Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 01:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9b967274ca4cb7284decde8fad2c074ae65c5ec25331f6941194ff8b9b8a9ca9.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
9b967274ca4cb7284decde8fad2c074ae65c5ec25331f6941194ff8b9b8a9ca9.exe
-
Size
454KB
-
MD5
c15fcd440d061fc6fec6fc05d291b1bd
-
SHA1
63059d94c0aac27ca1b772e990feac14df86c717
-
SHA256
9b967274ca4cb7284decde8fad2c074ae65c5ec25331f6941194ff8b9b8a9ca9
-
SHA512
258de746f0c3b94ca873aa7ae80c7ac9a816eb3210231286d0a277301e884f7f41aa1eb67e6d27f1a5c2c6c8ee78e949875ca14e578174fc5cf53bf0a89b8c74
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbem:q7Tc2NYHUrAwfMp3CDm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2268-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-75-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1680-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-141-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2088-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-272-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/768-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-309-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2004-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/436-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-503-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1604-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-586-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/804-663-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1320-734-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/472-749-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-756-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2704-784-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-856-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2268 npdhtfx.exe 2912 drfpv.exe 3024 jvtndh.exe 2596 bjddxrt.exe 3064 vhnrdr.exe 2164 fbprt.exe 2784 fdrbd.exe 2120 rnvfp.exe 1680 pvpvp.exe 2548 txphlf.exe 1904 xjhddh.exe 2412 nlvfrtd.exe 2344 hrffdv.exe 2640 xrnffb.exe 3008 dpfbx.exe 2088 rjvrtb.exe 808 fnhxjd.exe 2112 bbxhpfn.exe 2372 hlvjnx.exe 2084 vnbxhhr.exe 1712 jbxprt.exe 1972 lvjxdrd.exe 584 fphdv.exe 1960 bbnvhtf.exe 1576 pvnplh.exe 1268 lrbbfd.exe 1476 vxbvh.exe 2720 lthfj.exe 1704 fpnvjpt.exe 768 xrftvrx.exe 692 tnrbnb.exe 2216 fjtnxf.exe 2004 fhnhpj.exe 1632 rptnd.exe 3028 hhvbttd.exe 2912 lrhjd.exe 2224 fntddp.exe 1996 rrtxhp.exe 2136 rrbbn.exe 2804 nfjnvrn.exe 2228 nvnjvld.exe 2800 lrxjbx.exe 2364 ttdfp.exe 2092 jbblvf.exe 2376 dnnfdvj.exe 1516 vfppr.exe 1548 nxldxfl.exe 892 jtdxlr.exe 1904 dhnlplv.exe 2416 lvtnnd.exe 2044 jvrxbbb.exe 1740 tnrdvnj.exe 1240 jfnjjfv.exe 3008 tbxfx.exe 436 tjjbx.exe 2304 rvjjdr.exe 2496 pthnfnl.exe 2108 lbhhljd.exe 2388 tvdvjbr.exe 1840 fptfvv.exe 676 blhft.exe 900 fbrnh.exe 2072 btrjlnp.exe 1604 pnbbb.exe -
resource yara_rule behavioral1/memory/2268-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-391-0x00000000002C0000-0x00000000002EA000-memory.dmp upx behavioral1/memory/1516-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/436-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-503-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1604-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-586-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2844-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/472-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/472-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-784-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-810-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-823-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-856-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-865-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrlfvxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxvvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxtfdvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drvff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lttdrbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpdvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbxbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhtdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxdhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntjbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjxfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brtprtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlvht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhblrjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nldjddl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpttl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlpbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnrbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lphpbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btxljf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blhft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpjjvff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrlnnvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpfjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbhlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhxdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnfjxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvbfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdxjv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2132 wrote to memory of 2268 2132 9b967274ca4cb7284decde8fad2c074ae65c5ec25331f6941194ff8b9b8a9ca9.exe 30 PID 2132 wrote to memory of 2268 2132 9b967274ca4cb7284decde8fad2c074ae65c5ec25331f6941194ff8b9b8a9ca9.exe 30 PID 2132 wrote to memory of 2268 2132 9b967274ca4cb7284decde8fad2c074ae65c5ec25331f6941194ff8b9b8a9ca9.exe 30 PID 2132 wrote to memory of 2268 2132 9b967274ca4cb7284decde8fad2c074ae65c5ec25331f6941194ff8b9b8a9ca9.exe 30 PID 2268 wrote to memory of 2912 2268 npdhtfx.exe 31 PID 2268 wrote to memory of 2912 2268 npdhtfx.exe 31 PID 2268 wrote to memory of 2912 2268 npdhtfx.exe 31 PID 2268 wrote to memory of 2912 2268 npdhtfx.exe 31 PID 2912 wrote to memory of 3024 2912 drfpv.exe 32 PID 2912 wrote to memory of 3024 2912 drfpv.exe 32 PID 2912 wrote to memory of 3024 2912 drfpv.exe 32 PID 2912 wrote to memory of 3024 2912 drfpv.exe 32 PID 3024 wrote to memory of 2596 3024 jvtndh.exe 33 PID 3024 wrote to memory of 2596 3024 jvtndh.exe 33 PID 3024 wrote to memory of 2596 3024 jvtndh.exe 33 PID 3024 wrote to memory of 2596 3024 jvtndh.exe 33 PID 2596 wrote to memory of 3064 2596 bjddxrt.exe 34 PID 2596 wrote to memory of 3064 2596 bjddxrt.exe 34 PID 2596 wrote to memory of 3064 2596 bjddxrt.exe 34 PID 2596 wrote to memory of 3064 2596 bjddxrt.exe 34 PID 3064 wrote to memory of 2164 3064 vhnrdr.exe 35 PID 3064 wrote to memory of 2164 3064 vhnrdr.exe 35 PID 3064 wrote to memory of 2164 3064 vhnrdr.exe 35 PID 3064 wrote to memory of 2164 3064 vhnrdr.exe 35 PID 2164 wrote to memory of 2784 2164 fbprt.exe 36 PID 2164 wrote to memory of 2784 2164 fbprt.exe 36 PID 2164 wrote to memory of 2784 2164 fbprt.exe 36 PID 2164 wrote to memory of 2784 2164 fbprt.exe 36 PID 2784 wrote to memory of 2120 2784 fdrbd.exe 37 PID 2784 wrote to memory of 2120 2784 fdrbd.exe 37 PID 2784 wrote to memory of 2120 2784 fdrbd.exe 37 PID 2784 wrote to memory of 2120 2784 fdrbd.exe 37 PID 2120 wrote to memory of 1680 2120 rnvfp.exe 38 PID 2120 wrote to memory of 1680 2120 rnvfp.exe 38 PID 2120 wrote to memory of 1680 2120 rnvfp.exe 38 PID 2120 wrote to memory of 1680 2120 rnvfp.exe 38 PID 1680 wrote to memory of 2548 1680 pvpvp.exe 39 PID 1680 wrote to memory of 2548 1680 pvpvp.exe 39 PID 1680 wrote to memory of 2548 1680 pvpvp.exe 39 PID 1680 wrote to memory of 2548 1680 pvpvp.exe 39 PID 2548 wrote to memory of 1904 2548 txphlf.exe 40 PID 2548 wrote to memory of 1904 2548 txphlf.exe 40 PID 2548 wrote to memory of 1904 2548 txphlf.exe 40 PID 2548 wrote to memory of 1904 2548 txphlf.exe 40 PID 1904 wrote to memory of 2412 1904 xjhddh.exe 41 PID 1904 wrote to memory of 2412 1904 xjhddh.exe 41 PID 1904 wrote to memory of 2412 1904 xjhddh.exe 41 PID 1904 wrote to memory of 2412 1904 xjhddh.exe 41 PID 2412 wrote to memory of 2344 2412 nlvfrtd.exe 42 PID 2412 wrote to memory of 2344 2412 nlvfrtd.exe 42 PID 2412 wrote to memory of 2344 2412 nlvfrtd.exe 42 PID 2412 wrote to memory of 2344 2412 nlvfrtd.exe 42 PID 2344 wrote to memory of 2640 2344 hrffdv.exe 43 PID 2344 wrote to memory of 2640 2344 hrffdv.exe 43 PID 2344 wrote to memory of 2640 2344 hrffdv.exe 43 PID 2344 wrote to memory of 2640 2344 hrffdv.exe 43 PID 2640 wrote to memory of 3008 2640 xrnffb.exe 44 PID 2640 wrote to memory of 3008 2640 xrnffb.exe 44 PID 2640 wrote to memory of 3008 2640 xrnffb.exe 44 PID 2640 wrote to memory of 3008 2640 xrnffb.exe 44 PID 3008 wrote to memory of 2088 3008 dpfbx.exe 45 PID 3008 wrote to memory of 2088 3008 dpfbx.exe 45 PID 3008 wrote to memory of 2088 3008 dpfbx.exe 45 PID 3008 wrote to memory of 2088 3008 dpfbx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b967274ca4cb7284decde8fad2c074ae65c5ec25331f6941194ff8b9b8a9ca9.exe"C:\Users\Admin\AppData\Local\Temp\9b967274ca4cb7284decde8fad2c074ae65c5ec25331f6941194ff8b9b8a9ca9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\npdhtfx.exec:\npdhtfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\drfpv.exec:\drfpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\jvtndh.exec:\jvtndh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\bjddxrt.exec:\bjddxrt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\vhnrdr.exec:\vhnrdr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\fbprt.exec:\fbprt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\fdrbd.exec:\fdrbd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\rnvfp.exec:\rnvfp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\pvpvp.exec:\pvpvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\txphlf.exec:\txphlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\xjhddh.exec:\xjhddh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\nlvfrtd.exec:\nlvfrtd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\hrffdv.exec:\hrffdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\xrnffb.exec:\xrnffb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\dpfbx.exec:\dpfbx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\rjvrtb.exec:\rjvrtb.exe17⤵
- Executes dropped EXE
PID:2088 -
\??\c:\fnhxjd.exec:\fnhxjd.exe18⤵
- Executes dropped EXE
PID:808 -
\??\c:\bbxhpfn.exec:\bbxhpfn.exe19⤵
- Executes dropped EXE
PID:2112 -
\??\c:\hlvjnx.exec:\hlvjnx.exe20⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vnbxhhr.exec:\vnbxhhr.exe21⤵
- Executes dropped EXE
PID:2084 -
\??\c:\jbxprt.exec:\jbxprt.exe22⤵
- Executes dropped EXE
PID:1712 -
\??\c:\lvjxdrd.exec:\lvjxdrd.exe23⤵
- Executes dropped EXE
PID:1972 -
\??\c:\fphdv.exec:\fphdv.exe24⤵
- Executes dropped EXE
PID:584 -
\??\c:\bbnvhtf.exec:\bbnvhtf.exe25⤵
- Executes dropped EXE
PID:1960 -
\??\c:\pvnplh.exec:\pvnplh.exe26⤵
- Executes dropped EXE
PID:1576 -
\??\c:\lrbbfd.exec:\lrbbfd.exe27⤵
- Executes dropped EXE
PID:1268 -
\??\c:\vxbvh.exec:\vxbvh.exe28⤵
- Executes dropped EXE
PID:1476 -
\??\c:\lthfj.exec:\lthfj.exe29⤵
- Executes dropped EXE
PID:2720 -
\??\c:\fpnvjpt.exec:\fpnvjpt.exe30⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xrftvrx.exec:\xrftvrx.exe31⤵
- Executes dropped EXE
PID:768 -
\??\c:\tnrbnb.exec:\tnrbnb.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:692 -
\??\c:\fjtnxf.exec:\fjtnxf.exe33⤵
- Executes dropped EXE
PID:2216 -
\??\c:\fhnhpj.exec:\fhnhpj.exe34⤵
- Executes dropped EXE
PID:2004 -
\??\c:\rptnd.exec:\rptnd.exe35⤵
- Executes dropped EXE
PID:1632 -
\??\c:\hhvbttd.exec:\hhvbttd.exe36⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lrhjd.exec:\lrhjd.exe37⤵
- Executes dropped EXE
PID:2912 -
\??\c:\fntddp.exec:\fntddp.exe38⤵
- Executes dropped EXE
PID:2224 -
\??\c:\rrtxhp.exec:\rrtxhp.exe39⤵
- Executes dropped EXE
PID:1996 -
\??\c:\rrbbn.exec:\rrbbn.exe40⤵
- Executes dropped EXE
PID:2136 -
\??\c:\nfjnvrn.exec:\nfjnvrn.exe41⤵
- Executes dropped EXE
PID:2804 -
\??\c:\nvnjvld.exec:\nvnjvld.exe42⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lrxjbx.exec:\lrxjbx.exe43⤵
- Executes dropped EXE
PID:2800 -
\??\c:\ttdfp.exec:\ttdfp.exe44⤵
- Executes dropped EXE
PID:2364 -
\??\c:\jbblvf.exec:\jbblvf.exe45⤵
- Executes dropped EXE
PID:2092 -
\??\c:\dnnfdvj.exec:\dnnfdvj.exe46⤵
- Executes dropped EXE
PID:2376 -
\??\c:\vfppr.exec:\vfppr.exe47⤵
- Executes dropped EXE
PID:1516 -
\??\c:\nxldxfl.exec:\nxldxfl.exe48⤵
- Executes dropped EXE
PID:1548 -
\??\c:\jtdxlr.exec:\jtdxlr.exe49⤵
- Executes dropped EXE
PID:892 -
\??\c:\dhnlplv.exec:\dhnlplv.exe50⤵
- Executes dropped EXE
PID:1904 -
\??\c:\lvtnnd.exec:\lvtnnd.exe51⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jvrxbbb.exec:\jvrxbbb.exe52⤵
- Executes dropped EXE
PID:2044 -
\??\c:\tnrdvnj.exec:\tnrdvnj.exe53⤵
- Executes dropped EXE
PID:1740 -
\??\c:\jfnjjfv.exec:\jfnjjfv.exe54⤵
- Executes dropped EXE
PID:1240 -
\??\c:\tbxfx.exec:\tbxfx.exe55⤵
- Executes dropped EXE
PID:3008 -
\??\c:\tjjbx.exec:\tjjbx.exe56⤵
- Executes dropped EXE
PID:436 -
\??\c:\rvjjdr.exec:\rvjjdr.exe57⤵
- Executes dropped EXE
PID:2304 -
\??\c:\pthnfnl.exec:\pthnfnl.exe58⤵
- Executes dropped EXE
PID:2496 -
\??\c:\lbhhljd.exec:\lbhhljd.exe59⤵
- Executes dropped EXE
PID:2108 -
\??\c:\tvdvjbr.exec:\tvdvjbr.exe60⤵
- Executes dropped EXE
PID:2388 -
\??\c:\fptfvv.exec:\fptfvv.exe61⤵
- Executes dropped EXE
PID:1840 -
\??\c:\blhft.exec:\blhft.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:676 -
\??\c:\fbrnh.exec:\fbrnh.exe63⤵
- Executes dropped EXE
PID:900 -
\??\c:\btrjlnp.exec:\btrjlnp.exe64⤵
- Executes dropped EXE
PID:2072 -
\??\c:\pnbbb.exec:\pnbbb.exe65⤵
- Executes dropped EXE
PID:1604 -
\??\c:\hrbldn.exec:\hrbldn.exe66⤵PID:2404
-
\??\c:\fxjtdll.exec:\fxjtdll.exe67⤵PID:1564
-
\??\c:\jbbpth.exec:\jbbpth.exe68⤵PID:1576
-
\??\c:\trrnvv.exec:\trrnvv.exe69⤵PID:1568
-
\??\c:\dhffb.exec:\dhffb.exe70⤵PID:1444
-
\??\c:\xxlbxn.exec:\xxlbxn.exe71⤵PID:2060
-
\??\c:\prbnf.exec:\prbnf.exe72⤵PID:2944
-
\??\c:\fvbfv.exec:\fvbfv.exe73⤵
- System Location Discovery: System Language Discovery
PID:2528 -
\??\c:\dpdttl.exec:\dpdttl.exe74⤵PID:2000
-
\??\c:\dlhdbd.exec:\dlhdbd.exe75⤵PID:1640
-
\??\c:\xhdrx.exec:\xhdrx.exe76⤵PID:1048
-
\??\c:\rntbdtp.exec:\rntbdtp.exe77⤵PID:1228
-
\??\c:\hpbrhrl.exec:\hpbrhrl.exe78⤵PID:2004
-
\??\c:\jhpjtj.exec:\jhpjtj.exe79⤵PID:2892
-
\??\c:\jblfj.exec:\jblfj.exe80⤵PID:2556
-
\??\c:\rrxvvr.exec:\rrxvvr.exe81⤵
- System Location Discovery: System Language Discovery
PID:3060 -
\??\c:\dhxnhht.exec:\dhxnhht.exe82⤵PID:3044
-
\??\c:\jpdnfh.exec:\jpdnfh.exe83⤵PID:2284
-
\??\c:\vvbhff.exec:\vvbhff.exe84⤵PID:2136
-
\??\c:\jtdnjx.exec:\jtdnjx.exe85⤵PID:2804
-
\??\c:\vtltlr.exec:\vtltlr.exe86⤵PID:2228
-
\??\c:\dntjlr.exec:\dntjlr.exe87⤵PID:2832
-
\??\c:\nvrfrl.exec:\nvrfrl.exe88⤵PID:804
-
\??\c:\jttrh.exec:\jttrh.exe89⤵PID:2844
-
\??\c:\xvpftf.exec:\xvpftf.exe90⤵PID:2376
-
\??\c:\thflhp.exec:\thflhp.exe91⤵PID:2500
-
\??\c:\vxxxjvx.exec:\vxxxjvx.exe92⤵PID:2504
-
\??\c:\pfvrvp.exec:\pfvrvp.exe93⤵PID:2420
-
\??\c:\vjplpp.exec:\vjplpp.exe94⤵PID:2432
-
\??\c:\vplxp.exec:\vplxp.exe95⤵PID:2056
-
\??\c:\dnfvbvt.exec:\dnfvbvt.exe96⤵PID:1924
-
\??\c:\dxpbf.exec:\dxpbf.exe97⤵PID:952
-
\??\c:\rxfhf.exec:\rxfhf.exe98⤵PID:1336
-
\??\c:\xtfplxb.exec:\xtfplxb.exe99⤵PID:1320
-
\??\c:\vvjdjp.exec:\vvjdjp.exe100⤵PID:1312
-
\??\c:\xnhvd.exec:\xnhvd.exe101⤵PID:472
-
\??\c:\tjnxr.exec:\tjnxr.exe102⤵PID:2112
-
\??\c:\btdjlbj.exec:\btdjlbj.exe103⤵PID:2384
-
\??\c:\hdpft.exec:\hdpft.exe104⤵PID:2084
-
\??\c:\vndtxh.exec:\vndtxh.exe105⤵PID:2256
-
\??\c:\rjfjfht.exec:\rjfjfht.exe106⤵PID:108
-
\??\c:\jtjdxdf.exec:\jtjdxdf.exe107⤵PID:2704
-
\??\c:\vrdntf.exec:\vrdntf.exe108⤵PID:584
-
\??\c:\vbvhbnt.exec:\vbvhbnt.exe109⤵PID:1604
-
\??\c:\xnbfjx.exec:\xnbfjx.exe110⤵PID:2100
-
\??\c:\txhvpx.exec:\txhvpx.exe111⤵PID:1952
-
\??\c:\vdxvbvf.exec:\vdxvbvf.exe112⤵PID:1648
-
\??\c:\dxvbbtp.exec:\dxvbbtp.exe113⤵PID:2448
-
\??\c:\bjnfj.exec:\bjnfj.exe114⤵PID:2588
-
\??\c:\tfxffh.exec:\tfxffh.exe115⤵PID:1796
-
\??\c:\phpjdlt.exec:\phpjdlt.exe116⤵PID:784
-
\??\c:\dphlj.exec:\dphlj.exe117⤵PID:2624
-
\??\c:\hptjh.exec:\hptjh.exe118⤵PID:1932
-
\??\c:\pntdnh.exec:\pntdnh.exe119⤵PID:1640
-
\??\c:\bvprnpr.exec:\bvprnpr.exe120⤵PID:556
-
\??\c:\pthlpbd.exec:\pthlpbd.exe121⤵PID:1720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-