Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
21-12-2024 23:06
Behavioral task
behavioral1
Sample
c71eef7ed30793a6e179deabd3124e8701144799f0d905584416f2ab6a03062b.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c71eef7ed30793a6e179deabd3124e8701144799f0d905584416f2ab6a03062b.exe
-
Size
85KB
-
MD5
dac22bff5fbbd188307e6a02e3ba7def
-
SHA1
ace66429bf85d99eda6f333500165bf2c3a2104c
-
SHA256
c71eef7ed30793a6e179deabd3124e8701144799f0d905584416f2ab6a03062b
-
SHA512
17b4b4ce7959b12632209bbfbf00102f60dc625708e15b7390b6d04aef113e76aea5b6ae0a0540992adf781c8551dd215f2fd8a7a29c0bf0da9c5582b01f6e63
-
SSDEEP
1536:cvQBeOGtrYS3srx93UBWfwC6Ggnouy8HglW8wk8miJd1Rtt8Nqz1xw+a:chOmTsF93UYfwC6GIout3tk8mItt8N5F
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/1688-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1128-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1456-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1264-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/452-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1396-162-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2336-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/624-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/836-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/960-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/960-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2204-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2140-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1756-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-359-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2928-383-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2272-391-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1500-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1324-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1168-451-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/864-471-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/900-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1164-505-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1796-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2204-539-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2204-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-546-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1512-561-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2364-586-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2932-631-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-644-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1064-820-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2424-859-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1804-932-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1084-960-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2984-974-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/432-988-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2172-1096-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/1984-1146-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2324-1159-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2924-1178-0x0000000001B80000-0x0000000001BA7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1128 jlffd.exe 1456 vdtrhj.exe 2948 tvxbj.exe 2160 xvtff.exe 2932 jlrpxr.exe 2968 tbddnv.exe 2252 xpxxvj.exe 2804 nbrbxf.exe 2872 thlff.exe 2540 jpnxjhb.exe 1316 vlrjlx.exe 1264 jjrnrr.exe 1652 xtrhhx.exe 2316 xrdjt.exe 452 drlnxb.exe 1632 xxhxb.exe 1396 lbbrrbl.exe 1760 flfjl.exe 2336 rnhlr.exe 1960 lvpxt.exe 2428 jblbl.exe 624 xbvhp.exe 836 tplpfx.exe 1868 rfrjf.exe 960 flljfhv.exe 1564 vbdblpn.exe 2204 pfblj.exe 1708 hdlvvjp.exe 2892 lrjhj.exe 2616 bdlfpnf.exe 2140 lbflldv.exe 1756 bxpfrt.exe 952 xrnjbh.exe 1236 bfvdnb.exe 2192 hrvfnd.exe 872 nptvn.exe 2948 jrbbxxn.exe 1624 jxnltv.exe 2024 rvhjl.exe 2160 pdvhjlr.exe 2844 hrdpd.exe 2836 rdbjfn.exe 2512 vxlnf.exe 2820 hrndrbj.exe 2880 vdrvhnv.exe 2928 trrpl.exe 2272 pvtpv.exe 2988 xdrbvjp.exe 1248 brdxbdn.exe 2904 hbjvvlh.exe 2908 rttxb.exe 2664 lxvdx.exe 1500 tlxdbt.exe 1324 prfbdn.exe 2028 brhhn.exe 1168 trrvvh.exe 1304 vbpnn.exe 2196 xvfdjnx.exe 864 hvjrf.exe 2456 hfxhxh.exe 2284 frfxbn.exe 900 fplhx.exe 2468 rrxllf.exe 1164 thtplf.exe -
resource yara_rule behavioral1/memory/1688-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000012266-6.dat upx behavioral1/memory/1688-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1128-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0017000000016c92-18.dat upx behavioral1/memory/1456-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2948-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016cf0-27.dat upx behavioral1/memory/2160-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d0c-34.dat upx behavioral1/files/0x0007000000016d1c-45.dat upx behavioral1/files/0x000a000000016d2c-56.dat upx behavioral1/memory/2968-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2932-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2968-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d3f-64.dat upx behavioral1/files/0x0002000000018334-72.dat upx behavioral1/memory/2872-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ef-81.dat upx behavioral1/memory/2804-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2872-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001950f-91.dat upx behavioral1/memory/2540-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000016cab-98.dat upx behavioral1/memory/1316-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019515-109.dat upx behavioral1/memory/1264-117-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1264-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019547-120.dat upx behavioral1/files/0x000500000001957c-127.dat upx behavioral1/memory/2316-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a7-137.dat upx behavioral1/memory/452-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195ab-144.dat upx behavioral1/files/0x00050000000195ad-153.dat upx behavioral1/files/0x00050000000195af-163.dat upx behavioral1/files/0x00050000000195b1-171.dat upx behavioral1/memory/2336-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b3-179.dat upx behavioral1/memory/1960-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b5-188.dat upx behavioral1/files/0x00050000000195b7-197.dat upx behavioral1/files/0x00050000000195bb-206.dat upx behavioral1/memory/624-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/836-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195bd-215.dat upx behavioral1/files/0x00050000000195c1-223.dat upx behavioral1/memory/960-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/960-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c3-232.dat upx behavioral1/files/0x00050000000195c5-242.dat upx behavioral1/files/0x00050000000195c6-251.dat upx behavioral1/memory/2204-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c7-260.dat upx behavioral1/files/0x000500000001960c-268.dat upx behavioral1/files/0x0005000000019643-276.dat upx behavioral1/files/0x000500000001975a-284.dat upx behavioral1/memory/2140-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1756-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/952-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/872-313-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1624-332-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2844-351-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2836-352-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdphjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbrbxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvtpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnfxjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlrrxhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhpjdhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbndvtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnvlrvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvrxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfplt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxjxjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbfpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trbdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfvvblt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbrtrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjffj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlfbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvhjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btrjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnddpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdfxht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhrtptt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bphxnpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbrlhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhlpnpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhvbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxhxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpnxpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndpvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhvdbnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbjtxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhjhjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbfnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljldjld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltfhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxtftrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvdxnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrnpxhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrvxhtn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1688 wrote to memory of 1128 1688 c71eef7ed30793a6e179deabd3124e8701144799f0d905584416f2ab6a03062b.exe 30 PID 1688 wrote to memory of 1128 1688 c71eef7ed30793a6e179deabd3124e8701144799f0d905584416f2ab6a03062b.exe 30 PID 1688 wrote to memory of 1128 1688 c71eef7ed30793a6e179deabd3124e8701144799f0d905584416f2ab6a03062b.exe 30 PID 1688 wrote to memory of 1128 1688 c71eef7ed30793a6e179deabd3124e8701144799f0d905584416f2ab6a03062b.exe 30 PID 1128 wrote to memory of 1456 1128 jlffd.exe 31 PID 1128 wrote to memory of 1456 1128 jlffd.exe 31 PID 1128 wrote to memory of 1456 1128 jlffd.exe 31 PID 1128 wrote to memory of 1456 1128 jlffd.exe 31 PID 1456 wrote to memory of 2948 1456 vdtrhj.exe 32 PID 1456 wrote to memory of 2948 1456 vdtrhj.exe 32 PID 1456 wrote to memory of 2948 1456 vdtrhj.exe 32 PID 1456 wrote to memory of 2948 1456 vdtrhj.exe 32 PID 2948 wrote to memory of 2160 2948 tvxbj.exe 33 PID 2948 wrote to memory of 2160 2948 tvxbj.exe 33 PID 2948 wrote to memory of 2160 2948 tvxbj.exe 33 PID 2948 wrote to memory of 2160 2948 tvxbj.exe 33 PID 2160 wrote to memory of 2932 2160 xvtff.exe 34 PID 2160 wrote to memory of 2932 2160 xvtff.exe 34 PID 2160 wrote to memory of 2932 2160 xvtff.exe 34 PID 2160 wrote to memory of 2932 2160 xvtff.exe 34 PID 2932 wrote to memory of 2968 2932 jlrpxr.exe 35 PID 2932 wrote to memory of 2968 2932 jlrpxr.exe 35 PID 2932 wrote to memory of 2968 2932 jlrpxr.exe 35 PID 2932 wrote to memory of 2968 2932 jlrpxr.exe 35 PID 2968 wrote to memory of 2252 2968 tbddnv.exe 36 PID 2968 wrote to memory of 2252 2968 tbddnv.exe 36 PID 2968 wrote to memory of 2252 2968 tbddnv.exe 36 PID 2968 wrote to memory of 2252 2968 tbddnv.exe 36 PID 2252 wrote to memory of 2804 2252 xpxxvj.exe 37 PID 2252 wrote to memory of 2804 2252 xpxxvj.exe 37 PID 2252 wrote to memory of 2804 2252 xpxxvj.exe 37 PID 2252 wrote to memory of 2804 2252 xpxxvj.exe 37 PID 2804 wrote to memory of 2872 2804 nbrbxf.exe 38 PID 2804 wrote to memory of 2872 2804 nbrbxf.exe 38 PID 2804 wrote to memory of 2872 2804 nbrbxf.exe 38 PID 2804 wrote to memory of 2872 2804 nbrbxf.exe 38 PID 2872 wrote to memory of 2540 2872 thlff.exe 39 PID 2872 wrote to memory of 2540 2872 thlff.exe 39 PID 2872 wrote to memory of 2540 2872 thlff.exe 39 PID 2872 wrote to memory of 2540 2872 thlff.exe 39 PID 2540 wrote to memory of 1316 2540 jpnxjhb.exe 40 PID 2540 wrote to memory of 1316 2540 jpnxjhb.exe 40 PID 2540 wrote to memory of 1316 2540 jpnxjhb.exe 40 PID 2540 wrote to memory of 1316 2540 jpnxjhb.exe 40 PID 1316 wrote to memory of 1264 1316 vlrjlx.exe 41 PID 1316 wrote to memory of 1264 1316 vlrjlx.exe 41 PID 1316 wrote to memory of 1264 1316 vlrjlx.exe 41 PID 1316 wrote to memory of 1264 1316 vlrjlx.exe 41 PID 1264 wrote to memory of 1652 1264 jjrnrr.exe 42 PID 1264 wrote to memory of 1652 1264 jjrnrr.exe 42 PID 1264 wrote to memory of 1652 1264 jjrnrr.exe 42 PID 1264 wrote to memory of 1652 1264 jjrnrr.exe 42 PID 1652 wrote to memory of 2316 1652 xtrhhx.exe 43 PID 1652 wrote to memory of 2316 1652 xtrhhx.exe 43 PID 1652 wrote to memory of 2316 1652 xtrhhx.exe 43 PID 1652 wrote to memory of 2316 1652 xtrhhx.exe 43 PID 2316 wrote to memory of 452 2316 xrdjt.exe 44 PID 2316 wrote to memory of 452 2316 xrdjt.exe 44 PID 2316 wrote to memory of 452 2316 xrdjt.exe 44 PID 2316 wrote to memory of 452 2316 xrdjt.exe 44 PID 452 wrote to memory of 1632 452 drlnxb.exe 45 PID 452 wrote to memory of 1632 452 drlnxb.exe 45 PID 452 wrote to memory of 1632 452 drlnxb.exe 45 PID 452 wrote to memory of 1632 452 drlnxb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c71eef7ed30793a6e179deabd3124e8701144799f0d905584416f2ab6a03062b.exe"C:\Users\Admin\AppData\Local\Temp\c71eef7ed30793a6e179deabd3124e8701144799f0d905584416f2ab6a03062b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\jlffd.exec:\jlffd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\vdtrhj.exec:\vdtrhj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\tvxbj.exec:\tvxbj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\xvtff.exec:\xvtff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\jlrpxr.exec:\jlrpxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\tbddnv.exec:\tbddnv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\xpxxvj.exec:\xpxxvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\nbrbxf.exec:\nbrbxf.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\thlff.exec:\thlff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\jpnxjhb.exec:\jpnxjhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\vlrjlx.exec:\vlrjlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\jjrnrr.exec:\jjrnrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\xtrhhx.exec:\xtrhhx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\xrdjt.exec:\xrdjt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\drlnxb.exec:\drlnxb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\xxhxb.exec:\xxhxb.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1632 -
\??\c:\lbbrrbl.exec:\lbbrrbl.exe18⤵
- Executes dropped EXE
PID:1396 -
\??\c:\flfjl.exec:\flfjl.exe19⤵
- Executes dropped EXE
PID:1760 -
\??\c:\rnhlr.exec:\rnhlr.exe20⤵
- Executes dropped EXE
PID:2336 -
\??\c:\lvpxt.exec:\lvpxt.exe21⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jblbl.exec:\jblbl.exe22⤵
- Executes dropped EXE
PID:2428 -
\??\c:\xbvhp.exec:\xbvhp.exe23⤵
- Executes dropped EXE
PID:624 -
\??\c:\tplpfx.exec:\tplpfx.exe24⤵
- Executes dropped EXE
PID:836 -
\??\c:\rfrjf.exec:\rfrjf.exe25⤵
- Executes dropped EXE
PID:1868 -
\??\c:\flljfhv.exec:\flljfhv.exe26⤵
- Executes dropped EXE
PID:960 -
\??\c:\vbdblpn.exec:\vbdblpn.exe27⤵
- Executes dropped EXE
PID:1564 -
\??\c:\pfblj.exec:\pfblj.exe28⤵
- Executes dropped EXE
PID:2204 -
\??\c:\hdlvvjp.exec:\hdlvvjp.exe29⤵
- Executes dropped EXE
PID:1708 -
\??\c:\lrjhj.exec:\lrjhj.exe30⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bdlfpnf.exec:\bdlfpnf.exe31⤵
- Executes dropped EXE
PID:2616 -
\??\c:\lbflldv.exec:\lbflldv.exe32⤵
- Executes dropped EXE
PID:2140 -
\??\c:\bxpfrt.exec:\bxpfrt.exe33⤵
- Executes dropped EXE
PID:1756 -
\??\c:\xrnjbh.exec:\xrnjbh.exe34⤵
- Executes dropped EXE
PID:952 -
\??\c:\bfvdnb.exec:\bfvdnb.exe35⤵
- Executes dropped EXE
PID:1236 -
\??\c:\hrvfnd.exec:\hrvfnd.exe36⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nptvn.exec:\nptvn.exe37⤵
- Executes dropped EXE
PID:872 -
\??\c:\jrbbxxn.exec:\jrbbxxn.exe38⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jxnltv.exec:\jxnltv.exe39⤵
- Executes dropped EXE
PID:1624 -
\??\c:\rvhjl.exec:\rvhjl.exe40⤵
- Executes dropped EXE
PID:2024 -
\??\c:\pdvhjlr.exec:\pdvhjlr.exe41⤵
- Executes dropped EXE
PID:2160 -
\??\c:\hrdpd.exec:\hrdpd.exe42⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rdbjfn.exec:\rdbjfn.exe43⤵
- Executes dropped EXE
PID:2836 -
\??\c:\vxlnf.exec:\vxlnf.exe44⤵
- Executes dropped EXE
PID:2512 -
\??\c:\hrndrbj.exec:\hrndrbj.exe45⤵
- Executes dropped EXE
PID:2820 -
\??\c:\vdrvhnv.exec:\vdrvhnv.exe46⤵
- Executes dropped EXE
PID:2880 -
\??\c:\trrpl.exec:\trrpl.exe47⤵
- Executes dropped EXE
PID:2928 -
\??\c:\pvtpv.exec:\pvtpv.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2272 -
\??\c:\xdrbvjp.exec:\xdrbvjp.exe49⤵
- Executes dropped EXE
PID:2988 -
\??\c:\brdxbdn.exec:\brdxbdn.exe50⤵
- Executes dropped EXE
PID:1248 -
\??\c:\hbjvvlh.exec:\hbjvvlh.exe51⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rttxb.exec:\rttxb.exe52⤵
- Executes dropped EXE
PID:2908 -
\??\c:\lxvdx.exec:\lxvdx.exe53⤵
- Executes dropped EXE
PID:2664 -
\??\c:\tlxdbt.exec:\tlxdbt.exe54⤵
- Executes dropped EXE
PID:1500 -
\??\c:\prfbdn.exec:\prfbdn.exe55⤵
- Executes dropped EXE
PID:1324 -
\??\c:\brhhn.exec:\brhhn.exe56⤵
- Executes dropped EXE
PID:2028 -
\??\c:\trrvvh.exec:\trrvvh.exe57⤵
- Executes dropped EXE
PID:1168 -
\??\c:\vbpnn.exec:\vbpnn.exe58⤵
- Executes dropped EXE
PID:1304 -
\??\c:\xvfdjnx.exec:\xvfdjnx.exe59⤵
- Executes dropped EXE
PID:2196 -
\??\c:\hvjrf.exec:\hvjrf.exe60⤵
- Executes dropped EXE
PID:864 -
\??\c:\hfxhxh.exec:\hfxhxh.exe61⤵
- Executes dropped EXE
PID:2456 -
\??\c:\frfxbn.exec:\frfxbn.exe62⤵
- Executes dropped EXE
PID:2284 -
\??\c:\fplhx.exec:\fplhx.exe63⤵
- Executes dropped EXE
PID:900 -
\??\c:\rrxllf.exec:\rrxllf.exe64⤵
- Executes dropped EXE
PID:2468 -
\??\c:\thtplf.exec:\thtplf.exe65⤵
- Executes dropped EXE
PID:1164 -
\??\c:\vhhhrdd.exec:\vhhhrdd.exe66⤵PID:1796
-
\??\c:\ntdfplp.exec:\ntdfplp.exe67⤵PID:2400
-
\??\c:\frdlb.exec:\frdlb.exe68⤵PID:1996
-
\??\c:\fbrvjvn.exec:\fbrvjvn.exe69⤵PID:1564
-
\??\c:\jdlntp.exec:\jdlntp.exe70⤵PID:2204
-
\??\c:\nbvbfj.exec:\nbvbfj.exe71⤵PID:2704
-
\??\c:\txfrfr.exec:\txfrfr.exe72⤵PID:544
-
\??\c:\nbxvjpn.exec:\nbxvjpn.exe73⤵PID:1512
-
\??\c:\dptjh.exec:\dptjh.exe74⤵PID:1748
-
\??\c:\vpbjdbt.exec:\vpbjdbt.exe75⤵PID:892
-
\??\c:\thvjjfb.exec:\thvjjfb.exe76⤵PID:1288
-
\??\c:\hbtrd.exec:\hbtrd.exe77⤵PID:2364
-
\??\c:\rlldllt.exec:\rlldllt.exe78⤵PID:2212
-
\??\c:\vltftf.exec:\vltftf.exe79⤵PID:3000
-
\??\c:\tpdhj.exec:\tpdhj.exe80⤵PID:1612
-
\??\c:\rfxbrp.exec:\rfxbrp.exe81⤵PID:2044
-
\??\c:\lvjbjxp.exec:\lvjbjxp.exe82⤵PID:1704
-
\??\c:\xltrp.exec:\xltrp.exe83⤵PID:2940
-
\??\c:\lhpjbj.exec:\lhpjbj.exe84⤵PID:2932
-
\??\c:\lnhprlf.exec:\lnhprlf.exe85⤵PID:2980
-
\??\c:\jdnvb.exec:\jdnvb.exe86⤵PID:2252
-
\??\c:\pjjpx.exec:\pjjpx.exe87⤵PID:1804
-
\??\c:\xhjtnp.exec:\xhjtnp.exe88⤵PID:2516
-
\??\c:\dnrvnj.exec:\dnrvnj.exe89⤵PID:2444
-
\??\c:\tnvrdn.exec:\tnvrdn.exe90⤵PID:2872
-
\??\c:\tttxdrv.exec:\tttxdrv.exe91⤵PID:940
-
\??\c:\xtbrxlr.exec:\xtbrxlr.exe92⤵PID:1316
-
\??\c:\ndftn.exec:\ndftn.exe93⤵PID:1132
-
\??\c:\vxdvdnf.exec:\vxdvdnf.exe94⤵PID:2996
-
\??\c:\xjpptt.exec:\xjpptt.exe95⤵PID:1436
-
\??\c:\bbtrpj.exec:\bbtrpj.exe96⤵PID:432
-
\??\c:\prxvbt.exec:\prxvbt.exe97⤵PID:2676
-
\??\c:\jbdxbx.exec:\jbdxbx.exe98⤵PID:2032
-
\??\c:\hnxnn.exec:\hnxnn.exe99⤵PID:2348
-
\??\c:\nthhhnr.exec:\nthhhnr.exe100⤵PID:2268
-
\??\c:\bphjtlr.exec:\bphjtlr.exe101⤵PID:2052
-
\??\c:\jfnrj.exec:\jfnrj.exe102⤵PID:2232
-
\??\c:\xtbbh.exec:\xtbbh.exe103⤵PID:2336
-
\??\c:\rffxp.exec:\rffxp.exe104⤵PID:864
-
\??\c:\hjvnb.exec:\hjvnb.exe105⤵PID:2464
-
\??\c:\rxbtftx.exec:\rxbtftx.exe106⤵PID:972
-
\??\c:\rrbnnlp.exec:\rrbnnlp.exe107⤵PID:1992
-
\??\c:\lntttj.exec:\lntttj.exe108⤵PID:2468
-
\??\c:\vrvdrb.exec:\vrvdrb.exe109⤵PID:1320
-
\??\c:\jjpbr.exec:\jjpbr.exe110⤵PID:2552
-
\??\c:\bxtftrt.exec:\bxtftrt.exe111⤵
- System Location Discovery: System Language Discovery
PID:2400 -
\??\c:\fxxjnn.exec:\fxxjnn.exe112⤵PID:1308
-
\??\c:\nvfpt.exec:\nvfpt.exe113⤵PID:2072
-
\??\c:\blxjpfn.exec:\blxjpfn.exe114⤵PID:1064
-
\??\c:\vhxddpx.exec:\vhxddpx.exe115⤵PID:1768
-
\??\c:\djxbdrv.exec:\djxbdrv.exe116⤵PID:536
-
\??\c:\dfrhnx.exec:\dfrhnx.exe117⤵PID:1524
-
\??\c:\fftdlv.exec:\fftdlv.exe118⤵PID:2092
-
\??\c:\fhnff.exec:\fhnff.exe119⤵PID:276
-
\??\c:\bvbfxj.exec:\bvbfxj.exe120⤵PID:1688
-
\??\c:\fpjlj.exec:\fpjlj.exe121⤵PID:2424
-
\??\c:\lvlrj.exec:\lvlrj.exe122⤵PID:2156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-