Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 22:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe
-
Size
453KB
-
MD5
82ef3b69ce334a2addbbb2c2f1513f94
-
SHA1
7894dde28b156bd8b6a7c094eae645e7c72c413f
-
SHA256
31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638
-
SHA512
581a8e35c1dbab70d1c9b53b02dbaefb9c9abb039b5b4675a97911ef417159d891e6540abd6768993934bdeafc86385a6d70dc127869cb0b727b1cb8cae0c344
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeY:q7Tc2NYHUrAwfMp3CDY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2244-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-35-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2436-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-89-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2136-109-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2136-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/940-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-150-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1932-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-219-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/524-237-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1128-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-297-0x00000000770D0000-0x00000000771EF000-memory.dmp family_blackmoon behavioral1/memory/2852-327-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2176-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1204-466-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1076-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-639-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2624-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-665-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2940-706-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-730-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2448 dbtdvhd.exe 2968 lbjjd.exe 2888 xpxnfhl.exe 1824 ntrfvt.exe 2168 npdbvfx.exe 2804 tvlnvp.exe 2800 hlhbhnl.exe 2436 jjpvdxf.exe 2180 lhddt.exe 2064 jpddd.exe 2136 nvltfr.exe 940 htxxvxn.exe 2808 xflfndt.exe 2696 pjltd.exe 1640 dnxrjjd.exe 1932 pvrfjpn.exe 2252 jpbrr.exe 2228 rtdhjtx.exe 2300 lttthdf.exe 2476 lnjpv.exe 1900 xprvn.exe 2160 hpfblrb.exe 948 nfhrt.exe 524 hxffh.exe 2100 nfbvv.exe 1128 hhjxhbd.exe 596 jrlrxf.exe 2036 jlllhxn.exe 2684 nhdhln.exe 2652 nhnlr.exe 1780 rvhvld.exe 2224 dxtpdj.exe 2240 pjllxrx.exe 2852 lrflrnl.exe 2556 xjddvn.exe 3040 vnjjvx.exe 2176 flpbn.exe 2752 hnjhvr.exe 2620 xtpbbn.exe 2764 lhrvvhl.exe 1744 nfxjjrx.exe 1660 hbxhvlh.exe 2172 dfjtnt.exe 1116 nxttbf.exe 2360 llxlfxh.exe 2104 ndptbff.exe 3032 nxlhlp.exe 1444 lxvtjp.exe 2504 tvdnrhj.exe 2152 xpbdfrv.exe 856 dfrvr.exe 2264 ljlpnnp.exe 2708 jnbjd.exe 1204 bnnlx.exe 2272 vblpvff.exe 2060 jxnpvb.exe 1960 phnlr.exe 1076 tvphfj.exe 1896 xrffjf.exe 704 nxrppdf.exe 2480 hjddvdn.exe 2724 tddvnjt.exe 776 tdxxv.exe 676 fnjbj.exe -
resource yara_rule behavioral1/memory/2244-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-109-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/2136-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-150-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1932-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-327-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2176-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/704-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/964-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-717-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2304-730-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjnjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prbnrjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trvppt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhlndl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njlrjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjlhxbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbvrfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfnfnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhjxhbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnhlpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvdxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxvtjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnndr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dllvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbrnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flppb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvxnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbhbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djbltpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvbjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llddtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhphpxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxxvvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfbxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfddl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hddtpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thdnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrtxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjrfvlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbjfpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvrnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdhlvbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvnrpff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2448 2244 31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe 30 PID 2244 wrote to memory of 2448 2244 31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe 30 PID 2244 wrote to memory of 2448 2244 31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe 30 PID 2244 wrote to memory of 2448 2244 31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe 30 PID 2448 wrote to memory of 2968 2448 dbtdvhd.exe 31 PID 2448 wrote to memory of 2968 2448 dbtdvhd.exe 31 PID 2448 wrote to memory of 2968 2448 dbtdvhd.exe 31 PID 2448 wrote to memory of 2968 2448 dbtdvhd.exe 31 PID 2968 wrote to memory of 2888 2968 lbjjd.exe 32 PID 2968 wrote to memory of 2888 2968 lbjjd.exe 32 PID 2968 wrote to memory of 2888 2968 lbjjd.exe 32 PID 2968 wrote to memory of 2888 2968 lbjjd.exe 32 PID 2888 wrote to memory of 1824 2888 xpxnfhl.exe 33 PID 2888 wrote to memory of 1824 2888 xpxnfhl.exe 33 PID 2888 wrote to memory of 1824 2888 xpxnfhl.exe 33 PID 2888 wrote to memory of 1824 2888 xpxnfhl.exe 33 PID 1824 wrote to memory of 2168 1824 ntrfvt.exe 34 PID 1824 wrote to memory of 2168 1824 ntrfvt.exe 34 PID 1824 wrote to memory of 2168 1824 ntrfvt.exe 34 PID 1824 wrote to memory of 2168 1824 ntrfvt.exe 34 PID 2168 wrote to memory of 2804 2168 npdbvfx.exe 35 PID 2168 wrote to memory of 2804 2168 npdbvfx.exe 35 PID 2168 wrote to memory of 2804 2168 npdbvfx.exe 35 PID 2168 wrote to memory of 2804 2168 npdbvfx.exe 35 PID 2804 wrote to memory of 2800 2804 tvlnvp.exe 36 PID 2804 wrote to memory of 2800 2804 tvlnvp.exe 36 PID 2804 wrote to memory of 2800 2804 tvlnvp.exe 36 PID 2804 wrote to memory of 2800 2804 tvlnvp.exe 36 PID 2800 wrote to memory of 2436 2800 hlhbhnl.exe 37 PID 2800 wrote to memory of 2436 2800 hlhbhnl.exe 37 PID 2800 wrote to memory of 2436 2800 hlhbhnl.exe 37 PID 2800 wrote to memory of 2436 2800 hlhbhnl.exe 37 PID 2436 wrote to memory of 2180 2436 jjpvdxf.exe 38 PID 2436 wrote to memory of 2180 2436 jjpvdxf.exe 38 PID 2436 wrote to memory of 2180 2436 jjpvdxf.exe 38 PID 2436 wrote to memory of 2180 2436 jjpvdxf.exe 38 PID 2180 wrote to memory of 2064 2180 lhddt.exe 39 PID 2180 wrote to memory of 2064 2180 lhddt.exe 39 PID 2180 wrote to memory of 2064 2180 lhddt.exe 39 PID 2180 wrote to memory of 2064 2180 lhddt.exe 39 PID 2064 wrote to memory of 2136 2064 jpddd.exe 40 PID 2064 wrote to memory of 2136 2064 jpddd.exe 40 PID 2064 wrote to memory of 2136 2064 jpddd.exe 40 PID 2064 wrote to memory of 2136 2064 jpddd.exe 40 PID 2136 wrote to memory of 940 2136 nvltfr.exe 41 PID 2136 wrote to memory of 940 2136 nvltfr.exe 41 PID 2136 wrote to memory of 940 2136 nvltfr.exe 41 PID 2136 wrote to memory of 940 2136 nvltfr.exe 41 PID 940 wrote to memory of 2808 940 htxxvxn.exe 42 PID 940 wrote to memory of 2808 940 htxxvxn.exe 42 PID 940 wrote to memory of 2808 940 htxxvxn.exe 42 PID 940 wrote to memory of 2808 940 htxxvxn.exe 42 PID 2808 wrote to memory of 2696 2808 xflfndt.exe 43 PID 2808 wrote to memory of 2696 2808 xflfndt.exe 43 PID 2808 wrote to memory of 2696 2808 xflfndt.exe 43 PID 2808 wrote to memory of 2696 2808 xflfndt.exe 43 PID 2696 wrote to memory of 1640 2696 pjltd.exe 44 PID 2696 wrote to memory of 1640 2696 pjltd.exe 44 PID 2696 wrote to memory of 1640 2696 pjltd.exe 44 PID 2696 wrote to memory of 1640 2696 pjltd.exe 44 PID 1640 wrote to memory of 1932 1640 dnxrjjd.exe 45 PID 1640 wrote to memory of 1932 1640 dnxrjjd.exe 45 PID 1640 wrote to memory of 1932 1640 dnxrjjd.exe 45 PID 1640 wrote to memory of 1932 1640 dnxrjjd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe"C:\Users\Admin\AppData\Local\Temp\31361a9ea82726e631b7317dcc2d3fe10df57e5c370a97e03ebf764071cb9638.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\dbtdvhd.exec:\dbtdvhd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\lbjjd.exec:\lbjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\xpxnfhl.exec:\xpxnfhl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\ntrfvt.exec:\ntrfvt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\npdbvfx.exec:\npdbvfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\tvlnvp.exec:\tvlnvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\hlhbhnl.exec:\hlhbhnl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\jjpvdxf.exec:\jjpvdxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\lhddt.exec:\lhddt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\jpddd.exec:\jpddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\nvltfr.exec:\nvltfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\htxxvxn.exec:\htxxvxn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\xflfndt.exec:\xflfndt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\pjltd.exec:\pjltd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\dnxrjjd.exec:\dnxrjjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\pvrfjpn.exec:\pvrfjpn.exe17⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jpbrr.exec:\jpbrr.exe18⤵
- Executes dropped EXE
PID:2252 -
\??\c:\rtdhjtx.exec:\rtdhjtx.exe19⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lttthdf.exec:\lttthdf.exe20⤵
- Executes dropped EXE
PID:2300 -
\??\c:\lnjpv.exec:\lnjpv.exe21⤵
- Executes dropped EXE
PID:2476 -
\??\c:\xprvn.exec:\xprvn.exe22⤵
- Executes dropped EXE
PID:1900 -
\??\c:\hpfblrb.exec:\hpfblrb.exe23⤵
- Executes dropped EXE
PID:2160 -
\??\c:\nfhrt.exec:\nfhrt.exe24⤵
- Executes dropped EXE
PID:948 -
\??\c:\hxffh.exec:\hxffh.exe25⤵
- Executes dropped EXE
PID:524 -
\??\c:\nfbvv.exec:\nfbvv.exe26⤵
- Executes dropped EXE
PID:2100 -
\??\c:\hhjxhbd.exec:\hhjxhbd.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1128 -
\??\c:\jrlrxf.exec:\jrlrxf.exe28⤵
- Executes dropped EXE
PID:596 -
\??\c:\jlllhxn.exec:\jlllhxn.exe29⤵
- Executes dropped EXE
PID:2036 -
\??\c:\nhdhln.exec:\nhdhln.exe30⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nhnlr.exec:\nhnlr.exe31⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rvhvld.exec:\rvhvld.exe32⤵
- Executes dropped EXE
PID:1780 -
\??\c:\bxnbr.exec:\bxnbr.exe33⤵PID:1584
-
\??\c:\dxtpdj.exec:\dxtpdj.exe34⤵
- Executes dropped EXE
PID:2224 -
\??\c:\pjllxrx.exec:\pjllxrx.exe35⤵
- Executes dropped EXE
PID:2240 -
\??\c:\lrflrnl.exec:\lrflrnl.exe36⤵
- Executes dropped EXE
PID:2852 -
\??\c:\xjddvn.exec:\xjddvn.exe37⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vnjjvx.exec:\vnjjvx.exe38⤵
- Executes dropped EXE
PID:3040 -
\??\c:\flpbn.exec:\flpbn.exe39⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hnjhvr.exec:\hnjhvr.exe40⤵
- Executes dropped EXE
PID:2752 -
\??\c:\xtpbbn.exec:\xtpbbn.exe41⤵
- Executes dropped EXE
PID:2620 -
\??\c:\lhrvvhl.exec:\lhrvvhl.exe42⤵
- Executes dropped EXE
PID:2764 -
\??\c:\nfxjjrx.exec:\nfxjjrx.exe43⤵
- Executes dropped EXE
PID:1744 -
\??\c:\hbxhvlh.exec:\hbxhvlh.exe44⤵
- Executes dropped EXE
PID:1660 -
\??\c:\dfjtnt.exec:\dfjtnt.exe45⤵
- Executes dropped EXE
PID:2172 -
\??\c:\nxttbf.exec:\nxttbf.exe46⤵
- Executes dropped EXE
PID:1116 -
\??\c:\llxlfxh.exec:\llxlfxh.exe47⤵
- Executes dropped EXE
PID:2360 -
\??\c:\ndptbff.exec:\ndptbff.exe48⤵
- Executes dropped EXE
PID:2104 -
\??\c:\nxlhlp.exec:\nxlhlp.exe49⤵
- Executes dropped EXE
PID:3032 -
\??\c:\lxvtjp.exec:\lxvtjp.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1444 -
\??\c:\tvdnrhj.exec:\tvdnrhj.exe51⤵
- Executes dropped EXE
PID:2504 -
\??\c:\xpbdfrv.exec:\xpbdfrv.exe52⤵
- Executes dropped EXE
PID:2152 -
\??\c:\dfrvr.exec:\dfrvr.exe53⤵
- Executes dropped EXE
PID:856 -
\??\c:\ljlpnnp.exec:\ljlpnnp.exe54⤵
- Executes dropped EXE
PID:2264 -
\??\c:\jnbjd.exec:\jnbjd.exe55⤵
- Executes dropped EXE
PID:2708 -
\??\c:\bnnlx.exec:\bnnlx.exe56⤵
- Executes dropped EXE
PID:1204 -
\??\c:\vblpvff.exec:\vblpvff.exe57⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jxnpvb.exec:\jxnpvb.exe58⤵
- Executes dropped EXE
PID:2060 -
\??\c:\phnlr.exec:\phnlr.exe59⤵
- Executes dropped EXE
PID:1960 -
\??\c:\tvphfj.exec:\tvphfj.exe60⤵
- Executes dropped EXE
PID:1076 -
\??\c:\xrffjf.exec:\xrffjf.exe61⤵
- Executes dropped EXE
PID:1896 -
\??\c:\nxrppdf.exec:\nxrppdf.exe62⤵
- Executes dropped EXE
PID:704 -
\??\c:\hjddvdn.exec:\hjddvdn.exe63⤵
- Executes dropped EXE
PID:2480 -
\??\c:\tddvnjt.exec:\tddvnjt.exe64⤵
- Executes dropped EXE
PID:2724 -
\??\c:\tdxxv.exec:\tdxxv.exe65⤵
- Executes dropped EXE
PID:776 -
\??\c:\fnjbj.exec:\fnjbj.exe66⤵
- Executes dropped EXE
PID:676 -
\??\c:\pxtdlhd.exec:\pxtdlhd.exe67⤵PID:2680
-
\??\c:\pnprlht.exec:\pnprlht.exe68⤵PID:1384
-
\??\c:\lxtvfj.exec:\lxtvfj.exe69⤵PID:1924
-
\??\c:\xxrff.exec:\xxrff.exe70⤵PID:2132
-
\??\c:\pjfnv.exec:\pjfnv.exe71⤵PID:1740
-
\??\c:\dbfvjd.exec:\dbfvjd.exe72⤵PID:1716
-
\??\c:\jpllxp.exec:\jpllxp.exe73⤵PID:884
-
\??\c:\rxpfjfp.exec:\rxpfjfp.exe74⤵PID:3000
-
\??\c:\xxhdxx.exec:\xxhdxx.exe75⤵PID:1604
-
\??\c:\fjfdbr.exec:\fjfdbr.exe76⤵PID:2988
-
\??\c:\ttrfr.exec:\ttrfr.exe77⤵PID:2952
-
\??\c:\hllthnp.exec:\hllthnp.exe78⤵PID:2324
-
\??\c:\pldlnlt.exec:\pldlnlt.exe79⤵PID:2856
-
\??\c:\tdfvv.exec:\tdfvv.exe80⤵PID:964
-
\??\c:\vftvbhr.exec:\vftvbhr.exe81⤵PID:3040
-
\??\c:\nvdvx.exec:\nvdvx.exe82⤵PID:2920
-
\??\c:\pdfxxfh.exec:\pdfxxfh.exe83⤵PID:2820
-
\??\c:\nhbxnx.exec:\nhbxnx.exe84⤵PID:2972
-
\??\c:\bptnj.exec:\bptnj.exe85⤵PID:2624
-
\??\c:\pnpvfl.exec:\pnpvfl.exe86⤵PID:2256
-
\??\c:\rvrjnf.exec:\rvrjnf.exe87⤵PID:1936
-
\??\c:\vttfbxn.exec:\vttfbxn.exe88⤵PID:568
-
\??\c:\vtbnft.exec:\vtbnft.exe89⤵PID:2196
-
\??\c:\ltdnv.exec:\ltdnv.exe90⤵PID:2092
-
\??\c:\fnjpbt.exec:\fnjpbt.exe91⤵PID:2368
-
\??\c:\xbprrrj.exec:\xbprrrj.exe92⤵PID:2848
-
\??\c:\xhbjln.exec:\xhbjln.exe93⤵PID:2940
-
\??\c:\fndvj.exec:\fndvj.exe94⤵PID:2696
-
\??\c:\xnvtl.exec:\xnvtl.exe95⤵PID:2420
-
\??\c:\nhpnb.exec:\nhpnb.exe96⤵PID:1588
-
\??\c:\jdtlpv.exec:\jdtlpv.exe97⤵PID:2304
-
\??\c:\prtptn.exec:\prtptn.exe98⤵PID:2252
-
\??\c:\vxfdjbt.exec:\vxfdjbt.exe99⤵PID:2452
-
\??\c:\tpnjppj.exec:\tpnjppj.exe100⤵PID:2424
-
\??\c:\nljln.exec:\nljln.exe101⤵PID:560
-
\??\c:\htpfntd.exec:\htpfntd.exe102⤵PID:1960
-
\??\c:\trjbxv.exec:\trjbxv.exe103⤵PID:2476
-
\??\c:\nhhtljf.exec:\nhhtljf.exe104⤵PID:1896
-
\??\c:\ttbnxjl.exec:\ttbnxjl.exe105⤵PID:2056
-
\??\c:\pxjtlr.exec:\pxjtlr.exe106⤵PID:1748
-
\??\c:\tftdd.exec:\tftdd.exe107⤵PID:2724
-
\??\c:\xlpffb.exec:\xlpffb.exe108⤵PID:1768
-
\??\c:\hnnhh.exec:\hnnhh.exe109⤵PID:676
-
\??\c:\nlrbl.exec:\nlrbl.exe110⤵PID:2660
-
\??\c:\vbfbx.exec:\vbfbx.exe111⤵PID:1088
-
\??\c:\drxtnp.exec:\drxtnp.exe112⤵PID:1700
-
\??\c:\dvljlpl.exec:\dvljlpl.exe113⤵PID:2132
-
\??\c:\hbhjrdb.exec:\hbhjrdb.exe114⤵PID:892
-
\??\c:\pdvjnlj.exec:\pdvjnlj.exe115⤵PID:1720
-
\??\c:\trbnh.exec:\trbnh.exe116⤵PID:2216
-
\??\c:\hnbvtnh.exec:\hnbvtnh.exe117⤵PID:2584
-
\??\c:\vrndpf.exec:\vrndpf.exe118⤵PID:1604
-
\??\c:\ltdtt.exec:\ltdtt.exe119⤵PID:2892
-
\??\c:\npnxv.exec:\npnxv.exe120⤵PID:2952
-
\??\c:\dfhffjt.exec:\dfhffjt.exe121⤵PID:3004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-