Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 20:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6e460b87dfd3a4638f8cca15867eaad48ea1357c3092c80d391aa1462b2055daN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
6e460b87dfd3a4638f8cca15867eaad48ea1357c3092c80d391aa1462b2055daN.exe
-
Size
454KB
-
MD5
e904337b268b371061a25a51800ba700
-
SHA1
c68e714435603a93e93a1e7ba965fa0b7ff2aa37
-
SHA256
6e460b87dfd3a4638f8cca15867eaad48ea1357c3092c80d391aa1462b2055da
-
SHA512
b8a3b149d4b3bb14d115e081c5651415e03ff11a4b1e9b213df874ee13dc276661713b2fccfc683c146c22b407d17b79ac05ac7a24825e1d10b5352f59e794a6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe2:q7Tc2NYHUrAwfMp3CD2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2240-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/612-187-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2396-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-198-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2484-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-205-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1064-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-302-0x0000000077580000-0x000000007769F000-memory.dmp family_blackmoon behavioral1/memory/936-312-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3044-323-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2196-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1460-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-427-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2028-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-643-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3012-746-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/776-784-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-836-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2244-849-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-850-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-925-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-937-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2868-951-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2696-959-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-1103-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2308 hvnffrj.exe 1756 jprdbvl.exe 2632 djnft.exe 1920 vxdvlj.exe 2880 nxtfft.exe 2824 dvdxtn.exe 2932 vnptfnr.exe 3036 dbntnd.exe 2852 tltfr.exe 2688 dbttvn.exe 2204 trndl.exe 2116 dtvlvhf.exe 2664 hdhjhtb.exe 2028 bnvvbbj.exe 1152 plxvnbh.exe 2576 jhxfnv.exe 2996 vlplnjn.exe 2004 dvnpf.exe 836 xntvf.exe 612 flnhp.exe 2396 fxtjtdl.exe 2484 xtphb.exe 1700 nnpxn.exe 1064 xjfppjd.exe 1752 njvpvfn.exe 1412 dvnbhjr.exe 1028 nflbrl.exe 2640 nhlhrbt.exe 2072 frphb.exe 1672 jvnvjnf.exe 2520 jrfjhlv.exe 3060 htbpr.exe 2452 vjhjbl.exe 936 hpvlxj.exe 3044 xhfvph.exe 1756 lbhnnv.exe 2196 ntfndhd.exe 2152 tvvfn.exe 2920 bxxrnr.exe 1688 bnrnxlx.exe 2512 vdlbll.exe 2912 dfnpd.exe 3008 dxrjt.exe 2792 brlpr.exe 2848 fjjvvrd.exe 2316 vfrjf.exe 1960 drlrrb.exe 2012 jdnhlf.exe 1460 nrvlvh.exe 1456 vbpjtr.exe 2028 ttldjt.exe 1152 hvvlp.exe 2024 dfbrvdx.exe 2988 dnhfdf.exe 1764 vnflj.exe 2940 fdfldp.exe 836 bdrnfpn.exe 612 phxhpx.exe 1612 xdhnl.exe 1652 brbvht.exe 676 ptnbfd.exe 1980 vfjhff.exe 1512 tdvrr.exe 1160 dvvhxvr.exe -
resource yara_rule behavioral1/memory/2240-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-302-0x0000000077580000-0x000000007769F000-memory.dmp upx behavioral1/memory/936-312-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2196-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-784-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-849-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-850-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-939-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-959-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-1002-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-1015-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-1028-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-1078-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfhdvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfhtbvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrbrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbbnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttfpdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnfrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndfhnlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhntr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrtxvll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxrflvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjffxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fphpvfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhrpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttxtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnddln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvntpdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trhjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnrpjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpntl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttvblpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frbppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blfpptd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfdfxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlpprnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvnfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlplr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfjrdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflnbnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlbxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hndxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjjtrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdfdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxffvhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plhnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljdnlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfldt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnxnndl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvrrtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdnfbpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trjppx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntblvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrdhlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfbrvdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbfprbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpthdh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2308 2240 6e460b87dfd3a4638f8cca15867eaad48ea1357c3092c80d391aa1462b2055daN.exe 30 PID 2240 wrote to memory of 2308 2240 6e460b87dfd3a4638f8cca15867eaad48ea1357c3092c80d391aa1462b2055daN.exe 30 PID 2240 wrote to memory of 2308 2240 6e460b87dfd3a4638f8cca15867eaad48ea1357c3092c80d391aa1462b2055daN.exe 30 PID 2240 wrote to memory of 2308 2240 6e460b87dfd3a4638f8cca15867eaad48ea1357c3092c80d391aa1462b2055daN.exe 30 PID 2308 wrote to memory of 1756 2308 hvnffrj.exe 31 PID 2308 wrote to memory of 1756 2308 hvnffrj.exe 31 PID 2308 wrote to memory of 1756 2308 hvnffrj.exe 31 PID 2308 wrote to memory of 1756 2308 hvnffrj.exe 31 PID 1756 wrote to memory of 2632 1756 jprdbvl.exe 32 PID 1756 wrote to memory of 2632 1756 jprdbvl.exe 32 PID 1756 wrote to memory of 2632 1756 jprdbvl.exe 32 PID 1756 wrote to memory of 2632 1756 jprdbvl.exe 32 PID 2632 wrote to memory of 1920 2632 djnft.exe 33 PID 2632 wrote to memory of 1920 2632 djnft.exe 33 PID 2632 wrote to memory of 1920 2632 djnft.exe 33 PID 2632 wrote to memory of 1920 2632 djnft.exe 33 PID 1920 wrote to memory of 2880 1920 vxdvlj.exe 34 PID 1920 wrote to memory of 2880 1920 vxdvlj.exe 34 PID 1920 wrote to memory of 2880 1920 vxdvlj.exe 34 PID 1920 wrote to memory of 2880 1920 vxdvlj.exe 34 PID 2880 wrote to memory of 2824 2880 nxtfft.exe 35 PID 2880 wrote to memory of 2824 2880 nxtfft.exe 35 PID 2880 wrote to memory of 2824 2880 nxtfft.exe 35 PID 2880 wrote to memory of 2824 2880 nxtfft.exe 35 PID 2824 wrote to memory of 2932 2824 dvdxtn.exe 36 PID 2824 wrote to memory of 2932 2824 dvdxtn.exe 36 PID 2824 wrote to memory of 2932 2824 dvdxtn.exe 36 PID 2824 wrote to memory of 2932 2824 dvdxtn.exe 36 PID 2932 wrote to memory of 3036 2932 vnptfnr.exe 37 PID 2932 wrote to memory of 3036 2932 vnptfnr.exe 37 PID 2932 wrote to memory of 3036 2932 vnptfnr.exe 37 PID 2932 wrote to memory of 3036 2932 vnptfnr.exe 37 PID 3036 wrote to memory of 2852 3036 dbntnd.exe 38 PID 3036 wrote to memory of 2852 3036 dbntnd.exe 38 PID 3036 wrote to memory of 2852 3036 dbntnd.exe 38 PID 3036 wrote to memory of 2852 3036 dbntnd.exe 38 PID 2852 wrote to memory of 2688 2852 tltfr.exe 39 PID 2852 wrote to memory of 2688 2852 tltfr.exe 39 PID 2852 wrote to memory of 2688 2852 tltfr.exe 39 PID 2852 wrote to memory of 2688 2852 tltfr.exe 39 PID 2688 wrote to memory of 2204 2688 dbttvn.exe 40 PID 2688 wrote to memory of 2204 2688 dbttvn.exe 40 PID 2688 wrote to memory of 2204 2688 dbttvn.exe 40 PID 2688 wrote to memory of 2204 2688 dbttvn.exe 40 PID 2204 wrote to memory of 2116 2204 trndl.exe 41 PID 2204 wrote to memory of 2116 2204 trndl.exe 41 PID 2204 wrote to memory of 2116 2204 trndl.exe 41 PID 2204 wrote to memory of 2116 2204 trndl.exe 41 PID 2116 wrote to memory of 2664 2116 dtvlvhf.exe 42 PID 2116 wrote to memory of 2664 2116 dtvlvhf.exe 42 PID 2116 wrote to memory of 2664 2116 dtvlvhf.exe 42 PID 2116 wrote to memory of 2664 2116 dtvlvhf.exe 42 PID 2664 wrote to memory of 2028 2664 hdhjhtb.exe 43 PID 2664 wrote to memory of 2028 2664 hdhjhtb.exe 43 PID 2664 wrote to memory of 2028 2664 hdhjhtb.exe 43 PID 2664 wrote to memory of 2028 2664 hdhjhtb.exe 43 PID 2028 wrote to memory of 1152 2028 bnvvbbj.exe 44 PID 2028 wrote to memory of 1152 2028 bnvvbbj.exe 44 PID 2028 wrote to memory of 1152 2028 bnvvbbj.exe 44 PID 2028 wrote to memory of 1152 2028 bnvvbbj.exe 44 PID 1152 wrote to memory of 2576 1152 plxvnbh.exe 45 PID 1152 wrote to memory of 2576 1152 plxvnbh.exe 45 PID 1152 wrote to memory of 2576 1152 plxvnbh.exe 45 PID 1152 wrote to memory of 2576 1152 plxvnbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e460b87dfd3a4638f8cca15867eaad48ea1357c3092c80d391aa1462b2055daN.exe"C:\Users\Admin\AppData\Local\Temp\6e460b87dfd3a4638f8cca15867eaad48ea1357c3092c80d391aa1462b2055daN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\hvnffrj.exec:\hvnffrj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\jprdbvl.exec:\jprdbvl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\djnft.exec:\djnft.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\vxdvlj.exec:\vxdvlj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\nxtfft.exec:\nxtfft.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\dvdxtn.exec:\dvdxtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\vnptfnr.exec:\vnptfnr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\dbntnd.exec:\dbntnd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\tltfr.exec:\tltfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\dbttvn.exec:\dbttvn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\trndl.exec:\trndl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\dtvlvhf.exec:\dtvlvhf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\hdhjhtb.exec:\hdhjhtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\bnvvbbj.exec:\bnvvbbj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\plxvnbh.exec:\plxvnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\jhxfnv.exec:\jhxfnv.exe17⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vlplnjn.exec:\vlplnjn.exe18⤵
- Executes dropped EXE
PID:2996 -
\??\c:\dvnpf.exec:\dvnpf.exe19⤵
- Executes dropped EXE
PID:2004 -
\??\c:\xntvf.exec:\xntvf.exe20⤵
- Executes dropped EXE
PID:836 -
\??\c:\flnhp.exec:\flnhp.exe21⤵
- Executes dropped EXE
PID:612 -
\??\c:\fxtjtdl.exec:\fxtjtdl.exe22⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xtphb.exec:\xtphb.exe23⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nnpxn.exec:\nnpxn.exe24⤵
- Executes dropped EXE
PID:1700 -
\??\c:\xjfppjd.exec:\xjfppjd.exe25⤵
- Executes dropped EXE
PID:1064 -
\??\c:\njvpvfn.exec:\njvpvfn.exe26⤵
- Executes dropped EXE
PID:1752 -
\??\c:\dvnbhjr.exec:\dvnbhjr.exe27⤵
- Executes dropped EXE
PID:1412 -
\??\c:\nflbrl.exec:\nflbrl.exe28⤵
- Executes dropped EXE
PID:1028 -
\??\c:\nhlhrbt.exec:\nhlhrbt.exe29⤵
- Executes dropped EXE
PID:2640 -
\??\c:\frphb.exec:\frphb.exe30⤵
- Executes dropped EXE
PID:2072 -
\??\c:\jvnvjnf.exec:\jvnvjnf.exe31⤵
- Executes dropped EXE
PID:1672 -
\??\c:\jrfjhlv.exec:\jrfjhlv.exe32⤵
- Executes dropped EXE
PID:2520 -
\??\c:\htbpr.exec:\htbpr.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3060 -
\??\c:\vjhjbl.exec:\vjhjbl.exe34⤵
- Executes dropped EXE
PID:2452 -
\??\c:\tbvjpx.exec:\tbvjpx.exe35⤵PID:2404
-
\??\c:\hpvlxj.exec:\hpvlxj.exe36⤵
- Executes dropped EXE
PID:936 -
\??\c:\xhfvph.exec:\xhfvph.exe37⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lbhnnv.exec:\lbhnnv.exe38⤵
- Executes dropped EXE
PID:1756 -
\??\c:\ntfndhd.exec:\ntfndhd.exe39⤵
- Executes dropped EXE
PID:2196 -
\??\c:\tvvfn.exec:\tvvfn.exe40⤵
- Executes dropped EXE
PID:2152 -
\??\c:\bxxrnr.exec:\bxxrnr.exe41⤵
- Executes dropped EXE
PID:2920 -
\??\c:\bnrnxlx.exec:\bnrnxlx.exe42⤵
- Executes dropped EXE
PID:1688 -
\??\c:\vdlbll.exec:\vdlbll.exe43⤵
- Executes dropped EXE
PID:2512 -
\??\c:\dfnpd.exec:\dfnpd.exe44⤵
- Executes dropped EXE
PID:2912 -
\??\c:\dxrjt.exec:\dxrjt.exe45⤵
- Executes dropped EXE
PID:3008 -
\??\c:\brlpr.exec:\brlpr.exe46⤵
- Executes dropped EXE
PID:2792 -
\??\c:\fjjvvrd.exec:\fjjvvrd.exe47⤵
- Executes dropped EXE
PID:2848 -
\??\c:\vfrjf.exec:\vfrjf.exe48⤵
- Executes dropped EXE
PID:2316 -
\??\c:\drlrrb.exec:\drlrrb.exe49⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jdnhlf.exec:\jdnhlf.exe50⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nrvlvh.exec:\nrvlvh.exe51⤵
- Executes dropped EXE
PID:1460 -
\??\c:\vbpjtr.exec:\vbpjtr.exe52⤵
- Executes dropped EXE
PID:1456 -
\??\c:\ttldjt.exec:\ttldjt.exe53⤵
- Executes dropped EXE
PID:2028 -
\??\c:\hvvlp.exec:\hvvlp.exe54⤵
- Executes dropped EXE
PID:1152 -
\??\c:\dfbrvdx.exec:\dfbrvdx.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2024 -
\??\c:\dnhfdf.exec:\dnhfdf.exe56⤵
- Executes dropped EXE
PID:2988 -
\??\c:\vnflj.exec:\vnflj.exe57⤵
- Executes dropped EXE
PID:1764 -
\??\c:\fdfldp.exec:\fdfldp.exe58⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bdrnfpn.exec:\bdrnfpn.exe59⤵
- Executes dropped EXE
PID:836 -
\??\c:\phxhpx.exec:\phxhpx.exe60⤵
- Executes dropped EXE
PID:612 -
\??\c:\xdhnl.exec:\xdhnl.exe61⤵
- Executes dropped EXE
PID:1612 -
\??\c:\brbvht.exec:\brbvht.exe62⤵
- Executes dropped EXE
PID:1652 -
\??\c:\ptnbfd.exec:\ptnbfd.exe63⤵
- Executes dropped EXE
PID:676 -
\??\c:\vfjhff.exec:\vfjhff.exe64⤵
- Executes dropped EXE
PID:1980 -
\??\c:\tdvrr.exec:\tdvrr.exe65⤵
- Executes dropped EXE
PID:1512 -
\??\c:\dvvhxvr.exec:\dvvhxvr.exe66⤵
- Executes dropped EXE
PID:1160 -
\??\c:\hjhnf.exec:\hjhnf.exe67⤵PID:1828
-
\??\c:\htrlnvr.exec:\htrlnvr.exe68⤵PID:1732
-
\??\c:\rvdvp.exec:\rvdvp.exe69⤵PID:1192
-
\??\c:\lldtvb.exec:\lldtvb.exe70⤵PID:864
-
\??\c:\brvppr.exec:\brvppr.exe71⤵PID:772
-
\??\c:\nlhlvhf.exec:\nlhlvhf.exe72⤵PID:1100
-
\??\c:\hlrhnrn.exec:\hlrhnrn.exe73⤵PID:1620
-
\??\c:\vdvpdr.exec:\vdvpdr.exe74⤵PID:2444
-
\??\c:\xnppbvf.exec:\xnppbvf.exe75⤵PID:1216
-
\??\c:\dhhxfr.exec:\dhhxfr.exe76⤵PID:2320
-
\??\c:\dvnbt.exec:\dvnbt.exe77⤵PID:2604
-
\??\c:\xnhxvv.exec:\xnhxvv.exe78⤵PID:1704
-
\??\c:\btpdfl.exec:\btpdfl.exe79⤵PID:1768
-
\??\c:\nxfndl.exec:\nxfndl.exe80⤵PID:1708
-
\??\c:\hlrlf.exec:\hlrlf.exe81⤵PID:2648
-
\??\c:\dfvnvr.exec:\dfvnvr.exe82⤵PID:2104
-
\??\c:\jlxtld.exec:\jlxtld.exe83⤵PID:2196
-
\??\c:\lbdpfh.exec:\lbdpfh.exe84⤵PID:2228
-
\??\c:\frnxt.exec:\frnxt.exe85⤵PID:2892
-
\??\c:\ptbvxjf.exec:\ptbvxjf.exe86⤵PID:2952
-
\??\c:\ddxthlj.exec:\ddxthlj.exe87⤵PID:3052
-
\??\c:\xjjnbfd.exec:\xjjnbfd.exe88⤵PID:2856
-
\??\c:\ldvdd.exec:\ldvdd.exe89⤵PID:3036
-
\??\c:\rxrpj.exec:\rxrpj.exe90⤵PID:2676
-
\??\c:\ftrxfl.exec:\ftrxfl.exe91⤵PID:2752
-
\??\c:\jpxfh.exec:\jpxfh.exe92⤵PID:2720
-
\??\c:\jnvnxj.exec:\jnvnxj.exe93⤵PID:2316
-
\??\c:\hvlrln.exec:\hvlrln.exe94⤵PID:2116
-
\??\c:\tfdrdr.exec:\tfdrdr.exe95⤵PID:1196
-
\??\c:\htllvtx.exec:\htllvtx.exe96⤵PID:1948
-
\??\c:\xxdxvr.exec:\xxdxvr.exe97⤵PID:1772
-
\??\c:\flrbb.exec:\flrbb.exe98⤵PID:1640
-
\??\c:\xrtff.exec:\xrtff.exe99⤵PID:1484
-
\??\c:\jnrpjf.exec:\jnrpjf.exe100⤵
- System Location Discovery: System Language Discovery
PID:2056 -
\??\c:\bppdp.exec:\bppdp.exe101⤵PID:2288
-
\??\c:\bhbrnn.exec:\bhbrnn.exe102⤵PID:3012
-
\??\c:\hjdvlp.exec:\hjdvlp.exe103⤵PID:2416
-
\??\c:\vhbnf.exec:\vhbnf.exe104⤵PID:2276
-
\??\c:\lxplbb.exec:\lxplbb.exe105⤵PID:1696
-
\??\c:\vvtfvlv.exec:\vvtfvlv.exe106⤵PID:2348
-
\??\c:\nvrnvdd.exec:\nvrnvdd.exe107⤵PID:1876
-
\??\c:\lxxfbf.exec:\lxxfbf.exe108⤵PID:776
-
\??\c:\dthbfxn.exec:\dthbfxn.exe109⤵PID:2992
-
\??\c:\bbfprbv.exec:\bbfprbv.exe110⤵
- System Location Discovery: System Language Discovery
PID:992 -
\??\c:\nrbtjth.exec:\nrbtjth.exe111⤵PID:1064
-
\??\c:\pbnbr.exec:\pbnbr.exe112⤵PID:1784
-
\??\c:\xbnpd.exec:\xbnpd.exe113⤵PID:1148
-
\??\c:\hxnpj.exec:\hxnpj.exe114⤵PID:2260
-
\??\c:\lxhnr.exec:\lxhnr.exe115⤵PID:1584
-
\??\c:\jvhhf.exec:\jvhhf.exe116⤵PID:2540
-
\??\c:\rrnndv.exec:\rrnndv.exe117⤵PID:1896
-
\??\c:\jtrjvhf.exec:\jtrjvhf.exe118⤵PID:2244
-
\??\c:\nftppxv.exec:\nftppxv.exe119⤵PID:2520
-
\??\c:\jfdfxj.exec:\jfdfxj.exe120⤵
- System Location Discovery: System Language Discovery
PID:2556 -
\??\c:\pxdbth.exec:\pxdbth.exe121⤵PID:2492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-