Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 01:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9656255856587b5f72579181f5fe8ef5d050823903aa87b2808b5aa317e705a6.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
9656255856587b5f72579181f5fe8ef5d050823903aa87b2808b5aa317e705a6.exe
-
Size
456KB
-
MD5
a7578d4f7c8dfb72df0100fae741b3fc
-
SHA1
931add9de76cb6551b46da3dd7fd153b86891aa8
-
SHA256
9656255856587b5f72579181f5fe8ef5d050823903aa87b2808b5aa317e705a6
-
SHA512
81f30529ff5512b938d0b24a88ab26ffeff3c38b55830dcd48b4a2088590fa6352d354aca21dfc7cbc64e1b611a9e1dab372c4e44063309daecf8fd6ebced9a7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRw:q7Tc2NYHUrAwfMp3CDRw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2660-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-85-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2712-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1100-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-171-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2684-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-198-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2620-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-230-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/388-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-305-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2892-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-344-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/3032-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-495-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2444-520-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/884-584-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2308-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-673-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2504-747-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3008 xrvpp.exe 2448 jjbjhl.exe 2932 pddtd.exe 2720 prrpbtj.exe 2572 lbrhnx.exe 2976 dbfxlr.exe 2712 jhdhh.exe 2832 pfbbp.exe 2356 xjxpvd.exe 2396 hnvfnlt.exe 1100 fdrlnt.exe 3020 bnprbx.exe 2064 xfndl.exe 3028 jrtpdd.exe 1312 thbnfvh.exe 2328 vfxtrxh.exe 1272 pfrjhj.exe 1728 vrrnfrp.exe 2096 phpbdd.exe 2684 nlhfl.exe 1220 lbvtx.exe 2620 fxdptb.exe 2604 tdrhbhp.exe 1052 jvbpxnn.exe 388 ttlfh.exe 844 htjhpfp.exe 2476 fprhrxb.exe 1772 bfbvb.exe 956 fxdbnfx.exe 1920 djxhpll.exe 1512 lrbrvv.exe 1132 frjtj.exe 2892 jlthx.exe 1604 hjjfrjv.exe 2852 lvpxvx.exe 2984 dbntnv.exe 2316 fnfnlfr.exe 3004 dnnhpd.exe 3032 tjpxb.exe 2148 dnfnj.exe 1048 thpffp.exe 2824 jlpxrbt.exe 2596 lfdxt.exe 900 rvvnnl.exe 2084 fppdt.exe 1916 rrpjfxv.exe 1584 lrlfn.exe 1020 tvlbtp.exe 3036 btrjxhx.exe 2700 jrtjdld.exe 2968 vvfdx.exe 1296 vphhf.exe 584 bfhnt.exe 1312 xphdh.exe 1536 rbrrhfn.exe 2488 pfllnbr.exe 2272 vbfnp.exe 2072 tvxxff.exe 2096 tpvjd.exe 1968 jbxrdbj.exe 612 lfflnjn.exe 2516 fbdfj.exe 1644 rrlnd.exe 2444 nhpnxhn.exe -
resource yara_rule behavioral1/memory/2660-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/388-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-344-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/3032-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-747-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/1272-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-757-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-777-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvhrxjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bppxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxbxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prvrpvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrtxbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjxpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvlbtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvtbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjnnvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbrpvxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnxxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdrpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnhjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlbrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpdjxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfrjhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plrbddr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhxpvrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfxtrxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfrhfjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nplptlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvlfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnlllh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hddjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tblrdnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhbvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlthx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plbfjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlbjlxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjhnljb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpffxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvxrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dftftl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2660 wrote to memory of 3008 2660 9656255856587b5f72579181f5fe8ef5d050823903aa87b2808b5aa317e705a6.exe 29 PID 2660 wrote to memory of 3008 2660 9656255856587b5f72579181f5fe8ef5d050823903aa87b2808b5aa317e705a6.exe 29 PID 2660 wrote to memory of 3008 2660 9656255856587b5f72579181f5fe8ef5d050823903aa87b2808b5aa317e705a6.exe 29 PID 2660 wrote to memory of 3008 2660 9656255856587b5f72579181f5fe8ef5d050823903aa87b2808b5aa317e705a6.exe 29 PID 3008 wrote to memory of 2448 3008 xrvpp.exe 30 PID 3008 wrote to memory of 2448 3008 xrvpp.exe 30 PID 3008 wrote to memory of 2448 3008 xrvpp.exe 30 PID 3008 wrote to memory of 2448 3008 xrvpp.exe 30 PID 2448 wrote to memory of 2932 2448 jjbjhl.exe 31 PID 2448 wrote to memory of 2932 2448 jjbjhl.exe 31 PID 2448 wrote to memory of 2932 2448 jjbjhl.exe 31 PID 2448 wrote to memory of 2932 2448 jjbjhl.exe 31 PID 2932 wrote to memory of 2720 2932 pddtd.exe 32 PID 2932 wrote to memory of 2720 2932 pddtd.exe 32 PID 2932 wrote to memory of 2720 2932 pddtd.exe 32 PID 2932 wrote to memory of 2720 2932 pddtd.exe 32 PID 2720 wrote to memory of 2572 2720 prrpbtj.exe 33 PID 2720 wrote to memory of 2572 2720 prrpbtj.exe 33 PID 2720 wrote to memory of 2572 2720 prrpbtj.exe 33 PID 2720 wrote to memory of 2572 2720 prrpbtj.exe 33 PID 2572 wrote to memory of 2976 2572 lbrhnx.exe 34 PID 2572 wrote to memory of 2976 2572 lbrhnx.exe 34 PID 2572 wrote to memory of 2976 2572 lbrhnx.exe 34 PID 2572 wrote to memory of 2976 2572 lbrhnx.exe 34 PID 2976 wrote to memory of 2712 2976 dbfxlr.exe 35 PID 2976 wrote to memory of 2712 2976 dbfxlr.exe 35 PID 2976 wrote to memory of 2712 2976 dbfxlr.exe 35 PID 2976 wrote to memory of 2712 2976 dbfxlr.exe 35 PID 2712 wrote to memory of 2832 2712 jhdhh.exe 36 PID 2712 wrote to memory of 2832 2712 jhdhh.exe 36 PID 2712 wrote to memory of 2832 2712 jhdhh.exe 36 PID 2712 wrote to memory of 2832 2712 jhdhh.exe 36 PID 2832 wrote to memory of 2356 2832 pfbbp.exe 37 PID 2832 wrote to memory of 2356 2832 pfbbp.exe 37 PID 2832 wrote to memory of 2356 2832 pfbbp.exe 37 PID 2832 wrote to memory of 2356 2832 pfbbp.exe 37 PID 2356 wrote to memory of 2396 2356 xjxpvd.exe 38 PID 2356 wrote to memory of 2396 2356 xjxpvd.exe 38 PID 2356 wrote to memory of 2396 2356 xjxpvd.exe 38 PID 2356 wrote to memory of 2396 2356 xjxpvd.exe 38 PID 2396 wrote to memory of 1100 2396 hnvfnlt.exe 39 PID 2396 wrote to memory of 1100 2396 hnvfnlt.exe 39 PID 2396 wrote to memory of 1100 2396 hnvfnlt.exe 39 PID 2396 wrote to memory of 1100 2396 hnvfnlt.exe 39 PID 1100 wrote to memory of 3020 1100 fdrlnt.exe 40 PID 1100 wrote to memory of 3020 1100 fdrlnt.exe 40 PID 1100 wrote to memory of 3020 1100 fdrlnt.exe 40 PID 1100 wrote to memory of 3020 1100 fdrlnt.exe 40 PID 3020 wrote to memory of 2064 3020 bnprbx.exe 41 PID 3020 wrote to memory of 2064 3020 bnprbx.exe 41 PID 3020 wrote to memory of 2064 3020 bnprbx.exe 41 PID 3020 wrote to memory of 2064 3020 bnprbx.exe 41 PID 2064 wrote to memory of 3028 2064 xfndl.exe 42 PID 2064 wrote to memory of 3028 2064 xfndl.exe 42 PID 2064 wrote to memory of 3028 2064 xfndl.exe 42 PID 2064 wrote to memory of 3028 2064 xfndl.exe 42 PID 3028 wrote to memory of 1312 3028 jrtpdd.exe 43 PID 3028 wrote to memory of 1312 3028 jrtpdd.exe 43 PID 3028 wrote to memory of 1312 3028 jrtpdd.exe 43 PID 3028 wrote to memory of 1312 3028 jrtpdd.exe 43 PID 1312 wrote to memory of 2328 1312 thbnfvh.exe 44 PID 1312 wrote to memory of 2328 1312 thbnfvh.exe 44 PID 1312 wrote to memory of 2328 1312 thbnfvh.exe 44 PID 1312 wrote to memory of 2328 1312 thbnfvh.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\9656255856587b5f72579181f5fe8ef5d050823903aa87b2808b5aa317e705a6.exe"C:\Users\Admin\AppData\Local\Temp\9656255856587b5f72579181f5fe8ef5d050823903aa87b2808b5aa317e705a6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\xrvpp.exec:\xrvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\jjbjhl.exec:\jjbjhl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\pddtd.exec:\pddtd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\prrpbtj.exec:\prrpbtj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\lbrhnx.exec:\lbrhnx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\dbfxlr.exec:\dbfxlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\jhdhh.exec:\jhdhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\pfbbp.exec:\pfbbp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\xjxpvd.exec:\xjxpvd.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\hnvfnlt.exec:\hnvfnlt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\fdrlnt.exec:\fdrlnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\bnprbx.exec:\bnprbx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\xfndl.exec:\xfndl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\jrtpdd.exec:\jrtpdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\thbnfvh.exec:\thbnfvh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\vfxtrxh.exec:\vfxtrxh.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2328 -
\??\c:\pfrjhj.exec:\pfrjhj.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1272 -
\??\c:\vrrnfrp.exec:\vrrnfrp.exe19⤵
- Executes dropped EXE
PID:1728 -
\??\c:\phpbdd.exec:\phpbdd.exe20⤵
- Executes dropped EXE
PID:2096 -
\??\c:\nlhfl.exec:\nlhfl.exe21⤵
- Executes dropped EXE
PID:2684 -
\??\c:\lbvtx.exec:\lbvtx.exe22⤵
- Executes dropped EXE
PID:1220 -
\??\c:\fxdptb.exec:\fxdptb.exe23⤵
- Executes dropped EXE
PID:2620 -
\??\c:\tdrhbhp.exec:\tdrhbhp.exe24⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jvbpxnn.exec:\jvbpxnn.exe25⤵
- Executes dropped EXE
PID:1052 -
\??\c:\ttlfh.exec:\ttlfh.exe26⤵
- Executes dropped EXE
PID:388 -
\??\c:\htjhpfp.exec:\htjhpfp.exe27⤵
- Executes dropped EXE
PID:844 -
\??\c:\fprhrxb.exec:\fprhrxb.exe28⤵
- Executes dropped EXE
PID:2476 -
\??\c:\bfbvb.exec:\bfbvb.exe29⤵
- Executes dropped EXE
PID:1772 -
\??\c:\fxdbnfx.exec:\fxdbnfx.exe30⤵
- Executes dropped EXE
PID:956 -
\??\c:\djxhpll.exec:\djxhpll.exe31⤵
- Executes dropped EXE
PID:1920 -
\??\c:\lrbrvv.exec:\lrbrvv.exe32⤵
- Executes dropped EXE
PID:1512 -
\??\c:\frjtj.exec:\frjtj.exe33⤵
- Executes dropped EXE
PID:1132 -
\??\c:\jlthx.exec:\jlthx.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2892 -
\??\c:\hjjfrjv.exec:\hjjfrjv.exe35⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lvpxvx.exec:\lvpxvx.exe36⤵
- Executes dropped EXE
PID:2852 -
\??\c:\dbntnv.exec:\dbntnv.exe37⤵
- Executes dropped EXE
PID:2984 -
\??\c:\fnfnlfr.exec:\fnfnlfr.exe38⤵
- Executes dropped EXE
PID:2316 -
\??\c:\dnnhpd.exec:\dnnhpd.exe39⤵
- Executes dropped EXE
PID:3004 -
\??\c:\tjpxb.exec:\tjpxb.exe40⤵
- Executes dropped EXE
PID:3032 -
\??\c:\dnfnj.exec:\dnfnj.exe41⤵
- Executes dropped EXE
PID:2148 -
\??\c:\thpffp.exec:\thpffp.exe42⤵
- Executes dropped EXE
PID:1048 -
\??\c:\jlpxrbt.exec:\jlpxrbt.exe43⤵
- Executes dropped EXE
PID:2824 -
\??\c:\lfdxt.exec:\lfdxt.exe44⤵
- Executes dropped EXE
PID:2596 -
\??\c:\rvvnnl.exec:\rvvnnl.exe45⤵
- Executes dropped EXE
PID:900 -
\??\c:\fppdt.exec:\fppdt.exe46⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rrpjfxv.exec:\rrpjfxv.exe47⤵
- Executes dropped EXE
PID:1916 -
\??\c:\lrlfn.exec:\lrlfn.exe48⤵
- Executes dropped EXE
PID:1584 -
\??\c:\tvlbtp.exec:\tvlbtp.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1020 -
\??\c:\btrjxhx.exec:\btrjxhx.exe50⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jrtjdld.exec:\jrtjdld.exe51⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vvfdx.exec:\vvfdx.exe52⤵
- Executes dropped EXE
PID:2968 -
\??\c:\vphhf.exec:\vphhf.exe53⤵
- Executes dropped EXE
PID:1296 -
\??\c:\bfhnt.exec:\bfhnt.exe54⤵
- Executes dropped EXE
PID:584 -
\??\c:\xphdh.exec:\xphdh.exe55⤵
- Executes dropped EXE
PID:1312 -
\??\c:\rbrrhfn.exec:\rbrrhfn.exe56⤵
- Executes dropped EXE
PID:1536 -
\??\c:\pfllnbr.exec:\pfllnbr.exe57⤵
- Executes dropped EXE
PID:2488 -
\??\c:\vbfnp.exec:\vbfnp.exe58⤵
- Executes dropped EXE
PID:2272 -
\??\c:\tvxxff.exec:\tvxxff.exe59⤵
- Executes dropped EXE
PID:2072 -
\??\c:\tpvjd.exec:\tpvjd.exe60⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jbxrdbj.exec:\jbxrdbj.exe61⤵
- Executes dropped EXE
PID:1968 -
\??\c:\lfflnjn.exec:\lfflnjn.exe62⤵
- Executes dropped EXE
PID:612 -
\??\c:\fbdfj.exec:\fbdfj.exe63⤵
- Executes dropped EXE
PID:2516 -
\??\c:\rrlnd.exec:\rrlnd.exe64⤵
- Executes dropped EXE
PID:1644 -
\??\c:\nhpnxhn.exec:\nhpnxhn.exe65⤵
- Executes dropped EXE
PID:2444 -
\??\c:\pxxrxxh.exec:\pxxrxxh.exe66⤵PID:1816
-
\??\c:\xplpd.exec:\xplpd.exe67⤵PID:2164
-
\??\c:\jrvtr.exec:\jrvtr.exe68⤵PID:2524
-
\??\c:\rrlrp.exec:\rrlrp.exe69⤵PID:2008
-
\??\c:\dlnrvrj.exec:\dlnrvrj.exe70⤵PID:920
-
\??\c:\nbjfhnf.exec:\nbjfhnf.exe71⤵PID:1780
-
\??\c:\hlpllhx.exec:\hlpllhx.exe72⤵PID:1016
-
\??\c:\njjvrhx.exec:\njjvrhx.exe73⤵PID:2292
-
\??\c:\fdddpnp.exec:\fdddpnp.exe74⤵PID:884
-
\??\c:\jfpxr.exec:\jfpxr.exe75⤵PID:332
-
\??\c:\fhxvfjj.exec:\fhxvfjj.exe76⤵PID:2308
-
\??\c:\vrtdb.exec:\vrtdb.exe77⤵PID:1708
-
\??\c:\rbtrb.exec:\rbtrb.exe78⤵PID:2816
-
\??\c:\lxffr.exec:\lxffr.exe79⤵PID:2856
-
\??\c:\vjvhn.exec:\vjvhn.exe80⤵PID:2844
-
\??\c:\fvlpx.exec:\fvlpx.exe81⤵PID:2992
-
\??\c:\nfnjh.exec:\nfnjh.exe82⤵PID:3000
-
\??\c:\hpnrdf.exec:\hpnrdf.exe83⤵PID:1720
-
\??\c:\thvvvj.exec:\thvvvj.exe84⤵PID:2708
-
\??\c:\hvpjdvr.exec:\hvpjdvr.exe85⤵PID:2996
-
\??\c:\rxjndb.exec:\rxjndb.exe86⤵PID:2712
-
\??\c:\nffxp.exec:\nffxp.exe87⤵PID:2696
-
\??\c:\rvbndjj.exec:\rvbndjj.exe88⤵PID:2692
-
\??\c:\lnhjv.exec:\lnhjv.exe89⤵
- System Location Discovery: System Language Discovery
PID:2112 -
\??\c:\bfdxrrp.exec:\bfdxrrp.exe90⤵PID:1916
-
\??\c:\npnxp.exec:\npnxp.exe91⤵PID:1584
-
\??\c:\nxfnbt.exec:\nxfnbt.exe92⤵PID:1020
-
\??\c:\ttlrhvd.exec:\ttlrhvd.exe93⤵PID:3036
-
\??\c:\vxflxxv.exec:\vxflxxv.exe94⤵PID:1260
-
\??\c:\tvfjjh.exec:\tvfjjh.exe95⤵PID:2540
-
\??\c:\btvrpr.exec:\btvrpr.exe96⤵PID:2568
-
\??\c:\rhdfbvt.exec:\rhdfbvt.exe97⤵PID:2348
-
\??\c:\jpbrh.exec:\jpbrh.exe98⤵PID:1768
-
\??\c:\hvlhbv.exec:\hvlhbv.exe99⤵PID:2504
-
\??\c:\fxnvtt.exec:\fxnvtt.exe100⤵PID:1272
-
\??\c:\xbjlf.exec:\xbjlf.exe101⤵PID:2272
-
\??\c:\djjfj.exec:\djjfj.exe102⤵PID:976
-
\??\c:\xhdxr.exec:\xhdxr.exe103⤵PID:1124
-
\??\c:\npdddbd.exec:\npdddbd.exe104⤵PID:1848
-
\??\c:\fjfvj.exec:\fjfvj.exe105⤵PID:1408
-
\??\c:\jhrbv.exec:\jhrbv.exe106⤵PID:972
-
\??\c:\pplrbrd.exec:\pplrbrd.exe107⤵PID:1712
-
\??\c:\xjthhlx.exec:\xjthhlx.exe108⤵PID:1488
-
\??\c:\nnpvxn.exec:\nnpvxn.exe109⤵PID:1668
-
\??\c:\tdfrd.exec:\tdfrd.exe110⤵PID:2436
-
\??\c:\tfddb.exec:\tfddb.exe111⤵PID:948
-
\??\c:\trpdd.exec:\trpdd.exe112⤵PID:1372
-
\??\c:\bvxtrhh.exec:\bvxtrhh.exe113⤵PID:1772
-
\??\c:\njllpp.exec:\njllpp.exe114⤵PID:524
-
\??\c:\pjdhh.exec:\pjdhh.exe115⤵PID:1304
-
\??\c:\ntlhnph.exec:\ntlhnph.exe116⤵PID:2280
-
\??\c:\tprnl.exec:\tprnl.exe117⤵PID:2256
-
\??\c:\txlft.exec:\txlft.exe118⤵PID:1752
-
\??\c:\pxdll.exec:\pxdll.exe119⤵PID:1512
-
\??\c:\nftrp.exec:\nftrp.exe120⤵PID:2892
-
\??\c:\dbvlfx.exec:\dbvlfx.exe121⤵PID:3012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-