Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 21:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
69ed042324b4c2b34b6265cb5158f6b9d72041f8261663186077af672c038f5bN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
69ed042324b4c2b34b6265cb5158f6b9d72041f8261663186077af672c038f5bN.exe
-
Size
453KB
-
MD5
1430608c5294f0bcc2c142e04e3154e0
-
SHA1
dc1696e4d6442963685abab3472472810d71e358
-
SHA256
69ed042324b4c2b34b6265cb5158f6b9d72041f8261663186077af672c038f5b
-
SHA512
38dc6fefdc43885b801af47adce935caf38a74cbdb3f20831fe998420c046a3a407272a457678528e902e29b449a220ee16da16a80cf1c61ba69fbcd8444bbed
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet:q7Tc2NYHUrAwfMp3CDt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2248-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-84-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2012-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-113-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3052-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-189-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2212-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-244-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/860-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-252-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1380-274-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2968-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-376-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1172-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-415-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2360-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-430-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2932-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-628-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2588-642-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2212-775-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-788-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2840 rbvtvjv.exe 2956 xtthfr.exe 2888 bjfnrd.exe 2756 hxhdvnf.exe 2924 tdhlnv.exe 2860 xhhnbr.exe 2780 pvjntp.exe 2796 rjrphfp.exe 3048 ljvnj.exe 2012 rvjtbbf.exe 2816 njfrpf.exe 3052 btxjd.exe 2188 xjfttjx.exe 2120 dbpfh.exe 2656 nbppdh.exe 324 dbhrnf.exe 2260 rthrnxr.exe 1760 nbvxbp.exe 2568 rxvfhrn.exe 2212 hdfff.exe 980 nxfpr.exe 1992 dfxftl.exe 1724 plxbbnp.exe 236 bfxrh.exe 1380 fxfnx.exe 860 rdnpdxh.exe 2680 fnptnr.exe 2384 jfvlv.exe 332 jrbjn.exe 1928 vpfbjv.exe 664 bvnnn.exe 2240 vvxlt.exe 2236 ntthrh.exe 2968 vlvddp.exe 2204 jrndjd.exe 3004 ddrlhr.exe 3008 xfvrt.exe 928 djxfp.exe 2996 xdxfnnv.exe 2912 frvldbr.exe 2768 xxfhx.exe 2624 lljxb.exe 2560 fpjpnfn.exe 868 hbrpx.exe 1172 nxtdbnd.exe 1532 blblbv.exe 3028 vfjhpn.exe 2360 tdlbjf.exe 2108 rvbrhtp.exe 1444 lttnbd.exe 2696 pbtlt.exe 2932 dfpnnbv.exe 1932 bdhdpt.exe 2308 bldtxbr.exe 2304 rhltvjj.exe 2260 nvvrb.exe 2300 jdhtdfj.exe 2060 xvbjl.exe 1072 rrnjnld.exe 1020 ftxrl.exe 560 dnrjhxn.exe 2428 hvvdbbd.exe 1668 drbdd.exe 1748 llfntj.exe -
resource yara_rule behavioral1/memory/2248-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-113-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3052-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-376-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1172-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-415-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2360-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-430-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2932-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-621-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1624-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-775-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-789-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfbpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdbddf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbvpbhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtjpnfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdhrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brvlddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hddrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dltpftn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrthl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plvrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvhrfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffnxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbpltf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnjhrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vljxdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvfdlhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvhrbtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fndtfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfxdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxxbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbjdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbvjth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfbxnxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brvvdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdxhtdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlhtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhrjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhjjjnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhntxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hndrrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxnvfnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldhlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvrvjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrjnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxpdfpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbrrljj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjpbvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvfvlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvrdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlfhlvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brprjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjbjd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2840 2248 69ed042324b4c2b34b6265cb5158f6b9d72041f8261663186077af672c038f5bN.exe 30 PID 2248 wrote to memory of 2840 2248 69ed042324b4c2b34b6265cb5158f6b9d72041f8261663186077af672c038f5bN.exe 30 PID 2248 wrote to memory of 2840 2248 69ed042324b4c2b34b6265cb5158f6b9d72041f8261663186077af672c038f5bN.exe 30 PID 2248 wrote to memory of 2840 2248 69ed042324b4c2b34b6265cb5158f6b9d72041f8261663186077af672c038f5bN.exe 30 PID 2840 wrote to memory of 2956 2840 rbvtvjv.exe 31 PID 2840 wrote to memory of 2956 2840 rbvtvjv.exe 31 PID 2840 wrote to memory of 2956 2840 rbvtvjv.exe 31 PID 2840 wrote to memory of 2956 2840 rbvtvjv.exe 31 PID 2956 wrote to memory of 2888 2956 xtthfr.exe 32 PID 2956 wrote to memory of 2888 2956 xtthfr.exe 32 PID 2956 wrote to memory of 2888 2956 xtthfr.exe 32 PID 2956 wrote to memory of 2888 2956 xtthfr.exe 32 PID 2888 wrote to memory of 2756 2888 bjfnrd.exe 33 PID 2888 wrote to memory of 2756 2888 bjfnrd.exe 33 PID 2888 wrote to memory of 2756 2888 bjfnrd.exe 33 PID 2888 wrote to memory of 2756 2888 bjfnrd.exe 33 PID 2756 wrote to memory of 2924 2756 hxhdvnf.exe 34 PID 2756 wrote to memory of 2924 2756 hxhdvnf.exe 34 PID 2756 wrote to memory of 2924 2756 hxhdvnf.exe 34 PID 2756 wrote to memory of 2924 2756 hxhdvnf.exe 34 PID 2924 wrote to memory of 2860 2924 tdhlnv.exe 35 PID 2924 wrote to memory of 2860 2924 tdhlnv.exe 35 PID 2924 wrote to memory of 2860 2924 tdhlnv.exe 35 PID 2924 wrote to memory of 2860 2924 tdhlnv.exe 35 PID 2860 wrote to memory of 2780 2860 xhhnbr.exe 36 PID 2860 wrote to memory of 2780 2860 xhhnbr.exe 36 PID 2860 wrote to memory of 2780 2860 xhhnbr.exe 36 PID 2860 wrote to memory of 2780 2860 xhhnbr.exe 36 PID 2780 wrote to memory of 2796 2780 pvjntp.exe 37 PID 2780 wrote to memory of 2796 2780 pvjntp.exe 37 PID 2780 wrote to memory of 2796 2780 pvjntp.exe 37 PID 2780 wrote to memory of 2796 2780 pvjntp.exe 37 PID 2796 wrote to memory of 3048 2796 rjrphfp.exe 38 PID 2796 wrote to memory of 3048 2796 rjrphfp.exe 38 PID 2796 wrote to memory of 3048 2796 rjrphfp.exe 38 PID 2796 wrote to memory of 3048 2796 rjrphfp.exe 38 PID 3048 wrote to memory of 2012 3048 ljvnj.exe 39 PID 3048 wrote to memory of 2012 3048 ljvnj.exe 39 PID 3048 wrote to memory of 2012 3048 ljvnj.exe 39 PID 3048 wrote to memory of 2012 3048 ljvnj.exe 39 PID 2012 wrote to memory of 2816 2012 rvjtbbf.exe 40 PID 2012 wrote to memory of 2816 2012 rvjtbbf.exe 40 PID 2012 wrote to memory of 2816 2012 rvjtbbf.exe 40 PID 2012 wrote to memory of 2816 2012 rvjtbbf.exe 40 PID 2816 wrote to memory of 3052 2816 njfrpf.exe 41 PID 2816 wrote to memory of 3052 2816 njfrpf.exe 41 PID 2816 wrote to memory of 3052 2816 njfrpf.exe 41 PID 2816 wrote to memory of 3052 2816 njfrpf.exe 41 PID 3052 wrote to memory of 2188 3052 btxjd.exe 42 PID 3052 wrote to memory of 2188 3052 btxjd.exe 42 PID 3052 wrote to memory of 2188 3052 btxjd.exe 42 PID 3052 wrote to memory of 2188 3052 btxjd.exe 42 PID 2188 wrote to memory of 2120 2188 xjfttjx.exe 43 PID 2188 wrote to memory of 2120 2188 xjfttjx.exe 43 PID 2188 wrote to memory of 2120 2188 xjfttjx.exe 43 PID 2188 wrote to memory of 2120 2188 xjfttjx.exe 43 PID 2120 wrote to memory of 2656 2120 dbpfh.exe 44 PID 2120 wrote to memory of 2656 2120 dbpfh.exe 44 PID 2120 wrote to memory of 2656 2120 dbpfh.exe 44 PID 2120 wrote to memory of 2656 2120 dbpfh.exe 44 PID 2656 wrote to memory of 324 2656 nbppdh.exe 45 PID 2656 wrote to memory of 324 2656 nbppdh.exe 45 PID 2656 wrote to memory of 324 2656 nbppdh.exe 45 PID 2656 wrote to memory of 324 2656 nbppdh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\69ed042324b4c2b34b6265cb5158f6b9d72041f8261663186077af672c038f5bN.exe"C:\Users\Admin\AppData\Local\Temp\69ed042324b4c2b34b6265cb5158f6b9d72041f8261663186077af672c038f5bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\rbvtvjv.exec:\rbvtvjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\xtthfr.exec:\xtthfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\bjfnrd.exec:\bjfnrd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\hxhdvnf.exec:\hxhdvnf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\tdhlnv.exec:\tdhlnv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\xhhnbr.exec:\xhhnbr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\pvjntp.exec:\pvjntp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\rjrphfp.exec:\rjrphfp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\ljvnj.exec:\ljvnj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\rvjtbbf.exec:\rvjtbbf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\njfrpf.exec:\njfrpf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\btxjd.exec:\btxjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\xjfttjx.exec:\xjfttjx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\dbpfh.exec:\dbpfh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\nbppdh.exec:\nbppdh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\dbhrnf.exec:\dbhrnf.exe17⤵
- Executes dropped EXE
PID:324 -
\??\c:\rthrnxr.exec:\rthrnxr.exe18⤵
- Executes dropped EXE
PID:2260 -
\??\c:\nbvxbp.exec:\nbvxbp.exe19⤵
- Executes dropped EXE
PID:1760 -
\??\c:\rxvfhrn.exec:\rxvfhrn.exe20⤵
- Executes dropped EXE
PID:2568 -
\??\c:\hdfff.exec:\hdfff.exe21⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nxfpr.exec:\nxfpr.exe22⤵
- Executes dropped EXE
PID:980 -
\??\c:\dfxftl.exec:\dfxftl.exe23⤵
- Executes dropped EXE
PID:1992 -
\??\c:\plxbbnp.exec:\plxbbnp.exe24⤵
- Executes dropped EXE
PID:1724 -
\??\c:\bfxrh.exec:\bfxrh.exe25⤵
- Executes dropped EXE
PID:236 -
\??\c:\fxfnx.exec:\fxfnx.exe26⤵
- Executes dropped EXE
PID:1380 -
\??\c:\rdnpdxh.exec:\rdnpdxh.exe27⤵
- Executes dropped EXE
PID:860 -
\??\c:\fnptnr.exec:\fnptnr.exe28⤵
- Executes dropped EXE
PID:2680 -
\??\c:\jfvlv.exec:\jfvlv.exe29⤵
- Executes dropped EXE
PID:2384 -
\??\c:\jrbjn.exec:\jrbjn.exe30⤵
- Executes dropped EXE
PID:332 -
\??\c:\vpfbjv.exec:\vpfbjv.exe31⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bvnnn.exec:\bvnnn.exe32⤵
- Executes dropped EXE
PID:664 -
\??\c:\vvxlt.exec:\vvxlt.exe33⤵
- Executes dropped EXE
PID:2240 -
\??\c:\ntthrh.exec:\ntthrh.exe34⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vlvddp.exec:\vlvddp.exe35⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jrndjd.exec:\jrndjd.exe36⤵
- Executes dropped EXE
PID:2204 -
\??\c:\ddrlhr.exec:\ddrlhr.exe37⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xfvrt.exec:\xfvrt.exe38⤵
- Executes dropped EXE
PID:3008 -
\??\c:\djxfp.exec:\djxfp.exe39⤵
- Executes dropped EXE
PID:928 -
\??\c:\xdxfnnv.exec:\xdxfnnv.exe40⤵
- Executes dropped EXE
PID:2996 -
\??\c:\frvldbr.exec:\frvldbr.exe41⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xxfhx.exec:\xxfhx.exe42⤵
- Executes dropped EXE
PID:2768 -
\??\c:\lljxb.exec:\lljxb.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\fpjpnfn.exec:\fpjpnfn.exe44⤵
- Executes dropped EXE
PID:2560 -
\??\c:\hbrpx.exec:\hbrpx.exe45⤵
- Executes dropped EXE
PID:868 -
\??\c:\nxtdbnd.exec:\nxtdbnd.exe46⤵
- Executes dropped EXE
PID:1172 -
\??\c:\blblbv.exec:\blblbv.exe47⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vfjhpn.exec:\vfjhpn.exe48⤵
- Executes dropped EXE
PID:3028 -
\??\c:\tdlbjf.exec:\tdlbjf.exe49⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rvbrhtp.exec:\rvbrhtp.exe50⤵
- Executes dropped EXE
PID:2108 -
\??\c:\lttnbd.exec:\lttnbd.exe51⤵
- Executes dropped EXE
PID:1444 -
\??\c:\pbtlt.exec:\pbtlt.exe52⤵
- Executes dropped EXE
PID:2696 -
\??\c:\dfpnnbv.exec:\dfpnnbv.exe53⤵
- Executes dropped EXE
PID:2932 -
\??\c:\bdhdpt.exec:\bdhdpt.exe54⤵
- Executes dropped EXE
PID:1932 -
\??\c:\bldtxbr.exec:\bldtxbr.exe55⤵
- Executes dropped EXE
PID:2308 -
\??\c:\rhltvjj.exec:\rhltvjj.exe56⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nvvrb.exec:\nvvrb.exe57⤵
- Executes dropped EXE
PID:2260 -
\??\c:\jdhtdfj.exec:\jdhtdfj.exe58⤵
- Executes dropped EXE
PID:2300 -
\??\c:\xvbjl.exec:\xvbjl.exe59⤵
- Executes dropped EXE
PID:2060 -
\??\c:\rrnjnld.exec:\rrnjnld.exe60⤵
- Executes dropped EXE
PID:1072 -
\??\c:\ftxrl.exec:\ftxrl.exe61⤵
- Executes dropped EXE
PID:1020 -
\??\c:\dnrjhxn.exec:\dnrjhxn.exe62⤵
- Executes dropped EXE
PID:560 -
\??\c:\hvvdbbd.exec:\hvvdbbd.exe63⤵
- Executes dropped EXE
PID:2428 -
\??\c:\drbdd.exec:\drbdd.exe64⤵
- Executes dropped EXE
PID:1668 -
\??\c:\llfntj.exec:\llfntj.exe65⤵
- Executes dropped EXE
PID:1748 -
\??\c:\fdxhtdb.exec:\fdxhtdb.exe66⤵
- System Location Discovery: System Language Discovery
PID:2388 -
\??\c:\xtjpnfx.exec:\xtjpnfx.exe67⤵
- System Location Discovery: System Language Discovery
PID:1944 -
\??\c:\dbxpffr.exec:\dbxpffr.exe68⤵PID:1132
-
\??\c:\hpddpvv.exec:\hpddpvv.exe69⤵PID:2668
-
\??\c:\jjhlfvv.exec:\jjhlfvv.exe70⤵PID:2000
-
\??\c:\dpxjvbh.exec:\dpxjvbh.exe71⤵PID:2384
-
\??\c:\jldnnrt.exec:\jldnnrt.exe72⤵PID:1200
-
\??\c:\xlrbr.exec:\xlrbr.exe73⤵PID:884
-
\??\c:\tfrpjt.exec:\tfrpjt.exe74⤵PID:1156
-
\??\c:\rlprtp.exec:\rlprtp.exe75⤵PID:2896
-
\??\c:\bflbr.exec:\bflbr.exe76⤵PID:1616
-
\??\c:\hhvfj.exec:\hhvfj.exe77⤵PID:2948
-
\??\c:\rtnftt.exec:\rtnftt.exe78⤵PID:2856
-
\??\c:\xjnhhtv.exec:\xjnhhtv.exe79⤵PID:3020
-
\??\c:\pvfdlhn.exec:\pvfdlhn.exe80⤵
- System Location Discovery: System Language Discovery
PID:932 -
\??\c:\vvhtxnv.exec:\vvhtxnv.exe81⤵PID:3008
-
\??\c:\trrdfjl.exec:\trrdfjl.exe82⤵PID:928
-
\??\c:\ttnfbjb.exec:\ttnfbjb.exe83⤵PID:2588
-
\??\c:\pffnxp.exec:\pffnxp.exe84⤵PID:2812
-
\??\c:\fpxfnx.exec:\fpxfnx.exe85⤵PID:2612
-
\??\c:\nlflh.exec:\nlflh.exe86⤵PID:1936
-
\??\c:\bjblf.exec:\bjblf.exe87⤵PID:1672
-
\??\c:\xtjlb.exec:\xtjlb.exe88⤵PID:868
-
\??\c:\xjrbff.exec:\xjrbff.exe89⤵PID:1624
-
\??\c:\rfbpd.exec:\rfbpd.exe90⤵
- System Location Discovery: System Language Discovery
PID:316 -
\??\c:\htbrtlj.exec:\htbrtlj.exe91⤵PID:3056
-
\??\c:\pxfbh.exec:\pxfbh.exe92⤵PID:2104
-
\??\c:\jndbh.exec:\jndbh.exe93⤵PID:2848
-
\??\c:\vvhhrp.exec:\vvhhrp.exe94⤵PID:2408
-
\??\c:\fnrlfp.exec:\fnrlfp.exe95⤵PID:2736
-
\??\c:\pjjpdf.exec:\pjjpdf.exe96⤵PID:1176
-
\??\c:\vpxtt.exec:\vpxtt.exe97⤵PID:1108
-
\??\c:\vpnnp.exec:\vpnnp.exe98⤵PID:2116
-
\??\c:\bpjhj.exec:\bpjhj.exe99⤵PID:2500
-
\??\c:\njdbh.exec:\njdbh.exe100⤵PID:1760
-
\??\c:\vtrbjb.exec:\vtrbjb.exe101⤵PID:2284
-
\??\c:\rhfpj.exec:\rhfpj.exe102⤵PID:2288
-
\??\c:\ftrnfn.exec:\ftrnfn.exe103⤵PID:2212
-
\??\c:\fpjjp.exec:\fpjjp.exe104⤵PID:780
-
\??\c:\hxbld.exec:\hxbld.exe105⤵PID:2480
-
\??\c:\xlvjl.exec:\xlvjl.exe106⤵PID:1184
-
\??\c:\ppdlnjn.exec:\ppdlnjn.exe107⤵PID:1752
-
\??\c:\nplhbj.exec:\nplhbj.exe108⤵PID:2724
-
\??\c:\blvjltx.exec:\blvjltx.exe109⤵PID:1680
-
\??\c:\vjhpv.exec:\vjhpv.exe110⤵PID:112
-
\??\c:\fbjdt.exec:\fbjdt.exe111⤵
- System Location Discovery: System Language Discovery
PID:1384 -
\??\c:\vvxjn.exec:\vvxjn.exe112⤵PID:2668
-
\??\c:\tvhfdb.exec:\tvhfdb.exe113⤵PID:2572
-
\??\c:\bxptb.exec:\bxptb.exe114⤵PID:1060
-
\??\c:\nfrnnlr.exec:\nfrnnlr.exe115⤵PID:892
-
\??\c:\bvhjjb.exec:\bvhjjb.exe116⤵PID:2148
-
\??\c:\nvvbl.exec:\nvvbl.exe117⤵PID:1928
-
\??\c:\tnrbf.exec:\tnrbf.exe118⤵PID:1584
-
\??\c:\bbbbx.exec:\bbbbx.exe119⤵
- System Location Discovery: System Language Discovery
PID:2976 -
\??\c:\hbhldtb.exec:\hbhldtb.exe120⤵PID:2876
-
\??\c:\bjlld.exec:\bjlld.exe121⤵PID:2900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-