Analysis
-
max time kernel
150s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
21-12-2024 00:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
634968eed6d2b8a93dbef3df2ed88b0799fa4b21b404b0c8ab1f0cef74790801.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
634968eed6d2b8a93dbef3df2ed88b0799fa4b21b404b0c8ab1f0cef74790801.exe
-
Size
335KB
-
MD5
c5affacc3abd7f0e7a61a42962a0c358
-
SHA1
89394f8e3963170550295998bab8289361246d1a
-
SHA256
634968eed6d2b8a93dbef3df2ed88b0799fa4b21b404b0c8ab1f0cef74790801
-
SHA512
70e9d77ee62698644c9c9a38e7c9a846bdac1b36405841c5cff5ca7c79324759976c0298e35f7476e4d90161b8eca655a0562661aa68ad5b1949dc2b5173365f
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPh3:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2460-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-28-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2344-39-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2884-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-41-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2564-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-50-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/3028-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-207-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2272-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1840-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/700-280-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/700-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-343-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2756-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-376-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2320-387-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1496-439-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1644-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-557-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1680-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-566-0x00000000002F0000-0x000000000031A000-memory.dmp family_blackmoon behavioral1/memory/3040-591-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3000-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-618-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2980-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-641-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1036-674-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-681-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/796-697-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/892-769-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2460 trdpv.exe 2880 rrrnb.exe 2884 hfdnbl.exe 2564 xbdnf.exe 3028 xvvntj.exe 2744 fhjll.exe 2320 ltttjh.exe 884 jdtbr.exe 2312 hdlxtth.exe 588 njjnjhn.exe 1824 tpdjv.exe 1532 prrvr.exe 952 llnbbdb.exe 2924 txvxf.exe 1768 fthvb.exe 1784 nflnx.exe 2280 nxprr.exe 1320 vdftvr.exe 3060 hhpptrr.exe 316 fbrnhh.exe 756 nbjrx.exe 2272 ntddhp.exe 3048 rhdppxh.exe 2380 rrfjj.exe 1840 fthbx.exe 2396 rftbvfl.exe 1844 ltxtxf.exe 700 fvrhdpv.exe 1888 bpbnft.exe 3044 vpllf.exe 2104 lpdnvth.exe 2584 lnrntjv.exe 2948 bvjhj.exe 2972 xvdrpbj.exe 2996 nxvdbvl.exe 2980 brfbt.exe 2116 tptrl.exe 2756 xbprfb.exe 1796 htvdjb.exe 920 dbnnbr.exe 2796 rltbth.exe 2716 rrprfvp.exe 2320 lrpbrl.exe 2108 lldfj.exe 2648 vfvjnjf.exe 2312 vbbxn.exe 3020 xrjdpl.exe 1248 fhrttn.exe 2440 lbnxbbx.exe 1624 pdfrfjh.exe 1496 tjlpp.exe 2592 vbrvf.exe 1528 ldtplp.exe 1056 ttdjn.exe 2276 dhpnd.exe 2196 nblvjf.exe 892 bbvbfd.exe 2624 fnllp.exe 1644 xdbvp.exe 3060 vvpflf.exe 1284 hnnlfdf.exe 2480 ddbjpvn.exe 696 xjbbjj.exe 2816 drfjfhp.exe -
resource yara_rule behavioral1/memory/2344-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-51-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/3028-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-259-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1844-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-681-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/980-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-698-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbxnnfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpvdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndjjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffvbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvhdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbrvhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjbrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpvnrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntpdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhtpjph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnnrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvjfbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbpnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fphtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drhllhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbnxbbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbftftl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blflfhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdblx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjrhfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbdbvhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfnpbld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdjrfrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rphhvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjdnhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnhvhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnfnxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrvrprd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhpljx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2460 2344 634968eed6d2b8a93dbef3df2ed88b0799fa4b21b404b0c8ab1f0cef74790801.exe 30 PID 2344 wrote to memory of 2460 2344 634968eed6d2b8a93dbef3df2ed88b0799fa4b21b404b0c8ab1f0cef74790801.exe 30 PID 2344 wrote to memory of 2460 2344 634968eed6d2b8a93dbef3df2ed88b0799fa4b21b404b0c8ab1f0cef74790801.exe 30 PID 2344 wrote to memory of 2460 2344 634968eed6d2b8a93dbef3df2ed88b0799fa4b21b404b0c8ab1f0cef74790801.exe 30 PID 2460 wrote to memory of 2880 2460 trdpv.exe 31 PID 2460 wrote to memory of 2880 2460 trdpv.exe 31 PID 2460 wrote to memory of 2880 2460 trdpv.exe 31 PID 2460 wrote to memory of 2880 2460 trdpv.exe 31 PID 2880 wrote to memory of 2884 2880 rrrnb.exe 32 PID 2880 wrote to memory of 2884 2880 rrrnb.exe 32 PID 2880 wrote to memory of 2884 2880 rrrnb.exe 32 PID 2880 wrote to memory of 2884 2880 rrrnb.exe 32 PID 2884 wrote to memory of 2564 2884 hfdnbl.exe 33 PID 2884 wrote to memory of 2564 2884 hfdnbl.exe 33 PID 2884 wrote to memory of 2564 2884 hfdnbl.exe 33 PID 2884 wrote to memory of 2564 2884 hfdnbl.exe 33 PID 2564 wrote to memory of 3028 2564 xbdnf.exe 34 PID 2564 wrote to memory of 3028 2564 xbdnf.exe 34 PID 2564 wrote to memory of 3028 2564 xbdnf.exe 34 PID 2564 wrote to memory of 3028 2564 xbdnf.exe 34 PID 3028 wrote to memory of 2744 3028 xvvntj.exe 35 PID 3028 wrote to memory of 2744 3028 xvvntj.exe 35 PID 3028 wrote to memory of 2744 3028 xvvntj.exe 35 PID 3028 wrote to memory of 2744 3028 xvvntj.exe 35 PID 2744 wrote to memory of 2320 2744 fhjll.exe 36 PID 2744 wrote to memory of 2320 2744 fhjll.exe 36 PID 2744 wrote to memory of 2320 2744 fhjll.exe 36 PID 2744 wrote to memory of 2320 2744 fhjll.exe 36 PID 2320 wrote to memory of 884 2320 ltttjh.exe 37 PID 2320 wrote to memory of 884 2320 ltttjh.exe 37 PID 2320 wrote to memory of 884 2320 ltttjh.exe 37 PID 2320 wrote to memory of 884 2320 ltttjh.exe 37 PID 884 wrote to memory of 2312 884 jdtbr.exe 38 PID 884 wrote to memory of 2312 884 jdtbr.exe 38 PID 884 wrote to memory of 2312 884 jdtbr.exe 38 PID 884 wrote to memory of 2312 884 jdtbr.exe 38 PID 2312 wrote to memory of 588 2312 hdlxtth.exe 39 PID 2312 wrote to memory of 588 2312 hdlxtth.exe 39 PID 2312 wrote to memory of 588 2312 hdlxtth.exe 39 PID 2312 wrote to memory of 588 2312 hdlxtth.exe 39 PID 588 wrote to memory of 1824 588 njjnjhn.exe 40 PID 588 wrote to memory of 1824 588 njjnjhn.exe 40 PID 588 wrote to memory of 1824 588 njjnjhn.exe 40 PID 588 wrote to memory of 1824 588 njjnjhn.exe 40 PID 1824 wrote to memory of 1532 1824 tpdjv.exe 41 PID 1824 wrote to memory of 1532 1824 tpdjv.exe 41 PID 1824 wrote to memory of 1532 1824 tpdjv.exe 41 PID 1824 wrote to memory of 1532 1824 tpdjv.exe 41 PID 1532 wrote to memory of 952 1532 prrvr.exe 42 PID 1532 wrote to memory of 952 1532 prrvr.exe 42 PID 1532 wrote to memory of 952 1532 prrvr.exe 42 PID 1532 wrote to memory of 952 1532 prrvr.exe 42 PID 952 wrote to memory of 2924 952 llnbbdb.exe 43 PID 952 wrote to memory of 2924 952 llnbbdb.exe 43 PID 952 wrote to memory of 2924 952 llnbbdb.exe 43 PID 952 wrote to memory of 2924 952 llnbbdb.exe 43 PID 2924 wrote to memory of 1768 2924 txvxf.exe 44 PID 2924 wrote to memory of 1768 2924 txvxf.exe 44 PID 2924 wrote to memory of 1768 2924 txvxf.exe 44 PID 2924 wrote to memory of 1768 2924 txvxf.exe 44 PID 1768 wrote to memory of 1784 1768 fthvb.exe 45 PID 1768 wrote to memory of 1784 1768 fthvb.exe 45 PID 1768 wrote to memory of 1784 1768 fthvb.exe 45 PID 1768 wrote to memory of 1784 1768 fthvb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\634968eed6d2b8a93dbef3df2ed88b0799fa4b21b404b0c8ab1f0cef74790801.exe"C:\Users\Admin\AppData\Local\Temp\634968eed6d2b8a93dbef3df2ed88b0799fa4b21b404b0c8ab1f0cef74790801.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\trdpv.exec:\trdpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\rrrnb.exec:\rrrnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\hfdnbl.exec:\hfdnbl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\xbdnf.exec:\xbdnf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\xvvntj.exec:\xvvntj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\fhjll.exec:\fhjll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\ltttjh.exec:\ltttjh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\jdtbr.exec:\jdtbr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\hdlxtth.exec:\hdlxtth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\njjnjhn.exec:\njjnjhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\tpdjv.exec:\tpdjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\prrvr.exec:\prrvr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\llnbbdb.exec:\llnbbdb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\txvxf.exec:\txvxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\fthvb.exec:\fthvb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\nflnx.exec:\nflnx.exe17⤵
- Executes dropped EXE
PID:1784 -
\??\c:\nxprr.exec:\nxprr.exe18⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vdftvr.exec:\vdftvr.exe19⤵
- Executes dropped EXE
PID:1320 -
\??\c:\hhpptrr.exec:\hhpptrr.exe20⤵
- Executes dropped EXE
PID:3060 -
\??\c:\fbrnhh.exec:\fbrnhh.exe21⤵
- Executes dropped EXE
PID:316 -
\??\c:\nbjrx.exec:\nbjrx.exe22⤵
- Executes dropped EXE
PID:756 -
\??\c:\ntddhp.exec:\ntddhp.exe23⤵
- Executes dropped EXE
PID:2272 -
\??\c:\rhdppxh.exec:\rhdppxh.exe24⤵
- Executes dropped EXE
PID:3048 -
\??\c:\rrfjj.exec:\rrfjj.exe25⤵
- Executes dropped EXE
PID:2380 -
\??\c:\fthbx.exec:\fthbx.exe26⤵
- Executes dropped EXE
PID:1840 -
\??\c:\rftbvfl.exec:\rftbvfl.exe27⤵
- Executes dropped EXE
PID:2396 -
\??\c:\ltxtxf.exec:\ltxtxf.exe28⤵
- Executes dropped EXE
PID:1844 -
\??\c:\fvrhdpv.exec:\fvrhdpv.exe29⤵
- Executes dropped EXE
PID:700 -
\??\c:\bpbnft.exec:\bpbnft.exe30⤵
- Executes dropped EXE
PID:1888 -
\??\c:\vpllf.exec:\vpllf.exe31⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lpdnvth.exec:\lpdnvth.exe32⤵
- Executes dropped EXE
PID:2104 -
\??\c:\lnrntjv.exec:\lnrntjv.exe33⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bvjhj.exec:\bvjhj.exe34⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xvdrpbj.exec:\xvdrpbj.exe35⤵
- Executes dropped EXE
PID:2972 -
\??\c:\nxvdbvl.exec:\nxvdbvl.exe36⤵
- Executes dropped EXE
PID:2996 -
\??\c:\brfbt.exec:\brfbt.exe37⤵
- Executes dropped EXE
PID:2980 -
\??\c:\tptrl.exec:\tptrl.exe38⤵
- Executes dropped EXE
PID:2116 -
\??\c:\xbprfb.exec:\xbprfb.exe39⤵
- Executes dropped EXE
PID:2756 -
\??\c:\htvdjb.exec:\htvdjb.exe40⤵
- Executes dropped EXE
PID:1796 -
\??\c:\dbnnbr.exec:\dbnnbr.exe41⤵
- Executes dropped EXE
PID:920 -
\??\c:\rltbth.exec:\rltbth.exe42⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rrprfvp.exec:\rrprfvp.exe43⤵
- Executes dropped EXE
PID:2716 -
\??\c:\lrpbrl.exec:\lrpbrl.exe44⤵
- Executes dropped EXE
PID:2320 -
\??\c:\lldfj.exec:\lldfj.exe45⤵
- Executes dropped EXE
PID:2108 -
\??\c:\vfvjnjf.exec:\vfvjnjf.exe46⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vbbxn.exec:\vbbxn.exe47⤵
- Executes dropped EXE
PID:2312 -
\??\c:\xrjdpl.exec:\xrjdpl.exe48⤵
- Executes dropped EXE
PID:3020 -
\??\c:\fhrttn.exec:\fhrttn.exe49⤵
- Executes dropped EXE
PID:1248 -
\??\c:\lbnxbbx.exec:\lbnxbbx.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2440 -
\??\c:\pdfrfjh.exec:\pdfrfjh.exe51⤵
- Executes dropped EXE
PID:1624 -
\??\c:\tjlpp.exec:\tjlpp.exe52⤵
- Executes dropped EXE
PID:1496 -
\??\c:\vbrvf.exec:\vbrvf.exe53⤵
- Executes dropped EXE
PID:2592 -
\??\c:\ldtplp.exec:\ldtplp.exe54⤵
- Executes dropped EXE
PID:1528 -
\??\c:\ttdjn.exec:\ttdjn.exe55⤵
- Executes dropped EXE
PID:1056 -
\??\c:\dhpnd.exec:\dhpnd.exe56⤵
- Executes dropped EXE
PID:2276 -
\??\c:\nblvjf.exec:\nblvjf.exe57⤵
- Executes dropped EXE
PID:2196 -
\??\c:\bbvbfd.exec:\bbvbfd.exe58⤵
- Executes dropped EXE
PID:892 -
\??\c:\fnllp.exec:\fnllp.exe59⤵
- Executes dropped EXE
PID:2624 -
\??\c:\xdbvp.exec:\xdbvp.exe60⤵
- Executes dropped EXE
PID:1644 -
\??\c:\vvpflf.exec:\vvpflf.exe61⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hnnlfdf.exec:\hnnlfdf.exe62⤵
- Executes dropped EXE
PID:1284 -
\??\c:\ddbjpvn.exec:\ddbjpvn.exe63⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xjbbjj.exec:\xjbbjj.exe64⤵
- Executes dropped EXE
PID:696 -
\??\c:\drfjfhp.exec:\drfjfhp.exe65⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xntnd.exec:\xntnd.exe66⤵PID:1304
-
\??\c:\xhbft.exec:\xhbft.exe67⤵PID:2380
-
\??\c:\ptnpt.exec:\ptnpt.exe68⤵PID:1904
-
\??\c:\fphtr.exec:\fphtr.exe69⤵
- System Location Discovery: System Language Discovery
PID:108 -
\??\c:\bpxpxvh.exec:\bpxpxvh.exe70⤵PID:2524
-
\??\c:\dxbtxt.exec:\dxbtxt.exe71⤵PID:1680
-
\??\c:\tddrvnl.exec:\tddrvnl.exe72⤵PID:2644
-
\??\c:\vbbnpj.exec:\vbbnpj.exe73⤵PID:1924
-
\??\c:\hhdbbrf.exec:\hhdbbrf.exe74⤵PID:1580
-
\??\c:\hbrxdld.exec:\hbrxdld.exe75⤵PID:3040
-
\??\c:\tpthdnt.exec:\tpthdnt.exe76⤵PID:2456
-
\??\c:\jvlhhjr.exec:\jvlhhjr.exe77⤵PID:2484
-
\??\c:\dlbxxx.exec:\dlbxxx.exe78⤵PID:2840
-
\??\c:\fdfhj.exec:\fdfhj.exe79⤵PID:3000
-
\??\c:\tvrvt.exec:\tvrvt.exe80⤵PID:2864
-
\??\c:\fhtpjph.exec:\fhtpjph.exe81⤵
- System Location Discovery: System Language Discovery
PID:2980 -
\??\c:\ppvblrx.exec:\ppvblrx.exe82⤵PID:2868
-
\??\c:\hlxxtp.exec:\hlxxtp.exe83⤵PID:2896
-
\??\c:\jhrbhx.exec:\jhrbhx.exe84⤵PID:2788
-
\??\c:\bhfrpx.exec:\bhfrpx.exe85⤵PID:916
-
\??\c:\bbxth.exec:\bbxth.exe86⤵PID:2228
-
\??\c:\rtfrf.exec:\rtfrf.exe87⤵PID:1036
-
\??\c:\ndxfh.exec:\ndxfh.exe88⤵PID:884
-
\??\c:\llrhpxh.exec:\llrhpxh.exe89⤵PID:980
-
\??\c:\vdfbl.exec:\vdfbl.exe90⤵PID:796
-
\??\c:\jtrrd.exec:\jtrrd.exe91⤵PID:2092
-
\??\c:\bfnpbld.exec:\bfnpbld.exe92⤵
- System Location Discovery: System Language Discovery
PID:984 -
\??\c:\ttlrnh.exec:\ttlrnh.exe93⤵PID:924
-
\??\c:\rjjbj.exec:\rjjbj.exe94⤵PID:1808
-
\??\c:\dhpnppv.exec:\dhpnppv.exe95⤵PID:2772
-
\??\c:\dtxvf.exec:\dtxvf.exe96⤵PID:1496
-
\??\c:\rhdltr.exec:\rhdltr.exe97⤵PID:1128
-
\??\c:\hthjb.exec:\hthjb.exe98⤵PID:2928
-
\??\c:\hfrhlf.exec:\hfrhlf.exe99⤵PID:2444
-
\??\c:\vvfdxb.exec:\vvfdxb.exe100⤵PID:1052
-
\??\c:\lrtrpp.exec:\lrtrpp.exe101⤵PID:2660
-
\??\c:\xnlnjhn.exec:\xnlnjhn.exe102⤵PID:892
-
\??\c:\ldptpr.exec:\ldptpr.exe103⤵PID:2624
-
\??\c:\hjdlf.exec:\hjdlf.exe104⤵PID:1060
-
\??\c:\jxbph.exec:\jxbph.exe105⤵PID:908
-
\??\c:\fhxbp.exec:\fhxbp.exe106⤵PID:1860
-
\??\c:\rnppxd.exec:\rnppxd.exe107⤵PID:1836
-
\??\c:\lntdp.exec:\lntdp.exe108⤵PID:696
-
\??\c:\xprhfh.exec:\xprhfh.exe109⤵PID:1524
-
\??\c:\btnbbtp.exec:\btnbbtp.exe110⤵PID:1360
-
\??\c:\bxdljfn.exec:\bxdljfn.exe111⤵PID:1840
-
\??\c:\tndflxh.exec:\tndflxh.exe112⤵PID:1904
-
\??\c:\tplhvdd.exec:\tplhvdd.exe113⤵PID:2704
-
\??\c:\fldbb.exec:\fldbb.exe114⤵PID:764
-
\??\c:\dvtrf.exec:\dvtrf.exe115⤵PID:1652
-
\??\c:\bhpxfdj.exec:\bhpxfdj.exe116⤵PID:2672
-
\??\c:\xbxbd.exec:\xbxbd.exe117⤵PID:596
-
\??\c:\fbdtf.exec:\fbdtf.exe118⤵PID:1684
-
\??\c:\tpjbf.exec:\tpjbf.exe119⤵PID:3016
-
\??\c:\pnlxvxx.exec:\pnlxvxx.exe120⤵PID:1596
-
\??\c:\ttblv.exec:\ttblv.exe121⤵PID:2824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-