Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 04:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d33d937558fc2f4e60327e698c9734828b273337b02f390890d62cbac33f1c56.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d33d937558fc2f4e60327e698c9734828b273337b02f390890d62cbac33f1c56.exe
-
Size
454KB
-
MD5
c0da95c510515ff04476b51b74480366
-
SHA1
78011a0cb5499787267a14206864ae1767ffd491
-
SHA256
d33d937558fc2f4e60327e698c9734828b273337b02f390890d62cbac33f1c56
-
SHA512
ec2e5cc085524544a0790a881d76ad1aa66a411ff9367bca917bf48230e18f4c1842a608ce682c1585019acb42c2f757698bf0f26d71d60413f182bebda1abe2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeW:q7Tc2NYHUrAwfMp3CDW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2188-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-84-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2792-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-112-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1180-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1180-124-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2028-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-133-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2780-142-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2780-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-199-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1344-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1064-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1284-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/964-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-257-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1088-262-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1088-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-396-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1144-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-423-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2348-500-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2992-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-508-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2436-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-584-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1760-589-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2168-612-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1948-707-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1460-719-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2024-734-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2408 rdtdrpb.exe 1104 dfnhxfp.exe 2648 ddbnrdd.exe 1920 dprljx.exe 2884 xhhbrvv.exe 2784 rrbdbj.exe 2908 fvvjfp.exe 2816 tfhnlb.exe 2792 rjvphl.exe 2752 ppjltr.exe 1832 bffrx.exe 1180 jhxvxj.exe 2028 jpdhr.exe 2780 rhpjh.exe 1640 bjvbh.exe 1488 jrpjnpp.exe 1976 vlvrldj.exe 2940 xlrvlnx.exe 2052 nllvhl.exe 1612 btjpdr.exe 1344 jrrrx.exe 2440 hbxddfx.exe 1064 xdpbj.exe 1284 tbljv.exe 964 nnjvvb.exe 1716 frxbnt.exe 1088 nfbvv.exe 1092 thnjpjx.exe 2244 pfxlbl.exe 2336 vjpxp.exe 2472 dbfvhtx.exe 2604 rpbtxvp.exe 936 dnhpnh.exe 1708 xjprpt.exe 1104 dfbbl.exe 2196 frxlvd.exe 2864 prhrtrb.exe 2900 ntdbbpr.exe 3056 bhpffh.exe 2324 fjxxv.exe 1264 fdbrnbt.exe 2896 thtlrb.exe 2700 pnxhj.exe 2692 tbxnnp.exe 2748 dbnhnpr.exe 2192 fjdhv.exe 1144 jppbdd.exe 3016 tjxnlrl.exe 1328 llblvj.exe 2744 rvtppv.exe 1208 hfntf.exe 2056 nljhbdx.exe 1972 rtffdn.exe 2996 pddnxbx.exe 2916 nrrrfj.exe 2428 pbdlpjb.exe 2940 pxxjhp.exe 2348 xdprb.exe 2464 btfrhfr.exe 1928 tvjbr.exe 2588 dtjbxb.exe 2992 nbdnj.exe 1160 vrfrb.exe 1828 rxnbv.exe -
resource yara_rule behavioral1/memory/2188-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/964-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-508-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2436-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-747-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfntf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jftptjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntxtdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbxddfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhlnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvlbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlvvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjflhpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfhbpfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvhlxjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjjnjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trrvjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vflnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffvvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhtllv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbpxxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prjpbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtjrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drrpthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txrfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjvdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjjfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxvnfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtjtfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlfvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbvvnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljvhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlvvbrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljrxfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tllxdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thpdbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdndj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2408 2188 d33d937558fc2f4e60327e698c9734828b273337b02f390890d62cbac33f1c56.exe 30 PID 2188 wrote to memory of 2408 2188 d33d937558fc2f4e60327e698c9734828b273337b02f390890d62cbac33f1c56.exe 30 PID 2188 wrote to memory of 2408 2188 d33d937558fc2f4e60327e698c9734828b273337b02f390890d62cbac33f1c56.exe 30 PID 2188 wrote to memory of 2408 2188 d33d937558fc2f4e60327e698c9734828b273337b02f390890d62cbac33f1c56.exe 30 PID 2408 wrote to memory of 1104 2408 rdtdrpb.exe 31 PID 2408 wrote to memory of 1104 2408 rdtdrpb.exe 31 PID 2408 wrote to memory of 1104 2408 rdtdrpb.exe 31 PID 2408 wrote to memory of 1104 2408 rdtdrpb.exe 31 PID 1104 wrote to memory of 2648 1104 dfnhxfp.exe 32 PID 1104 wrote to memory of 2648 1104 dfnhxfp.exe 32 PID 1104 wrote to memory of 2648 1104 dfnhxfp.exe 32 PID 1104 wrote to memory of 2648 1104 dfnhxfp.exe 32 PID 2648 wrote to memory of 1920 2648 ddbnrdd.exe 33 PID 2648 wrote to memory of 1920 2648 ddbnrdd.exe 33 PID 2648 wrote to memory of 1920 2648 ddbnrdd.exe 33 PID 2648 wrote to memory of 1920 2648 ddbnrdd.exe 33 PID 1920 wrote to memory of 2884 1920 dprljx.exe 34 PID 1920 wrote to memory of 2884 1920 dprljx.exe 34 PID 1920 wrote to memory of 2884 1920 dprljx.exe 34 PID 1920 wrote to memory of 2884 1920 dprljx.exe 34 PID 2884 wrote to memory of 2784 2884 xhhbrvv.exe 35 PID 2884 wrote to memory of 2784 2884 xhhbrvv.exe 35 PID 2884 wrote to memory of 2784 2884 xhhbrvv.exe 35 PID 2884 wrote to memory of 2784 2884 xhhbrvv.exe 35 PID 2784 wrote to memory of 2908 2784 rrbdbj.exe 36 PID 2784 wrote to memory of 2908 2784 rrbdbj.exe 36 PID 2784 wrote to memory of 2908 2784 rrbdbj.exe 36 PID 2784 wrote to memory of 2908 2784 rrbdbj.exe 36 PID 2908 wrote to memory of 2816 2908 fvvjfp.exe 37 PID 2908 wrote to memory of 2816 2908 fvvjfp.exe 37 PID 2908 wrote to memory of 2816 2908 fvvjfp.exe 37 PID 2908 wrote to memory of 2816 2908 fvvjfp.exe 37 PID 2816 wrote to memory of 2792 2816 tfhnlb.exe 38 PID 2816 wrote to memory of 2792 2816 tfhnlb.exe 38 PID 2816 wrote to memory of 2792 2816 tfhnlb.exe 38 PID 2816 wrote to memory of 2792 2816 tfhnlb.exe 38 PID 2792 wrote to memory of 2752 2792 rjvphl.exe 39 PID 2792 wrote to memory of 2752 2792 rjvphl.exe 39 PID 2792 wrote to memory of 2752 2792 rjvphl.exe 39 PID 2792 wrote to memory of 2752 2792 rjvphl.exe 39 PID 2752 wrote to memory of 1832 2752 ppjltr.exe 40 PID 2752 wrote to memory of 1832 2752 ppjltr.exe 40 PID 2752 wrote to memory of 1832 2752 ppjltr.exe 40 PID 2752 wrote to memory of 1832 2752 ppjltr.exe 40 PID 1832 wrote to memory of 1180 1832 bffrx.exe 41 PID 1832 wrote to memory of 1180 1832 bffrx.exe 41 PID 1832 wrote to memory of 1180 1832 bffrx.exe 41 PID 1832 wrote to memory of 1180 1832 bffrx.exe 41 PID 1180 wrote to memory of 2028 1180 jhxvxj.exe 42 PID 1180 wrote to memory of 2028 1180 jhxvxj.exe 42 PID 1180 wrote to memory of 2028 1180 jhxvxj.exe 42 PID 1180 wrote to memory of 2028 1180 jhxvxj.exe 42 PID 2028 wrote to memory of 2780 2028 jpdhr.exe 43 PID 2028 wrote to memory of 2780 2028 jpdhr.exe 43 PID 2028 wrote to memory of 2780 2028 jpdhr.exe 43 PID 2028 wrote to memory of 2780 2028 jpdhr.exe 43 PID 2780 wrote to memory of 1640 2780 rhpjh.exe 44 PID 2780 wrote to memory of 1640 2780 rhpjh.exe 44 PID 2780 wrote to memory of 1640 2780 rhpjh.exe 44 PID 2780 wrote to memory of 1640 2780 rhpjh.exe 44 PID 1640 wrote to memory of 1488 1640 bjvbh.exe 45 PID 1640 wrote to memory of 1488 1640 bjvbh.exe 45 PID 1640 wrote to memory of 1488 1640 bjvbh.exe 45 PID 1640 wrote to memory of 1488 1640 bjvbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d33d937558fc2f4e60327e698c9734828b273337b02f390890d62cbac33f1c56.exe"C:\Users\Admin\AppData\Local\Temp\d33d937558fc2f4e60327e698c9734828b273337b02f390890d62cbac33f1c56.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\rdtdrpb.exec:\rdtdrpb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\dfnhxfp.exec:\dfnhxfp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\ddbnrdd.exec:\ddbnrdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\dprljx.exec:\dprljx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\xhhbrvv.exec:\xhhbrvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\rrbdbj.exec:\rrbdbj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\fvvjfp.exec:\fvvjfp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\tfhnlb.exec:\tfhnlb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\rjvphl.exec:\rjvphl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\ppjltr.exec:\ppjltr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\bffrx.exec:\bffrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\jhxvxj.exec:\jhxvxj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\jpdhr.exec:\jpdhr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\rhpjh.exec:\rhpjh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\bjvbh.exec:\bjvbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\jrpjnpp.exec:\jrpjnpp.exe17⤵
- Executes dropped EXE
PID:1488 -
\??\c:\vlvrldj.exec:\vlvrldj.exe18⤵
- Executes dropped EXE
PID:1976 -
\??\c:\xlrvlnx.exec:\xlrvlnx.exe19⤵
- Executes dropped EXE
PID:2940 -
\??\c:\nllvhl.exec:\nllvhl.exe20⤵
- Executes dropped EXE
PID:2052 -
\??\c:\btjpdr.exec:\btjpdr.exe21⤵
- Executes dropped EXE
PID:1612 -
\??\c:\jrrrx.exec:\jrrrx.exe22⤵
- Executes dropped EXE
PID:1344 -
\??\c:\hbxddfx.exec:\hbxddfx.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2440 -
\??\c:\xdpbj.exec:\xdpbj.exe24⤵
- Executes dropped EXE
PID:1064 -
\??\c:\tbljv.exec:\tbljv.exe25⤵
- Executes dropped EXE
PID:1284 -
\??\c:\nnjvvb.exec:\nnjvvb.exe26⤵
- Executes dropped EXE
PID:964 -
\??\c:\frxbnt.exec:\frxbnt.exe27⤵
- Executes dropped EXE
PID:1716 -
\??\c:\nfbvv.exec:\nfbvv.exe28⤵
- Executes dropped EXE
PID:1088 -
\??\c:\thnjpjx.exec:\thnjpjx.exe29⤵
- Executes dropped EXE
PID:1092 -
\??\c:\pfxlbl.exec:\pfxlbl.exe30⤵
- Executes dropped EXE
PID:2244 -
\??\c:\vjpxp.exec:\vjpxp.exe31⤵
- Executes dropped EXE
PID:2336 -
\??\c:\dbfvhtx.exec:\dbfvhtx.exe32⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rpbtxvp.exec:\rpbtxvp.exe33⤵
- Executes dropped EXE
PID:2604 -
\??\c:\dnhpnh.exec:\dnhpnh.exe34⤵
- Executes dropped EXE
PID:936 -
\??\c:\xjprpt.exec:\xjprpt.exe35⤵
- Executes dropped EXE
PID:1708 -
\??\c:\dfbbl.exec:\dfbbl.exe36⤵
- Executes dropped EXE
PID:1104 -
\??\c:\frxlvd.exec:\frxlvd.exe37⤵
- Executes dropped EXE
PID:2196 -
\??\c:\prhrtrb.exec:\prhrtrb.exe38⤵
- Executes dropped EXE
PID:2864 -
\??\c:\ntdbbpr.exec:\ntdbbpr.exe39⤵
- Executes dropped EXE
PID:2900 -
\??\c:\bhpffh.exec:\bhpffh.exe40⤵
- Executes dropped EXE
PID:3056 -
\??\c:\fjxxv.exec:\fjxxv.exe41⤵
- Executes dropped EXE
PID:2324 -
\??\c:\fdbrnbt.exec:\fdbrnbt.exe42⤵
- Executes dropped EXE
PID:1264 -
\??\c:\thtlrb.exec:\thtlrb.exe43⤵
- Executes dropped EXE
PID:2896 -
\??\c:\pnxhj.exec:\pnxhj.exe44⤵
- Executes dropped EXE
PID:2700 -
\??\c:\tbxnnp.exec:\tbxnnp.exe45⤵
- Executes dropped EXE
PID:2692 -
\??\c:\dbnhnpr.exec:\dbnhnpr.exe46⤵
- Executes dropped EXE
PID:2748 -
\??\c:\fjdhv.exec:\fjdhv.exe47⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jppbdd.exec:\jppbdd.exe48⤵
- Executes dropped EXE
PID:1144 -
\??\c:\tjxnlrl.exec:\tjxnlrl.exe49⤵
- Executes dropped EXE
PID:3016 -
\??\c:\llblvj.exec:\llblvj.exe50⤵
- Executes dropped EXE
PID:1328 -
\??\c:\rvtppv.exec:\rvtppv.exe51⤵
- Executes dropped EXE
PID:2744 -
\??\c:\hfntf.exec:\hfntf.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1208 -
\??\c:\nljhbdx.exec:\nljhbdx.exe53⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rtffdn.exec:\rtffdn.exe54⤵
- Executes dropped EXE
PID:1972 -
\??\c:\pddnxbx.exec:\pddnxbx.exe55⤵
- Executes dropped EXE
PID:2996 -
\??\c:\nrrrfj.exec:\nrrrfj.exe56⤵
- Executes dropped EXE
PID:2916 -
\??\c:\pbdlpjb.exec:\pbdlpjb.exe57⤵
- Executes dropped EXE
PID:2428 -
\??\c:\pxxjhp.exec:\pxxjhp.exe58⤵
- Executes dropped EXE
PID:2940 -
\??\c:\xdprb.exec:\xdprb.exe59⤵
- Executes dropped EXE
PID:2348 -
\??\c:\btfrhfr.exec:\btfrhfr.exe60⤵
- Executes dropped EXE
PID:2464 -
\??\c:\tvjbr.exec:\tvjbr.exe61⤵
- Executes dropped EXE
PID:1928 -
\??\c:\dtjbxb.exec:\dtjbxb.exe62⤵
- Executes dropped EXE
PID:2588 -
\??\c:\nbdnj.exec:\nbdnj.exe63⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vrfrb.exec:\vrfrb.exe64⤵
- Executes dropped EXE
PID:1160 -
\??\c:\rxnbv.exec:\rxnbv.exe65⤵
- Executes dropped EXE
PID:1828 -
\??\c:\dhhpr.exec:\dhhpr.exe66⤵PID:1324
-
\??\c:\prftxj.exec:\prftxj.exe67⤵PID:964
-
\??\c:\pbtpnnx.exec:\pbtpnnx.exe68⤵PID:1028
-
\??\c:\lhrffpr.exec:\lhrffpr.exe69⤵PID:2436
-
\??\c:\fxrpph.exec:\fxrpph.exe70⤵PID:1912
-
\??\c:\tlvxd.exec:\tlvxd.exe71⤵PID:784
-
\??\c:\dpjrfp.exec:\dpjrfp.exe72⤵PID:572
-
\??\c:\vfjpffv.exec:\vfjpffv.exe73⤵PID:2624
-
\??\c:\bffljhp.exec:\bffljhp.exe74⤵PID:2456
-
\??\c:\bflrtvr.exec:\bflrtvr.exe75⤵PID:1760
-
\??\c:\fdjjbpt.exec:\fdjjbpt.exe76⤵PID:2076
-
\??\c:\rfvbv.exec:\rfvbv.exe77⤵PID:2092
-
\??\c:\ffpdfjh.exec:\ffpdfjh.exe78⤵PID:2168
-
\??\c:\rxfdphj.exec:\rxfdphj.exe79⤵PID:2964
-
\??\c:\nrrfll.exec:\nrrfll.exe80⤵PID:2228
-
\??\c:\hdxlv.exec:\hdxlv.exe81⤵PID:2904
-
\??\c:\drhltd.exec:\drhltd.exe82⤵PID:2512
-
\??\c:\ljbrp.exec:\ljbrp.exe83⤵PID:2884
-
\??\c:\dlvvr.exec:\dlvvr.exe84⤵
- System Location Discovery: System Language Discovery
PID:2936 -
\??\c:\rpvfvtr.exec:\rpvfvtr.exe85⤵PID:3000
-
\??\c:\xnjntb.exec:\xnjntb.exe86⤵PID:2680
-
\??\c:\txrfj.exec:\txrfj.exe87⤵
- System Location Discovery: System Language Discovery
PID:2708 -
\??\c:\vnjhb.exec:\vnjhb.exe88⤵PID:524
-
\??\c:\frvxbb.exec:\frvxbb.exe89⤵PID:2032
-
\??\c:\hlhxh.exec:\hlhxh.exe90⤵PID:2012
-
\??\c:\vlnxt.exec:\vlnxt.exe91⤵PID:1460
-
\??\c:\bnjvt.exec:\bnjvt.exe92⤵PID:692
-
\??\c:\ldrdx.exec:\ldrdx.exe93⤵PID:1948
-
\??\c:\nlxldn.exec:\nlxldn.exe94⤵PID:1772
-
\??\c:\vbjjdbr.exec:\vbjjdbr.exe95⤵PID:1660
-
\??\c:\nnfplnr.exec:\nnfplnr.exe96⤵PID:2024
-
\??\c:\dhxhhhr.exec:\dhxhhhr.exe97⤵PID:1488
-
\??\c:\nhdfndp.exec:\nhdfndp.exe98⤵PID:1976
-
\??\c:\fpbntj.exec:\fpbntj.exe99⤵PID:3028
-
\??\c:\rtxhdr.exec:\rtxhdr.exe100⤵PID:2132
-
\??\c:\nnbxrl.exec:\nnbxrl.exe101⤵PID:2420
-
\??\c:\xxtbhdx.exec:\xxtbhdx.exe102⤵PID:1380
-
\??\c:\bpblxfd.exec:\bpblxfd.exe103⤵PID:1876
-
\??\c:\blvjl.exec:\blvjl.exe104⤵PID:2124
-
\??\c:\htpxhl.exec:\htpxhl.exe105⤵PID:656
-
\??\c:\xbrlh.exec:\xbrlh.exe106⤵PID:1552
-
\??\c:\vtpbl.exec:\vtpbl.exe107⤵PID:1068
-
\??\c:\ltlbfb.exec:\ltlbfb.exe108⤵PID:2860
-
\??\c:\hddtd.exec:\hddtd.exe109⤵PID:1324
-
\??\c:\bhnvtn.exec:\bhnvtn.exe110⤵PID:1424
-
\??\c:\jbdjr.exec:\jbdjr.exe111⤵PID:2164
-
\??\c:\njfdltf.exec:\njfdltf.exe112⤵PID:1892
-
\??\c:\hrvfbxb.exec:\hrvfbxb.exe113⤵PID:1768
-
\??\c:\jbrnd.exec:\jbrnd.exe114⤵PID:700
-
\??\c:\jxvnphl.exec:\jxvnphl.exe115⤵PID:896
-
\??\c:\bnxldfx.exec:\bnxldfx.exe116⤵PID:1944
-
\??\c:\vbfjnvf.exec:\vbfjnvf.exe117⤵PID:2188
-
\??\c:\vxrrr.exec:\vxrrr.exe118⤵PID:1592
-
\??\c:\xfvxvd.exec:\xfvxvd.exe119⤵PID:936
-
\??\c:\hbrrpd.exec:\hbrrpd.exe120⤵PID:2304
-
\??\c:\hldxrt.exec:\hldxrt.exe121⤵PID:2092
-
\??\c:\bfxdt.exec:\bfxdt.exe122⤵PID:288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-