Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 20:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
10edaea87b9eaf2e19f4fb94271d8d742b41f1a98a3354d7b54b8c4d13e1bc7cN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
10edaea87b9eaf2e19f4fb94271d8d742b41f1a98a3354d7b54b8c4d13e1bc7cN.exe
-
Size
453KB
-
MD5
158dcbfc6c9d9db047e1397ffb2c5860
-
SHA1
2900eef7504a2e065290e3fd4223fedfa1498307
-
SHA256
10edaea87b9eaf2e19f4fb94271d8d742b41f1a98a3354d7b54b8c4d13e1bc7c
-
SHA512
c57ffa5bafe1f1e4380766c3ade8a43d95a38681abc39d75d17a0bfa782e1a26da50a5253d4601ee19c0e67f36637cac6165dc3d544de393a5aa1b4e1b2b7c08
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeD:q7Tc2NYHUrAwfMp3CDD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2528-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-47-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3064-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-66-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-103-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1528-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-250-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1512-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-285-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2596-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-308-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2284-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-413-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2392-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1204-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-635-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2276-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-764-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-796-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2076 pxnrhn.exe 2880 fbfpp.exe 3012 bffvr.exe 568 jthjpjv.exe 3064 dxrdnvh.exe 2816 njjnb.exe 2784 vbftvb.exe 2564 hppbf.exe 1836 bldbnn.exe 1528 ffnjnh.exe 2352 rdtbn.exe 1564 ldhdfn.exe 1984 ldfdlnd.exe 2212 jjrpvpd.exe 1628 tpfptt.exe 1712 fpljjxr.exe 580 rfpjd.exe 368 vvvrhd.exe 2408 lrnnrf.exe 2260 drvdxr.exe 2468 bhtflxb.exe 1972 xhlrx.exe 2132 jhvvtt.exe 1924 jnrxdtp.exe 1788 xjllp.exe 1512 tvdxjnd.exe 1648 jhbvrht.exe 1004 ffxpv.exe 1324 xtdxn.exe 2596 nrlpj.exe 1328 jjrxhp.exe 2388 pdjpv.exe 1272 lbfphlb.exe 2284 xpffx.exe 2928 ththtp.exe 2880 ftrtln.exe 2988 xtxndn.exe 3032 ldbpnpx.exe 2124 xbprnt.exe 2488 fxvxbn.exe 2992 lhpnt.exe 2836 lvxdn.exe 1336 hjjnddd.exe 1632 bdjbpnf.exe 1044 jxxnlp.exe 1856 jptvx.exe 1528 hhpvlx.exe 1832 tnxnbph.exe 2332 vbtprd.exe 2860 jbhjvv.exe 2960 tdbbn.exe 2328 drjpd.exe 1628 nvhntf.exe 760 vvxdvv.exe 2380 jjnht.exe 2180 xxxxp.exe 2392 jxdjpnr.exe 1204 jbxfxjn.exe 2260 ndlrl.exe 2492 pbhxrd.exe 1716 jrptx.exe 904 pvxfh.exe 2132 fbphlnn.exe 1356 lvpvhfh.exe -
resource yara_rule behavioral1/memory/2528-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-347-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1044-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-750-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-892-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-936-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-943-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhhdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bddxxdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhrfrlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnvvbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnljff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvjpdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phprrdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tffxdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbftvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvdxjnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbjvbvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpjdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhvhpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttvrpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pprtpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnpfvhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtlfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhxtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxxnlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tltthrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpfhhvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drdplnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntlfxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlbpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfdxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrvtjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drvdxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlblbpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvvrxxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjxfdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfvnxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvdvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fntbhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntdtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frtdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhpjtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtrvlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltxnxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llpfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnxnbph.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2076 2528 10edaea87b9eaf2e19f4fb94271d8d742b41f1a98a3354d7b54b8c4d13e1bc7cN.exe 30 PID 2528 wrote to memory of 2076 2528 10edaea87b9eaf2e19f4fb94271d8d742b41f1a98a3354d7b54b8c4d13e1bc7cN.exe 30 PID 2528 wrote to memory of 2076 2528 10edaea87b9eaf2e19f4fb94271d8d742b41f1a98a3354d7b54b8c4d13e1bc7cN.exe 30 PID 2528 wrote to memory of 2076 2528 10edaea87b9eaf2e19f4fb94271d8d742b41f1a98a3354d7b54b8c4d13e1bc7cN.exe 30 PID 2076 wrote to memory of 2880 2076 pxnrhn.exe 31 PID 2076 wrote to memory of 2880 2076 pxnrhn.exe 31 PID 2076 wrote to memory of 2880 2076 pxnrhn.exe 31 PID 2076 wrote to memory of 2880 2076 pxnrhn.exe 31 PID 2880 wrote to memory of 3012 2880 fbfpp.exe 32 PID 2880 wrote to memory of 3012 2880 fbfpp.exe 32 PID 2880 wrote to memory of 3012 2880 fbfpp.exe 32 PID 2880 wrote to memory of 3012 2880 fbfpp.exe 32 PID 3012 wrote to memory of 568 3012 bffvr.exe 33 PID 3012 wrote to memory of 568 3012 bffvr.exe 33 PID 3012 wrote to memory of 568 3012 bffvr.exe 33 PID 3012 wrote to memory of 568 3012 bffvr.exe 33 PID 568 wrote to memory of 3064 568 jthjpjv.exe 34 PID 568 wrote to memory of 3064 568 jthjpjv.exe 34 PID 568 wrote to memory of 3064 568 jthjpjv.exe 34 PID 568 wrote to memory of 3064 568 jthjpjv.exe 34 PID 3064 wrote to memory of 2816 3064 dxrdnvh.exe 35 PID 3064 wrote to memory of 2816 3064 dxrdnvh.exe 35 PID 3064 wrote to memory of 2816 3064 dxrdnvh.exe 35 PID 3064 wrote to memory of 2816 3064 dxrdnvh.exe 35 PID 2816 wrote to memory of 2784 2816 njjnb.exe 36 PID 2816 wrote to memory of 2784 2816 njjnb.exe 36 PID 2816 wrote to memory of 2784 2816 njjnb.exe 36 PID 2816 wrote to memory of 2784 2816 njjnb.exe 36 PID 2784 wrote to memory of 2564 2784 vbftvb.exe 37 PID 2784 wrote to memory of 2564 2784 vbftvb.exe 37 PID 2784 wrote to memory of 2564 2784 vbftvb.exe 37 PID 2784 wrote to memory of 2564 2784 vbftvb.exe 37 PID 2564 wrote to memory of 1836 2564 hppbf.exe 38 PID 2564 wrote to memory of 1836 2564 hppbf.exe 38 PID 2564 wrote to memory of 1836 2564 hppbf.exe 38 PID 2564 wrote to memory of 1836 2564 hppbf.exe 38 PID 1836 wrote to memory of 1528 1836 bldbnn.exe 39 PID 1836 wrote to memory of 1528 1836 bldbnn.exe 39 PID 1836 wrote to memory of 1528 1836 bldbnn.exe 39 PID 1836 wrote to memory of 1528 1836 bldbnn.exe 39 PID 1528 wrote to memory of 2352 1528 ffnjnh.exe 40 PID 1528 wrote to memory of 2352 1528 ffnjnh.exe 40 PID 1528 wrote to memory of 2352 1528 ffnjnh.exe 40 PID 1528 wrote to memory of 2352 1528 ffnjnh.exe 40 PID 2352 wrote to memory of 1564 2352 rdtbn.exe 41 PID 2352 wrote to memory of 1564 2352 rdtbn.exe 41 PID 2352 wrote to memory of 1564 2352 rdtbn.exe 41 PID 2352 wrote to memory of 1564 2352 rdtbn.exe 41 PID 1564 wrote to memory of 1984 1564 ldhdfn.exe 42 PID 1564 wrote to memory of 1984 1564 ldhdfn.exe 42 PID 1564 wrote to memory of 1984 1564 ldhdfn.exe 42 PID 1564 wrote to memory of 1984 1564 ldhdfn.exe 42 PID 1984 wrote to memory of 2212 1984 ldfdlnd.exe 43 PID 1984 wrote to memory of 2212 1984 ldfdlnd.exe 43 PID 1984 wrote to memory of 2212 1984 ldfdlnd.exe 43 PID 1984 wrote to memory of 2212 1984 ldfdlnd.exe 43 PID 2212 wrote to memory of 1628 2212 jjrpvpd.exe 44 PID 2212 wrote to memory of 1628 2212 jjrpvpd.exe 44 PID 2212 wrote to memory of 1628 2212 jjrpvpd.exe 44 PID 2212 wrote to memory of 1628 2212 jjrpvpd.exe 44 PID 1628 wrote to memory of 1712 1628 tpfptt.exe 45 PID 1628 wrote to memory of 1712 1628 tpfptt.exe 45 PID 1628 wrote to memory of 1712 1628 tpfptt.exe 45 PID 1628 wrote to memory of 1712 1628 tpfptt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\10edaea87b9eaf2e19f4fb94271d8d742b41f1a98a3354d7b54b8c4d13e1bc7cN.exe"C:\Users\Admin\AppData\Local\Temp\10edaea87b9eaf2e19f4fb94271d8d742b41f1a98a3354d7b54b8c4d13e1bc7cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\pxnrhn.exec:\pxnrhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\fbfpp.exec:\fbfpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\bffvr.exec:\bffvr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\jthjpjv.exec:\jthjpjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\dxrdnvh.exec:\dxrdnvh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\njjnb.exec:\njjnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\vbftvb.exec:\vbftvb.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\hppbf.exec:\hppbf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\bldbnn.exec:\bldbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\ffnjnh.exec:\ffnjnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\rdtbn.exec:\rdtbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\ldhdfn.exec:\ldhdfn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\ldfdlnd.exec:\ldfdlnd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\jjrpvpd.exec:\jjrpvpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\tpfptt.exec:\tpfptt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\fpljjxr.exec:\fpljjxr.exe17⤵
- Executes dropped EXE
PID:1712 -
\??\c:\rfpjd.exec:\rfpjd.exe18⤵
- Executes dropped EXE
PID:580 -
\??\c:\vvvrhd.exec:\vvvrhd.exe19⤵
- Executes dropped EXE
PID:368 -
\??\c:\lrnnrf.exec:\lrnnrf.exe20⤵
- Executes dropped EXE
PID:2408 -
\??\c:\drvdxr.exec:\drvdxr.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2260 -
\??\c:\bhtflxb.exec:\bhtflxb.exe22⤵
- Executes dropped EXE
PID:2468 -
\??\c:\xhlrx.exec:\xhlrx.exe23⤵
- Executes dropped EXE
PID:1972 -
\??\c:\jhvvtt.exec:\jhvvtt.exe24⤵
- Executes dropped EXE
PID:2132 -
\??\c:\jnrxdtp.exec:\jnrxdtp.exe25⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xjllp.exec:\xjllp.exe26⤵
- Executes dropped EXE
PID:1788 -
\??\c:\tvdxjnd.exec:\tvdxjnd.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1512 -
\??\c:\jhbvrht.exec:\jhbvrht.exe28⤵
- Executes dropped EXE
PID:1648 -
\??\c:\ffxpv.exec:\ffxpv.exe29⤵
- Executes dropped EXE
PID:1004 -
\??\c:\xtdxn.exec:\xtdxn.exe30⤵
- Executes dropped EXE
PID:1324 -
\??\c:\nrlpj.exec:\nrlpj.exe31⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jjrxhp.exec:\jjrxhp.exe32⤵
- Executes dropped EXE
PID:1328 -
\??\c:\pdjpv.exec:\pdjpv.exe33⤵
- Executes dropped EXE
PID:2388 -
\??\c:\lbfphlb.exec:\lbfphlb.exe34⤵
- Executes dropped EXE
PID:1272 -
\??\c:\xpffx.exec:\xpffx.exe35⤵
- Executes dropped EXE
PID:2284 -
\??\c:\ththtp.exec:\ththtp.exe36⤵
- Executes dropped EXE
PID:2928 -
\??\c:\ftrtln.exec:\ftrtln.exe37⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xtxndn.exec:\xtxndn.exe38⤵
- Executes dropped EXE
PID:2988 -
\??\c:\ldbpnpx.exec:\ldbpnpx.exe39⤵
- Executes dropped EXE
PID:3032 -
\??\c:\xbprnt.exec:\xbprnt.exe40⤵
- Executes dropped EXE
PID:2124 -
\??\c:\fxvxbn.exec:\fxvxbn.exe41⤵
- Executes dropped EXE
PID:2488 -
\??\c:\lhpnt.exec:\lhpnt.exe42⤵
- Executes dropped EXE
PID:2992 -
\??\c:\lvxdn.exec:\lvxdn.exe43⤵
- Executes dropped EXE
PID:2836 -
\??\c:\hjjnddd.exec:\hjjnddd.exe44⤵
- Executes dropped EXE
PID:1336 -
\??\c:\bdjbpnf.exec:\bdjbpnf.exe45⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jxxnlp.exec:\jxxnlp.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1044 -
\??\c:\jptvx.exec:\jptvx.exe47⤵
- Executes dropped EXE
PID:1856 -
\??\c:\hhpvlx.exec:\hhpvlx.exe48⤵
- Executes dropped EXE
PID:1528 -
\??\c:\tnxnbph.exec:\tnxnbph.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1832 -
\??\c:\vbtprd.exec:\vbtprd.exe50⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jbhjvv.exec:\jbhjvv.exe51⤵
- Executes dropped EXE
PID:2860 -
\??\c:\tdbbn.exec:\tdbbn.exe52⤵
- Executes dropped EXE
PID:2960 -
\??\c:\drjpd.exec:\drjpd.exe53⤵
- Executes dropped EXE
PID:2328 -
\??\c:\nvhntf.exec:\nvhntf.exe54⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vvxdvv.exec:\vvxdvv.exe55⤵
- Executes dropped EXE
PID:760 -
\??\c:\jjnht.exec:\jjnht.exe56⤵
- Executes dropped EXE
PID:2380 -
\??\c:\xxxxp.exec:\xxxxp.exe57⤵
- Executes dropped EXE
PID:2180 -
\??\c:\jxdjpnr.exec:\jxdjpnr.exe58⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jbxfxjn.exec:\jbxfxjn.exe59⤵
- Executes dropped EXE
PID:1204 -
\??\c:\ndlrl.exec:\ndlrl.exe60⤵
- Executes dropped EXE
PID:2260 -
\??\c:\pbhxrd.exec:\pbhxrd.exe61⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jrptx.exec:\jrptx.exe62⤵
- Executes dropped EXE
PID:1716 -
\??\c:\pvxfh.exec:\pvxfh.exe63⤵
- Executes dropped EXE
PID:904 -
\??\c:\fbphlnn.exec:\fbphlnn.exe64⤵
- Executes dropped EXE
PID:2132 -
\??\c:\lvpvhfh.exec:\lvpvhfh.exe65⤵
- Executes dropped EXE
PID:1356 -
\??\c:\bnhjf.exec:\bnhjf.exe66⤵PID:2724
-
\??\c:\vxjjx.exec:\vxjjx.exe67⤵PID:680
-
\??\c:\tpfdvfd.exec:\tpfdvfd.exe68⤵PID:596
-
\??\c:\ffntt.exec:\ffntt.exe69⤵PID:1172
-
\??\c:\pdjvr.exec:\pdjvr.exe70⤵PID:1552
-
\??\c:\lhrvf.exec:\lhrvf.exe71⤵PID:2604
-
\??\c:\tpvdhjf.exec:\tpvdhjf.exe72⤵PID:1168
-
\??\c:\jvfdfx.exec:\jvfdfx.exe73⤵PID:704
-
\??\c:\tnfjbjl.exec:\tnfjbjl.exe74⤵PID:1328
-
\??\c:\brllx.exec:\brllx.exe75⤵PID:2548
-
\??\c:\tjrjb.exec:\tjrjb.exe76⤵PID:2956
-
\??\c:\plhnx.exec:\plhnx.exe77⤵PID:1476
-
\??\c:\bnnxtff.exec:\bnnxtff.exe78⤵PID:604
-
\??\c:\lxbvt.exec:\lxbvt.exe79⤵PID:2896
-
\??\c:\bdxdt.exec:\bdxdt.exe80⤵PID:2904
-
\??\c:\jdxppl.exec:\jdxppl.exe81⤵PID:2984
-
\??\c:\lbbdh.exec:\lbbdh.exe82⤵PID:3032
-
\??\c:\vpvpnf.exec:\vpvpnf.exe83⤵PID:2908
-
\??\c:\vrprphv.exec:\vrprphv.exe84⤵PID:536
-
\??\c:\jntpf.exec:\jntpf.exe85⤵PID:2756
-
\??\c:\ntdtp.exec:\ntdtp.exe86⤵
- System Location Discovery: System Language Discovery
PID:2784 -
\??\c:\xjfxld.exec:\xjfxld.exe87⤵PID:2892
-
\??\c:\xdbvldj.exec:\xdbvldj.exe88⤵PID:2456
-
\??\c:\tfvdrdf.exec:\tfvdrdf.exe89⤵PID:1472
-
\??\c:\xvtffd.exec:\xvtffd.exe90⤵PID:2276
-
\??\c:\nldxnht.exec:\nldxnht.exe91⤵PID:572
-
\??\c:\hxvvv.exec:\hxvvv.exe92⤵PID:1392
-
\??\c:\nlvbv.exec:\nlvbv.exe93⤵PID:1832
-
\??\c:\nhjxn.exec:\nhjxn.exe94⤵PID:2872
-
\??\c:\vpftll.exec:\vpftll.exe95⤵PID:980
-
\??\c:\hhnvdpp.exec:\hhnvdpp.exe96⤵PID:2300
-
\??\c:\pjtjjt.exec:\pjtjjt.exe97⤵PID:2328
-
\??\c:\pldlnt.exec:\pldlnt.exe98⤵PID:1800
-
\??\c:\lhfpl.exec:\lhfpl.exe99⤵PID:760
-
\??\c:\txlth.exec:\txlth.exe100⤵PID:2380
-
\??\c:\tvvjtp.exec:\tvvjtp.exe101⤵PID:2412
-
\??\c:\rxbpt.exec:\rxbpt.exe102⤵PID:2232
-
\??\c:\ddntdfp.exec:\ddntdfp.exe103⤵PID:2632
-
\??\c:\bpvpx.exec:\bpvpx.exe104⤵PID:2068
-
\??\c:\pjtrhbn.exec:\pjtrhbn.exe105⤵PID:2128
-
\??\c:\xfxjrl.exec:\xfxjrl.exe106⤵PID:2004
-
\??\c:\fhhdh.exec:\fhhdh.exe107⤵
- System Location Discovery: System Language Discovery
PID:1104 -
\??\c:\vbhphb.exec:\vbhphb.exe108⤵PID:1624
-
\??\c:\dhldj.exec:\dhldj.exe109⤵PID:1492
-
\??\c:\tbrffhr.exec:\tbrffhr.exe110⤵PID:2704
-
\??\c:\nlntp.exec:\nlntp.exe111⤵PID:2148
-
\??\c:\fxlbvjx.exec:\fxlbvjx.exe112⤵PID:668
-
\??\c:\fhxplb.exec:\fhxplb.exe113⤵PID:2736
-
\??\c:\xjfnlf.exec:\xjfnlf.exe114⤵PID:1004
-
\??\c:\dthvvjf.exec:\dthvvjf.exe115⤵PID:1236
-
\??\c:\bppthxv.exec:\bppthxv.exe116⤵PID:1764
-
\??\c:\rdnlvr.exec:\rdnlvr.exe117⤵PID:1680
-
\??\c:\fddjb.exec:\fddjb.exe118⤵PID:804
-
\??\c:\dvpnpj.exec:\dvpnpj.exe119⤵PID:2388
-
\??\c:\tfjjpt.exec:\tfjjpt.exe120⤵PID:1272
-
\??\c:\rhrpf.exec:\rhrpf.exe121⤵PID:1288
-
\??\c:\vdhvlv.exec:\vdhvlv.exe122⤵PID:2980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-