Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 22:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bc410a0881a2573adb750f0b11c677097b3945666e78084eec82b9489dd7efc2.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
bc410a0881a2573adb750f0b11c677097b3945666e78084eec82b9489dd7efc2.exe
-
Size
455KB
-
MD5
e0d00ed264faec5d76d903c971c763e0
-
SHA1
ad09bd392b05e1e7363977bb402f5fb82ff0e1b7
-
SHA256
bc410a0881a2573adb750f0b11c677097b3945666e78084eec82b9489dd7efc2
-
SHA512
92da5a8971317a490735ef7fbce0ff19a513c585adb5f279e4e015d39fef09cadd399e67311eb4b03c8ea9644b3332db6363b262714ad2b1a9e3bdd6cc3f0a81
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeQ:q7Tc2NYHUrAwfMp3CDQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2820-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-7-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2240-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-38-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2328-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-76-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2740-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-219-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1456-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1464-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/108-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/688-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-390-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2352-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-453-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2116-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-862-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2348-871-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2792-927-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2240 nlxjdtb.exe 2460 llhlbn.exe 2976 thtxvh.exe 2328 rvtxp.exe 2900 hdhnrf.exe 864 rfthjvh.exe 2740 ltfppfr.exe 2816 ttxrbjr.exe 2552 ftdlb.exe 2384 llfdrn.exe 3060 pnthndh.exe 1472 tblvrj.exe 2176 fldnndp.exe 1872 jfvrj.exe 1332 vvhhltf.exe 2092 jlpvv.exe 1496 vfhhh.exe 2196 ntdtxv.exe 288 vfrttll.exe 2088 rllrxtf.exe 1136 hdlhl.exe 1936 tjthbp.exe 1456 ftvnl.exe 1040 xnrbpbd.exe 1464 fvdpl.exe 932 rhtxfdn.exe 2188 hfpttl.exe 108 dpjjv.exe 1716 ljhnhl.exe 1004 vdjfn.exe 1020 xhlvrj.exe 688 htbxjr.exe 2348 dnrrnxf.exe 1592 hjpdpnx.exe 2884 fblxxrt.exe 2992 rlblj.exe 2940 lnxhnv.exe 2980 lfhbt.exe 2768 hnxnpjl.exe 2876 xrhtld.exe 2908 nxxfr.exe 2760 ltprh.exe 2740 ljxfl.exe 2504 xfvpxhh.exe 2580 xrxpv.exe 2352 vdxft.exe 3016 vhlft.exe 3056 ntxhrtb.exe 1744 pxxdbd.exe 2176 pphpx.exe 1900 fdfhp.exe 2916 tnthlxr.exe 1248 nvfrp.exe 2472 rrbrnr.exe 2292 vvdjp.exe 2440 rfhxjvv.exe 1972 xxfhl.exe 2704 lljrblf.exe 2468 lppfr.exe 960 tpvvjxh.exe 2116 hndbvd.exe 1912 hlltxx.exe 692 trhxlr.exe 1804 hhlrx.exe -
resource yara_rule behavioral1/memory/2820-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/688-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-875-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-871-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/3028-907-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2792-927-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvxjbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fptfhdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdhnrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfvnrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdfdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjhdph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlxxnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnxfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnrxhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhbjptx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jndnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pffbfhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fphrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxxbnrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljnppl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldvlfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxfdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvttttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldrpnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdtxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhdpfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpnjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfpfjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2820 wrote to memory of 2240 2820 bc410a0881a2573adb750f0b11c677097b3945666e78084eec82b9489dd7efc2.exe 30 PID 2820 wrote to memory of 2240 2820 bc410a0881a2573adb750f0b11c677097b3945666e78084eec82b9489dd7efc2.exe 30 PID 2820 wrote to memory of 2240 2820 bc410a0881a2573adb750f0b11c677097b3945666e78084eec82b9489dd7efc2.exe 30 PID 2820 wrote to memory of 2240 2820 bc410a0881a2573adb750f0b11c677097b3945666e78084eec82b9489dd7efc2.exe 30 PID 2240 wrote to memory of 2460 2240 nlxjdtb.exe 31 PID 2240 wrote to memory of 2460 2240 nlxjdtb.exe 31 PID 2240 wrote to memory of 2460 2240 nlxjdtb.exe 31 PID 2240 wrote to memory of 2460 2240 nlxjdtb.exe 31 PID 2460 wrote to memory of 2976 2460 llhlbn.exe 32 PID 2460 wrote to memory of 2976 2460 llhlbn.exe 32 PID 2460 wrote to memory of 2976 2460 llhlbn.exe 32 PID 2460 wrote to memory of 2976 2460 llhlbn.exe 32 PID 2976 wrote to memory of 2328 2976 thtxvh.exe 33 PID 2976 wrote to memory of 2328 2976 thtxvh.exe 33 PID 2976 wrote to memory of 2328 2976 thtxvh.exe 33 PID 2976 wrote to memory of 2328 2976 thtxvh.exe 33 PID 2328 wrote to memory of 2900 2328 rvtxp.exe 34 PID 2328 wrote to memory of 2900 2328 rvtxp.exe 34 PID 2328 wrote to memory of 2900 2328 rvtxp.exe 34 PID 2328 wrote to memory of 2900 2328 rvtxp.exe 34 PID 2900 wrote to memory of 864 2900 hdhnrf.exe 35 PID 2900 wrote to memory of 864 2900 hdhnrf.exe 35 PID 2900 wrote to memory of 864 2900 hdhnrf.exe 35 PID 2900 wrote to memory of 864 2900 hdhnrf.exe 35 PID 864 wrote to memory of 2740 864 rfthjvh.exe 36 PID 864 wrote to memory of 2740 864 rfthjvh.exe 36 PID 864 wrote to memory of 2740 864 rfthjvh.exe 36 PID 864 wrote to memory of 2740 864 rfthjvh.exe 36 PID 2740 wrote to memory of 2816 2740 ltfppfr.exe 37 PID 2740 wrote to memory of 2816 2740 ltfppfr.exe 37 PID 2740 wrote to memory of 2816 2740 ltfppfr.exe 37 PID 2740 wrote to memory of 2816 2740 ltfppfr.exe 37 PID 2816 wrote to memory of 2552 2816 ttxrbjr.exe 38 PID 2816 wrote to memory of 2552 2816 ttxrbjr.exe 38 PID 2816 wrote to memory of 2552 2816 ttxrbjr.exe 38 PID 2816 wrote to memory of 2552 2816 ttxrbjr.exe 38 PID 2552 wrote to memory of 2384 2552 ftdlb.exe 39 PID 2552 wrote to memory of 2384 2552 ftdlb.exe 39 PID 2552 wrote to memory of 2384 2552 ftdlb.exe 39 PID 2552 wrote to memory of 2384 2552 ftdlb.exe 39 PID 2384 wrote to memory of 3060 2384 llfdrn.exe 40 PID 2384 wrote to memory of 3060 2384 llfdrn.exe 40 PID 2384 wrote to memory of 3060 2384 llfdrn.exe 40 PID 2384 wrote to memory of 3060 2384 llfdrn.exe 40 PID 3060 wrote to memory of 1472 3060 pnthndh.exe 41 PID 3060 wrote to memory of 1472 3060 pnthndh.exe 41 PID 3060 wrote to memory of 1472 3060 pnthndh.exe 41 PID 3060 wrote to memory of 1472 3060 pnthndh.exe 41 PID 1472 wrote to memory of 2176 1472 tblvrj.exe 42 PID 1472 wrote to memory of 2176 1472 tblvrj.exe 42 PID 1472 wrote to memory of 2176 1472 tblvrj.exe 42 PID 1472 wrote to memory of 2176 1472 tblvrj.exe 42 PID 2176 wrote to memory of 1872 2176 fldnndp.exe 43 PID 2176 wrote to memory of 1872 2176 fldnndp.exe 43 PID 2176 wrote to memory of 1872 2176 fldnndp.exe 43 PID 2176 wrote to memory of 1872 2176 fldnndp.exe 43 PID 1872 wrote to memory of 1332 1872 jfvrj.exe 44 PID 1872 wrote to memory of 1332 1872 jfvrj.exe 44 PID 1872 wrote to memory of 1332 1872 jfvrj.exe 44 PID 1872 wrote to memory of 1332 1872 jfvrj.exe 44 PID 1332 wrote to memory of 2092 1332 vvhhltf.exe 45 PID 1332 wrote to memory of 2092 1332 vvhhltf.exe 45 PID 1332 wrote to memory of 2092 1332 vvhhltf.exe 45 PID 1332 wrote to memory of 2092 1332 vvhhltf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc410a0881a2573adb750f0b11c677097b3945666e78084eec82b9489dd7efc2.exe"C:\Users\Admin\AppData\Local\Temp\bc410a0881a2573adb750f0b11c677097b3945666e78084eec82b9489dd7efc2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\nlxjdtb.exec:\nlxjdtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\llhlbn.exec:\llhlbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\thtxvh.exec:\thtxvh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\rvtxp.exec:\rvtxp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\hdhnrf.exec:\hdhnrf.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\rfthjvh.exec:\rfthjvh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\ltfppfr.exec:\ltfppfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\ttxrbjr.exec:\ttxrbjr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\ftdlb.exec:\ftdlb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\llfdrn.exec:\llfdrn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\pnthndh.exec:\pnthndh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\tblvrj.exec:\tblvrj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\fldnndp.exec:\fldnndp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\jfvrj.exec:\jfvrj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\vvhhltf.exec:\vvhhltf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\jlpvv.exec:\jlpvv.exe17⤵
- Executes dropped EXE
PID:2092 -
\??\c:\vfhhh.exec:\vfhhh.exe18⤵
- Executes dropped EXE
PID:1496 -
\??\c:\ntdtxv.exec:\ntdtxv.exe19⤵
- Executes dropped EXE
PID:2196 -
\??\c:\vfrttll.exec:\vfrttll.exe20⤵
- Executes dropped EXE
PID:288 -
\??\c:\rllrxtf.exec:\rllrxtf.exe21⤵
- Executes dropped EXE
PID:2088 -
\??\c:\hdlhl.exec:\hdlhl.exe22⤵
- Executes dropped EXE
PID:1136 -
\??\c:\tjthbp.exec:\tjthbp.exe23⤵
- Executes dropped EXE
PID:1936 -
\??\c:\ftvnl.exec:\ftvnl.exe24⤵
- Executes dropped EXE
PID:1456 -
\??\c:\xnrbpbd.exec:\xnrbpbd.exe25⤵
- Executes dropped EXE
PID:1040 -
\??\c:\fvdpl.exec:\fvdpl.exe26⤵
- Executes dropped EXE
PID:1464 -
\??\c:\rhtxfdn.exec:\rhtxfdn.exe27⤵
- Executes dropped EXE
PID:932 -
\??\c:\hfpttl.exec:\hfpttl.exe28⤵
- Executes dropped EXE
PID:2188 -
\??\c:\dpjjv.exec:\dpjjv.exe29⤵
- Executes dropped EXE
PID:108 -
\??\c:\ljhnhl.exec:\ljhnhl.exe30⤵
- Executes dropped EXE
PID:1716 -
\??\c:\vdjfn.exec:\vdjfn.exe31⤵
- Executes dropped EXE
PID:1004 -
\??\c:\xhlvrj.exec:\xhlvrj.exe32⤵
- Executes dropped EXE
PID:1020 -
\??\c:\htbxjr.exec:\htbxjr.exe33⤵
- Executes dropped EXE
PID:688 -
\??\c:\dnrrnxf.exec:\dnrrnxf.exe34⤵
- Executes dropped EXE
PID:2348 -
\??\c:\hjpdpnx.exec:\hjpdpnx.exe35⤵
- Executes dropped EXE
PID:1592 -
\??\c:\fblxxrt.exec:\fblxxrt.exe36⤵
- Executes dropped EXE
PID:2884 -
\??\c:\rlblj.exec:\rlblj.exe37⤵
- Executes dropped EXE
PID:2992 -
\??\c:\lnxhnv.exec:\lnxhnv.exe38⤵
- Executes dropped EXE
PID:2940 -
\??\c:\lfhbt.exec:\lfhbt.exe39⤵
- Executes dropped EXE
PID:2980 -
\??\c:\hnxnpjl.exec:\hnxnpjl.exe40⤵
- Executes dropped EXE
PID:2768 -
\??\c:\xrhtld.exec:\xrhtld.exe41⤵
- Executes dropped EXE
PID:2876 -
\??\c:\nxxfr.exec:\nxxfr.exe42⤵
- Executes dropped EXE
PID:2908 -
\??\c:\ltprh.exec:\ltprh.exe43⤵
- Executes dropped EXE
PID:2760 -
\??\c:\ljxfl.exec:\ljxfl.exe44⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xfvpxhh.exec:\xfvpxhh.exe45⤵
- Executes dropped EXE
PID:2504 -
\??\c:\xrxpv.exec:\xrxpv.exe46⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vdxft.exec:\vdxft.exe47⤵
- Executes dropped EXE
PID:2352 -
\??\c:\vhlft.exec:\vhlft.exe48⤵
- Executes dropped EXE
PID:3016 -
\??\c:\ntxhrtb.exec:\ntxhrtb.exe49⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pxxdbd.exec:\pxxdbd.exe50⤵
- Executes dropped EXE
PID:1744 -
\??\c:\pphpx.exec:\pphpx.exe51⤵
- Executes dropped EXE
PID:2176 -
\??\c:\fdfhp.exec:\fdfhp.exe52⤵
- Executes dropped EXE
PID:1900 -
\??\c:\tnthlxr.exec:\tnthlxr.exe53⤵
- Executes dropped EXE
PID:2916 -
\??\c:\nvfrp.exec:\nvfrp.exe54⤵
- Executes dropped EXE
PID:1248 -
\??\c:\rrbrnr.exec:\rrbrnr.exe55⤵
- Executes dropped EXE
PID:2472 -
\??\c:\vvdjp.exec:\vvdjp.exe56⤵
- Executes dropped EXE
PID:2292 -
\??\c:\rfhxjvv.exec:\rfhxjvv.exe57⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xxfhl.exec:\xxfhl.exe58⤵
- Executes dropped EXE
PID:1972 -
\??\c:\lljrblf.exec:\lljrblf.exe59⤵
- Executes dropped EXE
PID:2704 -
\??\c:\lppfr.exec:\lppfr.exe60⤵
- Executes dropped EXE
PID:2468 -
\??\c:\tpvvjxh.exec:\tpvvjxh.exe61⤵
- Executes dropped EXE
PID:960 -
\??\c:\hndbvd.exec:\hndbvd.exe62⤵
- Executes dropped EXE
PID:2116 -
\??\c:\hlltxx.exec:\hlltxx.exe63⤵
- Executes dropped EXE
PID:1912 -
\??\c:\trhxlr.exec:\trhxlr.exe64⤵
- Executes dropped EXE
PID:692 -
\??\c:\hhlrx.exec:\hhlrx.exe65⤵
- Executes dropped EXE
PID:1804 -
\??\c:\nddvbpd.exec:\nddvbpd.exe66⤵PID:2396
-
\??\c:\hrhpj.exec:\hrhpj.exe67⤵PID:1740
-
\??\c:\plnnj.exec:\plnnj.exe68⤵PID:1896
-
\??\c:\hlthn.exec:\hlthn.exe69⤵PID:2188
-
\??\c:\hbhrj.exec:\hbhrj.exe70⤵PID:2676
-
\??\c:\tplpbt.exec:\tplpbt.exe71⤵PID:2624
-
\??\c:\njlxbfx.exec:\njlxbfx.exe72⤵PID:2544
-
\??\c:\hbxrtrx.exec:\hbxrtrx.exe73⤵PID:1724
-
\??\c:\xptrxrv.exec:\xptrxrv.exe74⤵PID:2208
-
\??\c:\fjvlf.exec:\fjvlf.exe75⤵PID:2932
-
\??\c:\ptxrhxf.exec:\ptxrhxf.exe76⤵PID:2416
-
\??\c:\vxpvj.exec:\vxpvj.exe77⤵PID:2240
-
\??\c:\pdhnr.exec:\pdhnr.exe78⤵PID:2848
-
\??\c:\btxbh.exec:\btxbh.exe79⤵PID:2892
-
\??\c:\ptvnhn.exec:\ptvnhn.exe80⤵PID:2344
-
\??\c:\xrlfjbp.exec:\xrlfjbp.exe81⤵PID:2328
-
\??\c:\rlfrj.exec:\rlfrj.exe82⤵PID:2980
-
\??\c:\lrlffhp.exec:\lrlffhp.exe83⤵PID:2768
-
\??\c:\nnvdbhp.exec:\nnvdbhp.exe84⤵PID:2736
-
\??\c:\dfjhb.exec:\dfjhb.exe85⤵PID:2804
-
\??\c:\pxhbhn.exec:\pxhbhn.exe86⤵
- System Location Discovery: System Language Discovery
PID:2760 -
\??\c:\tdlpxh.exec:\tdlpxh.exe87⤵PID:2556
-
\??\c:\nbpbvn.exec:\nbpbvn.exe88⤵PID:1576
-
\??\c:\fnlnx.exec:\fnlnx.exe89⤵PID:2412
-
\??\c:\xrnrdjr.exec:\xrnrdjr.exe90⤵PID:3012
-
\??\c:\dlpphf.exec:\dlpphf.exe91⤵PID:1888
-
\??\c:\hvfnbj.exec:\hvfnbj.exe92⤵PID:924
-
\??\c:\rhblj.exec:\rhblj.exe93⤵PID:2028
-
\??\c:\jtvhth.exec:\jtvhth.exe94⤵PID:2728
-
\??\c:\fddtp.exec:\fddtp.exe95⤵PID:1704
-
\??\c:\xdtvrb.exec:\xdtvrb.exe96⤵PID:560
-
\??\c:\fjbxv.exec:\fjbxv.exe97⤵PID:788
-
\??\c:\bjhvxt.exec:\bjhvxt.exe98⤵PID:2296
-
\??\c:\ntprbtr.exec:\ntprbtr.exe99⤵PID:2308
-
\??\c:\txhdv.exec:\txhdv.exe100⤵PID:2216
-
\??\c:\thpdx.exec:\thpdx.exe101⤵PID:1200
-
\??\c:\xfdxdl.exec:\xfdxdl.exe102⤵PID:2712
-
\??\c:\jvxndn.exec:\jvxndn.exe103⤵PID:2456
-
\??\c:\hnhhpl.exec:\hnhhpl.exe104⤵PID:2164
-
\??\c:\fplbpt.exec:\fplbpt.exe105⤵PID:548
-
\??\c:\bbfphhd.exec:\bbfphhd.exe106⤵PID:2632
-
\??\c:\vplpv.exec:\vplpv.exe107⤵PID:620
-
\??\c:\npllxh.exec:\npllxh.exe108⤵PID:1224
-
\??\c:\txfvd.exec:\txfvd.exe109⤵PID:2052
-
\??\c:\pppnjp.exec:\pppnjp.exe110⤵PID:1596
-
\??\c:\prbxfrx.exec:\prbxfrx.exe111⤵PID:2660
-
\??\c:\dxxxdpn.exec:\dxxxdpn.exe112⤵PID:1680
-
\??\c:\plhtjbp.exec:\plhtjbp.exe113⤵PID:2136
-
\??\c:\nttvl.exec:\nttvl.exe114⤵PID:2564
-
\??\c:\vjhnj.exec:\vjhnj.exe115⤵PID:1716
-
\??\c:\bplrh.exec:\bplrh.exe116⤵PID:2128
-
\??\c:\rfvnrd.exec:\rfvnrd.exe117⤵
- System Location Discovery: System Language Discovery
PID:1964 -
\??\c:\dtrfn.exec:\dtrfn.exe118⤵PID:2124
-
\??\c:\jjnpfvt.exec:\jjnpfvt.exe119⤵PID:576
-
\??\c:\jfrjr.exec:\jfrjr.exe120⤵PID:2348
-
\??\c:\thpnflp.exec:\thpnflp.exe121⤵PID:2480
-
\??\c:\xvhtdj.exec:\xvhtdj.exe122⤵PID:2888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-