Analysis
-
max time kernel
150s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 01:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3fc0d66009d49d5cc86c430bded5981586251e78abe5a432bcdec58cf5287aa4.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
3fc0d66009d49d5cc86c430bded5981586251e78abe5a432bcdec58cf5287aa4.exe
-
Size
455KB
-
MD5
fd29874125f0360d3a1e601663fad100
-
SHA1
658d7e04d299559f8f679a68d71db9382570ce1c
-
SHA256
3fc0d66009d49d5cc86c430bded5981586251e78abe5a432bcdec58cf5287aa4
-
SHA512
a480490c9c8f7f892812707c7247f40a67564c245a5aed8a9d5577454d2286cb5896408e4e24f56e4884cafd13d99748ffcbfecc9aa1f4904ba9ce249fab22ed
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2116-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1224-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-58-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2848-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-73-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2524-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-92-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/940-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-128-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2996-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-133-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2340-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/564-173-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/564-172-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2216-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1016-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-506-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/632-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-620-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/584-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-739-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2292-774-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 760 hdbjbl.exe 1224 hbntrph.exe 2128 dhbxprn.exe 2324 nhdhdvh.exe 2152 fhbpjt.exe 2848 nhprvh.exe 2800 lpthlj.exe 2524 ptprh.exe 1968 vvxlpxn.exe 940 pvjrfjv.exe 1248 dnlxjhh.exe 2996 xjjtrtp.exe 2340 xfdnxdd.exe 1836 lblbb.exe 2676 rdpvx.exe 696 fbbjjbt.exe 564 fjbntdj.exe 2216 ttbjpbp.exe 2384 djbfll.exe 2456 ffjxxhv.exe 2284 jlhltb.exe 1716 lhfbj.exe 2700 ftjtdjh.exe 1420 txlvf.exe 1788 xjntx.exe 2532 lbjbrxf.exe 1064 dnprbxx.exe 1232 jrhxrdt.exe 2808 vjlnx.exe 1808 nhprfdv.exe 1528 djbnlrl.exe 2236 nbfdr.exe 2596 ptrpx.exe 2164 phbfn.exe 2192 hffjlj.exe 584 pbxvjhv.exe 2956 ftrhlvj.exe 2952 jthffr.exe 2324 fxrdl.exe 2980 hvvvnrf.exe 2852 plllfx.exe 2848 hjbbn.exe 2516 ttdblpt.exe 2536 rpblt.exe 1944 hnvdl.exe 944 nxvjxb.exe 2360 vxfxhpj.exe 1784 fjxnb.exe 2132 bfptjrn.exe 3024 pbdhjv.exe 2560 jnrntn.exe 1108 lvfxflp.exe 1496 rlpbjb.exe 2600 nrnrd.exe 1348 rtldf.exe 1016 jjlttbn.exe 556 fxbnxt.exe 2244 tbplrj.exe 2656 hrrjlb.exe 2176 hvfbnv.exe 2328 tvbvjj.exe 560 tjhbhxt.exe 756 bxxnpfp.exe 1812 fpnhxft.exe -
resource yara_rule behavioral1/memory/2116-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-374-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2516-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-787-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frvjtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjntx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfbrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhvvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbfhjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dffbrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnflp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnvnhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjnbdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njlptpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btftl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvtvtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpnfpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djxrpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppnpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prlxdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnflxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flpvdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnndfxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thfpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvxtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dldhtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvhdbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddbxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbfblb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnfln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fldpbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllrpnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plhfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjfxbtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thfnj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 760 2116 3fc0d66009d49d5cc86c430bded5981586251e78abe5a432bcdec58cf5287aa4.exe 30 PID 2116 wrote to memory of 760 2116 3fc0d66009d49d5cc86c430bded5981586251e78abe5a432bcdec58cf5287aa4.exe 30 PID 2116 wrote to memory of 760 2116 3fc0d66009d49d5cc86c430bded5981586251e78abe5a432bcdec58cf5287aa4.exe 30 PID 2116 wrote to memory of 760 2116 3fc0d66009d49d5cc86c430bded5981586251e78abe5a432bcdec58cf5287aa4.exe 30 PID 760 wrote to memory of 1224 760 hdbjbl.exe 31 PID 760 wrote to memory of 1224 760 hdbjbl.exe 31 PID 760 wrote to memory of 1224 760 hdbjbl.exe 31 PID 760 wrote to memory of 1224 760 hdbjbl.exe 31 PID 1224 wrote to memory of 2128 1224 hbntrph.exe 32 PID 1224 wrote to memory of 2128 1224 hbntrph.exe 32 PID 1224 wrote to memory of 2128 1224 hbntrph.exe 32 PID 1224 wrote to memory of 2128 1224 hbntrph.exe 32 PID 2128 wrote to memory of 2324 2128 dhbxprn.exe 33 PID 2128 wrote to memory of 2324 2128 dhbxprn.exe 33 PID 2128 wrote to memory of 2324 2128 dhbxprn.exe 33 PID 2128 wrote to memory of 2324 2128 dhbxprn.exe 33 PID 2324 wrote to memory of 2152 2324 nhdhdvh.exe 34 PID 2324 wrote to memory of 2152 2324 nhdhdvh.exe 34 PID 2324 wrote to memory of 2152 2324 nhdhdvh.exe 34 PID 2324 wrote to memory of 2152 2324 nhdhdvh.exe 34 PID 2152 wrote to memory of 2848 2152 fhbpjt.exe 35 PID 2152 wrote to memory of 2848 2152 fhbpjt.exe 35 PID 2152 wrote to memory of 2848 2152 fhbpjt.exe 35 PID 2152 wrote to memory of 2848 2152 fhbpjt.exe 35 PID 2848 wrote to memory of 2800 2848 nhprvh.exe 36 PID 2848 wrote to memory of 2800 2848 nhprvh.exe 36 PID 2848 wrote to memory of 2800 2848 nhprvh.exe 36 PID 2848 wrote to memory of 2800 2848 nhprvh.exe 36 PID 2800 wrote to memory of 2524 2800 lpthlj.exe 37 PID 2800 wrote to memory of 2524 2800 lpthlj.exe 37 PID 2800 wrote to memory of 2524 2800 lpthlj.exe 37 PID 2800 wrote to memory of 2524 2800 lpthlj.exe 37 PID 2524 wrote to memory of 1968 2524 ptprh.exe 38 PID 2524 wrote to memory of 1968 2524 ptprh.exe 38 PID 2524 wrote to memory of 1968 2524 ptprh.exe 38 PID 2524 wrote to memory of 1968 2524 ptprh.exe 38 PID 1968 wrote to memory of 940 1968 vvxlpxn.exe 39 PID 1968 wrote to memory of 940 1968 vvxlpxn.exe 39 PID 1968 wrote to memory of 940 1968 vvxlpxn.exe 39 PID 1968 wrote to memory of 940 1968 vvxlpxn.exe 39 PID 940 wrote to memory of 1248 940 pvjrfjv.exe 40 PID 940 wrote to memory of 1248 940 pvjrfjv.exe 40 PID 940 wrote to memory of 1248 940 pvjrfjv.exe 40 PID 940 wrote to memory of 1248 940 pvjrfjv.exe 40 PID 1248 wrote to memory of 2996 1248 dnlxjhh.exe 41 PID 1248 wrote to memory of 2996 1248 dnlxjhh.exe 41 PID 1248 wrote to memory of 2996 1248 dnlxjhh.exe 41 PID 1248 wrote to memory of 2996 1248 dnlxjhh.exe 41 PID 2996 wrote to memory of 2340 2996 xjjtrtp.exe 42 PID 2996 wrote to memory of 2340 2996 xjjtrtp.exe 42 PID 2996 wrote to memory of 2340 2996 xjjtrtp.exe 42 PID 2996 wrote to memory of 2340 2996 xjjtrtp.exe 42 PID 2340 wrote to memory of 1836 2340 xfdnxdd.exe 43 PID 2340 wrote to memory of 1836 2340 xfdnxdd.exe 43 PID 2340 wrote to memory of 1836 2340 xfdnxdd.exe 43 PID 2340 wrote to memory of 1836 2340 xfdnxdd.exe 43 PID 1836 wrote to memory of 2676 1836 lblbb.exe 44 PID 1836 wrote to memory of 2676 1836 lblbb.exe 44 PID 1836 wrote to memory of 2676 1836 lblbb.exe 44 PID 1836 wrote to memory of 2676 1836 lblbb.exe 44 PID 2676 wrote to memory of 696 2676 rdpvx.exe 45 PID 2676 wrote to memory of 696 2676 rdpvx.exe 45 PID 2676 wrote to memory of 696 2676 rdpvx.exe 45 PID 2676 wrote to memory of 696 2676 rdpvx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fc0d66009d49d5cc86c430bded5981586251e78abe5a432bcdec58cf5287aa4.exe"C:\Users\Admin\AppData\Local\Temp\3fc0d66009d49d5cc86c430bded5981586251e78abe5a432bcdec58cf5287aa4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\hdbjbl.exec:\hdbjbl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\hbntrph.exec:\hbntrph.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\dhbxprn.exec:\dhbxprn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\nhdhdvh.exec:\nhdhdvh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\fhbpjt.exec:\fhbpjt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\nhprvh.exec:\nhprvh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\lpthlj.exec:\lpthlj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\ptprh.exec:\ptprh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\vvxlpxn.exec:\vvxlpxn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\pvjrfjv.exec:\pvjrfjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\dnlxjhh.exec:\dnlxjhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\xjjtrtp.exec:\xjjtrtp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\xfdnxdd.exec:\xfdnxdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\lblbb.exec:\lblbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\rdpvx.exec:\rdpvx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\fbbjjbt.exec:\fbbjjbt.exe17⤵
- Executes dropped EXE
PID:696 -
\??\c:\fjbntdj.exec:\fjbntdj.exe18⤵
- Executes dropped EXE
PID:564 -
\??\c:\ttbjpbp.exec:\ttbjpbp.exe19⤵
- Executes dropped EXE
PID:2216 -
\??\c:\djbfll.exec:\djbfll.exe20⤵
- Executes dropped EXE
PID:2384 -
\??\c:\ffjxxhv.exec:\ffjxxhv.exe21⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jlhltb.exec:\jlhltb.exe22⤵
- Executes dropped EXE
PID:2284 -
\??\c:\lhfbj.exec:\lhfbj.exe23⤵
- Executes dropped EXE
PID:1716 -
\??\c:\ftjtdjh.exec:\ftjtdjh.exe24⤵
- Executes dropped EXE
PID:2700 -
\??\c:\txlvf.exec:\txlvf.exe25⤵
- Executes dropped EXE
PID:1420 -
\??\c:\xjntx.exec:\xjntx.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1788 -
\??\c:\lbjbrxf.exec:\lbjbrxf.exe27⤵
- Executes dropped EXE
PID:2532 -
\??\c:\dnprbxx.exec:\dnprbxx.exe28⤵
- Executes dropped EXE
PID:1064 -
\??\c:\jrhxrdt.exec:\jrhxrdt.exe29⤵
- Executes dropped EXE
PID:1232 -
\??\c:\vjlnx.exec:\vjlnx.exe30⤵
- Executes dropped EXE
PID:2808 -
\??\c:\nhprfdv.exec:\nhprfdv.exe31⤵
- Executes dropped EXE
PID:1808 -
\??\c:\djbnlrl.exec:\djbnlrl.exe32⤵
- Executes dropped EXE
PID:1528 -
\??\c:\nbfdr.exec:\nbfdr.exe33⤵
- Executes dropped EXE
PID:2236 -
\??\c:\ptrpx.exec:\ptrpx.exe34⤵
- Executes dropped EXE
PID:2596 -
\??\c:\phbfn.exec:\phbfn.exe35⤵
- Executes dropped EXE
PID:2164 -
\??\c:\hffjlj.exec:\hffjlj.exe36⤵
- Executes dropped EXE
PID:2192 -
\??\c:\pbxvjhv.exec:\pbxvjhv.exe37⤵
- Executes dropped EXE
PID:584 -
\??\c:\ftrhlvj.exec:\ftrhlvj.exe38⤵
- Executes dropped EXE
PID:2956 -
\??\c:\jthffr.exec:\jthffr.exe39⤵
- Executes dropped EXE
PID:2952 -
\??\c:\fxrdl.exec:\fxrdl.exe40⤵
- Executes dropped EXE
PID:2324 -
\??\c:\hvvvnrf.exec:\hvvvnrf.exe41⤵
- Executes dropped EXE
PID:2980 -
\??\c:\plllfx.exec:\plllfx.exe42⤵
- Executes dropped EXE
PID:2852 -
\??\c:\hjbbn.exec:\hjbbn.exe43⤵
- Executes dropped EXE
PID:2848 -
\??\c:\ttdblpt.exec:\ttdblpt.exe44⤵
- Executes dropped EXE
PID:2516 -
\??\c:\rpblt.exec:\rpblt.exe45⤵
- Executes dropped EXE
PID:2536 -
\??\c:\hnvdl.exec:\hnvdl.exe46⤵
- Executes dropped EXE
PID:1944 -
\??\c:\nxvjxb.exec:\nxvjxb.exe47⤵
- Executes dropped EXE
PID:944 -
\??\c:\vxfxhpj.exec:\vxfxhpj.exe48⤵
- Executes dropped EXE
PID:2360 -
\??\c:\fjxnb.exec:\fjxnb.exe49⤵
- Executes dropped EXE
PID:1784 -
\??\c:\bfptjrn.exec:\bfptjrn.exe50⤵
- Executes dropped EXE
PID:2132 -
\??\c:\pbdhjv.exec:\pbdhjv.exe51⤵
- Executes dropped EXE
PID:3024 -
\??\c:\jnrntn.exec:\jnrntn.exe52⤵
- Executes dropped EXE
PID:2560 -
\??\c:\lvfxflp.exec:\lvfxflp.exe53⤵
- Executes dropped EXE
PID:1108 -
\??\c:\rlpbjb.exec:\rlpbjb.exe54⤵
- Executes dropped EXE
PID:1496 -
\??\c:\nrnrd.exec:\nrnrd.exe55⤵
- Executes dropped EXE
PID:2600 -
\??\c:\rtldf.exec:\rtldf.exe56⤵
- Executes dropped EXE
PID:1348 -
\??\c:\jjlttbn.exec:\jjlttbn.exe57⤵
- Executes dropped EXE
PID:1016 -
\??\c:\fxbnxt.exec:\fxbnxt.exe58⤵
- Executes dropped EXE
PID:556 -
\??\c:\tbplrj.exec:\tbplrj.exe59⤵
- Executes dropped EXE
PID:2244 -
\??\c:\hrrjlb.exec:\hrrjlb.exe60⤵
- Executes dropped EXE
PID:2656 -
\??\c:\hvfbnv.exec:\hvfbnv.exe61⤵
- Executes dropped EXE
PID:2176 -
\??\c:\tvbvjj.exec:\tvbvjj.exe62⤵
- Executes dropped EXE
PID:2328 -
\??\c:\tjhbhxt.exec:\tjhbhxt.exe63⤵
- Executes dropped EXE
PID:560 -
\??\c:\bxxnpfp.exec:\bxxnpfp.exe64⤵
- Executes dropped EXE
PID:756 -
\??\c:\fpnhxft.exec:\fpnhxft.exe65⤵
- Executes dropped EXE
PID:1812 -
\??\c:\dhtft.exec:\dhtft.exe66⤵PID:1700
-
\??\c:\pddxj.exec:\pddxj.exe67⤵PID:2400
-
\??\c:\rplvb.exec:\rplvb.exe68⤵PID:1788
-
\??\c:\lxbldn.exec:\lxbldn.exe69⤵PID:1308
-
\??\c:\hjrfb.exec:\hjrfb.exe70⤵PID:632
-
\??\c:\jlxhhpp.exec:\jlxhhpp.exe71⤵PID:2628
-
\??\c:\flrhl.exec:\flrhl.exe72⤵PID:1976
-
\??\c:\dfvlf.exec:\dfvlf.exe73⤵PID:2448
-
\??\c:\rhxfnvh.exec:\rhxfnvh.exe74⤵PID:2608
-
\??\c:\dfbtvb.exec:\dfbtvb.exe75⤵PID:1528
-
\??\c:\xhvtdv.exec:\xhvtdv.exe76⤵PID:2224
-
\??\c:\flpvdf.exec:\flpvdf.exe77⤵
- System Location Discovery: System Language Discovery
PID:1588 -
\??\c:\bjdrh.exec:\bjdrh.exe78⤵PID:2156
-
\??\c:\jxlxtxv.exec:\jxlxtxv.exe79⤵PID:2900
-
\??\c:\rnpvtp.exec:\rnpvtp.exe80⤵PID:2420
-
\??\c:\phxpb.exec:\phxpb.exe81⤵PID:584
-
\??\c:\vjfbrpl.exec:\vjfbrpl.exe82⤵PID:3044
-
\??\c:\bnxbldf.exec:\bnxbldf.exe83⤵PID:3040
-
\??\c:\lfnbtv.exec:\lfnbtv.exe84⤵PID:2152
-
\??\c:\rnnrhr.exec:\rnnrhr.exe85⤵PID:2876
-
\??\c:\bfjxnnp.exec:\bfjxnnp.exe86⤵PID:2880
-
\??\c:\ndvbhth.exec:\ndvbhth.exe87⤵PID:2444
-
\??\c:\dnlvh.exec:\dnlvh.exe88⤵PID:2380
-
\??\c:\brrpfxh.exec:\brrpfxh.exe89⤵PID:1552
-
\??\c:\bbthxlf.exec:\bbthxlf.exe90⤵PID:1264
-
\??\c:\hpvtf.exec:\hpvtf.exe91⤵PID:2260
-
\??\c:\vjntx.exec:\vjntx.exe92⤵PID:3028
-
\??\c:\ndlhxrx.exec:\ndlhxrx.exe93⤵PID:2580
-
\??\c:\flhvpnb.exec:\flhvpnb.exe94⤵PID:2792
-
\??\c:\llhpn.exec:\llhpn.exe95⤵PID:1832
-
\??\c:\rbfpr.exec:\rbfpr.exe96⤵PID:2560
-
\??\c:\xvrfl.exec:\xvrfl.exe97⤵PID:2032
-
\??\c:\nxnvv.exec:\nxnvv.exe98⤵PID:1028
-
\??\c:\rvptbf.exec:\rvptbf.exe99⤵PID:1148
-
\??\c:\nxfbrh.exec:\nxfbrh.exe100⤵PID:2292
-
\??\c:\xlvln.exec:\xlvln.exe101⤵PID:520
-
\??\c:\jrnfvj.exec:\jrnfvj.exe102⤵PID:2412
-
\??\c:\nvvrpjn.exec:\nvvrpjn.exe103⤵PID:2384
-
\??\c:\vppxbx.exec:\vppxbx.exe104⤵PID:1500
-
\??\c:\vhtrf.exec:\vhtrf.exe105⤵PID:912
-
\??\c:\bbjrjp.exec:\bbjrjp.exe106⤵PID:2468
-
\??\c:\hlvbxbt.exec:\hlvbxbt.exe107⤵PID:1320
-
\??\c:\thxrnbd.exec:\thxrnbd.exe108⤵PID:960
-
\??\c:\lvbnxb.exec:\lvbnxb.exe109⤵PID:1356
-
\??\c:\vvpbnj.exec:\vvpbnj.exe110⤵PID:2568
-
\??\c:\ttfjnr.exec:\ttfjnr.exe111⤵PID:2584
-
\??\c:\rxpxtt.exec:\rxpxtt.exe112⤵PID:1088
-
\??\c:\pxtjtj.exec:\pxtjtj.exe113⤵PID:2056
-
\??\c:\vbjhlr.exec:\vbjhlr.exe114⤵PID:2636
-
\??\c:\njfxlpn.exec:\njfxlpn.exe115⤵PID:1728
-
\??\c:\ntvjj.exec:\ntvjj.exe116⤵PID:892
-
\??\c:\rvvfdx.exec:\rvvfdx.exe117⤵PID:2592
-
\??\c:\ftbtdr.exec:\ftbtdr.exe118⤵PID:1736
-
\??\c:\rthhpfr.exec:\rthhpfr.exe119⤵PID:1616
-
\??\c:\flnltl.exec:\flnltl.exe120⤵PID:1236
-
\??\c:\jrhhbvp.exec:\jrhhbvp.exe121⤵PID:2424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-