Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 04:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ea68216f15e150df7f2da475f8d4079411185e26ed154d3e2b59082ade589469.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ea68216f15e150df7f2da475f8d4079411185e26ed154d3e2b59082ade589469.exe
-
Size
453KB
-
MD5
fd9320ad7a7ef069db62e0456cc60269
-
SHA1
b91ad8acb65e10995b79257b2d4117b839403a32
-
SHA256
ea68216f15e150df7f2da475f8d4079411185e26ed154d3e2b59082ade589469
-
SHA512
8a6f29c75f3043a24bd75e1748c2cbabf5a014345ba99df5ad60fb12134b430ccdb93f09a29d5e5d31be282504423ab81212b4416a16cfd1aec5f04632211c73
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe8:q7Tc2NYHUrAwfMp3CD8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2496-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-45-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2648-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/364-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/736-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/648-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1340-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-303-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/740-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-332-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1596-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-339-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/336-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1236-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-568-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-840-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-869-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2204 dxvvblv.exe 2784 ftjrtn.exe 2216 bjxpf.exe 3028 tbfbndx.exe 2648 vrxvh.exe 2252 httrtfl.exe 2232 xdfxd.exe 1328 jrphfh.exe 2608 xjnrpvj.exe 2820 jpdbxxf.exe 2436 llvhnh.exe 2088 fxltn.exe 1484 vhtflbr.exe 2704 xdpbfjn.exe 2972 jppdvhn.exe 1964 xhdxfd.exe 364 hjdrhv.exe 824 hlvhxv.exe 2432 tbfvxvx.exe 2356 nvjppvh.exe 2072 hrhdfn.exe 2560 jrvfr.exe 1608 hnljl.exe 736 npjph.exe 536 pbdphbb.exe 1340 tttth.exe 648 fbntf.exe 1040 tttlrtv.exe 564 xpdnv.exe 1800 xbrfnbh.exe 1856 vhlbdld.exe 1848 xnpjbpp.exe 740 fhdpvf.exe 2292 fbndp.exe 2832 tnffd.exe 1684 lljdrd.exe 1596 xplxd.exe 2784 ddpjxn.exe 3044 hnvhr.exe 2868 lrrnrpt.exe 2712 jjnrb.exe 2688 xfhhlh.exe 2620 lnttxdr.exe 1612 hhlhl.exe 336 txdlrhf.exe 2120 dvjfl.exe 2336 tlprr.exe 2080 brntvjn.exe 1236 blhlv.exe 1492 bhjbpv.exe 1480 htltrff.exe 2936 lxnrbj.exe 3020 rfnpbn.exe 1916 prxnld.exe 2136 hnvrbrp.exe 764 vjpnpnr.exe 1900 jppxpdl.exe 2152 fpntl.exe 2388 txntd.exe 1300 bfffl.exe 2004 bppbxn.exe 956 hjbpvp.exe 1288 xpdvp.exe 1672 hffjfbr.exe -
resource yara_rule behavioral1/memory/2496-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/364-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/736-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/648-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/740-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/740-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-398-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1236-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-840-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-843-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-869-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-919-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvxvnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fptnxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnprhrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fthbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttxjnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvbpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npfvrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxdxfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhnjfvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjtrtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptxnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bffrdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhbvfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhnbxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlphx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dffhhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttdpdfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbftnvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfndjnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdtpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndtft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxxtld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljfnrfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtnprt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxrttx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phhdhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dphfrvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbnblh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtfbtrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blfdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtvdjpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brvrjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phtvnvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2496 wrote to memory of 2204 2496 ea68216f15e150df7f2da475f8d4079411185e26ed154d3e2b59082ade589469.exe 30 PID 2496 wrote to memory of 2204 2496 ea68216f15e150df7f2da475f8d4079411185e26ed154d3e2b59082ade589469.exe 30 PID 2496 wrote to memory of 2204 2496 ea68216f15e150df7f2da475f8d4079411185e26ed154d3e2b59082ade589469.exe 30 PID 2496 wrote to memory of 2204 2496 ea68216f15e150df7f2da475f8d4079411185e26ed154d3e2b59082ade589469.exe 30 PID 2204 wrote to memory of 2784 2204 dxvvblv.exe 31 PID 2204 wrote to memory of 2784 2204 dxvvblv.exe 31 PID 2204 wrote to memory of 2784 2204 dxvvblv.exe 31 PID 2204 wrote to memory of 2784 2204 dxvvblv.exe 31 PID 2784 wrote to memory of 2216 2784 ftjrtn.exe 32 PID 2784 wrote to memory of 2216 2784 ftjrtn.exe 32 PID 2784 wrote to memory of 2216 2784 ftjrtn.exe 32 PID 2784 wrote to memory of 2216 2784 ftjrtn.exe 32 PID 2216 wrote to memory of 3028 2216 bjxpf.exe 33 PID 2216 wrote to memory of 3028 2216 bjxpf.exe 33 PID 2216 wrote to memory of 3028 2216 bjxpf.exe 33 PID 2216 wrote to memory of 3028 2216 bjxpf.exe 33 PID 3028 wrote to memory of 2648 3028 tbfbndx.exe 34 PID 3028 wrote to memory of 2648 3028 tbfbndx.exe 34 PID 3028 wrote to memory of 2648 3028 tbfbndx.exe 34 PID 3028 wrote to memory of 2648 3028 tbfbndx.exe 34 PID 2648 wrote to memory of 2252 2648 vrxvh.exe 35 PID 2648 wrote to memory of 2252 2648 vrxvh.exe 35 PID 2648 wrote to memory of 2252 2648 vrxvh.exe 35 PID 2648 wrote to memory of 2252 2648 vrxvh.exe 35 PID 2252 wrote to memory of 2232 2252 httrtfl.exe 36 PID 2252 wrote to memory of 2232 2252 httrtfl.exe 36 PID 2252 wrote to memory of 2232 2252 httrtfl.exe 36 PID 2252 wrote to memory of 2232 2252 httrtfl.exe 36 PID 2232 wrote to memory of 1328 2232 xdfxd.exe 37 PID 2232 wrote to memory of 1328 2232 xdfxd.exe 37 PID 2232 wrote to memory of 1328 2232 xdfxd.exe 37 PID 2232 wrote to memory of 1328 2232 xdfxd.exe 37 PID 1328 wrote to memory of 2608 1328 jrphfh.exe 38 PID 1328 wrote to memory of 2608 1328 jrphfh.exe 38 PID 1328 wrote to memory of 2608 1328 jrphfh.exe 38 PID 1328 wrote to memory of 2608 1328 jrphfh.exe 38 PID 2608 wrote to memory of 2820 2608 xjnrpvj.exe 39 PID 2608 wrote to memory of 2820 2608 xjnrpvj.exe 39 PID 2608 wrote to memory of 2820 2608 xjnrpvj.exe 39 PID 2608 wrote to memory of 2820 2608 xjnrpvj.exe 39 PID 2820 wrote to memory of 2436 2820 jpdbxxf.exe 40 PID 2820 wrote to memory of 2436 2820 jpdbxxf.exe 40 PID 2820 wrote to memory of 2436 2820 jpdbxxf.exe 40 PID 2820 wrote to memory of 2436 2820 jpdbxxf.exe 40 PID 2436 wrote to memory of 2088 2436 llvhnh.exe 41 PID 2436 wrote to memory of 2088 2436 llvhnh.exe 41 PID 2436 wrote to memory of 2088 2436 llvhnh.exe 41 PID 2436 wrote to memory of 2088 2436 llvhnh.exe 41 PID 2088 wrote to memory of 1484 2088 fxltn.exe 42 PID 2088 wrote to memory of 1484 2088 fxltn.exe 42 PID 2088 wrote to memory of 1484 2088 fxltn.exe 42 PID 2088 wrote to memory of 1484 2088 fxltn.exe 42 PID 1484 wrote to memory of 2704 1484 vhtflbr.exe 43 PID 1484 wrote to memory of 2704 1484 vhtflbr.exe 43 PID 1484 wrote to memory of 2704 1484 vhtflbr.exe 43 PID 1484 wrote to memory of 2704 1484 vhtflbr.exe 43 PID 2704 wrote to memory of 2972 2704 xdpbfjn.exe 44 PID 2704 wrote to memory of 2972 2704 xdpbfjn.exe 44 PID 2704 wrote to memory of 2972 2704 xdpbfjn.exe 44 PID 2704 wrote to memory of 2972 2704 xdpbfjn.exe 44 PID 2972 wrote to memory of 1964 2972 jppdvhn.exe 45 PID 2972 wrote to memory of 1964 2972 jppdvhn.exe 45 PID 2972 wrote to memory of 1964 2972 jppdvhn.exe 45 PID 2972 wrote to memory of 1964 2972 jppdvhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea68216f15e150df7f2da475f8d4079411185e26ed154d3e2b59082ade589469.exe"C:\Users\Admin\AppData\Local\Temp\ea68216f15e150df7f2da475f8d4079411185e26ed154d3e2b59082ade589469.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\dxvvblv.exec:\dxvvblv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\ftjrtn.exec:\ftjrtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\bjxpf.exec:\bjxpf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\tbfbndx.exec:\tbfbndx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\vrxvh.exec:\vrxvh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\httrtfl.exec:\httrtfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\xdfxd.exec:\xdfxd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\jrphfh.exec:\jrphfh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\xjnrpvj.exec:\xjnrpvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\jpdbxxf.exec:\jpdbxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\llvhnh.exec:\llvhnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\fxltn.exec:\fxltn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\vhtflbr.exec:\vhtflbr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\xdpbfjn.exec:\xdpbfjn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\jppdvhn.exec:\jppdvhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\xhdxfd.exec:\xhdxfd.exe17⤵
- Executes dropped EXE
PID:1964 -
\??\c:\hjdrhv.exec:\hjdrhv.exe18⤵
- Executes dropped EXE
PID:364 -
\??\c:\hlvhxv.exec:\hlvhxv.exe19⤵
- Executes dropped EXE
PID:824 -
\??\c:\tbfvxvx.exec:\tbfvxvx.exe20⤵
- Executes dropped EXE
PID:2432 -
\??\c:\nvjppvh.exec:\nvjppvh.exe21⤵
- Executes dropped EXE
PID:2356 -
\??\c:\hrhdfn.exec:\hrhdfn.exe22⤵
- Executes dropped EXE
PID:2072 -
\??\c:\jrvfr.exec:\jrvfr.exe23⤵
- Executes dropped EXE
PID:2560 -
\??\c:\hnljl.exec:\hnljl.exe24⤵
- Executes dropped EXE
PID:1608 -
\??\c:\npjph.exec:\npjph.exe25⤵
- Executes dropped EXE
PID:736 -
\??\c:\pbdphbb.exec:\pbdphbb.exe26⤵
- Executes dropped EXE
PID:536 -
\??\c:\tttth.exec:\tttth.exe27⤵
- Executes dropped EXE
PID:1340 -
\??\c:\fbntf.exec:\fbntf.exe28⤵
- Executes dropped EXE
PID:648 -
\??\c:\tttlrtv.exec:\tttlrtv.exe29⤵
- Executes dropped EXE
PID:1040 -
\??\c:\xpdnv.exec:\xpdnv.exe30⤵
- Executes dropped EXE
PID:564 -
\??\c:\xbrfnbh.exec:\xbrfnbh.exe31⤵
- Executes dropped EXE
PID:1800 -
\??\c:\vhlbdld.exec:\vhlbdld.exe32⤵
- Executes dropped EXE
PID:1856 -
\??\c:\xnpjbpp.exec:\xnpjbpp.exe33⤵
- Executes dropped EXE
PID:1848 -
\??\c:\fhdpvf.exec:\fhdpvf.exe34⤵
- Executes dropped EXE
PID:740 -
\??\c:\fbndp.exec:\fbndp.exe35⤵
- Executes dropped EXE
PID:2292 -
\??\c:\tnffd.exec:\tnffd.exe36⤵
- Executes dropped EXE
PID:2832 -
\??\c:\lljdrd.exec:\lljdrd.exe37⤵
- Executes dropped EXE
PID:1684 -
\??\c:\xplxd.exec:\xplxd.exe38⤵
- Executes dropped EXE
PID:1596 -
\??\c:\ddpjxn.exec:\ddpjxn.exe39⤵
- Executes dropped EXE
PID:2784 -
\??\c:\hnvhr.exec:\hnvhr.exe40⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lrrnrpt.exec:\lrrnrpt.exe41⤵
- Executes dropped EXE
PID:2868 -
\??\c:\jjnrb.exec:\jjnrb.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\xfhhlh.exec:\xfhhlh.exe43⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lnttxdr.exec:\lnttxdr.exe44⤵
- Executes dropped EXE
PID:2620 -
\??\c:\hhlhl.exec:\hhlhl.exe45⤵
- Executes dropped EXE
PID:1612 -
\??\c:\txdlrhf.exec:\txdlrhf.exe46⤵
- Executes dropped EXE
PID:336 -
\??\c:\dvjfl.exec:\dvjfl.exe47⤵
- Executes dropped EXE
PID:2120 -
\??\c:\tlprr.exec:\tlprr.exe48⤵
- Executes dropped EXE
PID:2336 -
\??\c:\brntvjn.exec:\brntvjn.exe49⤵
- Executes dropped EXE
PID:2080 -
\??\c:\blhlv.exec:\blhlv.exe50⤵
- Executes dropped EXE
PID:1236 -
\??\c:\bhjbpv.exec:\bhjbpv.exe51⤵
- Executes dropped EXE
PID:1492 -
\??\c:\htltrff.exec:\htltrff.exe52⤵
- Executes dropped EXE
PID:1480 -
\??\c:\lxnrbj.exec:\lxnrbj.exe53⤵
- Executes dropped EXE
PID:2936 -
\??\c:\rfnpbn.exec:\rfnpbn.exe54⤵
- Executes dropped EXE
PID:3020 -
\??\c:\prxnld.exec:\prxnld.exe55⤵
- Executes dropped EXE
PID:1916 -
\??\c:\hnvrbrp.exec:\hnvrbrp.exe56⤵
- Executes dropped EXE
PID:2136 -
\??\c:\vjpnpnr.exec:\vjpnpnr.exe57⤵
- Executes dropped EXE
PID:764 -
\??\c:\jppxpdl.exec:\jppxpdl.exe58⤵
- Executes dropped EXE
PID:1900 -
\??\c:\fpntl.exec:\fpntl.exe59⤵
- Executes dropped EXE
PID:2152 -
\??\c:\txntd.exec:\txntd.exe60⤵
- Executes dropped EXE
PID:2388 -
\??\c:\bfffl.exec:\bfffl.exe61⤵
- Executes dropped EXE
PID:1300 -
\??\c:\bppbxn.exec:\bppbxn.exe62⤵
- Executes dropped EXE
PID:2004 -
\??\c:\hjbpvp.exec:\hjbpvp.exe63⤵
- Executes dropped EXE
PID:956 -
\??\c:\xpdvp.exec:\xpdvp.exe64⤵
- Executes dropped EXE
PID:1288 -
\??\c:\hffjfbr.exec:\hffjfbr.exe65⤵
- Executes dropped EXE
PID:1672 -
\??\c:\vbvnpt.exec:\vbvnpt.exe66⤵PID:580
-
\??\c:\rvtxvn.exec:\rvtxvn.exe67⤵PID:2460
-
\??\c:\nblbnv.exec:\nblbnv.exe68⤵PID:1292
-
\??\c:\jfvxj.exec:\jfvxj.exe69⤵PID:1340
-
\??\c:\fhnbxf.exec:\fhnbxf.exe70⤵
- System Location Discovery: System Language Discovery
PID:1772 -
\??\c:\rbppj.exec:\rbppj.exe71⤵PID:908
-
\??\c:\dbttl.exec:\dbttl.exe72⤵PID:1516
-
\??\c:\rvbbdn.exec:\rvbbdn.exe73⤵PID:1732
-
\??\c:\fftltj.exec:\fftltj.exe74⤵PID:1932
-
\??\c:\vrtld.exec:\vrtld.exe75⤵PID:1316
-
\??\c:\dtdfvr.exec:\dtdfvr.exe76⤵PID:1504
-
\??\c:\vndftxf.exec:\vndftxf.exe77⤵PID:292
-
\??\c:\vhxjtbf.exec:\vhxjtbf.exe78⤵PID:2844
-
\??\c:\bnbjlx.exec:\bnbjlx.exe79⤵PID:1688
-
\??\c:\dtfrpf.exec:\dtfrpf.exe80⤵PID:2756
-
\??\c:\phpptdd.exec:\phpptdd.exe81⤵PID:2644
-
\??\c:\vpfhbvj.exec:\vpfhbvj.exe82⤵PID:2456
-
\??\c:\pvbtbf.exec:\pvbtbf.exe83⤵PID:2664
-
\??\c:\ndrlhhx.exec:\ndrlhhx.exe84⤵PID:3044
-
\??\c:\xnpxrfd.exec:\xnpxrfd.exe85⤵PID:2648
-
\??\c:\rvrjl.exec:\rvrjl.exe86⤵PID:2652
-
\??\c:\nbbnv.exec:\nbbnv.exe87⤵PID:2688
-
\??\c:\blfrfx.exec:\blfrfx.exe88⤵PID:2620
-
\??\c:\dtnrxjx.exec:\dtnrxjx.exe89⤵PID:1612
-
\??\c:\hvhxdlb.exec:\hvhxdlb.exe90⤵PID:336
-
\??\c:\jvhfn.exec:\jvhfn.exe91⤵PID:2140
-
\??\c:\xvbpp.exec:\xvbpp.exe92⤵
- System Location Discovery: System Language Discovery
PID:2820 -
\??\c:\rpfnh.exec:\rpfnh.exe93⤵PID:1076
-
\??\c:\nfnbbxv.exec:\nfnbbxv.exe94⤵PID:1476
-
\??\c:\vbvnxbp.exec:\vbvnxbp.exe95⤵PID:1272
-
\??\c:\npfvrh.exec:\npfvrh.exe96⤵
- System Location Discovery: System Language Discovery
PID:2920 -
\??\c:\hpnvfrb.exec:\hpnvfrb.exe97⤵PID:2704
-
\??\c:\ppvnjrr.exec:\ppvnjrr.exe98⤵PID:2972
-
\??\c:\rfrrrl.exec:\rfrrrl.exe99⤵PID:2596
-
\??\c:\nfrrt.exec:\nfrrt.exe100⤵PID:544
-
\??\c:\frjtpr.exec:\frjtpr.exe101⤵PID:1748
-
\??\c:\ttrvt.exec:\ttrvt.exe102⤵PID:2156
-
\??\c:\ttlrhlx.exec:\ttlrhlx.exe103⤵PID:2144
-
\??\c:\fnfrvrj.exec:\fnfrvrj.exe104⤵PID:2520
-
\??\c:\pbnhpx.exec:\pbnhpx.exe105⤵PID:2484
-
\??\c:\jtbnt.exec:\jtbnt.exe106⤵PID:1644
-
\??\c:\dhppjp.exec:\dhppjp.exe107⤵PID:388
-
\??\c:\jdnnnhv.exec:\jdnnnhv.exe108⤵PID:1608
-
\??\c:\xfbjffv.exec:\xfbjffv.exe109⤵PID:1908
-
\??\c:\xvhvp.exec:\xvhvp.exe110⤵PID:680
-
\??\c:\ffprltt.exec:\ffprltt.exe111⤵PID:580
-
\??\c:\phhdhh.exec:\phhdhh.exe112⤵
- System Location Discovery: System Language Discovery
PID:2460 -
\??\c:\vhdnt.exec:\vhdnt.exe113⤵PID:1796
-
\??\c:\brdjnff.exec:\brdjnff.exe114⤵PID:1852
-
\??\c:\ndfvp.exec:\ndfvp.exe115⤵PID:1772
-
\??\c:\nbndvtf.exec:\nbndvtf.exe116⤵PID:2228
-
\??\c:\nxdxfj.exec:\nxdxfj.exe117⤵
- System Location Discovery: System Language Discovery
PID:1516 -
\??\c:\hvfhdhr.exec:\hvfhdhr.exe118⤵PID:1488
-
\??\c:\rnlphxx.exec:\rnlphxx.exe119⤵PID:1808
-
\??\c:\nxpnxhn.exec:\nxpnxhn.exe120⤵PID:1316
-
\??\c:\btdxnx.exec:\btdxnx.exe121⤵PID:1504
-
\??\c:\dfnltt.exec:\dfnltt.exe122⤵PID:292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-