Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 00:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4465135063dbb879c81d72e683d63aa804874fa7df3f67001ff187e96a9a0925N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
4465135063dbb879c81d72e683d63aa804874fa7df3f67001ff187e96a9a0925N.exe
-
Size
453KB
-
MD5
fa489a40305fe5b34a41d05f35cfc350
-
SHA1
c2a7b5e5b239c810863d9c52cc24dbd0c460f619
-
SHA256
4465135063dbb879c81d72e683d63aa804874fa7df3f67001ff187e96a9a0925
-
SHA512
1a8aa845ce02c1279b2b658c885d0961387a41b60c953a7789d6b40cc403390a979cbff3abf9b9d9dfb3344f2b3cabdf6956a62d0c45626a768749db51192b12
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeK:q7Tc2NYHUrAwfMp3CDK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2132-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/812-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/812-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/812-112-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1708-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/652-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-186-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2320-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-415-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2948-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-499-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/592-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1464-577-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1464-596-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2224-622-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/892-685-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2240-718-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1076-744-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/900-787-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/900-785-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1604-807-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2268 jvbld.exe 2892 lbhtlln.exe 2536 lvhhfpd.exe 2096 jhbbbt.exe 3064 jrprv.exe 2932 hljvlbx.exe 2784 vnntl.exe 812 lpxhv.exe 2564 pntxlt.exe 2036 tfxplfj.exe 264 ljrjn.exe 1708 ddhbvb.exe 2424 xflthxv.exe 2348 phlbhrj.exe 1240 rpnxpvn.exe 652 bdjbd.exe 1316 bthhdtp.exe 2292 dftbrnb.exe 2320 rjxrd.exe 772 fbhxt.exe 1712 fllvj.exe 1972 tbhnnlr.exe 1964 rptvt.exe 2440 thrpxr.exe 1560 bfhhn.exe 1512 nhllnb.exe 1608 lxfplt.exe 1272 flnjbb.exe 2992 hnthj.exe 1944 ddbph.exe 2756 vnptvf.exe 1504 jjltv.exe 1684 jlntbd.exe 2860 tvlbl.exe 2908 rjbbth.exe 3060 jbrvvn.exe 1636 btftt.exe 2136 jflfn.exe 2596 rrptd.exe 3016 pjfrbpd.exe 2928 hdrldp.exe 2800 dnjjhh.exe 2788 txlhpl.exe 1516 fhpjrft.exe 1060 rbhdj.exe 1772 jjxjx.exe 2036 xhtlj.exe 2500 bnbtdr.exe 2512 pbxbnx.exe 2948 vdnvnbp.exe 2396 jjjnn.exe 884 lbhjl.exe 580 dlltb.exe 836 btrtx.exe 808 rfrtfl.exe 1312 ttfnr.exe 2304 bdvftj.exe 1928 vvxnd.exe 2204 dvnjvv.exe 1148 prvdbpt.exe 3000 trbjbxx.exe 2308 btvxl.exe 1832 dfrxbjp.exe 2820 jphllh.exe -
resource yara_rule behavioral1/memory/2132-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/652-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-363-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2800-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-785-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/1604-807-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-855-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jllpltv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vldvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fttdbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdfpnxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdtxxbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nljfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbnrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thrpxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxvhlnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nldtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trlbfpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtdbtfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddfvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvpffv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drtfpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxllt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxjrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpxdbld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhprdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thpxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnjlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdnrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttdtvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrdbblh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dftbrnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptptbbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tljtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbltrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpnjlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvtxpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtjttx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fntvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxdjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpnpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhlvnhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phvtprv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2132 wrote to memory of 2268 2132 4465135063dbb879c81d72e683d63aa804874fa7df3f67001ff187e96a9a0925N.exe 30 PID 2132 wrote to memory of 2268 2132 4465135063dbb879c81d72e683d63aa804874fa7df3f67001ff187e96a9a0925N.exe 30 PID 2132 wrote to memory of 2268 2132 4465135063dbb879c81d72e683d63aa804874fa7df3f67001ff187e96a9a0925N.exe 30 PID 2132 wrote to memory of 2268 2132 4465135063dbb879c81d72e683d63aa804874fa7df3f67001ff187e96a9a0925N.exe 30 PID 2268 wrote to memory of 2892 2268 jvbld.exe 31 PID 2268 wrote to memory of 2892 2268 jvbld.exe 31 PID 2268 wrote to memory of 2892 2268 jvbld.exe 31 PID 2268 wrote to memory of 2892 2268 jvbld.exe 31 PID 2892 wrote to memory of 2536 2892 lbhtlln.exe 32 PID 2892 wrote to memory of 2536 2892 lbhtlln.exe 32 PID 2892 wrote to memory of 2536 2892 lbhtlln.exe 32 PID 2892 wrote to memory of 2536 2892 lbhtlln.exe 32 PID 2536 wrote to memory of 2096 2536 lvhhfpd.exe 33 PID 2536 wrote to memory of 2096 2536 lvhhfpd.exe 33 PID 2536 wrote to memory of 2096 2536 lvhhfpd.exe 33 PID 2536 wrote to memory of 2096 2536 lvhhfpd.exe 33 PID 2096 wrote to memory of 3064 2096 jhbbbt.exe 34 PID 2096 wrote to memory of 3064 2096 jhbbbt.exe 34 PID 2096 wrote to memory of 3064 2096 jhbbbt.exe 34 PID 2096 wrote to memory of 3064 2096 jhbbbt.exe 34 PID 3064 wrote to memory of 2932 3064 jrprv.exe 35 PID 3064 wrote to memory of 2932 3064 jrprv.exe 35 PID 3064 wrote to memory of 2932 3064 jrprv.exe 35 PID 3064 wrote to memory of 2932 3064 jrprv.exe 35 PID 2932 wrote to memory of 2784 2932 hljvlbx.exe 36 PID 2932 wrote to memory of 2784 2932 hljvlbx.exe 36 PID 2932 wrote to memory of 2784 2932 hljvlbx.exe 36 PID 2932 wrote to memory of 2784 2932 hljvlbx.exe 36 PID 2784 wrote to memory of 812 2784 vnntl.exe 37 PID 2784 wrote to memory of 812 2784 vnntl.exe 37 PID 2784 wrote to memory of 812 2784 vnntl.exe 37 PID 2784 wrote to memory of 812 2784 vnntl.exe 37 PID 812 wrote to memory of 2564 812 lpxhv.exe 38 PID 812 wrote to memory of 2564 812 lpxhv.exe 38 PID 812 wrote to memory of 2564 812 lpxhv.exe 38 PID 812 wrote to memory of 2564 812 lpxhv.exe 38 PID 2564 wrote to memory of 2036 2564 pntxlt.exe 39 PID 2564 wrote to memory of 2036 2564 pntxlt.exe 39 PID 2564 wrote to memory of 2036 2564 pntxlt.exe 39 PID 2564 wrote to memory of 2036 2564 pntxlt.exe 39 PID 2036 wrote to memory of 264 2036 tfxplfj.exe 40 PID 2036 wrote to memory of 264 2036 tfxplfj.exe 40 PID 2036 wrote to memory of 264 2036 tfxplfj.exe 40 PID 2036 wrote to memory of 264 2036 tfxplfj.exe 40 PID 264 wrote to memory of 1708 264 ljrjn.exe 41 PID 264 wrote to memory of 1708 264 ljrjn.exe 41 PID 264 wrote to memory of 1708 264 ljrjn.exe 41 PID 264 wrote to memory of 1708 264 ljrjn.exe 41 PID 1708 wrote to memory of 2424 1708 ddhbvb.exe 42 PID 1708 wrote to memory of 2424 1708 ddhbvb.exe 42 PID 1708 wrote to memory of 2424 1708 ddhbvb.exe 42 PID 1708 wrote to memory of 2424 1708 ddhbvb.exe 42 PID 2424 wrote to memory of 2348 2424 xflthxv.exe 43 PID 2424 wrote to memory of 2348 2424 xflthxv.exe 43 PID 2424 wrote to memory of 2348 2424 xflthxv.exe 43 PID 2424 wrote to memory of 2348 2424 xflthxv.exe 43 PID 2348 wrote to memory of 1240 2348 phlbhrj.exe 44 PID 2348 wrote to memory of 1240 2348 phlbhrj.exe 44 PID 2348 wrote to memory of 1240 2348 phlbhrj.exe 44 PID 2348 wrote to memory of 1240 2348 phlbhrj.exe 44 PID 1240 wrote to memory of 652 1240 rpnxpvn.exe 45 PID 1240 wrote to memory of 652 1240 rpnxpvn.exe 45 PID 1240 wrote to memory of 652 1240 rpnxpvn.exe 45 PID 1240 wrote to memory of 652 1240 rpnxpvn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4465135063dbb879c81d72e683d63aa804874fa7df3f67001ff187e96a9a0925N.exe"C:\Users\Admin\AppData\Local\Temp\4465135063dbb879c81d72e683d63aa804874fa7df3f67001ff187e96a9a0925N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\jvbld.exec:\jvbld.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\lbhtlln.exec:\lbhtlln.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\lvhhfpd.exec:\lvhhfpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\jhbbbt.exec:\jhbbbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\jrprv.exec:\jrprv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\hljvlbx.exec:\hljvlbx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\vnntl.exec:\vnntl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\lpxhv.exec:\lpxhv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\pntxlt.exec:\pntxlt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\tfxplfj.exec:\tfxplfj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\ljrjn.exec:\ljrjn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\ddhbvb.exec:\ddhbvb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\xflthxv.exec:\xflthxv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\phlbhrj.exec:\phlbhrj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\rpnxpvn.exec:\rpnxpvn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\bdjbd.exec:\bdjbd.exe17⤵
- Executes dropped EXE
PID:652 -
\??\c:\bthhdtp.exec:\bthhdtp.exe18⤵
- Executes dropped EXE
PID:1316 -
\??\c:\dftbrnb.exec:\dftbrnb.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2292 -
\??\c:\rjxrd.exec:\rjxrd.exe20⤵
- Executes dropped EXE
PID:2320 -
\??\c:\fbhxt.exec:\fbhxt.exe21⤵
- Executes dropped EXE
PID:772 -
\??\c:\fllvj.exec:\fllvj.exe22⤵
- Executes dropped EXE
PID:1712 -
\??\c:\tbhnnlr.exec:\tbhnnlr.exe23⤵
- Executes dropped EXE
PID:1972 -
\??\c:\rptvt.exec:\rptvt.exe24⤵
- Executes dropped EXE
PID:1964 -
\??\c:\thrpxr.exec:\thrpxr.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2440 -
\??\c:\bfhhn.exec:\bfhhn.exe26⤵
- Executes dropped EXE
PID:1560 -
\??\c:\nhllnb.exec:\nhllnb.exe27⤵
- Executes dropped EXE
PID:1512 -
\??\c:\lxfplt.exec:\lxfplt.exe28⤵
- Executes dropped EXE
PID:1608 -
\??\c:\flnjbb.exec:\flnjbb.exe29⤵
- Executes dropped EXE
PID:1272 -
\??\c:\hnthj.exec:\hnthj.exe30⤵
- Executes dropped EXE
PID:2992 -
\??\c:\ddbph.exec:\ddbph.exe31⤵
- Executes dropped EXE
PID:1944 -
\??\c:\vnptvf.exec:\vnptvf.exe32⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jjltv.exec:\jjltv.exe33⤵
- Executes dropped EXE
PID:1504 -
\??\c:\jlntbd.exec:\jlntbd.exe34⤵
- Executes dropped EXE
PID:1684 -
\??\c:\tvlbl.exec:\tvlbl.exe35⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rjbbth.exec:\rjbbth.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2908 -
\??\c:\jbrvvn.exec:\jbrvvn.exe37⤵
- Executes dropped EXE
PID:3060 -
\??\c:\btftt.exec:\btftt.exe38⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jflfn.exec:\jflfn.exe39⤵
- Executes dropped EXE
PID:2136 -
\??\c:\rrptd.exec:\rrptd.exe40⤵
- Executes dropped EXE
PID:2596 -
\??\c:\pjfrbpd.exec:\pjfrbpd.exe41⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hdrldp.exec:\hdrldp.exe42⤵
- Executes dropped EXE
PID:2928 -
\??\c:\dnjjhh.exec:\dnjjhh.exe43⤵
- Executes dropped EXE
PID:2800 -
\??\c:\txlhpl.exec:\txlhpl.exe44⤵
- Executes dropped EXE
PID:2788 -
\??\c:\fhpjrft.exec:\fhpjrft.exe45⤵
- Executes dropped EXE
PID:1516 -
\??\c:\rbhdj.exec:\rbhdj.exe46⤵
- Executes dropped EXE
PID:1060 -
\??\c:\jjxjx.exec:\jjxjx.exe47⤵
- Executes dropped EXE
PID:1772 -
\??\c:\xhtlj.exec:\xhtlj.exe48⤵
- Executes dropped EXE
PID:2036 -
\??\c:\bnbtdr.exec:\bnbtdr.exe49⤵
- Executes dropped EXE
PID:2500 -
\??\c:\pbxbnx.exec:\pbxbnx.exe50⤵
- Executes dropped EXE
PID:2512 -
\??\c:\vdnvnbp.exec:\vdnvnbp.exe51⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jjjnn.exec:\jjjnn.exe52⤵
- Executes dropped EXE
PID:2396 -
\??\c:\lbhjl.exec:\lbhjl.exe53⤵
- Executes dropped EXE
PID:884 -
\??\c:\dlltb.exec:\dlltb.exe54⤵
- Executes dropped EXE
PID:580 -
\??\c:\btrtx.exec:\btrtx.exe55⤵
- Executes dropped EXE
PID:836 -
\??\c:\rfrtfl.exec:\rfrtfl.exe56⤵
- Executes dropped EXE
PID:808 -
\??\c:\ttfnr.exec:\ttfnr.exe57⤵
- Executes dropped EXE
PID:1312 -
\??\c:\bdvftj.exec:\bdvftj.exe58⤵
- Executes dropped EXE
PID:2304 -
\??\c:\vvxnd.exec:\vvxnd.exe59⤵
- Executes dropped EXE
PID:1928 -
\??\c:\dvnjvv.exec:\dvnjvv.exe60⤵
- Executes dropped EXE
PID:2204 -
\??\c:\prvdbpt.exec:\prvdbpt.exe61⤵
- Executes dropped EXE
PID:1148 -
\??\c:\trbjbxx.exec:\trbjbxx.exe62⤵
- Executes dropped EXE
PID:3000 -
\??\c:\btvxl.exec:\btvxl.exe63⤵
- Executes dropped EXE
PID:2308 -
\??\c:\dfrxbjp.exec:\dfrxbjp.exe64⤵
- Executes dropped EXE
PID:1832 -
\??\c:\jphllh.exec:\jphllh.exe65⤵
- Executes dropped EXE
PID:2820 -
\??\c:\lppnxxd.exec:\lppnxxd.exe66⤵PID:908
-
\??\c:\tjvbjnh.exec:\tjvbjnh.exe67⤵PID:1952
-
\??\c:\npbbxjp.exec:\npbbxjp.exe68⤵PID:2052
-
\??\c:\xpvxjd.exec:\xpvxjd.exe69⤵PID:1444
-
\??\c:\jxxhxht.exec:\jxxhxht.exe70⤵PID:236
-
\??\c:\vrdtlb.exec:\vrdtlb.exe71⤵PID:2744
-
\??\c:\fhhddx.exec:\fhhddx.exe72⤵PID:592
-
\??\c:\jvtvvlt.exec:\jvtvvlt.exe73⤵PID:2624
-
\??\c:\fbhfj.exec:\fbhfj.exe74⤵PID:1464
-
\??\c:\hntpj.exec:\hntpj.exe75⤵PID:2480
-
\??\c:\ltddv.exec:\ltddv.exe76⤵PID:432
-
\??\c:\nppjbvj.exec:\nppjbvj.exe77⤵PID:2380
-
\??\c:\fxxvb.exec:\fxxvb.exe78⤵PID:2260
-
\??\c:\nndjbbh.exec:\nndjbbh.exe79⤵PID:2892
-
\??\c:\jjbtf.exec:\jjbtf.exe80⤵PID:2920
-
\??\c:\dxjdth.exec:\dxjdth.exe81⤵PID:2224
-
\??\c:\ddvflj.exec:\ddvflj.exe82⤵PID:3044
-
\??\c:\djhjdr.exec:\djhjdr.exe83⤵PID:2796
-
\??\c:\rtdtp.exec:\rtdtp.exe84⤵PID:2936
-
\??\c:\dlxvx.exec:\dlxvx.exe85⤵PID:2932
-
\??\c:\ltxxbt.exec:\ltxxbt.exe86⤵PID:2928
-
\??\c:\jljddr.exec:\jljddr.exe87⤵PID:2748
-
\??\c:\ffjdb.exec:\ffjdb.exe88⤵PID:2788
-
\??\c:\rfnbp.exec:\rfnbp.exe89⤵PID:1516
-
\??\c:\lrjpxp.exec:\lrjpxp.exe90⤵PID:1060
-
\??\c:\dlxlplv.exec:\dlxlplv.exe91⤵PID:892
-
\??\c:\fbvhf.exec:\fbvhf.exe92⤵PID:1548
-
\??\c:\jrjptx.exec:\jrjptx.exe93⤵PID:2420
-
\??\c:\dnppld.exec:\dnppld.exe94⤵PID:2428
-
\??\c:\lfbxx.exec:\lfbxx.exe95⤵PID:1708
-
\??\c:\jtlhppf.exec:\jtlhppf.exe96⤵PID:2240
-
\??\c:\tbthvh.exec:\tbthvh.exe97⤵PID:1688
-
\??\c:\frptl.exec:\frptl.exe98⤵PID:580
-
\??\c:\ptdhfdf.exec:\ptdhfdf.exe99⤵PID:1192
-
\??\c:\rdjnf.exec:\rdjnf.exe100⤵PID:1076
-
\??\c:\pttnjjp.exec:\pttnjjp.exe101⤵PID:2632
-
\??\c:\bplfvv.exec:\bplfvv.exe102⤵PID:764
-
\??\c:\flxxbrb.exec:\flxxbrb.exe103⤵PID:2372
-
\??\c:\thnfr.exec:\thnfr.exe104⤵
- System Location Discovery: System Language Discovery
PID:2384 -
\??\c:\bvnbfh.exec:\bvnbfh.exe105⤵PID:1940
-
\??\c:\xxxdf.exec:\xxxdf.exe106⤵PID:900
-
\??\c:\rfjpr.exec:\rfjpr.exe107⤵PID:2300
-
\??\c:\pvjbbp.exec:\pvjbbp.exe108⤵PID:840
-
\??\c:\tflxpl.exec:\tflxpl.exe109⤵PID:1604
-
\??\c:\jjnht.exec:\jjnht.exe110⤵PID:2676
-
\??\c:\bxbpf.exec:\bxbpf.exe111⤵PID:1560
-
\??\c:\jbdtv.exec:\jbdtv.exe112⤵PID:2472
-
\??\c:\rfnxpr.exec:\rfnxpr.exe113⤵PID:1444
-
\??\c:\dhtjhvt.exec:\dhtjhvt.exe114⤵PID:236
-
\??\c:\ttjlnj.exec:\ttjlnj.exe115⤵PID:1908
-
\??\c:\prvrlft.exec:\prvrlft.exe116⤵PID:1220
-
\??\c:\jhdhjb.exec:\jhdhjb.exe117⤵PID:2728
-
\??\c:\xdlld.exec:\xdlld.exe118⤵PID:1260
-
\??\c:\dlndlff.exec:\dlndlff.exe119⤵PID:1048
-
\??\c:\dlttbjl.exec:\dlttbjl.exe120⤵PID:3020
-
\??\c:\lfdxx.exec:\lfdxx.exe121⤵PID:2872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-