Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 03:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3482ec7f059ffbfe72fe4c8828686c7c3009b17ad72a37d275d4d767bc132994.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
3482ec7f059ffbfe72fe4c8828686c7c3009b17ad72a37d275d4d767bc132994.exe
-
Size
454KB
-
MD5
fe44e91b80a4d7160a68a8620e1ffc0e
-
SHA1
fc90233e18451e40f10de7f0a2503aa56d307031
-
SHA256
3482ec7f059ffbfe72fe4c8828686c7c3009b17ad72a37d275d4d767bc132994
-
SHA512
819087618b66be5831ab5bc6bc927d72649f8ba951b26e07ac0d4ee16f1d7062531b5c8a746447cc09691ae5f3b34eb2c9bfce973a1fd78e0c0f5d85581ec426
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeB:q7Tc2NYHUrAwfMp3CDB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/3008-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-19-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2868-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-159-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/852-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-174-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2404-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-233-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2252-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-353-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2980-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-414-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2500-449-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1304-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/672-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-700-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2480-801-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1328-807-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1708-899-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-898-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3008 dhvdh.exe 2868 rfrpjd.exe 2332 blltnd.exe 2980 tdtvvdv.exe 2936 rlplx.exe 2724 frlpj.exe 2800 tfxdtb.exe 2092 ttnhhb.exe 1496 lfbxvh.exe 2672 rpvnx.exe 1760 hrbvrjj.exe 1240 ljxjblr.exe 2160 jhthn.exe 2192 prdlb.exe 2500 drpbdt.exe 2376 jjnhfj.exe 852 fxtbtx.exe 2124 lvvrlnf.exe 2188 btrvptt.exe 2404 tnfjx.exe 2076 drnnj.exe 1148 pvhbl.exe 1004 ptlpp.exe 1980 tfjvpp.exe 2252 xdnjhdj.exe 1676 dtpxrj.exe 932 djbdph.exe 1044 pdfjlvh.exe 956 hrfhvpt.exe 1104 ltbbrx.exe 1808 xlntdv.exe 1628 rjhln.exe 3020 hdlflx.exe 2488 pjfxldb.exe 3008 pplhx.exe 1600 nlrxd.exe 2956 xtjbft.exe 2852 dvvltff.exe 2508 bfhdtj.exe 2904 vfrvrft.exe 2980 fvltd.exe 2900 rjrhxfn.exe 2848 vlhxxt.exe 2800 fddxl.exe 2708 hrrpx.exe 1300 llpbll.exe 2284 ddpxl.exe 744 vhlvnvf.exe 2356 tnvpnb.exe 3052 xbndxl.exe 1240 hllpl.exe 2308 djnnbl.exe 2300 vljdln.exe 2500 pjjrvp.exe 3028 jrhthjl.exe 1848 tljtb.exe 2352 lhdlx.exe 2184 fndrt.exe 2644 rxlnlnh.exe 2080 fflrv.exe 2112 lthjhf.exe 2292 dtxfbd.exe 2480 tnlbhd.exe 1148 tbhxj.exe -
resource yara_rule behavioral1/memory/3008-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/928-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/928-567-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/672-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-899-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-898-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndjdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbpvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fphxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prvtdfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbtjxtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfbxvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thlxhrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbftll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnrfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjlhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjxhbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlhpjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpvdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxnxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxbxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpdbdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnfnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxtbtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpxxpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjbjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpvnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbdnbxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlfbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vffnpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thrrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvdxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfrvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxnrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pblvrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvfhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljhjrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fndvdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdltr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpxbtfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbblj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdtrxvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1820 wrote to memory of 3008 1820 3482ec7f059ffbfe72fe4c8828686c7c3009b17ad72a37d275d4d767bc132994.exe 29 PID 1820 wrote to memory of 3008 1820 3482ec7f059ffbfe72fe4c8828686c7c3009b17ad72a37d275d4d767bc132994.exe 29 PID 1820 wrote to memory of 3008 1820 3482ec7f059ffbfe72fe4c8828686c7c3009b17ad72a37d275d4d767bc132994.exe 29 PID 1820 wrote to memory of 3008 1820 3482ec7f059ffbfe72fe4c8828686c7c3009b17ad72a37d275d4d767bc132994.exe 29 PID 3008 wrote to memory of 2868 3008 dhvdh.exe 30 PID 3008 wrote to memory of 2868 3008 dhvdh.exe 30 PID 3008 wrote to memory of 2868 3008 dhvdh.exe 30 PID 3008 wrote to memory of 2868 3008 dhvdh.exe 30 PID 2868 wrote to memory of 2332 2868 rfrpjd.exe 31 PID 2868 wrote to memory of 2332 2868 rfrpjd.exe 31 PID 2868 wrote to memory of 2332 2868 rfrpjd.exe 31 PID 2868 wrote to memory of 2332 2868 rfrpjd.exe 31 PID 2332 wrote to memory of 2980 2332 blltnd.exe 32 PID 2332 wrote to memory of 2980 2332 blltnd.exe 32 PID 2332 wrote to memory of 2980 2332 blltnd.exe 32 PID 2332 wrote to memory of 2980 2332 blltnd.exe 32 PID 2980 wrote to memory of 2936 2980 tdtvvdv.exe 33 PID 2980 wrote to memory of 2936 2980 tdtvvdv.exe 33 PID 2980 wrote to memory of 2936 2980 tdtvvdv.exe 33 PID 2980 wrote to memory of 2936 2980 tdtvvdv.exe 33 PID 2936 wrote to memory of 2724 2936 rlplx.exe 34 PID 2936 wrote to memory of 2724 2936 rlplx.exe 34 PID 2936 wrote to memory of 2724 2936 rlplx.exe 34 PID 2936 wrote to memory of 2724 2936 rlplx.exe 34 PID 2724 wrote to memory of 2800 2724 frlpj.exe 35 PID 2724 wrote to memory of 2800 2724 frlpj.exe 35 PID 2724 wrote to memory of 2800 2724 frlpj.exe 35 PID 2724 wrote to memory of 2800 2724 frlpj.exe 35 PID 2800 wrote to memory of 2092 2800 tfxdtb.exe 36 PID 2800 wrote to memory of 2092 2800 tfxdtb.exe 36 PID 2800 wrote to memory of 2092 2800 tfxdtb.exe 36 PID 2800 wrote to memory of 2092 2800 tfxdtb.exe 36 PID 2092 wrote to memory of 1496 2092 ttnhhb.exe 37 PID 2092 wrote to memory of 1496 2092 ttnhhb.exe 37 PID 2092 wrote to memory of 1496 2092 ttnhhb.exe 37 PID 2092 wrote to memory of 1496 2092 ttnhhb.exe 37 PID 1496 wrote to memory of 2672 1496 lfbxvh.exe 38 PID 1496 wrote to memory of 2672 1496 lfbxvh.exe 38 PID 1496 wrote to memory of 2672 1496 lfbxvh.exe 38 PID 1496 wrote to memory of 2672 1496 lfbxvh.exe 38 PID 2672 wrote to memory of 1760 2672 rpvnx.exe 39 PID 2672 wrote to memory of 1760 2672 rpvnx.exe 39 PID 2672 wrote to memory of 1760 2672 rpvnx.exe 39 PID 2672 wrote to memory of 1760 2672 rpvnx.exe 39 PID 1760 wrote to memory of 1240 1760 hrbvrjj.exe 40 PID 1760 wrote to memory of 1240 1760 hrbvrjj.exe 40 PID 1760 wrote to memory of 1240 1760 hrbvrjj.exe 40 PID 1760 wrote to memory of 1240 1760 hrbvrjj.exe 40 PID 1240 wrote to memory of 2160 1240 ljxjblr.exe 41 PID 1240 wrote to memory of 2160 1240 ljxjblr.exe 41 PID 1240 wrote to memory of 2160 1240 ljxjblr.exe 41 PID 1240 wrote to memory of 2160 1240 ljxjblr.exe 41 PID 2160 wrote to memory of 2192 2160 jhthn.exe 42 PID 2160 wrote to memory of 2192 2160 jhthn.exe 42 PID 2160 wrote to memory of 2192 2160 jhthn.exe 42 PID 2160 wrote to memory of 2192 2160 jhthn.exe 42 PID 2192 wrote to memory of 2500 2192 prdlb.exe 43 PID 2192 wrote to memory of 2500 2192 prdlb.exe 43 PID 2192 wrote to memory of 2500 2192 prdlb.exe 43 PID 2192 wrote to memory of 2500 2192 prdlb.exe 43 PID 2500 wrote to memory of 2376 2500 drpbdt.exe 44 PID 2500 wrote to memory of 2376 2500 drpbdt.exe 44 PID 2500 wrote to memory of 2376 2500 drpbdt.exe 44 PID 2500 wrote to memory of 2376 2500 drpbdt.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\3482ec7f059ffbfe72fe4c8828686c7c3009b17ad72a37d275d4d767bc132994.exe"C:\Users\Admin\AppData\Local\Temp\3482ec7f059ffbfe72fe4c8828686c7c3009b17ad72a37d275d4d767bc132994.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\dhvdh.exec:\dhvdh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\rfrpjd.exec:\rfrpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\blltnd.exec:\blltnd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\tdtvvdv.exec:\tdtvvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\rlplx.exec:\rlplx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\frlpj.exec:\frlpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\tfxdtb.exec:\tfxdtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\ttnhhb.exec:\ttnhhb.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\lfbxvh.exec:\lfbxvh.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\rpvnx.exec:\rpvnx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\hrbvrjj.exec:\hrbvrjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\ljxjblr.exec:\ljxjblr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\jhthn.exec:\jhthn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\prdlb.exec:\prdlb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\drpbdt.exec:\drpbdt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\jjnhfj.exec:\jjnhfj.exe17⤵
- Executes dropped EXE
PID:2376 -
\??\c:\fxtbtx.exec:\fxtbtx.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:852 -
\??\c:\lvvrlnf.exec:\lvvrlnf.exe19⤵
- Executes dropped EXE
PID:2124 -
\??\c:\btrvptt.exec:\btrvptt.exe20⤵
- Executes dropped EXE
PID:2188 -
\??\c:\tnfjx.exec:\tnfjx.exe21⤵
- Executes dropped EXE
PID:2404 -
\??\c:\drnnj.exec:\drnnj.exe22⤵
- Executes dropped EXE
PID:2076 -
\??\c:\pvhbl.exec:\pvhbl.exe23⤵
- Executes dropped EXE
PID:1148 -
\??\c:\ptlpp.exec:\ptlpp.exe24⤵
- Executes dropped EXE
PID:1004 -
\??\c:\tfjvpp.exec:\tfjvpp.exe25⤵
- Executes dropped EXE
PID:1980 -
\??\c:\xdnjhdj.exec:\xdnjhdj.exe26⤵
- Executes dropped EXE
PID:2252 -
\??\c:\dtpxrj.exec:\dtpxrj.exe27⤵
- Executes dropped EXE
PID:1676 -
\??\c:\djbdph.exec:\djbdph.exe28⤵
- Executes dropped EXE
PID:932 -
\??\c:\pdfjlvh.exec:\pdfjlvh.exe29⤵
- Executes dropped EXE
PID:1044 -
\??\c:\hrfhvpt.exec:\hrfhvpt.exe30⤵
- Executes dropped EXE
PID:956 -
\??\c:\ltbbrx.exec:\ltbbrx.exe31⤵
- Executes dropped EXE
PID:1104 -
\??\c:\xlntdv.exec:\xlntdv.exe32⤵
- Executes dropped EXE
PID:1808 -
\??\c:\rjhln.exec:\rjhln.exe33⤵
- Executes dropped EXE
PID:1628 -
\??\c:\hdlflx.exec:\hdlflx.exe34⤵
- Executes dropped EXE
PID:3020 -
\??\c:\pjfxldb.exec:\pjfxldb.exe35⤵
- Executes dropped EXE
PID:2488 -
\??\c:\pplhx.exec:\pplhx.exe36⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nlrxd.exec:\nlrxd.exe37⤵
- Executes dropped EXE
PID:1600 -
\??\c:\xtjbft.exec:\xtjbft.exe38⤵
- Executes dropped EXE
PID:2956 -
\??\c:\dvvltff.exec:\dvvltff.exe39⤵
- Executes dropped EXE
PID:2852 -
\??\c:\bfhdtj.exec:\bfhdtj.exe40⤵
- Executes dropped EXE
PID:2508 -
\??\c:\vfrvrft.exec:\vfrvrft.exe41⤵
- Executes dropped EXE
PID:2904 -
\??\c:\fvltd.exec:\fvltd.exe42⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rjrhxfn.exec:\rjrhxfn.exe43⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vlhxxt.exec:\vlhxxt.exe44⤵
- Executes dropped EXE
PID:2848 -
\??\c:\fddxl.exec:\fddxl.exe45⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hrrpx.exec:\hrrpx.exe46⤵
- Executes dropped EXE
PID:2708 -
\??\c:\llpbll.exec:\llpbll.exe47⤵
- Executes dropped EXE
PID:1300 -
\??\c:\ddpxl.exec:\ddpxl.exe48⤵
- Executes dropped EXE
PID:2284 -
\??\c:\vhlvnvf.exec:\vhlvnvf.exe49⤵
- Executes dropped EXE
PID:744 -
\??\c:\tnvpnb.exec:\tnvpnb.exe50⤵
- Executes dropped EXE
PID:2356 -
\??\c:\xbndxl.exec:\xbndxl.exe51⤵
- Executes dropped EXE
PID:3052 -
\??\c:\hllpl.exec:\hllpl.exe52⤵
- Executes dropped EXE
PID:1240 -
\??\c:\djnnbl.exec:\djnnbl.exe53⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vljdln.exec:\vljdln.exe54⤵
- Executes dropped EXE
PID:2300 -
\??\c:\pjjrvp.exec:\pjjrvp.exe55⤵
- Executes dropped EXE
PID:2500 -
\??\c:\jrhthjl.exec:\jrhthjl.exe56⤵
- Executes dropped EXE
PID:3028 -
\??\c:\tljtb.exec:\tljtb.exe57⤵
- Executes dropped EXE
PID:1848 -
\??\c:\lhdlx.exec:\lhdlx.exe58⤵
- Executes dropped EXE
PID:2352 -
\??\c:\fndrt.exec:\fndrt.exe59⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rxlnlnh.exec:\rxlnlnh.exe60⤵
- Executes dropped EXE
PID:2644 -
\??\c:\fflrv.exec:\fflrv.exe61⤵
- Executes dropped EXE
PID:2080 -
\??\c:\lthjhf.exec:\lthjhf.exe62⤵
- Executes dropped EXE
PID:2112 -
\??\c:\dtxfbd.exec:\dtxfbd.exe63⤵
- Executes dropped EXE
PID:2292 -
\??\c:\tnlbhd.exec:\tnlbhd.exe64⤵
- Executes dropped EXE
PID:2480 -
\??\c:\tbhxj.exec:\tbhxj.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1148 -
\??\c:\dlftf.exec:\dlftf.exe66⤵PID:1004
-
\??\c:\dnvhb.exec:\dnvhb.exe67⤵PID:1304
-
\??\c:\vldbjn.exec:\vldbjn.exe68⤵PID:2700
-
\??\c:\hvxrxx.exec:\hvxrxx.exe69⤵PID:1752
-
\??\c:\frxff.exec:\frxff.exe70⤵PID:2024
-
\??\c:\ndbfp.exec:\ndbfp.exe71⤵PID:932
-
\??\c:\dbrjrlr.exec:\dbrjrlr.exe72⤵PID:1772
-
\??\c:\lttdfb.exec:\lttdfb.exe73⤵PID:928
-
\??\c:\hfrbbx.exec:\hfrbbx.exe74⤵PID:740
-
\??\c:\phpjd.exec:\phpjd.exe75⤵PID:672
-
\??\c:\lnfllh.exec:\lnfllh.exe76⤵PID:1800
-
\??\c:\pjnxrpp.exec:\pjnxrpp.exe77⤵PID:1488
-
\??\c:\fhhpt.exec:\fhhpt.exe78⤵PID:2140
-
\??\c:\blxhl.exec:\blxhl.exe79⤵PID:792
-
\??\c:\btjrrt.exec:\btjrrt.exe80⤵PID:2056
-
\??\c:\dxptl.exec:\dxptl.exe81⤵PID:1600
-
\??\c:\tfrtx.exec:\tfrtx.exe82⤵PID:2996
-
\??\c:\lxxdfdh.exec:\lxxdfdh.exe83⤵PID:2852
-
\??\c:\xtjlnbh.exec:\xtjlnbh.exe84⤵PID:2508
-
\??\c:\bftxth.exec:\bftxth.exe85⤵PID:3024
-
\??\c:\jhhrlb.exec:\jhhrlb.exe86⤵PID:2744
-
\??\c:\pdbrtj.exec:\pdbrtj.exe87⤵PID:2724
-
\??\c:\brdll.exec:\brdll.exe88⤵PID:1988
-
\??\c:\nbtvt.exec:\nbtvt.exe89⤵PID:1388
-
\??\c:\lfttbj.exec:\lfttbj.exe90⤵PID:1660
-
\??\c:\jvrrhhh.exec:\jvrrhhh.exe91⤵PID:1724
-
\??\c:\rrrnh.exec:\rrrnh.exe92⤵PID:1332
-
\??\c:\fhjvhj.exec:\fhjvhj.exe93⤵PID:1748
-
\??\c:\hrxntt.exec:\hrxntt.exe94⤵PID:1160
-
\??\c:\ltplvrl.exec:\ltplvrl.exe95⤵PID:2584
-
\??\c:\lvppn.exec:\lvppn.exe96⤵PID:2468
-
\??\c:\rxfnh.exec:\rxfnh.exe97⤵PID:3040
-
\??\c:\jdvjdf.exec:\jdvjdf.exe98⤵PID:1012
-
\??\c:\jddfrpr.exec:\jddfrpr.exe99⤵PID:2648
-
\??\c:\nfxxtlv.exec:\nfxxtlv.exe100⤵PID:844
-
\??\c:\pvpflb.exec:\pvpflb.exe101⤵PID:2320
-
\??\c:\rdrfpbd.exec:\rdrfpbd.exe102⤵PID:2368
-
\??\c:\fnfxf.exec:\fnfxf.exe103⤵PID:2204
-
\??\c:\tpppfl.exec:\tpppfl.exe104⤵PID:2676
-
\??\c:\ltlrt.exec:\ltlrt.exe105⤵PID:2176
-
\??\c:\bhlrp.exec:\bhlrp.exe106⤵PID:916
-
\??\c:\trxxr.exec:\trxxr.exe107⤵PID:1328
-
\??\c:\jjjftl.exec:\jjjftl.exe108⤵PID:2520
-
\??\c:\vfdnvp.exec:\vfdnvp.exe109⤵PID:2480
-
\??\c:\nrvhbtn.exec:\nrvhbtn.exe110⤵PID:1148
-
\??\c:\thhjhnj.exec:\thhjhnj.exe111⤵PID:1004
-
\??\c:\fpxxpj.exec:\fpxxpj.exe112⤵
- System Location Discovery: System Language Discovery
PID:992 -
\??\c:\dphdxd.exec:\dphdxd.exe113⤵PID:820
-
\??\c:\btbvxv.exec:\btbvxv.exe114⤵PID:1752
-
\??\c:\nxbdhrn.exec:\nxbdhrn.exe115⤵PID:1776
-
\??\c:\rntvd.exec:\rntvd.exe116⤵PID:1040
-
\??\c:\hptlvrr.exec:\hptlvrr.exe117⤵PID:2200
-
\??\c:\rpvbr.exec:\rpvbr.exe118⤵PID:432
-
\??\c:\nrtbntr.exec:\nrtbntr.exe119⤵PID:1104
-
\??\c:\ndnvnp.exec:\ndnvnp.exe120⤵PID:876
-
\??\c:\plhxt.exec:\plhxt.exe121⤵PID:2568
-
\??\c:\nfxff.exec:\nfxff.exe122⤵PID:652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-