Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 09:29
Behavioral task
behavioral1
Sample
e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe
-
Size
345KB
-
MD5
87a2b4f821111d88d54c35236913829c
-
SHA1
a4aff11fa7a3bc446b682cb8eafeb4e68fa62f42
-
SHA256
e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c
-
SHA512
1578e2e2b3faf87c77b0b31b89f675aef8a05368b9d661f6087c2e6090290bbd2bf2ac53ecec49ae0f83e2df55d28f206b50556f664bd1d3145000d63fcd421d
-
SSDEEP
6144:Lcm4FmowdHoSEYW5fNZWB5hFfci3Add4kGYA8:R4wFHoS3WXZshJX2VGd8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2388-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1044-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1484-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1484-105-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1020-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3036-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1532-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1148-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/584-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/584-152-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2244-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-187-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2220-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/972-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/920-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1464-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/884-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1132-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3036-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-425-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/1728-448-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1744-446-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1124-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-525-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-548-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1600-598-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-609-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2148-610-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2784-627-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2892 npfdbn.exe 1044 lxfvxj.exe 2948 rrrjv.exe 2844 hljxv.exe 2636 lnrdp.exe 1720 jljnhj.exe 2732 jphpx.exe 2772 rtvpvf.exe 2692 dnvbbnh.exe 2612 hjvvfj.exe 2116 tjnrrh.exe 1484 rjvfb.exe 1020 nbpldlt.exe 3036 rbltx.exe 1532 rtjvl.exe 1296 jxjhh.exe 584 hlnntf.exe 1148 fpnpf.exe 2188 vflfb.exe 2244 btjrlfh.exe 2088 nvnvbpf.exe 2220 fxdbll.exe 1968 rbrbn.exe 2620 hhrnbn.exe 972 jhnpxn.exe 2128 nfndrt.exe 1056 bjbxfh.exe 1556 ntthvn.exe 1640 ttxdpvb.exe 1464 nprxh.exe 920 hlxddb.exe 1780 bttjrll.exe 2648 brntjxd.exe 1692 hpbptpr.exe 884 hjdpbt.exe 1516 nrhxhnh.exe 2852 ldrpnl.exe 1132 jtlnhh.exe 2336 ljltl.exe 2932 rjnvhb.exe 2980 pvlpvrn.exe 2844 hxlnt.exe 2872 jbjvb.exe 2848 fjfdl.exe 2716 xndbph.exe 2788 hfbnxd.exe 2732 djdtl.exe 2196 xndhhd.exe 1676 pbdddr.exe 2100 ntpfldr.exe 832 vbrpxb.exe 1172 nxdxlxj.exe 2960 hbnfd.exe 3048 vblrv.exe 2320 bbfptnb.exe 3036 llnbt.exe 1144 prpxnt.exe 2024 prtbhv.exe 1448 ldjptdn.exe 1996 xfxxh.exe 1612 dnhlfp.exe 1744 vbpdvv.exe 1728 hrbbjtr.exe 2244 rfddv.exe -
resource yara_rule behavioral1/memory/2388-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2388-3-0x00000000005C0000-0x00000000005E7000-memory.dmp upx behavioral1/files/0x000a00000001225c-6.dat upx behavioral1/memory/2388-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000f00000001756e-17.dat upx behavioral1/memory/2892-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1044-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000018b05-26.dat upx behavioral1/memory/2948-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b50-35.dat upx behavioral1/files/0x0007000000018b54-41.dat upx behavioral1/memory/1720-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b59-49.dat upx behavioral1/memory/1720-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000018b71-59.dat upx behavioral1/files/0x0003000000018334-66.dat upx behavioral1/files/0x000500000001975a-73.dat upx behavioral1/memory/2772-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2692-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019761-82.dat upx behavioral1/files/0x00050000000197fd-89.dat upx behavioral1/memory/2612-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019820-97.dat upx behavioral1/files/0x000500000001998d-107.dat upx behavioral1/memory/1020-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1484-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf5-116.dat upx behavioral1/memory/3036-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1020-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf6-126.dat upx behavioral1/memory/1532-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3036-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1296-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf9-137.dat upx behavioral1/files/0x0005000000019c3c-144.dat upx behavioral1/memory/1532-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1148-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d61-155.dat upx behavioral1/memory/584-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d62-162.dat upx behavioral1/files/0x0005000000019d6d-172.dat upx behavioral1/memory/2244-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019e92-179.dat upx behavioral1/memory/2244-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2088-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019fd4-188.dat upx behavioral1/files/0x0005000000019fdd-197.dat upx behavioral1/memory/2220-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a03c-207.dat upx behavioral1/memory/1968-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a049-213.dat upx behavioral1/files/0x000500000001a0b6-221.dat upx behavioral1/memory/972-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2128-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1056-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a309-229.dat upx behavioral1/files/0x000500000001a3ab-239.dat upx behavioral1/files/0x000500000001a3f6-245.dat upx behavioral1/files/0x000500000001a3f8-255.dat upx behavioral1/memory/1464-254-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a3fd-264.dat upx behavioral1/memory/920-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1464-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a400-271.dat upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fprxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btfvdxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxxvjrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjhjdfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvfvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfvrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrlbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxntrhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nprxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrjdnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjhpxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvdxhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdxjdrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlhrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fljbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pffjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhvlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvdxbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvdjvxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjbhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfttfnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfxlprd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fptdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrrnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvtrvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lldpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpfflvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnlfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vplbrnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnjrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxlxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btjnvxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvffbfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljpxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldrpnl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2892 2388 e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe 29 PID 2388 wrote to memory of 2892 2388 e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe 29 PID 2388 wrote to memory of 2892 2388 e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe 29 PID 2388 wrote to memory of 2892 2388 e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe 29 PID 2892 wrote to memory of 1044 2892 npfdbn.exe 30 PID 2892 wrote to memory of 1044 2892 npfdbn.exe 30 PID 2892 wrote to memory of 1044 2892 npfdbn.exe 30 PID 2892 wrote to memory of 1044 2892 npfdbn.exe 30 PID 1044 wrote to memory of 2948 1044 lxfvxj.exe 31 PID 1044 wrote to memory of 2948 1044 lxfvxj.exe 31 PID 1044 wrote to memory of 2948 1044 lxfvxj.exe 31 PID 1044 wrote to memory of 2948 1044 lxfvxj.exe 31 PID 2948 wrote to memory of 2844 2948 rrrjv.exe 32 PID 2948 wrote to memory of 2844 2948 rrrjv.exe 32 PID 2948 wrote to memory of 2844 2948 rrrjv.exe 32 PID 2948 wrote to memory of 2844 2948 rrrjv.exe 32 PID 2844 wrote to memory of 2636 2844 hljxv.exe 33 PID 2844 wrote to memory of 2636 2844 hljxv.exe 33 PID 2844 wrote to memory of 2636 2844 hljxv.exe 33 PID 2844 wrote to memory of 2636 2844 hljxv.exe 33 PID 2636 wrote to memory of 1720 2636 lnrdp.exe 34 PID 2636 wrote to memory of 1720 2636 lnrdp.exe 34 PID 2636 wrote to memory of 1720 2636 lnrdp.exe 34 PID 2636 wrote to memory of 1720 2636 lnrdp.exe 34 PID 1720 wrote to memory of 2732 1720 jljnhj.exe 35 PID 1720 wrote to memory of 2732 1720 jljnhj.exe 35 PID 1720 wrote to memory of 2732 1720 jljnhj.exe 35 PID 1720 wrote to memory of 2732 1720 jljnhj.exe 35 PID 2732 wrote to memory of 2772 2732 jphpx.exe 36 PID 2732 wrote to memory of 2772 2732 jphpx.exe 36 PID 2732 wrote to memory of 2772 2732 jphpx.exe 36 PID 2732 wrote to memory of 2772 2732 jphpx.exe 36 PID 2772 wrote to memory of 2692 2772 rtvpvf.exe 37 PID 2772 wrote to memory of 2692 2772 rtvpvf.exe 37 PID 2772 wrote to memory of 2692 2772 rtvpvf.exe 37 PID 2772 wrote to memory of 2692 2772 rtvpvf.exe 37 PID 2692 wrote to memory of 2612 2692 dnvbbnh.exe 38 PID 2692 wrote to memory of 2612 2692 dnvbbnh.exe 38 PID 2692 wrote to memory of 2612 2692 dnvbbnh.exe 38 PID 2692 wrote to memory of 2612 2692 dnvbbnh.exe 38 PID 2612 wrote to memory of 2116 2612 hjvvfj.exe 39 PID 2612 wrote to memory of 2116 2612 hjvvfj.exe 39 PID 2612 wrote to memory of 2116 2612 hjvvfj.exe 39 PID 2612 wrote to memory of 2116 2612 hjvvfj.exe 39 PID 2116 wrote to memory of 1484 2116 tjnrrh.exe 40 PID 2116 wrote to memory of 1484 2116 tjnrrh.exe 40 PID 2116 wrote to memory of 1484 2116 tjnrrh.exe 40 PID 2116 wrote to memory of 1484 2116 tjnrrh.exe 40 PID 1484 wrote to memory of 1020 1484 rjvfb.exe 41 PID 1484 wrote to memory of 1020 1484 rjvfb.exe 41 PID 1484 wrote to memory of 1020 1484 rjvfb.exe 41 PID 1484 wrote to memory of 1020 1484 rjvfb.exe 41 PID 1020 wrote to memory of 3036 1020 nbpldlt.exe 42 PID 1020 wrote to memory of 3036 1020 nbpldlt.exe 42 PID 1020 wrote to memory of 3036 1020 nbpldlt.exe 42 PID 1020 wrote to memory of 3036 1020 nbpldlt.exe 42 PID 3036 wrote to memory of 1532 3036 rbltx.exe 43 PID 3036 wrote to memory of 1532 3036 rbltx.exe 43 PID 3036 wrote to memory of 1532 3036 rbltx.exe 43 PID 3036 wrote to memory of 1532 3036 rbltx.exe 43 PID 1532 wrote to memory of 1296 1532 rtjvl.exe 44 PID 1532 wrote to memory of 1296 1532 rtjvl.exe 44 PID 1532 wrote to memory of 1296 1532 rtjvl.exe 44 PID 1532 wrote to memory of 1296 1532 rtjvl.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe"C:\Users\Admin\AppData\Local\Temp\e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\npfdbn.exec:\npfdbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\lxfvxj.exec:\lxfvxj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\rrrjv.exec:\rrrjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\hljxv.exec:\hljxv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\lnrdp.exec:\lnrdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\jljnhj.exec:\jljnhj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\jphpx.exec:\jphpx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\rtvpvf.exec:\rtvpvf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\dnvbbnh.exec:\dnvbbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\hjvvfj.exec:\hjvvfj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\tjnrrh.exec:\tjnrrh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\rjvfb.exec:\rjvfb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\nbpldlt.exec:\nbpldlt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\rbltx.exec:\rbltx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\rtjvl.exec:\rtjvl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\jxjhh.exec:\jxjhh.exe17⤵
- Executes dropped EXE
PID:1296 -
\??\c:\hlnntf.exec:\hlnntf.exe18⤵
- Executes dropped EXE
PID:584 -
\??\c:\fpnpf.exec:\fpnpf.exe19⤵
- Executes dropped EXE
PID:1148 -
\??\c:\vflfb.exec:\vflfb.exe20⤵
- Executes dropped EXE
PID:2188 -
\??\c:\btjrlfh.exec:\btjrlfh.exe21⤵
- Executes dropped EXE
PID:2244 -
\??\c:\nvnvbpf.exec:\nvnvbpf.exe22⤵
- Executes dropped EXE
PID:2088 -
\??\c:\fxdbll.exec:\fxdbll.exe23⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rbrbn.exec:\rbrbn.exe24⤵
- Executes dropped EXE
PID:1968 -
\??\c:\hhrnbn.exec:\hhrnbn.exe25⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jhnpxn.exec:\jhnpxn.exe26⤵
- Executes dropped EXE
PID:972 -
\??\c:\nfndrt.exec:\nfndrt.exe27⤵
- Executes dropped EXE
PID:2128 -
\??\c:\bjbxfh.exec:\bjbxfh.exe28⤵
- Executes dropped EXE
PID:1056 -
\??\c:\ntthvn.exec:\ntthvn.exe29⤵
- Executes dropped EXE
PID:1556 -
\??\c:\ttxdpvb.exec:\ttxdpvb.exe30⤵
- Executes dropped EXE
PID:1640 -
\??\c:\nprxh.exec:\nprxh.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1464 -
\??\c:\hlxddb.exec:\hlxddb.exe32⤵
- Executes dropped EXE
PID:920 -
\??\c:\bttjrll.exec:\bttjrll.exe33⤵
- Executes dropped EXE
PID:1780 -
\??\c:\brntjxd.exec:\brntjxd.exe34⤵
- Executes dropped EXE
PID:2648 -
\??\c:\hpbptpr.exec:\hpbptpr.exe35⤵
- Executes dropped EXE
PID:1692 -
\??\c:\hjdpbt.exec:\hjdpbt.exe36⤵
- Executes dropped EXE
PID:884 -
\??\c:\nrhxhnh.exec:\nrhxhnh.exe37⤵
- Executes dropped EXE
PID:1516 -
\??\c:\ldrpnl.exec:\ldrpnl.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2852 -
\??\c:\jtlnhh.exec:\jtlnhh.exe39⤵
- Executes dropped EXE
PID:1132 -
\??\c:\bjhjdfd.exec:\bjhjdfd.exe40⤵
- System Location Discovery: System Language Discovery
PID:2144 -
\??\c:\ljltl.exec:\ljltl.exe41⤵
- Executes dropped EXE
PID:2336 -
\??\c:\rjnvhb.exec:\rjnvhb.exe42⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pvlpvrn.exec:\pvlpvrn.exe43⤵
- Executes dropped EXE
PID:2980 -
\??\c:\hxlnt.exec:\hxlnt.exe44⤵
- Executes dropped EXE
PID:2844 -
\??\c:\jbjvb.exec:\jbjvb.exe45⤵
- Executes dropped EXE
PID:2872 -
\??\c:\fjfdl.exec:\fjfdl.exe46⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xndbph.exec:\xndbph.exe47⤵
- Executes dropped EXE
PID:2716 -
\??\c:\hfbnxd.exec:\hfbnxd.exe48⤵
- Executes dropped EXE
PID:2788 -
\??\c:\djdtl.exec:\djdtl.exe49⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xndhhd.exec:\xndhhd.exe50⤵
- Executes dropped EXE
PID:2196 -
\??\c:\pbdddr.exec:\pbdddr.exe51⤵
- Executes dropped EXE
PID:1676 -
\??\c:\ntpfldr.exec:\ntpfldr.exe52⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vbrpxb.exec:\vbrpxb.exe53⤵
- Executes dropped EXE
PID:832 -
\??\c:\nxdxlxj.exec:\nxdxlxj.exe54⤵
- Executes dropped EXE
PID:1172 -
\??\c:\hbnfd.exec:\hbnfd.exe55⤵
- Executes dropped EXE
PID:2960 -
\??\c:\vblrv.exec:\vblrv.exe56⤵
- Executes dropped EXE
PID:3048 -
\??\c:\bbfptnb.exec:\bbfptnb.exe57⤵
- Executes dropped EXE
PID:2320 -
\??\c:\llnbt.exec:\llnbt.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3036 -
\??\c:\prpxnt.exec:\prpxnt.exe59⤵
- Executes dropped EXE
PID:1144 -
\??\c:\prtbhv.exec:\prtbhv.exe60⤵
- Executes dropped EXE
PID:2024 -
\??\c:\ldjptdn.exec:\ldjptdn.exe61⤵
- Executes dropped EXE
PID:1448 -
\??\c:\xfxxh.exec:\xfxxh.exe62⤵
- Executes dropped EXE
PID:1996 -
\??\c:\dnhlfp.exec:\dnhlfp.exe63⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vbpdvv.exec:\vbpdvv.exe64⤵
- Executes dropped EXE
PID:1744 -
\??\c:\hrbbjtr.exec:\hrbbjtr.exe65⤵
- Executes dropped EXE
PID:1728 -
\??\c:\rfddv.exec:\rfddv.exe66⤵
- Executes dropped EXE
PID:2244 -
\??\c:\pvffbfh.exec:\pvffbfh.exe67⤵
- System Location Discovery: System Language Discovery
PID:2480 -
\??\c:\hhdlf.exec:\hhdlf.exe68⤵PID:2056
-
\??\c:\rjtlbfh.exec:\rjtlbfh.exe69⤵PID:1220
-
\??\c:\bvrnj.exec:\bvrnj.exe70⤵PID:1124
-
\??\c:\rbjrjdj.exec:\rbjrjdj.exe71⤵PID:2156
-
\??\c:\fhvdv.exec:\fhvdv.exe72⤵PID:2604
-
\??\c:\dbjvp.exec:\dbjvp.exe73⤵PID:1644
-
\??\c:\jtxdfv.exec:\jtxdfv.exe74⤵PID:1052
-
\??\c:\dnfbb.exec:\dnfbb.exe75⤵PID:388
-
\??\c:\hdlltt.exec:\hdlltt.exe76⤵PID:1488
-
\??\c:\hdjphd.exec:\hdjphd.exe77⤵PID:2164
-
\??\c:\xptxpr.exec:\xptxpr.exe78⤵PID:2436
-
\??\c:\lxflnh.exec:\lxflnh.exe79⤵PID:2008
-
\??\c:\dbpvjt.exec:\dbpvjt.exe80⤵PID:2680
-
\??\c:\jvfnpf.exec:\jvfnpf.exe81⤵PID:572
-
\??\c:\xvplt.exec:\xvplt.exe82⤵PID:2964
-
\??\c:\lbhfndv.exec:\lbhfndv.exe83⤵PID:2268
-
\??\c:\vthlhv.exec:\vthlhv.exe84⤵PID:2132
-
\??\c:\jrxhbxx.exec:\jrxhbxx.exe85⤵PID:2256
-
\??\c:\brpjxfp.exec:\brpjxfp.exe86⤵PID:2388
-
\??\c:\pfpfpr.exec:\pfpfpr.exe87⤵PID:2860
-
\??\c:\fjxrr.exec:\fjxrr.exe88⤵PID:2468
-
\??\c:\tfvhx.exec:\tfvhx.exe89⤵PID:2144
-
\??\c:\vnrrl.exec:\vnrrl.exe90⤵PID:1600
-
\??\c:\nfphtfr.exec:\nfphtfr.exe91⤵PID:2932
-
\??\c:\tvhjp.exec:\tvhjp.exe92⤵PID:2148
-
\??\c:\lnvfn.exec:\lnvfn.exe93⤵PID:3032
-
\??\c:\rttdx.exec:\rttdx.exe94⤵PID:2708
-
\??\c:\dpvxrpj.exec:\dpvxrpj.exe95⤵PID:2784
-
\??\c:\lxprp.exec:\lxprp.exe96⤵PID:2596
-
\??\c:\hlprrvd.exec:\hlprrvd.exe97⤵PID:2696
-
\??\c:\rxppv.exec:\rxppv.exe98⤵PID:1060
-
\??\c:\ndphxph.exec:\ndphxph.exe99⤵PID:1292
-
\??\c:\lpxpdvv.exec:\lpxpdvv.exe100⤵PID:2416
-
\??\c:\fljbr.exec:\fljbr.exe101⤵PID:2116
-
\??\c:\dvxth.exec:\dvxth.exe102⤵PID:1688
-
\??\c:\jhnxn.exec:\jhnxn.exe103⤵PID:1484
-
\??\c:\jvbppht.exec:\jvbppht.exe104⤵PID:3044
-
\??\c:\bjphvr.exec:\bjphvr.exe105⤵PID:2176
-
\??\c:\vjdlj.exec:\vjdlj.exe106⤵PID:2764
-
\??\c:\jphhj.exec:\jphhj.exe107⤵PID:3036
-
\??\c:\jlxpj.exec:\jlxpj.exe108⤵PID:3028
-
\??\c:\hpjjtfn.exec:\hpjjtfn.exe109⤵PID:2264
-
\??\c:\bbfbvxb.exec:\bbfbvxb.exe110⤵PID:2332
-
\??\c:\vhrph.exec:\vhrph.exe111⤵PID:1704
-
\??\c:\bbflp.exec:\bbflp.exe112⤵PID:1804
-
\??\c:\xjptdt.exec:\xjptdt.exe113⤵PID:2232
-
\??\c:\dxljr.exec:\dxljr.exe114⤵PID:1728
-
\??\c:\pxblr.exec:\pxblr.exe115⤵PID:1652
-
\??\c:\pvrvnj.exec:\pvrvnj.exe116⤵PID:2512
-
\??\c:\jjxbhtn.exec:\jjxbhtn.exe117⤵PID:2052
-
\??\c:\drbjdt.exec:\drbjdt.exe118⤵PID:2220
-
\??\c:\xhrttpj.exec:\xhrttpj.exe119⤵PID:1552
-
\??\c:\rphdfvx.exec:\rphdfvx.exe120⤵PID:1124
-
\??\c:\lxxvp.exec:\lxxvp.exe121⤵PID:2156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-