Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 21:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8d34f298beebc72b97198e4bde422aced4328d8d53442266dc5019ffce8948ea.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
8d34f298beebc72b97198e4bde422aced4328d8d53442266dc5019ffce8948ea.exe
-
Size
456KB
-
MD5
a6e086eeea2c5c8625757c4ec7f5b755
-
SHA1
8de4d498e1bd91331ce320c31821191dae114b8f
-
SHA256
8d34f298beebc72b97198e4bde422aced4328d8d53442266dc5019ffce8948ea
-
SHA512
625313061f18eac70ccd0b4cef9e98e92a21740c3b3919f83e6df7215cb1c380a18ee40a70cff5a985ae0a35b8fb7560b38ad163411aacf1d11daa0c8d4a4aa0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR2:q7Tc2NYHUrAwfMp3CDR2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/3048-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/600-164-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2472-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1412-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/828-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1840-387-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1840-408-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/472-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-494-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2492-508-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1828-533-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1564-600-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2664-658-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-743-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/828-822-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1748 vlvnrb.exe 2792 vxrxnlx.exe 2980 dfntprp.exe 2716 blvlb.exe 2756 lpvpj.exe 2624 xjpvrhx.exe 3060 xnnxv.exe 1648 fnvxdh.exe 952 fjbxp.exe 2888 pddfxr.exe 2652 nxxll.exe 2936 vtvdxlj.exe 2396 fjnprh.exe 1924 bjdfx.exe 2632 fpjbhff.exe 1968 fnpfr.exe 600 npjpv.exe 2472 jbxxl.exe 1412 rdvrxt.exe 1760 vbdxh.exe 2100 lxnvj.exe 944 hxtxf.exe 964 fjvfn.exe 1724 trvjn.exe 828 xrtxrrp.exe 1940 ndjpfn.exe 1720 ntbrj.exe 3044 dpttb.exe 1484 xdvvbt.exe 1556 hjtnfxf.exe 2008 blxln.exe 892 ddpjdn.exe 2444 hfthb.exe 2684 xjlpdt.exe 2784 tpldp.exe 2788 jjvbvfj.exe 2976 dhjhtv.exe 2980 jbjth.exe 1916 hfjxpd.exe 2604 fhhvf.exe 2664 trnxdpp.exe 2308 tbfbh.exe 1200 nfrhjd.exe 1840 lnlhjn.exe 2688 jrdhhb.exe 2892 fhnpvd.exe 552 pjflrp.exe 1956 fdjldtn.exe 1728 bhtbffb.exe 2680 rhxpxp.exe 860 hrvxxnp.exe 3036 jppjrr.exe 332 tfjfdv.exe 472 drrnpn.exe 2336 lrlnhr.exe 2084 dnplxvf.exe 2472 jxjfnb.exe 1412 rhjtxx.exe 2120 rdpxj.exe 2016 hdbnh.exe 1704 nrphph.exe 2492 hlxptj.exe 2028 bhlbvjj.exe 1700 rlxbxn.exe -
resource yara_rule behavioral1/memory/3048-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/472-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/388-769-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-824-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhhrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrddhff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnrhfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlhdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhrld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldjtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhthhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvbldxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpldp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plprblx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhnvfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnpfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxdhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lplnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnljl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrbhtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvhpnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdfnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrxnjjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlptnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtbffb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdxpplf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhpbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdfjrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhjhtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvhvbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvxftdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jblftr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddhdtfn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 1748 3048 8d34f298beebc72b97198e4bde422aced4328d8d53442266dc5019ffce8948ea.exe 30 PID 3048 wrote to memory of 1748 3048 8d34f298beebc72b97198e4bde422aced4328d8d53442266dc5019ffce8948ea.exe 30 PID 3048 wrote to memory of 1748 3048 8d34f298beebc72b97198e4bde422aced4328d8d53442266dc5019ffce8948ea.exe 30 PID 3048 wrote to memory of 1748 3048 8d34f298beebc72b97198e4bde422aced4328d8d53442266dc5019ffce8948ea.exe 30 PID 1748 wrote to memory of 2792 1748 vlvnrb.exe 31 PID 1748 wrote to memory of 2792 1748 vlvnrb.exe 31 PID 1748 wrote to memory of 2792 1748 vlvnrb.exe 31 PID 1748 wrote to memory of 2792 1748 vlvnrb.exe 31 PID 2792 wrote to memory of 2980 2792 vxrxnlx.exe 32 PID 2792 wrote to memory of 2980 2792 vxrxnlx.exe 32 PID 2792 wrote to memory of 2980 2792 vxrxnlx.exe 32 PID 2792 wrote to memory of 2980 2792 vxrxnlx.exe 32 PID 2980 wrote to memory of 2716 2980 dfntprp.exe 33 PID 2980 wrote to memory of 2716 2980 dfntprp.exe 33 PID 2980 wrote to memory of 2716 2980 dfntprp.exe 33 PID 2980 wrote to memory of 2716 2980 dfntprp.exe 33 PID 2716 wrote to memory of 2756 2716 blvlb.exe 34 PID 2716 wrote to memory of 2756 2716 blvlb.exe 34 PID 2716 wrote to memory of 2756 2716 blvlb.exe 34 PID 2716 wrote to memory of 2756 2716 blvlb.exe 34 PID 2756 wrote to memory of 2624 2756 lpvpj.exe 35 PID 2756 wrote to memory of 2624 2756 lpvpj.exe 35 PID 2756 wrote to memory of 2624 2756 lpvpj.exe 35 PID 2756 wrote to memory of 2624 2756 lpvpj.exe 35 PID 2624 wrote to memory of 3060 2624 xjpvrhx.exe 36 PID 2624 wrote to memory of 3060 2624 xjpvrhx.exe 36 PID 2624 wrote to memory of 3060 2624 xjpvrhx.exe 36 PID 2624 wrote to memory of 3060 2624 xjpvrhx.exe 36 PID 3060 wrote to memory of 1648 3060 xnnxv.exe 37 PID 3060 wrote to memory of 1648 3060 xnnxv.exe 37 PID 3060 wrote to memory of 1648 3060 xnnxv.exe 37 PID 3060 wrote to memory of 1648 3060 xnnxv.exe 37 PID 1648 wrote to memory of 952 1648 fnvxdh.exe 38 PID 1648 wrote to memory of 952 1648 fnvxdh.exe 38 PID 1648 wrote to memory of 952 1648 fnvxdh.exe 38 PID 1648 wrote to memory of 952 1648 fnvxdh.exe 38 PID 952 wrote to memory of 2888 952 fjbxp.exe 39 PID 952 wrote to memory of 2888 952 fjbxp.exe 39 PID 952 wrote to memory of 2888 952 fjbxp.exe 39 PID 952 wrote to memory of 2888 952 fjbxp.exe 39 PID 2888 wrote to memory of 2652 2888 pddfxr.exe 40 PID 2888 wrote to memory of 2652 2888 pddfxr.exe 40 PID 2888 wrote to memory of 2652 2888 pddfxr.exe 40 PID 2888 wrote to memory of 2652 2888 pddfxr.exe 40 PID 2652 wrote to memory of 2936 2652 nxxll.exe 41 PID 2652 wrote to memory of 2936 2652 nxxll.exe 41 PID 2652 wrote to memory of 2936 2652 nxxll.exe 41 PID 2652 wrote to memory of 2936 2652 nxxll.exe 41 PID 2936 wrote to memory of 2396 2936 vtvdxlj.exe 42 PID 2936 wrote to memory of 2396 2936 vtvdxlj.exe 42 PID 2936 wrote to memory of 2396 2936 vtvdxlj.exe 42 PID 2936 wrote to memory of 2396 2936 vtvdxlj.exe 42 PID 2396 wrote to memory of 1924 2396 fjnprh.exe 43 PID 2396 wrote to memory of 1924 2396 fjnprh.exe 43 PID 2396 wrote to memory of 1924 2396 fjnprh.exe 43 PID 2396 wrote to memory of 1924 2396 fjnprh.exe 43 PID 1924 wrote to memory of 2632 1924 bjdfx.exe 44 PID 1924 wrote to memory of 2632 1924 bjdfx.exe 44 PID 1924 wrote to memory of 2632 1924 bjdfx.exe 44 PID 1924 wrote to memory of 2632 1924 bjdfx.exe 44 PID 2632 wrote to memory of 1968 2632 fpjbhff.exe 45 PID 2632 wrote to memory of 1968 2632 fpjbhff.exe 45 PID 2632 wrote to memory of 1968 2632 fpjbhff.exe 45 PID 2632 wrote to memory of 1968 2632 fpjbhff.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d34f298beebc72b97198e4bde422aced4328d8d53442266dc5019ffce8948ea.exe"C:\Users\Admin\AppData\Local\Temp\8d34f298beebc72b97198e4bde422aced4328d8d53442266dc5019ffce8948ea.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\vlvnrb.exec:\vlvnrb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\vxrxnlx.exec:\vxrxnlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\dfntprp.exec:\dfntprp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\blvlb.exec:\blvlb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\lpvpj.exec:\lpvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\xjpvrhx.exec:\xjpvrhx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\xnnxv.exec:\xnnxv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\fnvxdh.exec:\fnvxdh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\fjbxp.exec:\fjbxp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\pddfxr.exec:\pddfxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\nxxll.exec:\nxxll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\vtvdxlj.exec:\vtvdxlj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\fjnprh.exec:\fjnprh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\bjdfx.exec:\bjdfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\fpjbhff.exec:\fpjbhff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\fnpfr.exec:\fnpfr.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1968 -
\??\c:\npjpv.exec:\npjpv.exe18⤵
- Executes dropped EXE
PID:600 -
\??\c:\jbxxl.exec:\jbxxl.exe19⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rdvrxt.exec:\rdvrxt.exe20⤵
- Executes dropped EXE
PID:1412 -
\??\c:\vbdxh.exec:\vbdxh.exe21⤵
- Executes dropped EXE
PID:1760 -
\??\c:\lxnvj.exec:\lxnvj.exe22⤵
- Executes dropped EXE
PID:2100 -
\??\c:\hxtxf.exec:\hxtxf.exe23⤵
- Executes dropped EXE
PID:944 -
\??\c:\fjvfn.exec:\fjvfn.exe24⤵
- Executes dropped EXE
PID:964 -
\??\c:\trvjn.exec:\trvjn.exe25⤵
- Executes dropped EXE
PID:1724 -
\??\c:\xrtxrrp.exec:\xrtxrrp.exe26⤵
- Executes dropped EXE
PID:828 -
\??\c:\ndjpfn.exec:\ndjpfn.exe27⤵
- Executes dropped EXE
PID:1940 -
\??\c:\ntbrj.exec:\ntbrj.exe28⤵
- Executes dropped EXE
PID:1720 -
\??\c:\dpttb.exec:\dpttb.exe29⤵
- Executes dropped EXE
PID:3044 -
\??\c:\xdvvbt.exec:\xdvvbt.exe30⤵
- Executes dropped EXE
PID:1484 -
\??\c:\hjtnfxf.exec:\hjtnfxf.exe31⤵
- Executes dropped EXE
PID:1556 -
\??\c:\blxln.exec:\blxln.exe32⤵
- Executes dropped EXE
PID:2008 -
\??\c:\ddpjdn.exec:\ddpjdn.exe33⤵
- Executes dropped EXE
PID:892 -
\??\c:\hfthb.exec:\hfthb.exe34⤵
- Executes dropped EXE
PID:2444 -
\??\c:\xjlpdt.exec:\xjlpdt.exe35⤵
- Executes dropped EXE
PID:2684 -
\??\c:\tpldp.exec:\tpldp.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2784 -
\??\c:\jjvbvfj.exec:\jjvbvfj.exe37⤵
- Executes dropped EXE
PID:2788 -
\??\c:\dhjhtv.exec:\dhjhtv.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2976 -
\??\c:\jbjth.exec:\jbjth.exe39⤵
- Executes dropped EXE
PID:2980 -
\??\c:\hfjxpd.exec:\hfjxpd.exe40⤵
- Executes dropped EXE
PID:1916 -
\??\c:\fhhvf.exec:\fhhvf.exe41⤵
- Executes dropped EXE
PID:2604 -
\??\c:\trnxdpp.exec:\trnxdpp.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\tbfbh.exec:\tbfbh.exe43⤵
- Executes dropped EXE
PID:2308 -
\??\c:\nfrhjd.exec:\nfrhjd.exe44⤵
- Executes dropped EXE
PID:1200 -
\??\c:\lnlhjn.exec:\lnlhjn.exe45⤵
- Executes dropped EXE
PID:1840 -
\??\c:\jrdhhb.exec:\jrdhhb.exe46⤵
- Executes dropped EXE
PID:2688 -
\??\c:\fhnpvd.exec:\fhnpvd.exe47⤵
- Executes dropped EXE
PID:2892 -
\??\c:\pjflrp.exec:\pjflrp.exe48⤵
- Executes dropped EXE
PID:552 -
\??\c:\fdjldtn.exec:\fdjldtn.exe49⤵
- Executes dropped EXE
PID:1956 -
\??\c:\bhtbffb.exec:\bhtbffb.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1728 -
\??\c:\rhxpxp.exec:\rhxpxp.exe51⤵
- Executes dropped EXE
PID:2680 -
\??\c:\hrvxxnp.exec:\hrvxxnp.exe52⤵
- Executes dropped EXE
PID:860 -
\??\c:\jppjrr.exec:\jppjrr.exe53⤵
- Executes dropped EXE
PID:3036 -
\??\c:\tfjfdv.exec:\tfjfdv.exe54⤵
- Executes dropped EXE
PID:332 -
\??\c:\drrnpn.exec:\drrnpn.exe55⤵
- Executes dropped EXE
PID:472 -
\??\c:\lrlnhr.exec:\lrlnhr.exe56⤵
- Executes dropped EXE
PID:2336 -
\??\c:\dnplxvf.exec:\dnplxvf.exe57⤵
- Executes dropped EXE
PID:2084 -
\??\c:\jxjfnb.exec:\jxjfnb.exe58⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rhjtxx.exec:\rhjtxx.exe59⤵
- Executes dropped EXE
PID:1412 -
\??\c:\rdpxj.exec:\rdpxj.exe60⤵
- Executes dropped EXE
PID:2120 -
\??\c:\hdbnh.exec:\hdbnh.exe61⤵
- Executes dropped EXE
PID:2016 -
\??\c:\nrphph.exec:\nrphph.exe62⤵
- Executes dropped EXE
PID:1704 -
\??\c:\hlxptj.exec:\hlxptj.exe63⤵
- Executes dropped EXE
PID:2492 -
\??\c:\bhlbvjj.exec:\bhlbvjj.exe64⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rlxbxn.exec:\rlxbxn.exe65⤵
- Executes dropped EXE
PID:1700 -
\??\c:\blhftld.exec:\blhftld.exe66⤵PID:2208
-
\??\c:\jfpbh.exec:\jfpbh.exe67⤵PID:1828
-
\??\c:\htvdtrh.exec:\htvdtrh.exe68⤵PID:536
-
\??\c:\tbhbjx.exec:\tbhbjx.exe69⤵PID:1372
-
\??\c:\btbfx.exec:\btbfx.exe70⤵PID:1624
-
\??\c:\bpbhjxp.exec:\bpbhjxp.exe71⤵PID:2524
-
\??\c:\tppdjjp.exec:\tppdjjp.exe72⤵PID:1628
-
\??\c:\fvrjjh.exec:\fvrjjh.exe73⤵PID:2964
-
\??\c:\pxxrd.exec:\pxxrd.exe74⤵PID:1556
-
\??\c:\nfprpf.exec:\nfprpf.exe75⤵PID:2532
-
\??\c:\pnvddlp.exec:\pnvddlp.exe76⤵PID:1900
-
\??\c:\lxndh.exec:\lxndh.exe77⤵PID:1564
-
\??\c:\dfllhn.exec:\dfllhn.exe78⤵PID:1748
-
\??\c:\lxrxt.exec:\lxrxt.exe79⤵PID:2164
-
\??\c:\tbrxjr.exec:\tbrxjr.exe80⤵PID:2204
-
\??\c:\lhnhp.exec:\lhnhp.exe81⤵PID:2884
-
\??\c:\jxrdpvp.exec:\jxrdpvp.exe82⤵PID:2852
-
\??\c:\ttpdnp.exec:\ttpdnp.exe83⤵PID:2716
-
\??\c:\bjpfpb.exec:\bjpfpb.exe84⤵PID:2656
-
\??\c:\tjjxjv.exec:\tjjxjv.exe85⤵PID:1620
-
\??\c:\pnptpf.exec:\pnptpf.exe86⤵PID:2664
-
\??\c:\xprrtbj.exec:\xprrtbj.exe87⤵PID:684
-
\??\c:\hdljpx.exec:\hdljpx.exe88⤵PID:1672
-
\??\c:\vpfdp.exec:\vpfdp.exe89⤵PID:2948
-
\??\c:\rjnht.exec:\rjnht.exe90⤵PID:580
-
\??\c:\nlphthr.exec:\nlphthr.exe91⤵PID:2900
-
\??\c:\lvndj.exec:\lvndj.exe92⤵PID:2392
-
\??\c:\fvvrr.exec:\fvvrr.exe93⤵PID:2044
-
\??\c:\trlhdbh.exec:\trlhdbh.exe94⤵PID:1380
-
\??\c:\ndvpfh.exec:\ndvpfh.exe95⤵PID:340
-
\??\c:\nbdjxfx.exec:\nbdjxfx.exe96⤵PID:2184
-
\??\c:\rtvrrb.exec:\rtvrrb.exe97⤵PID:700
-
\??\c:\vhvdpf.exec:\vhvdpf.exe98⤵PID:1732
-
\??\c:\trxdndh.exec:\trxdndh.exe99⤵PID:2460
-
\??\c:\ljfrh.exec:\ljfrh.exe100⤵PID:2336
-
\??\c:\lnthlr.exec:\lnthlr.exe101⤵PID:2084
-
\??\c:\jjnpdvv.exec:\jjnpdvv.exe102⤵PID:1928
-
\??\c:\vvlxb.exec:\vvlxb.exe103⤵PID:2140
-
\??\c:\nvdplfl.exec:\nvdplfl.exe104⤵PID:388
-
\??\c:\nnnpf.exec:\nnnpf.exe105⤵PID:616
-
\??\c:\bnnnn.exec:\bnnnn.exe106⤵PID:1136
-
\??\c:\xnvft.exec:\xnvft.exe107⤵PID:2568
-
\??\c:\npfrr.exec:\npfrr.exe108⤵PID:1908
-
\??\c:\vpbnvt.exec:\vpbnvt.exe109⤵PID:1468
-
\??\c:\jdfvhl.exec:\jdfvhl.exe110⤵PID:1528
-
\??\c:\rxnbh.exec:\rxnbh.exe111⤵PID:828
-
\??\c:\rhhfvh.exec:\rhhfvh.exe112⤵PID:3028
-
\??\c:\vtrnhd.exec:\vtrnhd.exe113⤵PID:1248
-
\??\c:\lxldt.exec:\lxldt.exe114⤵PID:3000
-
\??\c:\lxddpth.exec:\lxddpth.exe115⤵PID:1484
-
\??\c:\lfxhx.exec:\lfxhx.exe116⤵PID:2012
-
\??\c:\xfxfdrt.exec:\xfxfdrt.exe117⤵PID:2000
-
\??\c:\pxpbbf.exec:\pxpbbf.exe118⤵PID:2316
-
\??\c:\bhxjt.exec:\bhxjt.exe119⤵PID:1236
-
\??\c:\tljnfvr.exec:\tljnfvr.exe120⤵PID:1592
-
\??\c:\vjjhhxj.exec:\vjjhhxj.exe121⤵PID:2804
-
\??\c:\fjrdtpp.exec:\fjrdtpp.exe122⤵PID:2800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-