Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 19:31
Behavioral task
behavioral1
Sample
fd515df48333b61e1c5654b37577276bb0e3f608cf27e1313ba8ae8433040fbf.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
fd515df48333b61e1c5654b37577276bb0e3f608cf27e1313ba8ae8433040fbf.exe
-
Size
70KB
-
MD5
3f3695f7514ba291fdaa2a70b3e37db7
-
SHA1
55a26f1a7283d5fef987987e368ea9edfbee2590
-
SHA256
fd515df48333b61e1c5654b37577276bb0e3f608cf27e1313ba8ae8433040fbf
-
SHA512
0a202da9cf109d85d52d414cc41697bf912bd3361c00041078f3526579485105a8bb469f5a1882cbe3515ae229e3868242194b74886fa00699e6d4b58dcd2c36
-
SSDEEP
1536:0vQBeOGtrYS3srx93UBWfwC6Ggnouy8CUYj7qQhtr+mCaWVzC:0hOmTsF93UYfwC6GIoutX8hUDG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/3052-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1824-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-74-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2800-72-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2656-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-92-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/588-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1740-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1656-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1908-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1844-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1132-167-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2492-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1288-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-194-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1452-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2136-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/296-240-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1716-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-284-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1952-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/540-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/540-293-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2308-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-317-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2772-335-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2972-352-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2748-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-350-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/3064-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1028-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/264-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/316-493-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/912-498-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2176-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1548-556-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1548-557-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2536-570-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2448-572-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2752-588-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2076-596-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-603-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-648-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1056-661-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2368-675-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2368-673-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1116-702-0x00000000001C0000-0x00000000001E7000-memory.dmp family_blackmoon behavioral1/memory/692-715-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-760-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2076-875-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2008-962-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-1034-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1748-1069-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2176-1087-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2176-1089-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2304-1115-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2388-1127-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1824 lntjnxv.exe 2076 lblpfb.exe 2844 jjrhl.exe 2716 ntnxrx.exe 2648 rplvj.exe 2640 xxxtd.exe 2800 hlfhnn.exe 2656 dthvnt.exe 2480 tnltbxd.exe 1100 fvhdxn.exe 588 dpjbx.exe 1740 htjbp.exe 1656 hrndd.exe 780 txvhfh.exe 1908 dbfxdx.exe 1844 vnbrlpn.exe 1132 bbbtntf.exe 2492 nthph.exe 1288 dxpvd.exe 1644 vvlnrh.exe 956 rhjpr.exe 1748 hffpdv.exe 1452 fdhbxjf.exe 2136 xnnvnfx.exe 296 rjdpt.exe 1800 pbrft.exe 2056 tbxbbp.exe 1716 njhnpl.exe 2184 nlxpxbn.exe 1952 bfxlpl.exe 540 dfhbjpf.exe 2308 bpbvjtl.exe 2012 dxhdd.exe 2420 lthlb.exe 2996 jtnpl.exe 2716 fpnttfb.exe 2772 fdptxdb.exe 2728 tnfhjv.exe 2972 bvvrp.exe 2748 hhljfnv.exe 2784 pxdxnb.exe 2800 vnrdfn.exe 1648 xppnhbh.exe 3064 vxhthbt.exe 2592 dxjbrdt.exe 2920 ttjxtv.exe 388 djtxnx.exe 2032 hlplb.exe 2000 fdhrd.exe 568 fnlrfb.exe 1028 bnvtnh.exe 264 djvlhhn.exe 2792 ndtll.exe 1844 tjbxjph.exe 3016 rfdfxlv.exe 2344 bvvhnxb.exe 2148 pxftvx.exe 1988 xrxll.exe 2372 jdhfbvn.exe 1348 lrxhjl.exe 316 ttfjbxd.exe 912 tphvxx.exe 1508 vhnxx.exe 1536 vljhl.exe -
resource yara_rule behavioral1/memory/3052-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3052-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d0000000133b8-5.dat upx behavioral1/memory/1824-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2076-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d0c-19.dat upx behavioral1/memory/1824-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d2c-28.dat upx behavioral1/memory/2716-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d3f-38.dat upx behavioral1/files/0x0007000000016d52-46.dat upx behavioral1/memory/2844-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d5c-57.dat upx behavioral1/files/0x0008000000016d64-65.dat upx behavioral1/memory/2640-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2648-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0002000000018334-77.dat upx behavioral1/memory/2800-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2656-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a9-84.dat upx behavioral1/files/0x00050000000195ab-95.dat upx behavioral1/files/0x00050000000195ad-103.dat upx behavioral1/memory/588-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195af-115.dat upx behavioral1/memory/588-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b1-123.dat upx behavioral1/memory/1740-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016ce0-133.dat upx behavioral1/files/0x00050000000195b3-140.dat upx behavioral1/memory/1656-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b5-150.dat upx behavioral1/memory/1908-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1844-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b7-158.dat upx behavioral1/files/0x00050000000195bb-164.dat upx behavioral1/memory/2492-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195bd-176.dat upx behavioral1/files/0x00050000000195c1-187.dat upx behavioral1/memory/1288-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1644-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c3-197.dat upx behavioral1/files/0x00050000000195c5-206.dat upx behavioral1/files/0x00050000000195c6-213.dat upx behavioral1/files/0x00050000000195c7-223.dat upx behavioral1/memory/1452-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960c-231.dat upx behavioral1/memory/2136-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019643-241.dat upx behavioral1/files/0x000500000001975a-248.dat upx behavioral1/files/0x00050000000197fd-266.dat upx behavioral1/memory/1716-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019761-258.dat upx behavioral1/memory/2056-256-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019820-275.dat upx behavioral1/files/0x000500000001998d-281.dat upx behavioral1/memory/1952-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/540-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf5-295.dat upx behavioral1/memory/2308-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2012-310-0x00000000002B0000-0x00000000002D7000-memory.dmp upx behavioral1/memory/2420-338-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2772-335-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2748-354-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2972-350-0x00000000002C0000-0x00000000002E7000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbdbxrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjrxbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbvbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nptnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjlbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhrnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfbdtjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtjjpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpflt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnltbxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtpdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fphdfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdtlbdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djtjfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnpxxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btvfjlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtrdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvvxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlhdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbhpfpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljfhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnffh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phftnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjhvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhhvlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfpnbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdfdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhjdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfdfxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpbfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnptdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrddh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3052 wrote to memory of 1824 3052 fd515df48333b61e1c5654b37577276bb0e3f608cf27e1313ba8ae8433040fbf.exe 30 PID 3052 wrote to memory of 1824 3052 fd515df48333b61e1c5654b37577276bb0e3f608cf27e1313ba8ae8433040fbf.exe 30 PID 3052 wrote to memory of 1824 3052 fd515df48333b61e1c5654b37577276bb0e3f608cf27e1313ba8ae8433040fbf.exe 30 PID 3052 wrote to memory of 1824 3052 fd515df48333b61e1c5654b37577276bb0e3f608cf27e1313ba8ae8433040fbf.exe 30 PID 1824 wrote to memory of 2076 1824 lntjnxv.exe 31 PID 1824 wrote to memory of 2076 1824 lntjnxv.exe 31 PID 1824 wrote to memory of 2076 1824 lntjnxv.exe 31 PID 1824 wrote to memory of 2076 1824 lntjnxv.exe 31 PID 2076 wrote to memory of 2844 2076 lblpfb.exe 32 PID 2076 wrote to memory of 2844 2076 lblpfb.exe 32 PID 2076 wrote to memory of 2844 2076 lblpfb.exe 32 PID 2076 wrote to memory of 2844 2076 lblpfb.exe 32 PID 2844 wrote to memory of 2716 2844 jjrhl.exe 33 PID 2844 wrote to memory of 2716 2844 jjrhl.exe 33 PID 2844 wrote to memory of 2716 2844 jjrhl.exe 33 PID 2844 wrote to memory of 2716 2844 jjrhl.exe 33 PID 2716 wrote to memory of 2648 2716 ntnxrx.exe 34 PID 2716 wrote to memory of 2648 2716 ntnxrx.exe 34 PID 2716 wrote to memory of 2648 2716 ntnxrx.exe 34 PID 2716 wrote to memory of 2648 2716 ntnxrx.exe 34 PID 2648 wrote to memory of 2640 2648 rplvj.exe 35 PID 2648 wrote to memory of 2640 2648 rplvj.exe 35 PID 2648 wrote to memory of 2640 2648 rplvj.exe 35 PID 2648 wrote to memory of 2640 2648 rplvj.exe 35 PID 2640 wrote to memory of 2800 2640 xxxtd.exe 36 PID 2640 wrote to memory of 2800 2640 xxxtd.exe 36 PID 2640 wrote to memory of 2800 2640 xxxtd.exe 36 PID 2640 wrote to memory of 2800 2640 xxxtd.exe 36 PID 2800 wrote to memory of 2656 2800 hlfhnn.exe 37 PID 2800 wrote to memory of 2656 2800 hlfhnn.exe 37 PID 2800 wrote to memory of 2656 2800 hlfhnn.exe 37 PID 2800 wrote to memory of 2656 2800 hlfhnn.exe 37 PID 2656 wrote to memory of 2480 2656 dthvnt.exe 38 PID 2656 wrote to memory of 2480 2656 dthvnt.exe 38 PID 2656 wrote to memory of 2480 2656 dthvnt.exe 38 PID 2656 wrote to memory of 2480 2656 dthvnt.exe 38 PID 2480 wrote to memory of 1100 2480 tnltbxd.exe 39 PID 2480 wrote to memory of 1100 2480 tnltbxd.exe 39 PID 2480 wrote to memory of 1100 2480 tnltbxd.exe 39 PID 2480 wrote to memory of 1100 2480 tnltbxd.exe 39 PID 1100 wrote to memory of 588 1100 fvhdxn.exe 40 PID 1100 wrote to memory of 588 1100 fvhdxn.exe 40 PID 1100 wrote to memory of 588 1100 fvhdxn.exe 40 PID 1100 wrote to memory of 588 1100 fvhdxn.exe 40 PID 588 wrote to memory of 1740 588 dpjbx.exe 41 PID 588 wrote to memory of 1740 588 dpjbx.exe 41 PID 588 wrote to memory of 1740 588 dpjbx.exe 41 PID 588 wrote to memory of 1740 588 dpjbx.exe 41 PID 1740 wrote to memory of 1656 1740 htjbp.exe 42 PID 1740 wrote to memory of 1656 1740 htjbp.exe 42 PID 1740 wrote to memory of 1656 1740 htjbp.exe 42 PID 1740 wrote to memory of 1656 1740 htjbp.exe 42 PID 1656 wrote to memory of 780 1656 hrndd.exe 43 PID 1656 wrote to memory of 780 1656 hrndd.exe 43 PID 1656 wrote to memory of 780 1656 hrndd.exe 43 PID 1656 wrote to memory of 780 1656 hrndd.exe 43 PID 780 wrote to memory of 1908 780 txvhfh.exe 44 PID 780 wrote to memory of 1908 780 txvhfh.exe 44 PID 780 wrote to memory of 1908 780 txvhfh.exe 44 PID 780 wrote to memory of 1908 780 txvhfh.exe 44 PID 1908 wrote to memory of 1844 1908 dbfxdx.exe 45 PID 1908 wrote to memory of 1844 1908 dbfxdx.exe 45 PID 1908 wrote to memory of 1844 1908 dbfxdx.exe 45 PID 1908 wrote to memory of 1844 1908 dbfxdx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd515df48333b61e1c5654b37577276bb0e3f608cf27e1313ba8ae8433040fbf.exe"C:\Users\Admin\AppData\Local\Temp\fd515df48333b61e1c5654b37577276bb0e3f608cf27e1313ba8ae8433040fbf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\lntjnxv.exec:\lntjnxv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\lblpfb.exec:\lblpfb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\jjrhl.exec:\jjrhl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\ntnxrx.exec:\ntnxrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\rplvj.exec:\rplvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\xxxtd.exec:\xxxtd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\hlfhnn.exec:\hlfhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\dthvnt.exec:\dthvnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\tnltbxd.exec:\tnltbxd.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\fvhdxn.exec:\fvhdxn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\dpjbx.exec:\dpjbx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\htjbp.exec:\htjbp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\hrndd.exec:\hrndd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\txvhfh.exec:\txvhfh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\dbfxdx.exec:\dbfxdx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\vnbrlpn.exec:\vnbrlpn.exe17⤵
- Executes dropped EXE
PID:1844 -
\??\c:\bbbtntf.exec:\bbbtntf.exe18⤵
- Executes dropped EXE
PID:1132 -
\??\c:\nthph.exec:\nthph.exe19⤵
- Executes dropped EXE
PID:2492 -
\??\c:\dxpvd.exec:\dxpvd.exe20⤵
- Executes dropped EXE
PID:1288 -
\??\c:\vvlnrh.exec:\vvlnrh.exe21⤵
- Executes dropped EXE
PID:1644 -
\??\c:\rhjpr.exec:\rhjpr.exe22⤵
- Executes dropped EXE
PID:956 -
\??\c:\hffpdv.exec:\hffpdv.exe23⤵
- Executes dropped EXE
PID:1748 -
\??\c:\fdhbxjf.exec:\fdhbxjf.exe24⤵
- Executes dropped EXE
PID:1452 -
\??\c:\xnnvnfx.exec:\xnnvnfx.exe25⤵
- Executes dropped EXE
PID:2136 -
\??\c:\rjdpt.exec:\rjdpt.exe26⤵
- Executes dropped EXE
PID:296 -
\??\c:\pbrft.exec:\pbrft.exe27⤵
- Executes dropped EXE
PID:1800 -
\??\c:\tbxbbp.exec:\tbxbbp.exe28⤵
- Executes dropped EXE
PID:2056 -
\??\c:\njhnpl.exec:\njhnpl.exe29⤵
- Executes dropped EXE
PID:1716 -
\??\c:\nlxpxbn.exec:\nlxpxbn.exe30⤵
- Executes dropped EXE
PID:2184 -
\??\c:\bfxlpl.exec:\bfxlpl.exe31⤵
- Executes dropped EXE
PID:1952 -
\??\c:\dfhbjpf.exec:\dfhbjpf.exe32⤵
- Executes dropped EXE
PID:540 -
\??\c:\bpbvjtl.exec:\bpbvjtl.exe33⤵
- Executes dropped EXE
PID:2308 -
\??\c:\dxhdd.exec:\dxhdd.exe34⤵
- Executes dropped EXE
PID:2012 -
\??\c:\lthlb.exec:\lthlb.exe35⤵
- Executes dropped EXE
PID:2420 -
\??\c:\jtnpl.exec:\jtnpl.exe36⤵
- Executes dropped EXE
PID:2996 -
\??\c:\fpnttfb.exec:\fpnttfb.exe37⤵
- Executes dropped EXE
PID:2716 -
\??\c:\fdptxdb.exec:\fdptxdb.exe38⤵
- Executes dropped EXE
PID:2772 -
\??\c:\tnfhjv.exec:\tnfhjv.exe39⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bvvrp.exec:\bvvrp.exe40⤵
- Executes dropped EXE
PID:2972 -
\??\c:\hhljfnv.exec:\hhljfnv.exe41⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pxdxnb.exec:\pxdxnb.exe42⤵
- Executes dropped EXE
PID:2784 -
\??\c:\vnrdfn.exec:\vnrdfn.exe43⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xppnhbh.exec:\xppnhbh.exe44⤵
- Executes dropped EXE
PID:1648 -
\??\c:\vxhthbt.exec:\vxhthbt.exe45⤵
- Executes dropped EXE
PID:3064 -
\??\c:\dxjbrdt.exec:\dxjbrdt.exe46⤵
- Executes dropped EXE
PID:2592 -
\??\c:\ttjxtv.exec:\ttjxtv.exe47⤵
- Executes dropped EXE
PID:2920 -
\??\c:\djtxnx.exec:\djtxnx.exe48⤵
- Executes dropped EXE
PID:388 -
\??\c:\hlplb.exec:\hlplb.exe49⤵
- Executes dropped EXE
PID:2032 -
\??\c:\fdhrd.exec:\fdhrd.exe50⤵
- Executes dropped EXE
PID:2000 -
\??\c:\fnlrfb.exec:\fnlrfb.exe51⤵
- Executes dropped EXE
PID:568 -
\??\c:\bnvtnh.exec:\bnvtnh.exe52⤵
- Executes dropped EXE
PID:1028 -
\??\c:\djvlhhn.exec:\djvlhhn.exe53⤵
- Executes dropped EXE
PID:264 -
\??\c:\ndtll.exec:\ndtll.exe54⤵
- Executes dropped EXE
PID:2792 -
\??\c:\tjbxjph.exec:\tjbxjph.exe55⤵
- Executes dropped EXE
PID:1844 -
\??\c:\rfdfxlv.exec:\rfdfxlv.exe56⤵
- Executes dropped EXE
PID:3016 -
\??\c:\bvvhnxb.exec:\bvvhnxb.exe57⤵
- Executes dropped EXE
PID:2344 -
\??\c:\pxftvx.exec:\pxftvx.exe58⤵
- Executes dropped EXE
PID:2148 -
\??\c:\xrxll.exec:\xrxll.exe59⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jdhfbvn.exec:\jdhfbvn.exe60⤵
- Executes dropped EXE
PID:2372 -
\??\c:\lrxhjl.exec:\lrxhjl.exe61⤵
- Executes dropped EXE
PID:1348 -
\??\c:\ttfjbxd.exec:\ttfjbxd.exe62⤵
- Executes dropped EXE
PID:316 -
\??\c:\tphvxx.exec:\tphvxx.exe63⤵
- Executes dropped EXE
PID:912 -
\??\c:\vhnxx.exec:\vhnxx.exe64⤵
- Executes dropped EXE
PID:1508 -
\??\c:\vljhl.exec:\vljhl.exe65⤵
- Executes dropped EXE
PID:1536 -
\??\c:\nrbbr.exec:\nrbbr.exe66⤵PID:1036
-
\??\c:\jflpnr.exec:\jflpnr.exe67⤵PID:932
-
\??\c:\lljhv.exec:\lljhv.exe68⤵PID:704
-
\??\c:\fvvlvv.exec:\fvvlvv.exe69⤵PID:2176
-
\??\c:\fvnhd.exec:\fvnhd.exe70⤵PID:2284
-
\??\c:\drllnbp.exec:\drllnbp.exe71⤵PID:2448
-
\??\c:\jhxdt.exec:\jhxdt.exe72⤵PID:1548
-
\??\c:\nvnvtft.exec:\nvnvtft.exe73⤵PID:2260
-
\??\c:\xlpddrx.exec:\xlpddrx.exe74⤵PID:2536
-
\??\c:\dpntlb.exec:\dpntlb.exe75⤵PID:2564
-
\??\c:\rhpvxhn.exec:\rhpvxhn.exe76⤵PID:2016
-
\??\c:\fdvrjpp.exec:\fdvrjpp.exe77⤵PID:2752
-
\??\c:\fhdpt.exec:\fhdpt.exe78⤵PID:2076
-
\??\c:\lvffbvv.exec:\lvffbvv.exe79⤵PID:2760
-
\??\c:\jxtjtbx.exec:\jxtjtbx.exe80⤵PID:2620
-
\??\c:\rnhvh.exec:\rnhvh.exe81⤵PID:2988
-
\??\c:\bbfbnxn.exec:\bbfbnxn.exe82⤵PID:1608
-
\??\c:\hnpfrpn.exec:\hnpfrpn.exe83⤵PID:2108
-
\??\c:\fvhplvx.exec:\fvhplvx.exe84⤵PID:2724
-
\??\c:\vlfvxd.exec:\vlfvxd.exe85⤵PID:2684
-
\??\c:\lpphx.exec:\lpphx.exe86⤵PID:2688
-
\??\c:\pdpdj.exec:\pdpdj.exe87⤵PID:2664
-
\??\c:\txdxp.exec:\txdxp.exe88⤵PID:1056
-
\??\c:\xlfrh.exec:\xlfrh.exe89⤵
- System Location Discovery: System Language Discovery
PID:1676 -
\??\c:\nfljf.exec:\nfljf.exe90⤵PID:2368
-
\??\c:\rhffvf.exec:\rhffvf.exe91⤵PID:588
-
\??\c:\rdphljn.exec:\rdphljn.exe92⤵PID:2356
-
\??\c:\pdrhvp.exec:\pdrhvp.exe93⤵PID:1668
-
\??\c:\flnfd.exec:\flnfd.exe94⤵PID:1116
-
\??\c:\xrrldf.exec:\xrrldf.exe95⤵PID:584
-
\??\c:\fdrrj.exec:\fdrrj.exe96⤵PID:692
-
\??\c:\pvhplj.exec:\pvhplj.exe97⤵PID:2428
-
\??\c:\xlhdfdx.exec:\xlhdfdx.exe98⤵PID:1844
-
\??\c:\xrtrx.exec:\xrtrx.exe99⤵PID:2208
-
\??\c:\ltfdnb.exec:\ltfdnb.exe100⤵PID:2160
-
\??\c:\rndtd.exec:\rndtd.exe101⤵PID:860
-
\??\c:\fjxpdr.exec:\fjxpdr.exe102⤵PID:1988
-
\??\c:\vtbfb.exec:\vtbfb.exe103⤵PID:2372
-
\??\c:\pvlpdnv.exec:\pvlpdnv.exe104⤵PID:976
-
\??\c:\bpfhvx.exec:\bpfhvx.exe105⤵PID:1620
-
\??\c:\jvpbn.exec:\jvpbn.exe106⤵PID:2132
-
\??\c:\jltvv.exec:\jltvv.exe107⤵PID:2916
-
\??\c:\jrvnxjl.exec:\jrvnxjl.exe108⤵PID:1856
-
\??\c:\pnhhlxr.exec:\pnhhlxr.exe109⤵PID:2152
-
\??\c:\bnjdb.exec:\bnjdb.exe110⤵PID:2220
-
\??\c:\nnrxh.exec:\nnrxh.exe111⤵PID:2088
-
\??\c:\jrjfjlp.exec:\jrjfjlp.exe112⤵PID:824
-
\??\c:\bdvltn.exec:\bdvltn.exe113⤵PID:548
-
\??\c:\hhfdvh.exec:\hhfdvh.exe114⤵PID:2448
-
\??\c:\vlvdp.exec:\vlvdp.exe115⤵PID:3024
-
\??\c:\hjhlb.exec:\hjhlb.exe116⤵PID:1504
-
\??\c:\rxvxdp.exec:\rxvxdp.exe117⤵PID:3056
-
\??\c:\txpfft.exec:\txpfft.exe118⤵PID:2308
-
\??\c:\frrdtx.exec:\frrdtx.exe119⤵PID:1636
-
\??\c:\jplnbt.exec:\jplnbt.exe120⤵PID:1824
-
\??\c:\dllbfn.exec:\dllbfn.exe121⤵PID:2828
-
\??\c:\xxvbp.exec:\xxvbp.exe122⤵PID:2076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-