Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 01:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe
-
Size
453KB
-
MD5
bd0a5f7caeeb32ce42cdd5414b2b1a8a
-
SHA1
1725c336f24d7408ad7d7b2907fb998fcbd76ee2
-
SHA256
a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1
-
SHA512
4f57fce8b268e082ab63a7f38b45f39b341e273a715edf442b7383b3cc01bd660469bf75ff118e7bc884aa108c33f29836c13446623bc42d25710fad312447cf
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeC:q7Tc2NYHUrAwfMp3CDC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2304-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-68-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2920-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1172-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-298-0x0000000077170000-0x000000007726A000-memory.dmp family_blackmoon behavioral1/memory/1604-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-297-0x0000000077050000-0x000000007716F000-memory.dmp family_blackmoon behavioral1/memory/2996-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-460-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2532-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-599-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2732-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-815-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2532 xrrpl.exe 2208 fpnfxv.exe 868 hjhnvb.exe 2892 vdprfvn.exe 2752 fnflh.exe 2920 ndxjlx.exe 2676 ddvrbx.exe 2696 ltxbbj.exe 2376 bdhxr.exe 2688 fbrxhlx.exe 3016 jjnxlv.exe 1740 nrvnbnn.exe 2968 jjxpxfx.exe 2820 rtvpl.exe 1288 xlxrtx.exe 2476 xvrhbjv.exe 1068 ntvdnlv.exe 2344 xdlnll.exe 2176 vfnbljh.exe 1172 nxblhvd.exe 2816 fvnjx.exe 1164 ndhrnb.exe 1016 bvnddtd.exe 2120 rfvhf.exe 648 ljbrjxl.exe 676 vbhjvxt.exe 2580 rflrv.exe 1660 xvxrfbr.exe 836 nhxhff.exe 2216 nttjf.exe 880 vffrfv.exe 2372 fddjlxn.exe 1700 hxvjhr.exe 1708 nlhbdj.exe 2208 dthtx.exe 2880 jhntvl.exe 2940 pvxfjhr.exe 2996 dddtrr.exe 2192 vfjrph.exe 2928 ftrltlr.exe 3020 fdvtb.exe 2684 dpjlvpx.exe 2672 drxltb.exe 1104 nlbdp.exe 1616 dnxhl.exe 2976 xxjnhl.exe 2608 rthrftn.exe 1980 hdxhj.exe 560 pnnpplp.exe 1928 nhvrhvj.exe 2820 njpbn.exe 2232 vpxfpbt.exe 2100 bjjfj.exe 2168 rhnnlx.exe 2988 vjjpv.exe 2028 jrxvxfv.exe 1812 fjtdpbr.exe 1172 tpltrl.exe 2392 hprtvpv.exe 1368 dfbbtf.exe 1184 dndfn.exe 2864 nptlpdr.exe 824 nvxbjv.exe 1688 hnljhlf.exe -
resource yara_rule behavioral1/memory/2304-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-775-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-815-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttjjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frvffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxxhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blpbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddlbxnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnjrtdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbvxvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdxrfnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrpjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fljjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drprr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfpbllv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftjpnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftrltlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlbfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvnfbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhbnblt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdhfbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vllbvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrjnffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjnxlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bffnjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfvvbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txrvrnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndnbld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpnvxhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnjnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlfpprv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjlvnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfntx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbrjnxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldjdhnx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2532 2304 a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe 31 PID 2304 wrote to memory of 2532 2304 a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe 31 PID 2304 wrote to memory of 2532 2304 a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe 31 PID 2304 wrote to memory of 2532 2304 a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe 31 PID 2532 wrote to memory of 2208 2532 xrrpl.exe 32 PID 2532 wrote to memory of 2208 2532 xrrpl.exe 32 PID 2532 wrote to memory of 2208 2532 xrrpl.exe 32 PID 2532 wrote to memory of 2208 2532 xrrpl.exe 32 PID 2208 wrote to memory of 868 2208 fpnfxv.exe 33 PID 2208 wrote to memory of 868 2208 fpnfxv.exe 33 PID 2208 wrote to memory of 868 2208 fpnfxv.exe 33 PID 2208 wrote to memory of 868 2208 fpnfxv.exe 33 PID 868 wrote to memory of 2892 868 hjhnvb.exe 34 PID 868 wrote to memory of 2892 868 hjhnvb.exe 34 PID 868 wrote to memory of 2892 868 hjhnvb.exe 34 PID 868 wrote to memory of 2892 868 hjhnvb.exe 34 PID 2892 wrote to memory of 2752 2892 vdprfvn.exe 35 PID 2892 wrote to memory of 2752 2892 vdprfvn.exe 35 PID 2892 wrote to memory of 2752 2892 vdprfvn.exe 35 PID 2892 wrote to memory of 2752 2892 vdprfvn.exe 35 PID 2752 wrote to memory of 2920 2752 fnflh.exe 36 PID 2752 wrote to memory of 2920 2752 fnflh.exe 36 PID 2752 wrote to memory of 2920 2752 fnflh.exe 36 PID 2752 wrote to memory of 2920 2752 fnflh.exe 36 PID 2920 wrote to memory of 2676 2920 ndxjlx.exe 37 PID 2920 wrote to memory of 2676 2920 ndxjlx.exe 37 PID 2920 wrote to memory of 2676 2920 ndxjlx.exe 37 PID 2920 wrote to memory of 2676 2920 ndxjlx.exe 37 PID 2676 wrote to memory of 2696 2676 ddvrbx.exe 38 PID 2676 wrote to memory of 2696 2676 ddvrbx.exe 38 PID 2676 wrote to memory of 2696 2676 ddvrbx.exe 38 PID 2676 wrote to memory of 2696 2676 ddvrbx.exe 38 PID 2696 wrote to memory of 2376 2696 ltxbbj.exe 39 PID 2696 wrote to memory of 2376 2696 ltxbbj.exe 39 PID 2696 wrote to memory of 2376 2696 ltxbbj.exe 39 PID 2696 wrote to memory of 2376 2696 ltxbbj.exe 39 PID 2376 wrote to memory of 2688 2376 bdhxr.exe 40 PID 2376 wrote to memory of 2688 2376 bdhxr.exe 40 PID 2376 wrote to memory of 2688 2376 bdhxr.exe 40 PID 2376 wrote to memory of 2688 2376 bdhxr.exe 40 PID 2688 wrote to memory of 3016 2688 fbrxhlx.exe 41 PID 2688 wrote to memory of 3016 2688 fbrxhlx.exe 41 PID 2688 wrote to memory of 3016 2688 fbrxhlx.exe 41 PID 2688 wrote to memory of 3016 2688 fbrxhlx.exe 41 PID 3016 wrote to memory of 1740 3016 jjnxlv.exe 42 PID 3016 wrote to memory of 1740 3016 jjnxlv.exe 42 PID 3016 wrote to memory of 1740 3016 jjnxlv.exe 42 PID 3016 wrote to memory of 1740 3016 jjnxlv.exe 42 PID 1740 wrote to memory of 2968 1740 nrvnbnn.exe 43 PID 1740 wrote to memory of 2968 1740 nrvnbnn.exe 43 PID 1740 wrote to memory of 2968 1740 nrvnbnn.exe 43 PID 1740 wrote to memory of 2968 1740 nrvnbnn.exe 43 PID 2968 wrote to memory of 2820 2968 jjxpxfx.exe 44 PID 2968 wrote to memory of 2820 2968 jjxpxfx.exe 44 PID 2968 wrote to memory of 2820 2968 jjxpxfx.exe 44 PID 2968 wrote to memory of 2820 2968 jjxpxfx.exe 44 PID 2820 wrote to memory of 1288 2820 rtvpl.exe 45 PID 2820 wrote to memory of 1288 2820 rtvpl.exe 45 PID 2820 wrote to memory of 1288 2820 rtvpl.exe 45 PID 2820 wrote to memory of 1288 2820 rtvpl.exe 45 PID 1288 wrote to memory of 2476 1288 xlxrtx.exe 46 PID 1288 wrote to memory of 2476 1288 xlxrtx.exe 46 PID 1288 wrote to memory of 2476 1288 xlxrtx.exe 46 PID 1288 wrote to memory of 2476 1288 xlxrtx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe"C:\Users\Admin\AppData\Local\Temp\a20459008ab964b1b5a16dad282387d20e1c8cb503b18056e9a0610d15a7eeb1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\xrrpl.exec:\xrrpl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\fpnfxv.exec:\fpnfxv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\hjhnvb.exec:\hjhnvb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\vdprfvn.exec:\vdprfvn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\fnflh.exec:\fnflh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\ndxjlx.exec:\ndxjlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\ddvrbx.exec:\ddvrbx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\ltxbbj.exec:\ltxbbj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\bdhxr.exec:\bdhxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\fbrxhlx.exec:\fbrxhlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\jjnxlv.exec:\jjnxlv.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\nrvnbnn.exec:\nrvnbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\jjxpxfx.exec:\jjxpxfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\rtvpl.exec:\rtvpl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\xlxrtx.exec:\xlxrtx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\xvrhbjv.exec:\xvrhbjv.exe17⤵
- Executes dropped EXE
PID:2476 -
\??\c:\ntvdnlv.exec:\ntvdnlv.exe18⤵
- Executes dropped EXE
PID:1068 -
\??\c:\xdlnll.exec:\xdlnll.exe19⤵
- Executes dropped EXE
PID:2344 -
\??\c:\vfnbljh.exec:\vfnbljh.exe20⤵
- Executes dropped EXE
PID:2176 -
\??\c:\nxblhvd.exec:\nxblhvd.exe21⤵
- Executes dropped EXE
PID:1172 -
\??\c:\fvnjx.exec:\fvnjx.exe22⤵
- Executes dropped EXE
PID:2816 -
\??\c:\ndhrnb.exec:\ndhrnb.exe23⤵
- Executes dropped EXE
PID:1164 -
\??\c:\bvnddtd.exec:\bvnddtd.exe24⤵
- Executes dropped EXE
PID:1016 -
\??\c:\rfvhf.exec:\rfvhf.exe25⤵
- Executes dropped EXE
PID:2120 -
\??\c:\ljbrjxl.exec:\ljbrjxl.exe26⤵
- Executes dropped EXE
PID:648 -
\??\c:\vbhjvxt.exec:\vbhjvxt.exe27⤵
- Executes dropped EXE
PID:676 -
\??\c:\rflrv.exec:\rflrv.exe28⤵
- Executes dropped EXE
PID:2580 -
\??\c:\xvxrfbr.exec:\xvxrfbr.exe29⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nhxhff.exec:\nhxhff.exe30⤵
- Executes dropped EXE
PID:836 -
\??\c:\nttjf.exec:\nttjf.exe31⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vffrfv.exec:\vffrfv.exe32⤵
- Executes dropped EXE
PID:880 -
\??\c:\fddjlxn.exec:\fddjlxn.exe33⤵
- Executes dropped EXE
PID:2372 -
\??\c:\xvrdp.exec:\xvrdp.exe34⤵PID:1604
-
\??\c:\hxvjhr.exec:\hxvjhr.exe35⤵
- Executes dropped EXE
PID:1700 -
\??\c:\nlhbdj.exec:\nlhbdj.exe36⤵
- Executes dropped EXE
PID:1708 -
\??\c:\dthtx.exec:\dthtx.exe37⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jhntvl.exec:\jhntvl.exe38⤵
- Executes dropped EXE
PID:2880 -
\??\c:\pvxfjhr.exec:\pvxfjhr.exe39⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dddtrr.exec:\dddtrr.exe40⤵
- Executes dropped EXE
PID:2996 -
\??\c:\vfjrph.exec:\vfjrph.exe41⤵
- Executes dropped EXE
PID:2192 -
\??\c:\ftrltlr.exec:\ftrltlr.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2928 -
\??\c:\fdvtb.exec:\fdvtb.exe43⤵
- Executes dropped EXE
PID:3020 -
\??\c:\dpjlvpx.exec:\dpjlvpx.exe44⤵
- Executes dropped EXE
PID:2684 -
\??\c:\drxltb.exec:\drxltb.exe45⤵
- Executes dropped EXE
PID:2672 -
\??\c:\nlbdp.exec:\nlbdp.exe46⤵
- Executes dropped EXE
PID:1104 -
\??\c:\dnxhl.exec:\dnxhl.exe47⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xxjnhl.exec:\xxjnhl.exe48⤵
- Executes dropped EXE
PID:2976 -
\??\c:\rthrftn.exec:\rthrftn.exe49⤵
- Executes dropped EXE
PID:2608 -
\??\c:\hdxhj.exec:\hdxhj.exe50⤵
- Executes dropped EXE
PID:1980 -
\??\c:\pnnpplp.exec:\pnnpplp.exe51⤵
- Executes dropped EXE
PID:560 -
\??\c:\nhvrhvj.exec:\nhvrhvj.exe52⤵
- Executes dropped EXE
PID:1928 -
\??\c:\njpbn.exec:\njpbn.exe53⤵
- Executes dropped EXE
PID:2820 -
\??\c:\vpxfpbt.exec:\vpxfpbt.exe54⤵
- Executes dropped EXE
PID:2232 -
\??\c:\bjjfj.exec:\bjjfj.exe55⤵
- Executes dropped EXE
PID:2100 -
\??\c:\rhnnlx.exec:\rhnnlx.exe56⤵
- Executes dropped EXE
PID:2168 -
\??\c:\vjjpv.exec:\vjjpv.exe57⤵
- Executes dropped EXE
PID:2988 -
\??\c:\jrxvxfv.exec:\jrxvxfv.exe58⤵
- Executes dropped EXE
PID:2028 -
\??\c:\fjtdpbr.exec:\fjtdpbr.exe59⤵
- Executes dropped EXE
PID:1812 -
\??\c:\tpltrl.exec:\tpltrl.exe60⤵
- Executes dropped EXE
PID:1172 -
\??\c:\hprtvpv.exec:\hprtvpv.exe61⤵
- Executes dropped EXE
PID:2392 -
\??\c:\dfbbtf.exec:\dfbbtf.exe62⤵
- Executes dropped EXE
PID:1368 -
\??\c:\dndfn.exec:\dndfn.exe63⤵
- Executes dropped EXE
PID:1184 -
\??\c:\nptlpdr.exec:\nptlpdr.exe64⤵
- Executes dropped EXE
PID:2864 -
\??\c:\nvxbjv.exec:\nvxbjv.exe65⤵
- Executes dropped EXE
PID:824 -
\??\c:\hnljhlf.exec:\hnljhlf.exe66⤵
- Executes dropped EXE
PID:1688 -
\??\c:\fdfvfdv.exec:\fdfvfdv.exe67⤵PID:1540
-
\??\c:\xfnjn.exec:\xfnjn.exe68⤵PID:1412
-
\??\c:\jhfxxd.exec:\jhfxxd.exe69⤵PID:2580
-
\??\c:\hxfvvhb.exec:\hxfvvhb.exe70⤵PID:1528
-
\??\c:\fjvfvdf.exec:\fjvfvdf.exe71⤵PID:2180
-
\??\c:\xjbbpr.exec:\xjbbpr.exe72⤵PID:1476
-
\??\c:\fthxnxp.exec:\fthxnxp.exe73⤵PID:1672
-
\??\c:\tvrhvp.exec:\tvrhvp.exe74⤵PID:2524
-
\??\c:\jnhjnb.exec:\jnhjnb.exe75⤵PID:2340
-
\??\c:\hjjnn.exec:\hjjnn.exe76⤵PID:2532
-
\??\c:\vhlvlr.exec:\vhlvlr.exe77⤵PID:2812
-
\??\c:\fffjnjh.exec:\fffjnjh.exe78⤵PID:2492
-
\??\c:\bhbvvxv.exec:\bhbvvxv.exe79⤵PID:2888
-
\??\c:\vllrxl.exec:\vllrxl.exe80⤵PID:1192
-
\??\c:\djbjtj.exec:\djbjtj.exe81⤵PID:2628
-
\??\c:\lrpvpn.exec:\lrpvpn.exe82⤵PID:2644
-
\??\c:\jlnvp.exec:\jlnvp.exe83⤵PID:2732
-
\??\c:\hjnjfv.exec:\hjnjfv.exe84⤵PID:2668
-
\??\c:\rhhlr.exec:\rhhlr.exe85⤵PID:2148
-
\??\c:\xvljr.exec:\xvljr.exe86⤵PID:2080
-
\??\c:\lvxvj.exec:\lvxvj.exe87⤵PID:2680
-
\??\c:\dlvvtx.exec:\dlvvtx.exe88⤵PID:1104
-
\??\c:\fnhlr.exec:\fnhlr.exe89⤵PID:2844
-
\??\c:\djrjlbj.exec:\djrjlbj.exe90⤵PID:2804
-
\??\c:\lhnvnxj.exec:\lhnvnxj.exe91⤵PID:1740
-
\??\c:\hvdxff.exec:\hvdxff.exe92⤵PID:384
-
\??\c:\vbdhd.exec:\vbdhd.exe93⤵PID:1984
-
\??\c:\ffjbnv.exec:\ffjbnv.exe94⤵PID:2364
-
\??\c:\blfrfjb.exec:\blfrfjb.exe95⤵PID:1896
-
\??\c:\nfxnfn.exec:\nfxnfn.exe96⤵PID:2404
-
\??\c:\xjvpdlx.exec:\xjvpdlx.exe97⤵PID:2808
-
\??\c:\jphppb.exec:\jphppb.exe98⤵PID:2716
-
\??\c:\jlfbt.exec:\jlfbt.exe99⤵PID:2564
-
\??\c:\nvbthl.exec:\nvbthl.exe100⤵PID:1908
-
\??\c:\lxlnh.exec:\lxlnh.exe101⤵PID:1156
-
\??\c:\bdpnf.exec:\bdpnf.exe102⤵PID:1480
-
\??\c:\ptlrt.exec:\ptlrt.exe103⤵PID:688
-
\??\c:\vvddvl.exec:\vvddvl.exe104⤵PID:1804
-
\??\c:\ftdxpd.exec:\ftdxpd.exe105⤵PID:1368
-
\??\c:\hfddndf.exec:\hfddndf.exe106⤵PID:1016
-
\??\c:\rlfjbxx.exec:\rlfjbxx.exe107⤵PID:1060
-
\??\c:\tbdjtrb.exec:\tbdjtrb.exe108⤵PID:1724
-
\??\c:\nrpnfpx.exec:\nrpnfpx.exe109⤵PID:1788
-
\??\c:\fffhxf.exec:\fffhxf.exe110⤵PID:1512
-
\??\c:\hrrrjnr.exec:\hrrrjnr.exe111⤵PID:2488
-
\??\c:\fljjt.exec:\fljjt.exe112⤵
- System Location Discovery: System Language Discovery
PID:2428 -
\??\c:\vnntljf.exec:\vnntljf.exe113⤵PID:568
-
\??\c:\rdvxrx.exec:\rdvxrx.exe114⤵PID:2408
-
\??\c:\ndfxtb.exec:\ndfxtb.exe115⤵PID:3028
-
\??\c:\bfrddrj.exec:\bfrddrj.exe116⤵PID:1116
-
\??\c:\rbhnnxf.exec:\rbhnnxf.exe117⤵PID:2524
-
\??\c:\hftrjj.exec:\hftrjj.exe118⤵PID:1988
-
\??\c:\pxvlhr.exec:\pxvlhr.exe119⤵PID:2456
-
\??\c:\vvthpvb.exec:\vvthpvb.exe120⤵PID:2748
-
\??\c:\rxdnr.exec:\rxdnr.exe121⤵PID:868
-
\??\c:\thjxd.exec:\thjxd.exe122⤵PID:2772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-