Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 10:41
Behavioral task
behavioral1
Sample
54dfd30f8476669fa88b6d84cfb89c2d92502ca5aaed6b290e39d1e6fde1a48d.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
54dfd30f8476669fa88b6d84cfb89c2d92502ca5aaed6b290e39d1e6fde1a48d.exe
-
Size
67KB
-
MD5
87fd57d32f54a02186b4850acdb92c89
-
SHA1
6f6dbb996ae8a20e6138620cada0eac8dbe543ff
-
SHA256
54dfd30f8476669fa88b6d84cfb89c2d92502ca5aaed6b290e39d1e6fde1a48d
-
SHA512
f03914a30a1180860c9667285bb45ccd01d522071c5c9f6e52687367ea214d51fd7cbce9ed2a96a402e3e635c0b526052f8b9b73872d5fd5823cc0f649ae9495
-
SSDEEP
1536:/vQBeOGtrYS3srx93UBWfwC6Ggnouy8jb5DiLKrb08I:/hOmTsF93UYfwC6GIoutcKbe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2116-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-28-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2900-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/584-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1128-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-64-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2512-73-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2480-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/668-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1152-152-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1152-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1164-216-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1868-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1364-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-292-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2432-302-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2432-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-299-0x00000000779C0000-0x0000000077ADF000-memory.dmp family_blackmoon behavioral1/memory/584-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/696-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/556-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2052-466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-506-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2848-634-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2928-650-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-674-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1400-724-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/520-738-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1260-751-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1320-782-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1088-817-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-830-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2104-851-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2160-884-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2364-893-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3048-898-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2572-940-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1128 nnbpx.exe 2900 njvnhdh.exe 584 htbnxh.exe 2324 pppnb.exe 3012 lflbv.exe 2480 vvdrtx.exe 2512 drbxf.exe 2840 jjlvhfn.exe 2444 pjbprx.exe 2260 rvxtt.exe 2868 nhhtj.exe 668 lxrbrt.exe 2560 xlpvd.exe 452 hjndt.exe 1152 jlxfxlr.exe 1340 fvvxdvn.exe 2196 dpjxt.exe 2336 dnxbrt.exe 1960 npdbfnl.exe 2428 tlfdf.exe 2408 rlrpx.exe 1164 bbfhbvn.exe 1868 nxfxp.exe 1364 pjrlpdd.exe 2544 rptvvvx.exe 2520 nprhppv.exe 1088 xftnvpp.exe 2388 pjfpfl.exe 2636 fnrlr.exe 2608 fbxpjhb.exe 1720 xjjxd.exe 2432 hnhnrvv.exe 2212 vbrjhj.exe 584 ttfbb.exe 2960 ddlpxd.exe 1588 jjdjf.exe 2952 njhnnrd.exe 2180 ntvlb.exe 2844 dldfp.exe 3040 lrdxnd.exe 2920 fdjphn.exe 2016 xxpdl.exe 2864 dlhft.exe 2360 hxjpdhr.exe 1444 htvpt.exe 2984 drbfj.exe 2276 lnnljvd.exe 2580 tllrj.exe 2664 vllbtv.exe 2120 lfxvbhb.exe 2028 hptxdp.exe 696 phjpf.exe 588 vfxbhf.exe 2240 vpfrbhj.exe 556 xxfrpn.exe 2052 hffvnn.exe 1964 rjhfpn.exe 2476 nfdrrf.exe 1644 rfdjnfx.exe 624 rvnfvh.exe 2148 hvvjfrf.exe 1812 lvhpnvl.exe 768 pbfbn.exe 1004 xvdnnh.exe -
resource yara_rule behavioral1/memory/2116-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000012266-5.dat upx behavioral1/memory/2116-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1128-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016cf0-18.dat upx behavioral1/files/0x0007000000016d0c-30.dat upx behavioral1/memory/584-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d1c-38.dat upx behavioral1/memory/584-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1128-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2324-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000016d2c-46.dat upx behavioral1/memory/3012-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d3f-55.dat upx behavioral1/files/0x0002000000018334-70.dat upx behavioral1/memory/2512-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2480-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ef-78.dat upx behavioral1/memory/2512-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001950f-88.dat upx behavioral1/files/0x0005000000019515-98.dat upx behavioral1/memory/2444-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2260-106-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2868-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019547-109.dat upx behavioral1/memory/2260-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/668-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000016cab-117.dat upx behavioral1/memory/668-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001957c-128.dat upx behavioral1/memory/2560-131-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/452-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a7-136.dat upx behavioral1/files/0x00050000000195a9-145.dat upx behavioral1/memory/1152-152-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1152-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195ab-155.dat upx behavioral1/memory/1152-154-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00050000000195ad-165.dat upx behavioral1/files/0x00050000000195af-173.dat upx behavioral1/memory/2336-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b1-182.dat upx behavioral1/files/0x00050000000195b3-190.dat upx behavioral1/files/0x00050000000195b5-200.dat upx behavioral1/memory/2408-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2428-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b7-209.dat upx behavioral1/files/0x00050000000195bb-217.dat upx behavioral1/memory/1868-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1868-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195bd-227.dat upx behavioral1/files/0x00050000000195c1-236.dat upx behavioral1/memory/1364-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c3-245.dat upx behavioral1/files/0x00050000000195c5-253.dat upx behavioral1/files/0x00050000000195c6-261.dat upx behavioral1/files/0x00050000000195c7-269.dat upx behavioral1/files/0x000500000001960c-278.dat upx behavioral1/memory/2636-277-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2608-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019643-288.dat upx behavioral1/memory/1720-290-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rptvvvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvlhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbdxrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrfbrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtljvxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndrblv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhdrfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlrpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfhffp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpthrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlpjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvdlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrppltt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttfnvjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbvpxrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrbjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljrjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nndjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbvxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nblbvth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxvhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxjpnfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brndf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npvbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfrjfhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfdtthj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbxvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbhbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtjvhpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxhffpb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 1128 2116 54dfd30f8476669fa88b6d84cfb89c2d92502ca5aaed6b290e39d1e6fde1a48d.exe 30 PID 2116 wrote to memory of 1128 2116 54dfd30f8476669fa88b6d84cfb89c2d92502ca5aaed6b290e39d1e6fde1a48d.exe 30 PID 2116 wrote to memory of 1128 2116 54dfd30f8476669fa88b6d84cfb89c2d92502ca5aaed6b290e39d1e6fde1a48d.exe 30 PID 2116 wrote to memory of 1128 2116 54dfd30f8476669fa88b6d84cfb89c2d92502ca5aaed6b290e39d1e6fde1a48d.exe 30 PID 1128 wrote to memory of 2900 1128 nnbpx.exe 31 PID 1128 wrote to memory of 2900 1128 nnbpx.exe 31 PID 1128 wrote to memory of 2900 1128 nnbpx.exe 31 PID 1128 wrote to memory of 2900 1128 nnbpx.exe 31 PID 2900 wrote to memory of 584 2900 njvnhdh.exe 32 PID 2900 wrote to memory of 584 2900 njvnhdh.exe 32 PID 2900 wrote to memory of 584 2900 njvnhdh.exe 32 PID 2900 wrote to memory of 584 2900 njvnhdh.exe 32 PID 584 wrote to memory of 2324 584 htbnxh.exe 33 PID 584 wrote to memory of 2324 584 htbnxh.exe 33 PID 584 wrote to memory of 2324 584 htbnxh.exe 33 PID 584 wrote to memory of 2324 584 htbnxh.exe 33 PID 2324 wrote to memory of 3012 2324 pppnb.exe 34 PID 2324 wrote to memory of 3012 2324 pppnb.exe 34 PID 2324 wrote to memory of 3012 2324 pppnb.exe 34 PID 2324 wrote to memory of 3012 2324 pppnb.exe 34 PID 3012 wrote to memory of 2480 3012 lflbv.exe 35 PID 3012 wrote to memory of 2480 3012 lflbv.exe 35 PID 3012 wrote to memory of 2480 3012 lflbv.exe 35 PID 3012 wrote to memory of 2480 3012 lflbv.exe 35 PID 2480 wrote to memory of 2512 2480 vvdrtx.exe 36 PID 2480 wrote to memory of 2512 2480 vvdrtx.exe 36 PID 2480 wrote to memory of 2512 2480 vvdrtx.exe 36 PID 2480 wrote to memory of 2512 2480 vvdrtx.exe 36 PID 2512 wrote to memory of 2840 2512 drbxf.exe 37 PID 2512 wrote to memory of 2840 2512 drbxf.exe 37 PID 2512 wrote to memory of 2840 2512 drbxf.exe 37 PID 2512 wrote to memory of 2840 2512 drbxf.exe 37 PID 2840 wrote to memory of 2444 2840 jjlvhfn.exe 38 PID 2840 wrote to memory of 2444 2840 jjlvhfn.exe 38 PID 2840 wrote to memory of 2444 2840 jjlvhfn.exe 38 PID 2840 wrote to memory of 2444 2840 jjlvhfn.exe 38 PID 2444 wrote to memory of 2260 2444 pjbprx.exe 39 PID 2444 wrote to memory of 2260 2444 pjbprx.exe 39 PID 2444 wrote to memory of 2260 2444 pjbprx.exe 39 PID 2444 wrote to memory of 2260 2444 pjbprx.exe 39 PID 2260 wrote to memory of 2868 2260 rvxtt.exe 40 PID 2260 wrote to memory of 2868 2260 rvxtt.exe 40 PID 2260 wrote to memory of 2868 2260 rvxtt.exe 40 PID 2260 wrote to memory of 2868 2260 rvxtt.exe 40 PID 2868 wrote to memory of 668 2868 nhhtj.exe 41 PID 2868 wrote to memory of 668 2868 nhhtj.exe 41 PID 2868 wrote to memory of 668 2868 nhhtj.exe 41 PID 2868 wrote to memory of 668 2868 nhhtj.exe 41 PID 668 wrote to memory of 2560 668 lxrbrt.exe 42 PID 668 wrote to memory of 2560 668 lxrbrt.exe 42 PID 668 wrote to memory of 2560 668 lxrbrt.exe 42 PID 668 wrote to memory of 2560 668 lxrbrt.exe 42 PID 2560 wrote to memory of 452 2560 xlpvd.exe 43 PID 2560 wrote to memory of 452 2560 xlpvd.exe 43 PID 2560 wrote to memory of 452 2560 xlpvd.exe 43 PID 2560 wrote to memory of 452 2560 xlpvd.exe 43 PID 452 wrote to memory of 1152 452 hjndt.exe 44 PID 452 wrote to memory of 1152 452 hjndt.exe 44 PID 452 wrote to memory of 1152 452 hjndt.exe 44 PID 452 wrote to memory of 1152 452 hjndt.exe 44 PID 1152 wrote to memory of 1340 1152 jlxfxlr.exe 45 PID 1152 wrote to memory of 1340 1152 jlxfxlr.exe 45 PID 1152 wrote to memory of 1340 1152 jlxfxlr.exe 45 PID 1152 wrote to memory of 1340 1152 jlxfxlr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\54dfd30f8476669fa88b6d84cfb89c2d92502ca5aaed6b290e39d1e6fde1a48d.exe"C:\Users\Admin\AppData\Local\Temp\54dfd30f8476669fa88b6d84cfb89c2d92502ca5aaed6b290e39d1e6fde1a48d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\nnbpx.exec:\nnbpx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\njvnhdh.exec:\njvnhdh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\htbnxh.exec:\htbnxh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:584 -
\??\c:\pppnb.exec:\pppnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\lflbv.exec:\lflbv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\vvdrtx.exec:\vvdrtx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\drbxf.exec:\drbxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\jjlvhfn.exec:\jjlvhfn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\pjbprx.exec:\pjbprx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\rvxtt.exec:\rvxtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\nhhtj.exec:\nhhtj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\lxrbrt.exec:\lxrbrt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\xlpvd.exec:\xlpvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\hjndt.exec:\hjndt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\jlxfxlr.exec:\jlxfxlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\fvvxdvn.exec:\fvvxdvn.exe17⤵
- Executes dropped EXE
PID:1340 -
\??\c:\dpjxt.exec:\dpjxt.exe18⤵
- Executes dropped EXE
PID:2196 -
\??\c:\dnxbrt.exec:\dnxbrt.exe19⤵
- Executes dropped EXE
PID:2336 -
\??\c:\npdbfnl.exec:\npdbfnl.exe20⤵
- Executes dropped EXE
PID:1960 -
\??\c:\tlfdf.exec:\tlfdf.exe21⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rlrpx.exec:\rlrpx.exe22⤵
- Executes dropped EXE
PID:2408 -
\??\c:\bbfhbvn.exec:\bbfhbvn.exe23⤵
- Executes dropped EXE
PID:1164 -
\??\c:\nxfxp.exec:\nxfxp.exe24⤵
- Executes dropped EXE
PID:1868 -
\??\c:\pjrlpdd.exec:\pjrlpdd.exe25⤵
- Executes dropped EXE
PID:1364 -
\??\c:\rptvvvx.exec:\rptvvvx.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2544 -
\??\c:\nprhppv.exec:\nprhppv.exe27⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xftnvpp.exec:\xftnvpp.exe28⤵
- Executes dropped EXE
PID:1088 -
\??\c:\pjfpfl.exec:\pjfpfl.exe29⤵
- Executes dropped EXE
PID:2388 -
\??\c:\fnrlr.exec:\fnrlr.exe30⤵
- Executes dropped EXE
PID:2636 -
\??\c:\fbxpjhb.exec:\fbxpjhb.exe31⤵
- Executes dropped EXE
PID:2608 -
\??\c:\xjjxd.exec:\xjjxd.exe32⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hnhnrvv.exec:\hnhnrvv.exe33⤵
- Executes dropped EXE
PID:2432 -
\??\c:\hfdtvl.exec:\hfdtvl.exe34⤵PID:1456
-
\??\c:\vbrjhj.exec:\vbrjhj.exe35⤵
- Executes dropped EXE
PID:2212 -
\??\c:\ttfbb.exec:\ttfbb.exe36⤵
- Executes dropped EXE
PID:584 -
\??\c:\ddlpxd.exec:\ddlpxd.exe37⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jjdjf.exec:\jjdjf.exe38⤵
- Executes dropped EXE
PID:1588 -
\??\c:\njhnnrd.exec:\njhnnrd.exe39⤵
- Executes dropped EXE
PID:2952 -
\??\c:\ntvlb.exec:\ntvlb.exe40⤵
- Executes dropped EXE
PID:2180 -
\??\c:\dldfp.exec:\dldfp.exe41⤵
- Executes dropped EXE
PID:2844 -
\??\c:\lrdxnd.exec:\lrdxnd.exe42⤵
- Executes dropped EXE
PID:3040 -
\??\c:\fdjphn.exec:\fdjphn.exe43⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xxpdl.exec:\xxpdl.exe44⤵
- Executes dropped EXE
PID:2016 -
\??\c:\dlhft.exec:\dlhft.exe45⤵
- Executes dropped EXE
PID:2864 -
\??\c:\hxjpdhr.exec:\hxjpdhr.exe46⤵
- Executes dropped EXE
PID:2360 -
\??\c:\htvpt.exec:\htvpt.exe47⤵
- Executes dropped EXE
PID:1444 -
\??\c:\drbfj.exec:\drbfj.exe48⤵
- Executes dropped EXE
PID:2984 -
\??\c:\lnnljvd.exec:\lnnljvd.exe49⤵
- Executes dropped EXE
PID:2276 -
\??\c:\tllrj.exec:\tllrj.exe50⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vllbtv.exec:\vllbtv.exe51⤵
- Executes dropped EXE
PID:2664 -
\??\c:\lfxvbhb.exec:\lfxvbhb.exe52⤵
- Executes dropped EXE
PID:2120 -
\??\c:\hptxdp.exec:\hptxdp.exe53⤵
- Executes dropped EXE
PID:2028 -
\??\c:\phjpf.exec:\phjpf.exe54⤵
- Executes dropped EXE
PID:696 -
\??\c:\vfxbhf.exec:\vfxbhf.exe55⤵
- Executes dropped EXE
PID:588 -
\??\c:\vpfrbhj.exec:\vpfrbhj.exe56⤵
- Executes dropped EXE
PID:2240 -
\??\c:\xxfrpn.exec:\xxfrpn.exe57⤵
- Executes dropped EXE
PID:556 -
\??\c:\hffvnn.exec:\hffvnn.exe58⤵
- Executes dropped EXE
PID:2052 -
\??\c:\rjhfpn.exec:\rjhfpn.exe59⤵
- Executes dropped EXE
PID:1964 -
\??\c:\nfdrrf.exec:\nfdrrf.exe60⤵
- Executes dropped EXE
PID:2476 -
\??\c:\rfdjnfx.exec:\rfdjnfx.exe61⤵
- Executes dropped EXE
PID:1644 -
\??\c:\rvnfvh.exec:\rvnfvh.exe62⤵
- Executes dropped EXE
PID:624 -
\??\c:\hvvjfrf.exec:\hvvjfrf.exe63⤵
- Executes dropped EXE
PID:2148 -
\??\c:\lvhpnvl.exec:\lvhpnvl.exe64⤵
- Executes dropped EXE
PID:1812 -
\??\c:\pbfbn.exec:\pbfbn.exe65⤵
- Executes dropped EXE
PID:768 -
\??\c:\xvdnnh.exec:\xvdnnh.exe66⤵
- Executes dropped EXE
PID:1004 -
\??\c:\xtnjvbl.exec:\xtnjvbl.exe67⤵PID:2264
-
\??\c:\dxvhr.exec:\dxvhr.exe68⤵
- System Location Discovery: System Language Discovery
PID:2544 -
\??\c:\httxbnn.exec:\httxbnn.exe69⤵PID:112
-
\??\c:\ldxht.exec:\ldxht.exe70⤵PID:1088
-
\??\c:\fvbdfhl.exec:\fvbdfhl.exe71⤵PID:1728
-
\??\c:\xdhvh.exec:\xdhvh.exe72⤵PID:1808
-
\??\c:\jvxpvvj.exec:\jvxpvvj.exe73⤵PID:892
-
\??\c:\fpljv.exec:\fpljv.exe74⤵PID:2288
-
\??\c:\ptvlnv.exec:\ptvlnv.exe75⤵PID:2596
-
\??\c:\hvddjvd.exec:\hvddjvd.exe76⤵PID:2368
-
\??\c:\jrnblr.exec:\jrnblr.exe77⤵PID:2192
-
\??\c:\rnhvfh.exec:\rnhvfh.exe78⤵PID:2948
-
\??\c:\frhdbv.exec:\frhdbv.exe79⤵PID:2040
-
\??\c:\dpxvhpd.exec:\dpxvhpd.exe80⤵PID:2020
-
\??\c:\pvlppj.exec:\pvlppj.exe81⤵PID:2392
-
\??\c:\nntdjl.exec:\nntdjl.exe82⤵PID:2324
-
\??\c:\vdtrt.exec:\vdtrt.exe83⤵PID:2952
-
\??\c:\hlrlv.exec:\hlrlv.exe84⤵PID:3032
-
\??\c:\djhpbll.exec:\djhpbll.exe85⤵PID:2848
-
\??\c:\lvrhxx.exec:\lvrhxx.exe86⤵PID:2480
-
\??\c:\vlhjxvl.exec:\vlhjxvl.exe87⤵PID:2928
-
\??\c:\nxvdvn.exec:\nxvdvn.exe88⤵PID:2484
-
\??\c:\dvdfbvh.exec:\dvdfbvh.exe89⤵PID:1248
-
\??\c:\xfptthr.exec:\xfptthr.exe90⤵PID:2248
-
\??\c:\dvlrl.exec:\dvlrl.exe91⤵PID:2996
-
\??\c:\bpxhd.exec:\bpxhd.exe92⤵PID:2984
-
\??\c:\vhrphf.exec:\vhrphf.exe93⤵PID:432
-
\??\c:\llphdnn.exec:\llphdnn.exe94⤵PID:1496
-
\??\c:\dfpxhjn.exec:\dfpxhjn.exe95⤵PID:668
-
\??\c:\nlhvn.exec:\nlhvn.exe96⤵PID:1632
-
\??\c:\hhbfd.exec:\hhbfd.exe97⤵PID:2356
-
\??\c:\vdhpjb.exec:\vdhpjb.exe98⤵PID:1148
-
\??\c:\lprfdr.exec:\lprfdr.exe99⤵PID:1400
-
\??\c:\jdthvjv.exec:\jdthvjv.exe100⤵PID:3008
-
\??\c:\lhldvv.exec:\lhldvv.exe101⤵PID:520
-
\??\c:\vjrplnn.exec:\vjrplnn.exe102⤵PID:2412
-
\??\c:\lphtbrx.exec:\lphtbrx.exe103⤵PID:1260
-
\??\c:\dljrlt.exec:\dljrlt.exe104⤵PID:2064
-
\??\c:\hbvjf.exec:\hbvjf.exe105⤵PID:680
-
\??\c:\phhlrbr.exec:\phhlrbr.exe106⤵PID:756
-
\??\c:\tdrtj.exec:\tdrtj.exe107⤵PID:1800
-
\??\c:\lvxnltv.exec:\lvxnltv.exe108⤵PID:1320
-
\??\c:\dldlxd.exec:\dldlxd.exe109⤵PID:1564
-
\??\c:\htdhndh.exec:\htdhndh.exe110⤵PID:2532
-
\??\c:\xlvjtfd.exec:\xlvjtfd.exe111⤵PID:1064
-
\??\c:\vbttxp.exec:\vbttxp.exe112⤵PID:1312
-
\??\c:\pbbxn.exec:\pbbxn.exe113⤵PID:112
-
\??\c:\hxvdrnr.exec:\hxvdrnr.exe114⤵PID:1088
-
\??\c:\xjjtnjl.exec:\xjjtnjl.exe115⤵PID:1820
-
\??\c:\jtdpltt.exec:\jtdpltt.exe116⤵PID:1928
-
\??\c:\xlvdrjd.exec:\xlvdrjd.exe117⤵PID:1720
-
\??\c:\lphbjfl.exec:\lphbjfl.exe118⤵PID:2104
-
\??\c:\ttpxtv.exec:\ttpxtv.exe119⤵PID:2424
-
\??\c:\pnpnh.exec:\pnpnh.exe120⤵PID:3000
-
\??\c:\dxxrj.exec:\dxxrj.exe121⤵PID:2156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-