Analysis
-
max time kernel
151s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 01:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe
-
Size
454KB
-
MD5
dd0505d68214397e092bc13b917087d1
-
SHA1
66c3cfd2f7e28596df8b2f92195409ddc1f60ba6
-
SHA256
a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0
-
SHA512
a02fba83b03ae01f932689672bef2c230c5af6fcd6da91ff1bbecfce569522aaea07fbb06c7cdfd7705b9942acb57cb20923ce1f6c36d431da6d20e422c88d3d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbew:q7Tc2NYHUrAwfMp3CDw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/3052-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/748-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/824-272-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2484-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-323-0x00000000777A0000-0x00000000778BF000-memory.dmp family_blackmoon behavioral1/memory/2908-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-378-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1100-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-413-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2596-422-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/780-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-575-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/696-581-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3056-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-603-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2740-611-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2720-620-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2616-648-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1828-776-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-810-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1060-842-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1824 vtjbjbn.exe 2200 nrhdtbd.exe 2824 xjjnnn.exe 2124 fhnllvh.exe 2860 blvjjtf.exe 2748 rftjtjx.exe 2608 pxdtxrl.exe 1852 pbptx.exe 2520 pfxnxv.exe 1652 hbvvr.exe 2368 fbrbbjd.exe 2036 hltvbp.exe 1492 bxdhlvh.exe 2936 ntflx.exe 2872 xlftv.exe 1264 hnppx.exe 1424 ddfrvn.exe 3016 hxdhj.exe 2128 rdrvl.exe 2160 xfllrf.exe 2096 phptr.exe 2508 vddhb.exe 1816 dvdvv.exe 1616 dfjtd.exe 2460 pnptt.exe 748 phpblbh.exe 772 xxdlbbd.exe 2580 jvdfhl.exe 824 thfbv.exe 1956 pvvtfdl.exe 2484 hjfjbnv.exe 1248 fpnjj.exe 1924 xfnhjpf.exe 1636 rdjjxhl.exe 2704 rvxxj.exe 2564 fllbl.exe 1692 rlbhdbr.exe 2648 dfddxr.exe 2908 flnxfbj.exe 2796 bffbf.exe 2776 vbptxfn.exe 2676 xnhxx.exe 2688 vjtxxhd.exe 1852 dbxlxvx.exe 1100 blrpl.exe 2596 bhnfthr.exe 1484 xljrvbb.exe 1048 fdbhd.exe 1784 ltntf.exe 2700 jpdrrr.exe 636 rpptf.exe 780 hxdbpxr.exe 1428 ldphv.exe 1588 bbttv.exe 3012 vjfxvvp.exe 1132 hfxrt.exe 2292 xnlxjp.exe 2232 thdrhdl.exe 1988 xrrbhx.exe 1168 vvdptv.exe 1620 lnlhf.exe 904 pvtlvd.exe 976 xfhhn.exe 1452 hlbvx.exe -
resource yara_rule behavioral1/memory/3052-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/748-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-323-0x00000000777A0000-0x00000000778BF000-memory.dmp upx behavioral1/memory/1692-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/780-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-581-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/3056-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/388-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-769-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-776-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-842-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpnbdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvbjhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drjffnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdxrxtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdprj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhnllvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfjlvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvxltdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jprbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpnlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtndh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjtrjxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxrhrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhtxvxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfrxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lptxtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njxlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frhnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlrjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdffbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfxhtlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbtjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfvlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plxddxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npvvdft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbdltlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvxbn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3052 wrote to memory of 1824 3052 a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe 30 PID 3052 wrote to memory of 1824 3052 a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe 30 PID 3052 wrote to memory of 1824 3052 a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe 30 PID 3052 wrote to memory of 1824 3052 a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe 30 PID 1824 wrote to memory of 2200 1824 vtjbjbn.exe 31 PID 1824 wrote to memory of 2200 1824 vtjbjbn.exe 31 PID 1824 wrote to memory of 2200 1824 vtjbjbn.exe 31 PID 1824 wrote to memory of 2200 1824 vtjbjbn.exe 31 PID 2200 wrote to memory of 2824 2200 nrhdtbd.exe 32 PID 2200 wrote to memory of 2824 2200 nrhdtbd.exe 32 PID 2200 wrote to memory of 2824 2200 nrhdtbd.exe 32 PID 2200 wrote to memory of 2824 2200 nrhdtbd.exe 32 PID 2824 wrote to memory of 2124 2824 xjjnnn.exe 33 PID 2824 wrote to memory of 2124 2824 xjjnnn.exe 33 PID 2824 wrote to memory of 2124 2824 xjjnnn.exe 33 PID 2824 wrote to memory of 2124 2824 xjjnnn.exe 33 PID 2124 wrote to memory of 2860 2124 fhnllvh.exe 34 PID 2124 wrote to memory of 2860 2124 fhnllvh.exe 34 PID 2124 wrote to memory of 2860 2124 fhnllvh.exe 34 PID 2124 wrote to memory of 2860 2124 fhnllvh.exe 34 PID 2860 wrote to memory of 2748 2860 blvjjtf.exe 35 PID 2860 wrote to memory of 2748 2860 blvjjtf.exe 35 PID 2860 wrote to memory of 2748 2860 blvjjtf.exe 35 PID 2860 wrote to memory of 2748 2860 blvjjtf.exe 35 PID 2748 wrote to memory of 2608 2748 rftjtjx.exe 36 PID 2748 wrote to memory of 2608 2748 rftjtjx.exe 36 PID 2748 wrote to memory of 2608 2748 rftjtjx.exe 36 PID 2748 wrote to memory of 2608 2748 rftjtjx.exe 36 PID 2608 wrote to memory of 1852 2608 pxdtxrl.exe 37 PID 2608 wrote to memory of 1852 2608 pxdtxrl.exe 37 PID 2608 wrote to memory of 1852 2608 pxdtxrl.exe 37 PID 2608 wrote to memory of 1852 2608 pxdtxrl.exe 37 PID 1852 wrote to memory of 2520 1852 pbptx.exe 38 PID 1852 wrote to memory of 2520 1852 pbptx.exe 38 PID 1852 wrote to memory of 2520 1852 pbptx.exe 38 PID 1852 wrote to memory of 2520 1852 pbptx.exe 38 PID 2520 wrote to memory of 1652 2520 pfxnxv.exe 39 PID 2520 wrote to memory of 1652 2520 pfxnxv.exe 39 PID 2520 wrote to memory of 1652 2520 pfxnxv.exe 39 PID 2520 wrote to memory of 1652 2520 pfxnxv.exe 39 PID 1652 wrote to memory of 2368 1652 hbvvr.exe 40 PID 1652 wrote to memory of 2368 1652 hbvvr.exe 40 PID 1652 wrote to memory of 2368 1652 hbvvr.exe 40 PID 1652 wrote to memory of 2368 1652 hbvvr.exe 40 PID 2368 wrote to memory of 2036 2368 fbrbbjd.exe 41 PID 2368 wrote to memory of 2036 2368 fbrbbjd.exe 41 PID 2368 wrote to memory of 2036 2368 fbrbbjd.exe 41 PID 2368 wrote to memory of 2036 2368 fbrbbjd.exe 41 PID 2036 wrote to memory of 1492 2036 hltvbp.exe 42 PID 2036 wrote to memory of 1492 2036 hltvbp.exe 42 PID 2036 wrote to memory of 1492 2036 hltvbp.exe 42 PID 2036 wrote to memory of 1492 2036 hltvbp.exe 42 PID 1492 wrote to memory of 2936 1492 bxdhlvh.exe 43 PID 1492 wrote to memory of 2936 1492 bxdhlvh.exe 43 PID 1492 wrote to memory of 2936 1492 bxdhlvh.exe 43 PID 1492 wrote to memory of 2936 1492 bxdhlvh.exe 43 PID 2936 wrote to memory of 2872 2936 ntflx.exe 44 PID 2936 wrote to memory of 2872 2936 ntflx.exe 44 PID 2936 wrote to memory of 2872 2936 ntflx.exe 44 PID 2936 wrote to memory of 2872 2936 ntflx.exe 44 PID 2872 wrote to memory of 1264 2872 xlftv.exe 45 PID 2872 wrote to memory of 1264 2872 xlftv.exe 45 PID 2872 wrote to memory of 1264 2872 xlftv.exe 45 PID 2872 wrote to memory of 1264 2872 xlftv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe"C:\Users\Admin\AppData\Local\Temp\a860770a1163f7c0ed45645994cce2d597240f69a408f1244493850532323bd0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\vtjbjbn.exec:\vtjbjbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\nrhdtbd.exec:\nrhdtbd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\xjjnnn.exec:\xjjnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\fhnllvh.exec:\fhnllvh.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\blvjjtf.exec:\blvjjtf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\rftjtjx.exec:\rftjtjx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\pxdtxrl.exec:\pxdtxrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\pbptx.exec:\pbptx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\pfxnxv.exec:\pfxnxv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\hbvvr.exec:\hbvvr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\fbrbbjd.exec:\fbrbbjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\hltvbp.exec:\hltvbp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\bxdhlvh.exec:\bxdhlvh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\ntflx.exec:\ntflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\xlftv.exec:\xlftv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\hnppx.exec:\hnppx.exe17⤵
- Executes dropped EXE
PID:1264 -
\??\c:\ddfrvn.exec:\ddfrvn.exe18⤵
- Executes dropped EXE
PID:1424 -
\??\c:\hxdhj.exec:\hxdhj.exe19⤵
- Executes dropped EXE
PID:3016 -
\??\c:\rdrvl.exec:\rdrvl.exe20⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xfllrf.exec:\xfllrf.exe21⤵
- Executes dropped EXE
PID:2160 -
\??\c:\phptr.exec:\phptr.exe22⤵
- Executes dropped EXE
PID:2096 -
\??\c:\vddhb.exec:\vddhb.exe23⤵
- Executes dropped EXE
PID:2508 -
\??\c:\dvdvv.exec:\dvdvv.exe24⤵
- Executes dropped EXE
PID:1816 -
\??\c:\dfjtd.exec:\dfjtd.exe25⤵
- Executes dropped EXE
PID:1616 -
\??\c:\pnptt.exec:\pnptt.exe26⤵
- Executes dropped EXE
PID:2460 -
\??\c:\phpblbh.exec:\phpblbh.exe27⤵
- Executes dropped EXE
PID:748 -
\??\c:\xxdlbbd.exec:\xxdlbbd.exe28⤵
- Executes dropped EXE
PID:772 -
\??\c:\jvdfhl.exec:\jvdfhl.exe29⤵
- Executes dropped EXE
PID:2580 -
\??\c:\thfbv.exec:\thfbv.exe30⤵
- Executes dropped EXE
PID:824 -
\??\c:\pvvtfdl.exec:\pvvtfdl.exe31⤵
- Executes dropped EXE
PID:1956 -
\??\c:\hjfjbnv.exec:\hjfjbnv.exe32⤵
- Executes dropped EXE
PID:2484 -
\??\c:\fpnjj.exec:\fpnjj.exe33⤵
- Executes dropped EXE
PID:1248 -
\??\c:\xfnhjpf.exec:\xfnhjpf.exe34⤵
- Executes dropped EXE
PID:1924 -
\??\c:\rdjjxhl.exec:\rdjjxhl.exe35⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rvxxj.exec:\rvxxj.exe36⤵
- Executes dropped EXE
PID:2704 -
\??\c:\fllbl.exec:\fllbl.exe37⤵
- Executes dropped EXE
PID:2564 -
\??\c:\rnpplx.exec:\rnpplx.exe38⤵PID:2720
-
\??\c:\rlbhdbr.exec:\rlbhdbr.exe39⤵
- Executes dropped EXE
PID:1692 -
\??\c:\dfddxr.exec:\dfddxr.exe40⤵
- Executes dropped EXE
PID:2648 -
\??\c:\flnxfbj.exec:\flnxfbj.exe41⤵
- Executes dropped EXE
PID:2908 -
\??\c:\bffbf.exec:\bffbf.exe42⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vbptxfn.exec:\vbptxfn.exe43⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xnhxx.exec:\xnhxx.exe44⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vjtxxhd.exec:\vjtxxhd.exe45⤵
- Executes dropped EXE
PID:2688 -
\??\c:\dbxlxvx.exec:\dbxlxvx.exe46⤵
- Executes dropped EXE
PID:1852 -
\??\c:\blrpl.exec:\blrpl.exe47⤵
- Executes dropped EXE
PID:1100 -
\??\c:\bhnfthr.exec:\bhnfthr.exe48⤵
- Executes dropped EXE
PID:2596 -
\??\c:\xljrvbb.exec:\xljrvbb.exe49⤵
- Executes dropped EXE
PID:1484 -
\??\c:\fdbhd.exec:\fdbhd.exe50⤵
- Executes dropped EXE
PID:1048 -
\??\c:\ltntf.exec:\ltntf.exe51⤵
- Executes dropped EXE
PID:1784 -
\??\c:\jpdrrr.exec:\jpdrrr.exe52⤵
- Executes dropped EXE
PID:2700 -
\??\c:\rpptf.exec:\rpptf.exe53⤵
- Executes dropped EXE
PID:636 -
\??\c:\hxdbpxr.exec:\hxdbpxr.exe54⤵
- Executes dropped EXE
PID:780 -
\??\c:\ldphv.exec:\ldphv.exe55⤵
- Executes dropped EXE
PID:1428 -
\??\c:\bbttv.exec:\bbttv.exe56⤵
- Executes dropped EXE
PID:1588 -
\??\c:\vjfxvvp.exec:\vjfxvvp.exe57⤵
- Executes dropped EXE
PID:3012 -
\??\c:\hfxrt.exec:\hfxrt.exe58⤵
- Executes dropped EXE
PID:1132 -
\??\c:\xnlxjp.exec:\xnlxjp.exe59⤵
- Executes dropped EXE
PID:2292 -
\??\c:\thdrhdl.exec:\thdrhdl.exe60⤵
- Executes dropped EXE
PID:2232 -
\??\c:\xrrbhx.exec:\xrrbhx.exe61⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vvdptv.exec:\vvdptv.exe62⤵
- Executes dropped EXE
PID:1168 -
\??\c:\lnlhf.exec:\lnlhf.exe63⤵
- Executes dropped EXE
PID:1620 -
\??\c:\pvtlvd.exec:\pvtlvd.exe64⤵
- Executes dropped EXE
PID:904 -
\??\c:\xfhhn.exec:\xfhhn.exe65⤵
- Executes dropped EXE
PID:976 -
\??\c:\hlbvx.exec:\hlbvx.exe66⤵
- Executes dropped EXE
PID:1452 -
\??\c:\pdbnp.exec:\pdbnp.exe67⤵PID:2112
-
\??\c:\tlxdlvd.exec:\tlxdlvd.exe68⤵PID:1856
-
\??\c:\hhrxlrt.exec:\hhrxlrt.exe69⤵PID:1800
-
\??\c:\xpjlv.exec:\xpjlv.exe70⤵PID:2456
-
\??\c:\ndbdrx.exec:\ndbdrx.exe71⤵PID:704
-
\??\c:\djrfjp.exec:\djrfjp.exe72⤵PID:2192
-
\??\c:\thxnh.exec:\thxnh.exe73⤵PID:2068
-
\??\c:\ntfbnrj.exec:\ntfbnrj.exe74⤵PID:2184
-
\??\c:\jxppnx.exec:\jxppnx.exe75⤵PID:1952
-
\??\c:\rhpld.exec:\rhpld.exe76⤵PID:696
-
\??\c:\pdffth.exec:\pdffth.exe77⤵PID:3056
-
\??\c:\xhrhdh.exec:\xhrhdh.exe78⤵PID:2980
-
\??\c:\dfxnxxx.exec:\dfxnxxx.exe79⤵PID:2200
-
\??\c:\vfvjl.exec:\vfvjl.exe80⤵PID:2740
-
\??\c:\xbbldr.exec:\xbbldr.exe81⤵PID:2564
-
\??\c:\nthfpn.exec:\nthfpn.exe82⤵PID:2720
-
\??\c:\tdbrbj.exec:\tdbrbj.exe83⤵PID:1688
-
\??\c:\dnxhv.exec:\dnxhv.exe84⤵PID:2816
-
\??\c:\tdprbxf.exec:\tdprbxf.exe85⤵PID:2908
-
\??\c:\nthlpt.exec:\nthlpt.exe86⤵PID:2616
-
\??\c:\rdptvft.exec:\rdptvft.exe87⤵PID:2748
-
\??\c:\xhfhvbd.exec:\xhfhvbd.exe88⤵PID:3064
-
\??\c:\jrjnt.exec:\jrjnt.exe89⤵PID:2688
-
\??\c:\pxrtp.exec:\pxrtp.exe90⤵PID:2452
-
\??\c:\tfdfx.exec:\tfdfx.exe91⤵PID:1804
-
\??\c:\jtldl.exec:\jtldl.exe92⤵PID:2964
-
\??\c:\ddnvfjt.exec:\ddnvfjt.exe93⤵PID:388
-
\??\c:\nbrfh.exec:\nbrfh.exe94⤵PID:2952
-
\??\c:\lxlbxl.exec:\lxlbxl.exe95⤵PID:1784
-
\??\c:\xjfdd.exec:\xjfdd.exe96⤵PID:1724
-
\??\c:\rbjhjp.exec:\rbjhjp.exe97⤵PID:2856
-
\??\c:\prhjfdv.exec:\prhjfdv.exe98⤵PID:2872
-
\??\c:\bfpbjf.exec:\bfpbjf.exe99⤵PID:1908
-
\??\c:\xfvhh.exec:\xfvhh.exe100⤵PID:524
-
\??\c:\fjjjfl.exec:\fjjjfl.exe101⤵PID:2224
-
\??\c:\rfrdxd.exec:\rfrdxd.exe102⤵PID:2492
-
\??\c:\hpdltt.exec:\hpdltt.exe103⤵PID:2444
-
\??\c:\xjtlv.exec:\xjtlv.exe104⤵PID:856
-
\??\c:\jnjjl.exec:\jnjjl.exe105⤵PID:1828
-
\??\c:\bfflppj.exec:\bfflppj.exe106⤵PID:956
-
\??\c:\hfdhxf.exec:\hfdhxf.exe107⤵PID:912
-
\??\c:\dlbfhr.exec:\dlbfhr.exe108⤵PID:904
-
\??\c:\dxbtb.exec:\dxbtb.exe109⤵PID:976
-
\??\c:\hljjj.exec:\hljjj.exe110⤵PID:2916
-
\??\c:\xrjjx.exec:\xrjjx.exe111⤵PID:2112
-
\??\c:\nbbntnd.exec:\nbbntnd.exe112⤵PID:1060
-
\??\c:\dntpdp.exec:\dntpdp.exe113⤵PID:1556
-
\??\c:\pfltd.exec:\pfltd.exe114⤵PID:2300
-
\??\c:\ldphb.exec:\ldphb.exe115⤵PID:2392
-
\??\c:\ffvbhln.exec:\ffvbhln.exe116⤵PID:824
-
\??\c:\dbldf.exec:\dbldf.exe117⤵PID:2348
-
\??\c:\jfvjfx.exec:\jfvjfx.exe118⤵PID:2484
-
\??\c:\rhjxvvl.exec:\rhjxvvl.exe119⤵PID:1040
-
\??\c:\dftnb.exec:\dftnb.exe120⤵PID:2304
-
\??\c:\brtvrhb.exec:\brtvrhb.exe121⤵PID:2072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-