Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 04:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d555f3a07f4b639effe3ae2a8ee2d1a893e8f63a387b5f77eb352b021c699b23.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d555f3a07f4b639effe3ae2a8ee2d1a893e8f63a387b5f77eb352b021c699b23.exe
-
Size
455KB
-
MD5
af40a74c0f70c93a16970ec5c319283b
-
SHA1
45ec2d42093ee15866f9a81eacbc25c9b7ebd0e0
-
SHA256
d555f3a07f4b639effe3ae2a8ee2d1a893e8f63a387b5f77eb352b021c699b23
-
SHA512
59155c497e068cf08dcc463e95a5a5433167d617f82505ac213c5dff62f5cb3e653a59b4281c0d3497d54a9ef5e9c0548fb5a0ebbb98971c20012c5665d23939
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbee:q7Tc2NYHUrAwfMp3CDe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2356-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-29-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2836-38-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2836-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-64-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2804-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-102-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2704-107-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2992-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/924-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/924-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/660-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-435-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/796-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/796-443-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2000-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/544-555-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2116-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/544-582-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2348-601-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2812-655-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2884-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2064 hxrfhb.exe 2352 trfhjp.exe 2836 ltprv.exe 2124 thrjljn.exe 2452 vbrtvp.exe 2804 xvbdt.exe 2812 thbxbvx.exe 2680 fjvxtbb.exe 2708 xfhjhl.exe 2704 pvplhlt.exe 2992 hrntpn.exe 884 dfppd.exe 924 xrffrh.exe 1256 ddjblrb.exe 1996 dhfdr.exe 660 ppjvfl.exe 1944 jpdlj.exe 2868 ltxjr.exe 3052 xhflrjd.exe 2360 bhtvxxl.exe 3028 bbvdnjr.exe 1864 ltffh.exe 584 xtjhfnt.exe 1744 ndnbhh.exe 2484 ljtlp.exe 1728 lpxbdl.exe 1368 ddfvrj.exe 1324 bhpvxf.exe 2400 hlnflbh.exe 1020 rblfnnn.exe 2712 jxpdhh.exe 1632 xppvpd.exe 2356 bbjvfj.exe 1572 nhrdfh.exe 2308 tdldv.exe 2984 xdjphj.exe 2352 hfhvl.exe 3060 brbrnx.exe 2440 ltvxpr.exe 2792 vftpd.exe 2788 dlpdf.exe 2932 hvtbr.exe 3056 btpfdvp.exe 2168 ltttvjt.exe 2824 rjljf.exe 2672 tfrnxlj.exe 2616 nrdft.exe 1804 nvhprn.exe 1548 njthp.exe 2312 bdhltdr.exe 624 ptxphh.exe 796 bljrvd.exe 2000 vxflfdt.exe 1948 ltlxjr.exe 1944 fdvfnf.exe 2868 fxdrvpj.exe 2324 nnxxdp.exe 1028 bhnlx.exe 2404 llvlp.exe 1476 vlffb.exe 2180 pdblvjp.exe 896 jvfprt.exe 1788 npdpf.exe 960 bhdxdpx.exe -
resource yara_rule behavioral1/memory/2356-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/660-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-795-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndnnvxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxtltx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnrvxtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djnfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjbnphj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hprjjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpxbdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxhjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljfbpvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpnhdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrjnlph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvbxpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjrjjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtpljbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpxvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrhlrth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvrhpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxntvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxplvvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxnhnbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bljrvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdpnxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fftnpnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trvjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbbxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vltrtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhtjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvbjtdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjffbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbdht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2064 2356 d555f3a07f4b639effe3ae2a8ee2d1a893e8f63a387b5f77eb352b021c699b23.exe 30 PID 2356 wrote to memory of 2064 2356 d555f3a07f4b639effe3ae2a8ee2d1a893e8f63a387b5f77eb352b021c699b23.exe 30 PID 2356 wrote to memory of 2064 2356 d555f3a07f4b639effe3ae2a8ee2d1a893e8f63a387b5f77eb352b021c699b23.exe 30 PID 2356 wrote to memory of 2064 2356 d555f3a07f4b639effe3ae2a8ee2d1a893e8f63a387b5f77eb352b021c699b23.exe 30 PID 2064 wrote to memory of 2352 2064 hxrfhb.exe 31 PID 2064 wrote to memory of 2352 2064 hxrfhb.exe 31 PID 2064 wrote to memory of 2352 2064 hxrfhb.exe 31 PID 2064 wrote to memory of 2352 2064 hxrfhb.exe 31 PID 2352 wrote to memory of 2836 2352 trfhjp.exe 32 PID 2352 wrote to memory of 2836 2352 trfhjp.exe 32 PID 2352 wrote to memory of 2836 2352 trfhjp.exe 32 PID 2352 wrote to memory of 2836 2352 trfhjp.exe 32 PID 2836 wrote to memory of 2124 2836 ltprv.exe 33 PID 2836 wrote to memory of 2124 2836 ltprv.exe 33 PID 2836 wrote to memory of 2124 2836 ltprv.exe 33 PID 2836 wrote to memory of 2124 2836 ltprv.exe 33 PID 2124 wrote to memory of 2452 2124 thrjljn.exe 34 PID 2124 wrote to memory of 2452 2124 thrjljn.exe 34 PID 2124 wrote to memory of 2452 2124 thrjljn.exe 34 PID 2124 wrote to memory of 2452 2124 thrjljn.exe 34 PID 2452 wrote to memory of 2804 2452 vbrtvp.exe 35 PID 2452 wrote to memory of 2804 2452 vbrtvp.exe 35 PID 2452 wrote to memory of 2804 2452 vbrtvp.exe 35 PID 2452 wrote to memory of 2804 2452 vbrtvp.exe 35 PID 2804 wrote to memory of 2812 2804 xvbdt.exe 36 PID 2804 wrote to memory of 2812 2804 xvbdt.exe 36 PID 2804 wrote to memory of 2812 2804 xvbdt.exe 36 PID 2804 wrote to memory of 2812 2804 xvbdt.exe 36 PID 2812 wrote to memory of 2680 2812 thbxbvx.exe 37 PID 2812 wrote to memory of 2680 2812 thbxbvx.exe 37 PID 2812 wrote to memory of 2680 2812 thbxbvx.exe 37 PID 2812 wrote to memory of 2680 2812 thbxbvx.exe 37 PID 2680 wrote to memory of 2708 2680 fjvxtbb.exe 38 PID 2680 wrote to memory of 2708 2680 fjvxtbb.exe 38 PID 2680 wrote to memory of 2708 2680 fjvxtbb.exe 38 PID 2680 wrote to memory of 2708 2680 fjvxtbb.exe 38 PID 2708 wrote to memory of 2704 2708 xfhjhl.exe 39 PID 2708 wrote to memory of 2704 2708 xfhjhl.exe 39 PID 2708 wrote to memory of 2704 2708 xfhjhl.exe 39 PID 2708 wrote to memory of 2704 2708 xfhjhl.exe 39 PID 2704 wrote to memory of 2992 2704 pvplhlt.exe 40 PID 2704 wrote to memory of 2992 2704 pvplhlt.exe 40 PID 2704 wrote to memory of 2992 2704 pvplhlt.exe 40 PID 2704 wrote to memory of 2992 2704 pvplhlt.exe 40 PID 2992 wrote to memory of 884 2992 hrntpn.exe 41 PID 2992 wrote to memory of 884 2992 hrntpn.exe 41 PID 2992 wrote to memory of 884 2992 hrntpn.exe 41 PID 2992 wrote to memory of 884 2992 hrntpn.exe 41 PID 884 wrote to memory of 924 884 dfppd.exe 42 PID 884 wrote to memory of 924 884 dfppd.exe 42 PID 884 wrote to memory of 924 884 dfppd.exe 42 PID 884 wrote to memory of 924 884 dfppd.exe 42 PID 924 wrote to memory of 1256 924 xrffrh.exe 43 PID 924 wrote to memory of 1256 924 xrffrh.exe 43 PID 924 wrote to memory of 1256 924 xrffrh.exe 43 PID 924 wrote to memory of 1256 924 xrffrh.exe 43 PID 1256 wrote to memory of 1996 1256 ddjblrb.exe 44 PID 1256 wrote to memory of 1996 1256 ddjblrb.exe 44 PID 1256 wrote to memory of 1996 1256 ddjblrb.exe 44 PID 1256 wrote to memory of 1996 1256 ddjblrb.exe 44 PID 1996 wrote to memory of 660 1996 dhfdr.exe 45 PID 1996 wrote to memory of 660 1996 dhfdr.exe 45 PID 1996 wrote to memory of 660 1996 dhfdr.exe 45 PID 1996 wrote to memory of 660 1996 dhfdr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d555f3a07f4b639effe3ae2a8ee2d1a893e8f63a387b5f77eb352b021c699b23.exe"C:\Users\Admin\AppData\Local\Temp\d555f3a07f4b639effe3ae2a8ee2d1a893e8f63a387b5f77eb352b021c699b23.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\hxrfhb.exec:\hxrfhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\trfhjp.exec:\trfhjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\ltprv.exec:\ltprv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\thrjljn.exec:\thrjljn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\vbrtvp.exec:\vbrtvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\xvbdt.exec:\xvbdt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\thbxbvx.exec:\thbxbvx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\fjvxtbb.exec:\fjvxtbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\xfhjhl.exec:\xfhjhl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\pvplhlt.exec:\pvplhlt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\hrntpn.exec:\hrntpn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\dfppd.exec:\dfppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\xrffrh.exec:\xrffrh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\ddjblrb.exec:\ddjblrb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\dhfdr.exec:\dhfdr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\ppjvfl.exec:\ppjvfl.exe17⤵
- Executes dropped EXE
PID:660 -
\??\c:\jpdlj.exec:\jpdlj.exe18⤵
- Executes dropped EXE
PID:1944 -
\??\c:\ltxjr.exec:\ltxjr.exe19⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xhflrjd.exec:\xhflrjd.exe20⤵
- Executes dropped EXE
PID:3052 -
\??\c:\bhtvxxl.exec:\bhtvxxl.exe21⤵
- Executes dropped EXE
PID:2360 -
\??\c:\bbvdnjr.exec:\bbvdnjr.exe22⤵
- Executes dropped EXE
PID:3028 -
\??\c:\ltffh.exec:\ltffh.exe23⤵
- Executes dropped EXE
PID:1864 -
\??\c:\xtjhfnt.exec:\xtjhfnt.exe24⤵
- Executes dropped EXE
PID:584 -
\??\c:\ndnbhh.exec:\ndnbhh.exe25⤵
- Executes dropped EXE
PID:1744 -
\??\c:\ljtlp.exec:\ljtlp.exe26⤵
- Executes dropped EXE
PID:2484 -
\??\c:\lpxbdl.exec:\lpxbdl.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1728 -
\??\c:\ddfvrj.exec:\ddfvrj.exe28⤵
- Executes dropped EXE
PID:1368 -
\??\c:\bhpvxf.exec:\bhpvxf.exe29⤵
- Executes dropped EXE
PID:1324 -
\??\c:\hlnflbh.exec:\hlnflbh.exe30⤵
- Executes dropped EXE
PID:2400 -
\??\c:\rblfnnn.exec:\rblfnnn.exe31⤵
- Executes dropped EXE
PID:1020 -
\??\c:\jxpdhh.exec:\jxpdhh.exe32⤵
- Executes dropped EXE
PID:2712 -
\??\c:\xppvpd.exec:\xppvpd.exe33⤵
- Executes dropped EXE
PID:1632 -
\??\c:\bbjvfj.exec:\bbjvfj.exe34⤵
- Executes dropped EXE
PID:2356 -
\??\c:\nhrdfh.exec:\nhrdfh.exe35⤵
- Executes dropped EXE
PID:1572 -
\??\c:\tdldv.exec:\tdldv.exe36⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xdjphj.exec:\xdjphj.exe37⤵
- Executes dropped EXE
PID:2984 -
\??\c:\hfhvl.exec:\hfhvl.exe38⤵
- Executes dropped EXE
PID:2352 -
\??\c:\brbrnx.exec:\brbrnx.exe39⤵
- Executes dropped EXE
PID:3060 -
\??\c:\ltvxpr.exec:\ltvxpr.exe40⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vftpd.exec:\vftpd.exe41⤵
- Executes dropped EXE
PID:2792 -
\??\c:\dlpdf.exec:\dlpdf.exe42⤵
- Executes dropped EXE
PID:2788 -
\??\c:\hvtbr.exec:\hvtbr.exe43⤵
- Executes dropped EXE
PID:2932 -
\??\c:\btpfdvp.exec:\btpfdvp.exe44⤵
- Executes dropped EXE
PID:3056 -
\??\c:\ltttvjt.exec:\ltttvjt.exe45⤵
- Executes dropped EXE
PID:2168 -
\??\c:\rjljf.exec:\rjljf.exe46⤵
- Executes dropped EXE
PID:2824 -
\??\c:\tfrnxlj.exec:\tfrnxlj.exe47⤵
- Executes dropped EXE
PID:2672 -
\??\c:\nrdft.exec:\nrdft.exe48⤵
- Executes dropped EXE
PID:2616 -
\??\c:\nvhprn.exec:\nvhprn.exe49⤵
- Executes dropped EXE
PID:1804 -
\??\c:\njthp.exec:\njthp.exe50⤵
- Executes dropped EXE
PID:1548 -
\??\c:\bdhltdr.exec:\bdhltdr.exe51⤵
- Executes dropped EXE
PID:2312 -
\??\c:\ptxphh.exec:\ptxphh.exe52⤵
- Executes dropped EXE
PID:624 -
\??\c:\bljrvd.exec:\bljrvd.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:796 -
\??\c:\vxflfdt.exec:\vxflfdt.exe54⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ltlxjr.exec:\ltlxjr.exe55⤵
- Executes dropped EXE
PID:1948 -
\??\c:\fdvfnf.exec:\fdvfnf.exe56⤵
- Executes dropped EXE
PID:1944 -
\??\c:\fxdrvpj.exec:\fxdrvpj.exe57⤵
- Executes dropped EXE
PID:2868 -
\??\c:\nnxxdp.exec:\nnxxdp.exe58⤵
- Executes dropped EXE
PID:2324 -
\??\c:\bhnlx.exec:\bhnlx.exe59⤵
- Executes dropped EXE
PID:1028 -
\??\c:\llvlp.exec:\llvlp.exe60⤵
- Executes dropped EXE
PID:2404 -
\??\c:\vlffb.exec:\vlffb.exe61⤵
- Executes dropped EXE
PID:1476 -
\??\c:\pdblvjp.exec:\pdblvjp.exe62⤵
- Executes dropped EXE
PID:2180 -
\??\c:\jvfprt.exec:\jvfprt.exe63⤵
- Executes dropped EXE
PID:896 -
\??\c:\npdpf.exec:\npdpf.exe64⤵
- Executes dropped EXE
PID:1788 -
\??\c:\bhdxdpx.exec:\bhdxdpx.exe65⤵
- Executes dropped EXE
PID:960 -
\??\c:\pvpdp.exec:\pvpdp.exe66⤵PID:1048
-
\??\c:\rpnptt.exec:\rpnptt.exe67⤵PID:1688
-
\??\c:\fprfl.exec:\fprfl.exe68⤵PID:1556
-
\??\c:\hrbpxpp.exec:\hrbpxpp.exe69⤵PID:1504
-
\??\c:\hvvvpf.exec:\hvvvpf.exe70⤵PID:544
-
\??\c:\ljplpln.exec:\ljplpln.exe71⤵PID:316
-
\??\c:\rnbpph.exec:\rnbpph.exe72⤵PID:676
-
\??\c:\xjdnrxj.exec:\xjdnrxj.exe73⤵PID:2116
-
\??\c:\fvptdp.exec:\fvptdp.exe74⤵PID:1624
-
\??\c:\ttfdj.exec:\ttfdj.exe75⤵PID:1576
-
\??\c:\hlnpxv.exec:\hlnpxv.exe76⤵PID:2356
-
\??\c:\djfhnp.exec:\djfhnp.exe77⤵PID:2348
-
\??\c:\tldvbr.exec:\tldvbr.exe78⤵PID:2308
-
\??\c:\pltlttl.exec:\pltlttl.exe79⤵PID:2508
-
\??\c:\jvtlln.exec:\jvtlln.exe80⤵PID:2352
-
\??\c:\hljvv.exec:\hljvv.exe81⤵PID:3060
-
\??\c:\bdhfpxr.exec:\bdhfpxr.exe82⤵PID:2176
-
\??\c:\xpbdfpb.exec:\xpbdfpb.exe83⤵PID:2220
-
\??\c:\hdjnjvh.exec:\hdjnjvh.exe84⤵PID:2660
-
\??\c:\npvdbt.exec:\npvdbt.exe85⤵PID:2812
-
\??\c:\rdjvj.exec:\rdjvj.exe86⤵PID:3056
-
\??\c:\dfdttv.exec:\dfdttv.exe87⤵PID:2168
-
\??\c:\ldvdxbl.exec:\ldvdxbl.exe88⤵PID:2652
-
\??\c:\tfthf.exec:\tfthf.exe89⤵PID:2696
-
\??\c:\tjrhbj.exec:\tjrhbj.exe90⤵PID:2632
-
\??\c:\trlhr.exec:\trlhr.exe91⤵PID:2992
-
\??\c:\dhdnxdr.exec:\dhdnxdr.exe92⤵PID:924
-
\??\c:\nrbrl.exec:\nrbrl.exe93⤵PID:2884
-
\??\c:\njjllxd.exec:\njjllxd.exe94⤵PID:1608
-
\??\c:\ptjxfj.exec:\ptjxfj.exe95⤵PID:2540
-
\??\c:\rdvpr.exec:\rdvpr.exe96⤵PID:1376
-
\??\c:\frvxdft.exec:\frvxdft.exe97⤵PID:2040
-
\??\c:\djlvlfn.exec:\djlvlfn.exe98⤵PID:2964
-
\??\c:\nfnpd.exec:\nfnpd.exe99⤵PID:2516
-
\??\c:\bvrxfdb.exec:\bvrxfdb.exe100⤵PID:2284
-
\??\c:\ptxrpjv.exec:\ptxrpjv.exe101⤵PID:1860
-
\??\c:\pbbxv.exec:\pbbxv.exe102⤵
- System Location Discovery: System Language Discovery
PID:936 -
\??\c:\jnpvtlh.exec:\jnpvtlh.exe103⤵PID:3028
-
\??\c:\jfdxjb.exec:\jfdxjb.exe104⤵PID:3016
-
\??\c:\xjvxj.exec:\xjvxj.exe105⤵PID:1252
-
\??\c:\hndtjdn.exec:\hndtjdn.exe106⤵PID:2548
-
\??\c:\nplprht.exec:\nplprht.exe107⤵PID:1004
-
\??\c:\ntdldnp.exec:\ntdldnp.exe108⤵PID:1680
-
\??\c:\dftfrv.exec:\dftfrv.exe109⤵PID:680
-
\??\c:\rppjt.exec:\rppjt.exe110⤵PID:264
-
\??\c:\hfddx.exec:\hfddx.exe111⤵PID:2300
-
\??\c:\tfpfjp.exec:\tfpfjp.exe112⤵PID:1324
-
\??\c:\pvvnbjr.exec:\pvvnbjr.exe113⤵PID:2576
-
\??\c:\lvtbh.exec:\lvtbh.exe114⤵PID:2272
-
\??\c:\dbxfpr.exec:\dbxfpr.exe115⤵PID:2228
-
\??\c:\hjlvv.exec:\hjlvv.exe116⤵PID:1632
-
\??\c:\hnpjt.exec:\hnpjt.exe117⤵PID:1564
-
\??\c:\xjfvjnl.exec:\xjfvjnl.exe118⤵PID:2356
-
\??\c:\xndptdx.exec:\xndptdx.exe119⤵PID:2348
-
\??\c:\hdnjhdv.exec:\hdnjhdv.exe120⤵PID:1972
-
\??\c:\xdpnxj.exec:\xdpnxj.exe121⤵
- System Location Discovery: System Language Discovery
PID:2424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-