Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 21:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
68636881a425d05f93157ef53f8768e6173608784a18462b22e07d819a367a8cN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
68636881a425d05f93157ef53f8768e6173608784a18462b22e07d819a367a8cN.exe
-
Size
456KB
-
MD5
db708eb5b02abd1ef92fec65afc9a970
-
SHA1
747de4aca3a66f6f6f878911234f3c0424e1b408
-
SHA256
68636881a425d05f93157ef53f8768e6173608784a18462b22e07d819a367a8c
-
SHA512
d2876a3d93e12ddfbd69b19c507ba1c9627d7daa085136c7f7f506245856bb3ae09f7255bf9a8ebac2eda182e0cf00b19477fc31cef4c598ea9ceb6042ec4aa2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR8:q7Tc2NYHUrAwfMp3CDR8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2916-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/744-109-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2308-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-212-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2520-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-362-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2740-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-382-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2560-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-404-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2360-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-457-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/900-494-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2076-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/632-734-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-737-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/940-787-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1032-812-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/912-844-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/820-845-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1248-860-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2316-908-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-935-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2916 xjndp.exe 2072 hfpjt.exe 2972 jlnppd.exe 2732 rbjnfxn.exe 2440 lxdnj.exe 2968 vftnhhx.exe 2792 frpbhf.exe 2560 lptvh.exe 2704 vtxfpf.exe 2380 ntrrx.exe 744 njjvhhf.exe 2828 hhvlf.exe 2240 xllrl.exe 2612 plbfnhn.exe 2308 vddfvth.exe 2416 rvjxpl.exe 3032 bbxrtrn.exe 1224 lpfxdln.exe 2276 hplnt.exe 2188 ntbnxr.exe 2088 rtvhrdh.exe 1536 nlptj.exe 2480 frnrvr.exe 2520 hnvphbx.exe 1028 xflhvd.exe 2252 hdrtx.exe 1780 nnrhpp.exe 1696 jfbjbh.exe 1772 hrfplph.exe 1092 rxplfth.exe 1480 xfxtnb.exe 2340 xpflh.exe 876 lhffbt.exe 3020 tbjfhxv.exe 2488 lhdlx.exe 2856 xnpjfd.exe 1580 bhxbbvb.exe 2960 fxjrxth.exe 2976 dnxjjrl.exe 2860 rfhtn.exe 2912 tdhtrb.exe 2424 jtphfpp.exe 2740 htphh.exe 2592 vphflr.exe 2572 xbdbnn.exe 2560 jxlpd.exe 288 phlpd.exe 1352 rffdf.exe 2356 bnjnxhj.exe 2764 djtrpbj.exe 2828 jbfhbvj.exe 2600 jfhpx.exe 2360 bprdxtx.exe 2636 lntdndh.exe 2400 xdhtxh.exe 3036 rfnhf.exe 1824 vlvxl.exe 1224 jrjrvv.exe 1588 ddnlh.exe 2080 bjfrf.exe 2108 llhxt.exe 900 fjhtlh.exe 2076 vrthxd.exe 1564 vtvxb.exe -
resource yara_rule behavioral1/memory/2916-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-571-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1040-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-844-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-852-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-867-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-908-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-921-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-935-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-948-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-1028-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-1096-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/928-1121-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlvxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvdjlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlpnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbjnfxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxdph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npldpxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrhdbdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdlfdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlbph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nphhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxpfvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrlthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrpbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnxfdfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpljvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftvrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltljpvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttlrbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdxdvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrrflrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lndtjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vftnhhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddfvth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvndb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpbdpbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npnhpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhbplt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrpxhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txxbnjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxjvnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbpbpjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpbvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nphtfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68636881a425d05f93157ef53f8768e6173608784a18462b22e07d819a367a8cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nptlrfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbhvrpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfvfnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npxpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vplnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffhbhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nplbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjllfv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1820 wrote to memory of 2916 1820 68636881a425d05f93157ef53f8768e6173608784a18462b22e07d819a367a8cN.exe 29 PID 1820 wrote to memory of 2916 1820 68636881a425d05f93157ef53f8768e6173608784a18462b22e07d819a367a8cN.exe 29 PID 1820 wrote to memory of 2916 1820 68636881a425d05f93157ef53f8768e6173608784a18462b22e07d819a367a8cN.exe 29 PID 1820 wrote to memory of 2916 1820 68636881a425d05f93157ef53f8768e6173608784a18462b22e07d819a367a8cN.exe 29 PID 2916 wrote to memory of 2072 2916 xjndp.exe 30 PID 2916 wrote to memory of 2072 2916 xjndp.exe 30 PID 2916 wrote to memory of 2072 2916 xjndp.exe 30 PID 2916 wrote to memory of 2072 2916 xjndp.exe 30 PID 2072 wrote to memory of 2972 2072 hfpjt.exe 31 PID 2072 wrote to memory of 2972 2072 hfpjt.exe 31 PID 2072 wrote to memory of 2972 2072 hfpjt.exe 31 PID 2072 wrote to memory of 2972 2072 hfpjt.exe 31 PID 2972 wrote to memory of 2732 2972 jlnppd.exe 32 PID 2972 wrote to memory of 2732 2972 jlnppd.exe 32 PID 2972 wrote to memory of 2732 2972 jlnppd.exe 32 PID 2972 wrote to memory of 2732 2972 jlnppd.exe 32 PID 2732 wrote to memory of 2440 2732 rbjnfxn.exe 33 PID 2732 wrote to memory of 2440 2732 rbjnfxn.exe 33 PID 2732 wrote to memory of 2440 2732 rbjnfxn.exe 33 PID 2732 wrote to memory of 2440 2732 rbjnfxn.exe 33 PID 2440 wrote to memory of 2968 2440 lxdnj.exe 34 PID 2440 wrote to memory of 2968 2440 lxdnj.exe 34 PID 2440 wrote to memory of 2968 2440 lxdnj.exe 34 PID 2440 wrote to memory of 2968 2440 lxdnj.exe 34 PID 2968 wrote to memory of 2792 2968 vftnhhx.exe 35 PID 2968 wrote to memory of 2792 2968 vftnhhx.exe 35 PID 2968 wrote to memory of 2792 2968 vftnhhx.exe 35 PID 2968 wrote to memory of 2792 2968 vftnhhx.exe 35 PID 2792 wrote to memory of 2560 2792 frpbhf.exe 36 PID 2792 wrote to memory of 2560 2792 frpbhf.exe 36 PID 2792 wrote to memory of 2560 2792 frpbhf.exe 36 PID 2792 wrote to memory of 2560 2792 frpbhf.exe 36 PID 2560 wrote to memory of 2704 2560 lptvh.exe 37 PID 2560 wrote to memory of 2704 2560 lptvh.exe 37 PID 2560 wrote to memory of 2704 2560 lptvh.exe 37 PID 2560 wrote to memory of 2704 2560 lptvh.exe 37 PID 2704 wrote to memory of 2380 2704 vtxfpf.exe 38 PID 2704 wrote to memory of 2380 2704 vtxfpf.exe 38 PID 2704 wrote to memory of 2380 2704 vtxfpf.exe 38 PID 2704 wrote to memory of 2380 2704 vtxfpf.exe 38 PID 2380 wrote to memory of 744 2380 ntrrx.exe 39 PID 2380 wrote to memory of 744 2380 ntrrx.exe 39 PID 2380 wrote to memory of 744 2380 ntrrx.exe 39 PID 2380 wrote to memory of 744 2380 ntrrx.exe 39 PID 744 wrote to memory of 2828 744 njjvhhf.exe 40 PID 744 wrote to memory of 2828 744 njjvhhf.exe 40 PID 744 wrote to memory of 2828 744 njjvhhf.exe 40 PID 744 wrote to memory of 2828 744 njjvhhf.exe 40 PID 2828 wrote to memory of 2240 2828 hhvlf.exe 41 PID 2828 wrote to memory of 2240 2828 hhvlf.exe 41 PID 2828 wrote to memory of 2240 2828 hhvlf.exe 41 PID 2828 wrote to memory of 2240 2828 hhvlf.exe 41 PID 2240 wrote to memory of 2612 2240 xllrl.exe 42 PID 2240 wrote to memory of 2612 2240 xllrl.exe 42 PID 2240 wrote to memory of 2612 2240 xllrl.exe 42 PID 2240 wrote to memory of 2612 2240 xllrl.exe 42 PID 2612 wrote to memory of 2308 2612 plbfnhn.exe 43 PID 2612 wrote to memory of 2308 2612 plbfnhn.exe 43 PID 2612 wrote to memory of 2308 2612 plbfnhn.exe 43 PID 2612 wrote to memory of 2308 2612 plbfnhn.exe 43 PID 2308 wrote to memory of 2416 2308 vddfvth.exe 44 PID 2308 wrote to memory of 2416 2308 vddfvth.exe 44 PID 2308 wrote to memory of 2416 2308 vddfvth.exe 44 PID 2308 wrote to memory of 2416 2308 vddfvth.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\68636881a425d05f93157ef53f8768e6173608784a18462b22e07d819a367a8cN.exe"C:\Users\Admin\AppData\Local\Temp\68636881a425d05f93157ef53f8768e6173608784a18462b22e07d819a367a8cN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\xjndp.exec:\xjndp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\hfpjt.exec:\hfpjt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\jlnppd.exec:\jlnppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\rbjnfxn.exec:\rbjnfxn.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\lxdnj.exec:\lxdnj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\vftnhhx.exec:\vftnhhx.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\frpbhf.exec:\frpbhf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\lptvh.exec:\lptvh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\vtxfpf.exec:\vtxfpf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\ntrrx.exec:\ntrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\njjvhhf.exec:\njjvhhf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\hhvlf.exec:\hhvlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\xllrl.exec:\xllrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\plbfnhn.exec:\plbfnhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\vddfvth.exec:\vddfvth.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\rvjxpl.exec:\rvjxpl.exe17⤵
- Executes dropped EXE
PID:2416 -
\??\c:\bbxrtrn.exec:\bbxrtrn.exe18⤵
- Executes dropped EXE
PID:3032 -
\??\c:\lpfxdln.exec:\lpfxdln.exe19⤵
- Executes dropped EXE
PID:1224 -
\??\c:\hplnt.exec:\hplnt.exe20⤵
- Executes dropped EXE
PID:2276 -
\??\c:\ntbnxr.exec:\ntbnxr.exe21⤵
- Executes dropped EXE
PID:2188 -
\??\c:\rtvhrdh.exec:\rtvhrdh.exe22⤵
- Executes dropped EXE
PID:2088 -
\??\c:\nlptj.exec:\nlptj.exe23⤵
- Executes dropped EXE
PID:1536 -
\??\c:\frnrvr.exec:\frnrvr.exe24⤵
- Executes dropped EXE
PID:2480 -
\??\c:\hnvphbx.exec:\hnvphbx.exe25⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xflhvd.exec:\xflhvd.exe26⤵
- Executes dropped EXE
PID:1028 -
\??\c:\hdrtx.exec:\hdrtx.exe27⤵
- Executes dropped EXE
PID:2252 -
\??\c:\nnrhpp.exec:\nnrhpp.exe28⤵
- Executes dropped EXE
PID:1780 -
\??\c:\jfbjbh.exec:\jfbjbh.exe29⤵
- Executes dropped EXE
PID:1696 -
\??\c:\hrfplph.exec:\hrfplph.exe30⤵
- Executes dropped EXE
PID:1772 -
\??\c:\rxplfth.exec:\rxplfth.exe31⤵
- Executes dropped EXE
PID:1092 -
\??\c:\xfxtnb.exec:\xfxtnb.exe32⤵
- Executes dropped EXE
PID:1480 -
\??\c:\xpflh.exec:\xpflh.exe33⤵
- Executes dropped EXE
PID:2340 -
\??\c:\lhffbt.exec:\lhffbt.exe34⤵
- Executes dropped EXE
PID:876 -
\??\c:\tbjfhxv.exec:\tbjfhxv.exe35⤵
- Executes dropped EXE
PID:3020 -
\??\c:\lhdlx.exec:\lhdlx.exe36⤵
- Executes dropped EXE
PID:2488 -
\??\c:\xnpjfd.exec:\xnpjfd.exe37⤵
- Executes dropped EXE
PID:2856 -
\??\c:\bhxbbvb.exec:\bhxbbvb.exe38⤵
- Executes dropped EXE
PID:1580 -
\??\c:\fxjrxth.exec:\fxjrxth.exe39⤵
- Executes dropped EXE
PID:2960 -
\??\c:\dnxjjrl.exec:\dnxjjrl.exe40⤵
- Executes dropped EXE
PID:2976 -
\??\c:\rfhtn.exec:\rfhtn.exe41⤵
- Executes dropped EXE
PID:2860 -
\??\c:\tdhtrb.exec:\tdhtrb.exe42⤵
- Executes dropped EXE
PID:2912 -
\??\c:\jtphfpp.exec:\jtphfpp.exe43⤵
- Executes dropped EXE
PID:2424 -
\??\c:\htphh.exec:\htphh.exe44⤵
- Executes dropped EXE
PID:2740 -
\??\c:\vphflr.exec:\vphflr.exe45⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xbdbnn.exec:\xbdbnn.exe46⤵
- Executes dropped EXE
PID:2572 -
\??\c:\jxlpd.exec:\jxlpd.exe47⤵
- Executes dropped EXE
PID:2560 -
\??\c:\phlpd.exec:\phlpd.exe48⤵
- Executes dropped EXE
PID:288 -
\??\c:\rffdf.exec:\rffdf.exe49⤵
- Executes dropped EXE
PID:1352 -
\??\c:\bnjnxhj.exec:\bnjnxhj.exe50⤵
- Executes dropped EXE
PID:2356 -
\??\c:\djtrpbj.exec:\djtrpbj.exe51⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jbfhbvj.exec:\jbfhbvj.exe52⤵
- Executes dropped EXE
PID:2828 -
\??\c:\jfhpx.exec:\jfhpx.exe53⤵
- Executes dropped EXE
PID:2600 -
\??\c:\bprdxtx.exec:\bprdxtx.exe54⤵
- Executes dropped EXE
PID:2360 -
\??\c:\lntdndh.exec:\lntdndh.exe55⤵
- Executes dropped EXE
PID:2636 -
\??\c:\xdhtxh.exec:\xdhtxh.exe56⤵
- Executes dropped EXE
PID:2400 -
\??\c:\rfnhf.exec:\rfnhf.exe57⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vlvxl.exec:\vlvxl.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1824 -
\??\c:\jrjrvv.exec:\jrjrvv.exe59⤵
- Executes dropped EXE
PID:1224 -
\??\c:\ddnlh.exec:\ddnlh.exe60⤵
- Executes dropped EXE
PID:1588 -
\??\c:\bjfrf.exec:\bjfrf.exe61⤵
- Executes dropped EXE
PID:2080 -
\??\c:\llhxt.exec:\llhxt.exe62⤵
- Executes dropped EXE
PID:2108 -
\??\c:\fjhtlh.exec:\fjhtlh.exe63⤵
- Executes dropped EXE
PID:900 -
\??\c:\vrthxd.exec:\vrthxd.exe64⤵
- Executes dropped EXE
PID:2076 -
\??\c:\vtvxb.exec:\vtvxb.exe65⤵
- Executes dropped EXE
PID:1564 -
\??\c:\bxfdrj.exec:\bxfdrj.exe66⤵PID:2516
-
\??\c:\xfnrdf.exec:\xfnrdf.exe67⤵PID:948
-
\??\c:\drxlvh.exec:\drxlvh.exe68⤵PID:1052
-
\??\c:\pldnv.exec:\pldnv.exe69⤵PID:1508
-
\??\c:\hftdj.exec:\hftdj.exe70⤵PID:756
-
\??\c:\dhbfhjt.exec:\dhbfhjt.exe71⤵PID:2008
-
\??\c:\bdtpp.exec:\bdtpp.exe72⤵PID:1044
-
\??\c:\pblxfdh.exec:\pblxfdh.exe73⤵PID:1744
-
\??\c:\hnbjhf.exec:\hnbjhf.exe74⤵PID:1048
-
\??\c:\xlnvt.exec:\xlnvt.exe75⤵PID:1728
-
\??\c:\dfnnbfn.exec:\dfnnbfn.exe76⤵PID:1040
-
\??\c:\vnrtbt.exec:\vnrtbt.exe77⤵PID:1512
-
\??\c:\plfpj.exec:\plfpj.exe78⤵PID:1720
-
\??\c:\dpxdlhj.exec:\dpxdlhj.exe79⤵PID:3004
-
\??\c:\bfhjfb.exec:\bfhjfb.exe80⤵PID:2836
-
\??\c:\hrnbj.exec:\hrnbj.exe81⤵PID:1860
-
\??\c:\hfvfhn.exec:\hfvfhn.exe82⤵PID:652
-
\??\c:\txtflvd.exec:\txtflvd.exe83⤵PID:2072
-
\??\c:\tplhp.exec:\tplhp.exe84⤵PID:2876
-
\??\c:\jnfht.exec:\jnfht.exe85⤵PID:2976
-
\??\c:\jvpfd.exec:\jvpfd.exe86⤵PID:2312
-
\??\c:\hnnlf.exec:\hnnlf.exe87⤵PID:2936
-
\??\c:\brltld.exec:\brltld.exe88⤵PID:2800
-
\??\c:\rnrxx.exec:\rnrxx.exe89⤵PID:2740
-
\??\c:\bnblph.exec:\bnblph.exe90⤵PID:2804
-
\??\c:\tphxrpb.exec:\tphxrpb.exe91⤵PID:2284
-
\??\c:\vdbxtxf.exec:\vdbxtxf.exe92⤵PID:2236
-
\??\c:\xtvdv.exec:\xtvdv.exe93⤵PID:884
-
\??\c:\tdnxnx.exec:\tdnxnx.exe94⤵PID:1748
-
\??\c:\bbtdlp.exec:\bbtdlp.exe95⤵PID:3068
-
\??\c:\rbfphl.exec:\rbfphl.exe96⤵PID:2128
-
\??\c:\ljdrr.exec:\ljdrr.exe97⤵PID:2084
-
\??\c:\rppppp.exec:\rppppp.exe98⤵PID:3056
-
\??\c:\fttlp.exec:\fttlp.exe99⤵PID:2500
-
\??\c:\bhlvh.exec:\bhlvh.exe100⤵PID:2392
-
\??\c:\xtnnpv.exec:\xtnnpv.exe101⤵PID:632
-
\??\c:\hvxhhx.exec:\hvxhhx.exe102⤵PID:2344
-
\??\c:\bvtvfxl.exec:\bvtvfxl.exe103⤵PID:852
-
\??\c:\hrlthn.exec:\hrlthn.exe104⤵
- System Location Discovery: System Language Discovery
PID:2352 -
\??\c:\jdftrpb.exec:\jdftrpb.exe105⤵PID:2644
-
\??\c:\rxbbh.exec:\rxbbh.exe106⤵PID:1680
-
\??\c:\htdtvft.exec:\htdtvft.exe107⤵PID:316
-
\??\c:\ddrtxfl.exec:\ddrtxfl.exe108⤵PID:516
-
\??\c:\xxtbvx.exec:\xxtbvx.exe109⤵PID:940
-
\??\c:\dnfpn.exec:\dnfpn.exe110⤵PID:1560
-
\??\c:\hrdpxrf.exec:\hrdpxrf.exe111⤵PID:2988
-
\??\c:\tvrxnph.exec:\tvrxnph.exe112⤵PID:1028
-
\??\c:\jnnjn.exec:\jnnjn.exe113⤵PID:1032
-
\??\c:\jxdph.exec:\jxdph.exe114⤵
- System Location Discovery: System Language Discovery
PID:2932 -
\??\c:\jvjnp.exec:\jvjnp.exe115⤵PID:820
-
\??\c:\hvvhrf.exec:\hvvhrf.exe116⤵PID:2628
-
\??\c:\tvnvxnj.exec:\tvnvxnj.exe117⤵PID:1248
-
\??\c:\vndbf.exec:\vndbf.exe118⤵PID:912
-
\??\c:\dpbtbv.exec:\dpbtbv.exe119⤵PID:2052
-
\??\c:\pflbx.exec:\pflbx.exe120⤵PID:2148
-
\??\c:\tpvtb.exec:\tpvtb.exe121⤵PID:1488
-
\??\c:\nrdlbhh.exec:\nrdlbhh.exe122⤵PID:876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-