Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 23:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c86e31ee7c8895188798ee7bb8913b3d636b2d0b34af3f958324c8957b1b8ad9N.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
c86e31ee7c8895188798ee7bb8913b3d636b2d0b34af3f958324c8957b1b8ad9N.exe
-
Size
456KB
-
MD5
1a3f740b079dd2b1bd6043ded0520b70
-
SHA1
dd8ea0ca452e3067b6a0441e6bbfef493fa4b4e9
-
SHA256
c86e31ee7c8895188798ee7bb8913b3d636b2d0b34af3f958324c8957b1b8ad9
-
SHA512
7dee575f0ce4c62b32898fa6903f10a3f4587cbbb43bdf0a9b8227d0b995b1ef0d7de62d1f197cea23c05b187cdaae80277f1b63b68040bb44ca3a909378a446
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeN:q7Tc2NYHUrAwfMp3CDN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2188-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-54-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2812-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1064-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/272-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-285-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2544-286-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/900-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-300-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1944-304-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1944-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-312-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2080-324-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1600-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-353-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2812-372-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2812-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-461-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2776-460-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2636-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-502-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1556-549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-601-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2372-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-699-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1560 rtnrl.exe 2304 jldflfv.exe 2648 ffvrn.exe 2956 vvdxldf.exe 2488 njddrvj.exe 2812 tflndtd.exe 1264 vrvpthv.exe 2816 nbtjxp.exe 2676 fbtfbtt.exe 2204 ffpfv.exe 2284 fdlbvfr.exe 2972 frvxfj.exe 2340 fdjhnfr.exe 2944 hvvxvlj.exe 1096 tjhjb.exe 2008 pxxtlrv.exe 1992 lthjtvr.exe 3012 hljdvdl.exe 2052 txpfjf.exe 2100 vvhfxvt.exe 1344 bdnln.exe 2440 hrdjjbl.exe 1064 vfdvvj.exe 1552 njjtvpt.exe 2652 thftrv.exe 1184 rjnrr.exe 272 jdnjxrb.exe 2436 dnlxb.exe 1892 jxrjt.exe 2544 hdldfnr.exe 900 vxrjbd.exe 1944 vhnff.exe 2408 tjtrtdn.exe 2080 tbhrxbv.exe 1600 pvrfjjb.exe 2632 dhjvldt.exe 2068 fhpdtlt.exe 2808 rxdtjd.exe 2820 plplp.exe 2952 bnbbr.exe 2812 bhhxrh.exe 2700 hfnxtj.exe 1904 rnnfr.exe 2708 nrrffd.exe 1532 ltlvn.exe 2724 fprpfx.exe 2568 njpfl.exe 1460 hbbxv.exe 3016 hvrbpdl.exe 1456 xhjld.exe 1152 jpfxbn.exe 2020 xhfnrp.exe 1484 nhrtvd.exe 2776 rbdndx.exe 2960 xxrtbrf.exe 2636 lhttd.exe 2276 nphxxdl.exe 2236 djbxjh.exe 676 jtrnf.exe 1344 xnbnt.exe 1876 tjhvjtl.exe 2440 dxlbdr.exe 1068 bjfxj.exe 1728 tptthv.exe -
resource yara_rule behavioral1/memory/2188-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/272-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-460-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2636-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-727-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnxptjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbvppn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltlvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbvfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrtfbdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffvltt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rplptf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trhfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnddxhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrprjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfdhxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtllnnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvxbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnjfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhvrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjbpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdlbvfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhjvldt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbpbbrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpjbnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tptthv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltxpvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjlxtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtnrth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhjlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbrnljf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxpht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfpvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjnjvxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rftrdrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhftr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptnvxbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxxtlrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxrjbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhnff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fprxjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlptn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnjdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tftnlld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txphdrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 1560 2188 c86e31ee7c8895188798ee7bb8913b3d636b2d0b34af3f958324c8957b1b8ad9N.exe 30 PID 2188 wrote to memory of 1560 2188 c86e31ee7c8895188798ee7bb8913b3d636b2d0b34af3f958324c8957b1b8ad9N.exe 30 PID 2188 wrote to memory of 1560 2188 c86e31ee7c8895188798ee7bb8913b3d636b2d0b34af3f958324c8957b1b8ad9N.exe 30 PID 2188 wrote to memory of 1560 2188 c86e31ee7c8895188798ee7bb8913b3d636b2d0b34af3f958324c8957b1b8ad9N.exe 30 PID 1560 wrote to memory of 2304 1560 rtnrl.exe 31 PID 1560 wrote to memory of 2304 1560 rtnrl.exe 31 PID 1560 wrote to memory of 2304 1560 rtnrl.exe 31 PID 1560 wrote to memory of 2304 1560 rtnrl.exe 31 PID 2304 wrote to memory of 2648 2304 jldflfv.exe 32 PID 2304 wrote to memory of 2648 2304 jldflfv.exe 32 PID 2304 wrote to memory of 2648 2304 jldflfv.exe 32 PID 2304 wrote to memory of 2648 2304 jldflfv.exe 32 PID 2648 wrote to memory of 2956 2648 ffvrn.exe 33 PID 2648 wrote to memory of 2956 2648 ffvrn.exe 33 PID 2648 wrote to memory of 2956 2648 ffvrn.exe 33 PID 2648 wrote to memory of 2956 2648 ffvrn.exe 33 PID 2956 wrote to memory of 2488 2956 vvdxldf.exe 34 PID 2956 wrote to memory of 2488 2956 vvdxldf.exe 34 PID 2956 wrote to memory of 2488 2956 vvdxldf.exe 34 PID 2956 wrote to memory of 2488 2956 vvdxldf.exe 34 PID 2488 wrote to memory of 2812 2488 njddrvj.exe 35 PID 2488 wrote to memory of 2812 2488 njddrvj.exe 35 PID 2488 wrote to memory of 2812 2488 njddrvj.exe 35 PID 2488 wrote to memory of 2812 2488 njddrvj.exe 35 PID 2812 wrote to memory of 1264 2812 tflndtd.exe 36 PID 2812 wrote to memory of 1264 2812 tflndtd.exe 36 PID 2812 wrote to memory of 1264 2812 tflndtd.exe 36 PID 2812 wrote to memory of 1264 2812 tflndtd.exe 36 PID 1264 wrote to memory of 2816 1264 vrvpthv.exe 37 PID 1264 wrote to memory of 2816 1264 vrvpthv.exe 37 PID 1264 wrote to memory of 2816 1264 vrvpthv.exe 37 PID 1264 wrote to memory of 2816 1264 vrvpthv.exe 37 PID 2816 wrote to memory of 2676 2816 nbtjxp.exe 38 PID 2816 wrote to memory of 2676 2816 nbtjxp.exe 38 PID 2816 wrote to memory of 2676 2816 nbtjxp.exe 38 PID 2816 wrote to memory of 2676 2816 nbtjxp.exe 38 PID 2676 wrote to memory of 2204 2676 fbtfbtt.exe 39 PID 2676 wrote to memory of 2204 2676 fbtfbtt.exe 39 PID 2676 wrote to memory of 2204 2676 fbtfbtt.exe 39 PID 2676 wrote to memory of 2204 2676 fbtfbtt.exe 39 PID 2204 wrote to memory of 2284 2204 ffpfv.exe 40 PID 2204 wrote to memory of 2284 2204 ffpfv.exe 40 PID 2204 wrote to memory of 2284 2204 ffpfv.exe 40 PID 2204 wrote to memory of 2284 2204 ffpfv.exe 40 PID 2284 wrote to memory of 2972 2284 fdlbvfr.exe 41 PID 2284 wrote to memory of 2972 2284 fdlbvfr.exe 41 PID 2284 wrote to memory of 2972 2284 fdlbvfr.exe 41 PID 2284 wrote to memory of 2972 2284 fdlbvfr.exe 41 PID 2972 wrote to memory of 2340 2972 frvxfj.exe 42 PID 2972 wrote to memory of 2340 2972 frvxfj.exe 42 PID 2972 wrote to memory of 2340 2972 frvxfj.exe 42 PID 2972 wrote to memory of 2340 2972 frvxfj.exe 42 PID 2340 wrote to memory of 2944 2340 fdjhnfr.exe 43 PID 2340 wrote to memory of 2944 2340 fdjhnfr.exe 43 PID 2340 wrote to memory of 2944 2340 fdjhnfr.exe 43 PID 2340 wrote to memory of 2944 2340 fdjhnfr.exe 43 PID 2944 wrote to memory of 1096 2944 hvvxvlj.exe 44 PID 2944 wrote to memory of 1096 2944 hvvxvlj.exe 44 PID 2944 wrote to memory of 1096 2944 hvvxvlj.exe 44 PID 2944 wrote to memory of 1096 2944 hvvxvlj.exe 44 PID 1096 wrote to memory of 2008 1096 tjhjb.exe 45 PID 1096 wrote to memory of 2008 1096 tjhjb.exe 45 PID 1096 wrote to memory of 2008 1096 tjhjb.exe 45 PID 1096 wrote to memory of 2008 1096 tjhjb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c86e31ee7c8895188798ee7bb8913b3d636b2d0b34af3f958324c8957b1b8ad9N.exe"C:\Users\Admin\AppData\Local\Temp\c86e31ee7c8895188798ee7bb8913b3d636b2d0b34af3f958324c8957b1b8ad9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\rtnrl.exec:\rtnrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\jldflfv.exec:\jldflfv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\ffvrn.exec:\ffvrn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\vvdxldf.exec:\vvdxldf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\njddrvj.exec:\njddrvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\tflndtd.exec:\tflndtd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\vrvpthv.exec:\vrvpthv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\nbtjxp.exec:\nbtjxp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\fbtfbtt.exec:\fbtfbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\ffpfv.exec:\ffpfv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\fdlbvfr.exec:\fdlbvfr.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\frvxfj.exec:\frvxfj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\fdjhnfr.exec:\fdjhnfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\hvvxvlj.exec:\hvvxvlj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\tjhjb.exec:\tjhjb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\pxxtlrv.exec:\pxxtlrv.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2008 -
\??\c:\lthjtvr.exec:\lthjtvr.exe18⤵
- Executes dropped EXE
PID:1992 -
\??\c:\hljdvdl.exec:\hljdvdl.exe19⤵
- Executes dropped EXE
PID:3012 -
\??\c:\txpfjf.exec:\txpfjf.exe20⤵
- Executes dropped EXE
PID:2052 -
\??\c:\vvhfxvt.exec:\vvhfxvt.exe21⤵
- Executes dropped EXE
PID:2100 -
\??\c:\bdnln.exec:\bdnln.exe22⤵
- Executes dropped EXE
PID:1344 -
\??\c:\hrdjjbl.exec:\hrdjjbl.exe23⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vfdvvj.exec:\vfdvvj.exe24⤵
- Executes dropped EXE
PID:1064 -
\??\c:\njjtvpt.exec:\njjtvpt.exe25⤵
- Executes dropped EXE
PID:1552 -
\??\c:\thftrv.exec:\thftrv.exe26⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rjnrr.exec:\rjnrr.exe27⤵
- Executes dropped EXE
PID:1184 -
\??\c:\jdnjxrb.exec:\jdnjxrb.exe28⤵
- Executes dropped EXE
PID:272 -
\??\c:\dnlxb.exec:\dnlxb.exe29⤵
- Executes dropped EXE
PID:2436 -
\??\c:\jxrjt.exec:\jxrjt.exe30⤵
- Executes dropped EXE
PID:1892 -
\??\c:\hdldfnr.exec:\hdldfnr.exe31⤵
- Executes dropped EXE
PID:2544 -
\??\c:\vxrjbd.exec:\vxrjbd.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:900 -
\??\c:\vhnff.exec:\vhnff.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1944 -
\??\c:\tjtrtdn.exec:\tjtrtdn.exe34⤵
- Executes dropped EXE
PID:2408 -
\??\c:\tbhrxbv.exec:\tbhrxbv.exe35⤵
- Executes dropped EXE
PID:2080 -
\??\c:\pvrfjjb.exec:\pvrfjjb.exe36⤵
- Executes dropped EXE
PID:1600 -
\??\c:\dhjvldt.exec:\dhjvldt.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2632 -
\??\c:\fhpdtlt.exec:\fhpdtlt.exe38⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rxdtjd.exec:\rxdtjd.exe39⤵
- Executes dropped EXE
PID:2808 -
\??\c:\plplp.exec:\plplp.exe40⤵
- Executes dropped EXE
PID:2820 -
\??\c:\bnbbr.exec:\bnbbr.exe41⤵
- Executes dropped EXE
PID:2952 -
\??\c:\bhhxrh.exec:\bhhxrh.exe42⤵
- Executes dropped EXE
PID:2812 -
\??\c:\hfnxtj.exec:\hfnxtj.exe43⤵
- Executes dropped EXE
PID:2700 -
\??\c:\rnnfr.exec:\rnnfr.exe44⤵
- Executes dropped EXE
PID:1904 -
\??\c:\nrrffd.exec:\nrrffd.exe45⤵
- Executes dropped EXE
PID:2708 -
\??\c:\ltlvn.exec:\ltlvn.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1532 -
\??\c:\fprpfx.exec:\fprpfx.exe47⤵
- Executes dropped EXE
PID:2724 -
\??\c:\njpfl.exec:\njpfl.exe48⤵
- Executes dropped EXE
PID:2568 -
\??\c:\hbbxv.exec:\hbbxv.exe49⤵
- Executes dropped EXE
PID:1460 -
\??\c:\hvrbpdl.exec:\hvrbpdl.exe50⤵
- Executes dropped EXE
PID:3016 -
\??\c:\xhjld.exec:\xhjld.exe51⤵
- Executes dropped EXE
PID:1456 -
\??\c:\jpfxbn.exec:\jpfxbn.exe52⤵
- Executes dropped EXE
PID:1152 -
\??\c:\xhfnrp.exec:\xhfnrp.exe53⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nhrtvd.exec:\nhrtvd.exe54⤵
- Executes dropped EXE
PID:1484 -
\??\c:\rbdndx.exec:\rbdndx.exe55⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xxrtbrf.exec:\xxrtbrf.exe56⤵
- Executes dropped EXE
PID:2960 -
\??\c:\lhttd.exec:\lhttd.exe57⤵
- Executes dropped EXE
PID:2636 -
\??\c:\nphxxdl.exec:\nphxxdl.exe58⤵
- Executes dropped EXE
PID:2276 -
\??\c:\djbxjh.exec:\djbxjh.exe59⤵
- Executes dropped EXE
PID:2236 -
\??\c:\jtrnf.exec:\jtrnf.exe60⤵
- Executes dropped EXE
PID:676 -
\??\c:\xnbnt.exec:\xnbnt.exe61⤵
- Executes dropped EXE
PID:1344 -
\??\c:\tjhvjtl.exec:\tjhvjtl.exe62⤵
- Executes dropped EXE
PID:1876 -
\??\c:\dxlbdr.exec:\dxlbdr.exe63⤵
- Executes dropped EXE
PID:2440 -
\??\c:\bjfxj.exec:\bjfxj.exe64⤵
- Executes dropped EXE
PID:1068 -
\??\c:\tptthv.exec:\tptthv.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1728 -
\??\c:\tnhjpr.exec:\tnhjpr.exe66⤵PID:2652
-
\??\c:\jjhnxd.exec:\jjhnxd.exe67⤵PID:1192
-
\??\c:\dfxxln.exec:\dfxxln.exe68⤵PID:1556
-
\??\c:\xftpnp.exec:\xftpnp.exe69⤵PID:2260
-
\??\c:\vdhtx.exec:\vdhtx.exe70⤵PID:2436
-
\??\c:\pfdndxv.exec:\pfdndxv.exe71⤵PID:1896
-
\??\c:\vbjphjv.exec:\vbjphjv.exe72⤵PID:572
-
\??\c:\xdvndv.exec:\xdvndv.exe73⤵PID:1824
-
\??\c:\blrjlb.exec:\blrjlb.exe74⤵PID:2384
-
\??\c:\nhtjlh.exec:\nhtjlh.exe75⤵PID:2404
-
\??\c:\lhpph.exec:\lhpph.exe76⤵PID:2372
-
\??\c:\nlvvv.exec:\nlvvv.exe77⤵
- System Location Discovery: System Language Discovery
PID:1576 -
\??\c:\lvrnbdr.exec:\lvrnbdr.exe78⤵PID:2168
-
\??\c:\dfrhnrn.exec:\dfrhnrn.exe79⤵PID:3040
-
\??\c:\lvxdpr.exec:\lvxdpr.exe80⤵PID:2532
-
\??\c:\vtbjhvb.exec:\vtbjhvb.exe81⤵PID:2068
-
\??\c:\rpvddnj.exec:\rpvddnj.exe82⤵PID:2892
-
\??\c:\bjlrb.exec:\bjlrb.exe83⤵PID:2784
-
\??\c:\pptlnn.exec:\pptlnn.exe84⤵PID:3008
-
\??\c:\ljpntt.exec:\ljpntt.exe85⤵PID:1528
-
\??\c:\nrdttnt.exec:\nrdttnt.exe86⤵PID:2732
-
\??\c:\ttvjpb.exec:\ttvjpb.exe87⤵PID:2672
-
\??\c:\drddx.exec:\drddx.exe88⤵PID:2748
-
\??\c:\htrlhhx.exec:\htrlhhx.exe89⤵PID:1960
-
\??\c:\brnxn.exec:\brnxn.exe90⤵PID:1144
-
\??\c:\lljjfnh.exec:\lljjfnh.exe91⤵PID:2664
-
\??\c:\fjxhtd.exec:\fjxhtd.exe92⤵PID:1664
-
\??\c:\fbnlpxh.exec:\fbnlpxh.exe93⤵PID:1188
-
\??\c:\hxpplfb.exec:\hxpplfb.exe94⤵PID:1644
-
\??\c:\nfbxj.exec:\nfbxj.exe95⤵PID:2576
-
\??\c:\ltvvfdb.exec:\ltvvfdb.exe96⤵PID:2988
-
\??\c:\fprxjn.exec:\fprxjn.exe97⤵
- System Location Discovery: System Language Discovery
PID:1988 -
\??\c:\lrnhdd.exec:\lrnhdd.exe98⤵PID:836
-
\??\c:\tlhxl.exec:\tlhxl.exe99⤵PID:2428
-
\??\c:\jxvdx.exec:\jxvdx.exe100⤵PID:2940
-
\??\c:\rhlxrjh.exec:\rhlxrjh.exe101⤵PID:1612
-
\??\c:\tfbnr.exec:\tfbnr.exe102⤵PID:2464
-
\??\c:\rvlvrvh.exec:\rvlvrvh.exe103⤵PID:1492
-
\??\c:\ffrjbd.exec:\ffrjbd.exe104⤵PID:2588
-
\??\c:\tlbbtb.exec:\tlbbtb.exe105⤵PID:1352
-
\??\c:\ltvdj.exec:\ltvdj.exe106⤵PID:1064
-
\??\c:\lvpnbl.exec:\lvpnbl.exe107⤵PID:1516
-
\??\c:\njpld.exec:\njpld.exe108⤵PID:2328
-
\??\c:\njptvd.exec:\njptvd.exe109⤵PID:1412
-
\??\c:\ttnfv.exec:\ttnfv.exe110⤵PID:1148
-
\??\c:\brxftrx.exec:\brxftrx.exe111⤵PID:1088
-
\??\c:\dbddf.exec:\dbddf.exe112⤵PID:640
-
\??\c:\ttxdbf.exec:\ttxdbf.exe113⤵PID:580
-
\??\c:\xtllnnj.exec:\xtllnnj.exe114⤵
- System Location Discovery: System Language Discovery
PID:2460 -
\??\c:\tbltbb.exec:\tbltbb.exe115⤵PID:2172
-
\??\c:\prjtd.exec:\prjtd.exe116⤵PID:1724
-
\??\c:\nlvhr.exec:\nlvhr.exe117⤵PID:2136
-
\??\c:\bflxl.exec:\bflxl.exe118⤵PID:2620
-
\??\c:\ffnnjf.exec:\ffnnjf.exe119⤵PID:2616
-
\??\c:\nxhxl.exec:\nxhxl.exe120⤵PID:2092
-
\??\c:\rbrvfb.exec:\rbrvfb.exe121⤵PID:2080
-
\??\c:\jphhvbt.exec:\jphhvbt.exe122⤵PID:2108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-