Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 23:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
84a3b08624cd23e257d999cf1ef854447b458728d6b1984d3e941832842d0537N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
84a3b08624cd23e257d999cf1ef854447b458728d6b1984d3e941832842d0537N.exe
-
Size
454KB
-
MD5
afeb0480f3857e8707766b0c78481da0
-
SHA1
fa11e081176e054e6e35f88408418a1c25093135
-
SHA256
84a3b08624cd23e257d999cf1ef854447b458728d6b1984d3e941832842d0537
-
SHA512
f42990f8a0523977c8a8ba645b3af6d950691a8353038300f630238cecb11da461608817c9886a97525e6ed1eadee5ce0a7b4c227f5647de2160ae4c4d83d916
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeK:q7Tc2NYHUrAwfMp3CDK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/1560-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-22-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2108-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-46-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2220-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-99-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1196-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/656-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/964-244-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1716-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/640-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-334-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3052-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-373-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2848-382-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2660-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-597-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2228-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-622-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2964-637-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2664-686-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1484-739-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/940-1068-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1560 ntfhv.exe 1104 njhfx.exe 2108 tdlnr.exe 1920 fxnhp.exe 2220 pbldfbj.exe 2788 vhvhv.exe 2908 rtrxrdb.exe 2700 nhxvrj.exe 1904 djhbd.exe 2740 nvhxdr.exe 2044 bfhjd.exe 2736 lttvv.exe 1196 jjllp.exe 1188 fdtvdr.exe 2332 lhlrbd.exe 2020 thhpblb.exe 1484 xhrjvxn.exe 2288 hjbnhn.exe 3020 ltvnl.exe 2268 lfdrpj.exe 1808 ttppxt.exe 560 lhdvlxh.exe 2588 xnrfr.exe 656 rntxlr.exe 1616 jvtdr.exe 964 tlbfxjj.exe 1716 rfxhn.exe 640 hlbfh.exe 1820 nhjbp.exe 2516 plhldb.exe 1896 bnvfj.exe 2172 prdxlvp.exe 2444 vrrbr.exe 2080 fldnh.exe 2076 bfxvj.exe 1704 fxpxft.exe 2760 vdrftfr.exe 2864 vpljpnv.exe 2956 jtppv.exe 2220 tfxlhbt.exe 3052 ppxnb.exe 2952 fdlfrpf.exe 2936 bnflffh.exe 2848 ffvrdrf.exe 2692 prndx.exe 2120 jljfjx.exe 524 pbjxx.exe 2660 pdtthh.exe 1200 plhtndl.exe 1880 lfxtfxv.exe 1328 pxpllx.exe 1644 pbbhj.exe 2056 hllpbh.exe 1488 xfxxx.exe 2000 rdvdhd.exe 1992 nlhpvv.exe 2636 fnjjjr.exe 3004 txbxxbh.exe 2132 txhdb.exe 112 vxxlp.exe 2772 jtpvj.exe 1380 nppdt.exe 3032 pptlh.exe 1516 dlvlppt.exe -
resource yara_rule behavioral1/memory/1560-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/656-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-733-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-808-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-891-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-904-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-967-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-993-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-1018-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-1049-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-1068-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-1153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-1191-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfbbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvldt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txtvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbnjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfdjnxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlfdlhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnlfdxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fppftdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnhnrjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffjnxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnxpbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjptdrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljdfxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltfvjtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptvvtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpnlfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjtvhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jflflh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlpfdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlffxrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdpbxhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pthlbhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbpfnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvnxphj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lljjlfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpxrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fblrnpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjxbln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxlhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlnrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdtljdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfhbnjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnvfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfdrxft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdtjhlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvpthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpjnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhhrtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvbdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1560 2240 84a3b08624cd23e257d999cf1ef854447b458728d6b1984d3e941832842d0537N.exe 30 PID 2240 wrote to memory of 1560 2240 84a3b08624cd23e257d999cf1ef854447b458728d6b1984d3e941832842d0537N.exe 30 PID 2240 wrote to memory of 1560 2240 84a3b08624cd23e257d999cf1ef854447b458728d6b1984d3e941832842d0537N.exe 30 PID 2240 wrote to memory of 1560 2240 84a3b08624cd23e257d999cf1ef854447b458728d6b1984d3e941832842d0537N.exe 30 PID 1560 wrote to memory of 1104 1560 ntfhv.exe 31 PID 1560 wrote to memory of 1104 1560 ntfhv.exe 31 PID 1560 wrote to memory of 1104 1560 ntfhv.exe 31 PID 1560 wrote to memory of 1104 1560 ntfhv.exe 31 PID 1104 wrote to memory of 2108 1104 njhfx.exe 32 PID 1104 wrote to memory of 2108 1104 njhfx.exe 32 PID 1104 wrote to memory of 2108 1104 njhfx.exe 32 PID 1104 wrote to memory of 2108 1104 njhfx.exe 32 PID 2108 wrote to memory of 1920 2108 tdlnr.exe 33 PID 2108 wrote to memory of 1920 2108 tdlnr.exe 33 PID 2108 wrote to memory of 1920 2108 tdlnr.exe 33 PID 2108 wrote to memory of 1920 2108 tdlnr.exe 33 PID 1920 wrote to memory of 2220 1920 fxnhp.exe 34 PID 1920 wrote to memory of 2220 1920 fxnhp.exe 34 PID 1920 wrote to memory of 2220 1920 fxnhp.exe 34 PID 1920 wrote to memory of 2220 1920 fxnhp.exe 34 PID 2220 wrote to memory of 2788 2220 pbldfbj.exe 35 PID 2220 wrote to memory of 2788 2220 pbldfbj.exe 35 PID 2220 wrote to memory of 2788 2220 pbldfbj.exe 35 PID 2220 wrote to memory of 2788 2220 pbldfbj.exe 35 PID 2788 wrote to memory of 2908 2788 vhvhv.exe 36 PID 2788 wrote to memory of 2908 2788 vhvhv.exe 36 PID 2788 wrote to memory of 2908 2788 vhvhv.exe 36 PID 2788 wrote to memory of 2908 2788 vhvhv.exe 36 PID 2908 wrote to memory of 2700 2908 rtrxrdb.exe 37 PID 2908 wrote to memory of 2700 2908 rtrxrdb.exe 37 PID 2908 wrote to memory of 2700 2908 rtrxrdb.exe 37 PID 2908 wrote to memory of 2700 2908 rtrxrdb.exe 37 PID 2700 wrote to memory of 1904 2700 nhxvrj.exe 38 PID 2700 wrote to memory of 1904 2700 nhxvrj.exe 38 PID 2700 wrote to memory of 1904 2700 nhxvrj.exe 38 PID 2700 wrote to memory of 1904 2700 nhxvrj.exe 38 PID 1904 wrote to memory of 2740 1904 djhbd.exe 39 PID 1904 wrote to memory of 2740 1904 djhbd.exe 39 PID 1904 wrote to memory of 2740 1904 djhbd.exe 39 PID 1904 wrote to memory of 2740 1904 djhbd.exe 39 PID 2740 wrote to memory of 2044 2740 nvhxdr.exe 40 PID 2740 wrote to memory of 2044 2740 nvhxdr.exe 40 PID 2740 wrote to memory of 2044 2740 nvhxdr.exe 40 PID 2740 wrote to memory of 2044 2740 nvhxdr.exe 40 PID 2044 wrote to memory of 2736 2044 bfhjd.exe 41 PID 2044 wrote to memory of 2736 2044 bfhjd.exe 41 PID 2044 wrote to memory of 2736 2044 bfhjd.exe 41 PID 2044 wrote to memory of 2736 2044 bfhjd.exe 41 PID 2736 wrote to memory of 1196 2736 lttvv.exe 42 PID 2736 wrote to memory of 1196 2736 lttvv.exe 42 PID 2736 wrote to memory of 1196 2736 lttvv.exe 42 PID 2736 wrote to memory of 1196 2736 lttvv.exe 42 PID 1196 wrote to memory of 1188 1196 jjllp.exe 43 PID 1196 wrote to memory of 1188 1196 jjllp.exe 43 PID 1196 wrote to memory of 1188 1196 jjllp.exe 43 PID 1196 wrote to memory of 1188 1196 jjllp.exe 43 PID 1188 wrote to memory of 2332 1188 fdtvdr.exe 44 PID 1188 wrote to memory of 2332 1188 fdtvdr.exe 44 PID 1188 wrote to memory of 2332 1188 fdtvdr.exe 44 PID 1188 wrote to memory of 2332 1188 fdtvdr.exe 44 PID 2332 wrote to memory of 2020 2332 lhlrbd.exe 45 PID 2332 wrote to memory of 2020 2332 lhlrbd.exe 45 PID 2332 wrote to memory of 2020 2332 lhlrbd.exe 45 PID 2332 wrote to memory of 2020 2332 lhlrbd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\84a3b08624cd23e257d999cf1ef854447b458728d6b1984d3e941832842d0537N.exe"C:\Users\Admin\AppData\Local\Temp\84a3b08624cd23e257d999cf1ef854447b458728d6b1984d3e941832842d0537N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\ntfhv.exec:\ntfhv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\njhfx.exec:\njhfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\tdlnr.exec:\tdlnr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\fxnhp.exec:\fxnhp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\pbldfbj.exec:\pbldfbj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\vhvhv.exec:\vhvhv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\rtrxrdb.exec:\rtrxrdb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\nhxvrj.exec:\nhxvrj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\djhbd.exec:\djhbd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\nvhxdr.exec:\nvhxdr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\bfhjd.exec:\bfhjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\lttvv.exec:\lttvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\jjllp.exec:\jjllp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\fdtvdr.exec:\fdtvdr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\lhlrbd.exec:\lhlrbd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\thhpblb.exec:\thhpblb.exe17⤵
- Executes dropped EXE
PID:2020 -
\??\c:\xhrjvxn.exec:\xhrjvxn.exe18⤵
- Executes dropped EXE
PID:1484 -
\??\c:\hjbnhn.exec:\hjbnhn.exe19⤵
- Executes dropped EXE
PID:2288 -
\??\c:\ltvnl.exec:\ltvnl.exe20⤵
- Executes dropped EXE
PID:3020 -
\??\c:\lfdrpj.exec:\lfdrpj.exe21⤵
- Executes dropped EXE
PID:2268 -
\??\c:\ttppxt.exec:\ttppxt.exe22⤵
- Executes dropped EXE
PID:1808 -
\??\c:\lhdvlxh.exec:\lhdvlxh.exe23⤵
- Executes dropped EXE
PID:560 -
\??\c:\xnrfr.exec:\xnrfr.exe24⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rntxlr.exec:\rntxlr.exe25⤵
- Executes dropped EXE
PID:656 -
\??\c:\jvtdr.exec:\jvtdr.exe26⤵
- Executes dropped EXE
PID:1616 -
\??\c:\tlbfxjj.exec:\tlbfxjj.exe27⤵
- Executes dropped EXE
PID:964 -
\??\c:\rfxhn.exec:\rfxhn.exe28⤵
- Executes dropped EXE
PID:1716 -
\??\c:\hlbfh.exec:\hlbfh.exe29⤵
- Executes dropped EXE
PID:640 -
\??\c:\nhjbp.exec:\nhjbp.exe30⤵
- Executes dropped EXE
PID:1820 -
\??\c:\plhldb.exec:\plhldb.exe31⤵
- Executes dropped EXE
PID:2516 -
\??\c:\bnvfj.exec:\bnvfj.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1896 -
\??\c:\prdxlvp.exec:\prdxlvp.exe33⤵
- Executes dropped EXE
PID:2172 -
\??\c:\vrrbr.exec:\vrrbr.exe34⤵
- Executes dropped EXE
PID:2444 -
\??\c:\fldnh.exec:\fldnh.exe35⤵
- Executes dropped EXE
PID:2080 -
\??\c:\bfxvj.exec:\bfxvj.exe36⤵
- Executes dropped EXE
PID:2076 -
\??\c:\fxpxft.exec:\fxpxft.exe37⤵
- Executes dropped EXE
PID:1704 -
\??\c:\vdrftfr.exec:\vdrftfr.exe38⤵
- Executes dropped EXE
PID:2760 -
\??\c:\vpljpnv.exec:\vpljpnv.exe39⤵
- Executes dropped EXE
PID:2864 -
\??\c:\jtppv.exec:\jtppv.exe40⤵
- Executes dropped EXE
PID:2956 -
\??\c:\tfxlhbt.exec:\tfxlhbt.exe41⤵
- Executes dropped EXE
PID:2220 -
\??\c:\ppxnb.exec:\ppxnb.exe42⤵
- Executes dropped EXE
PID:3052 -
\??\c:\fdlfrpf.exec:\fdlfrpf.exe43⤵
- Executes dropped EXE
PID:2952 -
\??\c:\bnflffh.exec:\bnflffh.exe44⤵
- Executes dropped EXE
PID:2936 -
\??\c:\ffvrdrf.exec:\ffvrdrf.exe45⤵
- Executes dropped EXE
PID:2848 -
\??\c:\prndx.exec:\prndx.exe46⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jljfjx.exec:\jljfjx.exe47⤵
- Executes dropped EXE
PID:2120 -
\??\c:\pbjxx.exec:\pbjxx.exe48⤵
- Executes dropped EXE
PID:524 -
\??\c:\pdtthh.exec:\pdtthh.exe49⤵
- Executes dropped EXE
PID:2660 -
\??\c:\plhtndl.exec:\plhtndl.exe50⤵
- Executes dropped EXE
PID:1200 -
\??\c:\lfxtfxv.exec:\lfxtfxv.exe51⤵
- Executes dropped EXE
PID:1880 -
\??\c:\pxpllx.exec:\pxpllx.exe52⤵
- Executes dropped EXE
PID:1328 -
\??\c:\pbbhj.exec:\pbbhj.exe53⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hllpbh.exec:\hllpbh.exe54⤵
- Executes dropped EXE
PID:2056 -
\??\c:\xfxxx.exec:\xfxxx.exe55⤵
- Executes dropped EXE
PID:1488 -
\??\c:\rdvdhd.exec:\rdvdhd.exe56⤵
- Executes dropped EXE
PID:2000 -
\??\c:\nlhpvv.exec:\nlhpvv.exe57⤵
- Executes dropped EXE
PID:1992 -
\??\c:\fnjjjr.exec:\fnjjjr.exe58⤵
- Executes dropped EXE
PID:2636 -
\??\c:\txbxxbh.exec:\txbxxbh.exe59⤵
- Executes dropped EXE
PID:3004 -
\??\c:\txhdb.exec:\txhdb.exe60⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vxxlp.exec:\vxxlp.exe61⤵
- Executes dropped EXE
PID:112 -
\??\c:\jtpvj.exec:\jtpvj.exe62⤵
- Executes dropped EXE
PID:2772 -
\??\c:\nppdt.exec:\nppdt.exe63⤵
- Executes dropped EXE
PID:1380 -
\??\c:\pptlh.exec:\pptlh.exe64⤵
- Executes dropped EXE
PID:3032 -
\??\c:\dlvlppt.exec:\dlvlppt.exe65⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xpbrd.exec:\xpbrd.exe66⤵PID:1784
-
\??\c:\bhrpb.exec:\bhrpb.exe67⤵PID:236
-
\??\c:\dthvdn.exec:\dthvdn.exe68⤵PID:1728
-
\??\c:\bltbvv.exec:\bltbvv.exe69⤵PID:864
-
\??\c:\prnvnbf.exec:\prnvnbf.exe70⤵PID:1432
-
\??\c:\lhdnh.exec:\lhdnh.exe71⤵PID:1100
-
\??\c:\hfrrfpl.exec:\hfrrfpl.exe72⤵PID:1912
-
\??\c:\pdpltf.exec:\pdpltf.exe73⤵PID:2564
-
\??\c:\pjvptt.exec:\pjvptt.exe74⤵PID:264
-
\??\c:\blrpjrr.exec:\blrpjrr.exe75⤵PID:2544
-
\??\c:\xbpfnnn.exec:\xbpfnnn.exe76⤵
- System Location Discovery: System Language Discovery
PID:2452 -
\??\c:\ddjrb.exec:\ddjrb.exe77⤵PID:2384
-
\??\c:\thlth.exec:\thlth.exe78⤵PID:1708
-
\??\c:\tbtpx.exec:\tbtpx.exe79⤵PID:1592
-
\??\c:\xxxfdb.exec:\xxxfdb.exe80⤵PID:2104
-
\??\c:\lllxx.exec:\lllxx.exe81⤵PID:2964
-
\??\c:\rptxjv.exec:\rptxjv.exe82⤵PID:2228
-
\??\c:\htjxhxn.exec:\htjxhxn.exe83⤵PID:2876
-
\??\c:\ndbvnf.exec:\ndbvnf.exe84⤵PID:2812
-
\??\c:\ljxxt.exec:\ljxxt.exe85⤵PID:3056
-
\??\c:\ptbjt.exec:\ptbjt.exe86⤵PID:2948
-
\??\c:\nxdjvv.exec:\nxdjvv.exe87⤵PID:2716
-
\??\c:\jvfnrjv.exec:\jvfnrjv.exe88⤵PID:2680
-
\??\c:\lrrbn.exec:\lrrbn.exe89⤵PID:2748
-
\??\c:\hpvjjj.exec:\hpvjjj.exe90⤵PID:2192
-
\??\c:\llfxx.exec:\llfxx.exe91⤵PID:2284
-
\??\c:\dpptbh.exec:\dpptbh.exe92⤵PID:2664
-
\??\c:\dpnrx.exec:\dpnrx.exe93⤵PID:2660
-
\??\c:\rlddxt.exec:\rlddxt.exe94⤵PID:1032
-
\??\c:\trrjdth.exec:\trrjdth.exe95⤵PID:2944
-
\??\c:\hjtvrn.exec:\hjtvrn.exe96⤵PID:2744
-
\??\c:\plnxnhf.exec:\plnxnhf.exe97⤵PID:1636
-
\??\c:\jpjfpdb.exec:\jpjfpdb.exe98⤵PID:1660
-
\??\c:\rxdpd.exec:\rxdpd.exe99⤵PID:2016
-
\??\c:\hhlfjtf.exec:\hhlfjtf.exe100⤵PID:1484
-
\??\c:\jrvbxt.exec:\jrvbxt.exe101⤵PID:1992
-
\??\c:\jxvvhnj.exec:\jxvvhnj.exe102⤵PID:2252
-
\??\c:\fdtljdx.exec:\fdtljdx.exe103⤵
- System Location Discovery: System Language Discovery
PID:2348 -
\??\c:\vpxrnpt.exec:\vpxrnpt.exe104⤵PID:2236
-
\??\c:\lxblnn.exec:\lxblnn.exe105⤵PID:1796
-
\??\c:\dxjlnlf.exec:\dxjlnlf.exe106⤵PID:396
-
\??\c:\dttpnr.exec:\dttpnr.exe107⤵PID:1380
-
\??\c:\hddrftj.exec:\hddrftj.exe108⤵PID:2124
-
\??\c:\rxffjph.exec:\rxffjph.exe109⤵PID:1828
-
\??\c:\xfjbtjb.exec:\xfjbtjb.exe110⤵PID:1068
-
\??\c:\jllrhp.exec:\jllrhp.exe111⤵PID:1412
-
\??\c:\ldrfrb.exec:\ldrfrb.exe112⤵PID:1028
-
\??\c:\fvftnjv.exec:\fvftnjv.exe113⤵PID:1192
-
\??\c:\xjfbb.exec:\xjfbb.exe114⤵PID:1648
-
\??\c:\dllbt.exec:\dllbt.exe115⤵PID:2400
-
\??\c:\lljhj.exec:\lljhj.exe116⤵PID:1672
-
\??\c:\bdfbxth.exec:\bdfbxth.exe117⤵PID:1620
-
\??\c:\brldp.exec:\brldp.exe118⤵PID:572
-
\??\c:\lrxlfxx.exec:\lrxlfxx.exe119⤵PID:900
-
\??\c:\vhjlrlj.exec:\vhjlrlj.exe120⤵PID:2240
-
\??\c:\vhrdh.exec:\vhrdh.exe121⤵PID:2372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-