Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 21:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
45928bd41becf97a265b366f383790d17a9b6ec477f488d395cb6cdecc531ae4.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
45928bd41becf97a265b366f383790d17a9b6ec477f488d395cb6cdecc531ae4.exe
-
Size
454KB
-
MD5
ca175a8654e17740060bd3dc7beecc4c
-
SHA1
1fca61813a09a03bc15d5d3e8904ac619cd66949
-
SHA256
45928bd41becf97a265b366f383790d17a9b6ec477f488d395cb6cdecc531ae4
-
SHA512
7b2ebc19b512ae2c36f8c9a52d2ac70ec60bfaf72ce8bb910ad43ba2eb694d79ad10d09b8535d52d8803608da17b304b54da9af807bfc20412773917138842e1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTx:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2772-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/628-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/524-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1464-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/520-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-286-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2892-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-318-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2380-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-569-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2888-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/732-800-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2872 bnthtrh.exe 2812 nhfvpbl.exe 2704 fhlnhx.exe 1860 lrddrh.exe 2668 thdnh.exe 1668 fxxdhn.exe 2976 rxnvhnr.exe 1996 lhlxflb.exe 3068 nblvflx.exe 2520 dbdhhf.exe 628 nxhvxx.exe 1684 rpllx.exe 2984 vxvhrvf.exe 1948 hdrfpn.exe 1460 rvnbrhr.exe 524 vdlnrvd.exe 2220 nbtvvr.exe 2528 pplvvp.exe 2584 vbhbjd.exe 1464 vvdrl.exe 520 vbhnht.exe 2444 jhrbnrf.exe 788 brfjvjb.exe 2612 dfrbj.exe 752 txdftl.exe 1812 rnjbpv.exe 1816 pjbtxpj.exe 1352 djddxh.exe 2328 rbjtlb.exe 2468 pttjpv.exe 2576 pnbtl.exe 2600 brhdth.exe 2892 lfndpv.exe 1536 hplfvd.exe 2860 brvbtb.exe 2696 jfbrnp.exe 2908 jdblxp.exe 2840 bljnj.exe 2804 pdjdx.exe 2824 vvdvxn.exe 2380 xjnvllb.exe 1888 rxfjdd.exe 2976 jnxdj.exe 2000 pdrnbp.exe 2476 dhxfd.exe 2616 rjnrx.exe 2964 ntbxrnh.exe 2728 fjjfh.exe 2992 tdtvp.exe 2176 thdnr.exe 2484 pxjhhhh.exe 2628 rjjhhd.exe 1776 hpntl.exe 1052 rjlhv.exe 2164 rpndjt.exe 2144 nbdftdn.exe 2232 bhxvj.exe 2548 ptrbl.exe 1060 vftvjnj.exe 1464 lbjxhbt.exe 2632 pvvjr.exe 1592 ndntbrj.exe 1960 ntxld.exe 2456 thnrbx.exe -
resource yara_rule behavioral1/memory/2772-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/524-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/520-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-569-0x00000000005C0000-0x00000000005EA000-memory.dmp upx behavioral1/memory/1988-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-653-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnbhnfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvbxjxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hflphpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhnndfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpttp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntxld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdnld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnjjnxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpvbdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrlxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhjnlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvlvhdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtvvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpndjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrhnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtnbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djxrvnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxhhpdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbxbfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjtttx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnrnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfvbjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjbxvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbhtfjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jffvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fplhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txbfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hllxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhnrpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvtjphd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpdhdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnfdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlvljx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjvdlh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2872 2772 45928bd41becf97a265b366f383790d17a9b6ec477f488d395cb6cdecc531ae4.exe 30 PID 2772 wrote to memory of 2872 2772 45928bd41becf97a265b366f383790d17a9b6ec477f488d395cb6cdecc531ae4.exe 30 PID 2772 wrote to memory of 2872 2772 45928bd41becf97a265b366f383790d17a9b6ec477f488d395cb6cdecc531ae4.exe 30 PID 2772 wrote to memory of 2872 2772 45928bd41becf97a265b366f383790d17a9b6ec477f488d395cb6cdecc531ae4.exe 30 PID 2872 wrote to memory of 2812 2872 bnthtrh.exe 31 PID 2872 wrote to memory of 2812 2872 bnthtrh.exe 31 PID 2872 wrote to memory of 2812 2872 bnthtrh.exe 31 PID 2872 wrote to memory of 2812 2872 bnthtrh.exe 31 PID 2812 wrote to memory of 2704 2812 nhfvpbl.exe 32 PID 2812 wrote to memory of 2704 2812 nhfvpbl.exe 32 PID 2812 wrote to memory of 2704 2812 nhfvpbl.exe 32 PID 2812 wrote to memory of 2704 2812 nhfvpbl.exe 32 PID 2704 wrote to memory of 1860 2704 fhlnhx.exe 33 PID 2704 wrote to memory of 1860 2704 fhlnhx.exe 33 PID 2704 wrote to memory of 1860 2704 fhlnhx.exe 33 PID 2704 wrote to memory of 1860 2704 fhlnhx.exe 33 PID 1860 wrote to memory of 2668 1860 lrddrh.exe 34 PID 1860 wrote to memory of 2668 1860 lrddrh.exe 34 PID 1860 wrote to memory of 2668 1860 lrddrh.exe 34 PID 1860 wrote to memory of 2668 1860 lrddrh.exe 34 PID 2668 wrote to memory of 1668 2668 thdnh.exe 35 PID 2668 wrote to memory of 1668 2668 thdnh.exe 35 PID 2668 wrote to memory of 1668 2668 thdnh.exe 35 PID 2668 wrote to memory of 1668 2668 thdnh.exe 35 PID 1668 wrote to memory of 2976 1668 fxxdhn.exe 36 PID 1668 wrote to memory of 2976 1668 fxxdhn.exe 36 PID 1668 wrote to memory of 2976 1668 fxxdhn.exe 36 PID 1668 wrote to memory of 2976 1668 fxxdhn.exe 36 PID 2976 wrote to memory of 1996 2976 rxnvhnr.exe 37 PID 2976 wrote to memory of 1996 2976 rxnvhnr.exe 37 PID 2976 wrote to memory of 1996 2976 rxnvhnr.exe 37 PID 2976 wrote to memory of 1996 2976 rxnvhnr.exe 37 PID 1996 wrote to memory of 3068 1996 lhlxflb.exe 38 PID 1996 wrote to memory of 3068 1996 lhlxflb.exe 38 PID 1996 wrote to memory of 3068 1996 lhlxflb.exe 38 PID 1996 wrote to memory of 3068 1996 lhlxflb.exe 38 PID 3068 wrote to memory of 2520 3068 nblvflx.exe 39 PID 3068 wrote to memory of 2520 3068 nblvflx.exe 39 PID 3068 wrote to memory of 2520 3068 nblvflx.exe 39 PID 3068 wrote to memory of 2520 3068 nblvflx.exe 39 PID 2520 wrote to memory of 628 2520 dbdhhf.exe 40 PID 2520 wrote to memory of 628 2520 dbdhhf.exe 40 PID 2520 wrote to memory of 628 2520 dbdhhf.exe 40 PID 2520 wrote to memory of 628 2520 dbdhhf.exe 40 PID 628 wrote to memory of 1684 628 nxhvxx.exe 41 PID 628 wrote to memory of 1684 628 nxhvxx.exe 41 PID 628 wrote to memory of 1684 628 nxhvxx.exe 41 PID 628 wrote to memory of 1684 628 nxhvxx.exe 41 PID 1684 wrote to memory of 2984 1684 rpllx.exe 42 PID 1684 wrote to memory of 2984 1684 rpllx.exe 42 PID 1684 wrote to memory of 2984 1684 rpllx.exe 42 PID 1684 wrote to memory of 2984 1684 rpllx.exe 42 PID 2984 wrote to memory of 1948 2984 vxvhrvf.exe 43 PID 2984 wrote to memory of 1948 2984 vxvhrvf.exe 43 PID 2984 wrote to memory of 1948 2984 vxvhrvf.exe 43 PID 2984 wrote to memory of 1948 2984 vxvhrvf.exe 43 PID 1948 wrote to memory of 1460 1948 hdrfpn.exe 44 PID 1948 wrote to memory of 1460 1948 hdrfpn.exe 44 PID 1948 wrote to memory of 1460 1948 hdrfpn.exe 44 PID 1948 wrote to memory of 1460 1948 hdrfpn.exe 44 PID 1460 wrote to memory of 524 1460 rvnbrhr.exe 45 PID 1460 wrote to memory of 524 1460 rvnbrhr.exe 45 PID 1460 wrote to memory of 524 1460 rvnbrhr.exe 45 PID 1460 wrote to memory of 524 1460 rvnbrhr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\45928bd41becf97a265b366f383790d17a9b6ec477f488d395cb6cdecc531ae4.exe"C:\Users\Admin\AppData\Local\Temp\45928bd41becf97a265b366f383790d17a9b6ec477f488d395cb6cdecc531ae4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\bnthtrh.exec:\bnthtrh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\nhfvpbl.exec:\nhfvpbl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\fhlnhx.exec:\fhlnhx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\lrddrh.exec:\lrddrh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\thdnh.exec:\thdnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\fxxdhn.exec:\fxxdhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\rxnvhnr.exec:\rxnvhnr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\lhlxflb.exec:\lhlxflb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\nblvflx.exec:\nblvflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\dbdhhf.exec:\dbdhhf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\nxhvxx.exec:\nxhvxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\rpllx.exec:\rpllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\vxvhrvf.exec:\vxvhrvf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\hdrfpn.exec:\hdrfpn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\rvnbrhr.exec:\rvnbrhr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\vdlnrvd.exec:\vdlnrvd.exe17⤵
- Executes dropped EXE
PID:524 -
\??\c:\nbtvvr.exec:\nbtvvr.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2220 -
\??\c:\pplvvp.exec:\pplvvp.exe19⤵
- Executes dropped EXE
PID:2528 -
\??\c:\vbhbjd.exec:\vbhbjd.exe20⤵
- Executes dropped EXE
PID:2584 -
\??\c:\vvdrl.exec:\vvdrl.exe21⤵
- Executes dropped EXE
PID:1464 -
\??\c:\vbhnht.exec:\vbhnht.exe22⤵
- Executes dropped EXE
PID:520 -
\??\c:\jhrbnrf.exec:\jhrbnrf.exe23⤵
- Executes dropped EXE
PID:2444 -
\??\c:\brfjvjb.exec:\brfjvjb.exe24⤵
- Executes dropped EXE
PID:788 -
\??\c:\dfrbj.exec:\dfrbj.exe25⤵
- Executes dropped EXE
PID:2612 -
\??\c:\txdftl.exec:\txdftl.exe26⤵
- Executes dropped EXE
PID:752 -
\??\c:\rnjbpv.exec:\rnjbpv.exe27⤵
- Executes dropped EXE
PID:1812 -
\??\c:\pjbtxpj.exec:\pjbtxpj.exe28⤵
- Executes dropped EXE
PID:1816 -
\??\c:\djddxh.exec:\djddxh.exe29⤵
- Executes dropped EXE
PID:1352 -
\??\c:\rbjtlb.exec:\rbjtlb.exe30⤵
- Executes dropped EXE
PID:2328 -
\??\c:\pttjpv.exec:\pttjpv.exe31⤵
- Executes dropped EXE
PID:2468 -
\??\c:\pnbtl.exec:\pnbtl.exe32⤵
- Executes dropped EXE
PID:2576 -
\??\c:\brhdth.exec:\brhdth.exe33⤵
- Executes dropped EXE
PID:2600 -
\??\c:\lfndpv.exec:\lfndpv.exe34⤵
- Executes dropped EXE
PID:2892 -
\??\c:\hplfvd.exec:\hplfvd.exe35⤵
- Executes dropped EXE
PID:1536 -
\??\c:\brvbtb.exec:\brvbtb.exe36⤵
- Executes dropped EXE
PID:2860 -
\??\c:\jfbrnp.exec:\jfbrnp.exe37⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jdblxp.exec:\jdblxp.exe38⤵
- Executes dropped EXE
PID:2908 -
\??\c:\bljnj.exec:\bljnj.exe39⤵
- Executes dropped EXE
PID:2840 -
\??\c:\pdjdx.exec:\pdjdx.exe40⤵
- Executes dropped EXE
PID:2804 -
\??\c:\vvdvxn.exec:\vvdvxn.exe41⤵
- Executes dropped EXE
PID:2824 -
\??\c:\xjnvllb.exec:\xjnvllb.exe42⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rxfjdd.exec:\rxfjdd.exe43⤵
- Executes dropped EXE
PID:1888 -
\??\c:\jnxdj.exec:\jnxdj.exe44⤵
- Executes dropped EXE
PID:2976 -
\??\c:\pdrnbp.exec:\pdrnbp.exe45⤵
- Executes dropped EXE
PID:2000 -
\??\c:\dhxfd.exec:\dhxfd.exe46⤵
- Executes dropped EXE
PID:2476 -
\??\c:\rjnrx.exec:\rjnrx.exe47⤵
- Executes dropped EXE
PID:2616 -
\??\c:\ntbxrnh.exec:\ntbxrnh.exe48⤵
- Executes dropped EXE
PID:2964 -
\??\c:\fjjfh.exec:\fjjfh.exe49⤵
- Executes dropped EXE
PID:2728 -
\??\c:\tdtvp.exec:\tdtvp.exe50⤵
- Executes dropped EXE
PID:2992 -
\??\c:\thdnr.exec:\thdnr.exe51⤵
- Executes dropped EXE
PID:2176 -
\??\c:\pxjhhhh.exec:\pxjhhhh.exe52⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rjjhhd.exec:\rjjhhd.exe53⤵
- Executes dropped EXE
PID:2628 -
\??\c:\hpntl.exec:\hpntl.exe54⤵
- Executes dropped EXE
PID:1776 -
\??\c:\rjlhv.exec:\rjlhv.exe55⤵
- Executes dropped EXE
PID:1052 -
\??\c:\rpndjt.exec:\rpndjt.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2164 -
\??\c:\nbdftdn.exec:\nbdftdn.exe57⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bhxvj.exec:\bhxvj.exe58⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ptrbl.exec:\ptrbl.exe59⤵
- Executes dropped EXE
PID:2548 -
\??\c:\vftvjnj.exec:\vftvjnj.exe60⤵
- Executes dropped EXE
PID:1060 -
\??\c:\lbjxhbt.exec:\lbjxhbt.exe61⤵
- Executes dropped EXE
PID:1464 -
\??\c:\pvvjr.exec:\pvvjr.exe62⤵
- Executes dropped EXE
PID:2632 -
\??\c:\ndntbrj.exec:\ndntbrj.exe63⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ntxld.exec:\ntxld.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1960 -
\??\c:\thnrbx.exec:\thnrbx.exe65⤵
- Executes dropped EXE
PID:2456 -
\??\c:\ndnhrdh.exec:\ndnhrdh.exe66⤵PID:1520
-
\??\c:\jjrpdjn.exec:\jjrpdjn.exe67⤵PID:736
-
\??\c:\lvdlxdl.exec:\lvdlxdl.exe68⤵PID:2344
-
\??\c:\btnlfd.exec:\btnlfd.exe69⤵PID:612
-
\??\c:\rtftvt.exec:\rtftvt.exe70⤵PID:2312
-
\??\c:\dhvxpb.exec:\dhvxpb.exe71⤵PID:1688
-
\??\c:\nxbxv.exec:\nxbxv.exe72⤵PID:560
-
\??\c:\hhbxprr.exec:\hhbxprr.exe73⤵PID:2328
-
\??\c:\lpjrr.exec:\lpjrr.exe74⤵PID:924
-
\??\c:\vnrnrx.exec:\vnrnrx.exe75⤵PID:1988
-
\??\c:\vvpdxf.exec:\vvpdxf.exe76⤵PID:2888
-
\??\c:\rdjvd.exec:\rdjvd.exe77⤵PID:2492
-
\??\c:\rhdhx.exec:\rhdhx.exe78⤵PID:604
-
\??\c:\rtfpn.exec:\rtfpn.exe79⤵PID:2936
-
\??\c:\fjhdtdl.exec:\fjhdtdl.exe80⤵PID:3048
-
\??\c:\hflphpr.exec:\hflphpr.exe81⤵
- System Location Discovery: System Language Discovery
PID:2704 -
\??\c:\rhvrrlx.exec:\rhvrrlx.exe82⤵PID:2660
-
\??\c:\bnxpjv.exec:\bnxpjv.exe83⤵PID:2732
-
\??\c:\lddndhb.exec:\lddndhb.exe84⤵PID:2096
-
\??\c:\pntvt.exec:\pntvt.exe85⤵PID:2264
-
\??\c:\lrlpjt.exec:\lrlpjt.exe86⤵PID:1196
-
\??\c:\nnjjnxj.exec:\nnjjnxj.exe87⤵
- System Location Discovery: System Language Discovery
PID:1888 -
\??\c:\pfhbft.exec:\pfhbft.exe88⤵PID:1880
-
\??\c:\rnflh.exec:\rnflh.exe89⤵PID:2072
-
\??\c:\ftxpvxr.exec:\ftxpvxr.exe90⤵PID:1924
-
\??\c:\lpprdjv.exec:\lpprdjv.exe91⤵PID:2424
-
\??\c:\lffpbrj.exec:\lffpbrj.exe92⤵PID:2964
-
\??\c:\jlvljx.exec:\jlvljx.exe93⤵
- System Location Discovery: System Language Discovery
PID:1684 -
\??\c:\phtnv.exec:\phtnv.exe94⤵PID:2132
-
\??\c:\hldlpb.exec:\hldlpb.exe95⤵PID:2084
-
\??\c:\vldpp.exec:\vldpp.exe96⤵PID:676
-
\??\c:\vjdbn.exec:\vjdbn.exe97⤵PID:1460
-
\??\c:\prlpjb.exec:\prlpjb.exe98⤵PID:1748
-
\??\c:\bhjhnxv.exec:\bhjhnxv.exe99⤵PID:2156
-
\??\c:\ftxtp.exec:\ftxtp.exe100⤵PID:2236
-
\??\c:\jrrvtlx.exec:\jrrvtlx.exe101⤵PID:1868
-
\??\c:\blrtpt.exec:\blrtpt.exe102⤵PID:956
-
\??\c:\nlfhb.exec:\nlfhb.exe103⤵PID:2200
-
\??\c:\xffrr.exec:\xffrr.exe104⤵PID:2320
-
\??\c:\tbhnpnv.exec:\tbhnpnv.exe105⤵PID:732
-
\??\c:\dfhjvl.exec:\dfhjvl.exe106⤵PID:2444
-
\??\c:\rlltp.exec:\rlltp.exe107⤵PID:2552
-
\??\c:\fxdxdr.exec:\fxdxdr.exe108⤵PID:2040
-
\??\c:\tndxt.exec:\tndxt.exe109⤵PID:2536
-
\??\c:\pfhprh.exec:\pfhprh.exe110⤵PID:3032
-
\??\c:\rtfhvbp.exec:\rtfhvbp.exe111⤵PID:588
-
\??\c:\jfpdtl.exec:\jfpdtl.exe112⤵PID:2556
-
\??\c:\pblhrv.exec:\pblhrv.exe113⤵PID:2636
-
\??\c:\nrbxvpn.exec:\nrbxvpn.exe114⤵PID:2480
-
\??\c:\hfxlvfr.exec:\hfxlvfr.exe115⤵PID:340
-
\??\c:\xjxdrb.exec:\xjxdrb.exe116⤵PID:1068
-
\??\c:\bdrxr.exec:\bdrxr.exe117⤵PID:1896
-
\??\c:\bhnfph.exec:\bhnfph.exe118⤵PID:2864
-
\??\c:\xnlhbp.exec:\xnlhbp.exe119⤵PID:1988
-
\??\c:\jbtlvf.exec:\jbtlvf.exe120⤵PID:3064
-
\??\c:\fjhfn.exec:\fjhfn.exe121⤵PID:2784
-
\??\c:\hnjpn.exec:\hnjpn.exe122⤵PID:2828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-