Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 22:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe
-
Size
453KB
-
MD5
94da7d64bbcaa3d3eac8984cc2c7131d
-
SHA1
7012e588c2711449d5658246a2d47049d9f47e02
-
SHA256
42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82
-
SHA512
703ee914dea5cc2c63a17079e1db7404f6deec62e65c5016bbe030b9a572151a4b59c36d3a27f2749df2a0529e7bf10bb68252709ea4aa8154971d524d09e520
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2244-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-173-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2228-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/948-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-302-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/640-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/308-371-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-411-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3052-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-499-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1852-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/932-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-629-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2836-715-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/840-727-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1108-766-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2680-829-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1772-846-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2448 ljtnx.exe 2960 vhnxxrj.exe 2852 hlxvx.exe 1824 fjtvdbh.exe 3068 fvlhn.exe 2792 bjhtx.exe 2800 pftprxj.exe 2796 flfdf.exe 3048 ppfrdxx.exe 2012 bfblxp.exe 2196 jlpph.exe 3064 xbtxdbn.exe 2508 drtrhd.exe 3060 nlfrhn.exe 2504 vtxfrl.exe 2152 lxdhjr.exe 1548 nlltd.exe 2460 xxxltj.exe 2228 hxxdpfp.exe 2232 lxnphpl.exe 1072 blrxvt.exe 320 dbbdvv.exe 1556 nlhlpp.exe 948 pvxph.exe 2724 lrvdlx.exe 2100 nnjtftn.exe 1768 txthn.exe 1384 jxfvx.exe 2676 pvdjnfl.exe 2660 btdtd.exe 2352 tthdh.exe 2328 lndnxp.exe 2472 vxhfb.exe 1584 tbvxbr.exe 2840 nhhpn.exe 640 drdpfrv.exe 2204 vrjdpv.exe 3008 vdppr.exe 2908 pptpnp.exe 308 fphxnxd.exe 2884 djrplbp.exe 2752 xjdvjth.exe 2768 vxrjpnh.exe 2800 nxllr.exe 1672 pjfhnf.exe 388 bbvldrh.exe 2180 vpfhdfn.exe 2816 lvlpr.exe 3052 dltdlv.exe 2444 pfhpp.exe 2808 jtddrth.exe 2736 fdxtjxn.exe 2656 lpnvt.exe 1468 hfxlhxb.exe 1956 nnrljb.exe 2220 hdnhh.exe 2200 xrbpl.exe 1204 fltrhhn.exe 2276 rjlpfl.exe 2232 rvtlrdj.exe 2212 brbvht.exe 908 vjldxdl.exe 1388 dtvxpp.exe 900 rbbbrxv.exe -
resource yara_rule behavioral1/memory/2244-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-727-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1020-767-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-826-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-829-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1524-854-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlfnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhrnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrbpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnrdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbxhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llpxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxtjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prhvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdrbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbbbrxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhjhxpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpxxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxhvtll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpljxpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpdtdpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlnpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntrjrpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nphrdvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpxvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvlvvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfblxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fltrhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnptp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btrrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfhpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjxdfnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxvrxb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2448 2244 42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe 30 PID 2244 wrote to memory of 2448 2244 42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe 30 PID 2244 wrote to memory of 2448 2244 42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe 30 PID 2244 wrote to memory of 2448 2244 42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe 30 PID 2448 wrote to memory of 2960 2448 ljtnx.exe 31 PID 2448 wrote to memory of 2960 2448 ljtnx.exe 31 PID 2448 wrote to memory of 2960 2448 ljtnx.exe 31 PID 2448 wrote to memory of 2960 2448 ljtnx.exe 31 PID 2960 wrote to memory of 2852 2960 vhnxxrj.exe 32 PID 2960 wrote to memory of 2852 2960 vhnxxrj.exe 32 PID 2960 wrote to memory of 2852 2960 vhnxxrj.exe 32 PID 2960 wrote to memory of 2852 2960 vhnxxrj.exe 32 PID 2852 wrote to memory of 1824 2852 hlxvx.exe 33 PID 2852 wrote to memory of 1824 2852 hlxvx.exe 33 PID 2852 wrote to memory of 1824 2852 hlxvx.exe 33 PID 2852 wrote to memory of 1824 2852 hlxvx.exe 33 PID 1824 wrote to memory of 3068 1824 fjtvdbh.exe 34 PID 1824 wrote to memory of 3068 1824 fjtvdbh.exe 34 PID 1824 wrote to memory of 3068 1824 fjtvdbh.exe 34 PID 1824 wrote to memory of 3068 1824 fjtvdbh.exe 34 PID 3068 wrote to memory of 2792 3068 fvlhn.exe 35 PID 3068 wrote to memory of 2792 3068 fvlhn.exe 35 PID 3068 wrote to memory of 2792 3068 fvlhn.exe 35 PID 3068 wrote to memory of 2792 3068 fvlhn.exe 35 PID 2792 wrote to memory of 2800 2792 bjhtx.exe 36 PID 2792 wrote to memory of 2800 2792 bjhtx.exe 36 PID 2792 wrote to memory of 2800 2792 bjhtx.exe 36 PID 2792 wrote to memory of 2800 2792 bjhtx.exe 36 PID 2800 wrote to memory of 2796 2800 pftprxj.exe 37 PID 2800 wrote to memory of 2796 2800 pftprxj.exe 37 PID 2800 wrote to memory of 2796 2800 pftprxj.exe 37 PID 2800 wrote to memory of 2796 2800 pftprxj.exe 37 PID 2796 wrote to memory of 3048 2796 flfdf.exe 38 PID 2796 wrote to memory of 3048 2796 flfdf.exe 38 PID 2796 wrote to memory of 3048 2796 flfdf.exe 38 PID 2796 wrote to memory of 3048 2796 flfdf.exe 38 PID 3048 wrote to memory of 2012 3048 ppfrdxx.exe 39 PID 3048 wrote to memory of 2012 3048 ppfrdxx.exe 39 PID 3048 wrote to memory of 2012 3048 ppfrdxx.exe 39 PID 3048 wrote to memory of 2012 3048 ppfrdxx.exe 39 PID 2012 wrote to memory of 2196 2012 bfblxp.exe 40 PID 2012 wrote to memory of 2196 2012 bfblxp.exe 40 PID 2012 wrote to memory of 2196 2012 bfblxp.exe 40 PID 2012 wrote to memory of 2196 2012 bfblxp.exe 40 PID 2196 wrote to memory of 3064 2196 jlpph.exe 41 PID 2196 wrote to memory of 3064 2196 jlpph.exe 41 PID 2196 wrote to memory of 3064 2196 jlpph.exe 41 PID 2196 wrote to memory of 3064 2196 jlpph.exe 41 PID 3064 wrote to memory of 2508 3064 xbtxdbn.exe 42 PID 3064 wrote to memory of 2508 3064 xbtxdbn.exe 42 PID 3064 wrote to memory of 2508 3064 xbtxdbn.exe 42 PID 3064 wrote to memory of 2508 3064 xbtxdbn.exe 42 PID 2508 wrote to memory of 3060 2508 drtrhd.exe 43 PID 2508 wrote to memory of 3060 2508 drtrhd.exe 43 PID 2508 wrote to memory of 3060 2508 drtrhd.exe 43 PID 2508 wrote to memory of 3060 2508 drtrhd.exe 43 PID 3060 wrote to memory of 2504 3060 nlfrhn.exe 44 PID 3060 wrote to memory of 2504 3060 nlfrhn.exe 44 PID 3060 wrote to memory of 2504 3060 nlfrhn.exe 44 PID 3060 wrote to memory of 2504 3060 nlfrhn.exe 44 PID 2504 wrote to memory of 2152 2504 vtxfrl.exe 45 PID 2504 wrote to memory of 2152 2504 vtxfrl.exe 45 PID 2504 wrote to memory of 2152 2504 vtxfrl.exe 45 PID 2504 wrote to memory of 2152 2504 vtxfrl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe"C:\Users\Admin\AppData\Local\Temp\42a1fc626ac52889a37c08603411caf91e322e1410afe7aec25daf92edcddf82.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\ljtnx.exec:\ljtnx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\vhnxxrj.exec:\vhnxxrj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\hlxvx.exec:\hlxvx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\fjtvdbh.exec:\fjtvdbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\fvlhn.exec:\fvlhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\bjhtx.exec:\bjhtx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\pftprxj.exec:\pftprxj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\flfdf.exec:\flfdf.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\ppfrdxx.exec:\ppfrdxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\bfblxp.exec:\bfblxp.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\jlpph.exec:\jlpph.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\xbtxdbn.exec:\xbtxdbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\drtrhd.exec:\drtrhd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\nlfrhn.exec:\nlfrhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\vtxfrl.exec:\vtxfrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\lxdhjr.exec:\lxdhjr.exe17⤵
- Executes dropped EXE
PID:2152 -
\??\c:\nlltd.exec:\nlltd.exe18⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xxxltj.exec:\xxxltj.exe19⤵
- Executes dropped EXE
PID:2460 -
\??\c:\hxxdpfp.exec:\hxxdpfp.exe20⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lxnphpl.exec:\lxnphpl.exe21⤵
- Executes dropped EXE
PID:2232 -
\??\c:\blrxvt.exec:\blrxvt.exe22⤵
- Executes dropped EXE
PID:1072 -
\??\c:\dbbdvv.exec:\dbbdvv.exe23⤵
- Executes dropped EXE
PID:320 -
\??\c:\nlhlpp.exec:\nlhlpp.exe24⤵
- Executes dropped EXE
PID:1556 -
\??\c:\pvxph.exec:\pvxph.exe25⤵
- Executes dropped EXE
PID:948 -
\??\c:\lrvdlx.exec:\lrvdlx.exe26⤵
- Executes dropped EXE
PID:2724 -
\??\c:\nnjtftn.exec:\nnjtftn.exe27⤵
- Executes dropped EXE
PID:2100 -
\??\c:\txthn.exec:\txthn.exe28⤵
- Executes dropped EXE
PID:1768 -
\??\c:\jxfvx.exec:\jxfvx.exe29⤵
- Executes dropped EXE
PID:1384 -
\??\c:\pvdjnfl.exec:\pvdjnfl.exe30⤵
- Executes dropped EXE
PID:2676 -
\??\c:\btdtd.exec:\btdtd.exe31⤵
- Executes dropped EXE
PID:2660 -
\??\c:\tthdh.exec:\tthdh.exe32⤵
- Executes dropped EXE
PID:2352 -
\??\c:\lndnxp.exec:\lndnxp.exe33⤵
- Executes dropped EXE
PID:2328 -
\??\c:\vxhfb.exec:\vxhfb.exe34⤵
- Executes dropped EXE
PID:2472 -
\??\c:\tbvxbr.exec:\tbvxbr.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\nhhpn.exec:\nhhpn.exe36⤵
- Executes dropped EXE
PID:2840 -
\??\c:\drdpfrv.exec:\drdpfrv.exe37⤵
- Executes dropped EXE
PID:640 -
\??\c:\vrjdpv.exec:\vrjdpv.exe38⤵
- Executes dropped EXE
PID:2204 -
\??\c:\vdppr.exec:\vdppr.exe39⤵
- Executes dropped EXE
PID:3008 -
\??\c:\pptpnp.exec:\pptpnp.exe40⤵
- Executes dropped EXE
PID:2908 -
\??\c:\fphxnxd.exec:\fphxnxd.exe41⤵
- Executes dropped EXE
PID:308 -
\??\c:\djrplbp.exec:\djrplbp.exe42⤵
- Executes dropped EXE
PID:2884 -
\??\c:\xjdvjth.exec:\xjdvjth.exe43⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vxrjpnh.exec:\vxrjpnh.exe44⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nxllr.exec:\nxllr.exe45⤵
- Executes dropped EXE
PID:2800 -
\??\c:\pjfhnf.exec:\pjfhnf.exe46⤵
- Executes dropped EXE
PID:1672 -
\??\c:\bbvldrh.exec:\bbvldrh.exe47⤵
- Executes dropped EXE
PID:388 -
\??\c:\vpfhdfn.exec:\vpfhdfn.exe48⤵
- Executes dropped EXE
PID:2180 -
\??\c:\lvlpr.exec:\lvlpr.exe49⤵
- Executes dropped EXE
PID:2816 -
\??\c:\dltdlv.exec:\dltdlv.exe50⤵
- Executes dropped EXE
PID:3052 -
\??\c:\pfhpp.exec:\pfhpp.exe51⤵
- Executes dropped EXE
PID:2444 -
\??\c:\jtddrth.exec:\jtddrth.exe52⤵
- Executes dropped EXE
PID:2808 -
\??\c:\fdxtjxn.exec:\fdxtjxn.exe53⤵
- Executes dropped EXE
PID:2736 -
\??\c:\lpnvt.exec:\lpnvt.exe54⤵
- Executes dropped EXE
PID:2656 -
\??\c:\hfxlhxb.exec:\hfxlhxb.exe55⤵
- Executes dropped EXE
PID:1468 -
\??\c:\nnrljb.exec:\nnrljb.exe56⤵
- Executes dropped EXE
PID:1956 -
\??\c:\hdnhh.exec:\hdnhh.exe57⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xrbpl.exec:\xrbpl.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2200 -
\??\c:\fltrhhn.exec:\fltrhhn.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1204 -
\??\c:\rjlpfl.exec:\rjlpfl.exe60⤵
- Executes dropped EXE
PID:2276 -
\??\c:\rvtlrdj.exec:\rvtlrdj.exe61⤵
- Executes dropped EXE
PID:2232 -
\??\c:\brbvht.exec:\brbvht.exe62⤵
- Executes dropped EXE
PID:2212 -
\??\c:\vjldxdl.exec:\vjldxdl.exe63⤵
- Executes dropped EXE
PID:908 -
\??\c:\dtvxpp.exec:\dtvxpp.exe64⤵
- Executes dropped EXE
PID:1388 -
\??\c:\rbbbrxv.exec:\rbbbrxv.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:900 -
\??\c:\jjptxhp.exec:\jjptxhp.exe66⤵PID:236
-
\??\c:\pjnxnx.exec:\pjnxnx.exe67⤵PID:2388
-
\??\c:\vbdjfl.exec:\vbdjfl.exe68⤵PID:776
-
\??\c:\nhhvrb.exec:\nhhvrb.exe69⤵PID:1216
-
\??\c:\vfllv.exec:\vfllv.exe70⤵PID:2680
-
\??\c:\xrtvpd.exec:\xrtvpd.exe71⤵PID:1544
-
\??\c:\ltfxhln.exec:\ltfxhln.exe72⤵PID:1852
-
\??\c:\pjpvthf.exec:\pjpvthf.exe73⤵PID:1664
-
\??\c:\vdppr.exec:\vdppr.exe74⤵PID:1700
-
\??\c:\lfffnd.exec:\lfffnd.exe75⤵PID:884
-
\??\c:\lppbt.exec:\lppbt.exe76⤵PID:2416
-
\??\c:\phjhj.exec:\phjhj.exe77⤵PID:2216
-
\??\c:\lndvt.exec:\lndvt.exe78⤵PID:2224
-
\??\c:\xfvxjb.exec:\xfvxjb.exe79⤵PID:1612
-
\??\c:\nhbnjd.exec:\nhbnjd.exe80⤵
- System Location Discovery: System Language Discovery
PID:932 -
\??\c:\djpfv.exec:\djpfv.exe81⤵PID:640
-
\??\c:\lthtvl.exec:\lthtvl.exe82⤵PID:2856
-
\??\c:\jnnthpv.exec:\jnnthpv.exe83⤵PID:3012
-
\??\c:\jphdvrd.exec:\jphdvrd.exe84⤵PID:2616
-
\??\c:\pxpdxxp.exec:\pxpdxxp.exe85⤵PID:2588
-
\??\c:\dtbhbh.exec:\dtbhbh.exe86⤵PID:2620
-
\??\c:\xtpltfx.exec:\xtpltfx.exe87⤵PID:2612
-
\??\c:\plbbltb.exec:\plbbltb.exe88⤵PID:2608
-
\??\c:\nprlplf.exec:\nprlplf.exe89⤵PID:944
-
\??\c:\rvvnh.exec:\rvvnh.exe90⤵PID:588
-
\??\c:\ptdtpl.exec:\ptdtpl.exe91⤵PID:1624
-
\??\c:\xvdtdtt.exec:\xvdtdtt.exe92⤵PID:896
-
\??\c:\ddvtjl.exec:\ddvtjl.exe93⤵PID:2788
-
\??\c:\bjjvx.exec:\bjjvx.exe94⤵PID:2772
-
\??\c:\lrfhxl.exec:\lrfhxl.exe95⤵PID:1968
-
\??\c:\nbnhx.exec:\nbnhx.exe96⤵PID:2836
-
\??\c:\lvrfvh.exec:\lvrfvh.exe97⤵PID:2408
-
\??\c:\ltnjpb.exec:\ltnjpb.exe98⤵PID:840
-
\??\c:\rxvhlnb.exec:\rxvhlnb.exe99⤵PID:2308
-
\??\c:\tdnrl.exec:\tdnrl.exe100⤵PID:1108
-
\??\c:\vdfdb.exec:\vdfdb.exe101⤵PID:2260
-
\??\c:\pxhldp.exec:\pxhldp.exe102⤵PID:2300
-
\??\c:\hbnrj.exec:\hbnrj.exe103⤵PID:2288
-
\??\c:\xjdhbr.exec:\xjdhbr.exe104⤵PID:1020
-
\??\c:\pffhxl.exec:\pffhxl.exe105⤵PID:560
-
\??\c:\jnjfdx.exec:\jnjfdx.exe106⤵PID:2636
-
\??\c:\bhltr.exec:\bhltr.exe107⤵PID:1828
-
\??\c:\nlhpvt.exec:\nlhpvt.exe108⤵PID:2644
-
\??\c:\ddbfv.exec:\ddbfv.exe109⤵PID:1680
-
\??\c:\lnrlp.exec:\lnrlp.exe110⤵PID:2388
-
\??\c:\xfbnld.exec:\xfbnld.exe111⤵PID:1192
-
\??\c:\nhnvljn.exec:\nhnvljn.exe112⤵PID:1464
-
\??\c:\ttpdvb.exec:\ttpdvb.exe113⤵PID:2680
-
\??\c:\vxtvh.exec:\vxtvh.exe114⤵PID:332
-
\??\c:\flhphv.exec:\flhphv.exe115⤵PID:1772
-
\??\c:\jxlrnf.exec:\jxlrnf.exe116⤵PID:1928
-
\??\c:\hrldxnh.exec:\hrldxnh.exe117⤵PID:1524
-
\??\c:\htpdnb.exec:\htpdnb.exe118⤵PID:2244
-
\??\c:\tpdpr.exec:\tpdpr.exe119⤵PID:2936
-
\??\c:\drpdhh.exec:\drpdhh.exe120⤵PID:2964
-
\??\c:\bhdnhlb.exec:\bhdnhlb.exe121⤵PID:2840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-