Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 14:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
23dae8ac2c6b6fbcfc3d92db1ebf5a917b8246bab467fcfafb211ced4939e07fN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
23dae8ac2c6b6fbcfc3d92db1ebf5a917b8246bab467fcfafb211ced4939e07fN.exe
-
Size
454KB
-
MD5
a7937f4f2f9201749842748e63920370
-
SHA1
981d3c1fa0053d8d93fd0ad720676498695ea4f1
-
SHA256
23dae8ac2c6b6fbcfc3d92db1ebf5a917b8246bab467fcfafb211ced4939e07f
-
SHA512
62b344d5310dddfb40b79c4e637f77e91ce6d28f9d4ef6991aa790ac8557502853da371ed5c2991a2018b657533a1f72b6a9be7e7096c448d881071dd056cd86
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbes:q7Tc2NYHUrAwfMp3CDs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2116-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-129-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2560-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1340-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-262-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2056-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-311-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1704-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-325-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2256-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-443-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/564-455-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/564-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-725-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 760 htjlbtt.exe 2184 ldxjvpn.exe 2912 jjnbrjl.exe 2324 fdxvldv.exe 3012 jrdhhlb.exe 3044 lxhfd.exe 2820 brdppp.exe 2524 dvnjn.exe 1552 dttjphd.exe 1692 nbjrfj.exe 2984 bjrxb.exe 2908 lhhpdhv.exe 1436 pfhfnl.exe 2560 rxrxv.exe 1324 lpdfb.exe 1152 dvdlr.exe 1340 jxlbl.exe 2504 xrtxf.exe 2052 lhhtfnd.exe 2124 bfxpthr.exe 2436 lvfljvj.exe 624 nrxfd.exe 836 rhvnbv.exe 2776 ndblr.exe 960 dnhftvb.exe 2544 bhbvfr.exe 2204 ntlhn.exe 1708 dpdpp.exe 2056 hjvlbx.exe 2140 lthxbx.exe 1808 vxxdhjl.exe 2616 xxjnhh.exe 2104 dplljrr.exe 2224 xxllht.exe 1704 fvvhvf.exe 1984 nfjhr.exe 2956 llrfllt.exe 2128 brlpjhv.exe 2256 rlptt.exe 2496 vdvnh.exe 2152 tjvnnj.exe 2920 hvndprh.exe 2872 tfvll.exe 2248 hhpvt.exe 2524 jbhjd.exe 940 tfjlxhn.exe 1316 tptrxt.exe 1444 fdjxxh.exe 3020 jrjjj.exe 2908 ndrnt.exe 1436 vtpndh.exe 1108 dtffj.exe 1056 tfpjv.exe 2028 rfrpdpn.exe 1548 vjflh.exe 564 vlfdhnx.exe 2216 pbdvh.exe 2244 dndpbf.exe 1168 jbvnnv.exe 2428 nxvnft.exe 1876 pvjtn.exe 2436 ljlxb.exe 624 tflrd.exe 1164 bdbnvbv.exe -
resource yara_rule behavioral1/memory/2116-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-429-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/564-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1168-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1164-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-827-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-853-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-1054-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-1106-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/1756-1133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-1148-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbxvprf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phnbpfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdflttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvnhbpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxfddt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjdjrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjxjfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tppdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fttjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtvvtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbprpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjrhbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhxrnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbfpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnbhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdbpvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlllbdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pltxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvxfjhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnbxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtrhpdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvxntlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvnjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tplrjtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pttfnjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pldbdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhljrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lntxtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjnlbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxttxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpdtrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvlhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbblxfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pthtnxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtxhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrxpblv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhplv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fldxdf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 760 2116 23dae8ac2c6b6fbcfc3d92db1ebf5a917b8246bab467fcfafb211ced4939e07fN.exe 30 PID 2116 wrote to memory of 760 2116 23dae8ac2c6b6fbcfc3d92db1ebf5a917b8246bab467fcfafb211ced4939e07fN.exe 30 PID 2116 wrote to memory of 760 2116 23dae8ac2c6b6fbcfc3d92db1ebf5a917b8246bab467fcfafb211ced4939e07fN.exe 30 PID 2116 wrote to memory of 760 2116 23dae8ac2c6b6fbcfc3d92db1ebf5a917b8246bab467fcfafb211ced4939e07fN.exe 30 PID 760 wrote to memory of 2184 760 htjlbtt.exe 31 PID 760 wrote to memory of 2184 760 htjlbtt.exe 31 PID 760 wrote to memory of 2184 760 htjlbtt.exe 31 PID 760 wrote to memory of 2184 760 htjlbtt.exe 31 PID 2184 wrote to memory of 2912 2184 ldxjvpn.exe 32 PID 2184 wrote to memory of 2912 2184 ldxjvpn.exe 32 PID 2184 wrote to memory of 2912 2184 ldxjvpn.exe 32 PID 2184 wrote to memory of 2912 2184 ldxjvpn.exe 32 PID 2912 wrote to memory of 2324 2912 jjnbrjl.exe 33 PID 2912 wrote to memory of 2324 2912 jjnbrjl.exe 33 PID 2912 wrote to memory of 2324 2912 jjnbrjl.exe 33 PID 2912 wrote to memory of 2324 2912 jjnbrjl.exe 33 PID 2324 wrote to memory of 3012 2324 fdxvldv.exe 34 PID 2324 wrote to memory of 3012 2324 fdxvldv.exe 34 PID 2324 wrote to memory of 3012 2324 fdxvldv.exe 34 PID 2324 wrote to memory of 3012 2324 fdxvldv.exe 34 PID 3012 wrote to memory of 3044 3012 jrdhhlb.exe 35 PID 3012 wrote to memory of 3044 3012 jrdhhlb.exe 35 PID 3012 wrote to memory of 3044 3012 jrdhhlb.exe 35 PID 3012 wrote to memory of 3044 3012 jrdhhlb.exe 35 PID 3044 wrote to memory of 2820 3044 lxhfd.exe 36 PID 3044 wrote to memory of 2820 3044 lxhfd.exe 36 PID 3044 wrote to memory of 2820 3044 lxhfd.exe 36 PID 3044 wrote to memory of 2820 3044 lxhfd.exe 36 PID 2820 wrote to memory of 2524 2820 brdppp.exe 37 PID 2820 wrote to memory of 2524 2820 brdppp.exe 37 PID 2820 wrote to memory of 2524 2820 brdppp.exe 37 PID 2820 wrote to memory of 2524 2820 brdppp.exe 37 PID 2524 wrote to memory of 1552 2524 dvnjn.exe 38 PID 2524 wrote to memory of 1552 2524 dvnjn.exe 38 PID 2524 wrote to memory of 1552 2524 dvnjn.exe 38 PID 2524 wrote to memory of 1552 2524 dvnjn.exe 38 PID 1552 wrote to memory of 1692 1552 dttjphd.exe 39 PID 1552 wrote to memory of 1692 1552 dttjphd.exe 39 PID 1552 wrote to memory of 1692 1552 dttjphd.exe 39 PID 1552 wrote to memory of 1692 1552 dttjphd.exe 39 PID 1692 wrote to memory of 2984 1692 nbjrfj.exe 40 PID 1692 wrote to memory of 2984 1692 nbjrfj.exe 40 PID 1692 wrote to memory of 2984 1692 nbjrfj.exe 40 PID 1692 wrote to memory of 2984 1692 nbjrfj.exe 40 PID 2984 wrote to memory of 2908 2984 bjrxb.exe 41 PID 2984 wrote to memory of 2908 2984 bjrxb.exe 41 PID 2984 wrote to memory of 2908 2984 bjrxb.exe 41 PID 2984 wrote to memory of 2908 2984 bjrxb.exe 41 PID 2908 wrote to memory of 1436 2908 lhhpdhv.exe 42 PID 2908 wrote to memory of 1436 2908 lhhpdhv.exe 42 PID 2908 wrote to memory of 1436 2908 lhhpdhv.exe 42 PID 2908 wrote to memory of 1436 2908 lhhpdhv.exe 42 PID 1436 wrote to memory of 2560 1436 pfhfnl.exe 43 PID 1436 wrote to memory of 2560 1436 pfhfnl.exe 43 PID 1436 wrote to memory of 2560 1436 pfhfnl.exe 43 PID 1436 wrote to memory of 2560 1436 pfhfnl.exe 43 PID 2560 wrote to memory of 1324 2560 rxrxv.exe 44 PID 2560 wrote to memory of 1324 2560 rxrxv.exe 44 PID 2560 wrote to memory of 1324 2560 rxrxv.exe 44 PID 2560 wrote to memory of 1324 2560 rxrxv.exe 44 PID 1324 wrote to memory of 1152 1324 lpdfb.exe 45 PID 1324 wrote to memory of 1152 1324 lpdfb.exe 45 PID 1324 wrote to memory of 1152 1324 lpdfb.exe 45 PID 1324 wrote to memory of 1152 1324 lpdfb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\23dae8ac2c6b6fbcfc3d92db1ebf5a917b8246bab467fcfafb211ced4939e07fN.exe"C:\Users\Admin\AppData\Local\Temp\23dae8ac2c6b6fbcfc3d92db1ebf5a917b8246bab467fcfafb211ced4939e07fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\htjlbtt.exec:\htjlbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\ldxjvpn.exec:\ldxjvpn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\jjnbrjl.exec:\jjnbrjl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\fdxvldv.exec:\fdxvldv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\jrdhhlb.exec:\jrdhhlb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\lxhfd.exec:\lxhfd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\brdppp.exec:\brdppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\dvnjn.exec:\dvnjn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\dttjphd.exec:\dttjphd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\nbjrfj.exec:\nbjrfj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\bjrxb.exec:\bjrxb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\lhhpdhv.exec:\lhhpdhv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\pfhfnl.exec:\pfhfnl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\rxrxv.exec:\rxrxv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\lpdfb.exec:\lpdfb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\dvdlr.exec:\dvdlr.exe17⤵
- Executes dropped EXE
PID:1152 -
\??\c:\jxlbl.exec:\jxlbl.exe18⤵
- Executes dropped EXE
PID:1340 -
\??\c:\xrtxf.exec:\xrtxf.exe19⤵
- Executes dropped EXE
PID:2504 -
\??\c:\lhhtfnd.exec:\lhhtfnd.exe20⤵
- Executes dropped EXE
PID:2052 -
\??\c:\bfxpthr.exec:\bfxpthr.exe21⤵
- Executes dropped EXE
PID:2124 -
\??\c:\lvfljvj.exec:\lvfljvj.exe22⤵
- Executes dropped EXE
PID:2436 -
\??\c:\nrxfd.exec:\nrxfd.exe23⤵
- Executes dropped EXE
PID:624 -
\??\c:\rhvnbv.exec:\rhvnbv.exe24⤵
- Executes dropped EXE
PID:836 -
\??\c:\ndblr.exec:\ndblr.exe25⤵
- Executes dropped EXE
PID:2776 -
\??\c:\dnhftvb.exec:\dnhftvb.exe26⤵
- Executes dropped EXE
PID:960 -
\??\c:\bhbvfr.exec:\bhbvfr.exe27⤵
- Executes dropped EXE
PID:2544 -
\??\c:\ntlhn.exec:\ntlhn.exe28⤵
- Executes dropped EXE
PID:2204 -
\??\c:\dpdpp.exec:\dpdpp.exe29⤵
- Executes dropped EXE
PID:1708 -
\??\c:\hjvlbx.exec:\hjvlbx.exe30⤵
- Executes dropped EXE
PID:2056 -
\??\c:\lthxbx.exec:\lthxbx.exe31⤵
- Executes dropped EXE
PID:2140 -
\??\c:\vxxdhjl.exec:\vxxdhjl.exe32⤵
- Executes dropped EXE
PID:1808 -
\??\c:\xxjnhh.exec:\xxjnhh.exe33⤵
- Executes dropped EXE
PID:2616 -
\??\c:\dplljrr.exec:\dplljrr.exe34⤵
- Executes dropped EXE
PID:2104 -
\??\c:\xxllht.exec:\xxllht.exe35⤵
- Executes dropped EXE
PID:2224 -
\??\c:\fvvhvf.exec:\fvvhvf.exe36⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nfjhr.exec:\nfjhr.exe37⤵
- Executes dropped EXE
PID:1984 -
\??\c:\llrfllt.exec:\llrfllt.exe38⤵
- Executes dropped EXE
PID:2956 -
\??\c:\brlpjhv.exec:\brlpjhv.exe39⤵
- Executes dropped EXE
PID:2128 -
\??\c:\rlptt.exec:\rlptt.exe40⤵
- Executes dropped EXE
PID:2256 -
\??\c:\vdvnh.exec:\vdvnh.exe41⤵
- Executes dropped EXE
PID:2496 -
\??\c:\tjvnnj.exec:\tjvnnj.exe42⤵
- Executes dropped EXE
PID:2152 -
\??\c:\hvndprh.exec:\hvndprh.exe43⤵
- Executes dropped EXE
PID:2920 -
\??\c:\tfvll.exec:\tfvll.exe44⤵
- Executes dropped EXE
PID:2872 -
\??\c:\hhpvt.exec:\hhpvt.exe45⤵
- Executes dropped EXE
PID:2248 -
\??\c:\jbhjd.exec:\jbhjd.exe46⤵
- Executes dropped EXE
PID:2524 -
\??\c:\tfjlxhn.exec:\tfjlxhn.exe47⤵
- Executes dropped EXE
PID:940 -
\??\c:\tptrxt.exec:\tptrxt.exe48⤵
- Executes dropped EXE
PID:1316 -
\??\c:\fdjxxh.exec:\fdjxxh.exe49⤵
- Executes dropped EXE
PID:1444 -
\??\c:\jrjjj.exec:\jrjjj.exe50⤵
- Executes dropped EXE
PID:3020 -
\??\c:\ndrnt.exec:\ndrnt.exe51⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vtpndh.exec:\vtpndh.exe52⤵
- Executes dropped EXE
PID:1436 -
\??\c:\dtffj.exec:\dtffj.exe53⤵
- Executes dropped EXE
PID:1108 -
\??\c:\tfpjv.exec:\tfpjv.exe54⤵
- Executes dropped EXE
PID:1056 -
\??\c:\rfrpdpn.exec:\rfrpdpn.exe55⤵
- Executes dropped EXE
PID:2028 -
\??\c:\vjflh.exec:\vjflh.exe56⤵
- Executes dropped EXE
PID:1548 -
\??\c:\vlfdhnx.exec:\vlfdhnx.exe57⤵
- Executes dropped EXE
PID:564 -
\??\c:\pbdvh.exec:\pbdvh.exe58⤵
- Executes dropped EXE
PID:2216 -
\??\c:\dndpbf.exec:\dndpbf.exe59⤵
- Executes dropped EXE
PID:2244 -
\??\c:\jbvnnv.exec:\jbvnnv.exe60⤵
- Executes dropped EXE
PID:1168 -
\??\c:\nxvnft.exec:\nxvnft.exe61⤵
- Executes dropped EXE
PID:2428 -
\??\c:\pvjtn.exec:\pvjtn.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1876 -
\??\c:\ljlxb.exec:\ljlxb.exe63⤵
- Executes dropped EXE
PID:2436 -
\??\c:\tflrd.exec:\tflrd.exe64⤵
- Executes dropped EXE
PID:624 -
\??\c:\bdbnvbv.exec:\bdbnvbv.exe65⤵
- Executes dropped EXE
PID:1164 -
\??\c:\flvplnp.exec:\flvplnp.exe66⤵PID:1420
-
\??\c:\nptlp.exec:\nptlp.exe67⤵PID:1788
-
\??\c:\hddrnrj.exec:\hddrnrj.exe68⤵PID:960
-
\??\c:\hdlrnvh.exec:\hdlrnvh.exe69⤵PID:2400
-
\??\c:\lvldv.exec:\lvldv.exe70⤵PID:632
-
\??\c:\hjlht.exec:\hjlht.exe71⤵PID:2704
-
\??\c:\xxvth.exec:\xxvth.exe72⤵PID:2376
-
\??\c:\nfppjxv.exec:\nfppjxv.exe73⤵PID:1668
-
\??\c:\lpdtf.exec:\lpdtf.exe74⤵PID:1524
-
\??\c:\lxddlt.exec:\lxddlt.exe75⤵PID:1808
-
\??\c:\lflvbff.exec:\lflvbff.exe76⤵PID:2320
-
\??\c:\xnfnvnj.exec:\xnfnvnj.exe77⤵PID:1128
-
\??\c:\pxfdb.exec:\pxfdb.exe78⤵PID:1620
-
\??\c:\bxflxdh.exec:\bxflxdh.exe79⤵PID:2368
-
\??\c:\pxpxnbv.exec:\pxpxnbv.exe80⤵PID:2424
-
\??\c:\hrhjj.exec:\hrhjj.exe81⤵PID:2184
-
\??\c:\lnbhv.exec:\lnbhv.exe82⤵
- System Location Discovery: System Language Discovery
PID:2960 -
\??\c:\bbblff.exec:\bbblff.exe83⤵PID:2932
-
\??\c:\hfrrntj.exec:\hfrrntj.exe84⤵PID:2180
-
\??\c:\hjlldv.exec:\hjlldv.exe85⤵PID:3012
-
\??\c:\nnrdll.exec:\nnrdll.exe86⤵PID:2896
-
\??\c:\vlbbbp.exec:\vlbbbp.exe87⤵PID:2840
-
\??\c:\fnndp.exec:\fnndp.exe88⤵PID:2484
-
\??\c:\bbxbjxv.exec:\bbxbjxv.exe89⤵PID:2872
-
\??\c:\rjdpr.exec:\rjdpr.exe90⤵PID:2248
-
\??\c:\rdhnt.exec:\rdhnt.exe91⤵PID:2524
-
\??\c:\nfbxh.exec:\nfbxh.exe92⤵PID:1084
-
\??\c:\fbxtxf.exec:\fbxtxf.exe93⤵PID:1316
-
\??\c:\dfppjl.exec:\dfppjl.exe94⤵PID:2136
-
\??\c:\hdbpvn.exec:\hdbpvn.exe95⤵
- System Location Discovery: System Language Discovery
PID:2740 -
\??\c:\hltjpjx.exec:\hltjpjx.exe96⤵PID:1660
-
\??\c:\fxrxv.exec:\fxrxv.exe97⤵PID:452
-
\??\c:\xxtvnn.exec:\xxtvnn.exe98⤵PID:1408
-
\??\c:\pjntx.exec:\pjntx.exe99⤵PID:696
-
\??\c:\dvvdvpv.exec:\dvvdvpv.exe100⤵PID:2348
-
\??\c:\fblbxt.exec:\fblbxt.exe101⤵PID:2292
-
\??\c:\djhfj.exec:\djhfj.exe102⤵PID:2504
-
\??\c:\pjvjhx.exec:\pjvjhx.exe103⤵PID:2476
-
\??\c:\pxxdphn.exec:\pxxdphn.exe104⤵PID:2412
-
\??\c:\lhtvd.exec:\lhtvd.exe105⤵PID:2472
-
\??\c:\htvfr.exec:\htvfr.exe106⤵PID:2228
-
\??\c:\fpnvxf.exec:\fpnvxf.exe107⤵PID:900
-
\??\c:\jfrdxp.exec:\jfrdxp.exe108⤵PID:756
-
\??\c:\tdhhlf.exec:\tdhhlf.exe109⤵PID:1800
-
\??\c:\xppfnpr.exec:\xppfnpr.exe110⤵PID:1868
-
\??\c:\tjdtd.exec:\tjdtd.exe111⤵PID:1996
-
\??\c:\rntfpf.exec:\rntfpf.exe112⤵PID:2300
-
\??\c:\hvlfpn.exec:\hvlfpn.exe113⤵PID:1064
-
\??\c:\hdxpfx.exec:\hdxpfx.exe114⤵PID:2204
-
\??\c:\lxftxxj.exec:\lxftxxj.exe115⤵PID:1708
-
\??\c:\rhddlp.exec:\rhddlp.exe116⤵PID:2404
-
\??\c:\rhjlj.exec:\rhjlj.exe117⤵PID:544
-
\??\c:\bxpdrjt.exec:\bxpdrjt.exe118⤵PID:2140
-
\??\c:\jxbrn.exec:\jxbrn.exe119⤵PID:1756
-
\??\c:\rhlhl.exec:\rhlhl.exe120⤵PID:1256
-
\??\c:\bxlrphv.exec:\bxlrphv.exe121⤵PID:1612
-
\??\c:\xdvjdvx.exec:\xdvjdvx.exe122⤵PID:1624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-