Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 20:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe
-
Size
456KB
-
MD5
671231fc6158870f2a2d6cd41136fe6e
-
SHA1
3150012d1855c4e9ce9d3340f44688a5218b49df
-
SHA256
2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25
-
SHA512
c7fde17396ad8b73a79adf7d576b4e11490642b2060955db211547eaf08d785a43c1b6c96bc397bbd506340c1f8d4665c17a635763c577837ffb90d04c54b81d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRV:q7Tc2NYHUrAwfMp3CDRV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/1656-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-25-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2900-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1144-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-196-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2460-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/340-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1064-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-305-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1588-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-420-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2072-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-469-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2184-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-818-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1856 vdhfjf.exe 2756 hnrxfrf.exe 2900 fjftl.exe 2768 rpnxd.exe 1660 ldvjd.exe 2688 xjtrjr.exe 1144 pdxpb.exe 2708 fhxbjh.exe 2732 xvnndj.exe 2428 rtpbd.exe 2588 lnnddfd.exe 2872 hjfjtvl.exe 2972 htfjh.exe 2984 tvjljn.exe 2964 tvvjrjr.exe 2424 ttpvlfp.exe 2056 fxtlplt.exe 316 vjfjbv.exe 2112 tdfbfjh.exe 2364 jpflv.exe 2372 fjrlrr.exe 1532 bbhjnxf.exe 2460 njxvd.exe 928 nbhbh.exe 340 pjvxxlr.exe 1864 lrlbn.exe 1400 pnnvtbb.exe 1064 brffpb.exe 2004 fpjxhp.exe 2320 ftfdfvh.exe 1816 vvpld.exe 1588 hpvntb.exe 1692 jrjfnfj.exe 1608 nrntpvj.exe 2228 fpdbh.exe 2892 tljpn.exe 2912 bjhxd.exe 2120 dbbdpd.exe 2816 pbtfndt.exe 2876 hnpvdj.exe 2116 dnbpr.exe 2832 ntfrh.exe 1576 vvllh.exe 2740 trrhl.exe 1708 rplrtfv.exe 2732 rbxxbbn.exe 2440 llrhl.exe 1732 xhnhpfp.exe 2420 lxhndvr.exe 2752 bbjxdj.exe 2072 bndnr.exe 3040 pxdxpr.exe 2992 vlvpxjn.exe 2352 jhrjh.exe 2084 jxdtpjh.exe 1820 fdbbp.exe 2236 hdlpb.exe 2184 bhfpv.exe 1872 rfjxp.exe 2364 prdxt.exe 2372 fddplh.exe 2164 jjlxhr.exe 2552 ljlph.exe 1520 lvdxnlf.exe -
resource yara_rule behavioral1/memory/1656-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/340-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-420-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2072-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-818-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-883-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-890-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-915-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-953-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-960-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-1004-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbpnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxdvfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbxrvpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pffxrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnvvlfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpthr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfdhlbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlfjjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfxnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxljhvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfvnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfjxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlhhhrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brvxbrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjxfvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfnptf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htpdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txfnbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tldld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdfftjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfpjlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blhdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxjjdth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frbdbdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdlnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnjlxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjhvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpplvxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdjht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtfbdhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxxhdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrrbtpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftdlvn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1656 wrote to memory of 1856 1656 2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe 29 PID 1656 wrote to memory of 1856 1656 2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe 29 PID 1656 wrote to memory of 1856 1656 2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe 29 PID 1656 wrote to memory of 1856 1656 2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe 29 PID 1856 wrote to memory of 2756 1856 vdhfjf.exe 30 PID 1856 wrote to memory of 2756 1856 vdhfjf.exe 30 PID 1856 wrote to memory of 2756 1856 vdhfjf.exe 30 PID 1856 wrote to memory of 2756 1856 vdhfjf.exe 30 PID 2756 wrote to memory of 2900 2756 hnrxfrf.exe 31 PID 2756 wrote to memory of 2900 2756 hnrxfrf.exe 31 PID 2756 wrote to memory of 2900 2756 hnrxfrf.exe 31 PID 2756 wrote to memory of 2900 2756 hnrxfrf.exe 31 PID 2900 wrote to memory of 2768 2900 fjftl.exe 32 PID 2900 wrote to memory of 2768 2900 fjftl.exe 32 PID 2900 wrote to memory of 2768 2900 fjftl.exe 32 PID 2900 wrote to memory of 2768 2900 fjftl.exe 32 PID 2768 wrote to memory of 1660 2768 rpnxd.exe 33 PID 2768 wrote to memory of 1660 2768 rpnxd.exe 33 PID 2768 wrote to memory of 1660 2768 rpnxd.exe 33 PID 2768 wrote to memory of 1660 2768 rpnxd.exe 33 PID 1660 wrote to memory of 2688 1660 ldvjd.exe 34 PID 1660 wrote to memory of 2688 1660 ldvjd.exe 34 PID 1660 wrote to memory of 2688 1660 ldvjd.exe 34 PID 1660 wrote to memory of 2688 1660 ldvjd.exe 34 PID 2688 wrote to memory of 1144 2688 xjtrjr.exe 35 PID 2688 wrote to memory of 1144 2688 xjtrjr.exe 35 PID 2688 wrote to memory of 1144 2688 xjtrjr.exe 35 PID 2688 wrote to memory of 1144 2688 xjtrjr.exe 35 PID 1144 wrote to memory of 2708 1144 pdxpb.exe 36 PID 1144 wrote to memory of 2708 1144 pdxpb.exe 36 PID 1144 wrote to memory of 2708 1144 pdxpb.exe 36 PID 1144 wrote to memory of 2708 1144 pdxpb.exe 36 PID 2708 wrote to memory of 2732 2708 fhxbjh.exe 37 PID 2708 wrote to memory of 2732 2708 fhxbjh.exe 37 PID 2708 wrote to memory of 2732 2708 fhxbjh.exe 37 PID 2708 wrote to memory of 2732 2708 fhxbjh.exe 37 PID 2732 wrote to memory of 2428 2732 xvnndj.exe 38 PID 2732 wrote to memory of 2428 2732 xvnndj.exe 38 PID 2732 wrote to memory of 2428 2732 xvnndj.exe 38 PID 2732 wrote to memory of 2428 2732 xvnndj.exe 38 PID 2428 wrote to memory of 2588 2428 rtpbd.exe 39 PID 2428 wrote to memory of 2588 2428 rtpbd.exe 39 PID 2428 wrote to memory of 2588 2428 rtpbd.exe 39 PID 2428 wrote to memory of 2588 2428 rtpbd.exe 39 PID 2588 wrote to memory of 2872 2588 lnnddfd.exe 40 PID 2588 wrote to memory of 2872 2588 lnnddfd.exe 40 PID 2588 wrote to memory of 2872 2588 lnnddfd.exe 40 PID 2588 wrote to memory of 2872 2588 lnnddfd.exe 40 PID 2872 wrote to memory of 2972 2872 hjfjtvl.exe 41 PID 2872 wrote to memory of 2972 2872 hjfjtvl.exe 41 PID 2872 wrote to memory of 2972 2872 hjfjtvl.exe 41 PID 2872 wrote to memory of 2972 2872 hjfjtvl.exe 41 PID 2972 wrote to memory of 2984 2972 htfjh.exe 42 PID 2972 wrote to memory of 2984 2972 htfjh.exe 42 PID 2972 wrote to memory of 2984 2972 htfjh.exe 42 PID 2972 wrote to memory of 2984 2972 htfjh.exe 42 PID 2984 wrote to memory of 2964 2984 tvjljn.exe 43 PID 2984 wrote to memory of 2964 2984 tvjljn.exe 43 PID 2984 wrote to memory of 2964 2984 tvjljn.exe 43 PID 2984 wrote to memory of 2964 2984 tvjljn.exe 43 PID 2964 wrote to memory of 2424 2964 tvvjrjr.exe 44 PID 2964 wrote to memory of 2424 2964 tvvjrjr.exe 44 PID 2964 wrote to memory of 2424 2964 tvvjrjr.exe 44 PID 2964 wrote to memory of 2424 2964 tvvjrjr.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe"C:\Users\Admin\AppData\Local\Temp\2004f7c71878aa601b35c543d3134e37839b536fb305162b2ebcf1c602c9dc25.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\vdhfjf.exec:\vdhfjf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\hnrxfrf.exec:\hnrxfrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\fjftl.exec:\fjftl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\rpnxd.exec:\rpnxd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\ldvjd.exec:\ldvjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\xjtrjr.exec:\xjtrjr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\pdxpb.exec:\pdxpb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\fhxbjh.exec:\fhxbjh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\xvnndj.exec:\xvnndj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\rtpbd.exec:\rtpbd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\lnnddfd.exec:\lnnddfd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\hjfjtvl.exec:\hjfjtvl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\htfjh.exec:\htfjh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\tvjljn.exec:\tvjljn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\tvvjrjr.exec:\tvvjrjr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\ttpvlfp.exec:\ttpvlfp.exe17⤵
- Executes dropped EXE
PID:2424 -
\??\c:\fxtlplt.exec:\fxtlplt.exe18⤵
- Executes dropped EXE
PID:2056 -
\??\c:\vjfjbv.exec:\vjfjbv.exe19⤵
- Executes dropped EXE
PID:316 -
\??\c:\tdfbfjh.exec:\tdfbfjh.exe20⤵
- Executes dropped EXE
PID:2112 -
\??\c:\jpflv.exec:\jpflv.exe21⤵
- Executes dropped EXE
PID:2364 -
\??\c:\fjrlrr.exec:\fjrlrr.exe22⤵
- Executes dropped EXE
PID:2372 -
\??\c:\bbhjnxf.exec:\bbhjnxf.exe23⤵
- Executes dropped EXE
PID:1532 -
\??\c:\njxvd.exec:\njxvd.exe24⤵
- Executes dropped EXE
PID:2460 -
\??\c:\nbhbh.exec:\nbhbh.exe25⤵
- Executes dropped EXE
PID:928 -
\??\c:\pjvxxlr.exec:\pjvxxlr.exe26⤵
- Executes dropped EXE
PID:340 -
\??\c:\lrlbn.exec:\lrlbn.exe27⤵
- Executes dropped EXE
PID:1864 -
\??\c:\pnnvtbb.exec:\pnnvtbb.exe28⤵
- Executes dropped EXE
PID:1400 -
\??\c:\brffpb.exec:\brffpb.exe29⤵
- Executes dropped EXE
PID:1064 -
\??\c:\fpjxhp.exec:\fpjxhp.exe30⤵
- Executes dropped EXE
PID:2004 -
\??\c:\ftfdfvh.exec:\ftfdfvh.exe31⤵
- Executes dropped EXE
PID:2320 -
\??\c:\vvpld.exec:\vvpld.exe32⤵
- Executes dropped EXE
PID:1816 -
\??\c:\hpvntb.exec:\hpvntb.exe33⤵
- Executes dropped EXE
PID:1588 -
\??\c:\jrjfnfj.exec:\jrjfnfj.exe34⤵
- Executes dropped EXE
PID:1692 -
\??\c:\nrntpvj.exec:\nrntpvj.exe35⤵
- Executes dropped EXE
PID:1608 -
\??\c:\fpdbh.exec:\fpdbh.exe36⤵
- Executes dropped EXE
PID:2228 -
\??\c:\tljpn.exec:\tljpn.exe37⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bjhxd.exec:\bjhxd.exe38⤵
- Executes dropped EXE
PID:2912 -
\??\c:\dbbdpd.exec:\dbbdpd.exe39⤵
- Executes dropped EXE
PID:2120 -
\??\c:\pbtfndt.exec:\pbtfndt.exe40⤵
- Executes dropped EXE
PID:2816 -
\??\c:\hnpvdj.exec:\hnpvdj.exe41⤵
- Executes dropped EXE
PID:2876 -
\??\c:\dnbpr.exec:\dnbpr.exe42⤵
- Executes dropped EXE
PID:2116 -
\??\c:\ntfrh.exec:\ntfrh.exe43⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vvllh.exec:\vvllh.exe44⤵
- Executes dropped EXE
PID:1576 -
\??\c:\trrhl.exec:\trrhl.exe45⤵
- Executes dropped EXE
PID:2740 -
\??\c:\rplrtfv.exec:\rplrtfv.exe46⤵
- Executes dropped EXE
PID:1708 -
\??\c:\rbxxbbn.exec:\rbxxbbn.exe47⤵
- Executes dropped EXE
PID:2732 -
\??\c:\llrhl.exec:\llrhl.exe48⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xhnhpfp.exec:\xhnhpfp.exe49⤵
- Executes dropped EXE
PID:1732 -
\??\c:\lxhndvr.exec:\lxhndvr.exe50⤵
- Executes dropped EXE
PID:2420 -
\??\c:\bbjxdj.exec:\bbjxdj.exe51⤵
- Executes dropped EXE
PID:2752 -
\??\c:\bndnr.exec:\bndnr.exe52⤵
- Executes dropped EXE
PID:2072 -
\??\c:\pxdxpr.exec:\pxdxpr.exe53⤵
- Executes dropped EXE
PID:3040 -
\??\c:\vlvpxjn.exec:\vlvpxjn.exe54⤵
- Executes dropped EXE
PID:2992 -
\??\c:\jhrjh.exec:\jhrjh.exe55⤵
- Executes dropped EXE
PID:2352 -
\??\c:\jxdtpjh.exec:\jxdtpjh.exe56⤵
- Executes dropped EXE
PID:2084 -
\??\c:\fdbbp.exec:\fdbbp.exe57⤵
- Executes dropped EXE
PID:1820 -
\??\c:\hdlpb.exec:\hdlpb.exe58⤵
- Executes dropped EXE
PID:2236 -
\??\c:\bhfpv.exec:\bhfpv.exe59⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rfjxp.exec:\rfjxp.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1872 -
\??\c:\prdxt.exec:\prdxt.exe61⤵
- Executes dropped EXE
PID:2364 -
\??\c:\fddplh.exec:\fddplh.exe62⤵
- Executes dropped EXE
PID:2372 -
\??\c:\jjlxhr.exec:\jjlxhr.exe63⤵
- Executes dropped EXE
PID:2164 -
\??\c:\ljlph.exec:\ljlph.exe64⤵
- Executes dropped EXE
PID:2552 -
\??\c:\lvdxnlf.exec:\lvdxnlf.exe65⤵
- Executes dropped EXE
PID:1520 -
\??\c:\jlpjbj.exec:\jlpjbj.exe66⤵PID:2496
-
\??\c:\flbrbj.exec:\flbrbj.exe67⤵PID:1020
-
\??\c:\hpppllx.exec:\hpppllx.exe68⤵PID:1784
-
\??\c:\xdpjjrl.exec:\xdpjjrl.exe69⤵PID:1688
-
\??\c:\rrbbf.exec:\rrbbf.exe70⤵PID:860
-
\??\c:\dpjddpx.exec:\dpjddpx.exe71⤵PID:1740
-
\??\c:\hbpnp.exec:\hbpnp.exe72⤵
- System Location Discovery: System Language Discovery
PID:1564 -
\??\c:\xtlhrhb.exec:\xtlhrhb.exe73⤵PID:940
-
\??\c:\fjlhb.exec:\fjlhb.exe74⤵PID:2480
-
\??\c:\hxxhdv.exec:\hxxhdv.exe75⤵
- System Location Discovery: System Language Discovery
PID:1080 -
\??\c:\ldnfh.exec:\ldnfh.exe76⤵PID:2576
-
\??\c:\rffljjd.exec:\rffljjd.exe77⤵PID:1588
-
\??\c:\bptjl.exec:\bptjl.exe78⤵PID:1720
-
\??\c:\hrrjxj.exec:\hrrjxj.exe79⤵PID:1508
-
\??\c:\dlptr.exec:\dlptr.exe80⤵PID:2380
-
\??\c:\jdrrjl.exec:\jdrrjl.exe81⤵PID:2936
-
\??\c:\tvxhjvf.exec:\tvxhjvf.exe82⤵PID:2464
-
\??\c:\rnblxrd.exec:\rnblxrd.exe83⤵PID:2060
-
\??\c:\hllpjb.exec:\hllpjb.exe84⤵PID:2844
-
\??\c:\bdfxd.exec:\bdfxd.exe85⤵PID:2692
-
\??\c:\xjdhphx.exec:\xjdhphx.exe86⤵PID:796
-
\??\c:\hjtttbd.exec:\hjtttbd.exe87⤵PID:2688
-
\??\c:\tfpxjtd.exec:\tfpxjtd.exe88⤵PID:2712
-
\??\c:\rbtdn.exec:\rbtdn.exe89⤵PID:2856
-
\??\c:\nrrprbp.exec:\nrrprbp.exe90⤵PID:2740
-
\??\c:\vnrtjvh.exec:\vnrtjvh.exe91⤵PID:1432
-
\??\c:\nlpfh.exec:\nlpfh.exe92⤵PID:1196
-
\??\c:\jdfdvhj.exec:\jdfdvhj.exe93⤵PID:1164
-
\??\c:\fxpvnr.exec:\fxpvnr.exe94⤵PID:2244
-
\??\c:\nplhrdp.exec:\nplhrdp.exe95⤵PID:2872
-
\??\c:\nnbrr.exec:\nnbrr.exe96⤵PID:2512
-
\??\c:\dbvhlx.exec:\dbvhlx.exe97⤵PID:540
-
\??\c:\dnnbj.exec:\dnnbj.exe98⤵PID:3012
-
\??\c:\jhfnpl.exec:\jhfnpl.exe99⤵PID:1964
-
\??\c:\vnhrdpb.exec:\vnhrdpb.exe100⤵PID:936
-
\??\c:\lxndrv.exec:\lxndrv.exe101⤵PID:2444
-
\??\c:\tvdfl.exec:\tvdfl.exe102⤵PID:1060
-
\??\c:\lrrlprv.exec:\lrrlprv.exe103⤵PID:2128
-
\??\c:\fjfnlpp.exec:\fjfnlpp.exe104⤵PID:2112
-
\??\c:\pplppxh.exec:\pplppxh.exe105⤵PID:2088
-
\??\c:\nbjvn.exec:\nbjvn.exe106⤵PID:2412
-
\??\c:\pnpjx.exec:\pnpjx.exe107⤵PID:1308
-
\??\c:\rnrfv.exec:\rnrfv.exe108⤵PID:1084
-
\??\c:\bvnjr.exec:\bvnjr.exe109⤵PID:948
-
\??\c:\nlfhbpp.exec:\nlfhbpp.exe110⤵PID:2216
-
\??\c:\tdxxlbn.exec:\tdxxlbn.exe111⤵PID:1804
-
\??\c:\lvvjj.exec:\lvvjj.exe112⤵PID:1380
-
\??\c:\rthxd.exec:\rthxd.exe113⤵PID:328
-
\??\c:\jfpbtx.exec:\jfpbtx.exe114⤵PID:2564
-
\??\c:\tnbrdf.exec:\tnbrdf.exe115⤵PID:1688
-
\??\c:\njldpp.exec:\njldpp.exe116⤵PID:960
-
\??\c:\jhvnv.exec:\jhvnv.exe117⤵PID:1728
-
\??\c:\pvpnpj.exec:\pvpnpj.exe118⤵PID:1564
-
\??\c:\fbnfvld.exec:\fbnfvld.exe119⤵PID:108
-
\??\c:\lvnvnv.exec:\lvnvnv.exe120⤵PID:2480
-
\??\c:\bdxbppb.exec:\bdxbppb.exe121⤵PID:868
-
\??\c:\nnvdf.exec:\nnvdf.exe122⤵PID:1592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-