Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 01:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a20136213384e8487dc4cb5e4dc4c2e94427e509d8fb213ab4e7f8126791a283.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
a20136213384e8487dc4cb5e4dc4c2e94427e509d8fb213ab4e7f8126791a283.exe
-
Size
454KB
-
MD5
24ee11649df7174f5daeae23063c1bd1
-
SHA1
4c926fda55c3f8b2f4eac8008a325aa7101b19ae
-
SHA256
a20136213384e8487dc4cb5e4dc4c2e94427e509d8fb213ab4e7f8126791a283
-
SHA512
a05da8c57e252f08b7b8739b0f229fe2e35839c7e6f7db5360750fbba3d1cae476771817f07ae36f2355728ee350e2e6f67230acb338977c8b16cf8847261193
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe17:q7Tc2NYHUrAwfMp3CD17
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2844-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1180-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/548-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-103-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1760-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-172-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2392-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-245-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2720-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-308-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2216-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-395-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1668-442-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1960-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-489-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/328-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-575-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2032-596-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2768-628-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2128-673-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-674-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2520-765-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-773-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2844 bphjdbh.exe 2736 hrlfnxv.exe 2792 rhlpx.exe 2664 bjtllv.exe 2640 bxrjrf.exe 2800 nfjnb.exe 1180 rvbhdrf.exe 548 bnpvr.exe 2196 trlhxp.exe 1076 phxjdl.exe 3008 xrrbnx.exe 1760 hxdld.exe 2920 rjjfpb.exe 2976 ndhth.exe 1388 jblrpjd.exe 2000 rrrldpt.exe 2376 brjbpdf.exe 2164 pfdvpxf.exe 2392 dbxbvjp.exe 2504 xhllbj.exe 1644 xpthhhj.exe 932 bxvvbjv.exe 952 rnbjfrf.exe 2460 fvprb.exe 1660 lttdnfv.exe 1764 xhbtlxv.exe 2408 lfdtdnp.exe 2288 llbxrr.exe 1732 vplrx.exe 2720 hfnxlj.exe 1144 llnfd.exe 860 jnrbr.exe 2776 bvvrxpf.exe 2912 jnxbfx.exe 2848 rrrfbjf.exe 2216 xdfbrpv.exe 2736 lbrfvf.exe 2916 rvnrjvn.exe 2868 tfjdh.exe 2668 vvjdptt.exe 1520 rtlpfhn.exe 2932 lpxxfx.exe 2176 nxnplh.exe 1680 dlbtrdh.exe 2336 bnlnn.exe 1236 xvhjp.exe 1492 vprhj.exe 1272 flnprpx.exe 2704 xhfjf.exe 2888 ljnlp.exe 2404 rfvrl.exe 1668 vbhvbvj.exe 1940 phhbl.exe 824 nnnbjrn.exe 2452 phfhjj.exe 2376 tnvpv.exe 2520 jvddl.exe 2468 dvttbt.exe 1960 dlvxdt.exe 1384 ptdhb.exe 880 dxbfbr.exe 2116 tjtxpbn.exe 2428 bxhfrt.exe 1952 lnrttfn.exe -
resource yara_rule behavioral1/memory/2776-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-80-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/548-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1236-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-575-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2852-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-765-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-788-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jprdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjddpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvdbbdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxhlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnpvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnljdfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjpxnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptdhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjptr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nplfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bphvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xndlth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnrvhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnfxxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jldhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnljvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbjtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrbfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrhhdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdjvfnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hptbrhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrvphp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbpfrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhndn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnrbvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbfprrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfvlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfplprl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbrfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtnrdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thfxdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnvpbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2776 wrote to memory of 2844 2776 a20136213384e8487dc4cb5e4dc4c2e94427e509d8fb213ab4e7f8126791a283.exe 30 PID 2776 wrote to memory of 2844 2776 a20136213384e8487dc4cb5e4dc4c2e94427e509d8fb213ab4e7f8126791a283.exe 30 PID 2776 wrote to memory of 2844 2776 a20136213384e8487dc4cb5e4dc4c2e94427e509d8fb213ab4e7f8126791a283.exe 30 PID 2776 wrote to memory of 2844 2776 a20136213384e8487dc4cb5e4dc4c2e94427e509d8fb213ab4e7f8126791a283.exe 30 PID 2844 wrote to memory of 2736 2844 bphjdbh.exe 31 PID 2844 wrote to memory of 2736 2844 bphjdbh.exe 31 PID 2844 wrote to memory of 2736 2844 bphjdbh.exe 31 PID 2844 wrote to memory of 2736 2844 bphjdbh.exe 31 PID 2736 wrote to memory of 2792 2736 hrlfnxv.exe 32 PID 2736 wrote to memory of 2792 2736 hrlfnxv.exe 32 PID 2736 wrote to memory of 2792 2736 hrlfnxv.exe 32 PID 2736 wrote to memory of 2792 2736 hrlfnxv.exe 32 PID 2792 wrote to memory of 2664 2792 rhlpx.exe 33 PID 2792 wrote to memory of 2664 2792 rhlpx.exe 33 PID 2792 wrote to memory of 2664 2792 rhlpx.exe 33 PID 2792 wrote to memory of 2664 2792 rhlpx.exe 33 PID 2664 wrote to memory of 2640 2664 bjtllv.exe 34 PID 2664 wrote to memory of 2640 2664 bjtllv.exe 34 PID 2664 wrote to memory of 2640 2664 bjtllv.exe 34 PID 2664 wrote to memory of 2640 2664 bjtllv.exe 34 PID 2640 wrote to memory of 2800 2640 bxrjrf.exe 35 PID 2640 wrote to memory of 2800 2640 bxrjrf.exe 35 PID 2640 wrote to memory of 2800 2640 bxrjrf.exe 35 PID 2640 wrote to memory of 2800 2640 bxrjrf.exe 35 PID 2800 wrote to memory of 1180 2800 nfjnb.exe 36 PID 2800 wrote to memory of 1180 2800 nfjnb.exe 36 PID 2800 wrote to memory of 1180 2800 nfjnb.exe 36 PID 2800 wrote to memory of 1180 2800 nfjnb.exe 36 PID 1180 wrote to memory of 548 1180 rvbhdrf.exe 37 PID 1180 wrote to memory of 548 1180 rvbhdrf.exe 37 PID 1180 wrote to memory of 548 1180 rvbhdrf.exe 37 PID 1180 wrote to memory of 548 1180 rvbhdrf.exe 37 PID 548 wrote to memory of 2196 548 bnpvr.exe 38 PID 548 wrote to memory of 2196 548 bnpvr.exe 38 PID 548 wrote to memory of 2196 548 bnpvr.exe 38 PID 548 wrote to memory of 2196 548 bnpvr.exe 38 PID 2196 wrote to memory of 1076 2196 trlhxp.exe 39 PID 2196 wrote to memory of 1076 2196 trlhxp.exe 39 PID 2196 wrote to memory of 1076 2196 trlhxp.exe 39 PID 2196 wrote to memory of 1076 2196 trlhxp.exe 39 PID 1076 wrote to memory of 3008 1076 phxjdl.exe 40 PID 1076 wrote to memory of 3008 1076 phxjdl.exe 40 PID 1076 wrote to memory of 3008 1076 phxjdl.exe 40 PID 1076 wrote to memory of 3008 1076 phxjdl.exe 40 PID 3008 wrote to memory of 1760 3008 xrrbnx.exe 41 PID 3008 wrote to memory of 1760 3008 xrrbnx.exe 41 PID 3008 wrote to memory of 1760 3008 xrrbnx.exe 41 PID 3008 wrote to memory of 1760 3008 xrrbnx.exe 41 PID 1760 wrote to memory of 2920 1760 hxdld.exe 42 PID 1760 wrote to memory of 2920 1760 hxdld.exe 42 PID 1760 wrote to memory of 2920 1760 hxdld.exe 42 PID 1760 wrote to memory of 2920 1760 hxdld.exe 42 PID 2920 wrote to memory of 2976 2920 rjjfpb.exe 43 PID 2920 wrote to memory of 2976 2920 rjjfpb.exe 43 PID 2920 wrote to memory of 2976 2920 rjjfpb.exe 43 PID 2920 wrote to memory of 2976 2920 rjjfpb.exe 43 PID 2976 wrote to memory of 1388 2976 ndhth.exe 44 PID 2976 wrote to memory of 1388 2976 ndhth.exe 44 PID 2976 wrote to memory of 1388 2976 ndhth.exe 44 PID 2976 wrote to memory of 1388 2976 ndhth.exe 44 PID 1388 wrote to memory of 2000 1388 jblrpjd.exe 45 PID 1388 wrote to memory of 2000 1388 jblrpjd.exe 45 PID 1388 wrote to memory of 2000 1388 jblrpjd.exe 45 PID 1388 wrote to memory of 2000 1388 jblrpjd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a20136213384e8487dc4cb5e4dc4c2e94427e509d8fb213ab4e7f8126791a283.exe"C:\Users\Admin\AppData\Local\Temp\a20136213384e8487dc4cb5e4dc4c2e94427e509d8fb213ab4e7f8126791a283.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\bphjdbh.exec:\bphjdbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\hrlfnxv.exec:\hrlfnxv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\rhlpx.exec:\rhlpx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\bjtllv.exec:\bjtllv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\bxrjrf.exec:\bxrjrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\nfjnb.exec:\nfjnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\rvbhdrf.exec:\rvbhdrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\bnpvr.exec:\bnpvr.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\trlhxp.exec:\trlhxp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\phxjdl.exec:\phxjdl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\xrrbnx.exec:\xrrbnx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\hxdld.exec:\hxdld.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\rjjfpb.exec:\rjjfpb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\ndhth.exec:\ndhth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\jblrpjd.exec:\jblrpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\rrrldpt.exec:\rrrldpt.exe17⤵
- Executes dropped EXE
PID:2000 -
\??\c:\brjbpdf.exec:\brjbpdf.exe18⤵
- Executes dropped EXE
PID:2376 -
\??\c:\pfdvpxf.exec:\pfdvpxf.exe19⤵
- Executes dropped EXE
PID:2164 -
\??\c:\dbxbvjp.exec:\dbxbvjp.exe20⤵
- Executes dropped EXE
PID:2392 -
\??\c:\xhllbj.exec:\xhllbj.exe21⤵
- Executes dropped EXE
PID:2504 -
\??\c:\xpthhhj.exec:\xpthhhj.exe22⤵
- Executes dropped EXE
PID:1644 -
\??\c:\bxvvbjv.exec:\bxvvbjv.exe23⤵
- Executes dropped EXE
PID:932 -
\??\c:\rnbjfrf.exec:\rnbjfrf.exe24⤵
- Executes dropped EXE
PID:952 -
\??\c:\fvprb.exec:\fvprb.exe25⤵
- Executes dropped EXE
PID:2460 -
\??\c:\lttdnfv.exec:\lttdnfv.exe26⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xhbtlxv.exec:\xhbtlxv.exe27⤵
- Executes dropped EXE
PID:1764 -
\??\c:\lfdtdnp.exec:\lfdtdnp.exe28⤵
- Executes dropped EXE
PID:2408 -
\??\c:\llbxrr.exec:\llbxrr.exe29⤵
- Executes dropped EXE
PID:2288 -
\??\c:\vplrx.exec:\vplrx.exe30⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hfnxlj.exec:\hfnxlj.exe31⤵
- Executes dropped EXE
PID:2720 -
\??\c:\llnfd.exec:\llnfd.exe32⤵
- Executes dropped EXE
PID:1144 -
\??\c:\jnrbr.exec:\jnrbr.exe33⤵
- Executes dropped EXE
PID:860 -
\??\c:\bvvrxpf.exec:\bvvrxpf.exe34⤵
- Executes dropped EXE
PID:2776 -
\??\c:\jnxbfx.exec:\jnxbfx.exe35⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rrrfbjf.exec:\rrrfbjf.exe36⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xdfbrpv.exec:\xdfbrpv.exe37⤵
- Executes dropped EXE
PID:2216 -
\??\c:\lbrfvf.exec:\lbrfvf.exe38⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rvnrjvn.exec:\rvnrjvn.exe39⤵
- Executes dropped EXE
PID:2916 -
\??\c:\tfjdh.exec:\tfjdh.exe40⤵
- Executes dropped EXE
PID:2868 -
\??\c:\vvjdptt.exec:\vvjdptt.exe41⤵
- Executes dropped EXE
PID:2668 -
\??\c:\rtlpfhn.exec:\rtlpfhn.exe42⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lpxxfx.exec:\lpxxfx.exe43⤵
- Executes dropped EXE
PID:2932 -
\??\c:\nxnplh.exec:\nxnplh.exe44⤵
- Executes dropped EXE
PID:2176 -
\??\c:\dlbtrdh.exec:\dlbtrdh.exe45⤵
- Executes dropped EXE
PID:1680 -
\??\c:\bnlnn.exec:\bnlnn.exe46⤵
- Executes dropped EXE
PID:2336 -
\??\c:\xvhjp.exec:\xvhjp.exe47⤵
- Executes dropped EXE
PID:1236 -
\??\c:\vprhj.exec:\vprhj.exe48⤵
- Executes dropped EXE
PID:1492 -
\??\c:\flnprpx.exec:\flnprpx.exe49⤵
- Executes dropped EXE
PID:1272 -
\??\c:\xhfjf.exec:\xhfjf.exe50⤵
- Executes dropped EXE
PID:2704 -
\??\c:\ljnlp.exec:\ljnlp.exe51⤵
- Executes dropped EXE
PID:2888 -
\??\c:\rfvrl.exec:\rfvrl.exe52⤵
- Executes dropped EXE
PID:2404 -
\??\c:\vbhvbvj.exec:\vbhvbvj.exe53⤵
- Executes dropped EXE
PID:1668 -
\??\c:\phhbl.exec:\phhbl.exe54⤵
- Executes dropped EXE
PID:1940 -
\??\c:\nnnbjrn.exec:\nnnbjrn.exe55⤵
- Executes dropped EXE
PID:824 -
\??\c:\phfhjj.exec:\phfhjj.exe56⤵
- Executes dropped EXE
PID:2452 -
\??\c:\tnvpv.exec:\tnvpv.exe57⤵
- Executes dropped EXE
PID:2376 -
\??\c:\jvddl.exec:\jvddl.exe58⤵
- Executes dropped EXE
PID:2520 -
\??\c:\dvttbt.exec:\dvttbt.exe59⤵
- Executes dropped EXE
PID:2468 -
\??\c:\dlvxdt.exec:\dlvxdt.exe60⤵
- Executes dropped EXE
PID:1960 -
\??\c:\ptdhb.exec:\ptdhb.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1384 -
\??\c:\dxbfbr.exec:\dxbfbr.exe62⤵
- Executes dropped EXE
PID:880 -
\??\c:\tjtxpbn.exec:\tjtxpbn.exe63⤵
- Executes dropped EXE
PID:2116 -
\??\c:\bxhfrt.exec:\bxhfrt.exe64⤵
- Executes dropped EXE
PID:2428 -
\??\c:\lnrttfn.exec:\lnrttfn.exe65⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jxrvhtx.exec:\jxrvhtx.exe66⤵PID:2716
-
\??\c:\xljtfpx.exec:\xljtfpx.exe67⤵PID:2556
-
\??\c:\lbbbn.exec:\lbbbn.exe68⤵PID:324
-
\??\c:\vjhfv.exec:\vjhfv.exe69⤵PID:328
-
\??\c:\hlrlxjd.exec:\hlrlxjd.exe70⤵PID:2540
-
\??\c:\nbjnjlh.exec:\nbjnjlh.exe71⤵PID:1488
-
\??\c:\vfrdvjt.exec:\vfrdvjt.exe72⤵PID:2240
-
\??\c:\pjpjt.exec:\pjpjt.exe73⤵PID:2032
-
\??\c:\nbtht.exec:\nbtht.exe74⤵PID:2036
-
\??\c:\bbrphn.exec:\bbrphn.exe75⤵PID:2304
-
\??\c:\jprjrf.exec:\jprjrf.exe76⤵PID:2876
-
\??\c:\bjnbntd.exec:\bjnbntd.exe77⤵PID:2852
-
\??\c:\vfpjtr.exec:\vfpjtr.exe78⤵PID:1600
-
\??\c:\xtpbrn.exec:\xtpbrn.exe79⤵PID:2748
-
\??\c:\hptrrx.exec:\hptrrx.exe80⤵PID:2660
-
\??\c:\rhndn.exec:\rhndn.exe81⤵
- System Location Discovery: System Language Discovery
PID:2768 -
\??\c:\bnvhl.exec:\bnvhl.exe82⤵PID:2792
-
\??\c:\jldjln.exec:\jldjln.exe83⤵PID:2832
-
\??\c:\ndxjpb.exec:\ndxjpb.exe84⤵PID:2668
-
\??\c:\nlhfjf.exec:\nlhfjf.exe85⤵PID:820
-
\??\c:\rrhvhjn.exec:\rrhvhjn.exe86⤵PID:1616
-
\??\c:\ffxxfv.exec:\ffxxfv.exe87⤵PID:2140
-
\??\c:\hxjdrj.exec:\hxjdrj.exe88⤵PID:2128
-
\??\c:\djvndpd.exec:\djvndpd.exe89⤵PID:1928
-
\??\c:\lrfrjpn.exec:\lrfrjpn.exe90⤵PID:2088
-
\??\c:\tbdfvd.exec:\tbdfvd.exe91⤵PID:1572
-
\??\c:\bnrhxhb.exec:\bnrhxhb.exe92⤵PID:3008
-
\??\c:\rjjpdp.exec:\rjjpdp.exe93⤵PID:2964
-
\??\c:\xrpldxl.exec:\xrpldxl.exe94⤵PID:2936
-
\??\c:\nlfxxd.exec:\nlfxxd.exe95⤵PID:2888
-
\??\c:\htrldvh.exec:\htrldvh.exe96⤵PID:2404
-
\??\c:\rjftn.exec:\rjftn.exe97⤵PID:672
-
\??\c:\fltvxt.exec:\fltvxt.exe98⤵PID:1940
-
\??\c:\vjpdhb.exec:\vjpdhb.exe99⤵PID:824
-
\??\c:\vnjfn.exec:\vnjfn.exe100⤵PID:1184
-
\??\c:\jnxtb.exec:\jnxtb.exe101⤵PID:2072
-
\??\c:\xbjjxb.exec:\xbjjxb.exe102⤵PID:2520
-
\??\c:\bnrnl.exec:\bnrnl.exe103⤵PID:2468
-
\??\c:\jhrjlld.exec:\jhrjlld.exe104⤵PID:872
-
\??\c:\brvjp.exec:\brvjp.exe105⤵PID:1672
-
\??\c:\lvlxh.exec:\lvlxh.exe106⤵PID:932
-
\??\c:\bnrnn.exec:\bnrnn.exe107⤵PID:952
-
\??\c:\ttrrjp.exec:\ttrrjp.exe108⤵PID:2460
-
\??\c:\njfdnd.exec:\njfdnd.exe109⤵PID:280
-
\??\c:\jfbnxjj.exec:\jfbnxjj.exe110⤵PID:1764
-
\??\c:\rnljdfl.exec:\rnljdfl.exe111⤵
- System Location Discovery: System Language Discovery
PID:2320 -
\??\c:\djrxdnx.exec:\djrxdnx.exe112⤵PID:328
-
\??\c:\dpnjxtn.exec:\dpnjxtn.exe113⤵PID:1996
-
\??\c:\fbljj.exec:\fbljj.exe114⤵PID:2040
-
\??\c:\vpfnt.exec:\vpfnt.exe115⤵PID:1028
-
\??\c:\lxxnnnd.exec:\lxxnnnd.exe116⤵PID:1144
-
\??\c:\nnjfrv.exec:\nnjfrv.exe117⤵PID:2036
-
\??\c:\pdvbjd.exec:\pdvbjd.exe118⤵PID:2304
-
\??\c:\vbjht.exec:\vbjht.exe119⤵PID:2784
-
\??\c:\rdtbpt.exec:\rdtbpt.exe120⤵PID:2852
-
\??\c:\lxftd.exec:\lxftd.exe121⤵PID:3068
-
\??\c:\xfdjbv.exec:\xfdjbv.exe122⤵PID:2456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-