Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 21:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9fc21b0e96d85ca8b4594e119613536cb44630d7a4b64a38b377f44ab4ca8d1e.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
9fc21b0e96d85ca8b4594e119613536cb44630d7a4b64a38b377f44ab4ca8d1e.exe
-
Size
454KB
-
MD5
9b75724fbeca4f69021aa0b85dab37c0
-
SHA1
11d83416871bcbc8633c9459a878d7018fa7e543
-
SHA256
9fc21b0e96d85ca8b4594e119613536cb44630d7a4b64a38b377f44ab4ca8d1e
-
SHA512
dfd37a1ad16dac7a32311183238406d0a80ff0239cac7626640812f9ff8a784825e5c3f74fb3ff951b1cb8b7064b10537b1b14adefb6d844467aeaf084748228
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT8:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/572-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-25-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2396-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/676-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/280-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-295-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2404-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-316-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2536-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/924-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-449-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2984-465-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1288-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-534-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1484-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-552-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2600-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-707-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2300 prhvdnp.exe 2396 ttfvf.exe 2932 tjdlnb.exe 2880 dxdxlxh.exe 2688 tlhpd.exe 2856 tvnjtx.exe 2728 tbjhl.exe 2292 jpjbl.exe 1808 phlhtjp.exe 1236 hdtrtlh.exe 2588 btxdlpd.exe 2956 hhtxltd.exe 2752 bljrd.exe 2512 xxtdhl.exe 3012 ftdrlt.exe 896 hrjhll.exe 976 jpbppvv.exe 1988 nlljbf.exe 2108 hvhbptt.exe 676 jblxdt.exe 2344 xrnltp.exe 2216 tjlxfxf.exe 1804 nxtxbxl.exe 280 nppvbpb.exe 2456 rblhfpr.exe 1020 bbtxftv.exe 1724 flxhj.exe 1712 rbtxf.exe 2028 lnbttp.exe 2280 flttptb.exe 2480 dbjlv.exe 2404 rbtfh.exe 2536 rxnxhx.exe 1548 tdvvxh.exe 1608 nrhll.exe 2792 nnrdp.exe 2396 dfpxrll.exe 2464 hrrndtn.exe 2060 vrhhd.exe 2116 vxbnbjb.exe 2860 hpllpr.exe 1144 dthlft.exe 2708 nxvjjjb.exe 2888 jfpnfd.exe 2036 dtxvh.exe 1432 nbdpvpx.exe 1260 lrrrd.exe 924 djvlhdt.exe 1744 lbdbx.exe 640 txpbn.exe 2948 vxfnf.exe 2752 btfpv.exe 2984 rjvlb.exe 1060 tttthft.exe 2444 djfddhx.exe 2276 vxhhjlf.exe 1528 thxjpfx.exe 2112 vtblxvl.exe 1872 fjjlpbp.exe 2208 ppjbp.exe 2392 ffhdvtb.exe 1952 tppdjjr.exe 1056 ptvtlbr.exe 948 vnvdnh.exe -
resource yara_rule behavioral1/memory/572-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-47-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2688-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/280-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-316-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2536-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-789-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-809-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtjvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpxljp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnrdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbnvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxbnbjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llvbdfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldjjnpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pflnrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvxxdll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvjxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvrjjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flbpvxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtddt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxtpxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdbdxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pblnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvprt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvvjtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lddhtjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftdrdvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhxjhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbdbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlpvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfhjvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btfpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtdtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnxrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hftxlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjhfljx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbjthvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptxttrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpxpnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnprvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfdhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnnhphr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlfjbrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttpxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvhdth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlfjldr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpbbl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 572 wrote to memory of 2300 572 9fc21b0e96d85ca8b4594e119613536cb44630d7a4b64a38b377f44ab4ca8d1e.exe 29 PID 572 wrote to memory of 2300 572 9fc21b0e96d85ca8b4594e119613536cb44630d7a4b64a38b377f44ab4ca8d1e.exe 29 PID 572 wrote to memory of 2300 572 9fc21b0e96d85ca8b4594e119613536cb44630d7a4b64a38b377f44ab4ca8d1e.exe 29 PID 572 wrote to memory of 2300 572 9fc21b0e96d85ca8b4594e119613536cb44630d7a4b64a38b377f44ab4ca8d1e.exe 29 PID 2300 wrote to memory of 2396 2300 prhvdnp.exe 30 PID 2300 wrote to memory of 2396 2300 prhvdnp.exe 30 PID 2300 wrote to memory of 2396 2300 prhvdnp.exe 30 PID 2300 wrote to memory of 2396 2300 prhvdnp.exe 30 PID 2396 wrote to memory of 2932 2396 ttfvf.exe 31 PID 2396 wrote to memory of 2932 2396 ttfvf.exe 31 PID 2396 wrote to memory of 2932 2396 ttfvf.exe 31 PID 2396 wrote to memory of 2932 2396 ttfvf.exe 31 PID 2932 wrote to memory of 2880 2932 tjdlnb.exe 32 PID 2932 wrote to memory of 2880 2932 tjdlnb.exe 32 PID 2932 wrote to memory of 2880 2932 tjdlnb.exe 32 PID 2932 wrote to memory of 2880 2932 tjdlnb.exe 32 PID 2880 wrote to memory of 2688 2880 dxdxlxh.exe 33 PID 2880 wrote to memory of 2688 2880 dxdxlxh.exe 33 PID 2880 wrote to memory of 2688 2880 dxdxlxh.exe 33 PID 2880 wrote to memory of 2688 2880 dxdxlxh.exe 33 PID 2688 wrote to memory of 2856 2688 tlhpd.exe 34 PID 2688 wrote to memory of 2856 2688 tlhpd.exe 34 PID 2688 wrote to memory of 2856 2688 tlhpd.exe 34 PID 2688 wrote to memory of 2856 2688 tlhpd.exe 34 PID 2856 wrote to memory of 2728 2856 tvnjtx.exe 35 PID 2856 wrote to memory of 2728 2856 tvnjtx.exe 35 PID 2856 wrote to memory of 2728 2856 tvnjtx.exe 35 PID 2856 wrote to memory of 2728 2856 tvnjtx.exe 35 PID 2728 wrote to memory of 2292 2728 tbjhl.exe 36 PID 2728 wrote to memory of 2292 2728 tbjhl.exe 36 PID 2728 wrote to memory of 2292 2728 tbjhl.exe 36 PID 2728 wrote to memory of 2292 2728 tbjhl.exe 36 PID 2292 wrote to memory of 1808 2292 jpjbl.exe 37 PID 2292 wrote to memory of 1808 2292 jpjbl.exe 37 PID 2292 wrote to memory of 1808 2292 jpjbl.exe 37 PID 2292 wrote to memory of 1808 2292 jpjbl.exe 37 PID 1808 wrote to memory of 1236 1808 phlhtjp.exe 38 PID 1808 wrote to memory of 1236 1808 phlhtjp.exe 38 PID 1808 wrote to memory of 1236 1808 phlhtjp.exe 38 PID 1808 wrote to memory of 1236 1808 phlhtjp.exe 38 PID 1236 wrote to memory of 2588 1236 hdtrtlh.exe 39 PID 1236 wrote to memory of 2588 1236 hdtrtlh.exe 39 PID 1236 wrote to memory of 2588 1236 hdtrtlh.exe 39 PID 1236 wrote to memory of 2588 1236 hdtrtlh.exe 39 PID 2588 wrote to memory of 2956 2588 btxdlpd.exe 40 PID 2588 wrote to memory of 2956 2588 btxdlpd.exe 40 PID 2588 wrote to memory of 2956 2588 btxdlpd.exe 40 PID 2588 wrote to memory of 2956 2588 btxdlpd.exe 40 PID 2956 wrote to memory of 2752 2956 hhtxltd.exe 41 PID 2956 wrote to memory of 2752 2956 hhtxltd.exe 41 PID 2956 wrote to memory of 2752 2956 hhtxltd.exe 41 PID 2956 wrote to memory of 2752 2956 hhtxltd.exe 41 PID 2752 wrote to memory of 2512 2752 bljrd.exe 42 PID 2752 wrote to memory of 2512 2752 bljrd.exe 42 PID 2752 wrote to memory of 2512 2752 bljrd.exe 42 PID 2752 wrote to memory of 2512 2752 bljrd.exe 42 PID 2512 wrote to memory of 3012 2512 xxtdhl.exe 43 PID 2512 wrote to memory of 3012 2512 xxtdhl.exe 43 PID 2512 wrote to memory of 3012 2512 xxtdhl.exe 43 PID 2512 wrote to memory of 3012 2512 xxtdhl.exe 43 PID 3012 wrote to memory of 896 3012 ftdrlt.exe 44 PID 3012 wrote to memory of 896 3012 ftdrlt.exe 44 PID 3012 wrote to memory of 896 3012 ftdrlt.exe 44 PID 3012 wrote to memory of 896 3012 ftdrlt.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fc21b0e96d85ca8b4594e119613536cb44630d7a4b64a38b377f44ab4ca8d1e.exe"C:\Users\Admin\AppData\Local\Temp\9fc21b0e96d85ca8b4594e119613536cb44630d7a4b64a38b377f44ab4ca8d1e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\prhvdnp.exec:\prhvdnp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\ttfvf.exec:\ttfvf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\tjdlnb.exec:\tjdlnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\dxdxlxh.exec:\dxdxlxh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\tlhpd.exec:\tlhpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\tvnjtx.exec:\tvnjtx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\tbjhl.exec:\tbjhl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\jpjbl.exec:\jpjbl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\phlhtjp.exec:\phlhtjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\hdtrtlh.exec:\hdtrtlh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\btxdlpd.exec:\btxdlpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\hhtxltd.exec:\hhtxltd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\bljrd.exec:\bljrd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\xxtdhl.exec:\xxtdhl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\ftdrlt.exec:\ftdrlt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\hrjhll.exec:\hrjhll.exe17⤵
- Executes dropped EXE
PID:896 -
\??\c:\jpbppvv.exec:\jpbppvv.exe18⤵
- Executes dropped EXE
PID:976 -
\??\c:\nlljbf.exec:\nlljbf.exe19⤵
- Executes dropped EXE
PID:1988 -
\??\c:\hvhbptt.exec:\hvhbptt.exe20⤵
- Executes dropped EXE
PID:2108 -
\??\c:\jblxdt.exec:\jblxdt.exe21⤵
- Executes dropped EXE
PID:676 -
\??\c:\xrnltp.exec:\xrnltp.exe22⤵
- Executes dropped EXE
PID:2344 -
\??\c:\tjlxfxf.exec:\tjlxfxf.exe23⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nxtxbxl.exec:\nxtxbxl.exe24⤵
- Executes dropped EXE
PID:1804 -
\??\c:\nppvbpb.exec:\nppvbpb.exe25⤵
- Executes dropped EXE
PID:280 -
\??\c:\rblhfpr.exec:\rblhfpr.exe26⤵
- Executes dropped EXE
PID:2456 -
\??\c:\bbtxftv.exec:\bbtxftv.exe27⤵
- Executes dropped EXE
PID:1020 -
\??\c:\flxhj.exec:\flxhj.exe28⤵
- Executes dropped EXE
PID:1724 -
\??\c:\rbtxf.exec:\rbtxf.exe29⤵
- Executes dropped EXE
PID:1712 -
\??\c:\lnbttp.exec:\lnbttp.exe30⤵
- Executes dropped EXE
PID:2028 -
\??\c:\flttptb.exec:\flttptb.exe31⤵
- Executes dropped EXE
PID:2280 -
\??\c:\dbjlv.exec:\dbjlv.exe32⤵
- Executes dropped EXE
PID:2480 -
\??\c:\rbtfh.exec:\rbtfh.exe33⤵
- Executes dropped EXE
PID:2404 -
\??\c:\rxnxhx.exec:\rxnxhx.exe34⤵
- Executes dropped EXE
PID:2536 -
\??\c:\tdvvxh.exec:\tdvvxh.exe35⤵
- Executes dropped EXE
PID:1548 -
\??\c:\nrhll.exec:\nrhll.exe36⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nnrdp.exec:\nnrdp.exe37⤵
- Executes dropped EXE
PID:2792 -
\??\c:\dfpxrll.exec:\dfpxrll.exe38⤵
- Executes dropped EXE
PID:2396 -
\??\c:\hrrndtn.exec:\hrrndtn.exe39⤵
- Executes dropped EXE
PID:2464 -
\??\c:\vrhhd.exec:\vrhhd.exe40⤵
- Executes dropped EXE
PID:2060 -
\??\c:\vxbnbjb.exec:\vxbnbjb.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2116 -
\??\c:\hpllpr.exec:\hpllpr.exe42⤵
- Executes dropped EXE
PID:2860 -
\??\c:\dthlft.exec:\dthlft.exe43⤵
- Executes dropped EXE
PID:1144 -
\??\c:\nxvjjjb.exec:\nxvjjjb.exe44⤵
- Executes dropped EXE
PID:2708 -
\??\c:\jfpnfd.exec:\jfpnfd.exe45⤵
- Executes dropped EXE
PID:2888 -
\??\c:\dtxvh.exec:\dtxvh.exe46⤵
- Executes dropped EXE
PID:2036 -
\??\c:\nbdpvpx.exec:\nbdpvpx.exe47⤵
- Executes dropped EXE
PID:1432 -
\??\c:\lrrrd.exec:\lrrrd.exe48⤵
- Executes dropped EXE
PID:1260 -
\??\c:\djvlhdt.exec:\djvlhdt.exe49⤵
- Executes dropped EXE
PID:924 -
\??\c:\lbdbx.exec:\lbdbx.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1744 -
\??\c:\txpbn.exec:\txpbn.exe51⤵
- Executes dropped EXE
PID:640 -
\??\c:\vxfnf.exec:\vxfnf.exe52⤵
- Executes dropped EXE
PID:2948 -
\??\c:\btfpv.exec:\btfpv.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2752 -
\??\c:\rjvlb.exec:\rjvlb.exe54⤵
- Executes dropped EXE
PID:2984 -
\??\c:\tttthft.exec:\tttthft.exe55⤵
- Executes dropped EXE
PID:1060 -
\??\c:\djfddhx.exec:\djfddhx.exe56⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vxhhjlf.exec:\vxhhjlf.exe57⤵
- Executes dropped EXE
PID:2276 -
\??\c:\thxjpfx.exec:\thxjpfx.exe58⤵
- Executes dropped EXE
PID:1528 -
\??\c:\vtblxvl.exec:\vtblxvl.exe59⤵
- Executes dropped EXE
PID:2112 -
\??\c:\fjjlpbp.exec:\fjjlpbp.exe60⤵
- Executes dropped EXE
PID:1872 -
\??\c:\ppjbp.exec:\ppjbp.exe61⤵
- Executes dropped EXE
PID:2208 -
\??\c:\ffhdvtb.exec:\ffhdvtb.exe62⤵
- Executes dropped EXE
PID:2392 -
\??\c:\tppdjjr.exec:\tppdjjr.exe63⤵
- Executes dropped EXE
PID:1952 -
\??\c:\ptvtlbr.exec:\ptvtlbr.exe64⤵
- Executes dropped EXE
PID:1056 -
\??\c:\vnvdnh.exec:\vnvdnh.exe65⤵
- Executes dropped EXE
PID:948 -
\??\c:\fjrfdr.exec:\fjrfdr.exe66⤵PID:1288
-
\??\c:\jpfvldb.exec:\jpfvldb.exe67⤵PID:2528
-
\??\c:\rtlhh.exec:\rtlhh.exe68⤵PID:1380
-
\??\c:\fpppjfh.exec:\fpppjfh.exe69⤵PID:1484
-
\??\c:\txrvh.exec:\txrvh.exe70⤵PID:2524
-
\??\c:\nvbrjt.exec:\nvbrjt.exe71⤵PID:1724
-
\??\c:\jnfrlv.exec:\jnfrlv.exe72⤵PID:2016
-
\??\c:\pbjvbv.exec:\pbjvbv.exe73⤵PID:1468
-
\??\c:\dlnrt.exec:\dlnrt.exe74⤵PID:108
-
\??\c:\dpdbptt.exec:\dpdbptt.exe75⤵PID:1844
-
\??\c:\dndftff.exec:\dndftff.exe76⤵PID:2600
-
\??\c:\fnxjn.exec:\fnxjn.exe77⤵PID:1704
-
\??\c:\bjvrd.exec:\bjvrd.exe78⤵PID:2536
-
\??\c:\ftrdfb.exec:\ftrdfb.exe79⤵PID:2228
-
\??\c:\fnxtr.exec:\fnxtr.exe80⤵PID:2808
-
\??\c:\jflnt.exec:\jflnt.exe81⤵PID:2904
-
\??\c:\pvxlllb.exec:\pvxlllb.exe82⤵PID:2896
-
\??\c:\htxvtt.exec:\htxvtt.exe83⤵PID:2932
-
\??\c:\xpldl.exec:\xpldl.exe84⤵PID:2880
-
\??\c:\jnhxhv.exec:\jnhxhv.exe85⤵PID:2704
-
\??\c:\fldhvvh.exec:\fldhvvh.exe86⤵PID:2776
-
\??\c:\bvtdlrx.exec:\bvtdlrx.exe87⤵PID:2684
-
\??\c:\hjjfrrl.exec:\hjjfrrl.exe88⤵PID:2492
-
\??\c:\jrntv.exec:\jrntv.exe89⤵PID:1640
-
\??\c:\xbnnbnb.exec:\xbnnbnb.exe90⤵PID:2944
-
\??\c:\xxbdjhp.exec:\xxbdjhp.exe91⤵PID:2036
-
\??\c:\vpbtd.exec:\vpbtd.exe92⤵PID:2244
-
\??\c:\vfhrl.exec:\vfhrl.exe93⤵PID:3056
-
\??\c:\hftnxrt.exec:\hftnxrt.exe94⤵PID:2032
-
\??\c:\tpnlvdh.exec:\tpnlvdh.exe95⤵PID:2952
-
\??\c:\vlxdx.exec:\vlxdx.exe96⤵PID:3008
-
\??\c:\dfflr.exec:\dfflr.exe97⤵PID:848
-
\??\c:\ptvth.exec:\ptvth.exe98⤵PID:2572
-
\??\c:\hjnhdvb.exec:\hjnhdvb.exe99⤵PID:2368
-
\??\c:\lxthbbt.exec:\lxthbbt.exe100⤵PID:1060
-
\??\c:\fvxfdh.exec:\fvxfdh.exe101⤵PID:1212
-
\??\c:\rlpvdd.exec:\rlpvdd.exe102⤵
- System Location Discovery: System Language Discovery
PID:2064 -
\??\c:\dhlxbb.exec:\dhlxbb.exe103⤵PID:1644
-
\??\c:\hpbbl.exec:\hpbbl.exe104⤵
- System Location Discovery: System Language Discovery
PID:2176 -
\??\c:\fpjfdbx.exec:\fpjfdbx.exe105⤵PID:2224
-
\??\c:\plljx.exec:\plljx.exe106⤵PID:2208
-
\??\c:\djrnt.exec:\djrnt.exe107⤵PID:2548
-
\??\c:\pdnrr.exec:\pdnrr.exe108⤵PID:1952
-
\??\c:\xxnhvv.exec:\xxnhvv.exe109⤵PID:1056
-
\??\c:\lvdjl.exec:\lvdjl.exe110⤵PID:948
-
\??\c:\hntdd.exec:\hntdd.exe111⤵PID:1008
-
\??\c:\rtdjvbh.exec:\rtdjvbh.exe112⤵PID:2528
-
\??\c:\xhtnrd.exec:\xhtnrd.exe113⤵PID:440
-
\??\c:\hlhxjvn.exec:\hlhxjvn.exe114⤵PID:920
-
\??\c:\pvndht.exec:\pvndht.exe115⤵PID:1868
-
\??\c:\jdvtbl.exec:\jdvtbl.exe116⤵PID:2616
-
\??\c:\ndtlhn.exec:\ndtlhn.exe117⤵PID:2028
-
\??\c:\hntfdtf.exec:\hntfdtf.exe118⤵PID:2416
-
\??\c:\pppnb.exec:\pppnb.exe119⤵PID:1816
-
\??\c:\frhdt.exec:\frhdt.exe120⤵PID:996
-
\??\c:\xxndtx.exec:\xxndtx.exe121⤵PID:2284
-
\??\c:\bbhvrh.exec:\bbhvrh.exe122⤵PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-