Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 20:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f98cc284f2ffbb1251875f8470a94fe7408bc69590f0161bec6c66162eb6273aN.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
f98cc284f2ffbb1251875f8470a94fe7408bc69590f0161bec6c66162eb6273aN.exe
-
Size
454KB
-
MD5
c2a6cf711c7dd1a203202a4bccabfea0
-
SHA1
ce800c6238ffc5172615a8d60d6070ba17c31ed9
-
SHA256
f98cc284f2ffbb1251875f8470a94fe7408bc69590f0161bec6c66162eb6273a
-
SHA512
3076e135782908258e296b748d31b2e44dc245666e02f18879823134d5ca3a7a5bbc7afbc9f3928ea5323c423d33bfeaa6d7d0c9bf719001ea508f26c6381e91
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/1688-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-51-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2152-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/452-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-160-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1400-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-179-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2476-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-335-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2924-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-372-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2876-392-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1952-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-542-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/888-593-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1620-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-670-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2120-803-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1128 fnxvrd.exe 1456 jvlnr.exe 584 hltdxhj.exe 2168 lhbbdx.exe 2152 dvbnh.exe 2512 btnprth.exe 2820 bvphpr.exe 2572 dxvnj.exe 2548 dntpbnd.exe 1872 phnrv.exe 2984 xxtltjn.exe 2908 dpvdll.exe 668 dblvdh.exe 1056 dvpxxjn.exe 452 lffpfl.exe 2028 bjvftv.exe 1400 xhtlxj.exe 1760 vlrfvl.exe 3008 tvdldh.exe 2476 tbnrbvr.exe 2428 txbxjx.exe 2064 pbhrrbp.exe 1164 xphdv.exe 768 hbdnp.exe 960 pbxrjt.exe 1564 ltbrx.exe 2764 dtthf.exe 1708 xljdr.exe 2892 nbrjj.exe 276 rfhfxtv.exe 2172 pjhdv.exe 1828 ntvjhfb.exe 1688 lrjjd.exe 1704 vhnbjv.exe 2192 bnjhpv.exe 2916 rbtnjfl.exe 2020 jfnvhn.exe 2960 nrlhplh.exe 2924 dbtnn.exe 2980 rvdrvhp.exe 2876 vfpxtr.exe 2864 vvbhfvf.exe 2856 ffxnppr.exe 2524 fxjtt.exe 1968 ddbfnj.exe 1040 jhtlb.exe 2904 vphfbjr.exe 1248 nnpnp.exe 2316 tjrbf.exe 1952 rvdrjrx.exe 1108 bvhdjxf.exe 1408 vvnnlx.exe 580 njlfj.exe 1152 nlrfrfb.exe 1400 pjxxd.exe 556 tvvnrn.exe 2656 rfjnp.exe 2456 rvhdh.exe 1424 tvfpjjp.exe 2200 trljhdd.exe 1876 djnltxr.exe 2468 hrrlj.exe 2148 bflrtnp.exe 1700 hhbrbf.exe -
resource yara_rule behavioral1/memory/1688-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/452-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1164-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-278-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2172-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-637-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jljdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jphph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxhjjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfjht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtfjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhnljp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnpxbnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxnppr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntxvtxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldxnft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtnnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxvpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnhhvhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhjbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdxpjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvflbpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvxptxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlptndv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbrrxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htvbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhtrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrdjntj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttprd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thppx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjxtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlrjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbxnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfnph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfhpvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdjbrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndrdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrndjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btpvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbxvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rntnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdnjbnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpjbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbxrjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjjhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxtbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pndjhvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxjdpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfndf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fntjnrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnvfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhldf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbplb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdtpfxv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1688 wrote to memory of 1128 1688 f98cc284f2ffbb1251875f8470a94fe7408bc69590f0161bec6c66162eb6273aN.exe 30 PID 1688 wrote to memory of 1128 1688 f98cc284f2ffbb1251875f8470a94fe7408bc69590f0161bec6c66162eb6273aN.exe 30 PID 1688 wrote to memory of 1128 1688 f98cc284f2ffbb1251875f8470a94fe7408bc69590f0161bec6c66162eb6273aN.exe 30 PID 1688 wrote to memory of 1128 1688 f98cc284f2ffbb1251875f8470a94fe7408bc69590f0161bec6c66162eb6273aN.exe 30 PID 1128 wrote to memory of 1456 1128 fnxvrd.exe 31 PID 1128 wrote to memory of 1456 1128 fnxvrd.exe 31 PID 1128 wrote to memory of 1456 1128 fnxvrd.exe 31 PID 1128 wrote to memory of 1456 1128 fnxvrd.exe 31 PID 1456 wrote to memory of 584 1456 jvlnr.exe 32 PID 1456 wrote to memory of 584 1456 jvlnr.exe 32 PID 1456 wrote to memory of 584 1456 jvlnr.exe 32 PID 1456 wrote to memory of 584 1456 jvlnr.exe 32 PID 584 wrote to memory of 2168 584 hltdxhj.exe 33 PID 584 wrote to memory of 2168 584 hltdxhj.exe 33 PID 584 wrote to memory of 2168 584 hltdxhj.exe 33 PID 584 wrote to memory of 2168 584 hltdxhj.exe 33 PID 2168 wrote to memory of 2152 2168 lhbbdx.exe 34 PID 2168 wrote to memory of 2152 2168 lhbbdx.exe 34 PID 2168 wrote to memory of 2152 2168 lhbbdx.exe 34 PID 2168 wrote to memory of 2152 2168 lhbbdx.exe 34 PID 2152 wrote to memory of 2512 2152 dvbnh.exe 35 PID 2152 wrote to memory of 2512 2152 dvbnh.exe 35 PID 2152 wrote to memory of 2512 2152 dvbnh.exe 35 PID 2152 wrote to memory of 2512 2152 dvbnh.exe 35 PID 2512 wrote to memory of 2820 2512 btnprth.exe 36 PID 2512 wrote to memory of 2820 2512 btnprth.exe 36 PID 2512 wrote to memory of 2820 2512 btnprth.exe 36 PID 2512 wrote to memory of 2820 2512 btnprth.exe 36 PID 2820 wrote to memory of 2572 2820 bvphpr.exe 37 PID 2820 wrote to memory of 2572 2820 bvphpr.exe 37 PID 2820 wrote to memory of 2572 2820 bvphpr.exe 37 PID 2820 wrote to memory of 2572 2820 bvphpr.exe 37 PID 2572 wrote to memory of 2548 2572 dxvnj.exe 38 PID 2572 wrote to memory of 2548 2572 dxvnj.exe 38 PID 2572 wrote to memory of 2548 2572 dxvnj.exe 38 PID 2572 wrote to memory of 2548 2572 dxvnj.exe 38 PID 2548 wrote to memory of 1872 2548 dntpbnd.exe 39 PID 2548 wrote to memory of 1872 2548 dntpbnd.exe 39 PID 2548 wrote to memory of 1872 2548 dntpbnd.exe 39 PID 2548 wrote to memory of 1872 2548 dntpbnd.exe 39 PID 1872 wrote to memory of 2984 1872 phnrv.exe 40 PID 1872 wrote to memory of 2984 1872 phnrv.exe 40 PID 1872 wrote to memory of 2984 1872 phnrv.exe 40 PID 1872 wrote to memory of 2984 1872 phnrv.exe 40 PID 2984 wrote to memory of 2908 2984 xxtltjn.exe 41 PID 2984 wrote to memory of 2908 2984 xxtltjn.exe 41 PID 2984 wrote to memory of 2908 2984 xxtltjn.exe 41 PID 2984 wrote to memory of 2908 2984 xxtltjn.exe 41 PID 2908 wrote to memory of 668 2908 dpvdll.exe 42 PID 2908 wrote to memory of 668 2908 dpvdll.exe 42 PID 2908 wrote to memory of 668 2908 dpvdll.exe 42 PID 2908 wrote to memory of 668 2908 dpvdll.exe 42 PID 668 wrote to memory of 1056 668 dblvdh.exe 43 PID 668 wrote to memory of 1056 668 dblvdh.exe 43 PID 668 wrote to memory of 1056 668 dblvdh.exe 43 PID 668 wrote to memory of 1056 668 dblvdh.exe 43 PID 1056 wrote to memory of 452 1056 dvpxxjn.exe 44 PID 1056 wrote to memory of 452 1056 dvpxxjn.exe 44 PID 1056 wrote to memory of 452 1056 dvpxxjn.exe 44 PID 1056 wrote to memory of 452 1056 dvpxxjn.exe 44 PID 452 wrote to memory of 2028 452 lffpfl.exe 45 PID 452 wrote to memory of 2028 452 lffpfl.exe 45 PID 452 wrote to memory of 2028 452 lffpfl.exe 45 PID 452 wrote to memory of 2028 452 lffpfl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f98cc284f2ffbb1251875f8470a94fe7408bc69590f0161bec6c66162eb6273aN.exe"C:\Users\Admin\AppData\Local\Temp\f98cc284f2ffbb1251875f8470a94fe7408bc69590f0161bec6c66162eb6273aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\fnxvrd.exec:\fnxvrd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\jvlnr.exec:\jvlnr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\hltdxhj.exec:\hltdxhj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:584 -
\??\c:\lhbbdx.exec:\lhbbdx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\dvbnh.exec:\dvbnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\btnprth.exec:\btnprth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\bvphpr.exec:\bvphpr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\dxvnj.exec:\dxvnj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\dntpbnd.exec:\dntpbnd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\phnrv.exec:\phnrv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\xxtltjn.exec:\xxtltjn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\dpvdll.exec:\dpvdll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\dblvdh.exec:\dblvdh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\dvpxxjn.exec:\dvpxxjn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\lffpfl.exec:\lffpfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\bjvftv.exec:\bjvftv.exe17⤵
- Executes dropped EXE
PID:2028 -
\??\c:\xhtlxj.exec:\xhtlxj.exe18⤵
- Executes dropped EXE
PID:1400 -
\??\c:\vlrfvl.exec:\vlrfvl.exe19⤵
- Executes dropped EXE
PID:1760 -
\??\c:\tvdldh.exec:\tvdldh.exe20⤵
- Executes dropped EXE
PID:3008 -
\??\c:\tbnrbvr.exec:\tbnrbvr.exe21⤵
- Executes dropped EXE
PID:2476 -
\??\c:\txbxjx.exec:\txbxjx.exe22⤵
- Executes dropped EXE
PID:2428 -
\??\c:\pbhrrbp.exec:\pbhrrbp.exe23⤵
- Executes dropped EXE
PID:2064 -
\??\c:\xphdv.exec:\xphdv.exe24⤵
- Executes dropped EXE
PID:1164 -
\??\c:\hbdnp.exec:\hbdnp.exe25⤵
- Executes dropped EXE
PID:768 -
\??\c:\pbxrjt.exec:\pbxrjt.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:960 -
\??\c:\ltbrx.exec:\ltbrx.exe27⤵
- Executes dropped EXE
PID:1564 -
\??\c:\dtthf.exec:\dtthf.exe28⤵
- Executes dropped EXE
PID:2764 -
\??\c:\xljdr.exec:\xljdr.exe29⤵
- Executes dropped EXE
PID:1708 -
\??\c:\nbrjj.exec:\nbrjj.exe30⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rfhfxtv.exec:\rfhfxtv.exe31⤵
- Executes dropped EXE
PID:276 -
\??\c:\pjhdv.exec:\pjhdv.exe32⤵
- Executes dropped EXE
PID:2172 -
\??\c:\ntvjhfb.exec:\ntvjhfb.exe33⤵
- Executes dropped EXE
PID:1828 -
\??\c:\lrjjd.exec:\lrjjd.exe34⤵
- Executes dropped EXE
PID:1688 -
\??\c:\vhnbjv.exec:\vhnbjv.exe35⤵
- Executes dropped EXE
PID:1704 -
\??\c:\bnjhpv.exec:\bnjhpv.exe36⤵
- Executes dropped EXE
PID:2192 -
\??\c:\rbtnjfl.exec:\rbtnjfl.exe37⤵
- Executes dropped EXE
PID:2916 -
\??\c:\jfnvhn.exec:\jfnvhn.exe38⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nrlhplh.exec:\nrlhplh.exe39⤵
- Executes dropped EXE
PID:2960 -
\??\c:\dbtnn.exec:\dbtnn.exe40⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rvdrvhp.exec:\rvdrvhp.exe41⤵
- Executes dropped EXE
PID:2980 -
\??\c:\vfpxtr.exec:\vfpxtr.exe42⤵
- Executes dropped EXE
PID:2876 -
\??\c:\vvbhfvf.exec:\vvbhfvf.exe43⤵
- Executes dropped EXE
PID:2864 -
\??\c:\ffxnppr.exec:\ffxnppr.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2856 -
\??\c:\fxjtt.exec:\fxjtt.exe45⤵
- Executes dropped EXE
PID:2524 -
\??\c:\ddbfnj.exec:\ddbfnj.exe46⤵
- Executes dropped EXE
PID:1968 -
\??\c:\jhtlb.exec:\jhtlb.exe47⤵
- Executes dropped EXE
PID:1040 -
\??\c:\vphfbjr.exec:\vphfbjr.exe48⤵
- Executes dropped EXE
PID:2904 -
\??\c:\nnpnp.exec:\nnpnp.exe49⤵
- Executes dropped EXE
PID:1248 -
\??\c:\tjrbf.exec:\tjrbf.exe50⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rvdrjrx.exec:\rvdrjrx.exe51⤵
- Executes dropped EXE
PID:1952 -
\??\c:\bvhdjxf.exec:\bvhdjxf.exe52⤵
- Executes dropped EXE
PID:1108 -
\??\c:\vvnnlx.exec:\vvnnlx.exe53⤵
- Executes dropped EXE
PID:1408 -
\??\c:\njlfj.exec:\njlfj.exe54⤵
- Executes dropped EXE
PID:580 -
\??\c:\nlrfrfb.exec:\nlrfrfb.exe55⤵
- Executes dropped EXE
PID:1152 -
\??\c:\pjxxd.exec:\pjxxd.exe56⤵
- Executes dropped EXE
PID:1400 -
\??\c:\tvvnrn.exec:\tvvnrn.exe57⤵
- Executes dropped EXE
PID:556 -
\??\c:\rfjnp.exec:\rfjnp.exe58⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rvhdh.exec:\rvhdh.exe59⤵
- Executes dropped EXE
PID:2456 -
\??\c:\tvfpjjp.exec:\tvfpjjp.exe60⤵
- Executes dropped EXE
PID:1424 -
\??\c:\trljhdd.exec:\trljhdd.exe61⤵
- Executes dropped EXE
PID:2200 -
\??\c:\djnltxr.exec:\djnltxr.exe62⤵
- Executes dropped EXE
PID:1876 -
\??\c:\hrrlj.exec:\hrrlj.exe63⤵
- Executes dropped EXE
PID:2468 -
\??\c:\bflrtnp.exec:\bflrtnp.exe64⤵
- Executes dropped EXE
PID:2148 -
\??\c:\hhbrbf.exec:\hhbrbf.exe65⤵
- Executes dropped EXE
PID:1700 -
\??\c:\jvdxpjb.exec:\jvdxpjb.exe66⤵
- System Location Discovery: System Language Discovery
PID:1364 -
\??\c:\xfbtb.exec:\xfbtb.exe67⤵PID:2576
-
\??\c:\rfxrrnh.exec:\rfxrrnh.exe68⤵PID:2440
-
\??\c:\trrrb.exec:\trrrb.exe69⤵PID:1312
-
\??\c:\thtfljn.exec:\thtfljn.exe70⤵PID:1708
-
\??\c:\vdrtb.exec:\vdrtb.exe71⤵PID:2096
-
\??\c:\xltpv.exec:\xltpv.exe72⤵PID:2752
-
\??\c:\rrlhjp.exec:\rrlhjp.exe73⤵PID:2616
-
\??\c:\nbxvl.exec:\nbxvl.exe74⤵PID:2172
-
\??\c:\fxnjvd.exec:\fxnjvd.exe75⤵PID:888
-
\??\c:\lphbdn.exec:\lphbdn.exe76⤵PID:936
-
\??\c:\jjnhtx.exec:\jjnhtx.exe77⤵PID:3000
-
\??\c:\bljlrlt.exec:\bljlrlt.exe78⤵PID:1620
-
\??\c:\xdbhfnn.exec:\xdbhfnn.exe79⤵PID:2192
-
\??\c:\rttnd.exec:\rttnd.exe80⤵PID:2140
-
\??\c:\jtpnjvt.exec:\jtpnjvt.exe81⤵PID:3068
-
\??\c:\xhlhhl.exec:\xhlhhl.exe82⤵PID:2964
-
\??\c:\tlpvx.exec:\tlpvx.exe83⤵PID:3032
-
\??\c:\xldvl.exec:\xldvl.exe84⤵PID:2152
-
\??\c:\rvnht.exec:\rvnht.exe85⤵PID:2800
-
\??\c:\dhrlh.exec:\dhrlh.exe86⤵PID:2824
-
\??\c:\htjjjrl.exec:\htjjjrl.exe87⤵PID:2272
-
\??\c:\xvvpxdn.exec:\xvvpxdn.exe88⤵PID:2788
-
\??\c:\rnblf.exec:\rnblf.exe89⤵PID:1084
-
\??\c:\jjbjtn.exec:\jjbjtn.exe90⤵PID:940
-
\??\c:\vjhbvx.exec:\vjhbvx.exe91⤵PID:1516
-
\??\c:\hlldrl.exec:\hlldrl.exe92⤵PID:2132
-
\??\c:\hpjdfxr.exec:\hpjdfxr.exe93⤵PID:2852
-
\??\c:\xjvtlb.exec:\xjvtlb.exe94⤵PID:668
-
\??\c:\xjtxl.exec:\xjtxl.exe95⤵PID:980
-
\??\c:\ftbjdn.exec:\ftbjdn.exe96⤵PID:2348
-
\??\c:\lhhxd.exec:\lhhxd.exe97⤵PID:1408
-
\??\c:\xpnvjnf.exec:\xpnvjnf.exe98⤵PID:1340
-
\??\c:\ttpjpb.exec:\ttpjpb.exe99⤵PID:1152
-
\??\c:\vlrlnb.exec:\vlrlnb.exe100⤵PID:2508
-
\??\c:\hjbfpp.exec:\hjbfpp.exe101⤵PID:520
-
\??\c:\ntxnn.exec:\ntxnn.exe102⤵PID:2412
-
\??\c:\hhrxfpd.exec:\hhrxfpd.exe103⤵PID:2452
-
\??\c:\jdrdv.exec:\jdrdv.exe104⤵PID:2284
-
\??\c:\dnltj.exec:\dnltj.exe105⤵PID:1716
-
\??\c:\vvpnpbh.exec:\vvpnpbh.exe106⤵PID:836
-
\??\c:\jppvxhh.exec:\jppvxhh.exe107⤵PID:1868
-
\??\c:\jrvhxv.exec:\jrvhxv.exe108⤵PID:2120
-
\??\c:\ffrhtb.exec:\ffrhtb.exe109⤵PID:1788
-
\??\c:\fnhffb.exec:\fnhffb.exe110⤵PID:1996
-
\??\c:\dvddlfn.exec:\dvddlfn.exe111⤵PID:1308
-
\??\c:\jpnnbx.exec:\jpnnbx.exe112⤵PID:2208
-
\??\c:\jldltb.exec:\jldltb.exe113⤵PID:2780
-
\??\c:\trblv.exec:\trblv.exe114⤵PID:1768
-
\??\c:\lhprbj.exec:\lhprbj.exe115⤵PID:2448
-
\??\c:\lnrjf.exec:\lnrjf.exe116⤵PID:2392
-
\??\c:\vflnrtt.exec:\vflnrtt.exe117⤵PID:1928
-
\??\c:\nnplhbx.exec:\nnplhbx.exe118⤵PID:2172
-
\??\c:\fnrnh.exec:\fnrnh.exe119⤵PID:1628
-
\??\c:\lnlvvvh.exec:\lnlvvvh.exe120⤵PID:2156
-
\??\c:\xrjhvx.exec:\xrjhvx.exe121⤵PID:760
-
\??\c:\lnbdlrh.exec:\lnbdlrh.exe122⤵PID:2212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-