Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 22:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a8658eba4a56c98472abd220c893a5d29728ee345c6e7cd9fa7cebd97a7deeceN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a8658eba4a56c98472abd220c893a5d29728ee345c6e7cd9fa7cebd97a7deeceN.exe
-
Size
453KB
-
MD5
03bfa4aeaa04d4af5a232ae8ad3a2e10
-
SHA1
c8d8c14f3ff3f974e4009fa097bd9f49ba9cba3a
-
SHA256
a8658eba4a56c98472abd220c893a5d29728ee345c6e7cd9fa7cebd97a7deece
-
SHA512
c8e38654edc59673ff3839c7e8f166fb976f12cad72e1818e007357fcb69281cee7b958b9b720bb80f8924511007206a55dc8daa77718644f2788787f1668799
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe9:q7Tc2NYHUrAwfMp3CD9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2732-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-18-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2028-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-58-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1160-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/392-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-113-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2360-112-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2164-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-276-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/908-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-310-0x00000000773C0000-0x00000000774DF000-memory.dmp family_blackmoon behavioral1/memory/1564-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-327-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2480-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-335-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2804-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-419-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/2592-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-446-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1572-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1360-480-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1860-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-640-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-690-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2588-697-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2596-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-733-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2732 bxpdxj.exe 2028 xftdp.exe 2872 nvhvvrt.exe 2776 jnnvvdr.exe 2684 ndnfpx.exe 1160 hlljvhf.exe 2652 lhbnbvn.exe 2404 pnfhnhp.exe 1888 vvrvttd.exe 392 pjtbhb.exe 2360 lrtfpn.exe 2956 vxtvjj.exe 2164 rnfjnb.exe 2952 fvpbf.exe 2372 xnjrfv.exe 2104 xtfjh.exe 912 rlppnpv.exe 2324 vxhvfxt.exe 2444 xvjrj.exe 2468 bxdpv.exe 1608 lrbjh.exe 2356 ppxpfh.exe 840 llldlr.exe 1456 dlxvvbt.exe 1972 pnjfv.exe 1520 hhflpb.exe 1492 dxtrn.exe 1604 ddrbr.exe 2516 xjhnhj.exe 1336 rtdbfnr.exe 908 tpdpnb.exe 2276 hvbhldp.exe 2508 pthjnp.exe 1504 vxxfvpj.exe 2744 pbltjj.exe 2480 hdxrhr.exe 2804 tdlxhxn.exe 2776 jbvph.exe 2812 hlrpblx.exe 2696 lrlvhv.exe 2692 jpjxjfl.exe 2708 rtrvjx.exe 2712 nfbjpv.exe 1032 jttnbt.exe 884 jnjhj.exe 772 xbpjf.exe 2592 txfnxhr.exe 1612 thvbp.exe 2748 fvftlrf.exe 1532 xfjxfn.exe 2236 jxfhx.exe 2720 rdnnj.exe 1004 ttrrb.exe 1572 bnnjtxt.exe 2412 tvvnfh.exe 1360 jlljhp.exe 1156 xfftt.exe 2172 jvdxx.exe 1320 rllrvdn.exe 2248 bxthjh.exe 876 fbttppx.exe 1968 rtppr.exe 2612 drhvbvt.exe 1868 lnfjlp.exe -
resource yara_rule behavioral1/memory/2732-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-58-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1160-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/392-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-276-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/908-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-310-0x00000000773C0000-0x00000000774DF000-memory.dmp upx behavioral1/memory/1564-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-733-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxxfvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thpnrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lttpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfxpnbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djhjjnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnrrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phdtpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvxjrpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndxpdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brhvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjjpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbpjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxbjvxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvthdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbjhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnjprtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhprlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dprbftj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fppvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvffv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbdthnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvxfdln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxpdxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjpjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhvvnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htjfbrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjtjjfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnbnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhprbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdnxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drjbjhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtndt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbjpjlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxjxdnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpnlvlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhplr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndhxbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frnxbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvbdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btjnxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptpbj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2732 2272 a8658eba4a56c98472abd220c893a5d29728ee345c6e7cd9fa7cebd97a7deeceN.exe 30 PID 2272 wrote to memory of 2732 2272 a8658eba4a56c98472abd220c893a5d29728ee345c6e7cd9fa7cebd97a7deeceN.exe 30 PID 2272 wrote to memory of 2732 2272 a8658eba4a56c98472abd220c893a5d29728ee345c6e7cd9fa7cebd97a7deeceN.exe 30 PID 2272 wrote to memory of 2732 2272 a8658eba4a56c98472abd220c893a5d29728ee345c6e7cd9fa7cebd97a7deeceN.exe 30 PID 2732 wrote to memory of 2028 2732 bxpdxj.exe 31 PID 2732 wrote to memory of 2028 2732 bxpdxj.exe 31 PID 2732 wrote to memory of 2028 2732 bxpdxj.exe 31 PID 2732 wrote to memory of 2028 2732 bxpdxj.exe 31 PID 2028 wrote to memory of 2872 2028 xftdp.exe 32 PID 2028 wrote to memory of 2872 2028 xftdp.exe 32 PID 2028 wrote to memory of 2872 2028 xftdp.exe 32 PID 2028 wrote to memory of 2872 2028 xftdp.exe 32 PID 2872 wrote to memory of 2776 2872 nvhvvrt.exe 33 PID 2872 wrote to memory of 2776 2872 nvhvvrt.exe 33 PID 2872 wrote to memory of 2776 2872 nvhvvrt.exe 33 PID 2872 wrote to memory of 2776 2872 nvhvvrt.exe 33 PID 2776 wrote to memory of 2684 2776 jnnvvdr.exe 34 PID 2776 wrote to memory of 2684 2776 jnnvvdr.exe 34 PID 2776 wrote to memory of 2684 2776 jnnvvdr.exe 34 PID 2776 wrote to memory of 2684 2776 jnnvvdr.exe 34 PID 2684 wrote to memory of 1160 2684 ndnfpx.exe 35 PID 2684 wrote to memory of 1160 2684 ndnfpx.exe 35 PID 2684 wrote to memory of 1160 2684 ndnfpx.exe 35 PID 2684 wrote to memory of 1160 2684 ndnfpx.exe 35 PID 1160 wrote to memory of 2652 1160 hlljvhf.exe 36 PID 1160 wrote to memory of 2652 1160 hlljvhf.exe 36 PID 1160 wrote to memory of 2652 1160 hlljvhf.exe 36 PID 1160 wrote to memory of 2652 1160 hlljvhf.exe 36 PID 2652 wrote to memory of 2404 2652 lhbnbvn.exe 37 PID 2652 wrote to memory of 2404 2652 lhbnbvn.exe 37 PID 2652 wrote to memory of 2404 2652 lhbnbvn.exe 37 PID 2652 wrote to memory of 2404 2652 lhbnbvn.exe 37 PID 2404 wrote to memory of 1888 2404 pnfhnhp.exe 38 PID 2404 wrote to memory of 1888 2404 pnfhnhp.exe 38 PID 2404 wrote to memory of 1888 2404 pnfhnhp.exe 38 PID 2404 wrote to memory of 1888 2404 pnfhnhp.exe 38 PID 1888 wrote to memory of 392 1888 vvrvttd.exe 39 PID 1888 wrote to memory of 392 1888 vvrvttd.exe 39 PID 1888 wrote to memory of 392 1888 vvrvttd.exe 39 PID 1888 wrote to memory of 392 1888 vvrvttd.exe 39 PID 392 wrote to memory of 2360 392 pjtbhb.exe 40 PID 392 wrote to memory of 2360 392 pjtbhb.exe 40 PID 392 wrote to memory of 2360 392 pjtbhb.exe 40 PID 392 wrote to memory of 2360 392 pjtbhb.exe 40 PID 2360 wrote to memory of 2956 2360 lrtfpn.exe 41 PID 2360 wrote to memory of 2956 2360 lrtfpn.exe 41 PID 2360 wrote to memory of 2956 2360 lrtfpn.exe 41 PID 2360 wrote to memory of 2956 2360 lrtfpn.exe 41 PID 2956 wrote to memory of 2164 2956 vxtvjj.exe 42 PID 2956 wrote to memory of 2164 2956 vxtvjj.exe 42 PID 2956 wrote to memory of 2164 2956 vxtvjj.exe 42 PID 2956 wrote to memory of 2164 2956 vxtvjj.exe 42 PID 2164 wrote to memory of 2952 2164 rnfjnb.exe 43 PID 2164 wrote to memory of 2952 2164 rnfjnb.exe 43 PID 2164 wrote to memory of 2952 2164 rnfjnb.exe 43 PID 2164 wrote to memory of 2952 2164 rnfjnb.exe 43 PID 2952 wrote to memory of 2372 2952 fvpbf.exe 44 PID 2952 wrote to memory of 2372 2952 fvpbf.exe 44 PID 2952 wrote to memory of 2372 2952 fvpbf.exe 44 PID 2952 wrote to memory of 2372 2952 fvpbf.exe 44 PID 2372 wrote to memory of 2104 2372 xnjrfv.exe 45 PID 2372 wrote to memory of 2104 2372 xnjrfv.exe 45 PID 2372 wrote to memory of 2104 2372 xnjrfv.exe 45 PID 2372 wrote to memory of 2104 2372 xnjrfv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8658eba4a56c98472abd220c893a5d29728ee345c6e7cd9fa7cebd97a7deeceN.exe"C:\Users\Admin\AppData\Local\Temp\a8658eba4a56c98472abd220c893a5d29728ee345c6e7cd9fa7cebd97a7deeceN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\bxpdxj.exec:\bxpdxj.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\xftdp.exec:\xftdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\nvhvvrt.exec:\nvhvvrt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\jnnvvdr.exec:\jnnvvdr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\ndnfpx.exec:\ndnfpx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\hlljvhf.exec:\hlljvhf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\lhbnbvn.exec:\lhbnbvn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\pnfhnhp.exec:\pnfhnhp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\vvrvttd.exec:\vvrvttd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\pjtbhb.exec:\pjtbhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\lrtfpn.exec:\lrtfpn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\vxtvjj.exec:\vxtvjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\rnfjnb.exec:\rnfjnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\fvpbf.exec:\fvpbf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\xnjrfv.exec:\xnjrfv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\xtfjh.exec:\xtfjh.exe17⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rlppnpv.exec:\rlppnpv.exe18⤵
- Executes dropped EXE
PID:912 -
\??\c:\vxhvfxt.exec:\vxhvfxt.exe19⤵
- Executes dropped EXE
PID:2324 -
\??\c:\xvjrj.exec:\xvjrj.exe20⤵
- Executes dropped EXE
PID:2444 -
\??\c:\bxdpv.exec:\bxdpv.exe21⤵
- Executes dropped EXE
PID:2468 -
\??\c:\lrbjh.exec:\lrbjh.exe22⤵
- Executes dropped EXE
PID:1608 -
\??\c:\ppxpfh.exec:\ppxpfh.exe23⤵
- Executes dropped EXE
PID:2356 -
\??\c:\llldlr.exec:\llldlr.exe24⤵
- Executes dropped EXE
PID:840 -
\??\c:\dlxvvbt.exec:\dlxvvbt.exe25⤵
- Executes dropped EXE
PID:1456 -
\??\c:\pnjfv.exec:\pnjfv.exe26⤵
- Executes dropped EXE
PID:1972 -
\??\c:\hhflpb.exec:\hhflpb.exe27⤵
- Executes dropped EXE
PID:1520 -
\??\c:\dxtrn.exec:\dxtrn.exe28⤵
- Executes dropped EXE
PID:1492 -
\??\c:\ddrbr.exec:\ddrbr.exe29⤵
- Executes dropped EXE
PID:1604 -
\??\c:\xjhnhj.exec:\xjhnhj.exe30⤵
- Executes dropped EXE
PID:2516 -
\??\c:\rtdbfnr.exec:\rtdbfnr.exe31⤵
- Executes dropped EXE
PID:1336 -
\??\c:\tpdpnb.exec:\tpdpnb.exe32⤵
- Executes dropped EXE
PID:908 -
\??\c:\hvbhldp.exec:\hvbhldp.exe33⤵
- Executes dropped EXE
PID:2276 -
\??\c:\pthjnp.exec:\pthjnp.exe34⤵
- Executes dropped EXE
PID:2508 -
\??\c:\jhvhf.exec:\jhvhf.exe35⤵PID:1564
-
\??\c:\vxxfvpj.exec:\vxxfvpj.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1504 -
\??\c:\pbltjj.exec:\pbltjj.exe37⤵
- Executes dropped EXE
PID:2744 -
\??\c:\hdxrhr.exec:\hdxrhr.exe38⤵
- Executes dropped EXE
PID:2480 -
\??\c:\tdlxhxn.exec:\tdlxhxn.exe39⤵
- Executes dropped EXE
PID:2804 -
\??\c:\jbvph.exec:\jbvph.exe40⤵
- Executes dropped EXE
PID:2776 -
\??\c:\hlrpblx.exec:\hlrpblx.exe41⤵
- Executes dropped EXE
PID:2812 -
\??\c:\lrlvhv.exec:\lrlvhv.exe42⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jpjxjfl.exec:\jpjxjfl.exe43⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rtrvjx.exec:\rtrvjx.exe44⤵
- Executes dropped EXE
PID:2708 -
\??\c:\nfbjpv.exec:\nfbjpv.exe45⤵
- Executes dropped EXE
PID:2712 -
\??\c:\jttnbt.exec:\jttnbt.exe46⤵
- Executes dropped EXE
PID:1032 -
\??\c:\jnjhj.exec:\jnjhj.exe47⤵
- Executes dropped EXE
PID:884 -
\??\c:\xbpjf.exec:\xbpjf.exe48⤵
- Executes dropped EXE
PID:772 -
\??\c:\txfnxhr.exec:\txfnxhr.exe49⤵
- Executes dropped EXE
PID:2592 -
\??\c:\thvbp.exec:\thvbp.exe50⤵
- Executes dropped EXE
PID:1612 -
\??\c:\fvftlrf.exec:\fvftlrf.exe51⤵
- Executes dropped EXE
PID:2748 -
\??\c:\xfjxfn.exec:\xfjxfn.exe52⤵
- Executes dropped EXE
PID:1532 -
\??\c:\jxfhx.exec:\jxfhx.exe53⤵
- Executes dropped EXE
PID:2236 -
\??\c:\rdnnj.exec:\rdnnj.exe54⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ttrrb.exec:\ttrrb.exe55⤵
- Executes dropped EXE
PID:1004 -
\??\c:\bnnjtxt.exec:\bnnjtxt.exe56⤵
- Executes dropped EXE
PID:1572 -
\??\c:\tvvnfh.exec:\tvvnfh.exe57⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jlljhp.exec:\jlljhp.exe58⤵
- Executes dropped EXE
PID:1360 -
\??\c:\xfftt.exec:\xfftt.exe59⤵
- Executes dropped EXE
PID:1156 -
\??\c:\jvdxx.exec:\jvdxx.exe60⤵
- Executes dropped EXE
PID:2172 -
\??\c:\rllrvdn.exec:\rllrvdn.exe61⤵
- Executes dropped EXE
PID:1320 -
\??\c:\bxthjh.exec:\bxthjh.exe62⤵
- Executes dropped EXE
PID:2248 -
\??\c:\fbttppx.exec:\fbttppx.exe63⤵
- Executes dropped EXE
PID:876 -
\??\c:\rtppr.exec:\rtppr.exe64⤵
- Executes dropped EXE
PID:1968 -
\??\c:\drhvbvt.exec:\drhvbvt.exe65⤵
- Executes dropped EXE
PID:2612 -
\??\c:\lnfjlp.exec:\lnfjlp.exe66⤵
- Executes dropped EXE
PID:1868 -
\??\c:\njhjt.exec:\njhjt.exe67⤵PID:1316
-
\??\c:\dxxxn.exec:\dxxxn.exe68⤵PID:1356
-
\??\c:\jrhnvv.exec:\jrhnvv.exe69⤵PID:1860
-
\??\c:\tjhtdj.exec:\tjhtdj.exe70⤵PID:744
-
\??\c:\dfvvfx.exec:\dfvvfx.exe71⤵PID:1604
-
\??\c:\xxhhjjl.exec:\xxhhjjl.exe72⤵PID:1628
-
\??\c:\bbrxjxj.exec:\bbrxjxj.exe73⤵PID:1932
-
\??\c:\xtrhhhx.exec:\xtrhhhx.exe74⤵PID:2204
-
\??\c:\tfrppvp.exec:\tfrppvp.exe75⤵PID:2280
-
\??\c:\hjvftj.exec:\hjvftj.exe76⤵PID:2112
-
\??\c:\hvdvvtx.exec:\hvdvvtx.exe77⤵PID:1852
-
\??\c:\dhfvh.exec:\dhfvh.exe78⤵PID:1600
-
\??\c:\xnjrnn.exec:\xnjrnn.exe79⤵PID:1564
-
\??\c:\rxfdn.exec:\rxfdn.exe80⤵PID:2456
-
\??\c:\lhjbdxt.exec:\lhjbdxt.exe81⤵PID:2744
-
\??\c:\jvhhpnp.exec:\jvhhpnp.exe82⤵PID:3064
-
\??\c:\ttjvp.exec:\ttjvp.exe83⤵PID:1508
-
\??\c:\pbxptf.exec:\pbxptf.exe84⤵PID:2936
-
\??\c:\bnbtjxx.exec:\bnbtjxx.exe85⤵PID:2676
-
\??\c:\bvbvf.exec:\bvbvf.exe86⤵PID:2904
-
\??\c:\brbnbvt.exec:\brbnbvt.exe87⤵PID:2664
-
\??\c:\xxfnbbd.exec:\xxfnbbd.exe88⤵PID:2632
-
\??\c:\drfnl.exec:\drfnl.exe89⤵PID:1780
-
\??\c:\prdbpf.exec:\prdbpf.exe90⤵PID:2404
-
\??\c:\pflvhvh.exec:\pflvhvh.exe91⤵PID:2588
-
\??\c:\tnrvxpd.exec:\tnrvxpd.exe92⤵PID:3020
-
\??\c:\jflbltj.exec:\jflbltj.exe93⤵PID:2596
-
\??\c:\bpllndp.exec:\bpllndp.exe94⤵PID:2956
-
\??\c:\xlrlj.exec:\xlrlj.exe95⤵PID:1964
-
\??\c:\fdhbr.exec:\fdhbr.exe96⤵PID:1640
-
\??\c:\vddpn.exec:\vddpn.exe97⤵PID:1384
-
\??\c:\bphdb.exec:\bphdb.exe98⤵PID:808
-
\??\c:\xvfpdlb.exec:\xvfpdlb.exe99⤵PID:1740
-
\??\c:\jtfhpjh.exec:\jtfhpjh.exe100⤵PID:2076
-
\??\c:\lffljfb.exec:\lffljfb.exe101⤵PID:3060
-
\??\c:\xlfxl.exec:\xlfxl.exe102⤵PID:2428
-
\??\c:\pbxbfb.exec:\pbxbfb.exe103⤵PID:2452
-
\??\c:\rvfbt.exec:\rvfbt.exe104⤵PID:2312
-
\??\c:\pftjpfh.exec:\pftjpfh.exe105⤵PID:996
-
\??\c:\lrlrn.exec:\lrlrn.exe106⤵PID:2436
-
\??\c:\tjfpfd.exec:\tjfpfd.exe107⤵PID:1904
-
\??\c:\hrdpbd.exec:\hrdpbd.exe108⤵PID:1976
-
\??\c:\rpnlvlp.exec:\rpnlvlp.exe109⤵
- System Location Discovery: System Language Discovery
PID:2268 -
\??\c:\hhhvfr.exec:\hhhvfr.exe110⤵PID:2552
-
\??\c:\lrbpp.exec:\lrbpp.exe111⤵PID:1128
-
\??\c:\pdnxp.exec:\pdnxp.exe112⤵
- System Location Discovery: System Language Discovery
PID:2220 -
\??\c:\plhfrhl.exec:\plhfrhl.exe113⤵PID:1356
-
\??\c:\rvhrrxf.exec:\rvhrrxf.exe114⤵PID:1860
-
\??\c:\rbpjr.exec:\rbpjr.exe115⤵
- System Location Discovery: System Language Discovery
PID:2252 -
\??\c:\nvfpxn.exec:\nvfpxn.exe116⤵PID:2536
-
\??\c:\vnxpbff.exec:\vnxpbff.exe117⤵PID:1864
-
\??\c:\fvflff.exec:\fvflff.exe118⤵PID:2524
-
\??\c:\vvvbdj.exec:\vvvbdj.exe119⤵
- System Location Discovery: System Language Discovery
PID:1672 -
\??\c:\ndhxxht.exec:\ndhxxht.exe120⤵PID:3040
-
\??\c:\frxnbx.exec:\frxnbx.exe121⤵PID:2208
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-