Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20/12/2024, 01:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1b4166f45bf54b83f39d13bfebeaaf6742773823f2ced23327eec8c02556fd58N.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
1b4166f45bf54b83f39d13bfebeaaf6742773823f2ced23327eec8c02556fd58N.exe
-
Size
454KB
-
MD5
ddf85624cd8a101cd2d1a48b51897450
-
SHA1
804d687027ac97fe4d96fb6593304718604d721e
-
SHA256
1b4166f45bf54b83f39d13bfebeaaf6742773823f2ced23327eec8c02556fd58
-
SHA512
fffa093e1ab13c2727207e05d6ce09825d09a5863d8217c7c193c6d4e19bd559f7a1f25c6f741d89c7df87f4dfcc76750255972bcc29c56a61f10e98cf715aeb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeI:q7Tc2NYHUrAwfMp3CDI
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2936-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-147-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1468-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/612-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-198-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/908-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/704-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-270-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2684-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-425-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2008-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/856-446-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2464-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-545-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/752-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-656-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-696-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/3036-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-709-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2300-789-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/524-805-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2224 dvltp.exe 2964 tjvnn.exe 2852 vlvdrd.exe 2944 dhvlf.exe 2916 nvbfdl.exe 2792 pflfxpr.exe 2768 dpbnx.exe 2796 bhhjrt.exe 2380 vhnjp.exe 1736 hhttx.exe 896 hnjtxh.exe 3028 rjttnf.exe 2700 prhxrv.exe 3032 pxlhl.exe 2408 lnhxfn.exe 1468 xpntrf.exe 612 dlfhr.exe 2464 ptblpl.exe 2500 drttxhf.exe 2288 bbdjr.exe 908 jlnvfjp.exe 980 tlvplx.exe 2428 lfbfn.exe 704 ldprfld.exe 236 fvrjf.exe 1380 bjvltdp.exe 860 rthndlr.exe 1652 hxhfd.exe 2660 brvjl.exe 2684 hpblhjl.exe 1200 hthpxrr.exe 2628 dfpppfh.exe 2148 lhxpn.exe 2240 lfdlnj.exe 2892 fjjbtlt.exe 640 brxnfxb.exe 3016 lrnbpp.exe 2880 rxptdpf.exe 3040 pphlj.exe 2168 ltnxb.exe 2972 jprtpf.exe 2800 lthdlvb.exe 2868 hxfjp.exe 2560 jnlvnff.exe 568 txbtj.exe 2024 hdllbvp.exe 432 flfjrjf.exe 2156 lnvjfnr.exe 2136 txxhn.exe 3056 nhrnlhj.exe 2188 jhxxr.exe 2844 lxxhl.exe 2008 hfbdp.exe 856 pthvph.exe 324 lfpnhv.exe 2304 bpbthv.exe 2264 lpftrl.exe 2464 hdfxnrn.exe 2564 vffptj.exe 2288 prjlr.exe 2424 bfrjr.exe 1896 jfjvfb.exe 760 ffrrhn.exe 2428 hxhvd.exe -
resource yara_rule behavioral1/memory/2936-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/704-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/964-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-775-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlbhtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njjfbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjnvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfbph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vntxdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pplbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjrhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txvblf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptjjjnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbpth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtjptbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvjpbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlvtdxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjbptn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfjxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjbrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdnbvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfpppfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntndv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvxndrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxdjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbrdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vffptj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndbnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdvxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnnph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjllxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnrvhjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdxpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfvfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvlrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdndjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntflhpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnlfrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlpnfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlvphff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvldvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvllnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pflfxpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnrdlbd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2224 2936 1b4166f45bf54b83f39d13bfebeaaf6742773823f2ced23327eec8c02556fd58N.exe 29 PID 2936 wrote to memory of 2224 2936 1b4166f45bf54b83f39d13bfebeaaf6742773823f2ced23327eec8c02556fd58N.exe 29 PID 2936 wrote to memory of 2224 2936 1b4166f45bf54b83f39d13bfebeaaf6742773823f2ced23327eec8c02556fd58N.exe 29 PID 2936 wrote to memory of 2224 2936 1b4166f45bf54b83f39d13bfebeaaf6742773823f2ced23327eec8c02556fd58N.exe 29 PID 2224 wrote to memory of 2964 2224 dvltp.exe 30 PID 2224 wrote to memory of 2964 2224 dvltp.exe 30 PID 2224 wrote to memory of 2964 2224 dvltp.exe 30 PID 2224 wrote to memory of 2964 2224 dvltp.exe 30 PID 2964 wrote to memory of 2852 2964 tjvnn.exe 31 PID 2964 wrote to memory of 2852 2964 tjvnn.exe 31 PID 2964 wrote to memory of 2852 2964 tjvnn.exe 31 PID 2964 wrote to memory of 2852 2964 tjvnn.exe 31 PID 2852 wrote to memory of 2944 2852 vlvdrd.exe 32 PID 2852 wrote to memory of 2944 2852 vlvdrd.exe 32 PID 2852 wrote to memory of 2944 2852 vlvdrd.exe 32 PID 2852 wrote to memory of 2944 2852 vlvdrd.exe 32 PID 2944 wrote to memory of 2916 2944 dhvlf.exe 33 PID 2944 wrote to memory of 2916 2944 dhvlf.exe 33 PID 2944 wrote to memory of 2916 2944 dhvlf.exe 33 PID 2944 wrote to memory of 2916 2944 dhvlf.exe 33 PID 2916 wrote to memory of 2792 2916 nvbfdl.exe 34 PID 2916 wrote to memory of 2792 2916 nvbfdl.exe 34 PID 2916 wrote to memory of 2792 2916 nvbfdl.exe 34 PID 2916 wrote to memory of 2792 2916 nvbfdl.exe 34 PID 2792 wrote to memory of 2768 2792 pflfxpr.exe 35 PID 2792 wrote to memory of 2768 2792 pflfxpr.exe 35 PID 2792 wrote to memory of 2768 2792 pflfxpr.exe 35 PID 2792 wrote to memory of 2768 2792 pflfxpr.exe 35 PID 2768 wrote to memory of 2796 2768 dpbnx.exe 36 PID 2768 wrote to memory of 2796 2768 dpbnx.exe 36 PID 2768 wrote to memory of 2796 2768 dpbnx.exe 36 PID 2768 wrote to memory of 2796 2768 dpbnx.exe 36 PID 2796 wrote to memory of 2380 2796 bhhjrt.exe 37 PID 2796 wrote to memory of 2380 2796 bhhjrt.exe 37 PID 2796 wrote to memory of 2380 2796 bhhjrt.exe 37 PID 2796 wrote to memory of 2380 2796 bhhjrt.exe 37 PID 2380 wrote to memory of 1736 2380 vhnjp.exe 38 PID 2380 wrote to memory of 1736 2380 vhnjp.exe 38 PID 2380 wrote to memory of 1736 2380 vhnjp.exe 38 PID 2380 wrote to memory of 1736 2380 vhnjp.exe 38 PID 1736 wrote to memory of 896 1736 hhttx.exe 39 PID 1736 wrote to memory of 896 1736 hhttx.exe 39 PID 1736 wrote to memory of 896 1736 hhttx.exe 39 PID 1736 wrote to memory of 896 1736 hhttx.exe 39 PID 896 wrote to memory of 3028 896 hnjtxh.exe 40 PID 896 wrote to memory of 3028 896 hnjtxh.exe 40 PID 896 wrote to memory of 3028 896 hnjtxh.exe 40 PID 896 wrote to memory of 3028 896 hnjtxh.exe 40 PID 3028 wrote to memory of 2700 3028 rjttnf.exe 41 PID 3028 wrote to memory of 2700 3028 rjttnf.exe 41 PID 3028 wrote to memory of 2700 3028 rjttnf.exe 41 PID 3028 wrote to memory of 2700 3028 rjttnf.exe 41 PID 2700 wrote to memory of 3032 2700 prhxrv.exe 42 PID 2700 wrote to memory of 3032 2700 prhxrv.exe 42 PID 2700 wrote to memory of 3032 2700 prhxrv.exe 42 PID 2700 wrote to memory of 3032 2700 prhxrv.exe 42 PID 3032 wrote to memory of 2408 3032 pxlhl.exe 43 PID 3032 wrote to memory of 2408 3032 pxlhl.exe 43 PID 3032 wrote to memory of 2408 3032 pxlhl.exe 43 PID 3032 wrote to memory of 2408 3032 pxlhl.exe 43 PID 2408 wrote to memory of 1468 2408 lnhxfn.exe 44 PID 2408 wrote to memory of 1468 2408 lnhxfn.exe 44 PID 2408 wrote to memory of 1468 2408 lnhxfn.exe 44 PID 2408 wrote to memory of 1468 2408 lnhxfn.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b4166f45bf54b83f39d13bfebeaaf6742773823f2ced23327eec8c02556fd58N.exe"C:\Users\Admin\AppData\Local\Temp\1b4166f45bf54b83f39d13bfebeaaf6742773823f2ced23327eec8c02556fd58N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\dvltp.exec:\dvltp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\tjvnn.exec:\tjvnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\vlvdrd.exec:\vlvdrd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\dhvlf.exec:\dhvlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\nvbfdl.exec:\nvbfdl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\pflfxpr.exec:\pflfxpr.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\dpbnx.exec:\dpbnx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\bhhjrt.exec:\bhhjrt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\vhnjp.exec:\vhnjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\hhttx.exec:\hhttx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\hnjtxh.exec:\hnjtxh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\rjttnf.exec:\rjttnf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\prhxrv.exec:\prhxrv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\pxlhl.exec:\pxlhl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\lnhxfn.exec:\lnhxfn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\xpntrf.exec:\xpntrf.exe17⤵
- Executes dropped EXE
PID:1468 -
\??\c:\dlfhr.exec:\dlfhr.exe18⤵
- Executes dropped EXE
PID:612 -
\??\c:\ptblpl.exec:\ptblpl.exe19⤵
- Executes dropped EXE
PID:2464 -
\??\c:\drttxhf.exec:\drttxhf.exe20⤵
- Executes dropped EXE
PID:2500 -
\??\c:\bbdjr.exec:\bbdjr.exe21⤵
- Executes dropped EXE
PID:2288 -
\??\c:\jlnvfjp.exec:\jlnvfjp.exe22⤵
- Executes dropped EXE
PID:908 -
\??\c:\tlvplx.exec:\tlvplx.exe23⤵
- Executes dropped EXE
PID:980 -
\??\c:\lfbfn.exec:\lfbfn.exe24⤵
- Executes dropped EXE
PID:2428 -
\??\c:\ldprfld.exec:\ldprfld.exe25⤵
- Executes dropped EXE
PID:704 -
\??\c:\fvrjf.exec:\fvrjf.exe26⤵
- Executes dropped EXE
PID:236 -
\??\c:\bjvltdp.exec:\bjvltdp.exe27⤵
- Executes dropped EXE
PID:1380 -
\??\c:\rthndlr.exec:\rthndlr.exe28⤵
- Executes dropped EXE
PID:860 -
\??\c:\hxhfd.exec:\hxhfd.exe29⤵
- Executes dropped EXE
PID:1652 -
\??\c:\brvjl.exec:\brvjl.exe30⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hpblhjl.exec:\hpblhjl.exe31⤵
- Executes dropped EXE
PID:2684 -
\??\c:\hthpxrr.exec:\hthpxrr.exe32⤵
- Executes dropped EXE
PID:1200 -
\??\c:\dfpppfh.exec:\dfpppfh.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2628 -
\??\c:\lhxpn.exec:\lhxpn.exe34⤵
- Executes dropped EXE
PID:2148 -
\??\c:\lfdlnj.exec:\lfdlnj.exe35⤵
- Executes dropped EXE
PID:2240 -
\??\c:\fjjbtlt.exec:\fjjbtlt.exe36⤵
- Executes dropped EXE
PID:2892 -
\??\c:\brxnfxb.exec:\brxnfxb.exe37⤵
- Executes dropped EXE
PID:640 -
\??\c:\lrnbpp.exec:\lrnbpp.exe38⤵
- Executes dropped EXE
PID:3016 -
\??\c:\rxptdpf.exec:\rxptdpf.exe39⤵
- Executes dropped EXE
PID:2880 -
\??\c:\pphlj.exec:\pphlj.exe40⤵
- Executes dropped EXE
PID:3040 -
\??\c:\ltnxb.exec:\ltnxb.exe41⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jprtpf.exec:\jprtpf.exe42⤵
- Executes dropped EXE
PID:2972 -
\??\c:\lthdlvb.exec:\lthdlvb.exe43⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hxfjp.exec:\hxfjp.exe44⤵
- Executes dropped EXE
PID:2868 -
\??\c:\jnlvnff.exec:\jnlvnff.exe45⤵
- Executes dropped EXE
PID:2560 -
\??\c:\txbtj.exec:\txbtj.exe46⤵
- Executes dropped EXE
PID:568 -
\??\c:\hdllbvp.exec:\hdllbvp.exe47⤵
- Executes dropped EXE
PID:2024 -
\??\c:\flfjrjf.exec:\flfjrjf.exe48⤵
- Executes dropped EXE
PID:432 -
\??\c:\lnvjfnr.exec:\lnvjfnr.exe49⤵
- Executes dropped EXE
PID:2156 -
\??\c:\txxhn.exec:\txxhn.exe50⤵
- Executes dropped EXE
PID:2136 -
\??\c:\nhrnlhj.exec:\nhrnlhj.exe51⤵
- Executes dropped EXE
PID:3056 -
\??\c:\jhxxr.exec:\jhxxr.exe52⤵
- Executes dropped EXE
PID:2188 -
\??\c:\lxxhl.exec:\lxxhl.exe53⤵
- Executes dropped EXE
PID:2844 -
\??\c:\hfbdp.exec:\hfbdp.exe54⤵
- Executes dropped EXE
PID:2008 -
\??\c:\pthvph.exec:\pthvph.exe55⤵
- Executes dropped EXE
PID:856 -
\??\c:\lfpnhv.exec:\lfpnhv.exe56⤵
- Executes dropped EXE
PID:324 -
\??\c:\bpbthv.exec:\bpbthv.exe57⤵
- Executes dropped EXE
PID:2304 -
\??\c:\lpftrl.exec:\lpftrl.exe58⤵
- Executes dropped EXE
PID:2264 -
\??\c:\hdfxnrn.exec:\hdfxnrn.exe59⤵
- Executes dropped EXE
PID:2464 -
\??\c:\vffptj.exec:\vffptj.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2564 -
\??\c:\prjlr.exec:\prjlr.exe61⤵
- Executes dropped EXE
PID:2288 -
\??\c:\bfrjr.exec:\bfrjr.exe62⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jfjvfb.exec:\jfjvfb.exe63⤵
- Executes dropped EXE
PID:1896 -
\??\c:\ffrrhn.exec:\ffrrhn.exe64⤵
- Executes dropped EXE
PID:760 -
\??\c:\hxhvd.exec:\hxhvd.exe65⤵
- Executes dropped EXE
PID:2428 -
\??\c:\nrrrdlt.exec:\nrrrdlt.exe66⤵PID:2644
-
\??\c:\flvlj.exec:\flvlj.exe67⤵PID:1504
-
\??\c:\jtpnvj.exec:\jtpnvj.exe68⤵PID:2712
-
\??\c:\plxnvjj.exec:\plxnvjj.exe69⤵PID:1768
-
\??\c:\dvrhr.exec:\dvrhr.exe70⤵PID:2668
-
\??\c:\tvxxxf.exec:\tvxxxf.exe71⤵PID:2396
-
\??\c:\bblntt.exec:\bblntt.exe72⤵PID:2660
-
\??\c:\vvxtptv.exec:\vvxtptv.exe73⤵PID:1928
-
\??\c:\nttntxl.exec:\nttntxl.exe74⤵PID:752
-
\??\c:\ttjvr.exec:\ttjvr.exe75⤵PID:964
-
\??\c:\hfdfdpj.exec:\hfdfdpj.exe76⤵PID:1780
-
\??\c:\vnbdv.exec:\vnbdv.exe77⤵PID:1608
-
\??\c:\vplpld.exec:\vplpld.exe78⤵PID:2584
-
\??\c:\xrpvbn.exec:\xrpvbn.exe79⤵PID:2892
-
\??\c:\lprlpn.exec:\lprlpn.exe80⤵PID:640
-
\??\c:\jltlx.exec:\jltlx.exe81⤵PID:3016
-
\??\c:\xhhdhnj.exec:\xhhdhnj.exe82⤵PID:2908
-
\??\c:\xrpxbdf.exec:\xrpxbdf.exe83⤵PID:2920
-
\??\c:\ntnvvnx.exec:\ntnvvnx.exe84⤵PID:2772
-
\??\c:\pxjjvbx.exec:\pxjjvbx.exe85⤵PID:2924
-
\??\c:\fvbhj.exec:\fvbhj.exe86⤵PID:2620
-
\??\c:\dhptrrv.exec:\dhptrrv.exe87⤵PID:2748
-
\??\c:\xvfblx.exec:\xvfblx.exe88⤵PID:2068
-
\??\c:\tjnvl.exec:\tjnvl.exe89⤵
- System Location Discovery: System Language Discovery
PID:2064 -
\??\c:\hhdjtjl.exec:\hhdjtjl.exe90⤵PID:2024
-
\??\c:\jtvfxr.exec:\jtvfxr.exe91⤵PID:3044
-
\??\c:\hlflx.exec:\hlflx.exe92⤵PID:3036
-
\??\c:\phvlp.exec:\phvlp.exe93⤵PID:896
-
\??\c:\dhnhtlj.exec:\dhnhtlj.exe94⤵PID:3060
-
\??\c:\fxpxn.exec:\fxpxn.exe95⤵PID:2120
-
\??\c:\tflbdx.exec:\tflbdx.exe96⤵PID:1444
-
\??\c:\rdttlv.exec:\rdttlv.exe97⤵PID:2008
-
\??\c:\thhxvt.exec:\thhxvt.exe98⤵PID:856
-
\??\c:\ftrlbx.exec:\ftrlbx.exe99⤵PID:2292
-
\??\c:\dbflv.exec:\dbflv.exe100⤵PID:2116
-
\??\c:\vtljtn.exec:\vtljtn.exe101⤵PID:2484
-
\??\c:\fthldh.exec:\fthldh.exe102⤵PID:2452
-
\??\c:\vpjpfpt.exec:\vpjpfpt.exe103⤵PID:2300
-
\??\c:\rlvbrj.exec:\rlvbrj.exe104⤵PID:1844
-
\??\c:\tnvbjhl.exec:\tnvbjhl.exe105⤵PID:908
-
\??\c:\pffhjjh.exec:\pffhjjh.exe106⤵PID:2084
-
\??\c:\bvfxn.exec:\bvfxn.exe107⤵PID:780
-
\??\c:\fdnft.exec:\fdnft.exe108⤵PID:1668
-
\??\c:\dpxdplf.exec:\dpxdplf.exe109⤵PID:524
-
\??\c:\jtdpv.exec:\jtdpv.exe110⤵PID:1472
-
\??\c:\jjtvxd.exec:\jjtvxd.exe111⤵PID:1084
-
\??\c:\lhljnx.exec:\lhljnx.exe112⤵PID:860
-
\??\c:\bhvndtj.exec:\bhvndtj.exe113⤵PID:2316
-
\??\c:\lxxfr.exec:\lxxfr.exe114⤵PID:2384
-
\??\c:\lpvld.exec:\lpvld.exe115⤵PID:1168
-
\??\c:\tphvf.exec:\tphvf.exe116⤵PID:1852
-
\??\c:\dllhf.exec:\dllhf.exe117⤵PID:1200
-
\??\c:\nvfpf.exec:\nvfpf.exe118⤵PID:884
-
\??\c:\rhnbb.exec:\rhnbb.exe119⤵PID:2840
-
\??\c:\pthpjxl.exec:\pthpjxl.exe120⤵PID:1704
-
\??\c:\npldx.exec:\npldx.exe121⤵PID:2980
-
\??\c:\ltxrldh.exec:\ltxrldh.exe122⤵PID:3020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-