Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 05:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
43ee5d36da2b4f862e709eeca36f4150698e5cb0f8440900b0daa9df969c12a6N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
43ee5d36da2b4f862e709eeca36f4150698e5cb0f8440900b0daa9df969c12a6N.exe
-
Size
454KB
-
MD5
51d164a611df217c90d1c43df3f60a30
-
SHA1
591c68047794694e20bbf028e5e6df55ad3a5c11
-
SHA256
43ee5d36da2b4f862e709eeca36f4150698e5cb0f8440900b0daa9df969c12a6
-
SHA512
426eefe977de1af40607e773dd0c07bbf42a702511ca522092efc1c190b739ac87471aac3654a5d9a94afdcd70b7bb828acf29da24502aba1056f66feac9d078
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2388-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-63-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2592-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-100-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1916-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-187-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2236-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1124-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/964-268-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/964-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-398-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/584-445-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2072-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/340-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-592-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2856-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-679-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1688-686-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-699-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-719-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2332-728-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/612-784-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2864-901-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3012 jtntt.exe 1044 jrhnpvd.exe 2948 bvhxrn.exe 2844 dddhd.exe 2936 nhfxr.exe 2848 pnnxt.exe 2712 tvbbb.exe 2592 frtftj.exe 1060 lhxjvpt.exe 2068 fvdxfpt.exe 1916 dlhhvjn.exe 2320 tlfrljl.exe 3036 jlbnnt.exe 2764 dxdbvt.exe 1296 dlppdd.exe 2248 fpdndjj.exe 800 bxhxft.exe 2240 lvvbtr.exe 2236 phjlphf.exe 2492 rxrnpbp.exe 2140 prjjnr.exe 1124 fjdlntf.exe 2012 jpjhh.exe 1636 dttbvxh.exe 1000 bjpvftr.exe 112 dvnnjt.exe 2436 rbrdlb.exe 948 pfdptfd.exe 964 xjlnhjr.exe 2656 xxdbt.exe 2268 pfhnrl.exe 2680 rlxdnrd.exe 1620 txlxvhj.exe 2184 htxnx.exe 1600 fjjxbn.exe 2860 rhxvfv.exe 2984 lldxf.exe 2836 rrrdfph.exe 2312 xdnxl.exe 3024 dpjdfh.exe 2884 bplprp.exe 2876 jxfndph.exe 2732 ttlhx.exe 2716 xnjpjp.exe 2440 xfvxvxt.exe 2780 trrpn.exe 2396 hnfjrx.exe 1844 dpthtvp.exe 1168 vhrblbl.exe 3020 tjhlth.exe 2180 vrpbhdh.exe 540 pbbpf.exe 2764 jbhhjt.exe 2540 rjdfl.exe 584 fhbbtx.exe 1840 ldjxf.exe 1768 tjxfph.exe 2424 pfvfvx.exe 1160 xlbtt.exe 2072 hpnxf.exe 2404 jbtvnbd.exe 2080 lhjbhn.exe 2156 hpbjnb.exe 2484 hfvbjjh.exe -
resource yara_rule behavioral1/memory/2388-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1124-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/964-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-414-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2072-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/340-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-784-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2388-893-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-908-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2736-909-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prpxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rphrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhrblbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfdjbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlxlrhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfpvjbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trdbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbnnlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvtjbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jltln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnfjrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptvdbtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxxlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdhjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljbrft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbvnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnxddhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drldbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfrthl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntlhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptxpdhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dldxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhjpjvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrppl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlpfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftxxrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlfrljl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpbdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptrfdjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtppjln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffdnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdfdjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrnfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxjjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxhxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbpnfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvnnjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nndxxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxdbvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdvdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrthr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prxrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrxtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxflj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjtdxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnxfrf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 3012 2388 43ee5d36da2b4f862e709eeca36f4150698e5cb0f8440900b0daa9df969c12a6N.exe 29 PID 2388 wrote to memory of 3012 2388 43ee5d36da2b4f862e709eeca36f4150698e5cb0f8440900b0daa9df969c12a6N.exe 29 PID 2388 wrote to memory of 3012 2388 43ee5d36da2b4f862e709eeca36f4150698e5cb0f8440900b0daa9df969c12a6N.exe 29 PID 2388 wrote to memory of 3012 2388 43ee5d36da2b4f862e709eeca36f4150698e5cb0f8440900b0daa9df969c12a6N.exe 29 PID 3012 wrote to memory of 1044 3012 jtntt.exe 30 PID 3012 wrote to memory of 1044 3012 jtntt.exe 30 PID 3012 wrote to memory of 1044 3012 jtntt.exe 30 PID 3012 wrote to memory of 1044 3012 jtntt.exe 30 PID 1044 wrote to memory of 2948 1044 jrhnpvd.exe 31 PID 1044 wrote to memory of 2948 1044 jrhnpvd.exe 31 PID 1044 wrote to memory of 2948 1044 jrhnpvd.exe 31 PID 1044 wrote to memory of 2948 1044 jrhnpvd.exe 31 PID 2948 wrote to memory of 2844 2948 bvhxrn.exe 32 PID 2948 wrote to memory of 2844 2948 bvhxrn.exe 32 PID 2948 wrote to memory of 2844 2948 bvhxrn.exe 32 PID 2948 wrote to memory of 2844 2948 bvhxrn.exe 32 PID 2844 wrote to memory of 2936 2844 dddhd.exe 33 PID 2844 wrote to memory of 2936 2844 dddhd.exe 33 PID 2844 wrote to memory of 2936 2844 dddhd.exe 33 PID 2844 wrote to memory of 2936 2844 dddhd.exe 33 PID 2936 wrote to memory of 2848 2936 nhfxr.exe 34 PID 2936 wrote to memory of 2848 2936 nhfxr.exe 34 PID 2936 wrote to memory of 2848 2936 nhfxr.exe 34 PID 2936 wrote to memory of 2848 2936 nhfxr.exe 34 PID 2848 wrote to memory of 2712 2848 pnnxt.exe 35 PID 2848 wrote to memory of 2712 2848 pnnxt.exe 35 PID 2848 wrote to memory of 2712 2848 pnnxt.exe 35 PID 2848 wrote to memory of 2712 2848 pnnxt.exe 35 PID 2712 wrote to memory of 2592 2712 tvbbb.exe 36 PID 2712 wrote to memory of 2592 2712 tvbbb.exe 36 PID 2712 wrote to memory of 2592 2712 tvbbb.exe 36 PID 2712 wrote to memory of 2592 2712 tvbbb.exe 36 PID 2592 wrote to memory of 1060 2592 frtftj.exe 37 PID 2592 wrote to memory of 1060 2592 frtftj.exe 37 PID 2592 wrote to memory of 1060 2592 frtftj.exe 37 PID 2592 wrote to memory of 1060 2592 frtftj.exe 37 PID 1060 wrote to memory of 2068 1060 lhxjvpt.exe 38 PID 1060 wrote to memory of 2068 1060 lhxjvpt.exe 38 PID 1060 wrote to memory of 2068 1060 lhxjvpt.exe 38 PID 1060 wrote to memory of 2068 1060 lhxjvpt.exe 38 PID 2068 wrote to memory of 1916 2068 fvdxfpt.exe 39 PID 2068 wrote to memory of 1916 2068 fvdxfpt.exe 39 PID 2068 wrote to memory of 1916 2068 fvdxfpt.exe 39 PID 2068 wrote to memory of 1916 2068 fvdxfpt.exe 39 PID 1916 wrote to memory of 2320 1916 dlhhvjn.exe 40 PID 1916 wrote to memory of 2320 1916 dlhhvjn.exe 40 PID 1916 wrote to memory of 2320 1916 dlhhvjn.exe 40 PID 1916 wrote to memory of 2320 1916 dlhhvjn.exe 40 PID 2320 wrote to memory of 3036 2320 tlfrljl.exe 41 PID 2320 wrote to memory of 3036 2320 tlfrljl.exe 41 PID 2320 wrote to memory of 3036 2320 tlfrljl.exe 41 PID 2320 wrote to memory of 3036 2320 tlfrljl.exe 41 PID 3036 wrote to memory of 2764 3036 jlbnnt.exe 42 PID 3036 wrote to memory of 2764 3036 jlbnnt.exe 42 PID 3036 wrote to memory of 2764 3036 jlbnnt.exe 42 PID 3036 wrote to memory of 2764 3036 jlbnnt.exe 42 PID 2764 wrote to memory of 1296 2764 dxdbvt.exe 43 PID 2764 wrote to memory of 1296 2764 dxdbvt.exe 43 PID 2764 wrote to memory of 1296 2764 dxdbvt.exe 43 PID 2764 wrote to memory of 1296 2764 dxdbvt.exe 43 PID 1296 wrote to memory of 2248 1296 dlppdd.exe 44 PID 1296 wrote to memory of 2248 1296 dlppdd.exe 44 PID 1296 wrote to memory of 2248 1296 dlppdd.exe 44 PID 1296 wrote to memory of 2248 1296 dlppdd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\43ee5d36da2b4f862e709eeca36f4150698e5cb0f8440900b0daa9df969c12a6N.exe"C:\Users\Admin\AppData\Local\Temp\43ee5d36da2b4f862e709eeca36f4150698e5cb0f8440900b0daa9df969c12a6N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\jtntt.exec:\jtntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\jrhnpvd.exec:\jrhnpvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\bvhxrn.exec:\bvhxrn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\dddhd.exec:\dddhd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\nhfxr.exec:\nhfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\pnnxt.exec:\pnnxt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\tvbbb.exec:\tvbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\frtftj.exec:\frtftj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\lhxjvpt.exec:\lhxjvpt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\fvdxfpt.exec:\fvdxfpt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\dlhhvjn.exec:\dlhhvjn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\tlfrljl.exec:\tlfrljl.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\jlbnnt.exec:\jlbnnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\dxdbvt.exec:\dxdbvt.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\dlppdd.exec:\dlppdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\fpdndjj.exec:\fpdndjj.exe17⤵
- Executes dropped EXE
PID:2248 -
\??\c:\bxhxft.exec:\bxhxft.exe18⤵
- Executes dropped EXE
PID:800 -
\??\c:\lvvbtr.exec:\lvvbtr.exe19⤵
- Executes dropped EXE
PID:2240 -
\??\c:\phjlphf.exec:\phjlphf.exe20⤵
- Executes dropped EXE
PID:2236 -
\??\c:\rxrnpbp.exec:\rxrnpbp.exe21⤵
- Executes dropped EXE
PID:2492 -
\??\c:\prjjnr.exec:\prjjnr.exe22⤵
- Executes dropped EXE
PID:2140 -
\??\c:\fjdlntf.exec:\fjdlntf.exe23⤵
- Executes dropped EXE
PID:1124 -
\??\c:\jpjhh.exec:\jpjhh.exe24⤵
- Executes dropped EXE
PID:2012 -
\??\c:\dttbvxh.exec:\dttbvxh.exe25⤵
- Executes dropped EXE
PID:1636 -
\??\c:\bjpvftr.exec:\bjpvftr.exe26⤵
- Executes dropped EXE
PID:1000 -
\??\c:\dvnnjt.exec:\dvnnjt.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:112 -
\??\c:\rbrdlb.exec:\rbrdlb.exe28⤵
- Executes dropped EXE
PID:2436 -
\??\c:\pfdptfd.exec:\pfdptfd.exe29⤵
- Executes dropped EXE
PID:948 -
\??\c:\xjlnhjr.exec:\xjlnhjr.exe30⤵
- Executes dropped EXE
PID:964 -
\??\c:\xxdbt.exec:\xxdbt.exe31⤵
- Executes dropped EXE
PID:2656 -
\??\c:\pfhnrl.exec:\pfhnrl.exe32⤵
- Executes dropped EXE
PID:2268 -
\??\c:\rlxdnrd.exec:\rlxdnrd.exe33⤵
- Executes dropped EXE
PID:2680 -
\??\c:\txlxvhj.exec:\txlxvhj.exe34⤵
- Executes dropped EXE
PID:1620 -
\??\c:\htxnx.exec:\htxnx.exe35⤵
- Executes dropped EXE
PID:2184 -
\??\c:\fjjxbn.exec:\fjjxbn.exe36⤵
- Executes dropped EXE
PID:1600 -
\??\c:\rhxvfv.exec:\rhxvfv.exe37⤵
- Executes dropped EXE
PID:2860 -
\??\c:\lldxf.exec:\lldxf.exe38⤵
- Executes dropped EXE
PID:2984 -
\??\c:\rrrdfph.exec:\rrrdfph.exe39⤵
- Executes dropped EXE
PID:2836 -
\??\c:\xdnxl.exec:\xdnxl.exe40⤵
- Executes dropped EXE
PID:2312 -
\??\c:\dpjdfh.exec:\dpjdfh.exe41⤵
- Executes dropped EXE
PID:3024 -
\??\c:\bplprp.exec:\bplprp.exe42⤵
- Executes dropped EXE
PID:2884 -
\??\c:\jxfndph.exec:\jxfndph.exe43⤵
- Executes dropped EXE
PID:2876 -
\??\c:\ttlhx.exec:\ttlhx.exe44⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xnjpjp.exec:\xnjpjp.exe45⤵
- Executes dropped EXE
PID:2716 -
\??\c:\xfvxvxt.exec:\xfvxvxt.exe46⤵
- Executes dropped EXE
PID:2440 -
\??\c:\trrpn.exec:\trrpn.exe47⤵
- Executes dropped EXE
PID:2780 -
\??\c:\hnfjrx.exec:\hnfjrx.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2396 -
\??\c:\dpthtvp.exec:\dpthtvp.exe49⤵
- Executes dropped EXE
PID:1844 -
\??\c:\vhrblbl.exec:\vhrblbl.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1168 -
\??\c:\tjhlth.exec:\tjhlth.exe51⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vrpbhdh.exec:\vrpbhdh.exe52⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pbbpf.exec:\pbbpf.exe53⤵
- Executes dropped EXE
PID:540 -
\??\c:\jbhhjt.exec:\jbhhjt.exe54⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rjdfl.exec:\rjdfl.exe55⤵
- Executes dropped EXE
PID:2540 -
\??\c:\fhbbtx.exec:\fhbbtx.exe56⤵
- Executes dropped EXE
PID:584 -
\??\c:\ldjxf.exec:\ldjxf.exe57⤵
- Executes dropped EXE
PID:1840 -
\??\c:\tjxfph.exec:\tjxfph.exe58⤵
- Executes dropped EXE
PID:1768 -
\??\c:\pfvfvx.exec:\pfvfvx.exe59⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xlbtt.exec:\xlbtt.exe60⤵
- Executes dropped EXE
PID:1160 -
\??\c:\hpnxf.exec:\hpnxf.exe61⤵
- Executes dropped EXE
PID:2072 -
\??\c:\jbtvnbd.exec:\jbtvnbd.exe62⤵
- Executes dropped EXE
PID:2404 -
\??\c:\lhjbhn.exec:\lhjbhn.exe63⤵
- Executes dropped EXE
PID:2080 -
\??\c:\hpbjnb.exec:\hpbjnb.exe64⤵
- Executes dropped EXE
PID:2156 -
\??\c:\hfvbjjh.exec:\hfvbjjh.exe65⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vfdjbh.exec:\vfdjbh.exe66⤵
- System Location Discovery: System Language Discovery
PID:340 -
\??\c:\jxttnpp.exec:\jxttnpp.exe67⤵PID:696
-
\??\c:\rpvdph.exec:\rpvdph.exe68⤵PID:2564
-
\??\c:\fvltn.exec:\fvltn.exe69⤵PID:2284
-
\??\c:\vjndv.exec:\vjndv.exe70⤵PID:1724
-
\??\c:\bfnfnr.exec:\bfnfnr.exe71⤵PID:1372
-
\??\c:\lxhvpb.exec:\lxhvpb.exe72⤵PID:1756
-
\??\c:\vtptbv.exec:\vtptbv.exe73⤵PID:1560
-
\??\c:\pdnbjb.exec:\pdnbjb.exe74⤵PID:1920
-
\??\c:\vrptv.exec:\vrptv.exe75⤵PID:2280
-
\??\c:\htnpv.exec:\htnpv.exe76⤵PID:1016
-
\??\c:\ltpht.exec:\ltpht.exe77⤵PID:2680
-
\??\c:\pndntnf.exec:\pndntnf.exe78⤵PID:1620
-
\??\c:\thdpr.exec:\thdpr.exe79⤵PID:2288
-
\??\c:\njfpt.exec:\njfpt.exe80⤵PID:2856
-
\??\c:\dtllhjr.exec:\dtllhjr.exe81⤵PID:1044
-
\??\c:\tlfrvbd.exec:\tlfrvbd.exe82⤵PID:2408
-
\??\c:\lljxlj.exec:\lljxlj.exe83⤵PID:2836
-
\??\c:\plhxxn.exec:\plhxxn.exe84⤵PID:2312
-
\??\c:\dhrdptd.exec:\dhrdptd.exe85⤵PID:2572
-
\??\c:\jdrjv.exec:\jdrjv.exe86⤵PID:2884
-
\??\c:\hrhxb.exec:\hrhxb.exe87⤵PID:2876
-
\??\c:\vjdhv.exec:\vjdhv.exe88⤵PID:2744
-
\??\c:\fljdrt.exec:\fljdrt.exe89⤵PID:2592
-
\??\c:\pttht.exec:\pttht.exe90⤵PID:2116
-
\??\c:\lhfvjrt.exec:\lhfvjrt.exe91⤵PID:832
-
\??\c:\dhvdbl.exec:\dhvdbl.exe92⤵PID:1688
-
\??\c:\ppxff.exec:\ppxff.exe93⤵PID:2956
-
\??\c:\xfrpbd.exec:\xfrpbd.exe94⤵PID:2800
-
\??\c:\rbjftjr.exec:\rbjftjr.exe95⤵PID:2200
-
\??\c:\fttjxnn.exec:\fttjxnn.exe96⤵PID:2952
-
\??\c:\dpbdpd.exec:\dpbdpd.exe97⤵
- System Location Discovery: System Language Discovery
PID:2024 -
\??\c:\jtbpjt.exec:\jtbpjt.exe98⤵PID:2332
-
\??\c:\nrnbp.exec:\nrnbp.exe99⤵PID:2248
-
\??\c:\vdvtftx.exec:\vdvtftx.exe100⤵PID:1744
-
\??\c:\xhjpjvx.exec:\xhjpjvx.exe101⤵
- System Location Discovery: System Language Discovery
PID:2488 -
\??\c:\xjtxvlj.exec:\xjtxvlj.exe102⤵PID:2908
-
\??\c:\vtdnjpp.exec:\vtdnjpp.exe103⤵PID:2088
-
\??\c:\vvvlxj.exec:\vvvlxj.exe104⤵PID:976
-
\??\c:\jrttdll.exec:\jrttdll.exe105⤵PID:2576
-
\??\c:\hthxv.exec:\hthxv.exe106⤵PID:2212
-
\??\c:\tpntl.exec:\tpntl.exe107⤵PID:612
-
\??\c:\jpdvfd.exec:\jpdvfd.exe108⤵PID:2548
-
\??\c:\dtrlpp.exec:\dtrlpp.exe109⤵PID:2584
-
\??\c:\rvdnjd.exec:\rvdnjd.exe110⤵PID:1056
-
\??\c:\vrnjntj.exec:\vrnjntj.exe111⤵PID:1456
-
\??\c:\tlhdr.exec:\tlhdr.exe112⤵PID:1668
-
\??\c:\rptxf.exec:\rptxf.exe113⤵PID:2436
-
\??\c:\lfvtt.exec:\lfvtt.exe114⤵PID:1396
-
\??\c:\hrtrd.exec:\hrtrd.exe115⤵PID:924
-
\??\c:\ptrfdjt.exec:\ptrfdjt.exe116⤵
- System Location Discovery: System Language Discovery
PID:524 -
\??\c:\btfldr.exec:\btfldr.exe117⤵PID:1512
-
\??\c:\rrhjx.exec:\rrhjx.exe118⤵PID:2280
-
\??\c:\nnvnjff.exec:\nnvnjff.exe119⤵PID:2268
-
\??\c:\rxhxtrh.exec:\rxhxtrh.exe120⤵PID:2388
-
\??\c:\tfjvlxf.exec:\tfjvlxf.exe121⤵PID:1604
-
\??\c:\hxpnptd.exec:\hxpnptd.exe122⤵PID:780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-