Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 01:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe
-
Size
453KB
-
MD5
bd0a5f7caeeb32ce42cdd5414b2b1a8a
-
SHA1
1725c336f24d7408ad7d7b2907fb998fcbd76ee2
-
SHA256
a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1
-
SHA512
4f57fce8b268e082ab63a7f38b45f39b341e273a715edf442b7383b3cc01bd660469bf75ff118e7bc884aa108c33f29836c13446623bc42d25710fad312447cf
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeC:q7Tc2NYHUrAwfMp3CDC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2224-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-17-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2984-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/984-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-113-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2128-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-238-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1836-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-277-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1152-288-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1720-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-345-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2372-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-537-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1216-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1384-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-566-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1644-585-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1928-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/664-599-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2156-705-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/432-720-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2252-753-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2252-752-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2060-768-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-795-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2224 hvnfpp.exe 2984 rfvlnxl.exe 2852 tllfp.exe 3012 xhldrp.exe 2860 fbffd.exe 2800 txvhrnv.exe 2796 bhnftjv.exe 2928 bhlvfff.exe 1692 dbfxb.exe 984 rbptt.exe 2136 xtttdlt.exe 2128 pjfnxn.exe 2108 vbfnfnb.exe 1444 tfxxv.exe 2516 prtfh.exe 1956 fjljb.exe 1536 hrrdj.exe 2456 jptnxj.exe 1204 pvdbbnn.exe 2272 vjptfn.exe 1072 jpdtx.exe 1388 hndrxt.exe 1556 lhxhjd.exe 900 nflxbjl.exe 1752 rfnxhvx.exe 1836 vjfnft.exe 1128 lfrdt.exe 1924 dfvhdp.exe 2316 vlxtv.exe 1152 ltlbflh.exe 1664 pntdn.exe 1720 bpxhlnr.exe 2216 fhdjt.exe 1584 vvxndf.exe 2964 pxljr.exe 2948 nhhdd.exe 3004 ntvpxp.exe 2944 xvtrh.exe 2372 ldvttpv.exe 2752 fdnflp.exe 2820 fnpjr.exe 2812 xnrrtb.exe 2404 llfbttb.exe 868 bpxdbj.exe 1672 nfdhl.exe 1736 bxnjnvt.exe 588 tbfjrh.exe 2156 pbldh.exe 3028 pppdptd.exe 3052 vpnxph.exe 2508 njfxv.exe 2296 tphfhv.exe 2420 hnbrf.exe 2516 fbjthn.exe 2308 ndbnfbp.exe 2464 phvvnj.exe 2544 htdlthr.exe 396 jrvnrdn.exe 2232 xlrnh.exe 1076 bnhpxp.exe 980 ptrvxn.exe 2532 bfjdjtb.exe 780 nlfdxv.exe 2480 xnrvvpj.exe -
resource yara_rule behavioral1/memory/2224-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-17-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/2852-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-768-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxbxxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdnjlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflxdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhxvbtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrvxvnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhvxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpvvlfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtpvhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trxbpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lndrvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdhhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njvbrnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdlvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djnvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jptnxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lprbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtttdlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrhxpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlhtfjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtlppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntntp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnxlvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpnxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njfxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdblp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvxpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjxbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdttnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prjtvbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhpxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjfhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnbjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phtjpjd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2596 wrote to memory of 2224 2596 a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe 29 PID 2596 wrote to memory of 2224 2596 a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe 29 PID 2596 wrote to memory of 2224 2596 a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe 29 PID 2596 wrote to memory of 2224 2596 a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe 29 PID 2224 wrote to memory of 2984 2224 hvnfpp.exe 30 PID 2224 wrote to memory of 2984 2224 hvnfpp.exe 30 PID 2224 wrote to memory of 2984 2224 hvnfpp.exe 30 PID 2224 wrote to memory of 2984 2224 hvnfpp.exe 30 PID 2984 wrote to memory of 2852 2984 rfvlnxl.exe 31 PID 2984 wrote to memory of 2852 2984 rfvlnxl.exe 31 PID 2984 wrote to memory of 2852 2984 rfvlnxl.exe 31 PID 2984 wrote to memory of 2852 2984 rfvlnxl.exe 31 PID 2852 wrote to memory of 3012 2852 tllfp.exe 32 PID 2852 wrote to memory of 3012 2852 tllfp.exe 32 PID 2852 wrote to memory of 3012 2852 tllfp.exe 32 PID 2852 wrote to memory of 3012 2852 tllfp.exe 32 PID 3012 wrote to memory of 2860 3012 xhldrp.exe 33 PID 3012 wrote to memory of 2860 3012 xhldrp.exe 33 PID 3012 wrote to memory of 2860 3012 xhldrp.exe 33 PID 3012 wrote to memory of 2860 3012 xhldrp.exe 33 PID 2860 wrote to memory of 2800 2860 fbffd.exe 34 PID 2860 wrote to memory of 2800 2860 fbffd.exe 34 PID 2860 wrote to memory of 2800 2860 fbffd.exe 34 PID 2860 wrote to memory of 2800 2860 fbffd.exe 34 PID 2800 wrote to memory of 2796 2800 txvhrnv.exe 35 PID 2800 wrote to memory of 2796 2800 txvhrnv.exe 35 PID 2800 wrote to memory of 2796 2800 txvhrnv.exe 35 PID 2800 wrote to memory of 2796 2800 txvhrnv.exe 35 PID 2796 wrote to memory of 2928 2796 bhnftjv.exe 36 PID 2796 wrote to memory of 2928 2796 bhnftjv.exe 36 PID 2796 wrote to memory of 2928 2796 bhnftjv.exe 36 PID 2796 wrote to memory of 2928 2796 bhnftjv.exe 36 PID 2928 wrote to memory of 1692 2928 bhlvfff.exe 37 PID 2928 wrote to memory of 1692 2928 bhlvfff.exe 37 PID 2928 wrote to memory of 1692 2928 bhlvfff.exe 37 PID 2928 wrote to memory of 1692 2928 bhlvfff.exe 37 PID 1692 wrote to memory of 984 1692 dbfxb.exe 38 PID 1692 wrote to memory of 984 1692 dbfxb.exe 38 PID 1692 wrote to memory of 984 1692 dbfxb.exe 38 PID 1692 wrote to memory of 984 1692 dbfxb.exe 38 PID 984 wrote to memory of 2136 984 rbptt.exe 39 PID 984 wrote to memory of 2136 984 rbptt.exe 39 PID 984 wrote to memory of 2136 984 rbptt.exe 39 PID 984 wrote to memory of 2136 984 rbptt.exe 39 PID 2136 wrote to memory of 2128 2136 xtttdlt.exe 40 PID 2136 wrote to memory of 2128 2136 xtttdlt.exe 40 PID 2136 wrote to memory of 2128 2136 xtttdlt.exe 40 PID 2136 wrote to memory of 2128 2136 xtttdlt.exe 40 PID 2128 wrote to memory of 2108 2128 pjfnxn.exe 41 PID 2128 wrote to memory of 2108 2128 pjfnxn.exe 41 PID 2128 wrote to memory of 2108 2128 pjfnxn.exe 41 PID 2128 wrote to memory of 2108 2128 pjfnxn.exe 41 PID 2108 wrote to memory of 1444 2108 vbfnfnb.exe 42 PID 2108 wrote to memory of 1444 2108 vbfnfnb.exe 42 PID 2108 wrote to memory of 1444 2108 vbfnfnb.exe 42 PID 2108 wrote to memory of 1444 2108 vbfnfnb.exe 42 PID 1444 wrote to memory of 2516 1444 tfxxv.exe 43 PID 1444 wrote to memory of 2516 1444 tfxxv.exe 43 PID 1444 wrote to memory of 2516 1444 tfxxv.exe 43 PID 1444 wrote to memory of 2516 1444 tfxxv.exe 43 PID 2516 wrote to memory of 1956 2516 prtfh.exe 44 PID 2516 wrote to memory of 1956 2516 prtfh.exe 44 PID 2516 wrote to memory of 1956 2516 prtfh.exe 44 PID 2516 wrote to memory of 1956 2516 prtfh.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe"C:\Users\Admin\AppData\Local\Temp\a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\hvnfpp.exec:\hvnfpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\rfvlnxl.exec:\rfvlnxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\tllfp.exec:\tllfp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\xhldrp.exec:\xhldrp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\fbffd.exec:\fbffd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\txvhrnv.exec:\txvhrnv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\bhnftjv.exec:\bhnftjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\bhlvfff.exec:\bhlvfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\dbfxb.exec:\dbfxb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\rbptt.exec:\rbptt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\xtttdlt.exec:\xtttdlt.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\pjfnxn.exec:\pjfnxn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\vbfnfnb.exec:\vbfnfnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\tfxxv.exec:\tfxxv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\prtfh.exec:\prtfh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\fjljb.exec:\fjljb.exe17⤵
- Executes dropped EXE
PID:1956 -
\??\c:\hrrdj.exec:\hrrdj.exe18⤵
- Executes dropped EXE
PID:1536 -
\??\c:\jptnxj.exec:\jptnxj.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2456 -
\??\c:\pvdbbnn.exec:\pvdbbnn.exe20⤵
- Executes dropped EXE
PID:1204 -
\??\c:\vjptfn.exec:\vjptfn.exe21⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jpdtx.exec:\jpdtx.exe22⤵
- Executes dropped EXE
PID:1072 -
\??\c:\hndrxt.exec:\hndrxt.exe23⤵
- Executes dropped EXE
PID:1388 -
\??\c:\lhxhjd.exec:\lhxhjd.exe24⤵
- Executes dropped EXE
PID:1556 -
\??\c:\nflxbjl.exec:\nflxbjl.exe25⤵
- Executes dropped EXE
PID:900 -
\??\c:\rfnxhvx.exec:\rfnxhvx.exe26⤵
- Executes dropped EXE
PID:1752 -
\??\c:\vjfnft.exec:\vjfnft.exe27⤵
- Executes dropped EXE
PID:1836 -
\??\c:\lfrdt.exec:\lfrdt.exe28⤵
- Executes dropped EXE
PID:1128 -
\??\c:\dfvhdp.exec:\dfvhdp.exe29⤵
- Executes dropped EXE
PID:1924 -
\??\c:\vlxtv.exec:\vlxtv.exe30⤵
- Executes dropped EXE
PID:2316 -
\??\c:\ltlbflh.exec:\ltlbflh.exe31⤵
- Executes dropped EXE
PID:1152 -
\??\c:\pntdn.exec:\pntdn.exe32⤵
- Executes dropped EXE
PID:1664 -
\??\c:\bpxhlnr.exec:\bpxhlnr.exe33⤵
- Executes dropped EXE
PID:1720 -
\??\c:\fhdjt.exec:\fhdjt.exe34⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vvxndf.exec:\vvxndf.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\pxljr.exec:\pxljr.exe36⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nhhdd.exec:\nhhdd.exe37⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ntvpxp.exec:\ntvpxp.exe38⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xvtrh.exec:\xvtrh.exe39⤵
- Executes dropped EXE
PID:2944 -
\??\c:\ldvttpv.exec:\ldvttpv.exe40⤵
- Executes dropped EXE
PID:2372 -
\??\c:\fdnflp.exec:\fdnflp.exe41⤵
- Executes dropped EXE
PID:2752 -
\??\c:\fnpjr.exec:\fnpjr.exe42⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xnrrtb.exec:\xnrrtb.exe43⤵
- Executes dropped EXE
PID:2812 -
\??\c:\llfbttb.exec:\llfbttb.exe44⤵
- Executes dropped EXE
PID:2404 -
\??\c:\bpxdbj.exec:\bpxdbj.exe45⤵
- Executes dropped EXE
PID:868 -
\??\c:\nfdhl.exec:\nfdhl.exe46⤵
- Executes dropped EXE
PID:1672 -
\??\c:\bxnjnvt.exec:\bxnjnvt.exe47⤵
- Executes dropped EXE
PID:1736 -
\??\c:\tbfjrh.exec:\tbfjrh.exe48⤵
- Executes dropped EXE
PID:588 -
\??\c:\pbldh.exec:\pbldh.exe49⤵
- Executes dropped EXE
PID:2156 -
\??\c:\pppdptd.exec:\pppdptd.exe50⤵
- Executes dropped EXE
PID:3028 -
\??\c:\vpnxph.exec:\vpnxph.exe51⤵
- Executes dropped EXE
PID:3052 -
\??\c:\njfxv.exec:\njfxv.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2508 -
\??\c:\tphfhv.exec:\tphfhv.exe53⤵
- Executes dropped EXE
PID:2296 -
\??\c:\hnbrf.exec:\hnbrf.exe54⤵
- Executes dropped EXE
PID:2420 -
\??\c:\fbjthn.exec:\fbjthn.exe55⤵
- Executes dropped EXE
PID:2516 -
\??\c:\ndbnfbp.exec:\ndbnfbp.exe56⤵
- Executes dropped EXE
PID:2308 -
\??\c:\phvvnj.exec:\phvvnj.exe57⤵
- Executes dropped EXE
PID:2464 -
\??\c:\htdlthr.exec:\htdlthr.exe58⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jrvnrdn.exec:\jrvnrdn.exe59⤵
- Executes dropped EXE
PID:396 -
\??\c:\xlrnh.exec:\xlrnh.exe60⤵
- Executes dropped EXE
PID:2232 -
\??\c:\bnhpxp.exec:\bnhpxp.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1076 -
\??\c:\ptrvxn.exec:\ptrvxn.exe62⤵
- Executes dropped EXE
PID:980 -
\??\c:\bfjdjtb.exec:\bfjdjtb.exe63⤵
- Executes dropped EXE
PID:2532 -
\??\c:\nlfdxv.exec:\nlfdxv.exe64⤵
- Executes dropped EXE
PID:780 -
\??\c:\xnrvvpj.exec:\xnrvvpj.exe65⤵
- Executes dropped EXE
PID:2480 -
\??\c:\bjfpn.exec:\bjfpn.exe66⤵PID:2644
-
\??\c:\jnlft.exec:\jnlft.exe67⤵PID:2388
-
\??\c:\rtlrv.exec:\rtlrv.exe68⤵PID:1752
-
\??\c:\jjxlbfd.exec:\jjxlbfd.exe69⤵PID:1216
-
\??\c:\tnffpv.exec:\tnffpv.exe70⤵PID:2668
-
\??\c:\fvxpt.exec:\fvxpt.exe71⤵
- System Location Discovery: System Language Discovery
PID:1384 -
\??\c:\hdpnbph.exec:\hdpnbph.exe72⤵PID:2384
-
\??\c:\htltph.exec:\htltph.exe73⤵PID:2664
-
\??\c:\tjvfhj.exec:\tjvfhj.exe74⤵PID:1104
-
\??\c:\flnbpx.exec:\flnbpx.exe75⤵PID:1644
-
\??\c:\dnxlvt.exec:\dnxlvt.exe76⤵PID:1928
-
\??\c:\rplhfnx.exec:\rplhfnx.exe77⤵PID:664
-
\??\c:\fnbjn.exec:\fnbjn.exe78⤵
- System Location Discovery: System Language Discovery
PID:1608 -
\??\c:\tlvvtfn.exec:\tlvvtfn.exe79⤵PID:1616
-
\??\c:\hnvnnt.exec:\hnvnnt.exe80⤵PID:2952
-
\??\c:\njdttx.exec:\njdttx.exe81⤵PID:2984
-
\??\c:\jrnhrhf.exec:\jrnhrhf.exe82⤵PID:2880
-
\??\c:\brtxhd.exec:\brtxhd.exe83⤵PID:2996
-
\??\c:\nlpvb.exec:\nlpvb.exe84⤵PID:2772
-
\??\c:\thfbvl.exec:\thfbvl.exe85⤵PID:2784
-
\??\c:\rpnxn.exec:\rpnxn.exe86⤵
- System Location Discovery: System Language Discovery
PID:2972 -
\??\c:\hhbjpph.exec:\hhbjpph.exe87⤵PID:2812
-
\??\c:\dltntfj.exec:\dltntfj.exe88⤵PID:944
-
\??\c:\jbvvhlb.exec:\jbvvhlb.exe89⤵PID:868
-
\??\c:\hxjvxnj.exec:\hxjvxnj.exe90⤵PID:2716
-
\??\c:\dpvhxd.exec:\dpvhxd.exe91⤵PID:1736
-
\??\c:\lhjhn.exec:\lhjhn.exe92⤵PID:432
-
\??\c:\lvllrp.exec:\lvllrp.exe93⤵PID:2156
-
\??\c:\ldvbtb.exec:\ldvbtb.exe94⤵PID:2368
-
\??\c:\tlbnrvp.exec:\tlbnrvp.exe95⤵PID:3052
-
\??\c:\rbplt.exec:\rbplt.exe96⤵PID:2848
-
\??\c:\pbftvtx.exec:\pbftvtx.exe97⤵PID:1972
-
\??\c:\bphpvnp.exec:\bphpvnp.exe98⤵PID:692
-
\??\c:\fbbtdh.exec:\fbbtdh.exe99⤵PID:1588
-
\??\c:\lvvfnb.exec:\lvvfnb.exe100⤵PID:2252
-
\??\c:\vpvld.exec:\vpvld.exe101⤵PID:1760
-
\??\c:\ljnvrb.exec:\ljnvrb.exe102⤵PID:2544
-
\??\c:\jxprjh.exec:\jxprjh.exe103⤵PID:2060
-
\??\c:\plnntxd.exec:\plnntxd.exe104⤵PID:2232
-
\??\c:\xvfjvf.exec:\xvfjvf.exe105⤵PID:1896
-
\??\c:\bbxfrd.exec:\bbxfrd.exe106⤵PID:1992
-
\??\c:\pldlvp.exec:\pldlvp.exe107⤵PID:1052
-
\??\c:\xxvtpbf.exec:\xxvtpbf.exe108⤵PID:1184
-
\??\c:\jdpxhh.exec:\jdpxhh.exe109⤵PID:2724
-
\??\c:\xpxbhth.exec:\xpxbhth.exe110⤵PID:1748
-
\??\c:\lnhnt.exec:\lnhnt.exe111⤵PID:1084
-
\??\c:\nprjr.exec:\nprjr.exe112⤵PID:584
-
\??\c:\lbxdhd.exec:\lbxdhd.exe113⤵PID:1544
-
\??\c:\fvldn.exec:\fvldn.exe114⤵PID:1188
-
\??\c:\ddlrtl.exec:\ddlrtl.exe115⤵PID:364
-
\??\c:\bpxfjp.exec:\bpxfjp.exe116⤵PID:2664
-
\??\c:\xrrnhj.exec:\xrrnhj.exe117⤵PID:1636
-
\??\c:\nxtbblf.exec:\nxtbblf.exe118⤵PID:1804
-
\??\c:\hjfbld.exec:\hjfbld.exe119⤵PID:2356
-
\??\c:\fxplbxn.exec:\fxplbxn.exe120⤵PID:2032
-
\??\c:\vnxhp.exec:\vnxhp.exe121⤵PID:2472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-