Analysis
-
max time kernel
150s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 22:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
487870bf25ab8469f039b998cf633233534f8c0408e67c050ffeb4eec930cfe4.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
487870bf25ab8469f039b998cf633233534f8c0408e67c050ffeb4eec930cfe4.exe
-
Size
454KB
-
MD5
d9ae31f29289ea8a8ec72eaa7e7af116
-
SHA1
3dae49950266693423f440d344de79a60da45be0
-
SHA256
487870bf25ab8469f039b998cf633233534f8c0408e67c050ffeb4eec930cfe4
-
SHA512
a192283a6cb4937f0155b326d8ae9b2c8d60ed15477cbe4c458b67f4c1d2d4efea9da76ec1877aef05218533c6fc64173819a7e875437fde36dcacc328967da5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet5:q7Tc2NYHUrAwfMp3CDt5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2660-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-86-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2472-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-97-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2500-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1124-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-223-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1396-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/924-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-613-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2768-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-727-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3008 jbbtlx.exe 1044 dfvfv.exe 2932 bdhdppr.exe 2844 xvfrf.exe 2748 bvfljn.exe 2876 thhxpx.exe 2708 vlpfrp.exe 2264 nvfhl.exe 2472 jxfxlb.exe 832 fdjph.exe 2500 xbthhpl.exe 3064 tfljvbf.exe 2200 pbbjfd.exe 2972 dnxntv.exe 2568 tdbrlr.exe 1096 vxhfr.exe 1704 nvvhbh.exe 2488 pdhnthn.exe 592 jxvrjd.exe 2404 jbxvv.exe 2052 nrppn.exe 1124 rprbd.exe 2012 fjxjpvl.exe 2584 ltnbv.exe 288 vdxjbj.exe 1816 njfhprx.exe 1396 vdxjvlp.exe 2020 hxhdn.exe 924 bhnrhjn.exe 572 xtjfvn.exe 2372 fpbrhvx.exe 1740 tbnnp.exe 2892 lhnjf.exe 2804 ddjvntl.exe 2184 tjndj.exe 1708 jnnppxh.exe 2984 bbhllnf.exe 2408 hjhbpx.exe 2720 bpvxdrh.exe 3032 vjxlt.exe 3016 rpdtbpb.exe 2712 hlvfrd.exe 2440 rdxfdhl.exe 2028 xffbjr.exe 2100 rtxtbl.exe 2116 vrndvph.exe 1916 djpht.exe 2800 nfbxf.exe 1168 bnfnj.exe 3060 rnrptr.exe 2764 pjddlfv.exe 2200 lvtvxpd.exe 2972 rxplh.exe 2900 lttxptf.exe 2348 jrnlb.exe 1612 ljpvhfn.exe 2228 brblh.exe 2488 bfjdf.exe 1652 vxphfp.exe 2072 lndfd.exe 848 nbbvxv.exe 2432 lfblb.exe 952 vbhbxnd.exe 2484 rbtth.exe -
resource yara_rule behavioral1/memory/2660-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1124-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-534-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1820-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-807-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjlbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnfnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlfjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftnnxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxpdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnlldr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbjjfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phlpfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phdtlbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdrfphx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhhhtvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlbbdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djxfbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrndfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvtlhlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvjvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpvjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjrntp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjnrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhxpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trptpdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfddthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppbhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbpjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbljhld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxfjprh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2660 wrote to memory of 3008 2660 487870bf25ab8469f039b998cf633233534f8c0408e67c050ffeb4eec930cfe4.exe 29 PID 2660 wrote to memory of 3008 2660 487870bf25ab8469f039b998cf633233534f8c0408e67c050ffeb4eec930cfe4.exe 29 PID 2660 wrote to memory of 3008 2660 487870bf25ab8469f039b998cf633233534f8c0408e67c050ffeb4eec930cfe4.exe 29 PID 2660 wrote to memory of 3008 2660 487870bf25ab8469f039b998cf633233534f8c0408e67c050ffeb4eec930cfe4.exe 29 PID 3008 wrote to memory of 1044 3008 jbbtlx.exe 30 PID 3008 wrote to memory of 1044 3008 jbbtlx.exe 30 PID 3008 wrote to memory of 1044 3008 jbbtlx.exe 30 PID 3008 wrote to memory of 1044 3008 jbbtlx.exe 30 PID 1044 wrote to memory of 2932 1044 dfvfv.exe 31 PID 1044 wrote to memory of 2932 1044 dfvfv.exe 31 PID 1044 wrote to memory of 2932 1044 dfvfv.exe 31 PID 1044 wrote to memory of 2932 1044 dfvfv.exe 31 PID 2932 wrote to memory of 2844 2932 bdhdppr.exe 32 PID 2932 wrote to memory of 2844 2932 bdhdppr.exe 32 PID 2932 wrote to memory of 2844 2932 bdhdppr.exe 32 PID 2932 wrote to memory of 2844 2932 bdhdppr.exe 32 PID 2844 wrote to memory of 2748 2844 xvfrf.exe 33 PID 2844 wrote to memory of 2748 2844 xvfrf.exe 33 PID 2844 wrote to memory of 2748 2844 xvfrf.exe 33 PID 2844 wrote to memory of 2748 2844 xvfrf.exe 33 PID 2748 wrote to memory of 2876 2748 bvfljn.exe 34 PID 2748 wrote to memory of 2876 2748 bvfljn.exe 34 PID 2748 wrote to memory of 2876 2748 bvfljn.exe 34 PID 2748 wrote to memory of 2876 2748 bvfljn.exe 34 PID 2876 wrote to memory of 2708 2876 thhxpx.exe 35 PID 2876 wrote to memory of 2708 2876 thhxpx.exe 35 PID 2876 wrote to memory of 2708 2876 thhxpx.exe 35 PID 2876 wrote to memory of 2708 2876 thhxpx.exe 35 PID 2708 wrote to memory of 2264 2708 vlpfrp.exe 36 PID 2708 wrote to memory of 2264 2708 vlpfrp.exe 36 PID 2708 wrote to memory of 2264 2708 vlpfrp.exe 36 PID 2708 wrote to memory of 2264 2708 vlpfrp.exe 36 PID 2264 wrote to memory of 2472 2264 nvfhl.exe 37 PID 2264 wrote to memory of 2472 2264 nvfhl.exe 37 PID 2264 wrote to memory of 2472 2264 nvfhl.exe 37 PID 2264 wrote to memory of 2472 2264 nvfhl.exe 37 PID 2472 wrote to memory of 832 2472 jxfxlb.exe 38 PID 2472 wrote to memory of 832 2472 jxfxlb.exe 38 PID 2472 wrote to memory of 832 2472 jxfxlb.exe 38 PID 2472 wrote to memory of 832 2472 jxfxlb.exe 38 PID 832 wrote to memory of 2500 832 fdjph.exe 39 PID 832 wrote to memory of 2500 832 fdjph.exe 39 PID 832 wrote to memory of 2500 832 fdjph.exe 39 PID 832 wrote to memory of 2500 832 fdjph.exe 39 PID 2500 wrote to memory of 3064 2500 xbthhpl.exe 40 PID 2500 wrote to memory of 3064 2500 xbthhpl.exe 40 PID 2500 wrote to memory of 3064 2500 xbthhpl.exe 40 PID 2500 wrote to memory of 3064 2500 xbthhpl.exe 40 PID 3064 wrote to memory of 2200 3064 tfljvbf.exe 41 PID 3064 wrote to memory of 2200 3064 tfljvbf.exe 41 PID 3064 wrote to memory of 2200 3064 tfljvbf.exe 41 PID 3064 wrote to memory of 2200 3064 tfljvbf.exe 41 PID 2200 wrote to memory of 2972 2200 pbbjfd.exe 42 PID 2200 wrote to memory of 2972 2200 pbbjfd.exe 42 PID 2200 wrote to memory of 2972 2200 pbbjfd.exe 42 PID 2200 wrote to memory of 2972 2200 pbbjfd.exe 42 PID 2972 wrote to memory of 2568 2972 dnxntv.exe 43 PID 2972 wrote to memory of 2568 2972 dnxntv.exe 43 PID 2972 wrote to memory of 2568 2972 dnxntv.exe 43 PID 2972 wrote to memory of 2568 2972 dnxntv.exe 43 PID 2568 wrote to memory of 1096 2568 tdbrlr.exe 44 PID 2568 wrote to memory of 1096 2568 tdbrlr.exe 44 PID 2568 wrote to memory of 1096 2568 tdbrlr.exe 44 PID 2568 wrote to memory of 1096 2568 tdbrlr.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\487870bf25ab8469f039b998cf633233534f8c0408e67c050ffeb4eec930cfe4.exe"C:\Users\Admin\AppData\Local\Temp\487870bf25ab8469f039b998cf633233534f8c0408e67c050ffeb4eec930cfe4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\jbbtlx.exec:\jbbtlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\dfvfv.exec:\dfvfv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\bdhdppr.exec:\bdhdppr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\xvfrf.exec:\xvfrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\bvfljn.exec:\bvfljn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\thhxpx.exec:\thhxpx.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\vlpfrp.exec:\vlpfrp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\nvfhl.exec:\nvfhl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\jxfxlb.exec:\jxfxlb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\fdjph.exec:\fdjph.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\xbthhpl.exec:\xbthhpl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\tfljvbf.exec:\tfljvbf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\pbbjfd.exec:\pbbjfd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\dnxntv.exec:\dnxntv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\tdbrlr.exec:\tdbrlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\vxhfr.exec:\vxhfr.exe17⤵
- Executes dropped EXE
PID:1096 -
\??\c:\nvvhbh.exec:\nvvhbh.exe18⤵
- Executes dropped EXE
PID:1704 -
\??\c:\pdhnthn.exec:\pdhnthn.exe19⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jxvrjd.exec:\jxvrjd.exe20⤵
- Executes dropped EXE
PID:592 -
\??\c:\jbxvv.exec:\jbxvv.exe21⤵
- Executes dropped EXE
PID:2404 -
\??\c:\nrppn.exec:\nrppn.exe22⤵
- Executes dropped EXE
PID:2052 -
\??\c:\rprbd.exec:\rprbd.exe23⤵
- Executes dropped EXE
PID:1124 -
\??\c:\fjxjpvl.exec:\fjxjpvl.exe24⤵
- Executes dropped EXE
PID:2012 -
\??\c:\ltnbv.exec:\ltnbv.exe25⤵
- Executes dropped EXE
PID:2584 -
\??\c:\vdxjbj.exec:\vdxjbj.exe26⤵
- Executes dropped EXE
PID:288 -
\??\c:\njfhprx.exec:\njfhprx.exe27⤵
- Executes dropped EXE
PID:1816 -
\??\c:\vdxjvlp.exec:\vdxjvlp.exe28⤵
- Executes dropped EXE
PID:1396 -
\??\c:\hxhdn.exec:\hxhdn.exe29⤵
- Executes dropped EXE
PID:2020 -
\??\c:\bhnrhjn.exec:\bhnrhjn.exe30⤵
- Executes dropped EXE
PID:924 -
\??\c:\xtjfvn.exec:\xtjfvn.exe31⤵
- Executes dropped EXE
PID:572 -
\??\c:\fpbrhvx.exec:\fpbrhvx.exe32⤵
- Executes dropped EXE
PID:2372 -
\??\c:\tbnnp.exec:\tbnnp.exe33⤵
- Executes dropped EXE
PID:1740 -
\??\c:\lhnjf.exec:\lhnjf.exe34⤵
- Executes dropped EXE
PID:2892 -
\??\c:\ddjvntl.exec:\ddjvntl.exe35⤵
- Executes dropped EXE
PID:2804 -
\??\c:\tjndj.exec:\tjndj.exe36⤵
- Executes dropped EXE
PID:2184 -
\??\c:\jnnppxh.exec:\jnnppxh.exe37⤵
- Executes dropped EXE
PID:1708 -
\??\c:\bbhllnf.exec:\bbhllnf.exe38⤵
- Executes dropped EXE
PID:2984 -
\??\c:\hjhbpx.exec:\hjhbpx.exe39⤵
- Executes dropped EXE
PID:2408 -
\??\c:\bpvxdrh.exec:\bpvxdrh.exe40⤵
- Executes dropped EXE
PID:2720 -
\??\c:\vjxlt.exec:\vjxlt.exe41⤵
- Executes dropped EXE
PID:3032 -
\??\c:\rpdtbpb.exec:\rpdtbpb.exe42⤵
- Executes dropped EXE
PID:3016 -
\??\c:\hlvfrd.exec:\hlvfrd.exe43⤵
- Executes dropped EXE
PID:2712 -
\??\c:\rdxfdhl.exec:\rdxfdhl.exe44⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xffbjr.exec:\xffbjr.exe45⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rtxtbl.exec:\rtxtbl.exe46⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vrndvph.exec:\vrndvph.exe47⤵
- Executes dropped EXE
PID:2116 -
\??\c:\djpht.exec:\djpht.exe48⤵
- Executes dropped EXE
PID:1916 -
\??\c:\nfbxf.exec:\nfbxf.exe49⤵
- Executes dropped EXE
PID:2800 -
\??\c:\bnfnj.exec:\bnfnj.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1168 -
\??\c:\rnrptr.exec:\rnrptr.exe51⤵
- Executes dropped EXE
PID:3060 -
\??\c:\pjddlfv.exec:\pjddlfv.exe52⤵
- Executes dropped EXE
PID:2764 -
\??\c:\lvtvxpd.exec:\lvtvxpd.exe53⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rxplh.exec:\rxplh.exe54⤵
- Executes dropped EXE
PID:2972 -
\??\c:\lttxptf.exec:\lttxptf.exe55⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jrnlb.exec:\jrnlb.exe56⤵
- Executes dropped EXE
PID:2348 -
\??\c:\ljpvhfn.exec:\ljpvhfn.exe57⤵
- Executes dropped EXE
PID:1612 -
\??\c:\brblh.exec:\brblh.exe58⤵
- Executes dropped EXE
PID:2228 -
\??\c:\bfjdf.exec:\bfjdf.exe59⤵
- Executes dropped EXE
PID:2488 -
\??\c:\vxphfp.exec:\vxphfp.exe60⤵
- Executes dropped EXE
PID:1652 -
\??\c:\lndfd.exec:\lndfd.exe61⤵
- Executes dropped EXE
PID:2072 -
\??\c:\nbbvxv.exec:\nbbvxv.exe62⤵
- Executes dropped EXE
PID:848 -
\??\c:\lfblb.exec:\lfblb.exe63⤵
- Executes dropped EXE
PID:2432 -
\??\c:\vbhbxnd.exec:\vbhbxnd.exe64⤵
- Executes dropped EXE
PID:952 -
\??\c:\rbtth.exec:\rbtth.exe65⤵
- Executes dropped EXE
PID:2484 -
\??\c:\fvnxr.exec:\fvnxr.exe66⤵PID:2128
-
\??\c:\jrffd.exec:\jrffd.exe67⤵PID:2032
-
\??\c:\jvddjp.exec:\jvddjp.exe68⤵PID:288
-
\??\c:\hxftpt.exec:\hxftpt.exe69⤵PID:1820
-
\??\c:\jvldbr.exec:\jvldbr.exe70⤵PID:1672
-
\??\c:\fhjfrl.exec:\fhjfrl.exe71⤵PID:1464
-
\??\c:\lrhbpbj.exec:\lrhbpbj.exe72⤵PID:472
-
\??\c:\hfptv.exec:\hfptv.exe73⤵PID:1472
-
\??\c:\xjfrddt.exec:\xjfrddt.exe74⤵PID:2256
-
\??\c:\prjbbjl.exec:\prjbbjl.exe75⤵PID:760
-
\??\c:\rvtlhlv.exec:\rvtlhlv.exe76⤵
- System Location Discovery: System Language Discovery
PID:956 -
\??\c:\bfrxv.exec:\bfrxv.exe77⤵PID:2840
-
\??\c:\frldj.exec:\frldj.exe78⤵PID:2804
-
\??\c:\nvrpph.exec:\nvrpph.exe79⤵PID:2184
-
\??\c:\jfpthb.exec:\jfpthb.exe80⤵PID:2980
-
\??\c:\hbxrxfp.exec:\hbxrxfp.exe81⤵PID:2336
-
\??\c:\rnhlvpt.exec:\rnhlvpt.exe82⤵PID:2872
-
\??\c:\bjfrll.exec:\bjfrll.exe83⤵PID:2844
-
\??\c:\nhhlj.exec:\nhhlj.exe84⤵PID:2940
-
\??\c:\dhddvr.exec:\dhddvr.exe85⤵PID:2996
-
\??\c:\npdrh.exec:\npdrh.exe86⤵PID:2768
-
\??\c:\bfdjtp.exec:\bfdjtp.exe87⤵PID:2772
-
\??\c:\hxfhrhn.exec:\hxfhrhn.exe88⤵PID:1064
-
\??\c:\rxhtn.exec:\rxhtn.exe89⤵PID:2068
-
\??\c:\bbtplhn.exec:\bbtplhn.exe90⤵PID:2112
-
\??\c:\xjntp.exec:\xjntp.exe91⤵PID:1844
-
\??\c:\rxxdx.exec:\rxxdx.exe92⤵PID:1020
-
\??\c:\ptjtdnd.exec:\ptjtdnd.exe93⤵PID:3044
-
\??\c:\vltphb.exec:\vltphb.exe94⤵PID:3068
-
\??\c:\fbllnl.exec:\fbllnl.exe95⤵PID:1400
-
\??\c:\nbhlvhx.exec:\nbhlvhx.exe96⤵PID:1984
-
\??\c:\rvpnfhd.exec:\rvpnfhd.exe97⤵PID:2972
-
\??\c:\frhhjld.exec:\frhhjld.exe98⤵PID:1804
-
\??\c:\vnhxvn.exec:\vnhxvn.exe99⤵PID:2232
-
\??\c:\pdrfj.exec:\pdrfj.exe100⤵PID:2452
-
\??\c:\ftnxd.exec:\ftnxd.exe101⤵PID:2096
-
\??\c:\tlrplt.exec:\tlrplt.exe102⤵PID:2192
-
\??\c:\lbtrdx.exec:\lbtrdx.exe103⤵PID:1220
-
\??\c:\fjrtpd.exec:\fjrtpd.exe104⤵PID:1968
-
\??\c:\xnnntxr.exec:\xnnntxr.exe105⤵PID:2652
-
\??\c:\hbxbldr.exec:\hbxbldr.exe106⤵PID:2412
-
\??\c:\hpnxxpt.exec:\hpnxxpt.exe107⤵PID:1832
-
\??\c:\lnjplf.exec:\lnjplf.exe108⤵PID:456
-
\??\c:\ptvrf.exec:\ptvrf.exe109⤵PID:2564
-
\??\c:\tdhnx.exec:\tdhnx.exe110⤵PID:1456
-
\??\c:\nttpnpt.exec:\nttpnpt.exe111⤵PID:2272
-
\??\c:\nrjnj.exec:\nrjnj.exe112⤵PID:1816
-
\??\c:\pxrtdv.exec:\pxrtdv.exe113⤵PID:1560
-
\??\c:\xlddt.exec:\xlddt.exe114⤵PID:2656
-
\??\c:\xbnhfdb.exec:\xbnhfdb.exe115⤵PID:2544
-
\??\c:\bjbjdh.exec:\bjbjdh.exe116⤵PID:2280
-
\??\c:\rhbbvb.exec:\rhbbvb.exe117⤵PID:2372
-
\??\c:\xvljrr.exec:\xvljrr.exe118⤵PID:1792
-
\??\c:\tpjnv.exec:\tpjnv.exe119⤵PID:1620
-
\??\c:\ptnxn.exec:\ptnxn.exe120⤵PID:2820
-
\??\c:\lrrnn.exec:\lrrnn.exe121⤵PID:2144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-