Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 20:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
168db49ba71e0b54bcb12af5779f46805ad57d303de8df403cbcf16e94079e02N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
168db49ba71e0b54bcb12af5779f46805ad57d303de8df403cbcf16e94079e02N.exe
-
Size
454KB
-
MD5
f8ae8b15d54b6dac1087894e8b68c9a0
-
SHA1
f8dcf0fad802aa27beaacc9ed509476fffd30e69
-
SHA256
168db49ba71e0b54bcb12af5779f46805ad57d303de8df403cbcf16e94079e02
-
SHA512
a3e2a39232a73e7ddbd9e121ad1a8e6ab0cd842944e19ddf41d0c7c6d23306de5d8b8b4def162d38f01cb98e0ac1b6918b012ec9e4a7310d07581fe2d0869142
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeL:q7Tc2NYHUrAwfMp3CDL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2552-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-92-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1612-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-103-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2700-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-172-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1112-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-201-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/436-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-215-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1684-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1068-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-246-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2712-312-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2580-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-407-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2620-422-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1900-450-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2220-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-495-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1460-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-685-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/372-757-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2072-773-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2072-795-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2580 jtnln.exe 2356 rflbvrp.exe 1692 ttdjfpp.exe 2760 rvvlhr.exe 2880 ltftf.exe 2492 xrfjvh.exe 2720 lthbrtx.exe 2632 bvndlhn.exe 1624 hvxrt.exe 1612 nttdn.exe 2700 jfltrnx.exe 1908 pjjtjdd.exe 1780 hvtlxf.exe 1972 bxhfdph.exe 1884 vvrhv.exe 2996 fpnjvrt.exe 2428 rthtbtb.exe 1112 lvxdtbt.exe 2224 jdtnj.exe 2204 nfhjtpb.exe 436 pvxfffh.exe 1320 llvrdnj.exe 1184 vhpbfpt.exe 1684 jlfblb.exe 1656 vtvlpxv.exe 1068 pxtdv.exe 568 dxhxflh.exe 3048 lbdhbr.exe 848 xdxnj.exe 2716 bhvxv.exe 2384 xjhxrh.exe 2552 xnvrpv.exe 2712 bxrld.exe 2580 jhrlhrp.exe 2560 dlrxlp.exe 2324 dhjrd.exe 2424 lrbrvxj.exe 2904 xhbxltp.exe 2776 bdrvrdr.exe 2764 nxbtp.exe 2660 xntfpb.exe 2800 rtntfl.exe 2664 rdvdntl.exe 2704 pxtlht.exe 2156 lpdvtf.exe 692 hxhjbt.exe 2964 hbxpd.exe 756 ppfhb.exe 2620 ldvtfnl.exe 2068 pxjfb.exe 1296 bfdvt.exe 1728 tnjpjjr.exe 1900 lfxtv.exe 1484 bnlnhbh.exe 2820 fvvfv.exe 2220 trhppfb.exe 2248 xphthpp.exe 1932 nrxnn.exe 3064 jnjjfrt.exe 1736 nnjdxx.exe 1644 vpplhh.exe 1836 btdhl.exe 2832 nrvrtfj.exe 1460 vnrjnnl.exe -
resource yara_rule behavioral1/memory/2552-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1112-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/436-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-320-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2764-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-470-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1736-495-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1460-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-765-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/972-780-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhrrnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjfxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjnhtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbbltlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbvlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvbpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfdfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbfjrhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrfpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vflhlfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvptp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbvhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnjjfrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nftnxbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpnfrvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbvvnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnnlttr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbfxprv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnvdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dndppx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lprjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxpjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdtpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfpdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phltnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltrnrtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhhrtx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2552 wrote to memory of 2580 2552 168db49ba71e0b54bcb12af5779f46805ad57d303de8df403cbcf16e94079e02N.exe 30 PID 2552 wrote to memory of 2580 2552 168db49ba71e0b54bcb12af5779f46805ad57d303de8df403cbcf16e94079e02N.exe 30 PID 2552 wrote to memory of 2580 2552 168db49ba71e0b54bcb12af5779f46805ad57d303de8df403cbcf16e94079e02N.exe 30 PID 2552 wrote to memory of 2580 2552 168db49ba71e0b54bcb12af5779f46805ad57d303de8df403cbcf16e94079e02N.exe 30 PID 2580 wrote to memory of 2356 2580 jtnln.exe 31 PID 2580 wrote to memory of 2356 2580 jtnln.exe 31 PID 2580 wrote to memory of 2356 2580 jtnln.exe 31 PID 2580 wrote to memory of 2356 2580 jtnln.exe 31 PID 2356 wrote to memory of 1692 2356 rflbvrp.exe 33 PID 2356 wrote to memory of 1692 2356 rflbvrp.exe 33 PID 2356 wrote to memory of 1692 2356 rflbvrp.exe 33 PID 2356 wrote to memory of 1692 2356 rflbvrp.exe 33 PID 1692 wrote to memory of 2760 1692 ttdjfpp.exe 34 PID 1692 wrote to memory of 2760 1692 ttdjfpp.exe 34 PID 1692 wrote to memory of 2760 1692 ttdjfpp.exe 34 PID 1692 wrote to memory of 2760 1692 ttdjfpp.exe 34 PID 2760 wrote to memory of 2880 2760 rvvlhr.exe 35 PID 2760 wrote to memory of 2880 2760 rvvlhr.exe 35 PID 2760 wrote to memory of 2880 2760 rvvlhr.exe 35 PID 2760 wrote to memory of 2880 2760 rvvlhr.exe 35 PID 2880 wrote to memory of 2492 2880 ltftf.exe 36 PID 2880 wrote to memory of 2492 2880 ltftf.exe 36 PID 2880 wrote to memory of 2492 2880 ltftf.exe 36 PID 2880 wrote to memory of 2492 2880 ltftf.exe 36 PID 2492 wrote to memory of 2720 2492 xrfjvh.exe 37 PID 2492 wrote to memory of 2720 2492 xrfjvh.exe 37 PID 2492 wrote to memory of 2720 2492 xrfjvh.exe 37 PID 2492 wrote to memory of 2720 2492 xrfjvh.exe 37 PID 2720 wrote to memory of 2632 2720 lthbrtx.exe 38 PID 2720 wrote to memory of 2632 2720 lthbrtx.exe 38 PID 2720 wrote to memory of 2632 2720 lthbrtx.exe 38 PID 2720 wrote to memory of 2632 2720 lthbrtx.exe 38 PID 2632 wrote to memory of 1624 2632 bvndlhn.exe 39 PID 2632 wrote to memory of 1624 2632 bvndlhn.exe 39 PID 2632 wrote to memory of 1624 2632 bvndlhn.exe 39 PID 2632 wrote to memory of 1624 2632 bvndlhn.exe 39 PID 1624 wrote to memory of 1612 1624 hvxrt.exe 40 PID 1624 wrote to memory of 1612 1624 hvxrt.exe 40 PID 1624 wrote to memory of 1612 1624 hvxrt.exe 40 PID 1624 wrote to memory of 1612 1624 hvxrt.exe 40 PID 1612 wrote to memory of 2700 1612 nttdn.exe 41 PID 1612 wrote to memory of 2700 1612 nttdn.exe 41 PID 1612 wrote to memory of 2700 1612 nttdn.exe 41 PID 1612 wrote to memory of 2700 1612 nttdn.exe 41 PID 2700 wrote to memory of 1908 2700 jfltrnx.exe 42 PID 2700 wrote to memory of 1908 2700 jfltrnx.exe 42 PID 2700 wrote to memory of 1908 2700 jfltrnx.exe 42 PID 2700 wrote to memory of 1908 2700 jfltrnx.exe 42 PID 1908 wrote to memory of 1780 1908 pjjtjdd.exe 43 PID 1908 wrote to memory of 1780 1908 pjjtjdd.exe 43 PID 1908 wrote to memory of 1780 1908 pjjtjdd.exe 43 PID 1908 wrote to memory of 1780 1908 pjjtjdd.exe 43 PID 1780 wrote to memory of 1972 1780 hvtlxf.exe 44 PID 1780 wrote to memory of 1972 1780 hvtlxf.exe 44 PID 1780 wrote to memory of 1972 1780 hvtlxf.exe 44 PID 1780 wrote to memory of 1972 1780 hvtlxf.exe 44 PID 1972 wrote to memory of 1884 1972 bxhfdph.exe 45 PID 1972 wrote to memory of 1884 1972 bxhfdph.exe 45 PID 1972 wrote to memory of 1884 1972 bxhfdph.exe 45 PID 1972 wrote to memory of 1884 1972 bxhfdph.exe 45 PID 1884 wrote to memory of 2996 1884 vvrhv.exe 46 PID 1884 wrote to memory of 2996 1884 vvrhv.exe 46 PID 1884 wrote to memory of 2996 1884 vvrhv.exe 46 PID 1884 wrote to memory of 2996 1884 vvrhv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\168db49ba71e0b54bcb12af5779f46805ad57d303de8df403cbcf16e94079e02N.exe"C:\Users\Admin\AppData\Local\Temp\168db49ba71e0b54bcb12af5779f46805ad57d303de8df403cbcf16e94079e02N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\jtnln.exec:\jtnln.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\rflbvrp.exec:\rflbvrp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\ttdjfpp.exec:\ttdjfpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\rvvlhr.exec:\rvvlhr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\ltftf.exec:\ltftf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\xrfjvh.exec:\xrfjvh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\lthbrtx.exec:\lthbrtx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\bvndlhn.exec:\bvndlhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\hvxrt.exec:\hvxrt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\nttdn.exec:\nttdn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\jfltrnx.exec:\jfltrnx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\pjjtjdd.exec:\pjjtjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\hvtlxf.exec:\hvtlxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\bxhfdph.exec:\bxhfdph.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\vvrhv.exec:\vvrhv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\fpnjvrt.exec:\fpnjvrt.exe17⤵
- Executes dropped EXE
PID:2996 -
\??\c:\rthtbtb.exec:\rthtbtb.exe18⤵
- Executes dropped EXE
PID:2428 -
\??\c:\lvxdtbt.exec:\lvxdtbt.exe19⤵
- Executes dropped EXE
PID:1112 -
\??\c:\jdtnj.exec:\jdtnj.exe20⤵
- Executes dropped EXE
PID:2224 -
\??\c:\nfhjtpb.exec:\nfhjtpb.exe21⤵
- Executes dropped EXE
PID:2204 -
\??\c:\pvxfffh.exec:\pvxfffh.exe22⤵
- Executes dropped EXE
PID:436 -
\??\c:\llvrdnj.exec:\llvrdnj.exe23⤵
- Executes dropped EXE
PID:1320 -
\??\c:\vhpbfpt.exec:\vhpbfpt.exe24⤵
- Executes dropped EXE
PID:1184 -
\??\c:\jlfblb.exec:\jlfblb.exe25⤵
- Executes dropped EXE
PID:1684 -
\??\c:\vtvlpxv.exec:\vtvlpxv.exe26⤵
- Executes dropped EXE
PID:1656 -
\??\c:\pxtdv.exec:\pxtdv.exe27⤵
- Executes dropped EXE
PID:1068 -
\??\c:\dxhxflh.exec:\dxhxflh.exe28⤵
- Executes dropped EXE
PID:568 -
\??\c:\lbdhbr.exec:\lbdhbr.exe29⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xdxnj.exec:\xdxnj.exe30⤵
- Executes dropped EXE
PID:848 -
\??\c:\bhvxv.exec:\bhvxv.exe31⤵
- Executes dropped EXE
PID:2716 -
\??\c:\xjhxrh.exec:\xjhxrh.exe32⤵
- Executes dropped EXE
PID:2384 -
\??\c:\xnvrpv.exec:\xnvrpv.exe33⤵
- Executes dropped EXE
PID:2552 -
\??\c:\bxrld.exec:\bxrld.exe34⤵
- Executes dropped EXE
PID:2712 -
\??\c:\jhrlhrp.exec:\jhrlhrp.exe35⤵
- Executes dropped EXE
PID:2580 -
\??\c:\dlrxlp.exec:\dlrxlp.exe36⤵
- Executes dropped EXE
PID:2560 -
\??\c:\dhjrd.exec:\dhjrd.exe37⤵
- Executes dropped EXE
PID:2324 -
\??\c:\lrbrvxj.exec:\lrbrvxj.exe38⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xhbxltp.exec:\xhbxltp.exe39⤵
- Executes dropped EXE
PID:2904 -
\??\c:\bdrvrdr.exec:\bdrvrdr.exe40⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nxbtp.exec:\nxbtp.exe41⤵
- Executes dropped EXE
PID:2764 -
\??\c:\xntfpb.exec:\xntfpb.exe42⤵
- Executes dropped EXE
PID:2660 -
\??\c:\rtntfl.exec:\rtntfl.exe43⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rdvdntl.exec:\rdvdntl.exe44⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pxtlht.exec:\pxtlht.exe45⤵
- Executes dropped EXE
PID:2704 -
\??\c:\lpdvtf.exec:\lpdvtf.exe46⤵
- Executes dropped EXE
PID:2156 -
\??\c:\hxhjbt.exec:\hxhjbt.exe47⤵
- Executes dropped EXE
PID:692 -
\??\c:\hbxpd.exec:\hbxpd.exe48⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ppfhb.exec:\ppfhb.exe49⤵
- Executes dropped EXE
PID:756 -
\??\c:\ldvtfnl.exec:\ldvtfnl.exe50⤵
- Executes dropped EXE
PID:2620 -
\??\c:\pxjfb.exec:\pxjfb.exe51⤵
- Executes dropped EXE
PID:2068 -
\??\c:\bfdvt.exec:\bfdvt.exe52⤵
- Executes dropped EXE
PID:1296 -
\??\c:\tnjpjjr.exec:\tnjpjjr.exe53⤵
- Executes dropped EXE
PID:1728 -
\??\c:\lfxtv.exec:\lfxtv.exe54⤵
- Executes dropped EXE
PID:1900 -
\??\c:\bnlnhbh.exec:\bnlnhbh.exe55⤵
- Executes dropped EXE
PID:1484 -
\??\c:\fvvfv.exec:\fvvfv.exe56⤵
- Executes dropped EXE
PID:2820 -
\??\c:\trhppfb.exec:\trhppfb.exe57⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xphthpp.exec:\xphthpp.exe58⤵
- Executes dropped EXE
PID:2248 -
\??\c:\nrxnn.exec:\nrxnn.exe59⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jnjjfrt.exec:\jnjjfrt.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3064 -
\??\c:\nnjdxx.exec:\nnjdxx.exe61⤵
- Executes dropped EXE
PID:1736 -
\??\c:\vpplhh.exec:\vpplhh.exe62⤵
- Executes dropped EXE
PID:1644 -
\??\c:\btdhl.exec:\btdhl.exe63⤵
- Executes dropped EXE
PID:1836 -
\??\c:\nrvrtfj.exec:\nrvrtfj.exe64⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vnrjnnl.exec:\vnrjnnl.exe65⤵
- Executes dropped EXE
PID:1460 -
\??\c:\vjttjv.exec:\vjttjv.exe66⤵PID:336
-
\??\c:\vnfnrh.exec:\vnfnrh.exe67⤵PID:2600
-
\??\c:\vttxbp.exec:\vttxbp.exe68⤵PID:608
-
\??\c:\xtlrd.exec:\xtlrd.exe69⤵PID:1648
-
\??\c:\nlpxj.exec:\nlpxj.exe70⤵PID:1952
-
\??\c:\vbxtlh.exec:\vbxtlh.exe71⤵PID:2488
-
\??\c:\btxrpj.exec:\btxrpj.exe72⤵PID:1716
-
\??\c:\nfnhrjt.exec:\nfnhrjt.exe73⤵PID:1532
-
\??\c:\lbjdlhb.exec:\lbjdlhb.exe74⤵PID:2588
-
\??\c:\xvrlnl.exec:\xvrlnl.exe75⤵PID:2360
-
\??\c:\nbdtpnp.exec:\nbdtpnp.exe76⤵PID:2712
-
\??\c:\ljpdrxn.exec:\ljpdrxn.exe77⤵PID:2352
-
\??\c:\nlrdpl.exec:\nlrdpl.exe78⤵PID:2936
-
\??\c:\pjbtdj.exec:\pjbtdj.exe79⤵PID:1376
-
\??\c:\lvxvh.exec:\lvxvh.exe80⤵PID:2856
-
\??\c:\bjpfhnr.exec:\bjpfhnr.exe81⤵PID:2784
-
\??\c:\rxxhtll.exec:\rxxhtll.exe82⤵PID:1988
-
\??\c:\djtbxld.exec:\djtbxld.exe83⤵PID:3016
-
\??\c:\bbjhxfp.exec:\bbjhxfp.exe84⤵PID:2796
-
\??\c:\bnrjbv.exec:\bnrjbv.exe85⤵PID:2720
-
\??\c:\rxjbxf.exec:\rxjbxf.exe86⤵PID:2752
-
\??\c:\vhxnfj.exec:\vhxnfj.exe87⤵PID:2912
-
\??\c:\pxxrvb.exec:\pxxrvb.exe88⤵PID:2396
-
\??\c:\jfhldxl.exec:\jfhldxl.exe89⤵PID:1572
-
\??\c:\ppvhtj.exec:\ppvhtj.exe90⤵PID:2980
-
\??\c:\jbnbvdd.exec:\jbnbvdd.exe91⤵PID:1172
-
\??\c:\dttbn.exec:\dttbn.exe92⤵PID:836
-
\??\c:\phlvd.exec:\phlvd.exe93⤵PID:536
-
\??\c:\phhvjh.exec:\phhvjh.exe94⤵PID:2068
-
\??\c:\vbprv.exec:\vbprv.exe95⤵PID:2988
-
\??\c:\jplrd.exec:\jplrd.exe96⤵PID:1556
-
\??\c:\xxpxfb.exec:\xxpxfb.exe97⤵PID:1900
-
\??\c:\dtrvjhd.exec:\dtrvjhd.exe98⤵PID:2428
-
\??\c:\xnxrnp.exec:\xnxrnp.exe99⤵PID:2388
-
\??\c:\vvftn.exec:\vvftn.exe100⤵PID:1944
-
\??\c:\ltldtpr.exec:\ltldtpr.exe101⤵PID:372
-
\??\c:\hbxtv.exec:\hbxtv.exe102⤵PID:2152
-
\??\c:\pbrvh.exec:\pbrvh.exe103⤵PID:2072
-
\??\c:\hjnhtj.exec:\hjnhtj.exe104⤵
- System Location Discovery: System Language Discovery
PID:1796 -
\??\c:\rrrrd.exec:\rrrrd.exe105⤵PID:972
-
\??\c:\nxtlp.exec:\nxtlp.exe106⤵PID:2044
-
\??\c:\bfhvl.exec:\bfhvl.exe107⤵PID:1684
-
\??\c:\ljpfnl.exec:\ljpfnl.exe108⤵PID:1536
-
\??\c:\jffphpt.exec:\jffphpt.exe109⤵PID:560
-
\??\c:\fdxjnt.exec:\fdxjnt.exe110⤵PID:580
-
\??\c:\rbjpnt.exec:\rbjpnt.exe111⤵PID:568
-
\??\c:\lprjr.exec:\lprjr.exe112⤵
- System Location Discovery: System Language Discovery
PID:2288 -
\??\c:\nbhvppr.exec:\nbhvppr.exe113⤵PID:1936
-
\??\c:\rhnxnt.exec:\rhnxnt.exe114⤵PID:1520
-
\??\c:\fljhfx.exec:\fljhfx.exe115⤵PID:2576
-
\??\c:\txhldv.exec:\txhldv.exe116⤵PID:324
-
\??\c:\lvbjfr.exec:\lvbjfr.exe117⤵PID:1832
-
\??\c:\bjvvx.exec:\bjvvx.exe118⤵PID:2568
-
\??\c:\xlrnjjv.exec:\xlrnjjv.exe119⤵PID:596
-
\??\c:\phdbddb.exec:\phdbddb.exe120⤵PID:1668
-
\??\c:\txlpt.exec:\txlpt.exe121⤵PID:2772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-