Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 04:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe
-
Size
455KB
-
MD5
fdcb0d1c35362790c47d3496a73ae170
-
SHA1
b12e29a4bff892a257ac112af499888eadfeb77d
-
SHA256
faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7
-
SHA512
b84ee16844220c5b6969465ffa5fd53ee775c262ff1449ecee628b85bd1f5bddcea86b2e5aaddc9ca1cbabd29d8802e0888de6663194c05ce31127cbaaa3223a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRIJ:q7Tc2NYHUrAwfMp3CDRQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2592-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/940-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1020-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-337-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2912-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-447-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2060-472-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1076-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-618-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2372-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/388-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1116-957-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3000 pprpvr.exe 2896 vfdrhll.exe 2904 hhdbptp.exe 2880 bjnrt.exe 2372 drndjp.exe 2672 dfrjj.exe 2744 vbvpln.exe 2620 lnlvdrt.exe 1936 hljfp.exe 1672 ltllv.exe 2024 vfjnhrd.exe 940 rxvlv.exe 2188 jdtlxlv.exe 2736 fpfdpl.exe 2420 djttxx.exe 1976 nfpvnnd.exe 2304 fpjpt.exe 2200 hnlbnrp.exe 2284 xjvfxlr.exe 2144 rhtxvr.exe 1540 lrlth.exe 1020 dhhdbf.exe 1556 nrtph.exe 948 ltnlfj.exe 1752 rbfrxdd.exe 1836 jxnvvv.exe 1084 pfhbdn.exe 2668 hbplxvt.exe 2268 xtbtht.exe 1772 tldjv.exe 1928 txbblvx.exe 1120 vbbxf.exe 2224 fbfbl.exe 2240 lrtnrdb.exe 2980 xxdppx.exe 2904 pjlrdx.exe 1824 rvrdnl.exe 2916 ddjxh.exe 308 flnpx.exe 2912 lbrvlb.exe 2764 rjfhjhb.exe 2936 dvhff.exe 2612 rpdlljb.exe 2608 dfvrvxh.exe 592 hjjrn.exe 2716 tdbdt.exe 2012 hlhxx.exe 2496 tvfjdd.exe 3032 rjrbt.exe 1972 hpxvj.exe 2528 fhxfhb.exe 2516 rhxjvx.exe 2420 jnlvvt.exe 2252 nptvpdx.exe 2112 bpxrx.exe 2200 bhhptbp.exe 1204 jtfptf.exe 2060 jtjddp.exe 1076 phjhx.exe 1388 fdnftb.exe 1992 vjttvp.exe 1724 phhfh.exe 236 dbtnt.exe 1504 nxpjll.exe -
resource yara_rule behavioral1/memory/2592-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-592-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2980-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/388-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-777-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-785-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-919-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrbbbhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpfvdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnjfvhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddndv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntrtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnrdhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdbddb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntlvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvfnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrjnbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxftr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brnptld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfpdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdrjll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lljlrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnfnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltbjjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhxjvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdjxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blvfdtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hphxtdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drdxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htrbjtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhrdtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpvxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnbjxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lprjfhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddnflfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlpxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdhpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplrdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnvfhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtbtht.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2592 wrote to memory of 3000 2592 faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe 30 PID 2592 wrote to memory of 3000 2592 faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe 30 PID 2592 wrote to memory of 3000 2592 faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe 30 PID 2592 wrote to memory of 3000 2592 faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe 30 PID 3000 wrote to memory of 2896 3000 pprpvr.exe 31 PID 3000 wrote to memory of 2896 3000 pprpvr.exe 31 PID 3000 wrote to memory of 2896 3000 pprpvr.exe 31 PID 3000 wrote to memory of 2896 3000 pprpvr.exe 31 PID 2896 wrote to memory of 2904 2896 vfdrhll.exe 32 PID 2896 wrote to memory of 2904 2896 vfdrhll.exe 32 PID 2896 wrote to memory of 2904 2896 vfdrhll.exe 32 PID 2896 wrote to memory of 2904 2896 vfdrhll.exe 32 PID 2904 wrote to memory of 2880 2904 hhdbptp.exe 33 PID 2904 wrote to memory of 2880 2904 hhdbptp.exe 33 PID 2904 wrote to memory of 2880 2904 hhdbptp.exe 33 PID 2904 wrote to memory of 2880 2904 hhdbptp.exe 33 PID 2880 wrote to memory of 2372 2880 bjnrt.exe 34 PID 2880 wrote to memory of 2372 2880 bjnrt.exe 34 PID 2880 wrote to memory of 2372 2880 bjnrt.exe 34 PID 2880 wrote to memory of 2372 2880 bjnrt.exe 34 PID 2372 wrote to memory of 2672 2372 drndjp.exe 35 PID 2372 wrote to memory of 2672 2372 drndjp.exe 35 PID 2372 wrote to memory of 2672 2372 drndjp.exe 35 PID 2372 wrote to memory of 2672 2372 drndjp.exe 35 PID 2672 wrote to memory of 2744 2672 dfrjj.exe 36 PID 2672 wrote to memory of 2744 2672 dfrjj.exe 36 PID 2672 wrote to memory of 2744 2672 dfrjj.exe 36 PID 2672 wrote to memory of 2744 2672 dfrjj.exe 36 PID 2744 wrote to memory of 2620 2744 vbvpln.exe 37 PID 2744 wrote to memory of 2620 2744 vbvpln.exe 37 PID 2744 wrote to memory of 2620 2744 vbvpln.exe 37 PID 2744 wrote to memory of 2620 2744 vbvpln.exe 37 PID 2620 wrote to memory of 1936 2620 lnlvdrt.exe 38 PID 2620 wrote to memory of 1936 2620 lnlvdrt.exe 38 PID 2620 wrote to memory of 1936 2620 lnlvdrt.exe 38 PID 2620 wrote to memory of 1936 2620 lnlvdrt.exe 38 PID 1936 wrote to memory of 1672 1936 hljfp.exe 39 PID 1936 wrote to memory of 1672 1936 hljfp.exe 39 PID 1936 wrote to memory of 1672 1936 hljfp.exe 39 PID 1936 wrote to memory of 1672 1936 hljfp.exe 39 PID 1672 wrote to memory of 2024 1672 ltllv.exe 40 PID 1672 wrote to memory of 2024 1672 ltllv.exe 40 PID 1672 wrote to memory of 2024 1672 ltllv.exe 40 PID 1672 wrote to memory of 2024 1672 ltllv.exe 40 PID 2024 wrote to memory of 940 2024 vfjnhrd.exe 41 PID 2024 wrote to memory of 940 2024 vfjnhrd.exe 41 PID 2024 wrote to memory of 940 2024 vfjnhrd.exe 41 PID 2024 wrote to memory of 940 2024 vfjnhrd.exe 41 PID 940 wrote to memory of 2188 940 rxvlv.exe 42 PID 940 wrote to memory of 2188 940 rxvlv.exe 42 PID 940 wrote to memory of 2188 940 rxvlv.exe 42 PID 940 wrote to memory of 2188 940 rxvlv.exe 42 PID 2188 wrote to memory of 2736 2188 jdtlxlv.exe 43 PID 2188 wrote to memory of 2736 2188 jdtlxlv.exe 43 PID 2188 wrote to memory of 2736 2188 jdtlxlv.exe 43 PID 2188 wrote to memory of 2736 2188 jdtlxlv.exe 43 PID 2736 wrote to memory of 2420 2736 fpfdpl.exe 44 PID 2736 wrote to memory of 2420 2736 fpfdpl.exe 44 PID 2736 wrote to memory of 2420 2736 fpfdpl.exe 44 PID 2736 wrote to memory of 2420 2736 fpfdpl.exe 44 PID 2420 wrote to memory of 1976 2420 djttxx.exe 45 PID 2420 wrote to memory of 1976 2420 djttxx.exe 45 PID 2420 wrote to memory of 1976 2420 djttxx.exe 45 PID 2420 wrote to memory of 1976 2420 djttxx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe"C:\Users\Admin\AppData\Local\Temp\faf668ba2ea6c5bd170e74e497d9f32a0ae38a94f9d4dd44e4eab2bb56e4a0a7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\pprpvr.exec:\pprpvr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\vfdrhll.exec:\vfdrhll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\hhdbptp.exec:\hhdbptp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\bjnrt.exec:\bjnrt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\drndjp.exec:\drndjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\dfrjj.exec:\dfrjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\vbvpln.exec:\vbvpln.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\lnlvdrt.exec:\lnlvdrt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\hljfp.exec:\hljfp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\ltllv.exec:\ltllv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\vfjnhrd.exec:\vfjnhrd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\rxvlv.exec:\rxvlv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\jdtlxlv.exec:\jdtlxlv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\fpfdpl.exec:\fpfdpl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\djttxx.exec:\djttxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\nfpvnnd.exec:\nfpvnnd.exe17⤵
- Executes dropped EXE
PID:1976 -
\??\c:\fpjpt.exec:\fpjpt.exe18⤵
- Executes dropped EXE
PID:2304 -
\??\c:\hnlbnrp.exec:\hnlbnrp.exe19⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xjvfxlr.exec:\xjvfxlr.exe20⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rhtxvr.exec:\rhtxvr.exe21⤵
- Executes dropped EXE
PID:2144 -
\??\c:\lrlth.exec:\lrlth.exe22⤵
- Executes dropped EXE
PID:1540 -
\??\c:\dhhdbf.exec:\dhhdbf.exe23⤵
- Executes dropped EXE
PID:1020 -
\??\c:\nrtph.exec:\nrtph.exe24⤵
- Executes dropped EXE
PID:1556 -
\??\c:\ltnlfj.exec:\ltnlfj.exe25⤵
- Executes dropped EXE
PID:948 -
\??\c:\rbfrxdd.exec:\rbfrxdd.exe26⤵
- Executes dropped EXE
PID:1752 -
\??\c:\jxnvvv.exec:\jxnvvv.exe27⤵
- Executes dropped EXE
PID:1836 -
\??\c:\pfhbdn.exec:\pfhbdn.exe28⤵
- Executes dropped EXE
PID:1084 -
\??\c:\hbplxvt.exec:\hbplxvt.exe29⤵
- Executes dropped EXE
PID:2668 -
\??\c:\xtbtht.exec:\xtbtht.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2268 -
\??\c:\tldjv.exec:\tldjv.exe31⤵
- Executes dropped EXE
PID:1772 -
\??\c:\txbblvx.exec:\txbblvx.exe32⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vbbxf.exec:\vbbxf.exe33⤵
- Executes dropped EXE
PID:1120 -
\??\c:\fbfbl.exec:\fbfbl.exe34⤵
- Executes dropped EXE
PID:2224 -
\??\c:\lrtnrdb.exec:\lrtnrdb.exe35⤵
- Executes dropped EXE
PID:2240 -
\??\c:\xxdppx.exec:\xxdppx.exe36⤵
- Executes dropped EXE
PID:2980 -
\??\c:\pjlrdx.exec:\pjlrdx.exe37⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rvrdnl.exec:\rvrdnl.exe38⤵
- Executes dropped EXE
PID:1824 -
\??\c:\ddjxh.exec:\ddjxh.exe39⤵
- Executes dropped EXE
PID:2916 -
\??\c:\flnpx.exec:\flnpx.exe40⤵
- Executes dropped EXE
PID:308 -
\??\c:\lbrvlb.exec:\lbrvlb.exe41⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rjfhjhb.exec:\rjfhjhb.exe42⤵
- Executes dropped EXE
PID:2764 -
\??\c:\dvhff.exec:\dvhff.exe43⤵
- Executes dropped EXE
PID:2936 -
\??\c:\rpdlljb.exec:\rpdlljb.exe44⤵
- Executes dropped EXE
PID:2612 -
\??\c:\dfvrvxh.exec:\dfvrvxh.exe45⤵
- Executes dropped EXE
PID:2608 -
\??\c:\hjjrn.exec:\hjjrn.exe46⤵
- Executes dropped EXE
PID:592 -
\??\c:\tdbdt.exec:\tdbdt.exe47⤵
- Executes dropped EXE
PID:2716 -
\??\c:\hlhxx.exec:\hlhxx.exe48⤵
- Executes dropped EXE
PID:2012 -
\??\c:\tvfjdd.exec:\tvfjdd.exe49⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rjrbt.exec:\rjrbt.exe50⤵
- Executes dropped EXE
PID:3032 -
\??\c:\hpxvj.exec:\hpxvj.exe51⤵
- Executes dropped EXE
PID:1972 -
\??\c:\fhxfhb.exec:\fhxfhb.exe52⤵
- Executes dropped EXE
PID:2528 -
\??\c:\rhxjvx.exec:\rhxjvx.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2516 -
\??\c:\jnlvvt.exec:\jnlvvt.exe54⤵
- Executes dropped EXE
PID:2420 -
\??\c:\nptvpdx.exec:\nptvpdx.exe55⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bpxrx.exec:\bpxrx.exe56⤵
- Executes dropped EXE
PID:2112 -
\??\c:\bhhptbp.exec:\bhhptbp.exe57⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jtfptf.exec:\jtfptf.exe58⤵
- Executes dropped EXE
PID:1204 -
\??\c:\jtjddp.exec:\jtjddp.exe59⤵
- Executes dropped EXE
PID:2060 -
\??\c:\phjhx.exec:\phjhx.exe60⤵
- Executes dropped EXE
PID:1076 -
\??\c:\fdnftb.exec:\fdnftb.exe61⤵
- Executes dropped EXE
PID:1388 -
\??\c:\vjttvp.exec:\vjttvp.exe62⤵
- Executes dropped EXE
PID:1992 -
\??\c:\phhfh.exec:\phhfh.exe63⤵
- Executes dropped EXE
PID:1724 -
\??\c:\dbtnt.exec:\dbtnt.exe64⤵
- Executes dropped EXE
PID:236 -
\??\c:\nxpjll.exec:\nxpjll.exe65⤵
- Executes dropped EXE
PID:1504 -
\??\c:\pxndtnv.exec:\pxndtnv.exe66⤵PID:1752
-
\??\c:\xbpjdb.exec:\xbpjdb.exe67⤵PID:860
-
\??\c:\xlbnf.exec:\xlbnf.exe68⤵PID:1944
-
\??\c:\jdfxjhv.exec:\jdfxjhv.exe69⤵PID:1384
-
\??\c:\ltdjp.exec:\ltdjp.exe70⤵PID:2000
-
\??\c:\dddltdv.exec:\dddltdv.exe71⤵PID:1700
-
\??\c:\pxrvhdd.exec:\pxrvhdd.exe72⤵PID:2332
-
\??\c:\jvrlvj.exec:\jvrlvj.exe73⤵PID:2412
-
\??\c:\lnhxhb.exec:\lnhxhb.exe74⤵PID:2596
-
\??\c:\hdbrv.exec:\hdbrv.exe75⤵PID:2580
-
\??\c:\vrvvf.exec:\vrvvf.exe76⤵PID:2968
-
\??\c:\ljthf.exec:\ljthf.exe77⤵PID:2584
-
\??\c:\nphhthd.exec:\nphhthd.exe78⤵PID:2980
-
\??\c:\jbxxh.exec:\jbxxh.exe79⤵PID:2096
-
\??\c:\lvxlblj.exec:\lvxlblj.exe80⤵PID:3020
-
\??\c:\bnjdhhx.exec:\bnjdhhx.exe81⤵PID:2916
-
\??\c:\tlxpxdl.exec:\tlxpxdl.exe82⤵PID:2372
-
\??\c:\nnbtjlv.exec:\nnbtjlv.exe83⤵PID:2672
-
\??\c:\xrjrj.exec:\xrjrj.exe84⤵PID:2820
-
\??\c:\rlnfrf.exec:\rlnfrf.exe85⤵PID:2604
-
\??\c:\hpltj.exec:\hpltj.exe86⤵PID:2732
-
\??\c:\dppxntp.exec:\dppxntp.exe87⤵PID:1660
-
\??\c:\xfnjr.exec:\xfnjr.exe88⤵PID:388
-
\??\c:\xlrhj.exec:\xlrhj.exe89⤵PID:984
-
\??\c:\tdhhltf.exec:\tdhhltf.exe90⤵PID:2788
-
\??\c:\fdpxtb.exec:\fdpxtb.exe91⤵PID:896
-
\??\c:\pjnpj.exec:\pjnpj.exe92⤵PID:2508
-
\??\c:\ldjthj.exec:\ldjthj.exe93⤵PID:2188
-
\??\c:\bjhxrh.exec:\bjhxrh.exe94⤵PID:1972
-
\??\c:\fnbnh.exec:\fnbnh.exe95⤵PID:1176
-
\??\c:\lrfnpt.exec:\lrfnpt.exe96⤵PID:1108
-
\??\c:\ndxrxlj.exec:\ndxrxlj.exe97⤵PID:1536
-
\??\c:\fnrhpl.exec:\fnrhpl.exe98⤵PID:2456
-
\??\c:\jrnttr.exec:\jrnttr.exe99⤵PID:2500
-
\??\c:\xnpfr.exec:\xnpfr.exe100⤵PID:2288
-
\??\c:\nvlnf.exec:\nvlnf.exe101⤵PID:2284
-
\??\c:\drdxlrr.exec:\drdxlrr.exe102⤵
- System Location Discovery: System Language Discovery
PID:2124 -
\??\c:\fxfvnhv.exec:\fxfvnhv.exe103⤵PID:1896
-
\??\c:\lbxpfvx.exec:\lbxpfvx.exe104⤵PID:2636
-
\??\c:\vfdbr.exec:\vfdbr.exe105⤵PID:704
-
\??\c:\vrbbbhf.exec:\vrbbbhf.exe106⤵
- System Location Discovery: System Language Discovery
PID:1184 -
\??\c:\hlddx.exec:\hlddx.exe107⤵PID:2724
-
\??\c:\nptvddj.exec:\nptvddj.exe108⤵PID:2712
-
\??\c:\bbfnvx.exec:\bbfnvx.exe109⤵PID:1836
-
\??\c:\llndpv.exec:\llndpv.exe110⤵PID:860
-
\??\c:\hvdbddx.exec:\hvdbddx.exe111⤵PID:676
-
\??\c:\brxdr.exec:\brxdr.exe112⤵PID:1384
-
\??\c:\lfrtpxf.exec:\lfrtpxf.exe113⤵PID:2000
-
\??\c:\lrpxh.exec:\lrpxh.exe114⤵PID:1772
-
\??\c:\vlxlp.exec:\vlxlp.exe115⤵PID:2392
-
\??\c:\frdhnxh.exec:\frdhnxh.exe116⤵PID:2032
-
\??\c:\ljdjxhh.exec:\ljdjxhh.exe117⤵PID:664
-
\??\c:\hvvhjnj.exec:\hvvhjnj.exe118⤵PID:2580
-
\??\c:\txrpph.exec:\txrpph.exe119⤵PID:2896
-
\??\c:\ljxhpn.exec:\ljxhpn.exe120⤵PID:2584
-
\??\c:\jlhvpn.exec:\jlhvpn.exe121⤵PID:2892
-
\??\c:\rnfxhxd.exec:\rnfxhxd.exe122⤵PID:2168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-