Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 06:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3c3ca734e2520d29a08670819ae17dc47de184828d7eba5c2e3da73e5b5a9319.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
3c3ca734e2520d29a08670819ae17dc47de184828d7eba5c2e3da73e5b5a9319.exe
-
Size
453KB
-
MD5
d39bb7af27f102defd19429d31a5fa5c
-
SHA1
b2f1643aff977d2f033b7abbdda630dbb6e99b3f
-
SHA256
3c3ca734e2520d29a08670819ae17dc47de184828d7eba5c2e3da73e5b5a9319
-
SHA512
d1a6cc077666f1586b5193d6ae3d66c68830b90142b04cce8a2b82d2f64b62bab7225a886038f899251ee4a5af6865641cd8c707cc08fb74f21fa505d24dd391
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbec:q7Tc2NYHUrAwfMp3CDc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2384-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-28-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3044-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1384-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-45-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2884-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-174-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2100-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/396-217-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2328-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-260-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2216-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-275-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2272-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-309-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2068-338-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2804-363-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2152-372-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2116-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-500-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/864-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-563-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/820-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-592-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2912-653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-725-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-732-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1488-739-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/560-774-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/968-807-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2384 pjrfdl.exe 3044 fnffjp.exe 1384 lppdn.exe 2360 fdnth.exe 2884 jjxdb.exe 3052 hhpvntj.exe 3008 fhxxn.exe 2852 nffdh.exe 2688 nrvnv.exe 2120 vfrjx.exe 2032 tbjllt.exe 3024 jxdrnvj.exe 1964 nhjhrp.exe 1644 hdtjtl.exe 1080 ndrlr.exe 1488 dddhfp.exe 1976 pthxxx.exe 2940 trxhf.exe 2252 ldplf.exe 2100 ftvvb.exe 2424 tbfnvtf.exe 396 pxxxf.exe 1064 pxpvpht.exe 1552 fvlbnvr.exe 2328 pnttt.exe 1184 pbfjjx.exe 1884 blnbd.exe 2216 frvvhdn.exe 2272 xlnpj.exe 2444 frnvfb.exe 2480 nnlxfl.exe 1916 ddxrfj.exe 2060 hjtlvbn.exe 1756 jnffhhj.exe 2112 xrrlph.exe 2600 hdffj.exe 2068 blpjjl.exe 584 tvljfv.exe 2152 vjbvhb.exe 2924 ddtvjjf.exe 2804 blvhn.exe 3052 htxpp.exe 3008 plpbh.exe 2896 drdppv.exe 2680 vhvxnpf.exe 2204 frbblrx.exe 2116 ljvtx.exe 1200 ntbfp.exe 1664 bffjhh.exe 1188 lxfhxd.exe 2576 drpdpb.exe 1644 vxvvl.exe 2008 npltvj.exe 2004 hhvxfdn.exe 1988 hnprj.exe 2976 vpxjd.exe 2280 xvfvj.exe 1696 pbhnbn.exe 2464 dffbnl.exe 2348 dpbnlp.exe 2424 jntnb.exe 1700 blrnphn.exe 656 frhnjbd.exe 1616 dffhfrv.exe -
resource yara_rule behavioral1/memory/2384-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-351-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/3052-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-372-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2204-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-421-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2280-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-563-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/820-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-592-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/2912-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/968-807-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnjvdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjphl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvbnrft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvjdbrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjfxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljvnvrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxbvfnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnplj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvrvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fppln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdlxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxnvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbvnhvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fftrjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jptnbfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxbhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpjbxvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnfvbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvnprx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhfdvfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dffbnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjrdvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljbfppn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttdrjlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhrvxvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvtfjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pthxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbtdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jflhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pttxpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pptrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfjbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfldlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2384 2060 3c3ca734e2520d29a08670819ae17dc47de184828d7eba5c2e3da73e5b5a9319.exe 30 PID 2060 wrote to memory of 2384 2060 3c3ca734e2520d29a08670819ae17dc47de184828d7eba5c2e3da73e5b5a9319.exe 30 PID 2060 wrote to memory of 2384 2060 3c3ca734e2520d29a08670819ae17dc47de184828d7eba5c2e3da73e5b5a9319.exe 30 PID 2060 wrote to memory of 2384 2060 3c3ca734e2520d29a08670819ae17dc47de184828d7eba5c2e3da73e5b5a9319.exe 30 PID 2384 wrote to memory of 3044 2384 pjrfdl.exe 31 PID 2384 wrote to memory of 3044 2384 pjrfdl.exe 31 PID 2384 wrote to memory of 3044 2384 pjrfdl.exe 31 PID 2384 wrote to memory of 3044 2384 pjrfdl.exe 31 PID 3044 wrote to memory of 1384 3044 fnffjp.exe 32 PID 3044 wrote to memory of 1384 3044 fnffjp.exe 32 PID 3044 wrote to memory of 1384 3044 fnffjp.exe 32 PID 3044 wrote to memory of 1384 3044 fnffjp.exe 32 PID 1384 wrote to memory of 2360 1384 lppdn.exe 33 PID 1384 wrote to memory of 2360 1384 lppdn.exe 33 PID 1384 wrote to memory of 2360 1384 lppdn.exe 33 PID 1384 wrote to memory of 2360 1384 lppdn.exe 33 PID 2360 wrote to memory of 2884 2360 fdnth.exe 34 PID 2360 wrote to memory of 2884 2360 fdnth.exe 34 PID 2360 wrote to memory of 2884 2360 fdnth.exe 34 PID 2360 wrote to memory of 2884 2360 fdnth.exe 34 PID 2884 wrote to memory of 3052 2884 jjxdb.exe 35 PID 2884 wrote to memory of 3052 2884 jjxdb.exe 35 PID 2884 wrote to memory of 3052 2884 jjxdb.exe 35 PID 2884 wrote to memory of 3052 2884 jjxdb.exe 35 PID 3052 wrote to memory of 3008 3052 hhpvntj.exe 36 PID 3052 wrote to memory of 3008 3052 hhpvntj.exe 36 PID 3052 wrote to memory of 3008 3052 hhpvntj.exe 36 PID 3052 wrote to memory of 3008 3052 hhpvntj.exe 36 PID 3008 wrote to memory of 2852 3008 fhxxn.exe 37 PID 3008 wrote to memory of 2852 3008 fhxxn.exe 37 PID 3008 wrote to memory of 2852 3008 fhxxn.exe 37 PID 3008 wrote to memory of 2852 3008 fhxxn.exe 37 PID 2852 wrote to memory of 2688 2852 nffdh.exe 38 PID 2852 wrote to memory of 2688 2852 nffdh.exe 38 PID 2852 wrote to memory of 2688 2852 nffdh.exe 38 PID 2852 wrote to memory of 2688 2852 nffdh.exe 38 PID 2688 wrote to memory of 2120 2688 nrvnv.exe 39 PID 2688 wrote to memory of 2120 2688 nrvnv.exe 39 PID 2688 wrote to memory of 2120 2688 nrvnv.exe 39 PID 2688 wrote to memory of 2120 2688 nrvnv.exe 39 PID 2120 wrote to memory of 2032 2120 vfrjx.exe 40 PID 2120 wrote to memory of 2032 2120 vfrjx.exe 40 PID 2120 wrote to memory of 2032 2120 vfrjx.exe 40 PID 2120 wrote to memory of 2032 2120 vfrjx.exe 40 PID 2032 wrote to memory of 3024 2032 tbjllt.exe 41 PID 2032 wrote to memory of 3024 2032 tbjllt.exe 41 PID 2032 wrote to memory of 3024 2032 tbjllt.exe 41 PID 2032 wrote to memory of 3024 2032 tbjllt.exe 41 PID 3024 wrote to memory of 1964 3024 jxdrnvj.exe 42 PID 3024 wrote to memory of 1964 3024 jxdrnvj.exe 42 PID 3024 wrote to memory of 1964 3024 jxdrnvj.exe 42 PID 3024 wrote to memory of 1964 3024 jxdrnvj.exe 42 PID 1964 wrote to memory of 1644 1964 nhjhrp.exe 43 PID 1964 wrote to memory of 1644 1964 nhjhrp.exe 43 PID 1964 wrote to memory of 1644 1964 nhjhrp.exe 43 PID 1964 wrote to memory of 1644 1964 nhjhrp.exe 43 PID 1644 wrote to memory of 1080 1644 hdtjtl.exe 44 PID 1644 wrote to memory of 1080 1644 hdtjtl.exe 44 PID 1644 wrote to memory of 1080 1644 hdtjtl.exe 44 PID 1644 wrote to memory of 1080 1644 hdtjtl.exe 44 PID 1080 wrote to memory of 1488 1080 ndrlr.exe 45 PID 1080 wrote to memory of 1488 1080 ndrlr.exe 45 PID 1080 wrote to memory of 1488 1080 ndrlr.exe 45 PID 1080 wrote to memory of 1488 1080 ndrlr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c3ca734e2520d29a08670819ae17dc47de184828d7eba5c2e3da73e5b5a9319.exe"C:\Users\Admin\AppData\Local\Temp\3c3ca734e2520d29a08670819ae17dc47de184828d7eba5c2e3da73e5b5a9319.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\pjrfdl.exec:\pjrfdl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\fnffjp.exec:\fnffjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\lppdn.exec:\lppdn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\fdnth.exec:\fdnth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\jjxdb.exec:\jjxdb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\hhpvntj.exec:\hhpvntj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\fhxxn.exec:\fhxxn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\nffdh.exec:\nffdh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\nrvnv.exec:\nrvnv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\vfrjx.exec:\vfrjx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\tbjllt.exec:\tbjllt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\jxdrnvj.exec:\jxdrnvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\nhjhrp.exec:\nhjhrp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\hdtjtl.exec:\hdtjtl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\ndrlr.exec:\ndrlr.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\dddhfp.exec:\dddhfp.exe17⤵
- Executes dropped EXE
PID:1488 -
\??\c:\pthxxx.exec:\pthxxx.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1976 -
\??\c:\trxhf.exec:\trxhf.exe19⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ldplf.exec:\ldplf.exe20⤵
- Executes dropped EXE
PID:2252 -
\??\c:\ftvvb.exec:\ftvvb.exe21⤵
- Executes dropped EXE
PID:2100 -
\??\c:\tbfnvtf.exec:\tbfnvtf.exe22⤵
- Executes dropped EXE
PID:2424 -
\??\c:\pxxxf.exec:\pxxxf.exe23⤵
- Executes dropped EXE
PID:396 -
\??\c:\pxpvpht.exec:\pxpvpht.exe24⤵
- Executes dropped EXE
PID:1064 -
\??\c:\fvlbnvr.exec:\fvlbnvr.exe25⤵
- Executes dropped EXE
PID:1552 -
\??\c:\pnttt.exec:\pnttt.exe26⤵
- Executes dropped EXE
PID:2328 -
\??\c:\pbfjjx.exec:\pbfjjx.exe27⤵
- Executes dropped EXE
PID:1184 -
\??\c:\blnbd.exec:\blnbd.exe28⤵
- Executes dropped EXE
PID:1884 -
\??\c:\frvvhdn.exec:\frvvhdn.exe29⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xlnpj.exec:\xlnpj.exe30⤵
- Executes dropped EXE
PID:2272 -
\??\c:\frnvfb.exec:\frnvfb.exe31⤵
- Executes dropped EXE
PID:2444 -
\??\c:\nnlxfl.exec:\nnlxfl.exe32⤵
- Executes dropped EXE
PID:2480 -
\??\c:\ddxrfj.exec:\ddxrfj.exe33⤵
- Executes dropped EXE
PID:1916 -
\??\c:\hjtlvbn.exec:\hjtlvbn.exe34⤵
- Executes dropped EXE
PID:2060 -
\??\c:\jnffhhj.exec:\jnffhhj.exe35⤵
- Executes dropped EXE
PID:1756 -
\??\c:\xrrlph.exec:\xrrlph.exe36⤵
- Executes dropped EXE
PID:2112 -
\??\c:\hdffj.exec:\hdffj.exe37⤵
- Executes dropped EXE
PID:2600 -
\??\c:\blpjjl.exec:\blpjjl.exe38⤵
- Executes dropped EXE
PID:2068 -
\??\c:\tvljfv.exec:\tvljfv.exe39⤵
- Executes dropped EXE
PID:584 -
\??\c:\vjbvhb.exec:\vjbvhb.exe40⤵
- Executes dropped EXE
PID:2152 -
\??\c:\ddtvjjf.exec:\ddtvjjf.exe41⤵
- Executes dropped EXE
PID:2924 -
\??\c:\blvhn.exec:\blvhn.exe42⤵
- Executes dropped EXE
PID:2804 -
\??\c:\htxpp.exec:\htxpp.exe43⤵
- Executes dropped EXE
PID:3052 -
\??\c:\plpbh.exec:\plpbh.exe44⤵
- Executes dropped EXE
PID:3008 -
\??\c:\drdppv.exec:\drdppv.exe45⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vhvxnpf.exec:\vhvxnpf.exe46⤵
- Executes dropped EXE
PID:2680 -
\??\c:\frbblrx.exec:\frbblrx.exe47⤵
- Executes dropped EXE
PID:2204 -
\??\c:\ljvtx.exec:\ljvtx.exe48⤵
- Executes dropped EXE
PID:2116 -
\??\c:\ntbfp.exec:\ntbfp.exe49⤵
- Executes dropped EXE
PID:1200 -
\??\c:\bffjhh.exec:\bffjhh.exe50⤵
- Executes dropped EXE
PID:1664 -
\??\c:\lxfhxd.exec:\lxfhxd.exe51⤵
- Executes dropped EXE
PID:1188 -
\??\c:\drpdpb.exec:\drpdpb.exe52⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vxvvl.exec:\vxvvl.exe53⤵
- Executes dropped EXE
PID:1644 -
\??\c:\npltvj.exec:\npltvj.exe54⤵
- Executes dropped EXE
PID:2008 -
\??\c:\hhvxfdn.exec:\hhvxfdn.exe55⤵
- Executes dropped EXE
PID:2004 -
\??\c:\hnprj.exec:\hnprj.exe56⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vpxjd.exec:\vpxjd.exe57⤵
- Executes dropped EXE
PID:2976 -
\??\c:\xvfvj.exec:\xvfvj.exe58⤵
- Executes dropped EXE
PID:2280 -
\??\c:\pbhnbn.exec:\pbhnbn.exe59⤵
- Executes dropped EXE
PID:1696 -
\??\c:\dffbnl.exec:\dffbnl.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2464 -
\??\c:\dpbnlp.exec:\dpbnlp.exe61⤵
- Executes dropped EXE
PID:2348 -
\??\c:\jntnb.exec:\jntnb.exe62⤵
- Executes dropped EXE
PID:2424 -
\??\c:\blrnphn.exec:\blrnphn.exe63⤵
- Executes dropped EXE
PID:1700 -
\??\c:\frhnjbd.exec:\frhnjbd.exe64⤵
- Executes dropped EXE
PID:656 -
\??\c:\dffhfrv.exec:\dffhfrv.exe65⤵
- Executes dropped EXE
PID:1616 -
\??\c:\thxlfrj.exec:\thxlfrj.exe66⤵PID:968
-
\??\c:\vdvtv.exec:\vdvtv.exe67⤵PID:864
-
\??\c:\nlhnfl.exec:\nlhnfl.exe68⤵PID:1716
-
\??\c:\ltvht.exec:\ltvht.exe69⤵PID:1432
-
\??\c:\hffdftb.exec:\hffdftb.exe70⤵PID:1100
-
\??\c:\ftpbfv.exec:\ftpbfv.exe71⤵PID:1092
-
\??\c:\dxhpr.exec:\dxhpr.exe72⤵PID:2400
-
\??\c:\tpjbxvr.exec:\tpjbxvr.exe73⤵
- System Location Discovery: System Language Discovery
PID:820 -
\??\c:\jbbjnfl.exec:\jbbjnfl.exe74⤵PID:2320
-
\??\c:\nltfvt.exec:\nltfvt.exe75⤵PID:2480
-
\??\c:\tfbvvfx.exec:\tfbvvfx.exe76⤵PID:2620
-
\??\c:\dxllj.exec:\dxllj.exe77⤵PID:2092
-
\??\c:\ldlnhn.exec:\ldlnhn.exe78⤵PID:1756
-
\??\c:\xxhvf.exec:\xxhvf.exe79⤵PID:2112
-
\??\c:\nlfbttp.exec:\nlfbttp.exe80⤵PID:2532
-
\??\c:\rvhlp.exec:\rvhlp.exe81⤵PID:1692
-
\??\c:\ldhrrd.exec:\ldhrrd.exe82⤵PID:2832
-
\??\c:\jjxfjtp.exec:\jjxfjtp.exe83⤵PID:2952
-
\??\c:\nndvpt.exec:\nndvpt.exe84⤵PID:2712
-
\??\c:\pbfjhtv.exec:\pbfjhtv.exe85⤵PID:2912
-
\??\c:\hlfrff.exec:\hlfrff.exe86⤵PID:3052
-
\??\c:\jvfdt.exec:\jvfdt.exe87⤵PID:2696
-
\??\c:\jfvnrxt.exec:\jfvnrxt.exe88⤵PID:2752
-
\??\c:\vvlnftt.exec:\vvlnftt.exe89⤵PID:1532
-
\??\c:\vhbht.exec:\vhbht.exe90⤵PID:2800
-
\??\c:\pjxvj.exec:\pjxvj.exe91⤵PID:2284
-
\??\c:\jhbbtb.exec:\jhbbtb.exe92⤵PID:2736
-
\??\c:\hrlxl.exec:\hrlxl.exe93⤵PID:1504
-
\??\c:\xbvbx.exec:\xbvbx.exe94⤵PID:1208
-
\??\c:\tttbflt.exec:\tttbflt.exe95⤵PID:2064
-
\??\c:\xptbj.exec:\xptbj.exe96⤵PID:2996
-
\??\c:\jppxd.exec:\jppxd.exe97⤵PID:1972
-
\??\c:\bhtfjlp.exec:\bhtfjlp.exe98⤵PID:1488
-
\??\c:\txhhl.exec:\txhhl.exe99⤵PID:2984
-
\??\c:\lrdptl.exec:\lrdptl.exe100⤵PID:2268
-
\??\c:\pnxbt.exec:\pnxbt.exe101⤵PID:1612
-
\??\c:\fnxdth.exec:\fnxdth.exe102⤵PID:2132
-
\??\c:\bjlnr.exec:\bjlnr.exe103⤵PID:560
-
\??\c:\tfjbx.exec:\tfjbx.exe104⤵
- System Location Discovery: System Language Discovery
PID:2348 -
\??\c:\txfrjj.exec:\txfrjj.exe105⤵PID:2424
-
\??\c:\tvdhv.exec:\tvdhv.exe106⤵PID:1284
-
\??\c:\lnrnhj.exec:\lnrnhj.exe107⤵PID:988
-
\??\c:\lvtfrl.exec:\lvtfrl.exe108⤵PID:1616
-
\??\c:\rvpxxdd.exec:\rvpxxdd.exe109⤵PID:968
-
\??\c:\fhjbdd.exec:\fhjbdd.exe110⤵PID:1184
-
\??\c:\dbvrdn.exec:\dbvrdn.exe111⤵PID:1716
-
\??\c:\vdlxp.exec:\vdlxp.exe112⤵
- System Location Discovery: System Language Discovery
PID:580 -
\??\c:\hhnhnl.exec:\hhnhnl.exe113⤵PID:2312
-
\??\c:\xlhvrf.exec:\xlhvrf.exe114⤵PID:1892
-
\??\c:\xntrth.exec:\xntrth.exe115⤵PID:2400
-
\??\c:\drlfbfn.exec:\drlfbfn.exe116⤵PID:2520
-
\??\c:\fjffvl.exec:\fjffvl.exe117⤵PID:1944
-
\??\c:\nrjjrbn.exec:\nrjjrbn.exe118⤵PID:2580
-
\??\c:\jjlxh.exec:\jjlxh.exe119⤵PID:2080
-
\??\c:\xxldd.exec:\xxldd.exe120⤵PID:2384
-
\??\c:\njptxlt.exec:\njptxlt.exe121⤵PID:2104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-