Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 01:16
Behavioral task
behavioral1
Sample
2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe
-
Size
334KB
-
MD5
110175f070cd0ff0983d94b3aaa4f9f7
-
SHA1
bdea063c8efdcc25587746af3d1545634bdba50b
-
SHA256
2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda
-
SHA512
6692e9a86dcdde691e4d1a38e9878009649980cfc8db74c7ed50b178d976b06375f861229fcf8aa5bc0ccff7aedaf676a99ed03d725e7b625d182e7bfa516a08
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeR4:R4wFHoSHYHUrAwfMp3CDR4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2936-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2216-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-31-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1476-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/308-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2256-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/588-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-107-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/940-114-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/940-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1980-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/840-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-225-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/596-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2412-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2256-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1144-378-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/3036-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1480-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-628-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2220-690-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-713-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2276-724-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1076-747-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2216 pdpjbvn.exe 2956 jjjdjtf.exe 2904 xnppb.exe 3008 bltfbx.exe 1476 rppbjf.exe 308 txnthhf.exe 2972 jrxxx.exe 2780 dlbhh.exe 2256 xdpnrr.exe 2024 ddhbdr.exe 588 hrnnvf.exe 2360 dnjnjrr.exe 940 bjpvjnh.exe 1980 tvhvrvv.exe 2736 xvrhbp.exe 2420 vhbfpnl.exe 840 ljltnr.exe 1776 rprrrx.exe 2456 pvrfvb.exe 2228 njxnxb.exe 2300 ljtjf.exe 2212 bplffnp.exe 2312 nrhxn.exe 2636 tbxxvt.exe 704 dfrpvd.exe 2644 lrpnl.exe 2388 rrjjdd.exe 860 jvvdll.exe 112 tbbbnnr.exe 596 dxhffn.exe 2412 bdpfdt.exe 1644 lvjrndr.exe 1168 jnpnb.exe 2832 drfjhxd.exe 2004 rfxrj.exe 2448 fxjxlv.exe 2664 rdbvrpl.exe 2580 fdxnnht.exe 2976 xjtjjj.exe 2872 lfrbvrr.exe 3016 ffttnnl.exe 1824 hvlrpj.exe 2920 lbbxf.exe 2996 rjblffn.exe 2588 rxnjnv.exe 2912 vjxvldh.exe 2812 frpbbb.exe 2800 npfxlxn.exe 944 rrxxd.exe 2256 ttxfptr.exe 1144 lpdhrv.exe 3044 vdbtp.exe 3036 vhpnj.exe 2360 pnfpl.exe 2108 tjxrrr.exe 2120 xnxtfr.exe 2844 vhllxb.exe 1640 nbxnljn.exe 2932 jdprp.exe 1976 njbvrnj.exe 2292 jlxvr.exe 2308 pxxjrf.exe 2576 dtjhvrx.exe 2564 vtbdb.exe -
resource yara_rule behavioral1/memory/2936-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000120fc-7.dat upx behavioral1/memory/2216-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2936-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000019394-15.dat upx behavioral1/memory/2216-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2956-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000193b8-24.dat upx behavioral1/files/0x0007000000019470-33.dat upx behavioral1/files/0x0006000000019489-39.dat upx behavioral1/files/0x000600000001948c-46.dat upx behavioral1/memory/1476-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019490-55.dat upx behavioral1/memory/308-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0031000000018bbf-66.dat upx behavioral1/memory/2972-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3008-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000194eb-74.dat upx behavioral1/memory/2780-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000195bb-83.dat upx behavioral1/memory/2256-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a309-90.dat upx behavioral1/memory/588-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a3ab-100.dat upx behavioral1/memory/588-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2360-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a3f6-108.dat upx behavioral1/files/0x000500000001a3f8-118.dat upx behavioral1/memory/940-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1980-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2736-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a3fd-125.dat upx behavioral1/files/0x000500000001a400-135.dat upx behavioral1/memory/2736-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2420-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a404-143.dat upx behavioral1/files/0x000500000001a438-151.dat upx behavioral1/memory/840-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a44d-158.dat upx behavioral1/files/0x000500000001a44f-166.dat upx behavioral1/memory/2456-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a457-173.dat upx behavioral1/files/0x000500000001a459-181.dat upx behavioral1/memory/2300-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a463-190.dat upx behavioral1/memory/2212-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a469-201.dat upx behavioral1/memory/2312-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a46b-208.dat upx behavioral1/files/0x000500000001a46d-218.dat upx behavioral1/files/0x000500000001a46f-226.dat upx behavioral1/memory/2388-227-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a471-235.dat upx behavioral1/files/0x000500000001a473-242.dat upx behavioral1/files/0x000500000001a475-251.dat upx behavioral1/memory/596-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a477-258.dat upx behavioral1/memory/596-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a479-267.dat upx behavioral1/memory/2412-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2832-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2004-290-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2448-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2996-335-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rftppt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxtdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lndjffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnbnxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxxnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbrfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njnxddb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fndhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjfjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxbxvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvxpllh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhxrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftxfht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxdfbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thlnvxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pblfbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfbxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljvhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpdnjhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjfpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhfvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjnbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlpvdxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnpnxxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhddlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfvvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drndnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhjnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djnbrbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxpnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxrxrbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jntjntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftlrrt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2216 2936 2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe 29 PID 2936 wrote to memory of 2216 2936 2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe 29 PID 2936 wrote to memory of 2216 2936 2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe 29 PID 2936 wrote to memory of 2216 2936 2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe 29 PID 2216 wrote to memory of 2956 2216 pdpjbvn.exe 30 PID 2216 wrote to memory of 2956 2216 pdpjbvn.exe 30 PID 2216 wrote to memory of 2956 2216 pdpjbvn.exe 30 PID 2216 wrote to memory of 2956 2216 pdpjbvn.exe 30 PID 2956 wrote to memory of 2904 2956 jjjdjtf.exe 31 PID 2956 wrote to memory of 2904 2956 jjjdjtf.exe 31 PID 2956 wrote to memory of 2904 2956 jjjdjtf.exe 31 PID 2956 wrote to memory of 2904 2956 jjjdjtf.exe 31 PID 2904 wrote to memory of 3008 2904 xnppb.exe 32 PID 2904 wrote to memory of 3008 2904 xnppb.exe 32 PID 2904 wrote to memory of 3008 2904 xnppb.exe 32 PID 2904 wrote to memory of 3008 2904 xnppb.exe 32 PID 3008 wrote to memory of 1476 3008 bltfbx.exe 33 PID 3008 wrote to memory of 1476 3008 bltfbx.exe 33 PID 3008 wrote to memory of 1476 3008 bltfbx.exe 33 PID 3008 wrote to memory of 1476 3008 bltfbx.exe 33 PID 1476 wrote to memory of 308 1476 rppbjf.exe 34 PID 1476 wrote to memory of 308 1476 rppbjf.exe 34 PID 1476 wrote to memory of 308 1476 rppbjf.exe 34 PID 1476 wrote to memory of 308 1476 rppbjf.exe 34 PID 308 wrote to memory of 2972 308 txnthhf.exe 35 PID 308 wrote to memory of 2972 308 txnthhf.exe 35 PID 308 wrote to memory of 2972 308 txnthhf.exe 35 PID 308 wrote to memory of 2972 308 txnthhf.exe 35 PID 2972 wrote to memory of 2780 2972 jrxxx.exe 36 PID 2972 wrote to memory of 2780 2972 jrxxx.exe 36 PID 2972 wrote to memory of 2780 2972 jrxxx.exe 36 PID 2972 wrote to memory of 2780 2972 jrxxx.exe 36 PID 2780 wrote to memory of 2256 2780 dlbhh.exe 37 PID 2780 wrote to memory of 2256 2780 dlbhh.exe 37 PID 2780 wrote to memory of 2256 2780 dlbhh.exe 37 PID 2780 wrote to memory of 2256 2780 dlbhh.exe 37 PID 2256 wrote to memory of 2024 2256 xdpnrr.exe 38 PID 2256 wrote to memory of 2024 2256 xdpnrr.exe 38 PID 2256 wrote to memory of 2024 2256 xdpnrr.exe 38 PID 2256 wrote to memory of 2024 2256 xdpnrr.exe 38 PID 2024 wrote to memory of 588 2024 ddhbdr.exe 39 PID 2024 wrote to memory of 588 2024 ddhbdr.exe 39 PID 2024 wrote to memory of 588 2024 ddhbdr.exe 39 PID 2024 wrote to memory of 588 2024 ddhbdr.exe 39 PID 588 wrote to memory of 2360 588 hrnnvf.exe 40 PID 588 wrote to memory of 2360 588 hrnnvf.exe 40 PID 588 wrote to memory of 2360 588 hrnnvf.exe 40 PID 588 wrote to memory of 2360 588 hrnnvf.exe 40 PID 2360 wrote to memory of 940 2360 dnjnjrr.exe 41 PID 2360 wrote to memory of 940 2360 dnjnjrr.exe 41 PID 2360 wrote to memory of 940 2360 dnjnjrr.exe 41 PID 2360 wrote to memory of 940 2360 dnjnjrr.exe 41 PID 940 wrote to memory of 1980 940 bjpvjnh.exe 42 PID 940 wrote to memory of 1980 940 bjpvjnh.exe 42 PID 940 wrote to memory of 1980 940 bjpvjnh.exe 42 PID 940 wrote to memory of 1980 940 bjpvjnh.exe 42 PID 1980 wrote to memory of 2736 1980 tvhvrvv.exe 43 PID 1980 wrote to memory of 2736 1980 tvhvrvv.exe 43 PID 1980 wrote to memory of 2736 1980 tvhvrvv.exe 43 PID 1980 wrote to memory of 2736 1980 tvhvrvv.exe 43 PID 2736 wrote to memory of 2420 2736 xvrhbp.exe 44 PID 2736 wrote to memory of 2420 2736 xvrhbp.exe 44 PID 2736 wrote to memory of 2420 2736 xvrhbp.exe 44 PID 2736 wrote to memory of 2420 2736 xvrhbp.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe"C:\Users\Admin\AppData\Local\Temp\2c869ba75101c8c383d68c4bab685c07a5a5436a6152c13c51936d2e7f3ddfda.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\pdpjbvn.exec:\pdpjbvn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\jjjdjtf.exec:\jjjdjtf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\xnppb.exec:\xnppb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\bltfbx.exec:\bltfbx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\rppbjf.exec:\rppbjf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\txnthhf.exec:\txnthhf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\jrxxx.exec:\jrxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\dlbhh.exec:\dlbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\xdpnrr.exec:\xdpnrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\ddhbdr.exec:\ddhbdr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\hrnnvf.exec:\hrnnvf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\dnjnjrr.exec:\dnjnjrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\bjpvjnh.exec:\bjpvjnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\tvhvrvv.exec:\tvhvrvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\xvrhbp.exec:\xvrhbp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\vhbfpnl.exec:\vhbfpnl.exe17⤵
- Executes dropped EXE
PID:2420 -
\??\c:\ljltnr.exec:\ljltnr.exe18⤵
- Executes dropped EXE
PID:840 -
\??\c:\rprrrx.exec:\rprrrx.exe19⤵
- Executes dropped EXE
PID:1776 -
\??\c:\pvrfvb.exec:\pvrfvb.exe20⤵
- Executes dropped EXE
PID:2456 -
\??\c:\njxnxb.exec:\njxnxb.exe21⤵
- Executes dropped EXE
PID:2228 -
\??\c:\ljtjf.exec:\ljtjf.exe22⤵
- Executes dropped EXE
PID:2300 -
\??\c:\bplffnp.exec:\bplffnp.exe23⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nrhxn.exec:\nrhxn.exe24⤵
- Executes dropped EXE
PID:2312 -
\??\c:\tbxxvt.exec:\tbxxvt.exe25⤵
- Executes dropped EXE
PID:2636 -
\??\c:\dfrpvd.exec:\dfrpvd.exe26⤵
- Executes dropped EXE
PID:704 -
\??\c:\lrpnl.exec:\lrpnl.exe27⤵
- Executes dropped EXE
PID:2644 -
\??\c:\rrjjdd.exec:\rrjjdd.exe28⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jvvdll.exec:\jvvdll.exe29⤵
- Executes dropped EXE
PID:860 -
\??\c:\tbbbnnr.exec:\tbbbnnr.exe30⤵
- Executes dropped EXE
PID:112 -
\??\c:\dxhffn.exec:\dxhffn.exe31⤵
- Executes dropped EXE
PID:596 -
\??\c:\bdpfdt.exec:\bdpfdt.exe32⤵
- Executes dropped EXE
PID:2412 -
\??\c:\lvjrndr.exec:\lvjrndr.exe33⤵
- Executes dropped EXE
PID:1644 -
\??\c:\jnpnb.exec:\jnpnb.exe34⤵
- Executes dropped EXE
PID:1168 -
\??\c:\drfjhxd.exec:\drfjhxd.exe35⤵
- Executes dropped EXE
PID:2832 -
\??\c:\rfxrj.exec:\rfxrj.exe36⤵
- Executes dropped EXE
PID:2004 -
\??\c:\fxjxlv.exec:\fxjxlv.exe37⤵
- Executes dropped EXE
PID:2448 -
\??\c:\rdbvrpl.exec:\rdbvrpl.exe38⤵
- Executes dropped EXE
PID:2664 -
\??\c:\fdxnnht.exec:\fdxnnht.exe39⤵
- Executes dropped EXE
PID:2580 -
\??\c:\xjtjjj.exec:\xjtjjj.exe40⤵
- Executes dropped EXE
PID:2976 -
\??\c:\lfrbvrr.exec:\lfrbvrr.exe41⤵
- Executes dropped EXE
PID:2872 -
\??\c:\ffttnnl.exec:\ffttnnl.exe42⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hvlrpj.exec:\hvlrpj.exe43⤵
- Executes dropped EXE
PID:1824 -
\??\c:\lbbxf.exec:\lbbxf.exe44⤵
- Executes dropped EXE
PID:2920 -
\??\c:\rjblffn.exec:\rjblffn.exe45⤵
- Executes dropped EXE
PID:2996 -
\??\c:\rxnjnv.exec:\rxnjnv.exe46⤵
- Executes dropped EXE
PID:2588 -
\??\c:\vjxvldh.exec:\vjxvldh.exe47⤵
- Executes dropped EXE
PID:2912 -
\??\c:\frpbbb.exec:\frpbbb.exe48⤵
- Executes dropped EXE
PID:2812 -
\??\c:\npfxlxn.exec:\npfxlxn.exe49⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rrxxd.exec:\rrxxd.exe50⤵
- Executes dropped EXE
PID:944 -
\??\c:\ttxfptr.exec:\ttxfptr.exe51⤵
- Executes dropped EXE
PID:2256 -
\??\c:\lpdhrv.exec:\lpdhrv.exe52⤵
- Executes dropped EXE
PID:1144 -
\??\c:\vdbtp.exec:\vdbtp.exe53⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vhpnj.exec:\vhpnj.exe54⤵
- Executes dropped EXE
PID:3036 -
\??\c:\pnfpl.exec:\pnfpl.exe55⤵
- Executes dropped EXE
PID:2360 -
\??\c:\tjxrrr.exec:\tjxrrr.exe56⤵
- Executes dropped EXE
PID:2108 -
\??\c:\xnxtfr.exec:\xnxtfr.exe57⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vhllxb.exec:\vhllxb.exe58⤵
- Executes dropped EXE
PID:2844 -
\??\c:\nbxnljn.exec:\nbxnljn.exe59⤵
- Executes dropped EXE
PID:1640 -
\??\c:\jdprp.exec:\jdprp.exe60⤵
- Executes dropped EXE
PID:2932 -
\??\c:\njbvrnj.exec:\njbvrnj.exe61⤵
- Executes dropped EXE
PID:1976 -
\??\c:\jlxvr.exec:\jlxvr.exe62⤵
- Executes dropped EXE
PID:2292 -
\??\c:\pxxjrf.exec:\pxxjrf.exe63⤵
- Executes dropped EXE
PID:2308 -
\??\c:\dtjhvrx.exec:\dtjhvrx.exe64⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vtbdb.exec:\vtbdb.exe65⤵
- Executes dropped EXE
PID:2564 -
\??\c:\xbvnf.exec:\xbvnf.exe66⤵PID:2520
-
\??\c:\lxrfpfx.exec:\lxrfpfx.exe67⤵PID:1540
-
\??\c:\lnthxf.exec:\lnthxf.exe68⤵PID:1592
-
\??\c:\xjdrjhh.exec:\xjdrjhh.exe69⤵PID:760
-
\??\c:\rhftj.exec:\rhftj.exe70⤵PID:1828
-
\??\c:\hrddj.exec:\hrddj.exe71⤵PID:948
-
\??\c:\bjrbnr.exec:\bjrbnr.exe72⤵PID:704
-
\??\c:\jrrvx.exec:\jrrvx.exe73⤵PID:1680
-
\??\c:\drxhd.exec:\drxhd.exe74⤵PID:2712
-
\??\c:\bvpnh.exec:\bvpnh.exe75⤵PID:1216
-
\??\c:\hxrhhff.exec:\hxrhhff.exe76⤵PID:1132
-
\??\c:\tldpnjt.exec:\tldpnjt.exe77⤵PID:1924
-
\??\c:\rvxjxjf.exec:\rvxjxjf.exe78⤵PID:2660
-
\??\c:\lpbrd.exec:\lpbrd.exe79⤵PID:1240
-
\??\c:\rtvnpfx.exec:\rtvnpfx.exe80⤵PID:752
-
\??\c:\vrlrrrx.exec:\vrlrrrx.exe81⤵PID:892
-
\??\c:\vhhhbf.exec:\vhhhbf.exe82⤵PID:1200
-
\??\c:\dhphrh.exec:\dhphrh.exe83⤵PID:932
-
\??\c:\vpvpv.exec:\vpvpv.exe84⤵PID:2596
-
\??\c:\fhnhdv.exec:\fhnhdv.exe85⤵PID:1480
-
\??\c:\fhjfj.exec:\fhjfj.exe86⤵PID:1604
-
\??\c:\btfbdn.exec:\btfbdn.exe87⤵PID:2968
-
\??\c:\vnbnxt.exec:\vnbnxt.exe88⤵
- System Location Discovery: System Language Discovery
PID:2952 -
\??\c:\tvptr.exec:\tvptr.exe89⤵PID:2204
-
\??\c:\lnjtb.exec:\lnjtb.exe90⤵PID:2888
-
\??\c:\pnvddt.exec:\pnvddt.exe91⤵PID:3040
-
\??\c:\rrpfv.exec:\rrpfv.exe92⤵PID:2924
-
\??\c:\fhnff.exec:\fhnff.exe93⤵PID:2672
-
\??\c:\dnrxvf.exec:\dnrxvf.exe94⤵PID:2996
-
\??\c:\drfnj.exec:\drfnj.exe95⤵PID:1376
-
\??\c:\hnjnvrr.exec:\hnjnvrr.exe96⤵PID:2620
-
\??\c:\jrfpb.exec:\jrfpb.exe97⤵PID:2560
-
\??\c:\bllfdbp.exec:\bllfdbp.exe98⤵PID:2728
-
\??\c:\tjjpp.exec:\tjjpp.exe99⤵PID:1172
-
\??\c:\nlfljlh.exec:\nlfljlh.exe100⤵PID:2024
-
\??\c:\nrrfxtd.exec:\nrrfxtd.exe101⤵PID:432
-
\??\c:\jhbprr.exec:\jhbprr.exe102⤵PID:588
-
\??\c:\bjxfr.exec:\bjxfr.exe103⤵PID:3036
-
\??\c:\plxdhv.exec:\plxdhv.exe104⤵PID:2368
-
\??\c:\bjbvh.exec:\bjbvh.exe105⤵PID:1444
-
\??\c:\nffpvrt.exec:\nffpvrt.exe106⤵PID:3060
-
\??\c:\prhjtn.exec:\prhjtn.exe107⤵PID:2504
-
\??\c:\xjntj.exec:\xjntj.exe108⤵PID:2296
-
\??\c:\pjdxjvb.exec:\pjdxjvb.exe109⤵PID:2220
-
\??\c:\rnjjj.exec:\rnjjj.exe110⤵PID:840
-
\??\c:\rntplt.exec:\rntplt.exe111⤵PID:2260
-
\??\c:\jphbnd.exec:\jphbnd.exe112⤵PID:2308
-
\??\c:\ttbbhfn.exec:\ttbbhfn.exe113⤵PID:2524
-
\??\c:\rnhrjfp.exec:\rnhrjfp.exe114⤵PID:2276
-
\??\c:\nnjxlr.exec:\nnjxlr.exe115⤵PID:1076
-
\??\c:\hvbrd.exec:\hvbrd.exe116⤵PID:1844
-
\??\c:\dndpbd.exec:\dndpbd.exe117⤵PID:980
-
\??\c:\rrrpxv.exec:\rrrpxv.exe118⤵PID:2532
-
\??\c:\llpddh.exec:\llpddh.exe119⤵PID:1848
-
\??\c:\brlhj.exec:\brlhj.exe120⤵PID:1724
-
\??\c:\frfvh.exec:\frfvh.exe121⤵PID:2056
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-