exe26⤵
- Executes dropped EXE
PID:1068 -
\??\c:\vnjxfxn.exec:\vnjxfxn.exe27⤵
- Executes dropped EXE
PID:1036 -
\??\c:\xrltv.exec:\xrltv.exe28⤵
- Executes dropped EXE
PID:1716 -
\??\c:\bhjddnb.exec:\bhjddnb.exe29⤵
- Executes dropped EXE
PID:1088 -
\??\c:\bdpdph.exec:\bdpdph.exe30⤵
- Executes dropped EXE
PID:1820 -
\??\c:\rbjfdrf.exec:\rbjfdrf.exe31⤵
- Executes dropped EXE
PID:1912 -
\??\c:\bvblr.exec:\bvblr.exe32⤵
- Executes dropped EXE
PID:1620 -
\??\c:\bfflpjp.exec:\bfflpjp.exe33⤵
- Executes dropped EXE
PID:288 -
\??\c:\vthnb.exec:\vthnb.exe34⤵
- Executes dropped EXE
PID:1220 -
\??\c:\plxflv.exec:\plxflv.exe35⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ltlrfpt.exec:\ltlrfpt.exe36⤵
- Executes dropped EXE
PID:2408 -
\??\c:\nxnvjt.exec:\nxnvjt.exe37⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jntnv.exec:\jntnv.exe38⤵
- Executes dropped EXE
PID:1600 -
\??\c:\bttbv.exec:\bttbv.exe39⤵
- Executes dropped EXE
PID:1384 -
\??\c:\lpvrxh.exec:\lpvrxh.exe40⤵
- Executes dropped EXE
PID:2864 -
\??\c:\lxfvhnp.exec:\lxfvhnp.exe41⤵
- Executes dropped EXE
PID:1692 -
\??\c:\jnvrb.exec:\jnvrb.exe42⤵
- Executes dropped EXE
PID:3068 -
\??\c:\rhpvrh.exec:\rhpvrh.exe43⤵
- Executes dropped EXE
PID:2684 -
\??\c:\dthtr.exec:\dthtr.exe44⤵
- Executes dropped EXE
PID:2896 -
\??\c:\rrrrr.exec:\rrrrr.exe45⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vhxnh.exec:\vhxnh.exe46⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jllfxhp.exec:\jllfxhp.exe47⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vprffjp.exec:\vprffjp.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2656 -
\??\c:\lpphhj.exec:\lpphhj.exe49⤵
- Executes dropped EXE
PID:2496 -
\??\c:\jhbtd.exec:\jhbtd.exe50⤵
- Executes dropped EXE
PID:1032 -
\??\c:\bjvjhbb.exec:\bjvjhbb.exe51⤵
- Executes dropped EXE
PID:1456 -
\??\c:\hfrjpvd.exec:\hfrjpvd.exe52⤵
- Executes dropped EXE
PID:1504 -
\??\c:\tjdxd.exec:\tjdxd.exe53⤵
- Executes dropped EXE
PID:1128 -
\??\c:\pfvppr.exec:\pfvppr.exe54⤵
- Executes dropped EXE
PID:1488 -
\??\c:\pdfrlbb.exec:\pdfrlbb.exe55⤵
- Executes dropped EXE
PID:2776 -
\??\c:\pnpbbr.exec:\pnpbbr.exe56⤵
- Executes dropped EXE
PID:1152 -
\??\c:\jdfnnnx.exec:\jdfnnnx.exe57⤵
- Executes dropped EXE
PID:2960 -
\??\c:\njvtrd.exec:\njvtrd.exe58⤵
- Executes dropped EXE
PID:2132 -
\??\c:\jnhnx.exec:\jnhnx.exe59⤵
- Executes dropped EXE
PID:2056 -
\??\c:\fddxd.exec:\fddxd.exe60⤵
- Executes dropped EXE
PID:1492 -
\??\c:\lfbnfv.exec:\lfbnfv.exe61⤵
- Executes dropped EXE
PID:2276 -
\??\c:\fpbdrhh.exec:\fpbdrhh.exe62⤵
- Executes dropped EXE
PID:2124 -
\??\c:\bpnvb.exec:\bpnvb.exe63⤵
- Executes dropped EXE
PID:1816 -
\??\c:\ptfrj.exec:\ptfrj.exe64⤵
- Executes dropped EXE
PID:1788 -
\??\c:\dljvfh.exec:\dljvfh.exe65⤵
- Executes dropped EXE
PID:560 -
\??\c:\bffvt.exec:\bffvt.exe66⤵PID:2860
-
\??\c:\jrdtd.exec:\jrdtd.exe67⤵PID:1732
-
\??\c:\rbhlpxr.exec:\rbhlpxr.exe68⤵PID:2216
-
\??\c:\fpjpn.exec:\fpjpn.exe69⤵PID:2164
-
\??\c:\vfbfnj.exec:\vfbfnj.exe70⤵PID:2400
-
\??\c:\hbnnjb.exec:\hbnnjb.exe71⤵PID:820
-
\??\c:\fvlnxrr.exec:\fvlnxrr.exe72⤵PID:2468
-
\??\c:\plnpbr.exec:\plnpbr.exe73⤵PID:2548
-
\??\c:\fdtvdl.exec:\fdtvdl.exe74⤵PID:2312
-
\??\c:\dpdtnjd.exec:\dpdtnjd.exe75⤵PID:2492
-
\??\c:\bffrrn.exec:\bffrrn.exe76⤵PID:2240
-
\??\c:\fhtvdlj.exec:\fhtvdlj.exe77⤵PID:2060
-
\??\c:\hjtnvx.exec:\hjtnvx.exe78⤵PID:2084
-
\??\c:\hrthl.exec:\hrthl.exe79⤵PID:1708
-
\??\c:\bnfbplh.exec:\bnfbplh.exe80⤵PID:2168
-
\??\c:\dxvnpt.exec:\dxvnpt.exe81⤵PID:2108
-
\??\c:\llhhx.exec:\llhhx.exe82⤵PID:2068
-
\??\c:\ptjxxfr.exec:\ptjxxfr.exe83⤵PID:2768
-
\??\c:\hpppn.exec:\hpppn.exe84⤵PID:2488
-
\??\c:\fdldxf.exec:\fdldxf.exe85⤵PID:2824
-
\??\c:\nfnxbt.exec:\nfnxbt.exe86⤵PID:2844
-
\??\c:\vfvftt.exec:\vfvftt.exe87⤵PID:1528
-
\??\c:\trhfjln.exec:\trhfjln.exe88⤵PID:2120
-
\??\c:\bdhpvnd.exec:\bdhpvnd.exe89⤵PID:2032
-
\??\c:\trfhndd.exec:\trfhndd.exe90⤵PID:1496
-
\??\c:\trxnbxn.exec:\trxnbxn.exe91⤵PID:2656
-
\??\c:\xrvnrbn.exec:\xrvnrbn.exe92⤵PID:1964
-
\??\c:\rdrtp.exec:\rdrtp.exe93⤵PID:2736
-
\??\c:\bftrx.exec:\bftrx.exe94⤵PID:2028
-
\??\c:\htjrjdj.exec:\htjrjdj.exe95⤵PID:2020
-
\??\c:\hhdbx.exec:\hhdbx.exe96⤵PID:2008
-
\??\c:\hxpdxn.exec:\hxpdxn.exe97⤵PID:1988
-
\??\c:\xvdbtn.exec:\xvdbtn.exe98⤵PID:2976
-
\??\c:\vxrjrpf.exec:\vxrjrpf.exe99⤵PID:2776
-
\??\c:\rrvdl.exec:\rrvdl.exe100⤵PID:1992
-
\??\c:\rrfxn.exec:\rrfxn.exe101⤵PID:2000
-
\??\c:\pfjhdl.exec:\pfjhdl.exe102⤵PID:676
-
\??\c:\dbnvbb.exec:\dbnvbb.exe103⤵PID:2428
-
\??\c:\vjhxnr.exec:\vjhxnr.exe104⤵PID:1808
-
\??\c:\pnfrrrv.exec:\pnfrrrv.exe105⤵PID:776
-
\??\c:\vfnrfb.exec:\vfnrfb.exe106⤵PID:1516
-
\??\c:\drxpt.exec:\drxpt.exe107⤵PID:1980
-
\??\c:\xxlpnf.exec:\xxlpnf.exe108⤵PID:3028
-
\??\c:\vhdldl.exec:\vhdldl.exe109⤵PID:1068
-
\??\c:\bljvrvl.exec:\bljvrvl.exe110⤵PID:1412
-
\??\c:\vhjvljx.exec:\vhjvljx.exe111⤵PID:1028
-
\??\c:\nvhxxpb.exec:\nvhxxpb.exe112⤵PID:1540
-
\??\c:\brvhb.exec:\brvhb.exe113⤵PID:1088
-
\??\c:\xdndjd.exec:\xdndjd.exe114⤵PID:2540
-
\??\c:\jltrbv.exec:\jltrbv.exe115⤵PID:1556
-
\??\c:\bhbjnp.exec:\bhbjnp.exe116⤵PID:2508
-
\??\c:\tbpbrjb.exec:\tbpbrjb.exe117⤵PID:2460
-
\??\c:\bdpxtr.exec:\bdpxtr.exe118⤵PID:2472
-
\??\c:\nthpv.exec:\nthpv.exe119⤵PID:1220
-
\??\c:\rvvhvrd.exec:\rvvhvrd.exe120⤵PID:2308
-
\??\c:\vnrbx.exec:\vnrbx.exe121⤵PID:1728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-