Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 11:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
faf37680b851c12dc3c7f346e756dc0e4547ed807550a015680542571704d960N.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
faf37680b851c12dc3c7f346e756dc0e4547ed807550a015680542571704d960N.exe
-
Size
453KB
-
MD5
19d6aff5e48834c275d9eb0aa012a670
-
SHA1
ce5f94ddaf55771e633e772c4ca416547de91055
-
SHA256
faf37680b851c12dc3c7f346e756dc0e4547ed807550a015680542571704d960
-
SHA512
2f36360c4186557ee452a4421868964e47ec4eae7a1ee4f83b4820d16d082da1156b8a2076455ebd317c4b2a05cba1b10ee1f729a5c3d98899bcfb74c1f90194
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeb:q7Tc2NYHUrAwfMp3CDb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2936-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/432-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-445-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2144-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-494-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1076-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-575-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/588-697-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2128-714-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-821-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2224 fvfvn.exe 2964 dlpvbn.exe 2852 thlbhhd.exe 1824 xlpppvd.exe 2912 rbbtrtt.exe 2764 nvnfntl.exe 2624 dbdpnr.exe 1936 fbnbhdd.exe 1672 xbvpj.exe 1708 rjfrtd.exe 432 ltbdn.exe 2360 djxddth.exe 2184 bnphprl.exe 2188 rlftvt.exe 2844 hfljbfr.exe 2008 jntjrv.exe 1176 rvxhxnf.exe 1536 frtpd.exe 2264 xnvbvtd.exe 2452 rbjlltf.exe 2272 xnjjhtb.exe 1076 hdfvb.exe 1900 njhlx.exe 760 rtbxfbl.exe 948 dplll.exe 2724 ntpnrvb.exe 2712 vtxpvx.exe 1768 pjrbt.exe 1924 nbxdrrn.exe 1152 bbvtfp.exe 1156 dfdhbj.exe 1716 jfpxpf.exe 2548 lvdrf.exe 1780 xndjxr.exe 2968 vtvxrrt.exe 2900 fntbfp.exe 1584 vfpthbf.exe 2852 tdxrxh.exe 2756 ddnvhb.exe 2860 blfvtr.exe 2912 fddfbt.exe 2764 pdjflb.exe 2620 rnxvn.exe 2728 pjfjxr.exe 1692 tvhblx.exe 1672 vppfjrf.exe 1624 dvdrrv.exe 2692 dtjnl.exe 2196 rvxnlj.exe 2788 pxfbf.exe 1968 txdvxxf.exe 1444 frlndj.exe 2656 rhrxfnx.exe 1468 dnjnlj.exe 1976 lbfvdbr.exe 2116 jrbjj.exe 1536 fvbxlvv.exe 2576 hlhbxdr.exe 396 ltxrvxb.exe 2144 hvnppt.exe 2432 hhbjxdd.exe 1076 jprtjvn.exe 1992 brrpdff.exe 1848 rxjlxh.exe -
resource yara_rule behavioral1/memory/2936-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/432-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-821-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhdnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhtfhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlvnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltnll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbtdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfpxthj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnfbhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrnfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxdldnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jldtdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvxvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxdvlbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htjlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frtpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvjvnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pflttx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frpbdnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjjxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njxlhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhxnnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdldbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbrtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbprnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndvjxvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dphtvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrffnhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddrlrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvxjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjrjhrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trrvjd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2224 2936 faf37680b851c12dc3c7f346e756dc0e4547ed807550a015680542571704d960N.exe 29 PID 2936 wrote to memory of 2224 2936 faf37680b851c12dc3c7f346e756dc0e4547ed807550a015680542571704d960N.exe 29 PID 2936 wrote to memory of 2224 2936 faf37680b851c12dc3c7f346e756dc0e4547ed807550a015680542571704d960N.exe 29 PID 2936 wrote to memory of 2224 2936 faf37680b851c12dc3c7f346e756dc0e4547ed807550a015680542571704d960N.exe 29 PID 2224 wrote to memory of 2964 2224 fvfvn.exe 30 PID 2224 wrote to memory of 2964 2224 fvfvn.exe 30 PID 2224 wrote to memory of 2964 2224 fvfvn.exe 30 PID 2224 wrote to memory of 2964 2224 fvfvn.exe 30 PID 2964 wrote to memory of 2852 2964 dlpvbn.exe 31 PID 2964 wrote to memory of 2852 2964 dlpvbn.exe 31 PID 2964 wrote to memory of 2852 2964 dlpvbn.exe 31 PID 2964 wrote to memory of 2852 2964 dlpvbn.exe 31 PID 2852 wrote to memory of 1824 2852 thlbhhd.exe 32 PID 2852 wrote to memory of 1824 2852 thlbhhd.exe 32 PID 2852 wrote to memory of 1824 2852 thlbhhd.exe 32 PID 2852 wrote to memory of 1824 2852 thlbhhd.exe 32 PID 1824 wrote to memory of 2912 1824 xlpppvd.exe 33 PID 1824 wrote to memory of 2912 1824 xlpppvd.exe 33 PID 1824 wrote to memory of 2912 1824 xlpppvd.exe 33 PID 1824 wrote to memory of 2912 1824 xlpppvd.exe 33 PID 2912 wrote to memory of 2764 2912 rbbtrtt.exe 34 PID 2912 wrote to memory of 2764 2912 rbbtrtt.exe 34 PID 2912 wrote to memory of 2764 2912 rbbtrtt.exe 34 PID 2912 wrote to memory of 2764 2912 rbbtrtt.exe 34 PID 2764 wrote to memory of 2624 2764 nvnfntl.exe 35 PID 2764 wrote to memory of 2624 2764 nvnfntl.exe 35 PID 2764 wrote to memory of 2624 2764 nvnfntl.exe 35 PID 2764 wrote to memory of 2624 2764 nvnfntl.exe 35 PID 2624 wrote to memory of 1936 2624 dbdpnr.exe 36 PID 2624 wrote to memory of 1936 2624 dbdpnr.exe 36 PID 2624 wrote to memory of 1936 2624 dbdpnr.exe 36 PID 2624 wrote to memory of 1936 2624 dbdpnr.exe 36 PID 1936 wrote to memory of 1672 1936 fbnbhdd.exe 37 PID 1936 wrote to memory of 1672 1936 fbnbhdd.exe 37 PID 1936 wrote to memory of 1672 1936 fbnbhdd.exe 37 PID 1936 wrote to memory of 1672 1936 fbnbhdd.exe 37 PID 1672 wrote to memory of 1708 1672 xbvpj.exe 38 PID 1672 wrote to memory of 1708 1672 xbvpj.exe 38 PID 1672 wrote to memory of 1708 1672 xbvpj.exe 38 PID 1672 wrote to memory of 1708 1672 xbvpj.exe 38 PID 1708 wrote to memory of 432 1708 rjfrtd.exe 39 PID 1708 wrote to memory of 432 1708 rjfrtd.exe 39 PID 1708 wrote to memory of 432 1708 rjfrtd.exe 39 PID 1708 wrote to memory of 432 1708 rjfrtd.exe 39 PID 432 wrote to memory of 2360 432 ltbdn.exe 40 PID 432 wrote to memory of 2360 432 ltbdn.exe 40 PID 432 wrote to memory of 2360 432 ltbdn.exe 40 PID 432 wrote to memory of 2360 432 ltbdn.exe 40 PID 2360 wrote to memory of 2184 2360 djxddth.exe 41 PID 2360 wrote to memory of 2184 2360 djxddth.exe 41 PID 2360 wrote to memory of 2184 2360 djxddth.exe 41 PID 2360 wrote to memory of 2184 2360 djxddth.exe 41 PID 2184 wrote to memory of 2188 2184 bnphprl.exe 42 PID 2184 wrote to memory of 2188 2184 bnphprl.exe 42 PID 2184 wrote to memory of 2188 2184 bnphprl.exe 42 PID 2184 wrote to memory of 2188 2184 bnphprl.exe 42 PID 2188 wrote to memory of 2844 2188 rlftvt.exe 43 PID 2188 wrote to memory of 2844 2188 rlftvt.exe 43 PID 2188 wrote to memory of 2844 2188 rlftvt.exe 43 PID 2188 wrote to memory of 2844 2188 rlftvt.exe 43 PID 2844 wrote to memory of 2008 2844 hfljbfr.exe 44 PID 2844 wrote to memory of 2008 2844 hfljbfr.exe 44 PID 2844 wrote to memory of 2008 2844 hfljbfr.exe 44 PID 2844 wrote to memory of 2008 2844 hfljbfr.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\faf37680b851c12dc3c7f346e756dc0e4547ed807550a015680542571704d960N.exe"C:\Users\Admin\AppData\Local\Temp\faf37680b851c12dc3c7f346e756dc0e4547ed807550a015680542571704d960N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\fvfvn.exec:\fvfvn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\dlpvbn.exec:\dlpvbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\thlbhhd.exec:\thlbhhd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\xlpppvd.exec:\xlpppvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\rbbtrtt.exec:\rbbtrtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\nvnfntl.exec:\nvnfntl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\dbdpnr.exec:\dbdpnr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\fbnbhdd.exec:\fbnbhdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\xbvpj.exec:\xbvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\rjfrtd.exec:\rjfrtd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\ltbdn.exec:\ltbdn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\djxddth.exec:\djxddth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\bnphprl.exec:\bnphprl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\rlftvt.exec:\rlftvt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\hfljbfr.exec:\hfljbfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\jntjrv.exec:\jntjrv.exe17⤵
- Executes dropped EXE
PID:2008 -
\??\c:\rvxhxnf.exec:\rvxhxnf.exe18⤵
- Executes dropped EXE
PID:1176 -
\??\c:\frtpd.exec:\frtpd.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1536 -
\??\c:\xnvbvtd.exec:\xnvbvtd.exe20⤵
- Executes dropped EXE
PID:2264 -
\??\c:\rbjlltf.exec:\rbjlltf.exe21⤵
- Executes dropped EXE
PID:2452 -
\??\c:\xnjjhtb.exec:\xnjjhtb.exe22⤵
- Executes dropped EXE
PID:2272 -
\??\c:\hdfvb.exec:\hdfvb.exe23⤵
- Executes dropped EXE
PID:1076 -
\??\c:\njhlx.exec:\njhlx.exe24⤵
- Executes dropped EXE
PID:1900 -
\??\c:\rtbxfbl.exec:\rtbxfbl.exe25⤵
- Executes dropped EXE
PID:760 -
\??\c:\dplll.exec:\dplll.exe26⤵
- Executes dropped EXE
PID:948 -
\??\c:\ntpnrvb.exec:\ntpnrvb.exe27⤵
- Executes dropped EXE
PID:2724 -
\??\c:\vtxpvx.exec:\vtxpvx.exe28⤵
- Executes dropped EXE
PID:2712 -
\??\c:\pjrbt.exec:\pjrbt.exe29⤵
- Executes dropped EXE
PID:1768 -
\??\c:\nbxdrrn.exec:\nbxdrrn.exe30⤵
- Executes dropped EXE
PID:1924 -
\??\c:\bbvtfp.exec:\bbvtfp.exe31⤵
- Executes dropped EXE
PID:1152 -
\??\c:\dfdhbj.exec:\dfdhbj.exe32⤵
- Executes dropped EXE
PID:1156 -
\??\c:\jfpxpf.exec:\jfpxpf.exe33⤵
- Executes dropped EXE
PID:1716 -
\??\c:\lvdrf.exec:\lvdrf.exe34⤵
- Executes dropped EXE
PID:2548 -
\??\c:\xndjxr.exec:\xndjxr.exe35⤵
- Executes dropped EXE
PID:1780 -
\??\c:\rlnlrx.exec:\rlnlrx.exe36⤵PID:1480
-
\??\c:\vtvxrrt.exec:\vtvxrrt.exe37⤵
- Executes dropped EXE
PID:2968 -
\??\c:\fntbfp.exec:\fntbfp.exe38⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vfpthbf.exec:\vfpthbf.exe39⤵
- Executes dropped EXE
PID:1584 -
\??\c:\tdxrxh.exec:\tdxrxh.exe40⤵
- Executes dropped EXE
PID:2852 -
\??\c:\ddnvhb.exec:\ddnvhb.exe41⤵
- Executes dropped EXE
PID:2756 -
\??\c:\blfvtr.exec:\blfvtr.exe42⤵
- Executes dropped EXE
PID:2860 -
\??\c:\fddfbt.exec:\fddfbt.exe43⤵
- Executes dropped EXE
PID:2912 -
\??\c:\pdjflb.exec:\pdjflb.exe44⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rnxvn.exec:\rnxvn.exe45⤵
- Executes dropped EXE
PID:2620 -
\??\c:\pjfjxr.exec:\pjfjxr.exe46⤵
- Executes dropped EXE
PID:2728 -
\??\c:\tvhblx.exec:\tvhblx.exe47⤵
- Executes dropped EXE
PID:1692 -
\??\c:\vppfjrf.exec:\vppfjrf.exe48⤵
- Executes dropped EXE
PID:1672 -
\??\c:\dvdrrv.exec:\dvdrrv.exe49⤵
- Executes dropped EXE
PID:1624 -
\??\c:\dtjnl.exec:\dtjnl.exe50⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rvxnlj.exec:\rvxnlj.exe51⤵
- Executes dropped EXE
PID:2196 -
\??\c:\pxfbf.exec:\pxfbf.exe52⤵
- Executes dropped EXE
PID:2788 -
\??\c:\txdvxxf.exec:\txdvxxf.exe53⤵
- Executes dropped EXE
PID:1968 -
\??\c:\frlndj.exec:\frlndj.exe54⤵
- Executes dropped EXE
PID:1444 -
\??\c:\rhrxfnx.exec:\rhrxfnx.exe55⤵
- Executes dropped EXE
PID:2656 -
\??\c:\dnjnlj.exec:\dnjnlj.exe56⤵
- Executes dropped EXE
PID:1468 -
\??\c:\lbfvdbr.exec:\lbfvdbr.exe57⤵
- Executes dropped EXE
PID:1976 -
\??\c:\jrbjj.exec:\jrbjj.exe58⤵
- Executes dropped EXE
PID:2116 -
\??\c:\fvbxlvv.exec:\fvbxlvv.exe59⤵
- Executes dropped EXE
PID:1536 -
\??\c:\hlhbxdr.exec:\hlhbxdr.exe60⤵
- Executes dropped EXE
PID:2576 -
\??\c:\ltxrvxb.exec:\ltxrvxb.exe61⤵
- Executes dropped EXE
PID:396 -
\??\c:\hvnppt.exec:\hvnppt.exe62⤵
- Executes dropped EXE
PID:2144 -
\??\c:\hhbjxdd.exec:\hhbjxdd.exe63⤵
- Executes dropped EXE
PID:2432 -
\??\c:\jprtjvn.exec:\jprtjvn.exe64⤵
- Executes dropped EXE
PID:1076 -
\??\c:\brrpdff.exec:\brrpdff.exe65⤵
- Executes dropped EXE
PID:1992 -
\??\c:\rxjlxh.exec:\rxjlxh.exe66⤵
- Executes dropped EXE
PID:1848 -
\??\c:\ffbfp.exec:\ffbfp.exe67⤵PID:236
-
\??\c:\dntvxxf.exec:\dntvxxf.exe68⤵PID:1500
-
\??\c:\tdvhdv.exec:\tdvhdv.exe69⤵PID:2724
-
\??\c:\hxdjb.exec:\hxdjb.exe70⤵PID:676
-
\??\c:\pfrxdn.exec:\pfrxdn.exe71⤵PID:1132
-
\??\c:\vtpfjd.exec:\vtpfjd.exe72⤵PID:1768
-
\??\c:\pttvhvf.exec:\pttvhvf.exe73⤵PID:2396
-
\??\c:\lhrfh.exec:\lhrfh.exe74⤵PID:2364
-
\??\c:\dxxjnf.exec:\dxxjnf.exe75⤵PID:2660
-
\??\c:\fxrrthv.exec:\fxrrthv.exe76⤵PID:1928
-
\??\c:\dtpjnl.exec:\dtpjnl.exe77⤵PID:2652
-
\??\c:\blxhfrv.exec:\blxhfrv.exe78⤵PID:2840
-
\??\c:\fdhnfr.exec:\fdhnfr.exe79⤵PID:2240
-
\??\c:\nppfjfj.exec:\nppfjfj.exe80⤵PID:2888
-
\??\c:\bhfrhn.exec:\bhfrhn.exe81⤵PID:2964
-
\??\c:\npvtx.exec:\npvtx.exe82⤵PID:1604
-
\??\c:\hhfflr.exec:\hhfflr.exe83⤵PID:2864
-
\??\c:\hbrjjtr.exec:\hbrjjtr.exe84⤵PID:2776
-
\??\c:\vbfjr.exec:\vbfjr.exe85⤵PID:2096
-
\??\c:\vvxjl.exec:\vvxjl.exe86⤵
- System Location Discovery: System Language Discovery
PID:2916 -
\??\c:\hnxjnpt.exec:\hnxjnpt.exe87⤵PID:2780
-
\??\c:\ltxhrhx.exec:\ltxhrhx.exe88⤵PID:2612
-
\??\c:\bxnnjlh.exec:\bxnnjlh.exe89⤵PID:2620
-
\??\c:\bbrbjfn.exec:\bbrbjfn.exe90⤵PID:2380
-
\??\c:\hdvvb.exec:\hdvvb.exe91⤵PID:2716
-
\??\c:\bvjdx.exec:\bvjdx.exe92⤵PID:2020
-
\??\c:\lxjdtf.exec:\lxjdtf.exe93⤵PID:588
-
\??\c:\jjnltv.exec:\jjnltv.exe94⤵PID:3044
-
\??\c:\tvlvrl.exec:\tvlvrl.exe95⤵PID:2128
-
\??\c:\vfltb.exec:\vfltb.exe96⤵PID:2788
-
\??\c:\vxvtvn.exec:\vxvtvn.exe97⤵PID:2408
-
\??\c:\xdpbr.exec:\xdpbr.exe98⤵PID:2704
-
\??\c:\vlnppr.exec:\vlnppr.exe99⤵PID:2152
-
\??\c:\nxdbf.exec:\nxdbf.exe100⤵PID:692
-
\??\c:\ldfvrfl.exec:\ldfvrfl.exe101⤵PID:2464
-
\??\c:\rbrvxth.exec:\rbrvxth.exe102⤵PID:1760
-
\??\c:\xjhbv.exec:\xjhbv.exe103⤵PID:2564
-
\??\c:\bjhbdfj.exec:\bjhbdfj.exe104⤵PID:2060
-
\??\c:\ffbbl.exec:\ffbbl.exe105⤵PID:1592
-
\??\c:\vbrfhx.exec:\vbrfhx.exe106⤵PID:320
-
\??\c:\dnrfjf.exec:\dnrfjf.exe107⤵PID:2532
-
\??\c:\xpvrjbb.exec:\xpvrjbb.exe108⤵PID:1896
-
\??\c:\jrxxrln.exec:\jrxxrln.exe109⤵PID:2056
-
\??\c:\jhlblhn.exec:\jhlblhn.exe110⤵PID:2480
-
\??\c:\fnjrp.exec:\fnjrp.exe111⤵PID:1812
-
\??\c:\fnnfjvb.exec:\fnnfjvb.exe112⤵PID:1552
-
\??\c:\txxvtft.exec:\txxvtft.exe113⤵PID:1088
-
\??\c:\rnvfnf.exec:\rnvfnf.exe114⤵PID:2680
-
\??\c:\fpjndxh.exec:\fpjndxh.exe115⤵PID:1068
-
\??\c:\pvhhj.exec:\pvhhj.exe116⤵PID:1740
-
\??\c:\vtnvfhj.exec:\vtnvfhj.exe117⤵PID:2492
-
\??\c:\btbhn.exec:\btbhn.exe118⤵PID:2412
-
\??\c:\llxbjr.exec:\llxbjr.exe119⤵PID:928
-
\??\c:\jhdnt.exec:\jhdnt.exe120⤵
- System Location Discovery: System Language Discovery
PID:964 -
\??\c:\bhbnfxt.exec:\bhbnfxt.exe121⤵PID:1780
-
\??\c:\pvxnrdl.exec:\pvxnrdl.exe122⤵PID:2952
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-