Analysis
-
max time kernel
120s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 23:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9dcc3d297ccd4eb0c90cfc4902d189cd91c13e29e080e49ecd21b459a5fe927cN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9dcc3d297ccd4eb0c90cfc4902d189cd91c13e29e080e49ecd21b459a5fe927cN.exe
-
Size
454KB
-
MD5
1c71a78ac7790ed0e6520d3d31c1d000
-
SHA1
a48ec9a554f249112d2c45cdd125a555c6a2ddaa
-
SHA256
9dcc3d297ccd4eb0c90cfc4902d189cd91c13e29e080e49ecd21b459a5fe927c
-
SHA512
d2c8d71ea29e98704f675d8c24b581700744a83e7b007f5a0c4c6c037616aa5e7650d6778b79581ae5c78c120ae7bf2388270f1800d2e1be2cea839b731cddfa
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbef:q7Tc2NYHUrAwfMp3CDf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/1552-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-150-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1792-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-334-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2148-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-369-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2788-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-481-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1884-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/948-531-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1116-550-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2384-585-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1908-590-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/736-678-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/932-711-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-789-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1552 rpdddhd.exe 2564 pblrnt.exe 2888 dnfxx.exe 3024 dxxfdx.exe 2972 rprnjd.exe 3064 hlnvhhl.exe 2916 nprhdtf.exe 2612 bddphxl.exe 2552 fddvlr.exe 2188 lllbh.exe 2152 vphlfjt.exe 1680 ljjdrb.exe 2984 trbdd.exe 2368 bhfjjfd.exe 1792 jbxnv.exe 1432 pxndjxd.exe 1760 phnnt.exe 2420 rjvftph.exe 1884 jlfbv.exe 2236 tdxbrtn.exe 1520 hrvljx.exe 324 nxtxhfn.exe 1048 dhbhh.exe 992 tlvlv.exe 1968 hlrjfr.exe 2052 nlbrjxd.exe 1052 vrfpn.exe 1064 dpxbrd.exe 1616 vfxfbl.exe 2072 fnpblp.exe 1376 bpxlrh.exe 2276 xddbj.exe 2296 vpnjvl.exe 2636 ddpjr.exe 1628 vdjxjvh.exe 2980 dhxvj.exe 2148 xnnbv.exe 3020 bxffv.exe 2128 htbrpl.exe 2940 rjfbvrn.exe 2868 dvfbt.exe 2840 jtnhtvr.exe 2788 xjnrt.exe 2168 pnxfvt.exe 2304 fplbnr.exe 1420 rtxvhp.exe 1568 dhpptxj.exe 616 bbvvd.exe 932 flrbtjr.exe 548 xhvpf.exe 2984 htpbjtl.exe 2692 njnjpjr.exe 3044 hjxphv.exe 1080 lhldt.exe 1432 fdhlnfd.exe 2176 ttxvx.exe 2480 hljtjlv.exe 2220 hnhnjpx.exe 1884 rhdtb.exe 1960 hfnhp.exe 1504 hjbfh.exe 948 xjldjb.exe 596 vxfpx.exe 272 rphpbdf.exe -
resource yara_rule behavioral1/memory/1552-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/272-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-711-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-811-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-819-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbxnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdbltft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhjlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtrpnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trbdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djhfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpppt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdhflj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxxxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxvltb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbvdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhbvxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trjjxrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhrbddr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhxnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxhjnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdrbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrtxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnjjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lptpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhljt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhphb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbvbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htpbjtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lptvtbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbfrpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhpjxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvtld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdblhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlpfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjdvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjfjfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtnbprn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phfntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhnjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxnbvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddbljv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthxvrn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2256 wrote to memory of 1552 2256 9dcc3d297ccd4eb0c90cfc4902d189cd91c13e29e080e49ecd21b459a5fe927cN.exe 30 PID 2256 wrote to memory of 1552 2256 9dcc3d297ccd4eb0c90cfc4902d189cd91c13e29e080e49ecd21b459a5fe927cN.exe 30 PID 2256 wrote to memory of 1552 2256 9dcc3d297ccd4eb0c90cfc4902d189cd91c13e29e080e49ecd21b459a5fe927cN.exe 30 PID 2256 wrote to memory of 1552 2256 9dcc3d297ccd4eb0c90cfc4902d189cd91c13e29e080e49ecd21b459a5fe927cN.exe 30 PID 1552 wrote to memory of 2564 1552 rpdddhd.exe 31 PID 1552 wrote to memory of 2564 1552 rpdddhd.exe 31 PID 1552 wrote to memory of 2564 1552 rpdddhd.exe 31 PID 1552 wrote to memory of 2564 1552 rpdddhd.exe 31 PID 2564 wrote to memory of 2888 2564 pblrnt.exe 32 PID 2564 wrote to memory of 2888 2564 pblrnt.exe 32 PID 2564 wrote to memory of 2888 2564 pblrnt.exe 32 PID 2564 wrote to memory of 2888 2564 pblrnt.exe 32 PID 2888 wrote to memory of 3024 2888 dnfxx.exe 33 PID 2888 wrote to memory of 3024 2888 dnfxx.exe 33 PID 2888 wrote to memory of 3024 2888 dnfxx.exe 33 PID 2888 wrote to memory of 3024 2888 dnfxx.exe 33 PID 3024 wrote to memory of 2972 3024 dxxfdx.exe 34 PID 3024 wrote to memory of 2972 3024 dxxfdx.exe 34 PID 3024 wrote to memory of 2972 3024 dxxfdx.exe 34 PID 3024 wrote to memory of 2972 3024 dxxfdx.exe 34 PID 2972 wrote to memory of 3064 2972 rprnjd.exe 35 PID 2972 wrote to memory of 3064 2972 rprnjd.exe 35 PID 2972 wrote to memory of 3064 2972 rprnjd.exe 35 PID 2972 wrote to memory of 3064 2972 rprnjd.exe 35 PID 3064 wrote to memory of 2916 3064 hlnvhhl.exe 36 PID 3064 wrote to memory of 2916 3064 hlnvhhl.exe 36 PID 3064 wrote to memory of 2916 3064 hlnvhhl.exe 36 PID 3064 wrote to memory of 2916 3064 hlnvhhl.exe 36 PID 2916 wrote to memory of 2612 2916 nprhdtf.exe 37 PID 2916 wrote to memory of 2612 2916 nprhdtf.exe 37 PID 2916 wrote to memory of 2612 2916 nprhdtf.exe 37 PID 2916 wrote to memory of 2612 2916 nprhdtf.exe 37 PID 2612 wrote to memory of 2552 2612 bddphxl.exe 38 PID 2612 wrote to memory of 2552 2612 bddphxl.exe 38 PID 2612 wrote to memory of 2552 2612 bddphxl.exe 38 PID 2612 wrote to memory of 2552 2612 bddphxl.exe 38 PID 2552 wrote to memory of 2188 2552 fddvlr.exe 39 PID 2552 wrote to memory of 2188 2552 fddvlr.exe 39 PID 2552 wrote to memory of 2188 2552 fddvlr.exe 39 PID 2552 wrote to memory of 2188 2552 fddvlr.exe 39 PID 2188 wrote to memory of 2152 2188 lllbh.exe 40 PID 2188 wrote to memory of 2152 2188 lllbh.exe 40 PID 2188 wrote to memory of 2152 2188 lllbh.exe 40 PID 2188 wrote to memory of 2152 2188 lllbh.exe 40 PID 2152 wrote to memory of 1680 2152 vphlfjt.exe 41 PID 2152 wrote to memory of 1680 2152 vphlfjt.exe 41 PID 2152 wrote to memory of 1680 2152 vphlfjt.exe 41 PID 2152 wrote to memory of 1680 2152 vphlfjt.exe 41 PID 1680 wrote to memory of 2984 1680 ljjdrb.exe 42 PID 1680 wrote to memory of 2984 1680 ljjdrb.exe 42 PID 1680 wrote to memory of 2984 1680 ljjdrb.exe 42 PID 1680 wrote to memory of 2984 1680 ljjdrb.exe 42 PID 2984 wrote to memory of 2368 2984 trbdd.exe 43 PID 2984 wrote to memory of 2368 2984 trbdd.exe 43 PID 2984 wrote to memory of 2368 2984 trbdd.exe 43 PID 2984 wrote to memory of 2368 2984 trbdd.exe 43 PID 2368 wrote to memory of 1792 2368 bhfjjfd.exe 44 PID 2368 wrote to memory of 1792 2368 bhfjjfd.exe 44 PID 2368 wrote to memory of 1792 2368 bhfjjfd.exe 44 PID 2368 wrote to memory of 1792 2368 bhfjjfd.exe 44 PID 1792 wrote to memory of 1432 1792 jbxnv.exe 45 PID 1792 wrote to memory of 1432 1792 jbxnv.exe 45 PID 1792 wrote to memory of 1432 1792 jbxnv.exe 45 PID 1792 wrote to memory of 1432 1792 jbxnv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9dcc3d297ccd4eb0c90cfc4902d189cd91c13e29e080e49ecd21b459a5fe927cN.exe"C:\Users\Admin\AppData\Local\Temp\9dcc3d297ccd4eb0c90cfc4902d189cd91c13e29e080e49ecd21b459a5fe927cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\rpdddhd.exec:\rpdddhd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\pblrnt.exec:\pblrnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\dnfxx.exec:\dnfxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\dxxfdx.exec:\dxxfdx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\rprnjd.exec:\rprnjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\hlnvhhl.exec:\hlnvhhl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\nprhdtf.exec:\nprhdtf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\bddphxl.exec:\bddphxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\fddvlr.exec:\fddvlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\lllbh.exec:\lllbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\vphlfjt.exec:\vphlfjt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\ljjdrb.exec:\ljjdrb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\trbdd.exec:\trbdd.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\bhfjjfd.exec:\bhfjjfd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\jbxnv.exec:\jbxnv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\pxndjxd.exec:\pxndjxd.exe17⤵
- Executes dropped EXE
PID:1432 -
\??\c:\phnnt.exec:\phnnt.exe18⤵
- Executes dropped EXE
PID:1760 -
\??\c:\rjvftph.exec:\rjvftph.exe19⤵
- Executes dropped EXE
PID:2420 -
\??\c:\jlfbv.exec:\jlfbv.exe20⤵
- Executes dropped EXE
PID:1884 -
\??\c:\tdxbrtn.exec:\tdxbrtn.exe21⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hrvljx.exec:\hrvljx.exe22⤵
- Executes dropped EXE
PID:1520 -
\??\c:\nxtxhfn.exec:\nxtxhfn.exe23⤵
- Executes dropped EXE
PID:324 -
\??\c:\dhbhh.exec:\dhbhh.exe24⤵
- Executes dropped EXE
PID:1048 -
\??\c:\tlvlv.exec:\tlvlv.exe25⤵
- Executes dropped EXE
PID:992 -
\??\c:\hlrjfr.exec:\hlrjfr.exe26⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nlbrjxd.exec:\nlbrjxd.exe27⤵
- Executes dropped EXE
PID:2052 -
\??\c:\vrfpn.exec:\vrfpn.exe28⤵
- Executes dropped EXE
PID:1052 -
\??\c:\dpxbrd.exec:\dpxbrd.exe29⤵
- Executes dropped EXE
PID:1064 -
\??\c:\vfxfbl.exec:\vfxfbl.exe30⤵
- Executes dropped EXE
PID:1616 -
\??\c:\fnpblp.exec:\fnpblp.exe31⤵
- Executes dropped EXE
PID:2072 -
\??\c:\bpxlrh.exec:\bpxlrh.exe32⤵
- Executes dropped EXE
PID:1376 -
\??\c:\xddbj.exec:\xddbj.exe33⤵
- Executes dropped EXE
PID:2276 -
\??\c:\vpnjvl.exec:\vpnjvl.exe34⤵
- Executes dropped EXE
PID:2296 -
\??\c:\ddpjr.exec:\ddpjr.exe35⤵
- Executes dropped EXE
PID:2636 -
\??\c:\vdjxjvh.exec:\vdjxjvh.exe36⤵
- Executes dropped EXE
PID:1628 -
\??\c:\dhxvj.exec:\dhxvj.exe37⤵
- Executes dropped EXE
PID:2980 -
\??\c:\xnnbv.exec:\xnnbv.exe38⤵
- Executes dropped EXE
PID:2148 -
\??\c:\bxffv.exec:\bxffv.exe39⤵
- Executes dropped EXE
PID:3020 -
\??\c:\htbrpl.exec:\htbrpl.exe40⤵
- Executes dropped EXE
PID:2128 -
\??\c:\rjfbvrn.exec:\rjfbvrn.exe41⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dvfbt.exec:\dvfbt.exe42⤵
- Executes dropped EXE
PID:2868 -
\??\c:\jtnhtvr.exec:\jtnhtvr.exe43⤵
- Executes dropped EXE
PID:2840 -
\??\c:\xjnrt.exec:\xjnrt.exe44⤵
- Executes dropped EXE
PID:2788 -
\??\c:\pnxfvt.exec:\pnxfvt.exe45⤵
- Executes dropped EXE
PID:2168 -
\??\c:\fplbnr.exec:\fplbnr.exe46⤵
- Executes dropped EXE
PID:2304 -
\??\c:\rtxvhp.exec:\rtxvhp.exe47⤵
- Executes dropped EXE
PID:1420 -
\??\c:\dhpptxj.exec:\dhpptxj.exe48⤵
- Executes dropped EXE
PID:1568 -
\??\c:\bbvvd.exec:\bbvvd.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:616 -
\??\c:\flrbtjr.exec:\flrbtjr.exe50⤵
- Executes dropped EXE
PID:932 -
\??\c:\xhvpf.exec:\xhvpf.exe51⤵
- Executes dropped EXE
PID:548 -
\??\c:\htpbjtl.exec:\htpbjtl.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2984 -
\??\c:\njnjpjr.exec:\njnjpjr.exe53⤵
- Executes dropped EXE
PID:2692 -
\??\c:\hjxphv.exec:\hjxphv.exe54⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lhldt.exec:\lhldt.exe55⤵
- Executes dropped EXE
PID:1080 -
\??\c:\fdhlnfd.exec:\fdhlnfd.exe56⤵
- Executes dropped EXE
PID:1432 -
\??\c:\ttxvx.exec:\ttxvx.exe57⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hljtjlv.exec:\hljtjlv.exe58⤵
- Executes dropped EXE
PID:2480 -
\??\c:\hnhnjpx.exec:\hnhnjpx.exe59⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rhdtb.exec:\rhdtb.exe60⤵
- Executes dropped EXE
PID:1884 -
\??\c:\hfnhp.exec:\hfnhp.exe61⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hjbfh.exec:\hjbfh.exe62⤵
- Executes dropped EXE
PID:1504 -
\??\c:\xjldjb.exec:\xjldjb.exe63⤵
- Executes dropped EXE
PID:948 -
\??\c:\vxfpx.exec:\vxfpx.exe64⤵
- Executes dropped EXE
PID:596 -
\??\c:\rphpbdf.exec:\rphpbdf.exe65⤵
- Executes dropped EXE
PID:272 -
\??\c:\ttdljb.exec:\ttdljb.exe66⤵PID:1972
-
\??\c:\bdltnrn.exec:\bdltnrn.exe67⤵PID:436
-
\??\c:\vrrhd.exec:\vrrhd.exe68⤵PID:1664
-
\??\c:\vlppl.exec:\vlppl.exe69⤵PID:1116
-
\??\c:\jpdlx.exec:\jpdlx.exe70⤵PID:1608
-
\??\c:\xtxvtd.exec:\xtxvtd.exe71⤵PID:2384
-
\??\c:\pfjrj.exec:\pfjrj.exe72⤵PID:2584
-
\??\c:\jfbpx.exec:\jfbpx.exe73⤵PID:1072
-
\??\c:\dnndtxl.exec:\dnndtxl.exe74⤵PID:1716
-
\??\c:\npvhrn.exec:\npvhrn.exe75⤵PID:1908
-
\??\c:\brrxj.exec:\brrxj.exe76⤵PID:1560
-
\??\c:\vbpttvd.exec:\vbpttvd.exe77⤵PID:2464
-
\??\c:\prjbd.exec:\prjbd.exe78⤵PID:2652
-
\??\c:\nhdpjx.exec:\nhdpjx.exe79⤵PID:3000
-
\??\c:\fjdddlt.exec:\fjdddlt.exe80⤵PID:2928
-
\??\c:\jvjrvld.exec:\jvjrvld.exe81⤵PID:3004
-
\??\c:\xtpxpx.exec:\xtpxpx.exe82⤵PID:3020
-
\??\c:\ltfbb.exec:\ltfbb.exe83⤵PID:1892
-
\??\c:\hldvxld.exec:\hldvxld.exe84⤵PID:2896
-
\??\c:\bbvxt.exec:\bbvxt.exe85⤵PID:2804
-
\??\c:\llhtfhx.exec:\llhtfhx.exe86⤵PID:2776
-
\??\c:\htbtpxr.exec:\htbtpxr.exe87⤵PID:2944
-
\??\c:\phxndt.exec:\phxndt.exe88⤵PID:2760
-
\??\c:\lpvhlj.exec:\lpvhlj.exe89⤵PID:736
-
\??\c:\dbhfbx.exec:\dbhfbx.exe90⤵PID:2304
-
\??\c:\rdntfbb.exec:\rdntfbb.exe91⤵PID:1420
-
\??\c:\lnbrln.exec:\lnbrln.exe92⤵PID:1568
-
\??\c:\pdhdfx.exec:\pdhdfx.exe93⤵PID:1680
-
\??\c:\fvlbl.exec:\fvlbl.exe94⤵PID:932
-
\??\c:\jfhlp.exec:\jfhlp.exe95⤵PID:2292
-
\??\c:\xbvfnr.exec:\xbvfnr.exe96⤵PID:2984
-
\??\c:\tjfpd.exec:\tjfpd.exe97⤵PID:2692
-
\??\c:\txvvvd.exec:\txvvvd.exe98⤵
- System Location Discovery: System Language Discovery
PID:660 -
\??\c:\dlxhjx.exec:\dlxhjx.exe99⤵PID:456
-
\??\c:\frxtplv.exec:\frxtplv.exe100⤵PID:2208
-
\??\c:\tbfvlxp.exec:\tbfvlxp.exe101⤵PID:1976
-
\??\c:\hhtbhd.exec:\hhtbhd.exe102⤵PID:944
-
\??\c:\jthfv.exec:\jthfv.exe103⤵PID:2580
-
\??\c:\tdblhbn.exec:\tdblhbn.exe104⤵
- System Location Discovery: System Language Discovery
PID:1512 -
\??\c:\jvlpf.exec:\jvlpf.exe105⤵PID:2740
-
\??\c:\nltdlbt.exec:\nltdlbt.exe106⤵PID:2028
-
\??\c:\dhrjpj.exec:\dhrjpj.exe107⤵PID:948
-
\??\c:\lppldt.exec:\lppldt.exe108⤵PID:1048
-
\??\c:\llvvvr.exec:\llvvvr.exe109⤵PID:1496
-
\??\c:\lrbtnd.exec:\lrbtnd.exe110⤵PID:2080
-
\??\c:\flbdl.exec:\flbdl.exe111⤵PID:1632
-
\??\c:\dblrnt.exec:\dblrnt.exe112⤵PID:2052
-
\??\c:\jdjlr.exec:\jdjlr.exe113⤵PID:1064
-
\??\c:\bhxlj.exec:\bhxlj.exe114⤵PID:1608
-
\??\c:\hbdrdj.exec:\hbdrdj.exe115⤵PID:2384
-
\??\c:\rvbtfhl.exec:\rvbtfhl.exe116⤵PID:1616
-
\??\c:\tdfrv.exec:\tdfrv.exe117⤵PID:2264
-
\??\c:\bbrrjr.exec:\bbrrjr.exe118⤵PID:2864
-
\??\c:\dxddt.exec:\dxddt.exe119⤵PID:2076
-
\??\c:\rfllfp.exec:\rfllfp.exe120⤵PID:2312
-
\??\c:\xlftnp.exec:\xlftnp.exe121⤵PID:2472
-
\??\c:\vpxtbpp.exec:\vpxtbpp.exe122⤵PID:2564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-