Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 22:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e1c6bbd9c7285f5d405fd5d7243e0878cbdc4cbcdd1d2eea3bfa1fcf09c7f241N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e1c6bbd9c7285f5d405fd5d7243e0878cbdc4cbcdd1d2eea3bfa1fcf09c7f241N.exe
-
Size
455KB
-
MD5
07a27ece8d4cc6fae2a4d852ebb5b890
-
SHA1
57b48568013b656d505d8affe4a97fc233390310
-
SHA256
e1c6bbd9c7285f5d405fd5d7243e0878cbdc4cbcdd1d2eea3bfa1fcf09c7f241
-
SHA512
7db9af0aca7822b7ee6f87f85361429931df3552d130b052cd8cc47fef9597b6cd83473c8c6dd6f8b859db510e38bd2c913d53ba4b5017abb64813026d318e8c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/1820-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-41-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2924-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-89-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/1760-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-157-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2392-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-215-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2932-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-317-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2440-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-396-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2220-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-490-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2644-495-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1536-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-616-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2752-648-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-683-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3008 ftrft.exe 2072 llvdp.exe 2976 nfnbp.exe 2924 nphnjn.exe 2904 fbhbhv.exe 2724 hjlpvj.exe 2800 jrrfbl.exe 1388 rpdjblh.exe 1496 hxrjhx.exe 2672 fjtvv.exe 1760 rjlbt.exe 1240 bvpvld.exe 2084 nnrrh.exe 2192 dltfdhj.exe 3048 bhnpxd.exe 2392 vbjbj.exe 844 bdbfpdb.exe 2040 vtxvfx.exe 2640 xxjdrj.exe 2080 rjltdr.exe 2164 jldtnx.exe 2480 flbhnb.exe 2520 llplrh.exe 1980 bjvhv.exe 2932 dxplbht.exe 1548 hjrfjnf.exe 1652 xtvhh.exe 2096 trfvnb.exe 2484 rbphp.exe 1728 dpbtbxr.exe 672 frhdtr.exe 1516 ljnxh.exe 2268 drhxh.exe 1604 xlnjv.exe 2504 bjjhjth.exe 2964 frjhvdd.exe 2332 flbfjj.exe 2752 rphbtr.exe 2440 ntrpv.exe 2840 jhrjbnj.exe 2784 hjvxhnf.exe 2792 ftddttr.exe 2224 hpjvb.exe 2704 hhvjvbh.exe 2388 npvhlp.exe 2220 jfxnld.exe 1620 lxfjf.exe 1748 tfjrpr.exe 2172 tddbbv.exe 2160 jnnxn.exe 2600 vhdbh.exe 2416 llrdxdb.exe 2648 rdvxxtj.exe 3028 pxxbjb.exe 1224 fthhn.exe 1920 jfvbhfh.exe 2908 lnhtj.exe 2208 vthpb.exe 2644 jfrdv.exe 2080 lrfdbb.exe 1536 lxdbtt.exe 1328 bpppj.exe 2680 dpltrb.exe 948 tnrbhbl.exe -
resource yara_rule behavioral1/memory/1820-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-157-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2392-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-490-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1536-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-616-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2752-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-698-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrfhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjvhxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhbbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbpxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfbtdtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhhvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhxfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvfntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxbplb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtpfpjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bldfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbxxdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntfrhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frnxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llltd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxhpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txdjptp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpnptnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtdxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlhtxbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvhdbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjxjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntrpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxdfrrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brhjvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dljhrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thxbbxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjnrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plrpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brjjvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfvnvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntxxxjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvhvlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjnvxvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnpjxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrrplx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dttjrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntvph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhpdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvpvld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxfjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfnnbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xthnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drjlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthrdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfnvxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrvnx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1820 wrote to memory of 3008 1820 e1c6bbd9c7285f5d405fd5d7243e0878cbdc4cbcdd1d2eea3bfa1fcf09c7f241N.exe 29 PID 1820 wrote to memory of 3008 1820 e1c6bbd9c7285f5d405fd5d7243e0878cbdc4cbcdd1d2eea3bfa1fcf09c7f241N.exe 29 PID 1820 wrote to memory of 3008 1820 e1c6bbd9c7285f5d405fd5d7243e0878cbdc4cbcdd1d2eea3bfa1fcf09c7f241N.exe 29 PID 1820 wrote to memory of 3008 1820 e1c6bbd9c7285f5d405fd5d7243e0878cbdc4cbcdd1d2eea3bfa1fcf09c7f241N.exe 29 PID 3008 wrote to memory of 2072 3008 ftrft.exe 30 PID 3008 wrote to memory of 2072 3008 ftrft.exe 30 PID 3008 wrote to memory of 2072 3008 ftrft.exe 30 PID 3008 wrote to memory of 2072 3008 ftrft.exe 30 PID 2072 wrote to memory of 2976 2072 llvdp.exe 31 PID 2072 wrote to memory of 2976 2072 llvdp.exe 31 PID 2072 wrote to memory of 2976 2072 llvdp.exe 31 PID 2072 wrote to memory of 2976 2072 llvdp.exe 31 PID 2976 wrote to memory of 2924 2976 nfnbp.exe 32 PID 2976 wrote to memory of 2924 2976 nfnbp.exe 32 PID 2976 wrote to memory of 2924 2976 nfnbp.exe 32 PID 2976 wrote to memory of 2924 2976 nfnbp.exe 32 PID 2924 wrote to memory of 2904 2924 nphnjn.exe 33 PID 2924 wrote to memory of 2904 2924 nphnjn.exe 33 PID 2924 wrote to memory of 2904 2924 nphnjn.exe 33 PID 2924 wrote to memory of 2904 2924 nphnjn.exe 33 PID 2904 wrote to memory of 2724 2904 fbhbhv.exe 34 PID 2904 wrote to memory of 2724 2904 fbhbhv.exe 34 PID 2904 wrote to memory of 2724 2904 fbhbhv.exe 34 PID 2904 wrote to memory of 2724 2904 fbhbhv.exe 34 PID 2724 wrote to memory of 2800 2724 hjlpvj.exe 35 PID 2724 wrote to memory of 2800 2724 hjlpvj.exe 35 PID 2724 wrote to memory of 2800 2724 hjlpvj.exe 35 PID 2724 wrote to memory of 2800 2724 hjlpvj.exe 35 PID 2800 wrote to memory of 1388 2800 jrrfbl.exe 36 PID 2800 wrote to memory of 1388 2800 jrrfbl.exe 36 PID 2800 wrote to memory of 1388 2800 jrrfbl.exe 36 PID 2800 wrote to memory of 1388 2800 jrrfbl.exe 36 PID 1388 wrote to memory of 1496 1388 rpdjblh.exe 37 PID 1388 wrote to memory of 1496 1388 rpdjblh.exe 37 PID 1388 wrote to memory of 1496 1388 rpdjblh.exe 37 PID 1388 wrote to memory of 1496 1388 rpdjblh.exe 37 PID 1496 wrote to memory of 2672 1496 hxrjhx.exe 38 PID 1496 wrote to memory of 2672 1496 hxrjhx.exe 38 PID 1496 wrote to memory of 2672 1496 hxrjhx.exe 38 PID 1496 wrote to memory of 2672 1496 hxrjhx.exe 38 PID 2672 wrote to memory of 1760 2672 fjtvv.exe 39 PID 2672 wrote to memory of 1760 2672 fjtvv.exe 39 PID 2672 wrote to memory of 1760 2672 fjtvv.exe 39 PID 2672 wrote to memory of 1760 2672 fjtvv.exe 39 PID 1760 wrote to memory of 1240 1760 rjlbt.exe 40 PID 1760 wrote to memory of 1240 1760 rjlbt.exe 40 PID 1760 wrote to memory of 1240 1760 rjlbt.exe 40 PID 1760 wrote to memory of 1240 1760 rjlbt.exe 40 PID 1240 wrote to memory of 2084 1240 bvpvld.exe 41 PID 1240 wrote to memory of 2084 1240 bvpvld.exe 41 PID 1240 wrote to memory of 2084 1240 bvpvld.exe 41 PID 1240 wrote to memory of 2084 1240 bvpvld.exe 41 PID 2084 wrote to memory of 2192 2084 nnrrh.exe 42 PID 2084 wrote to memory of 2192 2084 nnrrh.exe 42 PID 2084 wrote to memory of 2192 2084 nnrrh.exe 42 PID 2084 wrote to memory of 2192 2084 nnrrh.exe 42 PID 2192 wrote to memory of 3048 2192 dltfdhj.exe 43 PID 2192 wrote to memory of 3048 2192 dltfdhj.exe 43 PID 2192 wrote to memory of 3048 2192 dltfdhj.exe 43 PID 2192 wrote to memory of 3048 2192 dltfdhj.exe 43 PID 3048 wrote to memory of 2392 3048 bhnpxd.exe 44 PID 3048 wrote to memory of 2392 3048 bhnpxd.exe 44 PID 3048 wrote to memory of 2392 3048 bhnpxd.exe 44 PID 3048 wrote to memory of 2392 3048 bhnpxd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1c6bbd9c7285f5d405fd5d7243e0878cbdc4cbcdd1d2eea3bfa1fcf09c7f241N.exe"C:\Users\Admin\AppData\Local\Temp\e1c6bbd9c7285f5d405fd5d7243e0878cbdc4cbcdd1d2eea3bfa1fcf09c7f241N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\ftrft.exec:\ftrft.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\llvdp.exec:\llvdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\nfnbp.exec:\nfnbp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\nphnjn.exec:\nphnjn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\fbhbhv.exec:\fbhbhv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\hjlpvj.exec:\hjlpvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\jrrfbl.exec:\jrrfbl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\rpdjblh.exec:\rpdjblh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\hxrjhx.exec:\hxrjhx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\fjtvv.exec:\fjtvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\rjlbt.exec:\rjlbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\bvpvld.exec:\bvpvld.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\nnrrh.exec:\nnrrh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\dltfdhj.exec:\dltfdhj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\bhnpxd.exec:\bhnpxd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\vbjbj.exec:\vbjbj.exe17⤵
- Executes dropped EXE
PID:2392 -
\??\c:\bdbfpdb.exec:\bdbfpdb.exe18⤵
- Executes dropped EXE
PID:844 -
\??\c:\vtxvfx.exec:\vtxvfx.exe19⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xxjdrj.exec:\xxjdrj.exe20⤵
- Executes dropped EXE
PID:2640 -
\??\c:\rjltdr.exec:\rjltdr.exe21⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jldtnx.exec:\jldtnx.exe22⤵
- Executes dropped EXE
PID:2164 -
\??\c:\flbhnb.exec:\flbhnb.exe23⤵
- Executes dropped EXE
PID:2480 -
\??\c:\llplrh.exec:\llplrh.exe24⤵
- Executes dropped EXE
PID:2520 -
\??\c:\bjvhv.exec:\bjvhv.exe25⤵
- Executes dropped EXE
PID:1980 -
\??\c:\dxplbht.exec:\dxplbht.exe26⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hjrfjnf.exec:\hjrfjnf.exe27⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xtvhh.exec:\xtvhh.exe28⤵
- Executes dropped EXE
PID:1652 -
\??\c:\trfvnb.exec:\trfvnb.exe29⤵
- Executes dropped EXE
PID:2096 -
\??\c:\rbphp.exec:\rbphp.exe30⤵
- Executes dropped EXE
PID:2484 -
\??\c:\dpbtbxr.exec:\dpbtbxr.exe31⤵
- Executes dropped EXE
PID:1728 -
\??\c:\frhdtr.exec:\frhdtr.exe32⤵
- Executes dropped EXE
PID:672 -
\??\c:\ljnxh.exec:\ljnxh.exe33⤵
- Executes dropped EXE
PID:1516 -
\??\c:\drhxh.exec:\drhxh.exe34⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xlnjv.exec:\xlnjv.exe35⤵
- Executes dropped EXE
PID:1604 -
\??\c:\bjjhjth.exec:\bjjhjth.exe36⤵
- Executes dropped EXE
PID:2504 -
\??\c:\frjhvdd.exec:\frjhvdd.exe37⤵
- Executes dropped EXE
PID:2964 -
\??\c:\flbfjj.exec:\flbfjj.exe38⤵
- Executes dropped EXE
PID:2332 -
\??\c:\rphbtr.exec:\rphbtr.exe39⤵
- Executes dropped EXE
PID:2752 -
\??\c:\ntrpv.exec:\ntrpv.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2440 -
\??\c:\jhrjbnj.exec:\jhrjbnj.exe41⤵
- Executes dropped EXE
PID:2840 -
\??\c:\hjvxhnf.exec:\hjvxhnf.exe42⤵
- Executes dropped EXE
PID:2784 -
\??\c:\ftddttr.exec:\ftddttr.exe43⤵
- Executes dropped EXE
PID:2792 -
\??\c:\hpjvb.exec:\hpjvb.exe44⤵
- Executes dropped EXE
PID:2224 -
\??\c:\hhvjvbh.exec:\hhvjvbh.exe45⤵
- Executes dropped EXE
PID:2704 -
\??\c:\npvhlp.exec:\npvhlp.exe46⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jfxnld.exec:\jfxnld.exe47⤵
- Executes dropped EXE
PID:2220 -
\??\c:\lxfjf.exec:\lxfjf.exe48⤵
- Executes dropped EXE
PID:1620 -
\??\c:\tfjrpr.exec:\tfjrpr.exe49⤵
- Executes dropped EXE
PID:1748 -
\??\c:\tddbbv.exec:\tddbbv.exe50⤵
- Executes dropped EXE
PID:2172 -
\??\c:\jnnxn.exec:\jnnxn.exe51⤵
- Executes dropped EXE
PID:2160 -
\??\c:\vhdbh.exec:\vhdbh.exe52⤵
- Executes dropped EXE
PID:2600 -
\??\c:\llrdxdb.exec:\llrdxdb.exe53⤵
- Executes dropped EXE
PID:2416 -
\??\c:\rdvxxtj.exec:\rdvxxtj.exe54⤵
- Executes dropped EXE
PID:2648 -
\??\c:\pxxbjb.exec:\pxxbjb.exe55⤵
- Executes dropped EXE
PID:3028 -
\??\c:\fthhn.exec:\fthhn.exe56⤵
- Executes dropped EXE
PID:1224 -
\??\c:\jfvbhfh.exec:\jfvbhfh.exe57⤵
- Executes dropped EXE
PID:1920 -
\??\c:\lnhtj.exec:\lnhtj.exe58⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vthpb.exec:\vthpb.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jfrdv.exec:\jfrdv.exe60⤵
- Executes dropped EXE
PID:2644 -
\??\c:\lrfdbb.exec:\lrfdbb.exe61⤵
- Executes dropped EXE
PID:2080 -
\??\c:\lxdbtt.exec:\lxdbtt.exe62⤵
- Executes dropped EXE
PID:1536 -
\??\c:\bpppj.exec:\bpppj.exe63⤵
- Executes dropped EXE
PID:1328 -
\??\c:\dpltrb.exec:\dpltrb.exe64⤵
- Executes dropped EXE
PID:2680 -
\??\c:\tnrbhbl.exec:\tnrbhbl.exe65⤵
- Executes dropped EXE
PID:948 -
\??\c:\fvrbn.exec:\fvrbn.exe66⤵PID:2324
-
\??\c:\lllbhhv.exec:\lllbhhv.exe67⤵PID:1532
-
\??\c:\xjpjfxl.exec:\xjpjfxl.exe68⤵PID:1732
-
\??\c:\hfxbx.exec:\hfxbx.exe69⤵PID:1016
-
\??\c:\vxrdrl.exec:\vxrdrl.exe70⤵PID:304
-
\??\c:\fjldt.exec:\fjldt.exe71⤵PID:1044
-
\??\c:\vdljd.exec:\vdljd.exe72⤵PID:1040
-
\??\c:\tbvbdxb.exec:\tbvbdxb.exe73⤵PID:1740
-
\??\c:\fjnrlf.exec:\fjnrlf.exe74⤵
- System Location Discovery: System Language Discovery
PID:944 -
\??\c:\fxvjd.exec:\fxvjd.exe75⤵PID:1408
-
\??\c:\jdfjph.exec:\jdfjph.exe76⤵PID:3020
-
\??\c:\htfddl.exec:\htfddl.exe77⤵PID:1600
-
\??\c:\vhpft.exec:\vhpft.exe78⤵PID:1608
-
\??\c:\fhfjh.exec:\fhfjh.exe79⤵PID:928
-
\??\c:\tfpfnb.exec:\tfpfnb.exe80⤵PID:2996
-
\??\c:\nfbjxjj.exec:\nfbjxjj.exe81⤵PID:2732
-
\??\c:\nvbpp.exec:\nvbpp.exe82⤵PID:2332
-
\??\c:\jxnjp.exec:\jxnjp.exe83⤵PID:2752
-
\??\c:\lbbnnnn.exec:\lbbnnnn.exe84⤵
- System Location Discovery: System Language Discovery
PID:3024 -
\??\c:\bxvxx.exec:\bxvxx.exe85⤵PID:2720
-
\??\c:\ndjlv.exec:\ndjlv.exe86⤵PID:2896
-
\??\c:\jvhjhpp.exec:\jvhjhpp.exe87⤵PID:2804
-
\??\c:\dxfrfnr.exec:\dxfrfnr.exe88⤵PID:1668
-
\??\c:\nhjtblp.exec:\nhjtblp.exe89⤵PID:540
-
\??\c:\vhrdfp.exec:\vhrdfp.exe90⤵PID:2228
-
\??\c:\xbdprf.exec:\xbdprf.exe91⤵PID:2356
-
\??\c:\bbrrh.exec:\bbrrh.exe92⤵PID:2576
-
\??\c:\xpbvjh.exec:\xpbvjh.exe93⤵PID:2552
-
\??\c:\bjpbhn.exec:\bjpbhn.exe94⤵PID:2172
-
\??\c:\brrlvx.exec:\brrlvx.exe95⤵PID:2160
-
\??\c:\xtvtfd.exec:\xtvtfd.exe96⤵PID:2468
-
\??\c:\lfxxfp.exec:\lfxxfp.exe97⤵PID:2416
-
\??\c:\brrfbfx.exec:\brrfbfx.exe98⤵PID:2300
-
\??\c:\ffnbnp.exec:\ffnbnp.exe99⤵PID:1848
-
\??\c:\pnlnv.exec:\pnlnv.exe100⤵PID:2204
-
\??\c:\fvnld.exec:\fvnld.exe101⤵PID:1920
-
\??\c:\jphvv.exec:\jphvv.exe102⤵PID:2908
-
\??\c:\rppvtjr.exec:\rppvtjr.exe103⤵PID:2120
-
\??\c:\dlvnlf.exec:\dlvnlf.exe104⤵PID:2644
-
\??\c:\jbrtlfv.exec:\jbrtlfv.exe105⤵PID:572
-
\??\c:\pxrdphr.exec:\pxrdphr.exe106⤵PID:524
-
\??\c:\hhhjj.exec:\hhhjj.exe107⤵PID:1560
-
\??\c:\rlppvvx.exec:\rlppvvx.exe108⤵PID:1716
-
\??\c:\bdnfth.exec:\bdnfth.exe109⤵PID:896
-
\??\c:\fxttrf.exec:\fxttrf.exe110⤵PID:1676
-
\??\c:\jjdfhx.exec:\jjdfhx.exe111⤵PID:1360
-
\??\c:\ftfvpp.exec:\ftfvpp.exe112⤵PID:932
-
\??\c:\rbxxr.exec:\rbxxr.exe113⤵PID:1656
-
\??\c:\vxrxhh.exec:\vxrxhh.exe114⤵PID:956
-
\??\c:\jlfrrx.exec:\jlfrrx.exe115⤵PID:1480
-
\??\c:\tlfrnfj.exec:\tlfrnfj.exe116⤵PID:2260
-
\??\c:\tdbbnx.exec:\tdbbnx.exe117⤵PID:1968
-
\??\c:\jtlln.exec:\jtlln.exe118⤵PID:672
-
\??\c:\dllbrfn.exec:\dllbrfn.exe119⤵PID:548
-
\??\c:\fntff.exec:\fntff.exe120⤵PID:652
-
\??\c:\pbxxdl.exec:\pbxxdl.exe121⤵
- System Location Discovery: System Language Discovery
PID:1600 -
\??\c:\prhpx.exec:\prhpx.exe122⤵PID:1608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-