Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 01:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a6fe6c5900e969f0ef5df3fd62e3708675abef8d6496900943bbf3bb8b0b6e2c.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a6fe6c5900e969f0ef5df3fd62e3708675abef8d6496900943bbf3bb8b0b6e2c.exe
-
Size
453KB
-
MD5
82b621c3b330f9263a847ed8bcf6e2ef
-
SHA1
e406e62e1e15012c52d2dfc6027e9e0498adeaa2
-
SHA256
a6fe6c5900e969f0ef5df3fd62e3708675abef8d6496900943bbf3bb8b0b6e2c
-
SHA512
a25c39abec151e031fce45c4d10724da9adfd48a3c8bd04b0644886ee8ef62106a290657c4a0683225c3a1606461552d2e728308bcd50f41bdb256dd56368adc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeh:q7Tc2NYHUrAwfMp3CDh
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/1740-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-25-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2084-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/820-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1220-562-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2600-583-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1144-673-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-724-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-409-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1516-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-127-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2660-119-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2692-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/820-823-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1916-851-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2944-974-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2828-979-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1504-994-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2588-1040-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/960-1047-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1752-1066-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/516-1158-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2324 txfjltv.exe 2084 rlhxn.exe 2092 hjhdbdx.exe 3040 rdvrhxj.exe 2828 jppddd.exe 2836 ltvvtfr.exe 3052 xdfdt.exe 3000 rlbjj.exe 2848 hrvpjt.exe 2692 xxvbh.exe 2316 xhtrb.exe 2660 jlrlbnn.exe 3016 xjxfbh.exe 1964 hntrtjv.exe 1656 flfrdvv.exe 1080 ttdvrbh.exe 1660 hrdbnd.exe 1976 dffvl.exe 2940 xvvvjvv.exe 2252 xvdpjhp.exe 2348 hrrdr.exe 1652 pvnhrj.exe 2440 jthlh.exe 1352 rfbftbn.exe 1516 tlfvpb.exe 1828 jtftn.exe 2088 vxfvt.exe 908 dfbxfn.exe 2640 fxpvdv.exe 2072 lbxdjvx.exe 820 dfppnpd.exe 2520 jxlrb.exe 1724 xbbbdd.exe 2492 ppdxltd.exe 1688 lrnxrrn.exe 1596 vhftjtr.exe 1760 jdvvdpt.exe 2632 xbfpl.exe 2196 hjhhx.exe 2884 ntvhb.exe 2788 xvfthbj.exe 3068 nrthvf.exe 2840 hfrlhbp.exe 2932 tdxlrph.exe 3000 rvhpfv.exe 2928 bpljtfb.exe 2672 flvhjjh.exe 1960 pjnvfl.exe 2736 vhrtjv.exe 2980 jnlth.exe 2944 tprbt.exe 1208 jjrdjnx.exe 2664 vjpbvd.exe 1484 vrrjl.exe 1764 jrfxnpv.exe 1924 fdlfn.exe 1312 nlhnvj.exe 2940 bjtdfbh.exe 2484 rrxjptv.exe 2348 xnpvhnr.exe 1380 tvthfvl.exe 1160 rfrldvb.exe 1352 nvtdxfh.exe 2652 lrdldd.exe -
resource yara_rule behavioral1/memory/1740-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-25-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/2092-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1220-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-724-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-873-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-886-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-925-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpbvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrlrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dblvbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrpnnlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhbpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbvjnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txfjltv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxhxpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phnfdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drjvlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhnxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtdpbdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jljdtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvplhjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btvht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plnld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjxph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbxnnjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfrlhbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvxxpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxjptv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrpbvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfpvhtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndftj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjnfjll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pttbxvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvlvllv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tltjj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2324 1740 a6fe6c5900e969f0ef5df3fd62e3708675abef8d6496900943bbf3bb8b0b6e2c.exe 30 PID 1740 wrote to memory of 2324 1740 a6fe6c5900e969f0ef5df3fd62e3708675abef8d6496900943bbf3bb8b0b6e2c.exe 30 PID 1740 wrote to memory of 2324 1740 a6fe6c5900e969f0ef5df3fd62e3708675abef8d6496900943bbf3bb8b0b6e2c.exe 30 PID 1740 wrote to memory of 2324 1740 a6fe6c5900e969f0ef5df3fd62e3708675abef8d6496900943bbf3bb8b0b6e2c.exe 30 PID 2324 wrote to memory of 2084 2324 txfjltv.exe 31 PID 2324 wrote to memory of 2084 2324 txfjltv.exe 31 PID 2324 wrote to memory of 2084 2324 txfjltv.exe 31 PID 2324 wrote to memory of 2084 2324 txfjltv.exe 31 PID 2084 wrote to memory of 2092 2084 rlhxn.exe 32 PID 2084 wrote to memory of 2092 2084 rlhxn.exe 32 PID 2084 wrote to memory of 2092 2084 rlhxn.exe 32 PID 2084 wrote to memory of 2092 2084 rlhxn.exe 32 PID 2092 wrote to memory of 3040 2092 hjhdbdx.exe 33 PID 2092 wrote to memory of 3040 2092 hjhdbdx.exe 33 PID 2092 wrote to memory of 3040 2092 hjhdbdx.exe 33 PID 2092 wrote to memory of 3040 2092 hjhdbdx.exe 33 PID 3040 wrote to memory of 2828 3040 rdvrhxj.exe 34 PID 3040 wrote to memory of 2828 3040 rdvrhxj.exe 34 PID 3040 wrote to memory of 2828 3040 rdvrhxj.exe 34 PID 3040 wrote to memory of 2828 3040 rdvrhxj.exe 34 PID 2828 wrote to memory of 2836 2828 jppddd.exe 35 PID 2828 wrote to memory of 2836 2828 jppddd.exe 35 PID 2828 wrote to memory of 2836 2828 jppddd.exe 35 PID 2828 wrote to memory of 2836 2828 jppddd.exe 35 PID 2836 wrote to memory of 3052 2836 ltvvtfr.exe 36 PID 2836 wrote to memory of 3052 2836 ltvvtfr.exe 36 PID 2836 wrote to memory of 3052 2836 ltvvtfr.exe 36 PID 2836 wrote to memory of 3052 2836 ltvvtfr.exe 36 PID 3052 wrote to memory of 3000 3052 xdfdt.exe 75 PID 3052 wrote to memory of 3000 3052 xdfdt.exe 75 PID 3052 wrote to memory of 3000 3052 xdfdt.exe 75 PID 3052 wrote to memory of 3000 3052 xdfdt.exe 75 PID 3000 wrote to memory of 2848 3000 rlbjj.exe 38 PID 3000 wrote to memory of 2848 3000 rlbjj.exe 38 PID 3000 wrote to memory of 2848 3000 rlbjj.exe 38 PID 3000 wrote to memory of 2848 3000 rlbjj.exe 38 PID 2848 wrote to memory of 2692 2848 hrvpjt.exe 39 PID 2848 wrote to memory of 2692 2848 hrvpjt.exe 39 PID 2848 wrote to memory of 2692 2848 hrvpjt.exe 39 PID 2848 wrote to memory of 2692 2848 hrvpjt.exe 39 PID 2692 wrote to memory of 2316 2692 xxvbh.exe 40 PID 2692 wrote to memory of 2316 2692 xxvbh.exe 40 PID 2692 wrote to memory of 2316 2692 xxvbh.exe 40 PID 2692 wrote to memory of 2316 2692 xxvbh.exe 40 PID 2316 wrote to memory of 2660 2316 xhtrb.exe 41 PID 2316 wrote to memory of 2660 2316 xhtrb.exe 41 PID 2316 wrote to memory of 2660 2316 xhtrb.exe 41 PID 2316 wrote to memory of 2660 2316 xhtrb.exe 41 PID 2660 wrote to memory of 3016 2660 jlrlbnn.exe 42 PID 2660 wrote to memory of 3016 2660 jlrlbnn.exe 42 PID 2660 wrote to memory of 3016 2660 jlrlbnn.exe 42 PID 2660 wrote to memory of 3016 2660 jlrlbnn.exe 42 PID 3016 wrote to memory of 1964 3016 xjxfbh.exe 43 PID 3016 wrote to memory of 1964 3016 xjxfbh.exe 43 PID 3016 wrote to memory of 1964 3016 xjxfbh.exe 43 PID 3016 wrote to memory of 1964 3016 xjxfbh.exe 43 PID 1964 wrote to memory of 1656 1964 hntrtjv.exe 44 PID 1964 wrote to memory of 1656 1964 hntrtjv.exe 44 PID 1964 wrote to memory of 1656 1964 hntrtjv.exe 44 PID 1964 wrote to memory of 1656 1964 hntrtjv.exe 44 PID 1656 wrote to memory of 1080 1656 flfrdvv.exe 45 PID 1656 wrote to memory of 1080 1656 flfrdvv.exe 45 PID 1656 wrote to memory of 1080 1656 flfrdvv.exe 45 PID 1656 wrote to memory of 1080 1656 flfrdvv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6fe6c5900e969f0ef5df3fd62e3708675abef8d6496900943bbf3bb8b0b6e2c.exe"C:\Users\Admin\AppData\Local\Temp\a6fe6c5900e969f0ef5df3fd62e3708675abef8d6496900943bbf3bb8b0b6e2c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\txfjltv.exec:\txfjltv.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\rlhxn.exec:\rlhxn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\hjhdbdx.exec:\hjhdbdx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\rdvrhxj.exec:\rdvrhxj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\jppddd.exec:\jppddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\ltvvtfr.exec:\ltvvtfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\xdfdt.exec:\xdfdt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\rlbjj.exec:\rlbjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\hrvpjt.exec:\hrvpjt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\xxvbh.exec:\xxvbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\xhtrb.exec:\xhtrb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\jlrlbnn.exec:\jlrlbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\xjxfbh.exec:\xjxfbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\hntrtjv.exec:\hntrtjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\flfrdvv.exec:\flfrdvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\ttdvrbh.exec:\ttdvrbh.exe17⤵
- Executes dropped EXE
PID:1080 -
\??\c:\hrdbnd.exec:\hrdbnd.exe18⤵
- Executes dropped EXE
PID:1660 -
\??\c:\dffvl.exec:\dffvl.exe19⤵
- Executes dropped EXE
PID:1976 -
\??\c:\xvvvjvv.exec:\xvvvjvv.exe20⤵
- Executes dropped EXE
PID:2940 -
\??\c:\xvdpjhp.exec:\xvdpjhp.exe21⤵
- Executes dropped EXE
PID:2252 -
\??\c:\hrrdr.exec:\hrrdr.exe22⤵
- Executes dropped EXE
PID:2348 -
\??\c:\pvnhrj.exec:\pvnhrj.exe23⤵
- Executes dropped EXE
PID:1652 -
\??\c:\jthlh.exec:\jthlh.exe24⤵
- Executes dropped EXE
PID:2440 -
\??\c:\rfbftbn.exec:\rfbftbn.exe25⤵
- Executes dropped EXE
PID:1352 -
\??\c:\tlfvpb.exec:\tlfvpb.exe26⤵
- Executes dropped EXE
PID:1516 -
\??\c:\jtftn.exec:\jtftn.exe27⤵
- Executes dropped EXE
PID:1828 -
\??\c:\vxfvt.exec:\vxfvt.exe28⤵
- Executes dropped EXE
PID:2088 -
\??\c:\dfbxfn.exec:\dfbxfn.exe29⤵
- Executes dropped EXE
PID:908 -
\??\c:\fxpvdv.exec:\fxpvdv.exe30⤵
- Executes dropped EXE
PID:2640 -
\??\c:\lbxdjvx.exec:\lbxdjvx.exe31⤵
- Executes dropped EXE
PID:2072 -
\??\c:\dfppnpd.exec:\dfppnpd.exe32⤵
- Executes dropped EXE
PID:820 -
\??\c:\jxlrb.exec:\jxlrb.exe33⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xbbbdd.exec:\xbbbdd.exe34⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ppdxltd.exec:\ppdxltd.exe35⤵
- Executes dropped EXE
PID:2492 -
\??\c:\lrnxrrn.exec:\lrnxrrn.exe36⤵
- Executes dropped EXE
PID:1688 -
\??\c:\vhftjtr.exec:\vhftjtr.exe37⤵
- Executes dropped EXE
PID:1596 -
\??\c:\jdvvdpt.exec:\jdvvdpt.exe38⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xbfpl.exec:\xbfpl.exe39⤵
- Executes dropped EXE
PID:2632 -
\??\c:\hjhhx.exec:\hjhhx.exe40⤵
- Executes dropped EXE
PID:2196 -
\??\c:\ntvhb.exec:\ntvhb.exe41⤵
- Executes dropped EXE
PID:2884 -
\??\c:\xvfthbj.exec:\xvfthbj.exe42⤵
- Executes dropped EXE
PID:2788 -
\??\c:\nrthvf.exec:\nrthvf.exe43⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hfrlhbp.exec:\hfrlhbp.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2840 -
\??\c:\tdxlrph.exec:\tdxlrph.exe45⤵
- Executes dropped EXE
PID:2932 -
\??\c:\rvhpfv.exec:\rvhpfv.exe46⤵
- Executes dropped EXE
PID:3000 -
\??\c:\bpljtfb.exec:\bpljtfb.exe47⤵
- Executes dropped EXE
PID:2928 -
\??\c:\flvhjjh.exec:\flvhjjh.exe48⤵
- Executes dropped EXE
PID:2672 -
\??\c:\pjnvfl.exec:\pjnvfl.exe49⤵
- Executes dropped EXE
PID:1960 -
\??\c:\vhrtjv.exec:\vhrtjv.exe50⤵
- Executes dropped EXE
PID:2736 -
\??\c:\jnlth.exec:\jnlth.exe51⤵
- Executes dropped EXE
PID:2980 -
\??\c:\tprbt.exec:\tprbt.exe52⤵
- Executes dropped EXE
PID:2944 -
\??\c:\jjrdjnx.exec:\jjrdjnx.exe53⤵
- Executes dropped EXE
PID:1208 -
\??\c:\vjpbvd.exec:\vjpbvd.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2664 -
\??\c:\vrrjl.exec:\vrrjl.exe55⤵
- Executes dropped EXE
PID:1484 -
\??\c:\jrfxnpv.exec:\jrfxnpv.exe56⤵
- Executes dropped EXE
PID:1764 -
\??\c:\fdlfn.exec:\fdlfn.exe57⤵
- Executes dropped EXE
PID:1924 -
\??\c:\nlhnvj.exec:\nlhnvj.exe58⤵
- Executes dropped EXE
PID:1312 -
\??\c:\bjtdfbh.exec:\bjtdfbh.exe59⤵
- Executes dropped EXE
PID:2940 -
\??\c:\rrxjptv.exec:\rrxjptv.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2484 -
\??\c:\xnpvhnr.exec:\xnpvhnr.exe61⤵
- Executes dropped EXE
PID:2348 -
\??\c:\tvthfvl.exec:\tvthfvl.exe62⤵
- Executes dropped EXE
PID:1380 -
\??\c:\rfrldvb.exec:\rfrldvb.exe63⤵
- Executes dropped EXE
PID:1160 -
\??\c:\nvtdxfh.exec:\nvtdxfh.exe64⤵
- Executes dropped EXE
PID:1352 -
\??\c:\lrdldd.exec:\lrdldd.exe65⤵
- Executes dropped EXE
PID:2652 -
\??\c:\drhbrj.exec:\drhbrj.exe66⤵PID:2328
-
\??\c:\jlltbr.exec:\jlltbr.exe67⤵PID:272
-
\??\c:\vnbldb.exec:\vnbldb.exe68⤵PID:1088
-
\??\c:\txfth.exec:\txfth.exe69⤵PID:1584
-
\??\c:\fnjjd.exec:\fnjjd.exe70⤵PID:2172
-
\??\c:\rnfbtrp.exec:\rnfbtrp.exe71⤵PID:264
-
\??\c:\njnhjpn.exec:\njnhjpn.exe72⤵PID:2508
-
\??\c:\lnrtbtj.exec:\lnrtbtj.exe73⤵PID:1220
-
\??\c:\ftxtt.exec:\ftxtt.exe74⤵PID:2408
-
\??\c:\llnppfj.exec:\llnppfj.exe75⤵PID:2308
-
\??\c:\rdlrpjp.exec:\rdlrpjp.exe76⤵PID:2600
-
\??\c:\tpfnt.exec:\tpfnt.exe77⤵PID:1708
-
\??\c:\lhlrnj.exec:\lhlrnj.exe78⤵PID:2956
-
\??\c:\plrtlfh.exec:\plrtlfh.exe79⤵PID:368
-
\??\c:\nrlrt.exec:\nrlrt.exe80⤵
- System Location Discovery: System Language Discovery
PID:2280 -
\??\c:\blpfdj.exec:\blpfdj.exe81⤵PID:2140
-
\??\c:\lrlfvnb.exec:\lrlfvnb.exe82⤵PID:2768
-
\??\c:\frxft.exec:\frxft.exe83⤵PID:2512
-
\??\c:\vxpvt.exec:\vxpvt.exe84⤵PID:2952
-
\??\c:\prhrlt.exec:\prhrlt.exe85⤵PID:2948
-
\??\c:\ndvvbt.exec:\ndvvbt.exe86⤵PID:2804
-
\??\c:\frvxf.exec:\frvxf.exe87⤵PID:2688
-
\??\c:\lpnhj.exec:\lpnhj.exe88⤵PID:2052
-
\??\c:\dxrbl.exec:\dxrbl.exe89⤵PID:2044
-
\??\c:\txffjrp.exec:\txffjrp.exe90⤵PID:1144
-
\??\c:\tlphh.exec:\tlphh.exe91⤵PID:2656
-
\??\c:\vpndtr.exec:\vpndtr.exe92⤵PID:2736
-
\??\c:\nrbthxf.exec:\nrbthxf.exe93⤵PID:2980
-
\??\c:\pftxfd.exec:\pftxfd.exe94⤵PID:2568
-
\??\c:\dfjbhrl.exec:\dfjbhrl.exe95⤵PID:2024
-
\??\c:\bxvrj.exec:\bxvrj.exe96⤵PID:900
-
\??\c:\rnfjt.exec:\rnfjt.exe97⤵PID:2988
-
\??\c:\hfjtl.exec:\hfjtl.exe98⤵PID:1484
-
\??\c:\lpxtlf.exec:\lpxtlf.exe99⤵PID:612
-
\??\c:\jtdtvd.exec:\jtdtvd.exe100⤵PID:2268
-
\??\c:\pddpdnb.exec:\pddpdnb.exe101⤵PID:1312
-
\??\c:\bhdhvbd.exec:\bhdhvbd.exe102⤵PID:2940
-
\??\c:\rbxhlr.exec:\rbxhlr.exe103⤵PID:2484
-
\??\c:\ffdvb.exec:\ffdvb.exe104⤵PID:560
-
\??\c:\dxldpj.exec:\dxldpj.exe105⤵PID:1652
-
\??\c:\xhfftlb.exec:\xhfftlb.exe106⤵PID:1160
-
\??\c:\brbnfnn.exec:\brbnfnn.exe107⤵PID:1552
-
\??\c:\nxbdtj.exec:\nxbdtj.exe108⤵PID:1148
-
\??\c:\tdhppb.exec:\tdhppb.exe109⤵PID:1612
-
\??\c:\plffrtt.exec:\plffrtt.exe110⤵PID:1184
-
\??\c:\tfdrjpd.exec:\tfdrjpd.exe111⤵PID:1884
-
\??\c:\xthlxr.exec:\xthlxr.exe112⤵PID:2216
-
\??\c:\lvxtd.exec:\lvxtd.exe113⤵PID:1584
-
\??\c:\btfjtlr.exec:\btfjtlr.exe114⤵PID:820
-
\??\c:\xtxndxp.exec:\xtxndxp.exe115⤵PID:948
-
\??\c:\nlvtxnj.exec:\nlvtxnj.exe116⤵PID:2508
-
\??\c:\fdvbdt.exec:\fdvbdt.exe117⤵PID:2468
-
\??\c:\nrnpdfl.exec:\nrnpdfl.exe118⤵PID:1688
-
\??\c:\dvpllj.exec:\dvpllj.exe119⤵PID:1916
-
\??\c:\vfvpnp.exec:\vfvpnp.exe120⤵PID:1560
-
\??\c:\ppbrbhp.exec:\ppbrbhp.exe121⤵PID:2168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-