Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 02:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
be1df3c186bacfe876d9e8a1d67b45c4df22bdd32851edeb5446aa44b7f31aa2.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
be1df3c186bacfe876d9e8a1d67b45c4df22bdd32851edeb5446aa44b7f31aa2.exe
-
Size
453KB
-
MD5
9ab5ef1b37376011a74eadf8b3b227ed
-
SHA1
faafa40ee9ef4788a21fdef88eaa5a8788724ef1
-
SHA256
be1df3c186bacfe876d9e8a1d67b45c4df22bdd32851edeb5446aa44b7f31aa2
-
SHA512
ee83a34cbbdcaf92d63d920a7af211132d99b2107b2b7f3e812ce98292ba5da9f8bccb1d9b80588a02e6fe70e8bc2fe90154109f2064ed9091c7f6a95fa3d095
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2284-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-53-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2216-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1016-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-92-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1756-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-164-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2100-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-315-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2856-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-409-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1252-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-422-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1248-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-494-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2540-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-660-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-705-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-821-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1856-840-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-904-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2988-924-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2284 hljhvx.exe 2940 rdtnprx.exe 2884 fddfjvd.exe 2132 ffnbvj.exe 3032 rhvnbxx.exe 2736 hdlflt.exe 2216 dvbtrpd.exe 1016 npxpnjr.exe 1036 nljdfl.exe 2548 rvplvxn.exe 1756 fdxfh.exe 1276 flfhxtl.exe 1800 hvhrhfv.exe 1496 jhrndp.exe 1344 ntbvvbd.exe 1128 xptllj.exe 1044 jjjlv.exe 2596 lrbbfjp.exe 2176 bxtvlhl.exe 2100 vflhd.exe 2296 htrrbfd.exe 2504 xxdtjrd.exe 1260 rjvlxp.exe 616 xptfpv.exe 2400 xlrvpbj.exe 1524 tfpvh.exe 860 tjlhbl.exe 108 lnhbthf.exe 2672 rljxrnv.exe 900 jxdfh.exe 1680 vrvhb.exe 2348 rvhjjtj.exe 2632 nptjdn.exe 2384 tjbjx.exe 1592 lphfrl.exe 2628 frrhrhf.exe 2880 djblvr.exe 2856 tvtrrd.exe 2884 hdhbnvx.exe 2912 npfbn.exe 2780 vpvtft.exe 2764 blfff.exe 2796 tjlbh.exe 2216 brvdl.exe 956 jlbhhd.exe 1788 vbxblf.exe 2312 nlnbp.exe 2088 hhfhhx.exe 1032 dplvxt.exe 1252 jxhbp.exe 1248 fjvnlpj.exe 2364 hnpvr.exe 932 fbflnx.exe 2304 ddtjfdb.exe 1528 pbpnn.exe 1232 nhttj.exe 1056 lpbtbp.exe 2596 hxhjvh.exe 2208 pnppbjv.exe 1644 hhdndf.exe 2244 dfrtttf.exe 1284 jvrthx.exe 2540 lhnvbdp.exe 2388 bvpld.exe -
resource yara_rule behavioral1/memory/2284-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-422-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1248-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-840-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-881-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-911-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-924-0x00000000003D0000-0x00000000003FA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bldnpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdfhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lphfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnrrhnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thjjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htrrbfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptlfbvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhftlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdlhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnpdtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvdbxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfhjhvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvxpfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfnbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtxjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btdxxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trbxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpdntv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpxth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpxrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flplvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrvdpjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdthv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjpptbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lftlpnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drxtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djndlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flhlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xttxnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldflxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbfbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvtlxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdhdvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jftldbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxvfjhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpthr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvthf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffprr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trnhlfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjrthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjrlrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fptnhtx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2284 3016 be1df3c186bacfe876d9e8a1d67b45c4df22bdd32851edeb5446aa44b7f31aa2.exe 29 PID 3016 wrote to memory of 2284 3016 be1df3c186bacfe876d9e8a1d67b45c4df22bdd32851edeb5446aa44b7f31aa2.exe 29 PID 3016 wrote to memory of 2284 3016 be1df3c186bacfe876d9e8a1d67b45c4df22bdd32851edeb5446aa44b7f31aa2.exe 29 PID 3016 wrote to memory of 2284 3016 be1df3c186bacfe876d9e8a1d67b45c4df22bdd32851edeb5446aa44b7f31aa2.exe 29 PID 2284 wrote to memory of 2940 2284 hljhvx.exe 30 PID 2284 wrote to memory of 2940 2284 hljhvx.exe 30 PID 2284 wrote to memory of 2940 2284 hljhvx.exe 30 PID 2284 wrote to memory of 2940 2284 hljhvx.exe 30 PID 2940 wrote to memory of 2884 2940 rdtnprx.exe 31 PID 2940 wrote to memory of 2884 2940 rdtnprx.exe 31 PID 2940 wrote to memory of 2884 2940 rdtnprx.exe 31 PID 2940 wrote to memory of 2884 2940 rdtnprx.exe 31 PID 2884 wrote to memory of 2132 2884 fddfjvd.exe 32 PID 2884 wrote to memory of 2132 2884 fddfjvd.exe 32 PID 2884 wrote to memory of 2132 2884 fddfjvd.exe 32 PID 2884 wrote to memory of 2132 2884 fddfjvd.exe 32 PID 2132 wrote to memory of 3032 2132 ffnbvj.exe 33 PID 2132 wrote to memory of 3032 2132 ffnbvj.exe 33 PID 2132 wrote to memory of 3032 2132 ffnbvj.exe 33 PID 2132 wrote to memory of 3032 2132 ffnbvj.exe 33 PID 3032 wrote to memory of 2736 3032 rhvnbxx.exe 34 PID 3032 wrote to memory of 2736 3032 rhvnbxx.exe 34 PID 3032 wrote to memory of 2736 3032 rhvnbxx.exe 34 PID 3032 wrote to memory of 2736 3032 rhvnbxx.exe 34 PID 2736 wrote to memory of 2216 2736 hdlflt.exe 35 PID 2736 wrote to memory of 2216 2736 hdlflt.exe 35 PID 2736 wrote to memory of 2216 2736 hdlflt.exe 35 PID 2736 wrote to memory of 2216 2736 hdlflt.exe 35 PID 2216 wrote to memory of 1016 2216 dvbtrpd.exe 36 PID 2216 wrote to memory of 1016 2216 dvbtrpd.exe 36 PID 2216 wrote to memory of 1016 2216 dvbtrpd.exe 36 PID 2216 wrote to memory of 1016 2216 dvbtrpd.exe 36 PID 1016 wrote to memory of 1036 1016 npxpnjr.exe 37 PID 1016 wrote to memory of 1036 1016 npxpnjr.exe 37 PID 1016 wrote to memory of 1036 1016 npxpnjr.exe 37 PID 1016 wrote to memory of 1036 1016 npxpnjr.exe 37 PID 1036 wrote to memory of 2548 1036 nljdfl.exe 38 PID 1036 wrote to memory of 2548 1036 nljdfl.exe 38 PID 1036 wrote to memory of 2548 1036 nljdfl.exe 38 PID 1036 wrote to memory of 2548 1036 nljdfl.exe 38 PID 2548 wrote to memory of 1756 2548 rvplvxn.exe 39 PID 2548 wrote to memory of 1756 2548 rvplvxn.exe 39 PID 2548 wrote to memory of 1756 2548 rvplvxn.exe 39 PID 2548 wrote to memory of 1756 2548 rvplvxn.exe 39 PID 1756 wrote to memory of 1276 1756 fdxfh.exe 40 PID 1756 wrote to memory of 1276 1756 fdxfh.exe 40 PID 1756 wrote to memory of 1276 1756 fdxfh.exe 40 PID 1756 wrote to memory of 1276 1756 fdxfh.exe 40 PID 1276 wrote to memory of 1800 1276 flfhxtl.exe 41 PID 1276 wrote to memory of 1800 1276 flfhxtl.exe 41 PID 1276 wrote to memory of 1800 1276 flfhxtl.exe 41 PID 1276 wrote to memory of 1800 1276 flfhxtl.exe 41 PID 1800 wrote to memory of 1496 1800 hvhrhfv.exe 42 PID 1800 wrote to memory of 1496 1800 hvhrhfv.exe 42 PID 1800 wrote to memory of 1496 1800 hvhrhfv.exe 42 PID 1800 wrote to memory of 1496 1800 hvhrhfv.exe 42 PID 1496 wrote to memory of 1344 1496 jhrndp.exe 43 PID 1496 wrote to memory of 1344 1496 jhrndp.exe 43 PID 1496 wrote to memory of 1344 1496 jhrndp.exe 43 PID 1496 wrote to memory of 1344 1496 jhrndp.exe 43 PID 1344 wrote to memory of 1128 1344 ntbvvbd.exe 44 PID 1344 wrote to memory of 1128 1344 ntbvvbd.exe 44 PID 1344 wrote to memory of 1128 1344 ntbvvbd.exe 44 PID 1344 wrote to memory of 1128 1344 ntbvvbd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\be1df3c186bacfe876d9e8a1d67b45c4df22bdd32851edeb5446aa44b7f31aa2.exe"C:\Users\Admin\AppData\Local\Temp\be1df3c186bacfe876d9e8a1d67b45c4df22bdd32851edeb5446aa44b7f31aa2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\hljhvx.exec:\hljhvx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\rdtnprx.exec:\rdtnprx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\fddfjvd.exec:\fddfjvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\ffnbvj.exec:\ffnbvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\rhvnbxx.exec:\rhvnbxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\hdlflt.exec:\hdlflt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\dvbtrpd.exec:\dvbtrpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\npxpnjr.exec:\npxpnjr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\nljdfl.exec:\nljdfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\rvplvxn.exec:\rvplvxn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\fdxfh.exec:\fdxfh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\flfhxtl.exec:\flfhxtl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\hvhrhfv.exec:\hvhrhfv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\jhrndp.exec:\jhrndp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\ntbvvbd.exec:\ntbvvbd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\xptllj.exec:\xptllj.exe17⤵
- Executes dropped EXE
PID:1128 -
\??\c:\jjjlv.exec:\jjjlv.exe18⤵
- Executes dropped EXE
PID:1044 -
\??\c:\lrbbfjp.exec:\lrbbfjp.exe19⤵
- Executes dropped EXE
PID:2596 -
\??\c:\bxtvlhl.exec:\bxtvlhl.exe20⤵
- Executes dropped EXE
PID:2176 -
\??\c:\vflhd.exec:\vflhd.exe21⤵
- Executes dropped EXE
PID:2100 -
\??\c:\htrrbfd.exec:\htrrbfd.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2296 -
\??\c:\xxdtjrd.exec:\xxdtjrd.exe23⤵
- Executes dropped EXE
PID:2504 -
\??\c:\rjvlxp.exec:\rjvlxp.exe24⤵
- Executes dropped EXE
PID:1260 -
\??\c:\xptfpv.exec:\xptfpv.exe25⤵
- Executes dropped EXE
PID:616 -
\??\c:\xlrvpbj.exec:\xlrvpbj.exe26⤵
- Executes dropped EXE
PID:2400 -
\??\c:\tfpvh.exec:\tfpvh.exe27⤵
- Executes dropped EXE
PID:1524 -
\??\c:\tjlhbl.exec:\tjlhbl.exe28⤵
- Executes dropped EXE
PID:860 -
\??\c:\lnhbthf.exec:\lnhbthf.exe29⤵
- Executes dropped EXE
PID:108 -
\??\c:\rljxrnv.exec:\rljxrnv.exe30⤵
- Executes dropped EXE
PID:2672 -
\??\c:\jxdfh.exec:\jxdfh.exe31⤵
- Executes dropped EXE
PID:900 -
\??\c:\vrvhb.exec:\vrvhb.exe32⤵
- Executes dropped EXE
PID:1680 -
\??\c:\rvhjjtj.exec:\rvhjjtj.exe33⤵
- Executes dropped EXE
PID:2348 -
\??\c:\nptjdn.exec:\nptjdn.exe34⤵
- Executes dropped EXE
PID:2632 -
\??\c:\tjbjx.exec:\tjbjx.exe35⤵
- Executes dropped EXE
PID:2384 -
\??\c:\lphfrl.exec:\lphfrl.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1592 -
\??\c:\frrhrhf.exec:\frrhrhf.exe37⤵
- Executes dropped EXE
PID:2628 -
\??\c:\djblvr.exec:\djblvr.exe38⤵
- Executes dropped EXE
PID:2880 -
\??\c:\tvtrrd.exec:\tvtrrd.exe39⤵
- Executes dropped EXE
PID:2856 -
\??\c:\hdhbnvx.exec:\hdhbnvx.exe40⤵
- Executes dropped EXE
PID:2884 -
\??\c:\npfbn.exec:\npfbn.exe41⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vpvtft.exec:\vpvtft.exe42⤵
- Executes dropped EXE
PID:2780 -
\??\c:\blfff.exec:\blfff.exe43⤵
- Executes dropped EXE
PID:2764 -
\??\c:\tjlbh.exec:\tjlbh.exe44⤵
- Executes dropped EXE
PID:2796 -
\??\c:\brvdl.exec:\brvdl.exe45⤵
- Executes dropped EXE
PID:2216 -
\??\c:\jlbhhd.exec:\jlbhhd.exe46⤵
- Executes dropped EXE
PID:956 -
\??\c:\vbxblf.exec:\vbxblf.exe47⤵
- Executes dropped EXE
PID:1788 -
\??\c:\nlnbp.exec:\nlnbp.exe48⤵
- Executes dropped EXE
PID:2312 -
\??\c:\hhfhhx.exec:\hhfhhx.exe49⤵
- Executes dropped EXE
PID:2088 -
\??\c:\dplvxt.exec:\dplvxt.exe50⤵
- Executes dropped EXE
PID:1032 -
\??\c:\jxhbp.exec:\jxhbp.exe51⤵
- Executes dropped EXE
PID:1252 -
\??\c:\fjvnlpj.exec:\fjvnlpj.exe52⤵
- Executes dropped EXE
PID:1248 -
\??\c:\hnpvr.exec:\hnpvr.exe53⤵
- Executes dropped EXE
PID:2364 -
\??\c:\fbflnx.exec:\fbflnx.exe54⤵
- Executes dropped EXE
PID:932 -
\??\c:\ddtjfdb.exec:\ddtjfdb.exe55⤵
- Executes dropped EXE
PID:2304 -
\??\c:\pbpnn.exec:\pbpnn.exe56⤵
- Executes dropped EXE
PID:1528 -
\??\c:\nhttj.exec:\nhttj.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1232 -
\??\c:\lpbtbp.exec:\lpbtbp.exe58⤵
- Executes dropped EXE
PID:1056 -
\??\c:\hxhjvh.exec:\hxhjvh.exe59⤵
- Executes dropped EXE
PID:2596 -
\??\c:\pnppbjv.exec:\pnppbjv.exe60⤵
- Executes dropped EXE
PID:2208 -
\??\c:\hhdndf.exec:\hhdndf.exe61⤵
- Executes dropped EXE
PID:1644 -
\??\c:\dfrtttf.exec:\dfrtttf.exe62⤵
- Executes dropped EXE
PID:2244 -
\??\c:\jvrthx.exec:\jvrthx.exe63⤵
- Executes dropped EXE
PID:1284 -
\??\c:\lhnvbdp.exec:\lhnvbdp.exe64⤵
- Executes dropped EXE
PID:2540 -
\??\c:\bvpld.exec:\bvpld.exe65⤵
- Executes dropped EXE
PID:2388 -
\??\c:\lhpnvd.exec:\lhpnvd.exe66⤵PID:976
-
\??\c:\dnpxbh.exec:\dnpxbh.exe67⤵PID:1584
-
\??\c:\ppfnpr.exec:\ppfnpr.exe68⤵PID:2708
-
\??\c:\bvfrxj.exec:\bvfrxj.exe69⤵PID:1524
-
\??\c:\pbfxhbx.exec:\pbfxhbx.exe70⤵PID:1856
-
\??\c:\dldtdtt.exec:\dldtdtt.exe71⤵PID:472
-
\??\c:\nlltdjf.exec:\nlltdjf.exe72⤵PID:2328
-
\??\c:\ddjvbfj.exec:\ddjvbfj.exe73⤵PID:2656
-
\??\c:\ljblr.exec:\ljblr.exe74⤵PID:2200
-
\??\c:\dnrxxvd.exec:\dnrxxvd.exe75⤵PID:1020
-
\??\c:\dtjht.exec:\dtjht.exe76⤵PID:916
-
\??\c:\nvbvdv.exec:\nvbvdv.exe77⤵PID:964
-
\??\c:\nbndl.exec:\nbndl.exe78⤵PID:368
-
\??\c:\blvnlx.exec:\blvnlx.exe79⤵PID:1696
-
\??\c:\rftnh.exec:\rftnh.exe80⤵PID:2956
-
\??\c:\ffprr.exec:\ffprr.exe81⤵
- System Location Discovery: System Language Discovery
PID:2940 -
\??\c:\dfrbvlt.exec:\dfrbvlt.exe82⤵PID:2976
-
\??\c:\tdnljd.exec:\tdnljd.exe83⤵PID:2848
-
\??\c:\rdfjht.exec:\rdfjht.exe84⤵PID:2964
-
\??\c:\fnlptv.exec:\fnlptv.exe85⤵PID:2760
-
\??\c:\hxxljrx.exec:\hxxljrx.exe86⤵PID:2736
-
\??\c:\lbttj.exec:\lbttj.exe87⤵PID:2120
-
\??\c:\dtxhl.exec:\dtxhl.exe88⤵PID:1804
-
\??\c:\ppxllrd.exec:\ppxllrd.exe89⤵PID:2128
-
\??\c:\tdvfxrd.exec:\tdvfxrd.exe90⤵PID:884
-
\??\c:\phvrp.exec:\phvrp.exe91⤵PID:2464
-
\??\c:\xbnvx.exec:\xbnvx.exe92⤵PID:2260
-
\??\c:\vlhnjt.exec:\vlhnjt.exe93⤵PID:2308
-
\??\c:\xdbvtnh.exec:\xdbvtnh.exe94⤵PID:2356
-
\??\c:\nxnlhxh.exec:\nxnlhxh.exe95⤵PID:2440
-
\??\c:\hrptjtl.exec:\hrptjtl.exe96⤵PID:1764
-
\??\c:\bfrfdv.exec:\bfrfdv.exe97⤵PID:2720
-
\??\c:\nnjvnj.exec:\nnjvnj.exe98⤵PID:1496
-
\??\c:\dtnjtxh.exec:\dtnjtxh.exe99⤵PID:2772
-
\??\c:\nnnlnph.exec:\nnnlnph.exe100⤵PID:1244
-
\??\c:\xtrdft.exec:\xtrdft.exe101⤵PID:2036
-
\??\c:\pbxrljl.exec:\pbxrljl.exe102⤵PID:2292
-
\??\c:\jxbbbp.exec:\jxbbbp.exe103⤵PID:2180
-
\??\c:\tdppllv.exec:\tdppllv.exe104⤵PID:816
-
\??\c:\rvxtfp.exec:\rvxtfp.exe105⤵PID:2100
-
\??\c:\frtxjl.exec:\frtxjl.exe106⤵PID:908
-
\??\c:\rdnhlb.exec:\rdnhlb.exe107⤵PID:1724
-
\??\c:\fnnld.exec:\fnnld.exe108⤵PID:2300
-
\??\c:\jjrthd.exec:\jjrthd.exe109⤵PID:1836
-
\??\c:\vtthhf.exec:\vtthhf.exe110⤵PID:1868
-
\??\c:\rnbfp.exec:\rnbfp.exe111⤵PID:2148
-
\??\c:\llhpfb.exec:\llhpfb.exe112⤵PID:2400
-
\??\c:\xrbrpjt.exec:\xrbrpjt.exe113⤵PID:1200
-
\??\c:\lvxpnn.exec:\lvxpnn.exe114⤵PID:1280
-
\??\c:\vflth.exec:\vflth.exe115⤵PID:1856
-
\??\c:\jdddhjl.exec:\jdddhjl.exe116⤵PID:864
-
\??\c:\drjhpjn.exec:\drjhpjn.exe117⤵PID:1864
-
\??\c:\bnhrj.exec:\bnhrj.exe118⤵PID:1924
-
\??\c:\rpdldn.exec:\rpdldn.exe119⤵PID:2612
-
\??\c:\lffpnr.exec:\lffpnr.exe120⤵PID:2616
-
\??\c:\rrhvdb.exec:\rrhvdb.exe121⤵PID:2632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-