Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 01:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a16eaaee2e90d83d834fab53d41f6ce367490f19a836a3cf56b9e5abee7c6c76.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a16eaaee2e90d83d834fab53d41f6ce367490f19a836a3cf56b9e5abee7c6c76.exe
-
Size
455KB
-
MD5
6f62429486a44c80f2ac1f1f0d8b3bab
-
SHA1
7e173d76566840845b7ad7e2fdfdceba9fe3c46f
-
SHA256
a16eaaee2e90d83d834fab53d41f6ce367490f19a836a3cf56b9e5abee7c6c76
-
SHA512
790440f8310409102f16a2335b6fb89348014d0f9b6239c5208d97079d973dad68dea16c3802a76ed399a677ed84d7b002936f02f90f889e97af8159dd8ff70d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/1916-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-26-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2740-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-48-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2708-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/432-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-110-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2844-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1384-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/364-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-366-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/396-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/548-467-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2196-474-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1928-481-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1760-492-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2196-495-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2480-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-502-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1772-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-537-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1920-539-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1604-553-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2528-565-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/584-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-595-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1744-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-672-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1916 bblfbn.exe 2740 jpxrvf.exe 2864 jpfhhjl.exe 2708 ptffvnf.exe 2928 vtbpr.exe 2648 pdxdbn.exe 2824 hxpxhj.exe 576 dllfxvn.exe 432 dphpj.exe 2496 nhtdlx.exe 2844 vlbbttr.exe 2392 dtdhdlt.exe 2768 ltxxdp.exe 1768 xbldjvf.exe 1688 bvbhlxn.exe 548 prjlbhb.exe 2432 pptlpb.exe 1384 fxdfjpx.exe 1760 pdptt.exe 2424 vfbljfl.exe 944 pbnbdn.exe 1712 djrttn.exe 112 hbthr.exe 1828 frhxdp.exe 1548 vtnxdd.exe 536 rvbfjfd.exe 364 fjtbdhr.exe 3040 pnxdnx.exe 2672 xlvtjxn.exe 2232 jrrtrt.exe 2384 jtpxj.exe 2520 ndrrfpx.exe 2684 vdjnlb.exe 1756 vvrtdld.exe 2200 dlntlfp.exe 2748 lfnrlxb.exe 2724 dplrl.exe 2868 bxhrb.exe 2332 ndjrndr.exe 2636 hrpdd.exe 2608 ftfxpx.exe 2572 xfltn.exe 684 vfrjrx.exe 396 fpbpllp.exe 2940 rxvtjbb.exe 2652 jvfddl.exe 1116 rthbb.exe 1776 tfphndn.exe 1156 hfrxf.exe 2392 fjhhvh.exe 1784 vhjthp.exe 1572 lrllbtb.exe 812 txrjrf.exe 2212 ptfjvd.exe 548 npvhb.exe 2196 hjxdjx.exe 1928 httlr.exe 2356 rxdxnhl.exe 1760 vdtjdf.exe 2476 pprdlt.exe 2480 pbthnv.exe 708 ttflnpr.exe 1772 lvrntft.exe 2004 pnxph.exe -
resource yara_rule behavioral1/memory/1916-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/432-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/364-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-664-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfjntpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfpjbvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdbblhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbthnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxtvdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntrdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdhpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnhjth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbvdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndxrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhbhtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvvpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jttvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddbrpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xppth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jltrbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxtrxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhlvttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddbhjxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjtdrhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpvjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvbhlxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbvnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbtdlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrfjlvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjlbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxjflb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2536 wrote to memory of 1916 2536 a16eaaee2e90d83d834fab53d41f6ce367490f19a836a3cf56b9e5abee7c6c76.exe 30 PID 2536 wrote to memory of 1916 2536 a16eaaee2e90d83d834fab53d41f6ce367490f19a836a3cf56b9e5abee7c6c76.exe 30 PID 2536 wrote to memory of 1916 2536 a16eaaee2e90d83d834fab53d41f6ce367490f19a836a3cf56b9e5abee7c6c76.exe 30 PID 2536 wrote to memory of 1916 2536 a16eaaee2e90d83d834fab53d41f6ce367490f19a836a3cf56b9e5abee7c6c76.exe 30 PID 1916 wrote to memory of 2740 1916 bblfbn.exe 31 PID 1916 wrote to memory of 2740 1916 bblfbn.exe 31 PID 1916 wrote to memory of 2740 1916 bblfbn.exe 31 PID 1916 wrote to memory of 2740 1916 bblfbn.exe 31 PID 2740 wrote to memory of 2864 2740 jpxrvf.exe 32 PID 2740 wrote to memory of 2864 2740 jpxrvf.exe 32 PID 2740 wrote to memory of 2864 2740 jpxrvf.exe 32 PID 2740 wrote to memory of 2864 2740 jpxrvf.exe 32 PID 2864 wrote to memory of 2708 2864 jpfhhjl.exe 33 PID 2864 wrote to memory of 2708 2864 jpfhhjl.exe 33 PID 2864 wrote to memory of 2708 2864 jpfhhjl.exe 33 PID 2864 wrote to memory of 2708 2864 jpfhhjl.exe 33 PID 2708 wrote to memory of 2928 2708 ptffvnf.exe 34 PID 2708 wrote to memory of 2928 2708 ptffvnf.exe 34 PID 2708 wrote to memory of 2928 2708 ptffvnf.exe 34 PID 2708 wrote to memory of 2928 2708 ptffvnf.exe 34 PID 2928 wrote to memory of 2648 2928 vtbpr.exe 35 PID 2928 wrote to memory of 2648 2928 vtbpr.exe 35 PID 2928 wrote to memory of 2648 2928 vtbpr.exe 35 PID 2928 wrote to memory of 2648 2928 vtbpr.exe 35 PID 2648 wrote to memory of 2824 2648 pdxdbn.exe 36 PID 2648 wrote to memory of 2824 2648 pdxdbn.exe 36 PID 2648 wrote to memory of 2824 2648 pdxdbn.exe 36 PID 2648 wrote to memory of 2824 2648 pdxdbn.exe 36 PID 2824 wrote to memory of 576 2824 hxpxhj.exe 37 PID 2824 wrote to memory of 576 2824 hxpxhj.exe 37 PID 2824 wrote to memory of 576 2824 hxpxhj.exe 37 PID 2824 wrote to memory of 576 2824 hxpxhj.exe 37 PID 576 wrote to memory of 432 576 dllfxvn.exe 38 PID 576 wrote to memory of 432 576 dllfxvn.exe 38 PID 576 wrote to memory of 432 576 dllfxvn.exe 38 PID 576 wrote to memory of 432 576 dllfxvn.exe 38 PID 432 wrote to memory of 2496 432 dphpj.exe 39 PID 432 wrote to memory of 2496 432 dphpj.exe 39 PID 432 wrote to memory of 2496 432 dphpj.exe 39 PID 432 wrote to memory of 2496 432 dphpj.exe 39 PID 2496 wrote to memory of 2844 2496 nhtdlx.exe 40 PID 2496 wrote to memory of 2844 2496 nhtdlx.exe 40 PID 2496 wrote to memory of 2844 2496 nhtdlx.exe 40 PID 2496 wrote to memory of 2844 2496 nhtdlx.exe 40 PID 2844 wrote to memory of 2392 2844 vlbbttr.exe 41 PID 2844 wrote to memory of 2392 2844 vlbbttr.exe 41 PID 2844 wrote to memory of 2392 2844 vlbbttr.exe 41 PID 2844 wrote to memory of 2392 2844 vlbbttr.exe 41 PID 2392 wrote to memory of 2768 2392 dtdhdlt.exe 42 PID 2392 wrote to memory of 2768 2392 dtdhdlt.exe 42 PID 2392 wrote to memory of 2768 2392 dtdhdlt.exe 42 PID 2392 wrote to memory of 2768 2392 dtdhdlt.exe 42 PID 2768 wrote to memory of 1768 2768 ltxxdp.exe 43 PID 2768 wrote to memory of 1768 2768 ltxxdp.exe 43 PID 2768 wrote to memory of 1768 2768 ltxxdp.exe 43 PID 2768 wrote to memory of 1768 2768 ltxxdp.exe 43 PID 1768 wrote to memory of 1688 1768 xbldjvf.exe 44 PID 1768 wrote to memory of 1688 1768 xbldjvf.exe 44 PID 1768 wrote to memory of 1688 1768 xbldjvf.exe 44 PID 1768 wrote to memory of 1688 1768 xbldjvf.exe 44 PID 1688 wrote to memory of 548 1688 bvbhlxn.exe 45 PID 1688 wrote to memory of 548 1688 bvbhlxn.exe 45 PID 1688 wrote to memory of 548 1688 bvbhlxn.exe 45 PID 1688 wrote to memory of 548 1688 bvbhlxn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a16eaaee2e90d83d834fab53d41f6ce367490f19a836a3cf56b9e5abee7c6c76.exe"C:\Users\Admin\AppData\Local\Temp\a16eaaee2e90d83d834fab53d41f6ce367490f19a836a3cf56b9e5abee7c6c76.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\bblfbn.exec:\bblfbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\jpxrvf.exec:\jpxrvf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\jpfhhjl.exec:\jpfhhjl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\ptffvnf.exec:\ptffvnf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\vtbpr.exec:\vtbpr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\pdxdbn.exec:\pdxdbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\hxpxhj.exec:\hxpxhj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\dllfxvn.exec:\dllfxvn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\dphpj.exec:\dphpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\nhtdlx.exec:\nhtdlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\vlbbttr.exec:\vlbbttr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\dtdhdlt.exec:\dtdhdlt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\ltxxdp.exec:\ltxxdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\xbldjvf.exec:\xbldjvf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\bvbhlxn.exec:\bvbhlxn.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\prjlbhb.exec:\prjlbhb.exe17⤵
- Executes dropped EXE
PID:548 -
\??\c:\pptlpb.exec:\pptlpb.exe18⤵
- Executes dropped EXE
PID:2432 -
\??\c:\fxdfjpx.exec:\fxdfjpx.exe19⤵
- Executes dropped EXE
PID:1384 -
\??\c:\pdptt.exec:\pdptt.exe20⤵
- Executes dropped EXE
PID:1760 -
\??\c:\vfbljfl.exec:\vfbljfl.exe21⤵
- Executes dropped EXE
PID:2424 -
\??\c:\pbnbdn.exec:\pbnbdn.exe22⤵
- Executes dropped EXE
PID:944 -
\??\c:\djrttn.exec:\djrttn.exe23⤵
- Executes dropped EXE
PID:1712 -
\??\c:\hbthr.exec:\hbthr.exe24⤵
- Executes dropped EXE
PID:112 -
\??\c:\frhxdp.exec:\frhxdp.exe25⤵
- Executes dropped EXE
PID:1828 -
\??\c:\vtnxdd.exec:\vtnxdd.exe26⤵
- Executes dropped EXE
PID:1548 -
\??\c:\rvbfjfd.exec:\rvbfjfd.exe27⤵
- Executes dropped EXE
PID:536 -
\??\c:\fjtbdhr.exec:\fjtbdhr.exe28⤵
- Executes dropped EXE
PID:364 -
\??\c:\pnxdnx.exec:\pnxdnx.exe29⤵
- Executes dropped EXE
PID:3040 -
\??\c:\xlvtjxn.exec:\xlvtjxn.exe30⤵
- Executes dropped EXE
PID:2672 -
\??\c:\jrrtrt.exec:\jrrtrt.exe31⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jtpxj.exec:\jtpxj.exe32⤵
- Executes dropped EXE
PID:2384 -
\??\c:\ndrrfpx.exec:\ndrrfpx.exe33⤵
- Executes dropped EXE
PID:2520 -
\??\c:\vdjnlb.exec:\vdjnlb.exe34⤵
- Executes dropped EXE
PID:2684 -
\??\c:\vvrtdld.exec:\vvrtdld.exe35⤵
- Executes dropped EXE
PID:1756 -
\??\c:\dlntlfp.exec:\dlntlfp.exe36⤵
- Executes dropped EXE
PID:2200 -
\??\c:\lfnrlxb.exec:\lfnrlxb.exe37⤵
- Executes dropped EXE
PID:2748 -
\??\c:\dplrl.exec:\dplrl.exe38⤵
- Executes dropped EXE
PID:2724 -
\??\c:\bxhrb.exec:\bxhrb.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\ndjrndr.exec:\ndjrndr.exe40⤵
- Executes dropped EXE
PID:2332 -
\??\c:\hrpdd.exec:\hrpdd.exe41⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ftfxpx.exec:\ftfxpx.exe42⤵
- Executes dropped EXE
PID:2608 -
\??\c:\xfltn.exec:\xfltn.exe43⤵
- Executes dropped EXE
PID:2572 -
\??\c:\vfrjrx.exec:\vfrjrx.exe44⤵
- Executes dropped EXE
PID:684 -
\??\c:\fpbpllp.exec:\fpbpllp.exe45⤵
- Executes dropped EXE
PID:396 -
\??\c:\rxvtjbb.exec:\rxvtjbb.exe46⤵
- Executes dropped EXE
PID:2940 -
\??\c:\jvfddl.exec:\jvfddl.exe47⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rthbb.exec:\rthbb.exe48⤵
- Executes dropped EXE
PID:1116 -
\??\c:\tfphndn.exec:\tfphndn.exe49⤵
- Executes dropped EXE
PID:1776 -
\??\c:\hfrxf.exec:\hfrxf.exe50⤵
- Executes dropped EXE
PID:1156 -
\??\c:\fjhhvh.exec:\fjhhvh.exe51⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vhjthp.exec:\vhjthp.exe52⤵
- Executes dropped EXE
PID:1784 -
\??\c:\lrllbtb.exec:\lrllbtb.exe53⤵
- Executes dropped EXE
PID:1572 -
\??\c:\txrjrf.exec:\txrjrf.exe54⤵
- Executes dropped EXE
PID:812 -
\??\c:\ptfjvd.exec:\ptfjvd.exe55⤵
- Executes dropped EXE
PID:2212 -
\??\c:\npvhb.exec:\npvhb.exe56⤵
- Executes dropped EXE
PID:548 -
\??\c:\hjxdjx.exec:\hjxdjx.exe57⤵
- Executes dropped EXE
PID:2196 -
\??\c:\httlr.exec:\httlr.exe58⤵
- Executes dropped EXE
PID:1928 -
\??\c:\rxdxnhl.exec:\rxdxnhl.exe59⤵
- Executes dropped EXE
PID:2356 -
\??\c:\vdtjdf.exec:\vdtjdf.exe60⤵
- Executes dropped EXE
PID:1760 -
\??\c:\pprdlt.exec:\pprdlt.exe61⤵
- Executes dropped EXE
PID:2476 -
\??\c:\pbthnv.exec:\pbthnv.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2480 -
\??\c:\ttflnpr.exec:\ttflnpr.exe63⤵
- Executes dropped EXE
PID:708 -
\??\c:\lvrntft.exec:\lvrntft.exe64⤵
- Executes dropped EXE
PID:1772 -
\??\c:\pnxph.exec:\pnxph.exe65⤵
- Executes dropped EXE
PID:2004 -
\??\c:\lnvjrr.exec:\lnvjrr.exe66⤵PID:1920
-
\??\c:\lttfd.exec:\lttfd.exe67⤵PID:2840
-
\??\c:\dldhdf.exec:\dldhdf.exe68⤵PID:1604
-
\??\c:\fhrbr.exec:\fhrbr.exe69⤵PID:2056
-
\??\c:\dffvr.exec:\dffvr.exe70⤵PID:2528
-
\??\c:\xblrp.exec:\xblrp.exe71⤵PID:584
-
\??\c:\xfxfd.exec:\xfxfd.exe72⤵PID:2500
-
\??\c:\xfdhhbr.exec:\xfdhhbr.exe73⤵PID:2504
-
\??\c:\prrdjtt.exec:\prrdjtt.exe74⤵PID:1996
-
\??\c:\xpvvtft.exec:\xpvvtft.exe75⤵PID:2264
-
\??\c:\xbdbnl.exec:\xbdbnl.exe76⤵PID:1592
-
\??\c:\tlxnbp.exec:\tlxnbp.exe77⤵PID:1744
-
\??\c:\hbxlp.exec:\hbxlp.exe78⤵PID:2800
-
\??\c:\hjhfdr.exec:\hjhfdr.exe79⤵PID:2980
-
\??\c:\fppvxf.exec:\fppvxf.exe80⤵PID:2740
-
\??\c:\trrbd.exec:\trrbd.exe81⤵PID:2204
-
\??\c:\tfttjlx.exec:\tfttjlx.exe82⤵PID:2728
-
\??\c:\tlxdr.exec:\tlxdr.exe83⤵PID:2704
-
\??\c:\xfjdbj.exec:\xfjdbj.exe84⤵PID:2588
-
\??\c:\lpxbxp.exec:\lpxbxp.exe85⤵PID:3068
-
\??\c:\xjhffbt.exec:\xjhffbt.exe86⤵PID:1072
-
\??\c:\ldlnh.exec:\ldlnh.exe87⤵PID:952
-
\??\c:\lphrx.exec:\lphrx.exe88⤵PID:2932
-
\??\c:\bfltnvl.exec:\bfltnvl.exe89⤵PID:2924
-
\??\c:\dnxhxp.exec:\dnxhxp.exe90⤵PID:2836
-
\??\c:\rhptt.exec:\rhptt.exe91⤵PID:876
-
\??\c:\rjhrdpx.exec:\rjhrdpx.exe92⤵PID:1956
-
\??\c:\blhdft.exec:\blhdft.exe93⤵PID:1764
-
\??\c:\tfldtt.exec:\tfldtt.exe94⤵PID:1796
-
\??\c:\djlvp.exec:\djlvp.exe95⤵PID:3036
-
\??\c:\lrtvvj.exec:\lrtvvj.exe96⤵PID:592
-
\??\c:\jhbddx.exec:\jhbddx.exe97⤵PID:2336
-
\??\c:\rxvlxf.exec:\rxvlxf.exe98⤵PID:524
-
\??\c:\drjnvdh.exec:\drjnvdh.exe99⤵PID:2404
-
\??\c:\txxnb.exec:\txxnb.exe100⤵PID:2152
-
\??\c:\xljxpt.exec:\xljxpt.exe101⤵PID:2140
-
\??\c:\hhhfr.exec:\hhhfr.exe102⤵PID:1516
-
\??\c:\xpbjr.exec:\xpbjr.exe103⤵PID:2016
-
\??\c:\dxpxj.exec:\dxpxj.exe104⤵PID:1808
-
\??\c:\xhhjph.exec:\xhhjph.exe105⤵PID:236
-
\??\c:\dxtvdt.exec:\dxtvdt.exe106⤵
- System Location Discovery: System Language Discovery
PID:2028 -
\??\c:\jltrbf.exec:\jltrbf.exe107⤵
- System Location Discovery: System Language Discovery
PID:708 -
\??\c:\ldhhn.exec:\ldhhn.exe108⤵PID:1772
-
\??\c:\tbtbnd.exec:\tbtbnd.exe109⤵PID:1804
-
\??\c:\btbfhpp.exec:\btbfhpp.exe110⤵PID:1548
-
\??\c:\lvdlbxv.exec:\lvdlbxv.exe111⤵PID:1228
-
\??\c:\dphpbnj.exec:\dphpbnj.exe112⤵PID:2040
-
\??\c:\jffrt.exec:\jffrt.exe113⤵PID:1484
-
\??\c:\xrbnh.exec:\xrbnh.exe114⤵PID:2512
-
\??\c:\fjpbnjx.exec:\fjpbnjx.exe115⤵PID:848
-
\??\c:\nrfjlvx.exec:\nrfjlvx.exe116⤵
- System Location Discovery: System Language Discovery
PID:2676 -
\??\c:\vdhpp.exec:\vdhpp.exe117⤵
- System Location Discovery: System Language Discovery
PID:1692 -
\??\c:\xxdjhp.exec:\xxdjhp.exe118⤵PID:2504
-
\??\c:\vrjpvpj.exec:\vrjpvpj.exe119⤵PID:2260
-
\??\c:\jtfxn.exec:\jtfxn.exe120⤵PID:2772
-
\??\c:\jvnvtbh.exec:\jvnvtbh.exe121⤵PID:1592
-
\??\c:\fdnhvph.exec:\fdnhvph.exe122⤵PID:2804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-