Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 09:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fe31971659c280308977f5092dec377e63c42d8df18c9d790fab2f08fd88ed57.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
fe31971659c280308977f5092dec377e63c42d8df18c9d790fab2f08fd88ed57.exe
-
Size
487KB
-
MD5
6ee38431c177f390173f0ab32b549408
-
SHA1
3bf399258a013dec7952affe25b0909579948802
-
SHA256
fe31971659c280308977f5092dec377e63c42d8df18c9d790fab2f08fd88ed57
-
SHA512
c523b1a2f4bc774621e6ff64221bb462f372f514c32061839c4852034a390fa5bbfb17d47e45fe393a59f36d2df6b1f3e677e7b116a48d7e0e22d22d89c84dfb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2CfNnkymTwaJ3tb:q7Tc2NYHUrAwfMHNnplsp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2308-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-105-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/524-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1196-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/968-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-314-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2372-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-348-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2832-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-465-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1764-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/656-517-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1092-834-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2308 frjnnh.exe 1104 jhlbdr.exe 2108 xxpbdl.exe 1920 flbhfn.exe 584 hfbxlj.exe 2832 hbdht.exe 2512 xvfhlv.exe 3036 xntnhl.exe 2844 hxhdr.exe 2740 fvnhvj.exe 524 jtfjn.exe 2012 vfdfd.exe 1196 rdhttj.exe 1504 dxbddph.exe 1956 hplvnj.exe 2996 nxdtbj.exe 2016 lpbfx.exe 2960 dhxtt.exe 2636 djvtl.exe 1908 rvjjb.exe 2484 rrrftv.exe 1796 xpddt.exe 3032 vnlbd.exe 744 xjrnhhf.exe 968 vrfrv.exe 1736 nhldndl.exe 1556 nhdlhf.exe 2540 fhdtt.exe 1892 nvtpjt.exe 2432 jprlt.exe 3060 vvtbf.exe 2524 fjfjjnd.exe 2324 nfxnf.exe 1596 fffdr.exe 2372 xrpbv.exe 1384 hprdljr.exe 2760 nppjh.exe 2068 njbnhp.exe 1920 nxvjfb.exe 2804 hprbv.exe 2832 dtlxnlp.exe 2704 fpnvdt.exe 2912 lnlhnlp.exe 2676 tjpfxl.exe 2708 nljjjlp.exe 2316 ffhbhr.exe 2116 xfbrh.exe 524 hltxp.exe 2644 dpllx.exe 1456 xljbxr.exe 2944 bfbrvnp.exe 1096 rrftndf.exe 2024 phrnllj.exe 2000 bpxdjxf.exe 1764 xlxbnxv.exe 2940 bxrdtxp.exe 2052 lbbjxd.exe 1696 dlfpp.exe 112 nvpnjf.exe 1380 hlftjdd.exe 2440 hjttt.exe 2124 vdtlvf.exe 656 vtvxbft.exe 992 xhphblt.exe -
resource yara_rule behavioral1/memory/2308-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-72-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/3036-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/524-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/524-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/968-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-733-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-782-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-821-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-834-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpxbdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvtfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjbpphp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpfvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhpnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnnnvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvlvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tprrthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfppxbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrnddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjllvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjdttv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljfnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxvhpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdfdxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hffnljx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjrnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvfxnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhldndl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtnxjxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfrxjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjxbfbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fntdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjnbvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtrfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvxbpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjbff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjrhrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hprttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpprr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnfttv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fprjbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhdndvt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2200 wrote to memory of 2308 2200 fe31971659c280308977f5092dec377e63c42d8df18c9d790fab2f08fd88ed57.exe 30 PID 2200 wrote to memory of 2308 2200 fe31971659c280308977f5092dec377e63c42d8df18c9d790fab2f08fd88ed57.exe 30 PID 2200 wrote to memory of 2308 2200 fe31971659c280308977f5092dec377e63c42d8df18c9d790fab2f08fd88ed57.exe 30 PID 2200 wrote to memory of 2308 2200 fe31971659c280308977f5092dec377e63c42d8df18c9d790fab2f08fd88ed57.exe 30 PID 2308 wrote to memory of 1104 2308 frjnnh.exe 31 PID 2308 wrote to memory of 1104 2308 frjnnh.exe 31 PID 2308 wrote to memory of 1104 2308 frjnnh.exe 31 PID 2308 wrote to memory of 1104 2308 frjnnh.exe 31 PID 1104 wrote to memory of 2108 1104 jhlbdr.exe 32 PID 1104 wrote to memory of 2108 1104 jhlbdr.exe 32 PID 1104 wrote to memory of 2108 1104 jhlbdr.exe 32 PID 1104 wrote to memory of 2108 1104 jhlbdr.exe 32 PID 2108 wrote to memory of 1920 2108 xxpbdl.exe 33 PID 2108 wrote to memory of 1920 2108 xxpbdl.exe 33 PID 2108 wrote to memory of 1920 2108 xxpbdl.exe 33 PID 2108 wrote to memory of 1920 2108 xxpbdl.exe 33 PID 1920 wrote to memory of 584 1920 flbhfn.exe 34 PID 1920 wrote to memory of 584 1920 flbhfn.exe 34 PID 1920 wrote to memory of 584 1920 flbhfn.exe 34 PID 1920 wrote to memory of 584 1920 flbhfn.exe 34 PID 584 wrote to memory of 2832 584 hfbxlj.exe 35 PID 584 wrote to memory of 2832 584 hfbxlj.exe 35 PID 584 wrote to memory of 2832 584 hfbxlj.exe 35 PID 584 wrote to memory of 2832 584 hfbxlj.exe 35 PID 2832 wrote to memory of 2512 2832 hbdht.exe 36 PID 2832 wrote to memory of 2512 2832 hbdht.exe 36 PID 2832 wrote to memory of 2512 2832 hbdht.exe 36 PID 2832 wrote to memory of 2512 2832 hbdht.exe 36 PID 2512 wrote to memory of 3036 2512 xvfhlv.exe 37 PID 2512 wrote to memory of 3036 2512 xvfhlv.exe 37 PID 2512 wrote to memory of 3036 2512 xvfhlv.exe 37 PID 2512 wrote to memory of 3036 2512 xvfhlv.exe 37 PID 3036 wrote to memory of 2844 3036 xntnhl.exe 38 PID 3036 wrote to memory of 2844 3036 xntnhl.exe 38 PID 3036 wrote to memory of 2844 3036 xntnhl.exe 38 PID 3036 wrote to memory of 2844 3036 xntnhl.exe 38 PID 2844 wrote to memory of 2740 2844 hxhdr.exe 39 PID 2844 wrote to memory of 2740 2844 hxhdr.exe 39 PID 2844 wrote to memory of 2740 2844 hxhdr.exe 39 PID 2844 wrote to memory of 2740 2844 hxhdr.exe 39 PID 2740 wrote to memory of 524 2740 fvnhvj.exe 40 PID 2740 wrote to memory of 524 2740 fvnhvj.exe 40 PID 2740 wrote to memory of 524 2740 fvnhvj.exe 40 PID 2740 wrote to memory of 524 2740 fvnhvj.exe 40 PID 524 wrote to memory of 2012 524 jtfjn.exe 41 PID 524 wrote to memory of 2012 524 jtfjn.exe 41 PID 524 wrote to memory of 2012 524 jtfjn.exe 41 PID 524 wrote to memory of 2012 524 jtfjn.exe 41 PID 2012 wrote to memory of 1196 2012 vfdfd.exe 42 PID 2012 wrote to memory of 1196 2012 vfdfd.exe 42 PID 2012 wrote to memory of 1196 2012 vfdfd.exe 42 PID 2012 wrote to memory of 1196 2012 vfdfd.exe 42 PID 1196 wrote to memory of 1504 1196 rdhttj.exe 43 PID 1196 wrote to memory of 1504 1196 rdhttj.exe 43 PID 1196 wrote to memory of 1504 1196 rdhttj.exe 43 PID 1196 wrote to memory of 1504 1196 rdhttj.exe 43 PID 1504 wrote to memory of 1956 1504 dxbddph.exe 44 PID 1504 wrote to memory of 1956 1504 dxbddph.exe 44 PID 1504 wrote to memory of 1956 1504 dxbddph.exe 44 PID 1504 wrote to memory of 1956 1504 dxbddph.exe 44 PID 1956 wrote to memory of 2996 1956 hplvnj.exe 45 PID 1956 wrote to memory of 2996 1956 hplvnj.exe 45 PID 1956 wrote to memory of 2996 1956 hplvnj.exe 45 PID 1956 wrote to memory of 2996 1956 hplvnj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe31971659c280308977f5092dec377e63c42d8df18c9d790fab2f08fd88ed57.exe"C:\Users\Admin\AppData\Local\Temp\fe31971659c280308977f5092dec377e63c42d8df18c9d790fab2f08fd88ed57.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\frjnnh.exec:\frjnnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\jhlbdr.exec:\jhlbdr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\xxpbdl.exec:\xxpbdl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\flbhfn.exec:\flbhfn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\hfbxlj.exec:\hfbxlj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:584 -
\??\c:\hbdht.exec:\hbdht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\xvfhlv.exec:\xvfhlv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\xntnhl.exec:\xntnhl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\hxhdr.exec:\hxhdr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\fvnhvj.exec:\fvnhvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\jtfjn.exec:\jtfjn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:524 -
\??\c:\vfdfd.exec:\vfdfd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\rdhttj.exec:\rdhttj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\dxbddph.exec:\dxbddph.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\hplvnj.exec:\hplvnj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\nxdtbj.exec:\nxdtbj.exe17⤵
- Executes dropped EXE
PID:2996 -
\??\c:\lpbfx.exec:\lpbfx.exe18⤵
- Executes dropped EXE
PID:2016 -
\??\c:\dhxtt.exec:\dhxtt.exe19⤵
- Executes dropped EXE
PID:2960 -
\??\c:\djvtl.exec:\djvtl.exe20⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rvjjb.exec:\rvjjb.exe21⤵
- Executes dropped EXE
PID:1908 -
\??\c:\rrrftv.exec:\rrrftv.exe22⤵
- Executes dropped EXE
PID:2484 -
\??\c:\xpddt.exec:\xpddt.exe23⤵
- Executes dropped EXE
PID:1796 -
\??\c:\vnlbd.exec:\vnlbd.exe24⤵
- Executes dropped EXE
PID:3032 -
\??\c:\xjrnhhf.exec:\xjrnhhf.exe25⤵
- Executes dropped EXE
PID:744 -
\??\c:\vrfrv.exec:\vrfrv.exe26⤵
- Executes dropped EXE
PID:968 -
\??\c:\nhldndl.exec:\nhldndl.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1736 -
\??\c:\nhdlhf.exec:\nhdlhf.exe28⤵
- Executes dropped EXE
PID:1556 -
\??\c:\fhdtt.exec:\fhdtt.exe29⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nvtpjt.exec:\nvtpjt.exe30⤵
- Executes dropped EXE
PID:1892 -
\??\c:\jprlt.exec:\jprlt.exe31⤵
- Executes dropped EXE
PID:2432 -
\??\c:\vvtbf.exec:\vvtbf.exe32⤵
- Executes dropped EXE
PID:3060 -
\??\c:\fjfjjnd.exec:\fjfjjnd.exe33⤵
- Executes dropped EXE
PID:2524 -
\??\c:\nfxnf.exec:\nfxnf.exe34⤵
- Executes dropped EXE
PID:2324 -
\??\c:\fffdr.exec:\fffdr.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\xrpbv.exec:\xrpbv.exe36⤵
- Executes dropped EXE
PID:2372 -
\??\c:\hprdljr.exec:\hprdljr.exe37⤵
- Executes dropped EXE
PID:1384 -
\??\c:\nppjh.exec:\nppjh.exe38⤵
- Executes dropped EXE
PID:2760 -
\??\c:\njbnhp.exec:\njbnhp.exe39⤵
- Executes dropped EXE
PID:2068 -
\??\c:\nxvjfb.exec:\nxvjfb.exe40⤵
- Executes dropped EXE
PID:1920 -
\??\c:\hprbv.exec:\hprbv.exe41⤵
- Executes dropped EXE
PID:2804 -
\??\c:\dtlxnlp.exec:\dtlxnlp.exe42⤵
- Executes dropped EXE
PID:2832 -
\??\c:\fpnvdt.exec:\fpnvdt.exe43⤵
- Executes dropped EXE
PID:2704 -
\??\c:\lnlhnlp.exec:\lnlhnlp.exe44⤵
- Executes dropped EXE
PID:2912 -
\??\c:\tjpfxl.exec:\tjpfxl.exe45⤵
- Executes dropped EXE
PID:2676 -
\??\c:\nljjjlp.exec:\nljjjlp.exe46⤵
- Executes dropped EXE
PID:2708 -
\??\c:\ffhbhr.exec:\ffhbhr.exe47⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xfbrh.exec:\xfbrh.exe48⤵
- Executes dropped EXE
PID:2116 -
\??\c:\hltxp.exec:\hltxp.exe49⤵
- Executes dropped EXE
PID:524 -
\??\c:\dpllx.exec:\dpllx.exe50⤵
- Executes dropped EXE
PID:2644 -
\??\c:\xljbxr.exec:\xljbxr.exe51⤵
- Executes dropped EXE
PID:1456 -
\??\c:\bfbrvnp.exec:\bfbrvnp.exe52⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rrftndf.exec:\rrftndf.exe53⤵
- Executes dropped EXE
PID:1096 -
\??\c:\phrnllj.exec:\phrnllj.exe54⤵
- Executes dropped EXE
PID:2024 -
\??\c:\bpxdjxf.exec:\bpxdjxf.exe55⤵
- Executes dropped EXE
PID:2000 -
\??\c:\xlxbnxv.exec:\xlxbnxv.exe56⤵
- Executes dropped EXE
PID:1764 -
\??\c:\bxrdtxp.exec:\bxrdtxp.exe57⤵
- Executes dropped EXE
PID:2940 -
\??\c:\lbbjxd.exec:\lbbjxd.exe58⤵
- Executes dropped EXE
PID:2052 -
\??\c:\dlfpp.exec:\dlfpp.exe59⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nvpnjf.exec:\nvpnjf.exe60⤵
- Executes dropped EXE
PID:112 -
\??\c:\hlftjdd.exec:\hlftjdd.exe61⤵
- Executes dropped EXE
PID:1380 -
\??\c:\hjttt.exec:\hjttt.exe62⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vdtlvf.exec:\vdtlvf.exe63⤵
- Executes dropped EXE
PID:2124 -
\??\c:\vtvxbft.exec:\vtvxbft.exe64⤵
- Executes dropped EXE
PID:656 -
\??\c:\xhphblt.exec:\xhphblt.exe65⤵
- Executes dropped EXE
PID:992 -
\??\c:\pvvfjvd.exec:\pvvfjvd.exe66⤵PID:744
-
\??\c:\vtlfljx.exec:\vtlfljx.exe67⤵PID:1036
-
\??\c:\vnvxh.exec:\vnvxh.exe68⤵PID:1932
-
\??\c:\vfdrlxd.exec:\vfdrlxd.exe69⤵PID:2436
-
\??\c:\dfljnl.exec:\dfljnl.exe70⤵PID:2400
-
\??\c:\vfjfvxn.exec:\vfjfvxn.exe71⤵PID:1584
-
\??\c:\drpnfxp.exec:\drpnfxp.exe72⤵PID:2516
-
\??\c:\pbjpbvd.exec:\pbjpbvd.exe73⤵PID:2556
-
\??\c:\vbnjf.exec:\vbnjf.exe74⤵PID:896
-
\??\c:\xdptnvb.exec:\xdptnvb.exe75⤵PID:900
-
\??\c:\rbhll.exec:\rbhll.exe76⤵PID:1600
-
\??\c:\ldxxt.exec:\ldxxt.exe77⤵PID:2408
-
\??\c:\fbnbdvr.exec:\fbnbdvr.exe78⤵PID:2080
-
\??\c:\pblnf.exec:\pblnf.exe79⤵PID:1596
-
\??\c:\jdnpvbh.exec:\jdnpvbh.exe80⤵PID:2372
-
\??\c:\tphlpnx.exec:\tphlpnx.exe81⤵PID:536
-
\??\c:\xjjlhp.exec:\xjjlhp.exe82⤵PID:2756
-
\??\c:\brprtjl.exec:\brprtjl.exe83⤵PID:2768
-
\??\c:\xvnfr.exec:\xvnfr.exe84⤵PID:1920
-
\??\c:\njbbn.exec:\njbbn.exe85⤵PID:2836
-
\??\c:\vprjdfn.exec:\vprjdfn.exe86⤵PID:2832
-
\??\c:\vbdvj.exec:\vbdvj.exe87⤵PID:1528
-
\??\c:\vhbtpth.exec:\vhbtpth.exe88⤵PID:3000
-
\??\c:\hxddb.exec:\hxddb.exe89⤵PID:2868
-
\??\c:\brdfbb.exec:\brdfbb.exe90⤵PID:2688
-
\??\c:\pfvlrl.exec:\pfvlrl.exe91⤵PID:2496
-
\??\c:\nbjjpx.exec:\nbjjpx.exe92⤵PID:2568
-
\??\c:\hphhp.exec:\hphhp.exe93⤵PID:1496
-
\??\c:\lphxhvp.exec:\lphxhvp.exe94⤵PID:1880
-
\??\c:\vxvbnrb.exec:\vxvbnrb.exe95⤵PID:2744
-
\??\c:\tvjbp.exec:\tvjbp.exe96⤵PID:2368
-
\??\c:\jtlfrph.exec:\jtlfrph.exe97⤵PID:1128
-
\??\c:\tvpfjl.exec:\tvpfjl.exe98⤵PID:2008
-
\??\c:\jrllvxt.exec:\jrllvxt.exe99⤵PID:1988
-
\??\c:\bjvhhx.exec:\bjvhhx.exe100⤵PID:2016
-
\??\c:\txjfhf.exec:\txjfhf.exe101⤵PID:1312
-
\??\c:\fdtvh.exec:\fdtvh.exe102⤵PID:3028
-
\??\c:\djlblp.exec:\djlblp.exe103⤵PID:2100
-
\??\c:\nvlnn.exec:\nvlnn.exe104⤵PID:2636
-
\??\c:\xtrfb.exec:\xtrfb.exe105⤵
- System Location Discovery: System Language Discovery
PID:1928 -
\??\c:\nrhlj.exec:\nrhlj.exe106⤵PID:1652
-
\??\c:\phbbjn.exec:\phbbjn.exe107⤵PID:108
-
\??\c:\httjdpt.exec:\httjdpt.exe108⤵PID:2124
-
\??\c:\ppvddxl.exec:\ppvddxl.exe109⤵PID:1324
-
\??\c:\thpxrnt.exec:\thpxrnt.exe110⤵PID:2652
-
\??\c:\hlnhnh.exec:\hlnhnh.exe111⤵PID:2088
-
\??\c:\drhfr.exec:\drhfr.exe112⤵PID:2968
-
\??\c:\pdhnnf.exec:\pdhnnf.exe113⤵PID:580
-
\??\c:\xlpdvf.exec:\xlpdvf.exe114⤵PID:1092
-
\??\c:\jtnxjxv.exec:\jtnxjxv.exe115⤵
- System Location Discovery: System Language Discovery
PID:1672 -
\??\c:\dltjbt.exec:\dltjbt.exe116⤵PID:2544
-
\??\c:\fdtfr.exec:\fdtfr.exe117⤵PID:2320
-
\??\c:\xlvfrxr.exec:\xlvfrxr.exe118⤵PID:288
-
\??\c:\bjvrf.exec:\bjvrf.exe119⤵PID:1724
-
\??\c:\lfjhlb.exec:\lfjhlb.exe120⤵PID:3060
-
\??\c:\bhvprx.exec:\bhvprx.exe121⤵PID:2308
-
\??\c:\fhjvpj.exec:\fhjvpj.exe122⤵PID:2584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-