Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 10:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
826bb0be08cb06a9b44f7dc120d5738a3997e14e0a250f1c2274c076ecc3c225N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
826bb0be08cb06a9b44f7dc120d5738a3997e14e0a250f1c2274c076ecc3c225N.exe
-
Size
453KB
-
MD5
4f50929735a11e6c155a98d7ec458aa0
-
SHA1
ba1aa51b2d9a9f128a68693f681375077b932ae4
-
SHA256
826bb0be08cb06a9b44f7dc120d5738a3997e14e0a250f1c2274c076ecc3c225
-
SHA512
4b27a70217054ebfa8ab22421f7689a3092e3606ff2b16d80ad8e2f88833dcaf5443236ad166a2849ddf5e033c9c43f512cdf4ef13aaf730ff615060f848f16c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeQ:q7Tc2NYHUrAwfMp3CDQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2172-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-131-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2212-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-193-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1732-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/268-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-306-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2096-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-332-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2072-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/968-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1392-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/948-541-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3020-635-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2760-670-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2308-690-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/828-697-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/932-806-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1020-839-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1020-840-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-927-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-977-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-984-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2216 trnnt.exe 2988 xbxnpr.exe 3020 dflhlf.exe 3032 xxnblr.exe 2852 vrvtxh.exe 2720 thbrdvn.exe 2884 hhplj.exe 1616 flxxp.exe 1032 ntndh.exe 1740 pttxtrx.exe 2948 hrdxt.exe 2784 vdbnll.exe 3068 ptvbdxr.exe 2892 dxhhrt.exe 2212 htdlp.exe 1788 dtrnb.exe 1240 dxbjnxl.exe 1980 brvthnv.exe 2192 llvpx.exe 2520 fpthdjt.exe 1732 xlhpnvj.exe 268 hhbdd.exe 2612 lltbn.exe 2168 btpbbfv.exe 1428 rnnndjv.exe 1712 xnrjrt.exe 764 vltpv.exe 1656 nxnlrbp.exe 1288 rvplnf.exe 1676 hnttrn.exe 2592 dvpbp.exe 2376 pjlddv.exe 1724 bdjhlxf.exe 1876 hrpjj.exe 2276 vtrjdf.exe 2424 nblrlxl.exe 2096 xftxbbl.exe 2072 dxtfdlx.exe 2752 fnfnv.exe 2896 nhlpxlx.exe 3004 nfvfpl.exe 2852 tbtblrx.exe 2720 xbfjnx.exe 2792 vdxfjbl.exe 2884 tljpv.exe 1720 tdftnj.exe 700 jphrvb.exe 968 xdhbf.exe 828 dnpvf.exe 2948 tvvbl.exe 1252 ltbjf.exe 3036 tfbhd.exe 972 vjptpp.exe 2908 lxdff.exe 1868 vvrhbd.exe 2676 nfdfd.exe 1820 vxbhpnn.exe 840 rhpllhn.exe 2356 vxhhpb.exe 2232 pfhpj.exe 904 lxfth.exe 2288 vffvtb.exe 1392 txxbr.exe 772 jnftd.exe -
resource yara_rule behavioral1/memory/2216-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/968-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-806-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-813-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-820-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-840-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-888-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-901-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-927-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-977-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-991-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-1011-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-1024-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djhxplj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxpnvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxbld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfjprp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhftltx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phxdrrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tljpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nprbpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlpvhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjpntr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlnhnfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfrvrdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxndlxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnrfdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpdfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lthtll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtlhljl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjhtjht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhjdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhjdbxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnjlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lltlft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njhpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvnprtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llbxltb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpnxht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjjrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddhhxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjldd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrpbvld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdvnxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnhnrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlhpnvj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2172 wrote to memory of 2216 2172 826bb0be08cb06a9b44f7dc120d5738a3997e14e0a250f1c2274c076ecc3c225N.exe 29 PID 2172 wrote to memory of 2216 2172 826bb0be08cb06a9b44f7dc120d5738a3997e14e0a250f1c2274c076ecc3c225N.exe 29 PID 2172 wrote to memory of 2216 2172 826bb0be08cb06a9b44f7dc120d5738a3997e14e0a250f1c2274c076ecc3c225N.exe 29 PID 2172 wrote to memory of 2216 2172 826bb0be08cb06a9b44f7dc120d5738a3997e14e0a250f1c2274c076ecc3c225N.exe 29 PID 2216 wrote to memory of 2988 2216 trnnt.exe 30 PID 2216 wrote to memory of 2988 2216 trnnt.exe 30 PID 2216 wrote to memory of 2988 2216 trnnt.exe 30 PID 2216 wrote to memory of 2988 2216 trnnt.exe 30 PID 2988 wrote to memory of 3020 2988 xbxnpr.exe 31 PID 2988 wrote to memory of 3020 2988 xbxnpr.exe 31 PID 2988 wrote to memory of 3020 2988 xbxnpr.exe 31 PID 2988 wrote to memory of 3020 2988 xbxnpr.exe 31 PID 3020 wrote to memory of 3032 3020 dflhlf.exe 32 PID 3020 wrote to memory of 3032 3020 dflhlf.exe 32 PID 3020 wrote to memory of 3032 3020 dflhlf.exe 32 PID 3020 wrote to memory of 3032 3020 dflhlf.exe 32 PID 3032 wrote to memory of 2852 3032 xxnblr.exe 33 PID 3032 wrote to memory of 2852 3032 xxnblr.exe 33 PID 3032 wrote to memory of 2852 3032 xxnblr.exe 33 PID 3032 wrote to memory of 2852 3032 xxnblr.exe 33 PID 2852 wrote to memory of 2720 2852 vrvtxh.exe 34 PID 2852 wrote to memory of 2720 2852 vrvtxh.exe 34 PID 2852 wrote to memory of 2720 2852 vrvtxh.exe 34 PID 2852 wrote to memory of 2720 2852 vrvtxh.exe 34 PID 2720 wrote to memory of 2884 2720 thbrdvn.exe 35 PID 2720 wrote to memory of 2884 2720 thbrdvn.exe 35 PID 2720 wrote to memory of 2884 2720 thbrdvn.exe 35 PID 2720 wrote to memory of 2884 2720 thbrdvn.exe 35 PID 2884 wrote to memory of 1616 2884 hhplj.exe 36 PID 2884 wrote to memory of 1616 2884 hhplj.exe 36 PID 2884 wrote to memory of 1616 2884 hhplj.exe 36 PID 2884 wrote to memory of 1616 2884 hhplj.exe 36 PID 1616 wrote to memory of 1032 1616 flxxp.exe 37 PID 1616 wrote to memory of 1032 1616 flxxp.exe 37 PID 1616 wrote to memory of 1032 1616 flxxp.exe 37 PID 1616 wrote to memory of 1032 1616 flxxp.exe 37 PID 1032 wrote to memory of 1740 1032 ntndh.exe 38 PID 1032 wrote to memory of 1740 1032 ntndh.exe 38 PID 1032 wrote to memory of 1740 1032 ntndh.exe 38 PID 1032 wrote to memory of 1740 1032 ntndh.exe 38 PID 1740 wrote to memory of 2948 1740 pttxtrx.exe 39 PID 1740 wrote to memory of 2948 1740 pttxtrx.exe 39 PID 1740 wrote to memory of 2948 1740 pttxtrx.exe 39 PID 1740 wrote to memory of 2948 1740 pttxtrx.exe 39 PID 2948 wrote to memory of 2784 2948 hrdxt.exe 40 PID 2948 wrote to memory of 2784 2948 hrdxt.exe 40 PID 2948 wrote to memory of 2784 2948 hrdxt.exe 40 PID 2948 wrote to memory of 2784 2948 hrdxt.exe 40 PID 2784 wrote to memory of 3068 2784 vdbnll.exe 41 PID 2784 wrote to memory of 3068 2784 vdbnll.exe 41 PID 2784 wrote to memory of 3068 2784 vdbnll.exe 41 PID 2784 wrote to memory of 3068 2784 vdbnll.exe 41 PID 3068 wrote to memory of 2892 3068 ptvbdxr.exe 42 PID 3068 wrote to memory of 2892 3068 ptvbdxr.exe 42 PID 3068 wrote to memory of 2892 3068 ptvbdxr.exe 42 PID 3068 wrote to memory of 2892 3068 ptvbdxr.exe 42 PID 2892 wrote to memory of 2212 2892 dxhhrt.exe 43 PID 2892 wrote to memory of 2212 2892 dxhhrt.exe 43 PID 2892 wrote to memory of 2212 2892 dxhhrt.exe 43 PID 2892 wrote to memory of 2212 2892 dxhhrt.exe 43 PID 2212 wrote to memory of 1788 2212 htdlp.exe 44 PID 2212 wrote to memory of 1788 2212 htdlp.exe 44 PID 2212 wrote to memory of 1788 2212 htdlp.exe 44 PID 2212 wrote to memory of 1788 2212 htdlp.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\826bb0be08cb06a9b44f7dc120d5738a3997e14e0a250f1c2274c076ecc3c225N.exe"C:\Users\Admin\AppData\Local\Temp\826bb0be08cb06a9b44f7dc120d5738a3997e14e0a250f1c2274c076ecc3c225N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\trnnt.exec:\trnnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\xbxnpr.exec:\xbxnpr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\dflhlf.exec:\dflhlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\xxnblr.exec:\xxnblr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\vrvtxh.exec:\vrvtxh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\thbrdvn.exec:\thbrdvn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\hhplj.exec:\hhplj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\flxxp.exec:\flxxp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\ntndh.exec:\ntndh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\pttxtrx.exec:\pttxtrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\hrdxt.exec:\hrdxt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\vdbnll.exec:\vdbnll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\ptvbdxr.exec:\ptvbdxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\dxhhrt.exec:\dxhhrt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\htdlp.exec:\htdlp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\dtrnb.exec:\dtrnb.exe17⤵
- Executes dropped EXE
PID:1788 -
\??\c:\dxbjnxl.exec:\dxbjnxl.exe18⤵
- Executes dropped EXE
PID:1240 -
\??\c:\brvthnv.exec:\brvthnv.exe19⤵
- Executes dropped EXE
PID:1980 -
\??\c:\llvpx.exec:\llvpx.exe20⤵
- Executes dropped EXE
PID:2192 -
\??\c:\fpthdjt.exec:\fpthdjt.exe21⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xlhpnvj.exec:\xlhpnvj.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1732 -
\??\c:\hhbdd.exec:\hhbdd.exe23⤵
- Executes dropped EXE
PID:268 -
\??\c:\lltbn.exec:\lltbn.exe24⤵
- Executes dropped EXE
PID:2612 -
\??\c:\btpbbfv.exec:\btpbbfv.exe25⤵
- Executes dropped EXE
PID:2168 -
\??\c:\rnnndjv.exec:\rnnndjv.exe26⤵
- Executes dropped EXE
PID:1428 -
\??\c:\xnrjrt.exec:\xnrjrt.exe27⤵
- Executes dropped EXE
PID:1712 -
\??\c:\vltpv.exec:\vltpv.exe28⤵
- Executes dropped EXE
PID:764 -
\??\c:\nxnlrbp.exec:\nxnlrbp.exe29⤵
- Executes dropped EXE
PID:1656 -
\??\c:\rvplnf.exec:\rvplnf.exe30⤵
- Executes dropped EXE
PID:1288 -
\??\c:\hnttrn.exec:\hnttrn.exe31⤵
- Executes dropped EXE
PID:1676 -
\??\c:\dvpbp.exec:\dvpbp.exe32⤵
- Executes dropped EXE
PID:2592 -
\??\c:\pjlddv.exec:\pjlddv.exe33⤵
- Executes dropped EXE
PID:2376 -
\??\c:\bdjhlxf.exec:\bdjhlxf.exe34⤵
- Executes dropped EXE
PID:1724 -
\??\c:\hrpjj.exec:\hrpjj.exe35⤵
- Executes dropped EXE
PID:1876 -
\??\c:\vtrjdf.exec:\vtrjdf.exe36⤵
- Executes dropped EXE
PID:2276 -
\??\c:\nblrlxl.exec:\nblrlxl.exe37⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xftxbbl.exec:\xftxbbl.exe38⤵
- Executes dropped EXE
PID:2096 -
\??\c:\dxtfdlx.exec:\dxtfdlx.exe39⤵
- Executes dropped EXE
PID:2072 -
\??\c:\fnfnv.exec:\fnfnv.exe40⤵
- Executes dropped EXE
PID:2752 -
\??\c:\nhlpxlx.exec:\nhlpxlx.exe41⤵
- Executes dropped EXE
PID:2896 -
\??\c:\nfvfpl.exec:\nfvfpl.exe42⤵
- Executes dropped EXE
PID:3004 -
\??\c:\tbtblrx.exec:\tbtblrx.exe43⤵
- Executes dropped EXE
PID:2852 -
\??\c:\xbfjnx.exec:\xbfjnx.exe44⤵
- Executes dropped EXE
PID:2720 -
\??\c:\vdxfjbl.exec:\vdxfjbl.exe45⤵
- Executes dropped EXE
PID:2792 -
\??\c:\tljpv.exec:\tljpv.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2884 -
\??\c:\tdftnj.exec:\tdftnj.exe47⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jphrvb.exec:\jphrvb.exe48⤵
- Executes dropped EXE
PID:700 -
\??\c:\xdhbf.exec:\xdhbf.exe49⤵
- Executes dropped EXE
PID:968 -
\??\c:\dnpvf.exec:\dnpvf.exe50⤵
- Executes dropped EXE
PID:828 -
\??\c:\tvvbl.exec:\tvvbl.exe51⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ltbjf.exec:\ltbjf.exe52⤵
- Executes dropped EXE
PID:1252 -
\??\c:\tfbhd.exec:\tfbhd.exe53⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vjptpp.exec:\vjptpp.exe54⤵
- Executes dropped EXE
PID:972 -
\??\c:\lxdff.exec:\lxdff.exe55⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vvrhbd.exec:\vvrhbd.exe56⤵
- Executes dropped EXE
PID:1868 -
\??\c:\nfdfd.exec:\nfdfd.exe57⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vxbhpnn.exec:\vxbhpnn.exe58⤵
- Executes dropped EXE
PID:1820 -
\??\c:\rhpllhn.exec:\rhpllhn.exe59⤵
- Executes dropped EXE
PID:840 -
\??\c:\vxhhpb.exec:\vxhhpb.exe60⤵
- Executes dropped EXE
PID:2356 -
\??\c:\pfhpj.exec:\pfhpj.exe61⤵
- Executes dropped EXE
PID:2232 -
\??\c:\lxfth.exec:\lxfth.exe62⤵
- Executes dropped EXE
PID:904 -
\??\c:\vffvtb.exec:\vffvtb.exe63⤵
- Executes dropped EXE
PID:2288 -
\??\c:\txxbr.exec:\txxbr.exe64⤵
- Executes dropped EXE
PID:1392 -
\??\c:\jnftd.exec:\jnftd.exe65⤵
- Executes dropped EXE
PID:772 -
\??\c:\hphlh.exec:\hphlh.exe66⤵PID:604
-
\??\c:\ndprj.exec:\ndprj.exe67⤵PID:948
-
\??\c:\npphrvf.exec:\npphrvf.exe68⤵PID:1872
-
\??\c:\frnfr.exec:\frnfr.exe69⤵PID:2468
-
\??\c:\fpfdd.exec:\fpfdd.exe70⤵PID:1516
-
\??\c:\nlnhnfb.exec:\nlnhnfb.exe71⤵
- System Location Discovery: System Language Discovery
PID:964 -
\??\c:\xnrtxld.exec:\xnrtxld.exe72⤵PID:928
-
\??\c:\xlbbj.exec:\xlbbj.exe73⤵PID:956
-
\??\c:\txbfd.exec:\txbfd.exe74⤵PID:1288
-
\??\c:\xtdjb.exec:\xtdjb.exe75⤵PID:1056
-
\??\c:\pbnrtvx.exec:\pbnrtvx.exe76⤵PID:1816
-
\??\c:\vnjdjh.exec:\vnjdjh.exe77⤵PID:2524
-
\??\c:\prbhn.exec:\prbhn.exe78⤵PID:1716
-
\??\c:\vbxvdpr.exec:\vbxvdpr.exe79⤵PID:2660
-
\??\c:\tptfjnd.exec:\tptfjnd.exe80⤵PID:2460
-
\??\c:\xjfnh.exec:\xjfnh.exe81⤵PID:1672
-
\??\c:\jpnpd.exec:\jpnpd.exe82⤵PID:2856
-
\??\c:\dbtlxxt.exec:\dbtlxxt.exe83⤵PID:2820
-
\??\c:\bvhndt.exec:\bvhndt.exe84⤵PID:2264
-
\??\c:\bxtrlnl.exec:\bxtrlnl.exe85⤵PID:3020
-
\??\c:\dfxdjh.exec:\dfxdjh.exe86⤵PID:2828
-
\??\c:\dfjlfhj.exec:\dfjlfhj.exe87⤵PID:2732
-
\??\c:\fvlvrf.exec:\fvlvrf.exe88⤵PID:2888
-
\??\c:\xnbpxxn.exec:\xnbpxxn.exe89⤵PID:2600
-
\??\c:\nrnvt.exec:\nrnvt.exe90⤵PID:2760
-
\??\c:\lnlfpr.exec:\lnlfpr.exe91⤵PID:2268
-
\??\c:\hxhhrt.exec:\hxhhrt.exe92⤵PID:2100
-
\??\c:\xjdntb.exec:\xjdntb.exe93⤵PID:1748
-
\??\c:\dbrpxf.exec:\dbrpxf.exe94⤵PID:2308
-
\??\c:\xfnjdb.exec:\xfnjdb.exe95⤵PID:828
-
\??\c:\xbblvxx.exec:\xbblvxx.exe96⤵PID:2496
-
\??\c:\vdrhf.exec:\vdrhf.exe97⤵PID:3064
-
\??\c:\xfrjhd.exec:\xfrjhd.exe98⤵PID:1360
-
\??\c:\djhxplj.exec:\djhxplj.exe99⤵
- System Location Discovery: System Language Discovery
PID:2292 -
\??\c:\lpdrv.exec:\lpdrv.exe100⤵PID:1248
-
\??\c:\ddjlbbt.exec:\ddjlbbt.exe101⤵PID:2320
-
\??\c:\pvflvln.exec:\pvflvln.exe102⤵PID:568
-
\??\c:\djpfhd.exec:\djpfhd.exe103⤵PID:1084
-
\??\c:\nhddht.exec:\nhddht.exe104⤵PID:2272
-
\??\c:\rvxdxdl.exec:\rvxdxdl.exe105⤵PID:468
-
\??\c:\trtjt.exec:\trtjt.exe106⤵PID:2144
-
\??\c:\tfdblv.exec:\tfdblv.exe107⤵PID:2332
-
\??\c:\vnnvr.exec:\vnnvr.exe108⤵PID:2556
-
\??\c:\xljbvj.exec:\xljbvj.exe109⤵PID:1956
-
\??\c:\lvrphp.exec:\lvrphp.exe110⤵PID:2580
-
\??\c:\lhhbt.exec:\lhhbt.exe111⤵PID:600
-
\??\c:\rpfrjjf.exec:\rpfrjjf.exe112⤵PID:932
-
\??\c:\lrvbj.exec:\lrvbj.exe113⤵PID:2528
-
\??\c:\tfflxx.exec:\tfflxx.exe114⤵PID:1332
-
\??\c:\vfxfhj.exec:\vfxfhj.exe115⤵PID:1712
-
\??\c:\dpjvndf.exec:\dpjvndf.exe116⤵PID:1020
-
\??\c:\lnjtx.exec:\lnjtx.exe117⤵PID:1304
-
\??\c:\vdtdd.exec:\vdtdd.exe118⤵PID:916
-
\??\c:\xtfxln.exec:\xtfxln.exe119⤵PID:1048
-
\??\c:\tfdvpx.exec:\tfdvpx.exe120⤵PID:1676
-
\??\c:\nhnvx.exec:\nhnvx.exe121⤵PID:2260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-