Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 03:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d704c4b012098ee6f32d9fb518c6e4428da317ebe5cd80b70b1ffa527cadbccc.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d704c4b012098ee6f32d9fb518c6e4428da317ebe5cd80b70b1ffa527cadbccc.exe
-
Size
453KB
-
MD5
ed8c8d463ad043014f34b78cd8e79bce
-
SHA1
868ac639d881f675b0a7dbbf235e607924d80ed0
-
SHA256
d704c4b012098ee6f32d9fb518c6e4428da317ebe5cd80b70b1ffa527cadbccc
-
SHA512
2b87252b074d4523b778f4db3495e1878dfed86d29e2369f7fa583e9f7a160e74eddbba81dcd874b53ceedf623c39084d149634a726250e438e99ed8c90ea99e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeY:q7Tc2NYHUrAwfMp3CDY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2904-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-40-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2740-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-63-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2092-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/600-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-252-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2332-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/396-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-427-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2516-447-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/756-455-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2256-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-771-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1596-836-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2104-891-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-1007-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-1110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2820 lrrprv.exe 2672 pdptdpl.exe 3036 rhrbxbd.exe 2832 xndbpvv.exe 2740 dxpnjp.exe 2360 ntjvt.exe 2004 pjvxxf.exe 2092 xxvlv.exe 952 pjpfrlj.exe 600 tlprrb.exe 2188 rvrxx.exe 2488 jtpdvn.exe 2228 xxlfdrh.exe 2996 vrrttvx.exe 2764 xxbpf.exe 3068 rbvfb.exe 1520 pfvhdt.exe 2032 pxlxrt.exe 2372 jdlhj.exe 1440 hvhpll.exe 2240 plfnvj.exe 236 hdllddr.exe 888 txrrxt.exe 1540 lnfvvf.exe 1492 nrnhvv.exe 1348 xvxffv.exe 2332 pdbtv.exe 1388 fxnnj.exe 1704 lnfll.exe 2100 xrrtvhr.exe 1936 jnvtfx.exe 788 tffpdfj.exe 1656 rpjbxt.exe 2776 tprjxdb.exe 2088 xbnrdvl.exe 1484 xfjdn.exe 1984 rhjjjn.exe 3052 xbxptff.exe 2500 njjtd.exe 2308 dhjjhb.exe 2724 jtvtnxp.exe 396 xhttdll.exe 2000 vnllhpv.exe 1132 hjvpb.exe 2152 trlnx.exe 1504 vnhfxrh.exe 2480 ldhdd.exe 2288 lnlfrb.exe 2572 vjpvf.exe 2216 jfxpnh.exe 2980 hxbpddh.exe 2516 tptldd.exe 2996 pvxltfp.exe 2448 jhtfj.exe 3040 phfbj.exe 756 dfvnrjx.exe 2404 djbxv.exe 1316 ffrdl.exe 2592 lnlrnn.exe 2576 rtdbhtr.exe 2240 hnbjtj.exe 1788 xjdlf.exe 856 tvdhv.exe 1756 bjfbtnb.exe -
resource yara_rule behavioral1/memory/2904-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-40-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2740-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-472-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1732-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-770-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2104-891-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-912-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-1007-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-1027-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-1047-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-1056-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-1110-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdtbvxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnhln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfdht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rndptlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrnnndp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffvdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htplb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dflfphj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlvbhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbnfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvrnlrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnrlpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlrlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbxptff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbppl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhfjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpnhrjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpjblvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvtxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlhdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthdhfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbbpdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbjrrpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjrbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bppfdrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvnlbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxjnpbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhdrdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhnflv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvvtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbdfpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fplnptd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnlfrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hprdlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2820 2904 d704c4b012098ee6f32d9fb518c6e4428da317ebe5cd80b70b1ffa527cadbccc.exe 30 PID 2904 wrote to memory of 2820 2904 d704c4b012098ee6f32d9fb518c6e4428da317ebe5cd80b70b1ffa527cadbccc.exe 30 PID 2904 wrote to memory of 2820 2904 d704c4b012098ee6f32d9fb518c6e4428da317ebe5cd80b70b1ffa527cadbccc.exe 30 PID 2904 wrote to memory of 2820 2904 d704c4b012098ee6f32d9fb518c6e4428da317ebe5cd80b70b1ffa527cadbccc.exe 30 PID 2820 wrote to memory of 2672 2820 lrrprv.exe 31 PID 2820 wrote to memory of 2672 2820 lrrprv.exe 31 PID 2820 wrote to memory of 2672 2820 lrrprv.exe 31 PID 2820 wrote to memory of 2672 2820 lrrprv.exe 31 PID 2672 wrote to memory of 3036 2672 pdptdpl.exe 32 PID 2672 wrote to memory of 3036 2672 pdptdpl.exe 32 PID 2672 wrote to memory of 3036 2672 pdptdpl.exe 32 PID 2672 wrote to memory of 3036 2672 pdptdpl.exe 32 PID 3036 wrote to memory of 2832 3036 rhrbxbd.exe 33 PID 3036 wrote to memory of 2832 3036 rhrbxbd.exe 33 PID 3036 wrote to memory of 2832 3036 rhrbxbd.exe 33 PID 3036 wrote to memory of 2832 3036 rhrbxbd.exe 33 PID 2832 wrote to memory of 2740 2832 xndbpvv.exe 34 PID 2832 wrote to memory of 2740 2832 xndbpvv.exe 34 PID 2832 wrote to memory of 2740 2832 xndbpvv.exe 34 PID 2832 wrote to memory of 2740 2832 xndbpvv.exe 34 PID 2740 wrote to memory of 2360 2740 dxpnjp.exe 35 PID 2740 wrote to memory of 2360 2740 dxpnjp.exe 35 PID 2740 wrote to memory of 2360 2740 dxpnjp.exe 35 PID 2740 wrote to memory of 2360 2740 dxpnjp.exe 35 PID 2360 wrote to memory of 2004 2360 ntjvt.exe 36 PID 2360 wrote to memory of 2004 2360 ntjvt.exe 36 PID 2360 wrote to memory of 2004 2360 ntjvt.exe 36 PID 2360 wrote to memory of 2004 2360 ntjvt.exe 36 PID 2004 wrote to memory of 2092 2004 pjvxxf.exe 37 PID 2004 wrote to memory of 2092 2004 pjvxxf.exe 37 PID 2004 wrote to memory of 2092 2004 pjvxxf.exe 37 PID 2004 wrote to memory of 2092 2004 pjvxxf.exe 37 PID 2092 wrote to memory of 952 2092 xxvlv.exe 38 PID 2092 wrote to memory of 952 2092 xxvlv.exe 38 PID 2092 wrote to memory of 952 2092 xxvlv.exe 38 PID 2092 wrote to memory of 952 2092 xxvlv.exe 38 PID 952 wrote to memory of 600 952 pjpfrlj.exe 39 PID 952 wrote to memory of 600 952 pjpfrlj.exe 39 PID 952 wrote to memory of 600 952 pjpfrlj.exe 39 PID 952 wrote to memory of 600 952 pjpfrlj.exe 39 PID 600 wrote to memory of 2188 600 tlprrb.exe 40 PID 600 wrote to memory of 2188 600 tlprrb.exe 40 PID 600 wrote to memory of 2188 600 tlprrb.exe 40 PID 600 wrote to memory of 2188 600 tlprrb.exe 40 PID 2188 wrote to memory of 2488 2188 rvrxx.exe 41 PID 2188 wrote to memory of 2488 2188 rvrxx.exe 41 PID 2188 wrote to memory of 2488 2188 rvrxx.exe 41 PID 2188 wrote to memory of 2488 2188 rvrxx.exe 41 PID 2488 wrote to memory of 2228 2488 jtpdvn.exe 42 PID 2488 wrote to memory of 2228 2488 jtpdvn.exe 42 PID 2488 wrote to memory of 2228 2488 jtpdvn.exe 42 PID 2488 wrote to memory of 2228 2488 jtpdvn.exe 42 PID 2228 wrote to memory of 2996 2228 xxlfdrh.exe 43 PID 2228 wrote to memory of 2996 2228 xxlfdrh.exe 43 PID 2228 wrote to memory of 2996 2228 xxlfdrh.exe 43 PID 2228 wrote to memory of 2996 2228 xxlfdrh.exe 43 PID 2996 wrote to memory of 2764 2996 vrrttvx.exe 44 PID 2996 wrote to memory of 2764 2996 vrrttvx.exe 44 PID 2996 wrote to memory of 2764 2996 vrrttvx.exe 44 PID 2996 wrote to memory of 2764 2996 vrrttvx.exe 44 PID 2764 wrote to memory of 3068 2764 xxbpf.exe 45 PID 2764 wrote to memory of 3068 2764 xxbpf.exe 45 PID 2764 wrote to memory of 3068 2764 xxbpf.exe 45 PID 2764 wrote to memory of 3068 2764 xxbpf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d704c4b012098ee6f32d9fb518c6e4428da317ebe5cd80b70b1ffa527cadbccc.exe"C:\Users\Admin\AppData\Local\Temp\d704c4b012098ee6f32d9fb518c6e4428da317ebe5cd80b70b1ffa527cadbccc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\lrrprv.exec:\lrrprv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\pdptdpl.exec:\pdptdpl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\rhrbxbd.exec:\rhrbxbd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\xndbpvv.exec:\xndbpvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\dxpnjp.exec:\dxpnjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\ntjvt.exec:\ntjvt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\pjvxxf.exec:\pjvxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\xxvlv.exec:\xxvlv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\pjpfrlj.exec:\pjpfrlj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\tlprrb.exec:\tlprrb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\rvrxx.exec:\rvrxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\jtpdvn.exec:\jtpdvn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\xxlfdrh.exec:\xxlfdrh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\vrrttvx.exec:\vrrttvx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\xxbpf.exec:\xxbpf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\rbvfb.exec:\rbvfb.exe17⤵
- Executes dropped EXE
PID:3068 -
\??\c:\pfvhdt.exec:\pfvhdt.exe18⤵
- Executes dropped EXE
PID:1520 -
\??\c:\pxlxrt.exec:\pxlxrt.exe19⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jdlhj.exec:\jdlhj.exe20⤵
- Executes dropped EXE
PID:2372 -
\??\c:\hvhpll.exec:\hvhpll.exe21⤵
- Executes dropped EXE
PID:1440 -
\??\c:\plfnvj.exec:\plfnvj.exe22⤵
- Executes dropped EXE
PID:2240 -
\??\c:\hdllddr.exec:\hdllddr.exe23⤵
- Executes dropped EXE
PID:236 -
\??\c:\txrrxt.exec:\txrrxt.exe24⤵
- Executes dropped EXE
PID:888 -
\??\c:\lnfvvf.exec:\lnfvvf.exe25⤵
- Executes dropped EXE
PID:1540 -
\??\c:\nrnhvv.exec:\nrnhvv.exe26⤵
- Executes dropped EXE
PID:1492 -
\??\c:\xvxffv.exec:\xvxffv.exe27⤵
- Executes dropped EXE
PID:1348 -
\??\c:\pdbtv.exec:\pdbtv.exe28⤵
- Executes dropped EXE
PID:2332 -
\??\c:\fxnnj.exec:\fxnnj.exe29⤵
- Executes dropped EXE
PID:1388 -
\??\c:\lnfll.exec:\lnfll.exe30⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xrrtvhr.exec:\xrrtvhr.exe31⤵
- Executes dropped EXE
PID:2100 -
\??\c:\jnvtfx.exec:\jnvtfx.exe32⤵
- Executes dropped EXE
PID:1936 -
\??\c:\tffpdfj.exec:\tffpdfj.exe33⤵
- Executes dropped EXE
PID:788 -
\??\c:\rpjbxt.exec:\rpjbxt.exe34⤵
- Executes dropped EXE
PID:1656 -
\??\c:\tprjxdb.exec:\tprjxdb.exe35⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xbnrdvl.exec:\xbnrdvl.exe36⤵
- Executes dropped EXE
PID:2088 -
\??\c:\xfjdn.exec:\xfjdn.exe37⤵
- Executes dropped EXE
PID:1484 -
\??\c:\rhjjjn.exec:\rhjjjn.exe38⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xbxptff.exec:\xbxptff.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3052 -
\??\c:\njjtd.exec:\njjtd.exe40⤵
- Executes dropped EXE
PID:2500 -
\??\c:\dhjjhb.exec:\dhjjhb.exe41⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jtvtnxp.exec:\jtvtnxp.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xhttdll.exec:\xhttdll.exe43⤵
- Executes dropped EXE
PID:396 -
\??\c:\vnllhpv.exec:\vnllhpv.exe44⤵
- Executes dropped EXE
PID:2000 -
\??\c:\hjvpb.exec:\hjvpb.exe45⤵
- Executes dropped EXE
PID:1132 -
\??\c:\trlnx.exec:\trlnx.exe46⤵
- Executes dropped EXE
PID:2152 -
\??\c:\vnhfxrh.exec:\vnhfxrh.exe47⤵
- Executes dropped EXE
PID:1504 -
\??\c:\ldhdd.exec:\ldhdd.exe48⤵
- Executes dropped EXE
PID:2480 -
\??\c:\lnlfrb.exec:\lnlfrb.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2288 -
\??\c:\vjpvf.exec:\vjpvf.exe50⤵
- Executes dropped EXE
PID:2572 -
\??\c:\jfxpnh.exec:\jfxpnh.exe51⤵
- Executes dropped EXE
PID:2216 -
\??\c:\hxbpddh.exec:\hxbpddh.exe52⤵
- Executes dropped EXE
PID:2980 -
\??\c:\tptldd.exec:\tptldd.exe53⤵
- Executes dropped EXE
PID:2516 -
\??\c:\pvxltfp.exec:\pvxltfp.exe54⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jhtfj.exec:\jhtfj.exe55⤵
- Executes dropped EXE
PID:2448 -
\??\c:\phfbj.exec:\phfbj.exe56⤵
- Executes dropped EXE
PID:3040 -
\??\c:\dfvnrjx.exec:\dfvnrjx.exe57⤵
- Executes dropped EXE
PID:756 -
\??\c:\djbxv.exec:\djbxv.exe58⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ffrdl.exec:\ffrdl.exe59⤵
- Executes dropped EXE
PID:1316 -
\??\c:\lnlrnn.exec:\lnlrnn.exe60⤵
- Executes dropped EXE
PID:2592 -
\??\c:\rtdbhtr.exec:\rtdbhtr.exe61⤵
- Executes dropped EXE
PID:2576 -
\??\c:\hnbjtj.exec:\hnbjtj.exe62⤵
- Executes dropped EXE
PID:2240 -
\??\c:\xjdlf.exec:\xjdlf.exe63⤵
- Executes dropped EXE
PID:1788 -
\??\c:\tvdhv.exec:\tvdhv.exe64⤵
- Executes dropped EXE
PID:856 -
\??\c:\bjfbtnb.exec:\bjfbtnb.exe65⤵
- Executes dropped EXE
PID:1756 -
\??\c:\rdptvrd.exec:\rdptvrd.exe66⤵PID:1872
-
\??\c:\fbnptdb.exec:\fbnptdb.exe67⤵PID:1552
-
\??\c:\jjflrl.exec:\jjflrl.exe68⤵PID:2008
-
\??\c:\tvnbfr.exec:\tvnbfr.exe69⤵PID:1732
-
\??\c:\jhvlrr.exec:\jhvlrr.exe70⤵PID:1288
-
\??\c:\xdxxx.exec:\xdxxx.exe71⤵PID:1636
-
\??\c:\nbvbhj.exec:\nbvbhj.exe72⤵PID:2256
-
\??\c:\hllht.exec:\hllht.exe73⤵PID:2508
-
\??\c:\rnxddtd.exec:\rnxddtd.exe74⤵PID:1796
-
\??\c:\jjnjtx.exec:\jjnjtx.exe75⤵PID:2736
-
\??\c:\rtnrvn.exec:\rtnrvn.exe76⤵PID:2248
-
\??\c:\bllbdfj.exec:\bllbdfj.exe77⤵PID:2772
-
\??\c:\fxlln.exec:\fxlln.exe78⤵PID:1612
-
\??\c:\lthbpt.exec:\lthbpt.exe79⤵PID:2820
-
\??\c:\xxnjjjf.exec:\xxnjjjf.exe80⤵PID:2940
-
\??\c:\bjvlf.exec:\bjvlf.exe81⤵PID:3064
-
\??\c:\njbbdnj.exec:\njbbdnj.exe82⤵PID:2720
-
\??\c:\ddhbpt.exec:\ddhbpt.exe83⤵PID:2656
-
\??\c:\nrljbfd.exec:\nrljbfd.exe84⤵PID:2744
-
\??\c:\vvxrdpd.exec:\vvxrdpd.exe85⤵PID:876
-
\??\c:\fxvdlpd.exec:\fxvdlpd.exe86⤵PID:2724
-
\??\c:\jtxtdrt.exec:\jtxtdrt.exe87⤵PID:2640
-
\??\c:\brbtl.exec:\brbtl.exe88⤵PID:2424
-
\??\c:\txvlv.exec:\txvlv.exe89⤵PID:1964
-
\??\c:\bhjnbnr.exec:\bhjnbnr.exe90⤵PID:2152
-
\??\c:\pvxfh.exec:\pvxfh.exe91⤵PID:2156
-
\??\c:\pdhtfp.exec:\pdhtfp.exe92⤵PID:2320
-
\??\c:\vbbfb.exec:\vbbfb.exe93⤵PID:2180
-
\??\c:\ndpjp.exec:\ndpjp.exe94⤵PID:2572
-
\??\c:\btfllvv.exec:\btfllvv.exe95⤵PID:2216
-
\??\c:\fhbvv.exec:\fhbvv.exe96⤵PID:2316
-
\??\c:\njhff.exec:\njhff.exe97⤵PID:1544
-
\??\c:\hndnfb.exec:\hndnfb.exe98⤵PID:2220
-
\??\c:\ttljl.exec:\ttljl.exe99⤵PID:3032
-
\??\c:\rtfdxxx.exec:\rtfdxxx.exe100⤵PID:332
-
\??\c:\brfxdl.exec:\brfxdl.exe101⤵PID:2384
-
\??\c:\xdrtd.exec:\xdrtd.exe102⤵PID:2032
-
\??\c:\lllhhp.exec:\lllhhp.exe103⤵PID:2372
-
\??\c:\tnxfhf.exec:\tnxfhf.exe104⤵PID:1944
-
\??\c:\tdrxhd.exec:\tdrxhd.exe105⤵PID:1096
-
\??\c:\xnfbbvl.exec:\xnfbbvl.exe106⤵PID:1376
-
\??\c:\fbjjhrf.exec:\fbjjhrf.exe107⤵PID:956
-
\??\c:\htplb.exec:\htplb.exe108⤵
- System Location Discovery: System Language Discovery
PID:2648 -
\??\c:\nfddl.exec:\nfddl.exe109⤵PID:564
-
\??\c:\ltxdxrp.exec:\ltxdxrp.exe110⤵PID:2432
-
\??\c:\xptjj.exec:\xptjj.exe111⤵PID:1820
-
\??\c:\jdbdvdx.exec:\jdbdvdx.exe112⤵PID:1860
-
\??\c:\bdvxxp.exec:\bdvxxp.exe113⤵PID:1596
-
\??\c:\xpxpn.exec:\xpxpn.exe114⤵PID:2992
-
\??\c:\pvxpxx.exec:\pvxpxx.exe115⤵PID:1440
-
\??\c:\jhtrbft.exec:\jhtrbft.exe116⤵PID:1048
-
\??\c:\trxrb.exec:\trxrb.exe117⤵PID:2912
-
\??\c:\hntvhvn.exec:\hntvhvn.exe118⤵PID:1032
-
\??\c:\fdvnld.exec:\fdvnld.exe119⤵PID:1328
-
\??\c:\rthnhpf.exec:\rthnhpf.exe120⤵PID:788
-
\??\c:\rllnd.exec:\rllnd.exe121⤵PID:2748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-