Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 14:29
Behavioral task
behavioral1
Sample
0ea5c80877d2639b2f3d07c06122f694672c5d2bb28d9d927368e62b6d4bbc39.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
0ea5c80877d2639b2f3d07c06122f694672c5d2bb28d9d927368e62b6d4bbc39.exe
-
Size
66KB
-
MD5
80feb676fd7f318f1c77dedd9cdeccec
-
SHA1
846ab76503e1c53bd5fad4bb248916c45c444729
-
SHA256
0ea5c80877d2639b2f3d07c06122f694672c5d2bb28d9d927368e62b6d4bbc39
-
SHA512
3365ddd94aff10b2ecfd4da11d9a92ed6d1cbe858ed7cae5ad7bd2f40755738406e9b8df945032689f201f41c5a81300f190a56bdadb730b17eced407fcc0418
-
SSDEEP
1536:/vQBeOGtrYS3srx93UBWfwC6Ggnouy8jb5DiLKrb03:/hOmTsF93UYfwC6GIoutcKbW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 59 IoCs
resource yara_rule behavioral1/memory/2448-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-64-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2072-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1008-122-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1008-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1304-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1160-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/760-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/760-151-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1956-161-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2108-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1956-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/600-231-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1312-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1276-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-292-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2528-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1808-301-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1808-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1504-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1504-332-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1504-355-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2688-381-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2688-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-420-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1868-433-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2456-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-500-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/552-513-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1276-556-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-570-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-691-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1684-811-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-860-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-872-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2896-886-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/2820-898-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2852-912-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2664-926-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2664-927-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/604-940-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2508-978-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2508-979-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2316-986-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/664-993-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1964-1001-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1580-1072-0x0000000001B80000-0x0000000001BA7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2748 lxxbhtn.exe 2772 vnvvp.exe 2860 plbfvb.exe 2916 jpfxt.exe 2784 dnltf.exe 2652 llfvj.exe 2072 dpffjf.exe 2660 vdtlbr.exe 2200 lllphd.exe 2004 bbvpb.exe 2316 xxffll.exe 1008 pvxrp.exe 1304 xtdbjxr.exe 1160 jpjhj.exe 760 hlvpxf.exe 1956 vnrbfv.exe 2108 bdpbvj.exe 2444 pttltrf.exe 2348 rfvlf.exe 2556 bpnddrt.exe 2512 dfldlt.exe 1864 vffpj.exe 316 ftpbd.exe 600 jrnfpn.exe 1336 lrtlnjd.exe 1656 njjdd.exe 1312 nxxjt.exe 1276 jfbrhrt.exe 2184 hhljhl.exe 3000 xdxnbt.exe 2528 brtjtdj.exe 1808 lhnvlxt.exe 2728 pblxhtf.exe 2724 fnnjt.exe 2896 djrnn.exe 2196 rpnbh.exe 1504 djnpvrl.exe 2648 rdfrjhf.exe 2756 phldx.exe 2416 bhttx.exe 2616 djlbnx.exe 2684 jflvfnf.exe 2600 xjffd.exe 2688 jptxdnn.exe 2236 tjpdjpr.exe 2500 rndxjdv.exe 1776 nffjflv.exe 2000 vpdpp.exe 2972 xfrjhbv.exe 2956 xlxldtd.exe 568 bfxjlt.exe 1868 drbdfdf.exe 852 tvrxvj.exe 2152 fllvp.exe 1608 dpxlvft.exe 1572 ntdtb.exe 2108 xjxxxf.exe 2160 nfnbn.exe 2260 llfnfxf.exe 2456 xjxddll.exe 2556 jhjpnft.exe 1844 nbxhbtj.exe 1768 bppnp.exe 552 vvhjt.exe -
resource yara_rule behavioral1/memory/2448-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001227e-5.dat upx behavioral1/memory/2448-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2748-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001756b-18.dat upx behavioral1/files/0x0002000000018334-28.dat upx behavioral1/memory/2860-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2772-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186b7-36.dat upx behavioral1/memory/2916-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2916-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186bb-49.dat upx behavioral1/memory/2784-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186c3-56.dat upx behavioral1/memory/2784-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2652-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2072-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000018b05-67.dat upx behavioral1/memory/2072-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000018b28-80.dat upx behavioral1/memory/2660-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c5-88.dat upx behavioral1/memory/2200-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c6-98.dat upx behavioral1/memory/2200-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c7-108.dat upx behavioral1/memory/2004-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960c-114.dat upx behavioral1/files/0x000d000000016fc9-123.dat upx behavioral1/memory/1008-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1304-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019643-133.dat upx behavioral1/memory/1160-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001975a-143.dat upx behavioral1/memory/760-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019761-153.dat upx behavioral1/memory/2108-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000197fd-164.dat upx behavioral1/memory/1956-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019820-172.dat upx behavioral1/files/0x000500000001998d-179.dat upx behavioral1/files/0x0005000000019bf5-188.dat upx behavioral1/memory/2556-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf6-197.dat upx behavioral1/memory/2512-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf9-206.dat upx behavioral1/memory/1864-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c3c-215.dat upx behavioral1/files/0x0005000000019d61-223.dat upx behavioral1/files/0x0005000000019d62-232.dat upx behavioral1/files/0x0005000000019d6d-240.dat upx behavioral1/files/0x0005000000019e92-248.dat upx behavioral1/files/0x0005000000019fd4-257.dat upx behavioral1/memory/1312-256-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1276-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019fdd-265.dat upx behavioral1/memory/2184-268-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a03c-275.dat upx behavioral1/files/0x000500000001a049-282.dat upx behavioral1/memory/2528-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2528-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a0b6-293.dat upx behavioral1/memory/1808-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1504-335-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvplp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpvvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npbfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfplphd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrbln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttlpbnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnpdbpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhljhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvlvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnpjln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldlhjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfnvbhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blfvrbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvrvbjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvjfnpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnrbfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pttltrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfnfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfdpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhjbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dndxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdnfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnbhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frpnrrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nffjflv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjntxnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vllpnbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbbrxht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvtjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jblplf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttxvdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjrhbrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frvpvhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjtlvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdhtpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtdvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btppbfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnpph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjrhjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbbpfbn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2448 wrote to memory of 2748 2448 0ea5c80877d2639b2f3d07c06122f694672c5d2bb28d9d927368e62b6d4bbc39.exe 30 PID 2448 wrote to memory of 2748 2448 0ea5c80877d2639b2f3d07c06122f694672c5d2bb28d9d927368e62b6d4bbc39.exe 30 PID 2448 wrote to memory of 2748 2448 0ea5c80877d2639b2f3d07c06122f694672c5d2bb28d9d927368e62b6d4bbc39.exe 30 PID 2448 wrote to memory of 2748 2448 0ea5c80877d2639b2f3d07c06122f694672c5d2bb28d9d927368e62b6d4bbc39.exe 30 PID 2748 wrote to memory of 2772 2748 lxxbhtn.exe 31 PID 2748 wrote to memory of 2772 2748 lxxbhtn.exe 31 PID 2748 wrote to memory of 2772 2748 lxxbhtn.exe 31 PID 2748 wrote to memory of 2772 2748 lxxbhtn.exe 31 PID 2772 wrote to memory of 2860 2772 vnvvp.exe 32 PID 2772 wrote to memory of 2860 2772 vnvvp.exe 32 PID 2772 wrote to memory of 2860 2772 vnvvp.exe 32 PID 2772 wrote to memory of 2860 2772 vnvvp.exe 32 PID 2860 wrote to memory of 2916 2860 plbfvb.exe 33 PID 2860 wrote to memory of 2916 2860 plbfvb.exe 33 PID 2860 wrote to memory of 2916 2860 plbfvb.exe 33 PID 2860 wrote to memory of 2916 2860 plbfvb.exe 33 PID 2916 wrote to memory of 2784 2916 jpfxt.exe 34 PID 2916 wrote to memory of 2784 2916 jpfxt.exe 34 PID 2916 wrote to memory of 2784 2916 jpfxt.exe 34 PID 2916 wrote to memory of 2784 2916 jpfxt.exe 34 PID 2784 wrote to memory of 2652 2784 dnltf.exe 35 PID 2784 wrote to memory of 2652 2784 dnltf.exe 35 PID 2784 wrote to memory of 2652 2784 dnltf.exe 35 PID 2784 wrote to memory of 2652 2784 dnltf.exe 35 PID 2652 wrote to memory of 2072 2652 llfvj.exe 36 PID 2652 wrote to memory of 2072 2652 llfvj.exe 36 PID 2652 wrote to memory of 2072 2652 llfvj.exe 36 PID 2652 wrote to memory of 2072 2652 llfvj.exe 36 PID 2072 wrote to memory of 2660 2072 dpffjf.exe 37 PID 2072 wrote to memory of 2660 2072 dpffjf.exe 37 PID 2072 wrote to memory of 2660 2072 dpffjf.exe 37 PID 2072 wrote to memory of 2660 2072 dpffjf.exe 37 PID 2660 wrote to memory of 2200 2660 vdtlbr.exe 38 PID 2660 wrote to memory of 2200 2660 vdtlbr.exe 38 PID 2660 wrote to memory of 2200 2660 vdtlbr.exe 38 PID 2660 wrote to memory of 2200 2660 vdtlbr.exe 38 PID 2200 wrote to memory of 2004 2200 lllphd.exe 39 PID 2200 wrote to memory of 2004 2200 lllphd.exe 39 PID 2200 wrote to memory of 2004 2200 lllphd.exe 39 PID 2200 wrote to memory of 2004 2200 lllphd.exe 39 PID 2004 wrote to memory of 2316 2004 bbvpb.exe 40 PID 2004 wrote to memory of 2316 2004 bbvpb.exe 40 PID 2004 wrote to memory of 2316 2004 bbvpb.exe 40 PID 2004 wrote to memory of 2316 2004 bbvpb.exe 40 PID 2316 wrote to memory of 1008 2316 xxffll.exe 41 PID 2316 wrote to memory of 1008 2316 xxffll.exe 41 PID 2316 wrote to memory of 1008 2316 xxffll.exe 41 PID 2316 wrote to memory of 1008 2316 xxffll.exe 41 PID 1008 wrote to memory of 1304 1008 pvxrp.exe 42 PID 1008 wrote to memory of 1304 1008 pvxrp.exe 42 PID 1008 wrote to memory of 1304 1008 pvxrp.exe 42 PID 1008 wrote to memory of 1304 1008 pvxrp.exe 42 PID 1304 wrote to memory of 1160 1304 xtdbjxr.exe 43 PID 1304 wrote to memory of 1160 1304 xtdbjxr.exe 43 PID 1304 wrote to memory of 1160 1304 xtdbjxr.exe 43 PID 1304 wrote to memory of 1160 1304 xtdbjxr.exe 43 PID 1160 wrote to memory of 760 1160 jpjhj.exe 44 PID 1160 wrote to memory of 760 1160 jpjhj.exe 44 PID 1160 wrote to memory of 760 1160 jpjhj.exe 44 PID 1160 wrote to memory of 760 1160 jpjhj.exe 44 PID 760 wrote to memory of 1956 760 hlvpxf.exe 45 PID 760 wrote to memory of 1956 760 hlvpxf.exe 45 PID 760 wrote to memory of 1956 760 hlvpxf.exe 45 PID 760 wrote to memory of 1956 760 hlvpxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ea5c80877d2639b2f3d07c06122f694672c5d2bb28d9d927368e62b6d4bbc39.exe"C:\Users\Admin\AppData\Local\Temp\0ea5c80877d2639b2f3d07c06122f694672c5d2bb28d9d927368e62b6d4bbc39.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\lxxbhtn.exec:\lxxbhtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\vnvvp.exec:\vnvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\plbfvb.exec:\plbfvb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\jpfxt.exec:\jpfxt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\dnltf.exec:\dnltf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\llfvj.exec:\llfvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\dpffjf.exec:\dpffjf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\vdtlbr.exec:\vdtlbr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\lllphd.exec:\lllphd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\bbvpb.exec:\bbvpb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\xxffll.exec:\xxffll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\pvxrp.exec:\pvxrp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\xtdbjxr.exec:\xtdbjxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\jpjhj.exec:\jpjhj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\hlvpxf.exec:\hlvpxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\vnrbfv.exec:\vnrbfv.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1956 -
\??\c:\bdpbvj.exec:\bdpbvj.exe18⤵
- Executes dropped EXE
PID:2108 -
\??\c:\pttltrf.exec:\pttltrf.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2444 -
\??\c:\rfvlf.exec:\rfvlf.exe20⤵
- Executes dropped EXE
PID:2348 -
\??\c:\bpnddrt.exec:\bpnddrt.exe21⤵
- Executes dropped EXE
PID:2556 -
\??\c:\dfldlt.exec:\dfldlt.exe22⤵
- Executes dropped EXE
PID:2512 -
\??\c:\vffpj.exec:\vffpj.exe23⤵
- Executes dropped EXE
PID:1864 -
\??\c:\ftpbd.exec:\ftpbd.exe24⤵
- Executes dropped EXE
PID:316 -
\??\c:\jrnfpn.exec:\jrnfpn.exe25⤵
- Executes dropped EXE
PID:600 -
\??\c:\lrtlnjd.exec:\lrtlnjd.exe26⤵
- Executes dropped EXE
PID:1336 -
\??\c:\njjdd.exec:\njjdd.exe27⤵
- Executes dropped EXE
PID:1656 -
\??\c:\nxxjt.exec:\nxxjt.exe28⤵
- Executes dropped EXE
PID:1312 -
\??\c:\jfbrhrt.exec:\jfbrhrt.exe29⤵
- Executes dropped EXE
PID:1276 -
\??\c:\hhljhl.exec:\hhljhl.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2184 -
\??\c:\xdxnbt.exec:\xdxnbt.exe31⤵
- Executes dropped EXE
PID:3000 -
\??\c:\brtjtdj.exec:\brtjtdj.exe32⤵
- Executes dropped EXE
PID:2528 -
\??\c:\lhnvlxt.exec:\lhnvlxt.exe33⤵
- Executes dropped EXE
PID:1808 -
\??\c:\pblxhtf.exec:\pblxhtf.exe34⤵
- Executes dropped EXE
PID:2728 -
\??\c:\fnnjt.exec:\fnnjt.exe35⤵
- Executes dropped EXE
PID:2724 -
\??\c:\djrnn.exec:\djrnn.exe36⤵
- Executes dropped EXE
PID:2896 -
\??\c:\rpnbh.exec:\rpnbh.exe37⤵
- Executes dropped EXE
PID:2196 -
\??\c:\djnpvrl.exec:\djnpvrl.exe38⤵
- Executes dropped EXE
PID:1504 -
\??\c:\rdfrjhf.exec:\rdfrjhf.exe39⤵
- Executes dropped EXE
PID:2648 -
\??\c:\phldx.exec:\phldx.exe40⤵
- Executes dropped EXE
PID:2756 -
\??\c:\bhttx.exec:\bhttx.exe41⤵
- Executes dropped EXE
PID:2416 -
\??\c:\djlbnx.exec:\djlbnx.exe42⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jflvfnf.exec:\jflvfnf.exe43⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xjffd.exec:\xjffd.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\jptxdnn.exec:\jptxdnn.exe45⤵
- Executes dropped EXE
PID:2688 -
\??\c:\tjpdjpr.exec:\tjpdjpr.exe46⤵
- Executes dropped EXE
PID:2236 -
\??\c:\rndxjdv.exec:\rndxjdv.exe47⤵
- Executes dropped EXE
PID:2500 -
\??\c:\nffjflv.exec:\nffjflv.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1776 -
\??\c:\vpdpp.exec:\vpdpp.exe49⤵
- Executes dropped EXE
PID:2000 -
\??\c:\xfrjhbv.exec:\xfrjhbv.exe50⤵
- Executes dropped EXE
PID:2972 -
\??\c:\xlxldtd.exec:\xlxldtd.exe51⤵
- Executes dropped EXE
PID:2956 -
\??\c:\bfxjlt.exec:\bfxjlt.exe52⤵
- Executes dropped EXE
PID:568 -
\??\c:\drbdfdf.exec:\drbdfdf.exe53⤵
- Executes dropped EXE
PID:1868 -
\??\c:\tvrxvj.exec:\tvrxvj.exe54⤵
- Executes dropped EXE
PID:852 -
\??\c:\fllvp.exec:\fllvp.exe55⤵
- Executes dropped EXE
PID:2152 -
\??\c:\dpxlvft.exec:\dpxlvft.exe56⤵
- Executes dropped EXE
PID:1608 -
\??\c:\ntdtb.exec:\ntdtb.exe57⤵
- Executes dropped EXE
PID:1572 -
\??\c:\xjxxxf.exec:\xjxxxf.exe58⤵
- Executes dropped EXE
PID:2108 -
\??\c:\nfnbn.exec:\nfnbn.exe59⤵
- Executes dropped EXE
PID:2160 -
\??\c:\llfnfxf.exec:\llfnfxf.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2260 -
\??\c:\xjxddll.exec:\xjxddll.exe61⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jhjpnft.exec:\jhjpnft.exe62⤵
- Executes dropped EXE
PID:2556 -
\??\c:\nbxhbtj.exec:\nbxhbtj.exe63⤵
- Executes dropped EXE
PID:1844 -
\??\c:\bppnp.exec:\bppnp.exe64⤵
- Executes dropped EXE
PID:1768 -
\??\c:\vvhjt.exec:\vvhjt.exe65⤵
- Executes dropped EXE
PID:552 -
\??\c:\rrvll.exec:\rrvll.exe66⤵PID:1056
-
\??\c:\bvddh.exec:\bvddh.exe67⤵PID:984
-
\??\c:\phhhxj.exec:\phhhxj.exe68⤵PID:1464
-
\??\c:\fthxf.exec:\fthxf.exe69⤵PID:1588
-
\??\c:\tjfrfdl.exec:\tjfrfdl.exe70⤵PID:2132
-
\??\c:\thxdpph.exec:\thxdpph.exe71⤵PID:112
-
\??\c:\drhvn.exec:\drhvn.exe72⤵PID:1276
-
\??\c:\bjpbbl.exec:\bjpbbl.exe73⤵PID:1748
-
\??\c:\fbjbvn.exec:\fbjbvn.exe74⤵PID:3052
-
\??\c:\hhvfj.exec:\hhvfj.exe75⤵PID:1724
-
\??\c:\rlxrl.exec:\rlxrl.exe76⤵PID:2248
-
\??\c:\bbfvdxp.exec:\bbfvdxp.exe77⤵PID:1288
-
\??\c:\bbftfv.exec:\bbftfv.exe78⤵PID:2828
-
\??\c:\jdjvhd.exec:\jdjvhd.exe79⤵PID:2752
-
\??\c:\bljltnd.exec:\bljltnd.exe80⤵PID:2436
-
\??\c:\hdnxxdt.exec:\hdnxxdt.exe81⤵PID:2908
-
\??\c:\pxjbfjd.exec:\pxjbfjd.exe82⤵PID:1544
-
\??\c:\xfltb.exec:\xfltb.exe83⤵PID:1504
-
\??\c:\jdpnb.exec:\jdpnb.exe84⤵PID:2648
-
\??\c:\hfffn.exec:\hfffn.exe85⤵PID:2732
-
\??\c:\rtdrlh.exec:\rtdrlh.exe86⤵PID:2416
-
\??\c:\trprvtl.exec:\trprvtl.exe87⤵PID:2624
-
\??\c:\fltbt.exec:\fltbt.exe88⤵PID:2652
-
\??\c:\thnhb.exec:\thnhb.exe89⤵PID:2600
-
\??\c:\pjjxpd.exec:\pjjxpd.exe90⤵PID:2688
-
\??\c:\bpjpv.exec:\bpjpv.exe91⤵PID:2148
-
\??\c:\htpvdp.exec:\htpvdp.exe92⤵PID:2328
-
\??\c:\vnhhbvj.exec:\vnhhbvj.exe93⤵PID:1416
-
\??\c:\hbflhvx.exec:\hbflhvx.exe94⤵PID:2508
-
\??\c:\blrhxrl.exec:\blrhxrl.exe95⤵PID:2972
-
\??\c:\jjrnvfj.exec:\jjrnvfj.exe96⤵PID:2716
-
\??\c:\ptfpl.exec:\ptfpl.exe97⤵PID:864
-
\??\c:\brttpll.exec:\brttpll.exe98⤵PID:1308
-
\??\c:\xfdrnh.exec:\xfdrnh.exe99⤵PID:572
-
\??\c:\bnbplt.exec:\bnbplt.exe100⤵PID:296
-
\??\c:\hpphhn.exec:\hpphhn.exe101⤵PID:2428
-
\??\c:\ntrjpbh.exec:\ntrjpbh.exe102⤵PID:2044
-
\??\c:\pbjvpvh.exec:\pbjvpvh.exe103⤵PID:2192
-
\??\c:\ntpxndp.exec:\ntpxndp.exe104⤵PID:2356
-
\??\c:\pfbxlv.exec:\pfbxlv.exe105⤵PID:2396
-
\??\c:\vhphxfh.exec:\vhphxfh.exe106⤵PID:2496
-
\??\c:\jjxpnb.exec:\jjxpnb.exe107⤵PID:1668
-
\??\c:\pbldb.exec:\pbldb.exe108⤵PID:2580
-
\??\c:\pbhhvth.exec:\pbhhvth.exe109⤵PID:2156
-
\??\c:\tnlbx.exec:\tnlbx.exe110⤵PID:1116
-
\??\c:\pfrhpxv.exec:\pfrhpxv.exe111⤵PID:2460
-
\??\c:\ldpfv.exec:\ldpfv.exe112⤵PID:2352
-
\??\c:\plbhl.exec:\plbhl.exe113⤵PID:1684
-
\??\c:\vfrrfp.exec:\vfrrfp.exe114⤵PID:3068
-
\??\c:\ljftd.exec:\ljftd.exe115⤵PID:2212
-
\??\c:\xtxtj.exec:\xtxtj.exe116⤵PID:1496
-
\??\c:\jlhbp.exec:\jlhbp.exe117⤵PID:2540
-
\??\c:\lfxdh.exec:\lfxdh.exe118⤵PID:1316
-
\??\c:\pjlvhvd.exec:\pjlvhvd.exe119⤵PID:324
-
\??\c:\nfvbhhl.exec:\nfvbhhl.exe120⤵PID:884
-
\??\c:\bnptvtd.exec:\bnptvtd.exe121⤵PID:1724
-
\??\c:\rvplp.exec:\rvplp.exe122⤵
- System Location Discovery: System Language Discovery
PID:2248
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-