Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 01:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe
-
Size
455KB
-
MD5
cea7f83c18ba553af131d7f9b25942b7
-
SHA1
8941504acd8cdc4f72a0cec54dc80cfdc160a1af
-
SHA256
a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822
-
SHA512
6a51961d20dba6eaabd9b43ea6b0592bb225b22d4a5d4df8b200ac09aafa0d4a59f2c363450e3cd361ceb4bc3ad67a2b45a52356c1f11f74dbbf49d7843feb89
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/612-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-73-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2372-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/704-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-387-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2172-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-534-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1748-541-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2976-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-676-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2496-703-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2656-716-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-726-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-733-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/612-734-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/612-762-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/964-769-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2340-981-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2448 lvpvdjn.exe 2960 rnhrprp.exe 2900 hjnlb.exe 3008 jlvftn.exe 2372 ptxrbl.exe 2616 jxbjhv.exe 2744 flndl.exe 2648 trrvpl.exe 944 hfjtnn.exe 1172 vnrlrj.exe 2156 tjtnp.exe 2128 lpttv.exe 2104 xtfhrhn.exe 2836 lrpjfh.exe 2504 dnnffrb.exe 2152 lxbndj.exe 612 tftbjdt.exe 2464 nvhfbpn.exe 2500 tvlrlr.exe 2288 lttdd.exe 2212 fpjxfpb.exe 980 xhlxnd.exe 1992 vvxtjn.exe 704 pjntn.exe 236 fxhjd.exe 1380 dlpbh.exe 1944 rrjlbt.exe 1652 lxblvr.exe 2400 xdvxf.exe 1696 pvpdrnv.exe 2396 fvldfxp.exe 892 hftrlnn.exe 2148 fnvhpp.exe 2224 xlthx.exe 1612 hjlrjn.exe 2988 vthrn.exe 2968 hxpxhn.exe 3016 rnpbbt.exe 2900 fltdr.exe 1476 dhbjnxr.exe 2176 vbvljxb.exe 2936 dnvhh.exe 2800 hxphp.exe 2760 xnfhnnd.exe 2560 hfblf.exe 2172 ltbtnnf.exe 1532 nvhvp.exe 928 vlfhx.exe 316 hdpflp.exe 940 tpjfx.exe 2188 hvtxdnb.exe 2120 ntlhp.exe 2008 ljdbrrn.exe 2932 fxpfptt.exe 840 djnbx.exe 2220 xfvlhh.exe 2708 ljrdhl.exe 2544 jpfbrxn.exe 2568 xlnvfv.exe 2276 nvlxvxj.exe 2520 npxtfp.exe 2432 vblfjfj.exe 2636 hhljh.exe 1052 rbfxr.exe -
resource yara_rule behavioral1/memory/612-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/704-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-344-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2936-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-676-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2012-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-858-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-866-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-924-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvnnbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhlhtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fddbrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtfxvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tddbpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtnpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhrdjxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpvbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhdppt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvpbpbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hljdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpbhxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdhnhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfbvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhfhhhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvxtjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbnjrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjhjhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnrpln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpxnhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvjdrpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbbpfnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlxjdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjjdhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrftvxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lprhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvjxft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brxptr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nprndp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvtxdnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txbxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxpvtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjxnlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llnvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2592 wrote to memory of 2448 2592 a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe 30 PID 2592 wrote to memory of 2448 2592 a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe 30 PID 2592 wrote to memory of 2448 2592 a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe 30 PID 2592 wrote to memory of 2448 2592 a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe 30 PID 2448 wrote to memory of 2960 2448 lvpvdjn.exe 31 PID 2448 wrote to memory of 2960 2448 lvpvdjn.exe 31 PID 2448 wrote to memory of 2960 2448 lvpvdjn.exe 31 PID 2448 wrote to memory of 2960 2448 lvpvdjn.exe 31 PID 2960 wrote to memory of 2900 2960 rnhrprp.exe 32 PID 2960 wrote to memory of 2900 2960 rnhrprp.exe 32 PID 2960 wrote to memory of 2900 2960 rnhrprp.exe 32 PID 2960 wrote to memory of 2900 2960 rnhrprp.exe 32 PID 2900 wrote to memory of 3008 2900 hjnlb.exe 33 PID 2900 wrote to memory of 3008 2900 hjnlb.exe 33 PID 2900 wrote to memory of 3008 2900 hjnlb.exe 33 PID 2900 wrote to memory of 3008 2900 hjnlb.exe 33 PID 3008 wrote to memory of 2372 3008 jlvftn.exe 34 PID 3008 wrote to memory of 2372 3008 jlvftn.exe 34 PID 3008 wrote to memory of 2372 3008 jlvftn.exe 34 PID 3008 wrote to memory of 2372 3008 jlvftn.exe 34 PID 2372 wrote to memory of 2616 2372 ptxrbl.exe 35 PID 2372 wrote to memory of 2616 2372 ptxrbl.exe 35 PID 2372 wrote to memory of 2616 2372 ptxrbl.exe 35 PID 2372 wrote to memory of 2616 2372 ptxrbl.exe 35 PID 2616 wrote to memory of 2744 2616 jxbjhv.exe 36 PID 2616 wrote to memory of 2744 2616 jxbjhv.exe 36 PID 2616 wrote to memory of 2744 2616 jxbjhv.exe 36 PID 2616 wrote to memory of 2744 2616 jxbjhv.exe 36 PID 2744 wrote to memory of 2648 2744 flndl.exe 37 PID 2744 wrote to memory of 2648 2744 flndl.exe 37 PID 2744 wrote to memory of 2648 2744 flndl.exe 37 PID 2744 wrote to memory of 2648 2744 flndl.exe 37 PID 2648 wrote to memory of 944 2648 trrvpl.exe 38 PID 2648 wrote to memory of 944 2648 trrvpl.exe 38 PID 2648 wrote to memory of 944 2648 trrvpl.exe 38 PID 2648 wrote to memory of 944 2648 trrvpl.exe 38 PID 944 wrote to memory of 1172 944 hfjtnn.exe 39 PID 944 wrote to memory of 1172 944 hfjtnn.exe 39 PID 944 wrote to memory of 1172 944 hfjtnn.exe 39 PID 944 wrote to memory of 1172 944 hfjtnn.exe 39 PID 1172 wrote to memory of 2156 1172 vnrlrj.exe 40 PID 1172 wrote to memory of 2156 1172 vnrlrj.exe 40 PID 1172 wrote to memory of 2156 1172 vnrlrj.exe 40 PID 1172 wrote to memory of 2156 1172 vnrlrj.exe 40 PID 2156 wrote to memory of 2128 2156 tjtnp.exe 41 PID 2156 wrote to memory of 2128 2156 tjtnp.exe 41 PID 2156 wrote to memory of 2128 2156 tjtnp.exe 41 PID 2156 wrote to memory of 2128 2156 tjtnp.exe 41 PID 2128 wrote to memory of 2104 2128 lpttv.exe 42 PID 2128 wrote to memory of 2104 2128 lpttv.exe 42 PID 2128 wrote to memory of 2104 2128 lpttv.exe 42 PID 2128 wrote to memory of 2104 2128 lpttv.exe 42 PID 2104 wrote to memory of 2836 2104 xtfhrhn.exe 43 PID 2104 wrote to memory of 2836 2104 xtfhrhn.exe 43 PID 2104 wrote to memory of 2836 2104 xtfhrhn.exe 43 PID 2104 wrote to memory of 2836 2104 xtfhrhn.exe 43 PID 2836 wrote to memory of 2504 2836 lrpjfh.exe 44 PID 2836 wrote to memory of 2504 2836 lrpjfh.exe 44 PID 2836 wrote to memory of 2504 2836 lrpjfh.exe 44 PID 2836 wrote to memory of 2504 2836 lrpjfh.exe 44 PID 2504 wrote to memory of 2152 2504 dnnffrb.exe 45 PID 2504 wrote to memory of 2152 2504 dnnffrb.exe 45 PID 2504 wrote to memory of 2152 2504 dnnffrb.exe 45 PID 2504 wrote to memory of 2152 2504 dnnffrb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe"C:\Users\Admin\AppData\Local\Temp\a9e70e52ae16cfafda4973fc762c16f143ad5057d94aedcfbfd31615e8f9f822.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\lvpvdjn.exec:\lvpvdjn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\rnhrprp.exec:\rnhrprp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\hjnlb.exec:\hjnlb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\jlvftn.exec:\jlvftn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\ptxrbl.exec:\ptxrbl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\jxbjhv.exec:\jxbjhv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\flndl.exec:\flndl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\trrvpl.exec:\trrvpl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\hfjtnn.exec:\hfjtnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\vnrlrj.exec:\vnrlrj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\tjtnp.exec:\tjtnp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\lpttv.exec:\lpttv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\xtfhrhn.exec:\xtfhrhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\lrpjfh.exec:\lrpjfh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\dnnffrb.exec:\dnnffrb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\lxbndj.exec:\lxbndj.exe17⤵
- Executes dropped EXE
PID:2152 -
\??\c:\tftbjdt.exec:\tftbjdt.exe18⤵
- Executes dropped EXE
PID:612 -
\??\c:\nvhfbpn.exec:\nvhfbpn.exe19⤵
- Executes dropped EXE
PID:2464 -
\??\c:\tvlrlr.exec:\tvlrlr.exe20⤵
- Executes dropped EXE
PID:2500 -
\??\c:\lttdd.exec:\lttdd.exe21⤵
- Executes dropped EXE
PID:2288 -
\??\c:\fpjxfpb.exec:\fpjxfpb.exe22⤵
- Executes dropped EXE
PID:2212 -
\??\c:\xhlxnd.exec:\xhlxnd.exe23⤵
- Executes dropped EXE
PID:980 -
\??\c:\vvxtjn.exec:\vvxtjn.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1992 -
\??\c:\pjntn.exec:\pjntn.exe25⤵
- Executes dropped EXE
PID:704 -
\??\c:\fxhjd.exec:\fxhjd.exe26⤵
- Executes dropped EXE
PID:236 -
\??\c:\dlpbh.exec:\dlpbh.exe27⤵
- Executes dropped EXE
PID:1380 -
\??\c:\rrjlbt.exec:\rrjlbt.exe28⤵
- Executes dropped EXE
PID:1944 -
\??\c:\lxblvr.exec:\lxblvr.exe29⤵
- Executes dropped EXE
PID:1652 -
\??\c:\xdvxf.exec:\xdvxf.exe30⤵
- Executes dropped EXE
PID:2400 -
\??\c:\pvpdrnv.exec:\pvpdrnv.exe31⤵
- Executes dropped EXE
PID:1696 -
\??\c:\fvldfxp.exec:\fvldfxp.exe32⤵
- Executes dropped EXE
PID:2396 -
\??\c:\hftrlnn.exec:\hftrlnn.exe33⤵
- Executes dropped EXE
PID:892 -
\??\c:\fnvhpp.exec:\fnvhpp.exe34⤵
- Executes dropped EXE
PID:2148 -
\??\c:\xlthx.exec:\xlthx.exe35⤵
- Executes dropped EXE
PID:2224 -
\??\c:\hjlrjn.exec:\hjlrjn.exe36⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vthrn.exec:\vthrn.exe37⤵
- Executes dropped EXE
PID:2988 -
\??\c:\hxpxhn.exec:\hxpxhn.exe38⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rnpbbt.exec:\rnpbbt.exe39⤵
- Executes dropped EXE
PID:3016 -
\??\c:\fltdr.exec:\fltdr.exe40⤵
- Executes dropped EXE
PID:2900 -
\??\c:\dhbjnxr.exec:\dhbjnxr.exe41⤵
- Executes dropped EXE
PID:1476 -
\??\c:\vbvljxb.exec:\vbvljxb.exe42⤵
- Executes dropped EXE
PID:2176 -
\??\c:\dnvhh.exec:\dnvhh.exe43⤵
- Executes dropped EXE
PID:2936 -
\??\c:\hxphp.exec:\hxphp.exe44⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xnfhnnd.exec:\xnfhnnd.exe45⤵
- Executes dropped EXE
PID:2760 -
\??\c:\hfblf.exec:\hfblf.exe46⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ltbtnnf.exec:\ltbtnnf.exe47⤵
- Executes dropped EXE
PID:2172 -
\??\c:\nvhvp.exec:\nvhvp.exe48⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vlfhx.exec:\vlfhx.exe49⤵
- Executes dropped EXE
PID:928 -
\??\c:\hdpflp.exec:\hdpflp.exe50⤵
- Executes dropped EXE
PID:316 -
\??\c:\tpjfx.exec:\tpjfx.exe51⤵
- Executes dropped EXE
PID:940 -
\??\c:\hvtxdnb.exec:\hvtxdnb.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2188 -
\??\c:\ntlhp.exec:\ntlhp.exe53⤵
- Executes dropped EXE
PID:2120 -
\??\c:\ljdbrrn.exec:\ljdbrrn.exe54⤵
- Executes dropped EXE
PID:2008 -
\??\c:\fxpfptt.exec:\fxpfptt.exe55⤵
- Executes dropped EXE
PID:2932 -
\??\c:\djnbx.exec:\djnbx.exe56⤵
- Executes dropped EXE
PID:840 -
\??\c:\xfvlhh.exec:\xfvlhh.exe57⤵
- Executes dropped EXE
PID:2220 -
\??\c:\ljrdhl.exec:\ljrdhl.exe58⤵
- Executes dropped EXE
PID:2708 -
\??\c:\jpfbrxn.exec:\jpfbrxn.exe59⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xlnvfv.exec:\xlnvfv.exe60⤵
- Executes dropped EXE
PID:2568 -
\??\c:\nvlxvxj.exec:\nvlxvxj.exe61⤵
- Executes dropped EXE
PID:2276 -
\??\c:\npxtfp.exec:\npxtfp.exe62⤵
- Executes dropped EXE
PID:2520 -
\??\c:\vblfjfj.exec:\vblfjfj.exe63⤵
- Executes dropped EXE
PID:2432 -
\??\c:\hhljh.exec:\hhljh.exe64⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rbfxr.exec:\rbfxr.exe65⤵
- Executes dropped EXE
PID:1052 -
\??\c:\hvhlxrf.exec:\hvhlxrf.exe66⤵PID:1184
-
\??\c:\lxxpbjj.exec:\lxxpbjj.exe67⤵PID:1748
-
\??\c:\pbxxn.exec:\pbxxn.exe68⤵PID:1472
-
\??\c:\pnvnhv.exec:\pnvnhv.exe69⤵PID:1192
-
\??\c:\pfbvp.exec:\pfbvp.exe70⤵
- System Location Discovery: System Language Discovery
PID:112 -
\??\c:\tlhjnp.exec:\tlhjnp.exe71⤵PID:2680
-
\??\c:\txbxv.exec:\txbxv.exe72⤵
- System Location Discovery: System Language Discovery
PID:2600 -
\??\c:\xhvvfx.exec:\xhvvfx.exe73⤵PID:332
-
\??\c:\fjhlxhl.exec:\fjhlxhl.exe74⤵PID:364
-
\??\c:\lhxfpfp.exec:\lhxfpfp.exe75⤵PID:1804
-
\??\c:\jbttb.exec:\jbttb.exe76⤵PID:892
-
\??\c:\xtxht.exec:\xtxht.exe77⤵PID:2592
-
\??\c:\rrvvd.exec:\rrvvd.exe78⤵
- System Location Discovery: System Language Discovery
PID:2472 -
\??\c:\xlxttt.exec:\xlxttt.exe79⤵
- System Location Discovery: System Language Discovery
PID:2876 -
\??\c:\vtfjl.exec:\vtfjl.exe80⤵PID:2976
-
\??\c:\nnhxv.exec:\nnhxv.exe81⤵PID:640
-
\??\c:\rfnnn.exec:\rfnnn.exe82⤵PID:3016
-
\??\c:\fpljbtb.exec:\fpljbtb.exe83⤵PID:2920
-
\??\c:\lplxf.exec:\lplxf.exe84⤵PID:2168
-
\??\c:\vtrrbjd.exec:\vtrrbjd.exe85⤵PID:2792
-
\??\c:\rrvtxrf.exec:\rrvtxrf.exe86⤵PID:2768
-
\??\c:\jlpflf.exec:\jlpflf.exe87⤵PID:2604
-
\??\c:\trhbhpd.exec:\trhbhpd.exe88⤵PID:2404
-
\??\c:\xxjtd.exec:\xxjtd.exe89⤵PID:3048
-
\??\c:\rntfp.exec:\rntfp.exe90⤵PID:2020
-
\??\c:\pthbnb.exec:\pthbnb.exe91⤵PID:2348
-
\??\c:\dlxbr.exec:\dlxbr.exe92⤵PID:2012
-
\??\c:\xbfbbx.exec:\xbfbbx.exe93⤵PID:2184
-
\??\c:\rjrrfjf.exec:\rjrrfjf.exe94⤵PID:2128
-
\??\c:\bfnjhvj.exec:\bfnjhvj.exe95⤵PID:2496
-
\??\c:\pbxlhln.exec:\pbxlhln.exe96⤵PID:2696
-
\??\c:\vjpld.exec:\vjpld.exe97⤵PID:2656
-
\??\c:\rvrpj.exec:\rvrpj.exe98⤵PID:2516
-
\??\c:\bdhrhlf.exec:\bdhrhlf.exe99⤵PID:2152
-
\??\c:\rfbffvj.exec:\rfbffvj.exe100⤵PID:612
-
\??\c:\btfrpr.exec:\btfrpr.exe101⤵PID:964
-
\??\c:\xdfhrt.exec:\xdfhrt.exe102⤵PID:396
-
\??\c:\dlpdx.exec:\dlpdx.exe103⤵PID:2124
-
\??\c:\tjblxl.exec:\tjblxl.exe104⤵PID:1592
-
\??\c:\hjdrj.exec:\hjdrj.exe105⤵PID:1844
-
\??\c:\jhthlfp.exec:\jhthlfp.exe106⤵PID:780
-
\??\c:\vvhthhl.exec:\vvhthhl.exe107⤵PID:2428
-
\??\c:\nvtbdvb.exec:\nvtbdvb.exe108⤵PID:1052
-
\??\c:\rlnxr.exec:\rlnxr.exe109⤵PID:1184
-
\??\c:\lffhf.exec:\lffhf.exe110⤵PID:1748
-
\??\c:\tnttbjn.exec:\tnttbjn.exe111⤵PID:1216
-
\??\c:\thndtj.exec:\thndtj.exe112⤵PID:2100
-
\??\c:\vvtfr.exec:\vvtfr.exe113⤵PID:1688
-
\??\c:\nvtff.exec:\nvtff.exe114⤵PID:1384
-
\??\c:\hlpnn.exec:\hlpnn.exe115⤵PID:1664
-
\??\c:\dhhlhd.exec:\dhhlhd.exe116⤵PID:2412
-
\??\c:\vbnjxp.exec:\vbnjxp.exe117⤵PID:1200
-
\??\c:\tthjlj.exec:\tthjlj.exe118⤵PID:1720
-
\??\c:\ttdrx.exec:\ttdrx.exe119⤵PID:2244
-
\??\c:\dhvhl.exec:\dhvhl.exe120⤵PID:2148
-
\??\c:\rrbxlp.exec:\rrbxlp.exe121⤵PID:2984
-
\??\c:\bnhln.exec:\bnhln.exe122⤵PID:2948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-