Analysis
-
max time kernel
107s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 05:17
Behavioral task
behavioral1
Sample
145a6da3d5d1d025e246c26267f6b9c318df1aa23ec2d703f108b1dceec479e0N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
145a6da3d5d1d025e246c26267f6b9c318df1aa23ec2d703f108b1dceec479e0N.exe
-
Size
142KB
-
MD5
b525ca3a5f9eea968a3a509ac6998560
-
SHA1
96706651ceeefd6bf2564c61d2693a64eaa30982
-
SHA256
145a6da3d5d1d025e246c26267f6b9c318df1aa23ec2d703f108b1dceec479e0
-
SHA512
d0191aa932932f80689948529e5e1ef7eff9f76f752aa9ff4052c0a4c8f247f398984350dfadaac667efa42debcaef7a5795e4884b3ca521e8d6ea298518a222
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BfDKPeGrR+G:kcm4FmowdHoSphraHcpOaKHcG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/1952-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1300-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-127-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2340-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1944-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1140-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1836-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1784-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-281-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1636-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-326-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2600-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-417-0x00000000002E0000-0x0000000000307000-memory.dmp family_blackmoon behavioral1/memory/3044-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2192-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1152-482-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2428-521-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2088-528-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2172-535-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-548-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-563-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2120-606-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-619-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-655-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-668-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-703-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1716-875-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2660-894-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1716-893-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2964-966-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/940-979-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1904-1012-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/276-1051-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2140-1095-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2864-1152-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2928-1196-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2016 vfdjdb.exe 2884 fhtdrt.exe 1300 xfxnrbv.exe 2856 ddplbpd.exe 2600 dfbllr.exe 2848 hvbxrtt.exe 2732 lbrplph.exe 2588 ptnhbhf.exe 2764 hptdnrn.exe 2372 vdxbdrr.exe 2652 btbhhnv.exe 2900 vpvft.exe 2888 bdnbjb.exe 460 hxbfh.exe 1508 rdjjfd.exe 1908 fpdbdvh.exe 2340 fxdrt.exe 1944 jnbfpf.exe 3056 tbrrh.exe 1140 tbpfh.exe 1468 rbrrfx.exe 1836 hpxdxh.exe 2228 dftvjjx.exe 1904 xfrhp.exe 2432 nfxnhx.exe 2972 bnfrfl.exe 2444 xxvhpt.exe 2540 hpftlj.exe 1784 vflxlr.exe 1284 bvtjjtr.exe 1636 vjxhtp.exe 2536 rjjdn.exe 2140 brptbdv.exe 2320 vvrrh.exe 2796 tbhddpx.exe 2704 lfthhpb.exe 2752 rfrjhx.exe 2720 rvfxp.exe 2600 xxdtl.exe 2640 hfjdf.exe 2760 nlvrn.exe 2668 pnhnpx.exe 2240 xjthfdv.exe 2644 ndhfdbb.exe 1536 xdljvv.exe 2840 dvdjrrn.exe 2580 rvbvjfb.exe 2992 fndbf.exe 2896 fvrvpvp.exe 520 tdjlr.exe 952 hprvthp.exe 2200 vbpxfxb.exe 3044 rfrbt.exe 2008 jrhvlbp.exe 2192 tljjdr.exe 1944 hddrv.exe 1752 hvblrvd.exe 1196 rtfxp.exe 1168 lhhff.exe 1468 lrvtjx.exe 1152 hptfh.exe 932 rjpth.exe 1552 pjjdvnd.exe 2132 lhjfj.exe -
resource yara_rule behavioral1/memory/1952-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016cf0-18.dat upx behavioral1/files/0x0009000000016ace-10.dat upx behavioral1/memory/2016-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1952-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2016-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d0c-27.dat upx behavioral1/memory/1300-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2884-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1300-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d1c-36.dat upx behavioral1/files/0x0009000000016d3f-46.dat upx behavioral1/memory/2856-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2848-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0002000000018334-56.dat upx behavioral1/files/0x0006000000018b28-66.dat upx behavioral1/memory/2732-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2848-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2600-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b50-76.dat upx behavioral1/files/0x0006000000018b54-83.dat upx behavioral1/files/0x0006000000018b64-100.dat upx behavioral1/memory/2372-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b59-92.dat upx behavioral1/files/0x0006000000018b89-118.dat upx behavioral1/memory/2900-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b71-110.dat upx behavioral1/memory/2652-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016ccc-130.dat upx behavioral1/memory/1508-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018bbf-147.dat upx behavioral1/files/0x0006000000018baf-137.dat upx behavioral1/files/0x0006000000018bd7-154.dat upx behavioral1/memory/2888-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-126-0x00000000002C0000-0x00000000002E7000-memory.dmp upx behavioral1/files/0x0006000000018f85-163.dat upx behavioral1/memory/2340-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1944-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019326-169.dat upx behavioral1/memory/3056-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001932a-182.dat upx behavioral1/files/0x0005000000019394-191.dat upx behavioral1/memory/1140-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193a0-199.dat upx behavioral1/memory/1836-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193b8-208.dat upx behavioral1/files/0x0005000000019470-225.dat upx behavioral1/files/0x00050000000193c7-218.dat upx behavioral1/memory/1904-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019480-233.dat upx behavioral1/files/0x0005000000019489-241.dat upx behavioral1/memory/2444-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001948c-251.dat upx behavioral1/files/0x0005000000019490-258.dat upx behavioral1/files/0x00050000000194a3-267.dat upx behavioral1/memory/1784-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194eb-275.dat upx behavioral1/memory/1636-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ef-287.dat upx behavioral1/memory/2536-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2536-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2704-314-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2600-333-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2760-351-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnxxpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnthnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndhfdbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppxpfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thphj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfjdjvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvrvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhffb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfjlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjrtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxdlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfnlxrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpnlrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxvvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnfxhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djhxnrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhfnrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdxxtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbdxtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llvrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxbvxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfjhrbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hppllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjldrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhtrtbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfxpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfdbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhfdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njvhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltjffjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npxtpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvfvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvntlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdxnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rftbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtfrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtfhnjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjhvxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtfxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdxhtt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1952 wrote to memory of 2016 1952 145a6da3d5d1d025e246c26267f6b9c318df1aa23ec2d703f108b1dceec479e0N.exe 31 PID 1952 wrote to memory of 2016 1952 145a6da3d5d1d025e246c26267f6b9c318df1aa23ec2d703f108b1dceec479e0N.exe 31 PID 1952 wrote to memory of 2016 1952 145a6da3d5d1d025e246c26267f6b9c318df1aa23ec2d703f108b1dceec479e0N.exe 31 PID 1952 wrote to memory of 2016 1952 145a6da3d5d1d025e246c26267f6b9c318df1aa23ec2d703f108b1dceec479e0N.exe 31 PID 2016 wrote to memory of 2884 2016 vfdjdb.exe 32 PID 2016 wrote to memory of 2884 2016 vfdjdb.exe 32 PID 2016 wrote to memory of 2884 2016 vfdjdb.exe 32 PID 2016 wrote to memory of 2884 2016 vfdjdb.exe 32 PID 2884 wrote to memory of 1300 2884 fhtdrt.exe 33 PID 2884 wrote to memory of 1300 2884 fhtdrt.exe 33 PID 2884 wrote to memory of 1300 2884 fhtdrt.exe 33 PID 2884 wrote to memory of 1300 2884 fhtdrt.exe 33 PID 1300 wrote to memory of 2856 1300 xfxnrbv.exe 34 PID 1300 wrote to memory of 2856 1300 xfxnrbv.exe 34 PID 1300 wrote to memory of 2856 1300 xfxnrbv.exe 34 PID 1300 wrote to memory of 2856 1300 xfxnrbv.exe 34 PID 2856 wrote to memory of 2600 2856 ddplbpd.exe 35 PID 2856 wrote to memory of 2600 2856 ddplbpd.exe 35 PID 2856 wrote to memory of 2600 2856 ddplbpd.exe 35 PID 2856 wrote to memory of 2600 2856 ddplbpd.exe 35 PID 2600 wrote to memory of 2848 2600 dfbllr.exe 36 PID 2600 wrote to memory of 2848 2600 dfbllr.exe 36 PID 2600 wrote to memory of 2848 2600 dfbllr.exe 36 PID 2600 wrote to memory of 2848 2600 dfbllr.exe 36 PID 2848 wrote to memory of 2732 2848 hvbxrtt.exe 37 PID 2848 wrote to memory of 2732 2848 hvbxrtt.exe 37 PID 2848 wrote to memory of 2732 2848 hvbxrtt.exe 37 PID 2848 wrote to memory of 2732 2848 hvbxrtt.exe 37 PID 2732 wrote to memory of 2588 2732 lbrplph.exe 38 PID 2732 wrote to memory of 2588 2732 lbrplph.exe 38 PID 2732 wrote to memory of 2588 2732 lbrplph.exe 38 PID 2732 wrote to memory of 2588 2732 lbrplph.exe 38 PID 2588 wrote to memory of 2764 2588 ptnhbhf.exe 39 PID 2588 wrote to memory of 2764 2588 ptnhbhf.exe 39 PID 2588 wrote to memory of 2764 2588 ptnhbhf.exe 39 PID 2588 wrote to memory of 2764 2588 ptnhbhf.exe 39 PID 2764 wrote to memory of 2372 2764 hptdnrn.exe 40 PID 2764 wrote to memory of 2372 2764 hptdnrn.exe 40 PID 2764 wrote to memory of 2372 2764 hptdnrn.exe 40 PID 2764 wrote to memory of 2372 2764 hptdnrn.exe 40 PID 2372 wrote to memory of 2652 2372 vdxbdrr.exe 41 PID 2372 wrote to memory of 2652 2372 vdxbdrr.exe 41 PID 2372 wrote to memory of 2652 2372 vdxbdrr.exe 41 PID 2372 wrote to memory of 2652 2372 vdxbdrr.exe 41 PID 2652 wrote to memory of 2900 2652 btbhhnv.exe 42 PID 2652 wrote to memory of 2900 2652 btbhhnv.exe 42 PID 2652 wrote to memory of 2900 2652 btbhhnv.exe 42 PID 2652 wrote to memory of 2900 2652 btbhhnv.exe 42 PID 2900 wrote to memory of 2888 2900 vpvft.exe 43 PID 2900 wrote to memory of 2888 2900 vpvft.exe 43 PID 2900 wrote to memory of 2888 2900 vpvft.exe 43 PID 2900 wrote to memory of 2888 2900 vpvft.exe 43 PID 2888 wrote to memory of 460 2888 bdnbjb.exe 44 PID 2888 wrote to memory of 460 2888 bdnbjb.exe 44 PID 2888 wrote to memory of 460 2888 bdnbjb.exe 44 PID 2888 wrote to memory of 460 2888 bdnbjb.exe 44 PID 460 wrote to memory of 1508 460 hxbfh.exe 45 PID 460 wrote to memory of 1508 460 hxbfh.exe 45 PID 460 wrote to memory of 1508 460 hxbfh.exe 45 PID 460 wrote to memory of 1508 460 hxbfh.exe 45 PID 1508 wrote to memory of 1908 1508 rdjjfd.exe 46 PID 1508 wrote to memory of 1908 1508 rdjjfd.exe 46 PID 1508 wrote to memory of 1908 1508 rdjjfd.exe 46 PID 1508 wrote to memory of 1908 1508 rdjjfd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\145a6da3d5d1d025e246c26267f6b9c318df1aa23ec2d703f108b1dceec479e0N.exe"C:\Users\Admin\AppData\Local\Temp\145a6da3d5d1d025e246c26267f6b9c318df1aa23ec2d703f108b1dceec479e0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\vfdjdb.exec:\vfdjdb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\fhtdrt.exec:\fhtdrt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\xfxnrbv.exec:\xfxnrbv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\ddplbpd.exec:\ddplbpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\dfbllr.exec:\dfbllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\hvbxrtt.exec:\hvbxrtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\lbrplph.exec:\lbrplph.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\ptnhbhf.exec:\ptnhbhf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\hptdnrn.exec:\hptdnrn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\vdxbdrr.exec:\vdxbdrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\btbhhnv.exec:\btbhhnv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\vpvft.exec:\vpvft.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\bdnbjb.exec:\bdnbjb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\hxbfh.exec:\hxbfh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
\??\c:\rdjjfd.exec:\rdjjfd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\fpdbdvh.exec:\fpdbdvh.exe17⤵
- Executes dropped EXE
PID:1908 -
\??\c:\fxdrt.exec:\fxdrt.exe18⤵
- Executes dropped EXE
PID:2340 -
\??\c:\jnbfpf.exec:\jnbfpf.exe19⤵
- Executes dropped EXE
PID:1944 -
\??\c:\tbrrh.exec:\tbrrh.exe20⤵
- Executes dropped EXE
PID:3056 -
\??\c:\tbpfh.exec:\tbpfh.exe21⤵
- Executes dropped EXE
PID:1140 -
\??\c:\rbrrfx.exec:\rbrrfx.exe22⤵
- Executes dropped EXE
PID:1468 -
\??\c:\hpxdxh.exec:\hpxdxh.exe23⤵
- Executes dropped EXE
PID:1836 -
\??\c:\dftvjjx.exec:\dftvjjx.exe24⤵
- Executes dropped EXE
PID:2228 -
\??\c:\xfrhp.exec:\xfrhp.exe25⤵
- Executes dropped EXE
PID:1904 -
\??\c:\nfxnhx.exec:\nfxnhx.exe26⤵
- Executes dropped EXE
PID:2432 -
\??\c:\bnfrfl.exec:\bnfrfl.exe27⤵
- Executes dropped EXE
PID:2972 -
\??\c:\xxvhpt.exec:\xxvhpt.exe28⤵
- Executes dropped EXE
PID:2444 -
\??\c:\hpftlj.exec:\hpftlj.exe29⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vflxlr.exec:\vflxlr.exe30⤵
- Executes dropped EXE
PID:1784 -
\??\c:\bvtjjtr.exec:\bvtjjtr.exe31⤵
- Executes dropped EXE
PID:1284 -
\??\c:\vjxhtp.exec:\vjxhtp.exe32⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rjjdn.exec:\rjjdn.exe33⤵
- Executes dropped EXE
PID:2536 -
\??\c:\brptbdv.exec:\brptbdv.exe34⤵
- Executes dropped EXE
PID:2140 -
\??\c:\vvrrh.exec:\vvrrh.exe35⤵
- Executes dropped EXE
PID:2320 -
\??\c:\tbhddpx.exec:\tbhddpx.exe36⤵
- Executes dropped EXE
PID:2796 -
\??\c:\lfthhpb.exec:\lfthhpb.exe37⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rfrjhx.exec:\rfrjhx.exe38⤵
- Executes dropped EXE
PID:2752 -
\??\c:\rvfxp.exec:\rvfxp.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\xxdtl.exec:\xxdtl.exe40⤵
- Executes dropped EXE
PID:2600 -
\??\c:\hfjdf.exec:\hfjdf.exe41⤵
- Executes dropped EXE
PID:2640 -
\??\c:\nlvrn.exec:\nlvrn.exe42⤵
- Executes dropped EXE
PID:2760 -
\??\c:\pnhnpx.exec:\pnhnpx.exe43⤵
- Executes dropped EXE
PID:2668 -
\??\c:\xjthfdv.exec:\xjthfdv.exe44⤵
- Executes dropped EXE
PID:2240 -
\??\c:\ndhfdbb.exec:\ndhfdbb.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2644 -
\??\c:\xdljvv.exec:\xdljvv.exe46⤵
- Executes dropped EXE
PID:1536 -
\??\c:\dvdjrrn.exec:\dvdjrrn.exe47⤵
- Executes dropped EXE
PID:2840 -
\??\c:\rvbvjfb.exec:\rvbvjfb.exe48⤵
- Executes dropped EXE
PID:2580 -
\??\c:\fndbf.exec:\fndbf.exe49⤵
- Executes dropped EXE
PID:2992 -
\??\c:\fvrvpvp.exec:\fvrvpvp.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2896 -
\??\c:\tdjlr.exec:\tdjlr.exe51⤵
- Executes dropped EXE
PID:520 -
\??\c:\hprvthp.exec:\hprvthp.exe52⤵
- Executes dropped EXE
PID:952 -
\??\c:\vbpxfxb.exec:\vbpxfxb.exe53⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rfrbt.exec:\rfrbt.exe54⤵
- Executes dropped EXE
PID:3044 -
\??\c:\jrhvlbp.exec:\jrhvlbp.exe55⤵
- Executes dropped EXE
PID:2008 -
\??\c:\tljjdr.exec:\tljjdr.exe56⤵
- Executes dropped EXE
PID:2192 -
\??\c:\hddrv.exec:\hddrv.exe57⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hvblrvd.exec:\hvblrvd.exe58⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rtfxp.exec:\rtfxp.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1196 -
\??\c:\lhhff.exec:\lhhff.exe60⤵
- Executes dropped EXE
PID:1168 -
\??\c:\lrvtjx.exec:\lrvtjx.exe61⤵
- Executes dropped EXE
PID:1468 -
\??\c:\hptfh.exec:\hptfh.exe62⤵
- Executes dropped EXE
PID:1152 -
\??\c:\rjpth.exec:\rjpth.exe63⤵
- Executes dropped EXE
PID:932 -
\??\c:\pjjdvnd.exec:\pjjdvnd.exe64⤵
- Executes dropped EXE
PID:1552 -
\??\c:\lhjfj.exec:\lhjfj.exe65⤵
- Executes dropped EXE
PID:2132 -
\??\c:\nldbfd.exec:\nldbfd.exe66⤵PID:2432
-
\??\c:\bpnlrp.exec:\bpnlrp.exe67⤵
- System Location Discovery: System Language Discovery
PID:548 -
\??\c:\fjddt.exec:\fjddt.exe68⤵PID:2428
-
\??\c:\pxfdhpl.exec:\pxfdhpl.exe69⤵PID:2088
-
\??\c:\xjpph.exec:\xjpph.exe70⤵PID:2172
-
\??\c:\pnjfvn.exec:\pnjfvn.exe71⤵PID:884
-
\??\c:\bndndd.exec:\bndndd.exe72⤵PID:2528
-
\??\c:\htjfpln.exec:\htjfpln.exe73⤵PID:1480
-
\??\c:\rfbhh.exec:\rfbhh.exe74⤵PID:2476
-
\??\c:\xdjht.exec:\xdjht.exe75⤵PID:2780
-
\??\c:\fhvvh.exec:\fhvvh.exe76⤵PID:1596
-
\??\c:\pbpfb.exec:\pbpfb.exe77⤵PID:1852
-
\??\c:\lxvvt.exec:\lxvvt.exe78⤵PID:2808
-
\??\c:\nlhddtj.exec:\nlhddtj.exe79⤵PID:2828
-
\??\c:\fhpnlnh.exec:\fhpnlnh.exe80⤵PID:2752
-
\??\c:\lxbjpxl.exec:\lxbjpxl.exe81⤵PID:2120
-
\??\c:\pprjflj.exec:\pprjflj.exe82⤵PID:2600
-
\??\c:\xfdbhnh.exec:\xfdbhnh.exe83⤵
- System Location Discovery: System Language Discovery
PID:2864 -
\??\c:\xnndh.exec:\xnndh.exe84⤵PID:2820
-
\??\c:\bprvxn.exec:\bprvxn.exe85⤵PID:2672
-
\??\c:\ptpbhp.exec:\ptpbhp.exe86⤵PID:2188
-
\??\c:\dphjf.exec:\dphjf.exe87⤵PID:664
-
\??\c:\vfjfrjd.exec:\vfjfrjd.exe88⤵PID:3000
-
\??\c:\hvrvj.exec:\hvrvj.exe89⤵PID:2912
-
\??\c:\pdlfhh.exec:\pdlfhh.exe90⤵PID:2784
-
\??\c:\hlphhxx.exec:\hlphhxx.exe91⤵PID:516
-
\??\c:\hthjxbd.exec:\hthjxbd.exe92⤵PID:1508
-
\??\c:\rrbrnrf.exec:\rrbrnrf.exe93⤵PID:2772
-
\??\c:\nbdvjfn.exec:\nbdvjfn.exe94⤵PID:1608
-
\??\c:\lrxtddj.exec:\lrxtddj.exe95⤵PID:2692
-
\??\c:\ddtdr.exec:\ddtdr.exe96⤵PID:2520
-
\??\c:\bjlddfn.exec:\bjlddfn.exe97⤵PID:2208
-
\??\c:\vtxjth.exec:\vtxjth.exe98⤵PID:812
-
\??\c:\lbnhjf.exec:\lbnhjf.exe99⤵PID:1200
-
\??\c:\tttbll.exec:\tttbll.exe100⤵PID:844
-
\??\c:\hppllf.exec:\hppllf.exe101⤵
- System Location Discovery: System Language Discovery
PID:644 -
\??\c:\prhfxnf.exec:\prhfxnf.exe102⤵PID:288
-
\??\c:\vlnfpr.exec:\vlnfpr.exe103⤵PID:1528
-
\??\c:\tfphvff.exec:\tfphvff.exe104⤵PID:1152
-
\??\c:\rfvhjl.exec:\rfvhjl.exe105⤵PID:1008
-
\??\c:\ntjrvlb.exec:\ntjrvlb.exe106⤵PID:2012
-
\??\c:\jntxh.exec:\jntxh.exe107⤵PID:836
-
\??\c:\nnnrxth.exec:\nnnrxth.exe108⤵PID:2276
-
\??\c:\hvhjjx.exec:\hvhjjx.exe109⤵PID:2252
-
\??\c:\pbfxvr.exec:\pbfxvr.exe110⤵PID:2540
-
\??\c:\vxlthrx.exec:\vxlthrx.exe111⤵PID:2128
-
\??\c:\dhxbb.exec:\dhxbb.exe112⤵PID:2172
-
\??\c:\rxjvd.exec:\rxjvd.exe113⤵PID:1952
-
\??\c:\jjldrt.exec:\jjldrt.exe114⤵
- System Location Discovery: System Language Discovery
PID:2528 -
\??\c:\fbtjnd.exec:\fbtjnd.exe115⤵PID:1068
-
\??\c:\brtlpv.exec:\brtlpv.exe116⤵PID:2476
-
\??\c:\pflxdtf.exec:\pflxdtf.exe117⤵PID:2780
-
\??\c:\vvtnp.exec:\vvtnp.exe118⤵PID:2740
-
\??\c:\ndvnr.exec:\ndvnr.exe119⤵PID:1852
-
\??\c:\jvxhx.exec:\jvxhx.exe120⤵PID:2808
-
\??\c:\jrbflj.exec:\jrbflj.exe121⤵PID:2828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-