Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 03:14
Behavioral task
behavioral1
Sample
9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe
-
Size
333KB
-
MD5
b1eaf5db7e7eb52285d559606b0eb4ee
-
SHA1
87a979a408c4c8431d9393071f105cf1a01d6937
-
SHA256
9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f
-
SHA512
7f902a6dfe676a3a268fb73e87ecab81da312872ace10ce1c8259049ffe28e647d44f5395b33542337de85ad9edea9309980da881983d64c68f065612408f40e
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeTb:R4wFHoSHYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2188-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2152-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2152-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1532-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1832-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1196-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1188-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2364-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1808-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1652-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1352-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-236-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1736-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/272-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1672-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1528-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1868-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2308-568-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-569-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-665-0x00000000002F0000-0x0000000000317000-memory.dmp family_blackmoon behavioral1/memory/2712-883-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1528-902-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2792-908-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2468-6792-0x00000000776A0000-0x000000007779A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2408 hrtrbhb.exe 2076 rhhll.exe 2104 pjfhxn.exe 2760 ndrjxx.exe 2152 vjbnjr.exe 2924 nxfnfhn.exe 2788 jrjxl.exe 2908 bxjtj.exe 2704 nphxj.exe 2844 npjnfbb.exe 2688 lpxjxr.exe 1532 xhpfx.exe 1832 tlvbv.exe 2736 hvdvt.exe 1196 hlrpdt.exe 1188 ltxdn.exe 2364 xpjdh.exe 2064 ttbrx.exe 1488 hvtlp.exe 1764 bdtpxvb.exe 3020 tfffxnh.exe 2268 hfbbf.exe 1808 tjxbrtp.exe 1652 nrvrrhf.exe 2440 bnrpxb.exe 1352 rhdxx.exe 744 vthvrpp.exe 988 prdnd.exe 1736 rlxxd.exe 272 bdlrfn.exe 2164 vbljjh.exe 2400 ddthvt.exe 1672 fdrdtp.exe 2244 nhbbj.exe 3060 hvvhdhv.exe 2392 dthvh.exe 2324 tlbrn.exe 1592 dndtl.exe 2616 nppntt.exe 1708 hhntxl.exe 2648 tjjvpj.exe 1384 rdxxht.exe 1920 btpdrx.exe 2228 jnhfhr.exe 2920 pdnhddf.exe 2876 jnpxnxj.exe 2232 pvtvbp.exe 2788 hddhbnl.exe 2796 xtxdfnn.exe 1528 nfndth.exe 2792 jbbdflv.exe 2696 pfhhht.exe 2800 nbdpjhb.exe 2720 hlnvxb.exe 2660 fvrbfhp.exe 1832 rjbdvh.exe 2028 pjjvbr.exe 1152 ljxbtj.exe 2744 hrjvvpv.exe 1188 rxrvh.exe 1128 djvvtt.exe 1080 pxplf.exe 2000 nflld.exe 2776 ntbhjhb.exe -
resource yara_rule behavioral1/memory/2188-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000e000000012267-7.dat upx behavioral1/memory/2188-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2408-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000016d64-17.dat upx behavioral1/memory/2408-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d69-23.dat upx behavioral1/files/0x0007000000016fc9-30.dat upx behavioral1/memory/2104-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016fe5-38.dat upx behavioral1/memory/2152-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000170f8-46.dat upx behavioral1/files/0x000800000001756e-53.dat upx behavioral1/memory/2924-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2788-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d3f-62.dat upx behavioral1/memory/2152-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b3-72.dat upx behavioral1/memory/2908-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b5-78.dat upx behavioral1/files/0x00050000000195b7-85.dat upx behavioral1/memory/2688-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195bb-92.dat upx behavioral1/memory/1532-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195bd-101.dat upx behavioral1/memory/1832-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c1-110.dat upx behavioral1/files/0x00050000000195c3-117.dat upx behavioral1/memory/1196-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c5-125.dat upx behavioral1/memory/1188-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c6-133.dat upx behavioral1/memory/2364-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c7-141.dat upx behavioral1/files/0x000500000001960c-151.dat upx behavioral1/memory/2064-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019643-161.dat upx behavioral1/memory/1488-159-0x0000000000260000-0x0000000000287000-memory.dmp upx behavioral1/memory/1764-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001975a-172.dat upx behavioral1/memory/2268-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019761-178.dat upx behavioral1/files/0x00050000000197fd-186.dat upx behavioral1/memory/2268-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019820-195.dat upx behavioral1/memory/1808-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1652-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001998d-203.dat upx behavioral1/files/0x0005000000019bf5-210.dat upx behavioral1/memory/1352-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf6-218.dat upx behavioral1/files/0x0005000000019bf9-225.dat upx behavioral1/files/0x0005000000019c3c-232.dat upx behavioral1/files/0x0005000000019d61-243.dat upx behavioral1/memory/272-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1736-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/272-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d62-250.dat upx behavioral1/files/0x0005000000019d6d-257.dat upx behavioral1/memory/2400-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1672-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3060-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1708-321-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2232-345-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxvrbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpnthp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnpvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jphpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jltfrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvrtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjdnjrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhpljpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhhll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnjbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffbln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbdxpth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnrvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhvjjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfrxnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjtbdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrllhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhbhpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njpxfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfdhdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdvlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvblt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhntxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptxlvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxbltfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nljhjfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjbtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxhtfvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljrxrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nplthtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfjfjdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbhpfth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nldjtdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxldht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfbbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdnhddf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpptp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dttllfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtxxffd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njxphp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhtxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtdvfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhfhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlxpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbxnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpfrph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxhnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xndpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjxpxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjfrvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrtrnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntjjvjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfpdjdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltpfpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjbbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djnhnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fplvfd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2408 2188 9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe 30 PID 2188 wrote to memory of 2408 2188 9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe 30 PID 2188 wrote to memory of 2408 2188 9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe 30 PID 2188 wrote to memory of 2408 2188 9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe 30 PID 2408 wrote to memory of 2076 2408 hrtrbhb.exe 31 PID 2408 wrote to memory of 2076 2408 hrtrbhb.exe 31 PID 2408 wrote to memory of 2076 2408 hrtrbhb.exe 31 PID 2408 wrote to memory of 2076 2408 hrtrbhb.exe 31 PID 2076 wrote to memory of 2104 2076 rhhll.exe 32 PID 2076 wrote to memory of 2104 2076 rhhll.exe 32 PID 2076 wrote to memory of 2104 2076 rhhll.exe 32 PID 2076 wrote to memory of 2104 2076 rhhll.exe 32 PID 2104 wrote to memory of 2760 2104 pjfhxn.exe 33 PID 2104 wrote to memory of 2760 2104 pjfhxn.exe 33 PID 2104 wrote to memory of 2760 2104 pjfhxn.exe 33 PID 2104 wrote to memory of 2760 2104 pjfhxn.exe 33 PID 2760 wrote to memory of 2152 2760 ndrjxx.exe 34 PID 2760 wrote to memory of 2152 2760 ndrjxx.exe 34 PID 2760 wrote to memory of 2152 2760 ndrjxx.exe 34 PID 2760 wrote to memory of 2152 2760 ndrjxx.exe 34 PID 2152 wrote to memory of 2924 2152 vjbnjr.exe 35 PID 2152 wrote to memory of 2924 2152 vjbnjr.exe 35 PID 2152 wrote to memory of 2924 2152 vjbnjr.exe 35 PID 2152 wrote to memory of 2924 2152 vjbnjr.exe 35 PID 2924 wrote to memory of 2788 2924 nxfnfhn.exe 36 PID 2924 wrote to memory of 2788 2924 nxfnfhn.exe 36 PID 2924 wrote to memory of 2788 2924 nxfnfhn.exe 36 PID 2924 wrote to memory of 2788 2924 nxfnfhn.exe 36 PID 2788 wrote to memory of 2908 2788 jrjxl.exe 37 PID 2788 wrote to memory of 2908 2788 jrjxl.exe 37 PID 2788 wrote to memory of 2908 2788 jrjxl.exe 37 PID 2788 wrote to memory of 2908 2788 jrjxl.exe 37 PID 2908 wrote to memory of 2704 2908 bxjtj.exe 38 PID 2908 wrote to memory of 2704 2908 bxjtj.exe 38 PID 2908 wrote to memory of 2704 2908 bxjtj.exe 38 PID 2908 wrote to memory of 2704 2908 bxjtj.exe 38 PID 2704 wrote to memory of 2844 2704 nphxj.exe 39 PID 2704 wrote to memory of 2844 2704 nphxj.exe 39 PID 2704 wrote to memory of 2844 2704 nphxj.exe 39 PID 2704 wrote to memory of 2844 2704 nphxj.exe 39 PID 2844 wrote to memory of 2688 2844 npjnfbb.exe 40 PID 2844 wrote to memory of 2688 2844 npjnfbb.exe 40 PID 2844 wrote to memory of 2688 2844 npjnfbb.exe 40 PID 2844 wrote to memory of 2688 2844 npjnfbb.exe 40 PID 2688 wrote to memory of 1532 2688 lpxjxr.exe 41 PID 2688 wrote to memory of 1532 2688 lpxjxr.exe 41 PID 2688 wrote to memory of 1532 2688 lpxjxr.exe 41 PID 2688 wrote to memory of 1532 2688 lpxjxr.exe 41 PID 1532 wrote to memory of 1832 1532 xhpfx.exe 42 PID 1532 wrote to memory of 1832 1532 xhpfx.exe 42 PID 1532 wrote to memory of 1832 1532 xhpfx.exe 42 PID 1532 wrote to memory of 1832 1532 xhpfx.exe 42 PID 1832 wrote to memory of 2736 1832 tlvbv.exe 43 PID 1832 wrote to memory of 2736 1832 tlvbv.exe 43 PID 1832 wrote to memory of 2736 1832 tlvbv.exe 43 PID 1832 wrote to memory of 2736 1832 tlvbv.exe 43 PID 2736 wrote to memory of 1196 2736 hvdvt.exe 44 PID 2736 wrote to memory of 1196 2736 hvdvt.exe 44 PID 2736 wrote to memory of 1196 2736 hvdvt.exe 44 PID 2736 wrote to memory of 1196 2736 hvdvt.exe 44 PID 1196 wrote to memory of 1188 1196 hlrpdt.exe 45 PID 1196 wrote to memory of 1188 1196 hlrpdt.exe 45 PID 1196 wrote to memory of 1188 1196 hlrpdt.exe 45 PID 1196 wrote to memory of 1188 1196 hlrpdt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe"C:\Users\Admin\AppData\Local\Temp\9d4a5c5698b7400a3b08dcc2d382e2695ef5007bee80d070669f03b2889b512f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\hrtrbhb.exec:\hrtrbhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\rhhll.exec:\rhhll.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\pjfhxn.exec:\pjfhxn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\ndrjxx.exec:\ndrjxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\vjbnjr.exec:\vjbnjr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\nxfnfhn.exec:\nxfnfhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\jrjxl.exec:\jrjxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\bxjtj.exec:\bxjtj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\nphxj.exec:\nphxj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\npjnfbb.exec:\npjnfbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\lpxjxr.exec:\lpxjxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\xhpfx.exec:\xhpfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\tlvbv.exec:\tlvbv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\hvdvt.exec:\hvdvt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\hlrpdt.exec:\hlrpdt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\ltxdn.exec:\ltxdn.exe17⤵
- Executes dropped EXE
PID:1188 -
\??\c:\xpjdh.exec:\xpjdh.exe18⤵
- Executes dropped EXE
PID:2364 -
\??\c:\ttbrx.exec:\ttbrx.exe19⤵
- Executes dropped EXE
PID:2064 -
\??\c:\hvtlp.exec:\hvtlp.exe20⤵
- Executes dropped EXE
PID:1488 -
\??\c:\bdtpxvb.exec:\bdtpxvb.exe21⤵
- Executes dropped EXE
PID:1764 -
\??\c:\tfffxnh.exec:\tfffxnh.exe22⤵
- Executes dropped EXE
PID:3020 -
\??\c:\hfbbf.exec:\hfbbf.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2268 -
\??\c:\tjxbrtp.exec:\tjxbrtp.exe24⤵
- Executes dropped EXE
PID:1808 -
\??\c:\nrvrrhf.exec:\nrvrrhf.exe25⤵
- Executes dropped EXE
PID:1652 -
\??\c:\bnrpxb.exec:\bnrpxb.exe26⤵
- Executes dropped EXE
PID:2440 -
\??\c:\rhdxx.exec:\rhdxx.exe27⤵
- Executes dropped EXE
PID:1352 -
\??\c:\vthvrpp.exec:\vthvrpp.exe28⤵
- Executes dropped EXE
PID:744 -
\??\c:\prdnd.exec:\prdnd.exe29⤵
- Executes dropped EXE
PID:988 -
\??\c:\rlxxd.exec:\rlxxd.exe30⤵
- Executes dropped EXE
PID:1736 -
\??\c:\bdlrfn.exec:\bdlrfn.exe31⤵
- Executes dropped EXE
PID:272 -
\??\c:\vbljjh.exec:\vbljjh.exe32⤵
- Executes dropped EXE
PID:2164 -
\??\c:\ddthvt.exec:\ddthvt.exe33⤵
- Executes dropped EXE
PID:2400 -
\??\c:\fdrdtp.exec:\fdrdtp.exe34⤵
- Executes dropped EXE
PID:1672 -
\??\c:\nhbbj.exec:\nhbbj.exe35⤵
- Executes dropped EXE
PID:2244 -
\??\c:\hvvhdhv.exec:\hvvhdhv.exe36⤵
- Executes dropped EXE
PID:3060 -
\??\c:\dthvh.exec:\dthvh.exe37⤵
- Executes dropped EXE
PID:2392 -
\??\c:\tlbrn.exec:\tlbrn.exe38⤵
- Executes dropped EXE
PID:2324 -
\??\c:\dndtl.exec:\dndtl.exe39⤵
- Executes dropped EXE
PID:1592 -
\??\c:\nppntt.exec:\nppntt.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\hhntxl.exec:\hhntxl.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1708 -
\??\c:\tjjvpj.exec:\tjjvpj.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2648 -
\??\c:\rdxxht.exec:\rdxxht.exe43⤵
- Executes dropped EXE
PID:1384 -
\??\c:\btpdrx.exec:\btpdrx.exe44⤵
- Executes dropped EXE
PID:1920 -
\??\c:\jnhfhr.exec:\jnhfhr.exe45⤵
- Executes dropped EXE
PID:2228 -
\??\c:\pdnhddf.exec:\pdnhddf.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2920 -
\??\c:\jnpxnxj.exec:\jnpxnxj.exe47⤵
- Executes dropped EXE
PID:2876 -
\??\c:\pvtvbp.exec:\pvtvbp.exe48⤵
- Executes dropped EXE
PID:2232 -
\??\c:\hddhbnl.exec:\hddhbnl.exe49⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xtxdfnn.exec:\xtxdfnn.exe50⤵
- Executes dropped EXE
PID:2796 -
\??\c:\nfndth.exec:\nfndth.exe51⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jbbdflv.exec:\jbbdflv.exe52⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pfhhht.exec:\pfhhht.exe53⤵
- Executes dropped EXE
PID:2696 -
\??\c:\nbdpjhb.exec:\nbdpjhb.exe54⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hlnvxb.exec:\hlnvxb.exe55⤵
- Executes dropped EXE
PID:2720 -
\??\c:\fvrbfhp.exec:\fvrbfhp.exe56⤵
- Executes dropped EXE
PID:2660 -
\??\c:\rjbdvh.exec:\rjbdvh.exe57⤵
- Executes dropped EXE
PID:1832 -
\??\c:\pjjvbr.exec:\pjjvbr.exe58⤵
- Executes dropped EXE
PID:2028 -
\??\c:\ljxbtj.exec:\ljxbtj.exe59⤵
- Executes dropped EXE
PID:1152 -
\??\c:\hrjvvpv.exec:\hrjvvpv.exe60⤵
- Executes dropped EXE
PID:2744 -
\??\c:\rxrvh.exec:\rxrvh.exe61⤵
- Executes dropped EXE
PID:1188 -
\??\c:\djvvtt.exec:\djvvtt.exe62⤵
- Executes dropped EXE
PID:1128 -
\??\c:\pxplf.exec:\pxplf.exe63⤵
- Executes dropped EXE
PID:1080 -
\??\c:\nflld.exec:\nflld.exe64⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ntbhjhb.exec:\ntbhjhb.exe65⤵
- Executes dropped EXE
PID:2776 -
\??\c:\pdpdh.exec:\pdpdh.exe66⤵PID:2976
-
\??\c:\pvdhb.exec:\pvdhb.exe67⤵PID:1312
-
\??\c:\trdtn.exec:\trdtn.exe68⤵PID:2264
-
\??\c:\xntxdl.exec:\xntxdl.exe69⤵PID:2252
-
\??\c:\hvprb.exec:\hvprb.exe70⤵PID:1868
-
\??\c:\ljbbfd.exec:\ljbbfd.exe71⤵PID:676
-
\??\c:\tpnbhn.exec:\tpnbhn.exe72⤵PID:1796
-
\??\c:\bhjbxbn.exec:\bhjbxbn.exe73⤵PID:1816
-
\??\c:\rfhrrlf.exec:\rfhrrlf.exe74⤵PID:2124
-
\??\c:\rlrhph.exec:\rlrhph.exe75⤵PID:1064
-
\??\c:\nnnfnfj.exec:\nnnfnfj.exe76⤵PID:1784
-
\??\c:\jxbjnj.exec:\jxbjnj.exe77⤵PID:1068
-
\??\c:\ffdhjpl.exec:\ffdhjpl.exe78⤵PID:1968
-
\??\c:\pvfphf.exec:\pvfphf.exe79⤵PID:2860
-
\??\c:\jhrhtjt.exec:\jhrhtjt.exe80⤵PID:1088
-
\??\c:\hdpxr.exec:\hdpxr.exe81⤵PID:1584
-
\??\c:\nhnnv.exec:\nhnnv.exe82⤵PID:1892
-
\??\c:\hrlpjl.exec:\hrlpjl.exe83⤵PID:264
-
\??\c:\lxdnb.exec:\lxdnb.exe84⤵PID:2480
-
\??\c:\bhlpjxd.exec:\bhlpjxd.exe85⤵PID:288
-
\??\c:\rdxlp.exec:\rdxlp.exe86⤵PID:3060
-
\??\c:\nbtlh.exec:\nbtlh.exe87⤵PID:2392
-
\??\c:\dxhnv.exec:\dxhnv.exe88⤵
- System Location Discovery: System Language Discovery
PID:2308 -
\??\c:\nrfrtdr.exec:\nrfrtdr.exe89⤵PID:2624
-
\??\c:\tvpbn.exec:\tvpbn.exe90⤵PID:1760
-
\??\c:\tdxdvft.exec:\tdxdvft.exe91⤵PID:2600
-
\??\c:\vbxjrhr.exec:\vbxjrhr.exe92⤵PID:2104
-
\??\c:\pnhfd.exec:\pnhfd.exe93⤵PID:2760
-
\??\c:\dxhjx.exec:\dxhjx.exe94⤵PID:2888
-
\??\c:\vnxddhb.exec:\vnxddhb.exe95⤵PID:1016
-
\??\c:\bpdnxl.exec:\bpdnxl.exe96⤵PID:1688
-
\??\c:\xfbpdlj.exec:\xfbpdlj.exe97⤵PID:2804
-
\??\c:\blhpbvh.exec:\blhpbvh.exe98⤵PID:3000
-
\??\c:\vdnnvl.exec:\vdnnvl.exe99⤵PID:2936
-
\??\c:\rvjdnr.exec:\rvjdnr.exe100⤵PID:2948
-
\??\c:\xxvrbv.exec:\xxvrbv.exe101⤵
- System Location Discovery: System Language Discovery
PID:2676 -
\??\c:\lddrj.exec:\lddrj.exe102⤵PID:2724
-
\??\c:\ffjldvt.exec:\ffjldvt.exe103⤵PID:2316
-
\??\c:\vjnhlx.exec:\vjnhlx.exe104⤵PID:1960
-
\??\c:\prtdf.exec:\prtdf.exe105⤵PID:2044
-
\??\c:\bpvxl.exec:\bpvxl.exe106⤵PID:2660
-
\??\c:\vxvbthr.exec:\vxvbthr.exe107⤵PID:1832
-
\??\c:\rhpxrtl.exec:\rhpxrtl.exe108⤵PID:2028
-
\??\c:\vpnthp.exec:\vpnthp.exe109⤵
- System Location Discovery: System Language Discovery
PID:1152 -
\??\c:\btbdx.exec:\btbdx.exe110⤵PID:2332
-
\??\c:\hjvnfhp.exec:\hjvnfhp.exe111⤵PID:2056
-
\??\c:\hrxvxpf.exec:\hrxvxpf.exe112⤵PID:1924
-
\??\c:\rjhjf.exec:\rjhjf.exe113⤵PID:1984
-
\??\c:\xbjxjd.exec:\xbjxjd.exe114⤵PID:2000
-
\??\c:\ljrxrv.exec:\ljrxrv.exe115⤵
- System Location Discovery: System Language Discovery
PID:1764 -
\??\c:\xndhl.exec:\xndhl.exe116⤵PID:2280
-
\??\c:\hllht.exec:\hllht.exe117⤵PID:1312
-
\??\c:\hlxndlj.exec:\hlxndlj.exe118⤵PID:2100
-
\??\c:\hvhjnd.exec:\hvhjnd.exe119⤵PID:2252
-
\??\c:\pvnbj.exec:\pvnbj.exe120⤵PID:1868
-
\??\c:\fxpxxlb.exec:\fxpxxlb.exe121⤵PID:676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-