Analysis
-
max time kernel
120s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 15:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15N.exe
-
Size
456KB
-
MD5
abc45e7e40bded452877935ebac8a4f0
-
SHA1
777244ab61d2fcb45f499325cc8e615aafe55560
-
SHA256
86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15
-
SHA512
bbda582bbaff8c3fa546bebaff30223bc84b8539104c40b53bd91fd31f346c04c6f89048c4e991aa9eee9a19dd03d8766b6a775b5b52aa301d15e18cd87138c4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRl:q7Tc2NYHUrAwfMp3CDRl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2344-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/644-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/436-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1280-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-330-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1644-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-389-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2788-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-480-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1068-517-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1068-537-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1584-538-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2000-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-559-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1028-565-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2344-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-609-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2844-777-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2612 vtjbnx.exe 644 xvljllh.exe 2856 ltxjx.exe 2520 lhpxv.exe 2880 hhtlh.exe 2792 ddphb.exe 2784 tjhnpv.exe 1920 dxdtpdd.exe 2688 hjrprll.exe 436 hxxdxj.exe 1080 njhpdff.exe 2412 dtnxtxj.exe 2308 vjxxb.exe 2736 bhrlbr.exe 1720 jvntv.exe 1800 hnjbb.exe 1280 vrrjlf.exe 1400 ndnbtvl.exe 1708 nxpfnnt.exe 2232 xdjphr.exe 3044 bvvnjrn.exe 2516 dljtfp.exe 2636 jffjrd.exe 2564 hhfxp.exe 2296 dljnvv.exe 1584 xrlptn.exe 316 jvdxvr.exe 2196 lfftnbf.exe 2124 xlxhxlv.exe 788 lbfxf.exe 2448 pphfvd.exe 696 rvfpp.exe 2752 nhhrtpl.exe 860 xxnrdrt.exe 2180 dpxjjj.exe 1724 hxphrv.exe 1644 pfndh.exe 2760 bpvjf.exe 2772 bvbddpx.exe 2872 frrxvd.exe 2868 fdtbhp.exe 3032 tvlxhbr.exe 2068 vvnrpt.exe 2944 tpdhd.exe 2712 hnvtlx.exe 2788 bvrbpj.exe 772 pbtrjnn.exe 1632 vlfhdpx.exe 912 xpldh.exe 2092 rbbhrpx.exe 308 fhhvnn.exe 2996 thljtjl.exe 1760 jjrpfpf.exe 3008 trxflvn.exe 1704 jfbxl.exe 1832 frvfj.exe 2252 lnlptb.exe 2464 pbjdxx.exe 2248 rdxhhh.exe 3060 pllpn.exe 3056 rxbpjnt.exe 2452 rhbjdl.exe 2316 dhbvb.exe 1068 vbjbtv.exe -
resource yara_rule behavioral1/memory/2344-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/644-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/436-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/436-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-389-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2788-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-649-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2724-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-676-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2128-732-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhrtpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpffh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txplrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdbljfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtdljlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlbbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndxthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfjrdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjxjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brplxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rprrtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhfxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlxpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frjfbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvttx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvvvjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvlppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvrbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhvbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrvpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lblbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hphrtxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnjtfhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfdhhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lprjhlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrnffhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfnjvtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhjvhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnjxxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbtxnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvdvjbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjbvfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drlndx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txnrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhlrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnbjdrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fttptp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prndnvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnnbl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2612 2344 86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15N.exe 29 PID 2344 wrote to memory of 2612 2344 86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15N.exe 29 PID 2344 wrote to memory of 2612 2344 86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15N.exe 29 PID 2344 wrote to memory of 2612 2344 86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15N.exe 29 PID 2612 wrote to memory of 644 2612 vtjbnx.exe 30 PID 2612 wrote to memory of 644 2612 vtjbnx.exe 30 PID 2612 wrote to memory of 644 2612 vtjbnx.exe 30 PID 2612 wrote to memory of 644 2612 vtjbnx.exe 30 PID 644 wrote to memory of 2856 644 xvljllh.exe 31 PID 644 wrote to memory of 2856 644 xvljllh.exe 31 PID 644 wrote to memory of 2856 644 xvljllh.exe 31 PID 644 wrote to memory of 2856 644 xvljllh.exe 31 PID 2856 wrote to memory of 2520 2856 ltxjx.exe 32 PID 2856 wrote to memory of 2520 2856 ltxjx.exe 32 PID 2856 wrote to memory of 2520 2856 ltxjx.exe 32 PID 2856 wrote to memory of 2520 2856 ltxjx.exe 32 PID 2520 wrote to memory of 2880 2520 lhpxv.exe 33 PID 2520 wrote to memory of 2880 2520 lhpxv.exe 33 PID 2520 wrote to memory of 2880 2520 lhpxv.exe 33 PID 2520 wrote to memory of 2880 2520 lhpxv.exe 33 PID 2880 wrote to memory of 2792 2880 hhtlh.exe 34 PID 2880 wrote to memory of 2792 2880 hhtlh.exe 34 PID 2880 wrote to memory of 2792 2880 hhtlh.exe 34 PID 2880 wrote to memory of 2792 2880 hhtlh.exe 34 PID 2792 wrote to memory of 2784 2792 ddphb.exe 35 PID 2792 wrote to memory of 2784 2792 ddphb.exe 35 PID 2792 wrote to memory of 2784 2792 ddphb.exe 35 PID 2792 wrote to memory of 2784 2792 ddphb.exe 35 PID 2784 wrote to memory of 1920 2784 tjhnpv.exe 36 PID 2784 wrote to memory of 1920 2784 tjhnpv.exe 36 PID 2784 wrote to memory of 1920 2784 tjhnpv.exe 36 PID 2784 wrote to memory of 1920 2784 tjhnpv.exe 36 PID 1920 wrote to memory of 2688 1920 dxdtpdd.exe 37 PID 1920 wrote to memory of 2688 1920 dxdtpdd.exe 37 PID 1920 wrote to memory of 2688 1920 dxdtpdd.exe 37 PID 1920 wrote to memory of 2688 1920 dxdtpdd.exe 37 PID 2688 wrote to memory of 436 2688 hjrprll.exe 38 PID 2688 wrote to memory of 436 2688 hjrprll.exe 38 PID 2688 wrote to memory of 436 2688 hjrprll.exe 38 PID 2688 wrote to memory of 436 2688 hjrprll.exe 38 PID 436 wrote to memory of 1080 436 hxxdxj.exe 39 PID 436 wrote to memory of 1080 436 hxxdxj.exe 39 PID 436 wrote to memory of 1080 436 hxxdxj.exe 39 PID 436 wrote to memory of 1080 436 hxxdxj.exe 39 PID 1080 wrote to memory of 2412 1080 njhpdff.exe 40 PID 1080 wrote to memory of 2412 1080 njhpdff.exe 40 PID 1080 wrote to memory of 2412 1080 njhpdff.exe 40 PID 1080 wrote to memory of 2412 1080 njhpdff.exe 40 PID 2412 wrote to memory of 2308 2412 dtnxtxj.exe 41 PID 2412 wrote to memory of 2308 2412 dtnxtxj.exe 41 PID 2412 wrote to memory of 2308 2412 dtnxtxj.exe 41 PID 2412 wrote to memory of 2308 2412 dtnxtxj.exe 41 PID 2308 wrote to memory of 2736 2308 vjxxb.exe 42 PID 2308 wrote to memory of 2736 2308 vjxxb.exe 42 PID 2308 wrote to memory of 2736 2308 vjxxb.exe 42 PID 2308 wrote to memory of 2736 2308 vjxxb.exe 42 PID 2736 wrote to memory of 1720 2736 bhrlbr.exe 43 PID 2736 wrote to memory of 1720 2736 bhrlbr.exe 43 PID 2736 wrote to memory of 1720 2736 bhrlbr.exe 43 PID 2736 wrote to memory of 1720 2736 bhrlbr.exe 43 PID 1720 wrote to memory of 1800 1720 jvntv.exe 44 PID 1720 wrote to memory of 1800 1720 jvntv.exe 44 PID 1720 wrote to memory of 1800 1720 jvntv.exe 44 PID 1720 wrote to memory of 1800 1720 jvntv.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15N.exe"C:\Users\Admin\AppData\Local\Temp\86b75aa205cc9a8b086dc79d9d76f08260fbec4daceaf8245f274f46c6545a15N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\vtjbnx.exec:\vtjbnx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\xvljllh.exec:\xvljllh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\ltxjx.exec:\ltxjx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\lhpxv.exec:\lhpxv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\hhtlh.exec:\hhtlh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\ddphb.exec:\ddphb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\tjhnpv.exec:\tjhnpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\dxdtpdd.exec:\dxdtpdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\hjrprll.exec:\hjrprll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\hxxdxj.exec:\hxxdxj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\njhpdff.exec:\njhpdff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\dtnxtxj.exec:\dtnxtxj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\vjxxb.exec:\vjxxb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\bhrlbr.exec:\bhrlbr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\jvntv.exec:\jvntv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\hnjbb.exec:\hnjbb.exe17⤵
- Executes dropped EXE
PID:1800 -
\??\c:\vrrjlf.exec:\vrrjlf.exe18⤵
- Executes dropped EXE
PID:1280 -
\??\c:\ndnbtvl.exec:\ndnbtvl.exe19⤵
- Executes dropped EXE
PID:1400 -
\??\c:\nxpfnnt.exec:\nxpfnnt.exe20⤵
- Executes dropped EXE
PID:1708 -
\??\c:\xdjphr.exec:\xdjphr.exe21⤵
- Executes dropped EXE
PID:2232 -
\??\c:\bvvnjrn.exec:\bvvnjrn.exe22⤵
- Executes dropped EXE
PID:3044 -
\??\c:\dljtfp.exec:\dljtfp.exe23⤵
- Executes dropped EXE
PID:2516 -
\??\c:\jffjrd.exec:\jffjrd.exe24⤵
- Executes dropped EXE
PID:2636 -
\??\c:\hhfxp.exec:\hhfxp.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2564 -
\??\c:\dljnvv.exec:\dljnvv.exe26⤵
- Executes dropped EXE
PID:2296 -
\??\c:\xrlptn.exec:\xrlptn.exe27⤵
- Executes dropped EXE
PID:1584 -
\??\c:\jvdxvr.exec:\jvdxvr.exe28⤵
- Executes dropped EXE
PID:316 -
\??\c:\lfftnbf.exec:\lfftnbf.exe29⤵
- Executes dropped EXE
PID:2196 -
\??\c:\xlxhxlv.exec:\xlxhxlv.exe30⤵
- Executes dropped EXE
PID:2124 -
\??\c:\lbfxf.exec:\lbfxf.exe31⤵
- Executes dropped EXE
PID:788 -
\??\c:\pphfvd.exec:\pphfvd.exe32⤵
- Executes dropped EXE
PID:2448 -
\??\c:\rvfpp.exec:\rvfpp.exe33⤵
- Executes dropped EXE
PID:696 -
\??\c:\nhhrtpl.exec:\nhhrtpl.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2752 -
\??\c:\xxnrdrt.exec:\xxnrdrt.exe35⤵
- Executes dropped EXE
PID:860 -
\??\c:\dpxjjj.exec:\dpxjjj.exe36⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hxphrv.exec:\hxphrv.exe37⤵
- Executes dropped EXE
PID:1724 -
\??\c:\pfndh.exec:\pfndh.exe38⤵
- Executes dropped EXE
PID:1644 -
\??\c:\bpvjf.exec:\bpvjf.exe39⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bvbddpx.exec:\bvbddpx.exe40⤵
- Executes dropped EXE
PID:2772 -
\??\c:\frrxvd.exec:\frrxvd.exe41⤵
- Executes dropped EXE
PID:2872 -
\??\c:\fdtbhp.exec:\fdtbhp.exe42⤵
- Executes dropped EXE
PID:2868 -
\??\c:\tvlxhbr.exec:\tvlxhbr.exe43⤵
- Executes dropped EXE
PID:3032 -
\??\c:\vvnrpt.exec:\vvnrpt.exe44⤵
- Executes dropped EXE
PID:2068 -
\??\c:\tpdhd.exec:\tpdhd.exe45⤵
- Executes dropped EXE
PID:2944 -
\??\c:\hnvtlx.exec:\hnvtlx.exe46⤵
- Executes dropped EXE
PID:2712 -
\??\c:\bvrbpj.exec:\bvrbpj.exe47⤵
- Executes dropped EXE
PID:2788 -
\??\c:\pbtrjnn.exec:\pbtrjnn.exe48⤵
- Executes dropped EXE
PID:772 -
\??\c:\vlfhdpx.exec:\vlfhdpx.exe49⤵
- Executes dropped EXE
PID:1632 -
\??\c:\xpldh.exec:\xpldh.exe50⤵
- Executes dropped EXE
PID:912 -
\??\c:\rbbhrpx.exec:\rbbhrpx.exe51⤵
- Executes dropped EXE
PID:2092 -
\??\c:\fhhvnn.exec:\fhhvnn.exe52⤵
- Executes dropped EXE
PID:308 -
\??\c:\thljtjl.exec:\thljtjl.exe53⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jjrpfpf.exec:\jjrpfpf.exe54⤵
- Executes dropped EXE
PID:1760 -
\??\c:\trxflvn.exec:\trxflvn.exe55⤵
- Executes dropped EXE
PID:3008 -
\??\c:\jfbxl.exec:\jfbxl.exe56⤵
- Executes dropped EXE
PID:1704 -
\??\c:\frvfj.exec:\frvfj.exe57⤵
- Executes dropped EXE
PID:1832 -
\??\c:\lnlptb.exec:\lnlptb.exe58⤵
- Executes dropped EXE
PID:2252 -
\??\c:\pbjdxx.exec:\pbjdxx.exe59⤵
- Executes dropped EXE
PID:2464 -
\??\c:\rdxhhh.exec:\rdxhhh.exe60⤵
- Executes dropped EXE
PID:2248 -
\??\c:\pllpn.exec:\pllpn.exe61⤵
- Executes dropped EXE
PID:3060 -
\??\c:\rxbpjnt.exec:\rxbpjnt.exe62⤵
- Executes dropped EXE
PID:3056 -
\??\c:\rhbjdl.exec:\rhbjdl.exe63⤵
- Executes dropped EXE
PID:2452 -
\??\c:\dhbvb.exec:\dhbvb.exe64⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vbjbtv.exec:\vbjbtv.exe65⤵
- Executes dropped EXE
PID:1068 -
\??\c:\hvjjvf.exec:\hvjjvf.exe66⤵PID:1092
-
\??\c:\rxdntt.exec:\rxdntt.exe67⤵PID:1440
-
\??\c:\txtxnv.exec:\txtxnv.exe68⤵PID:1584
-
\??\c:\jfnlx.exec:\jfnlx.exe69⤵PID:1740
-
\??\c:\txpltfl.exec:\txpltfl.exe70⤵PID:2000
-
\??\c:\ltvjjj.exec:\ltvjjj.exe71⤵
- System Location Discovery: System Language Discovery
PID:2020 -
\??\c:\bjjjbpn.exec:\bjjjbpn.exe72⤵PID:1028
-
\??\c:\vdvnb.exec:\vdvnb.exe73⤵PID:1204
-
\??\c:\jbdjxr.exec:\jbdjxr.exe74⤵PID:1536
-
\??\c:\djndnpb.exec:\djndnpb.exe75⤵PID:1648
-
\??\c:\vnjfnd.exec:\vnjfnd.exe76⤵PID:2344
-
\??\c:\rpnpr.exec:\rpnpr.exe77⤵PID:952
-
\??\c:\tlxpr.exec:\tlxpr.exe78⤵
- System Location Discovery: System Language Discovery
PID:2044 -
\??\c:\hdvvp.exec:\hdvvp.exe79⤵PID:1628
-
\??\c:\tffntxx.exec:\tffntxx.exe80⤵PID:3016
-
\??\c:\vdpjbn.exec:\vdpjbn.exe81⤵PID:2776
-
\??\c:\rxlvd.exec:\rxlvd.exe82⤵PID:2856
-
\??\c:\hppttj.exec:\hppttj.exe83⤵PID:2936
-
\??\c:\npxpffv.exec:\npxpffv.exe84⤵PID:2820
-
\??\c:\bpltjp.exec:\bpltjp.exe85⤵PID:2828
-
\??\c:\tvbnddn.exec:\tvbnddn.exe86⤵PID:2836
-
\??\c:\rbrtldn.exec:\rbrtldn.exe87⤵PID:2724
-
\??\c:\bfrhf.exec:\bfrhf.exe88⤵PID:2744
-
\??\c:\dntdhdv.exec:\dntdhdv.exe89⤵PID:1388
-
\??\c:\djtphb.exec:\djtphb.exe90⤵PID:1552
-
\??\c:\bjhdvbj.exec:\bjhdvbj.exe91⤵PID:1748
-
\??\c:\lbtbdvv.exec:\lbtbdvv.exe92⤵PID:2412
-
\??\c:\txhfll.exec:\txhfll.exe93⤵PID:2956
-
\??\c:\htntlv.exec:\htntlv.exe94⤵PID:2308
-
\??\c:\xnbjx.exec:\xnbjx.exe95⤵PID:2848
-
\??\c:\bvndb.exec:\bvndb.exe96⤵PID:1532
-
\??\c:\hlnthn.exec:\hlnthn.exe97⤵PID:2128
-
\??\c:\vjrbn.exec:\vjrbn.exe98⤵PID:1656
-
\??\c:\lxhnx.exec:\lxhnx.exe99⤵PID:236
-
\??\c:\pdxlr.exec:\pdxlr.exe100⤵PID:1908
-
\??\c:\rjflrjp.exec:\rjflrjp.exe101⤵PID:1376
-
\??\c:\rvpjh.exec:\rvpjh.exe102⤵PID:3048
-
\??\c:\vdthnnd.exec:\vdthnnd.exe103⤵PID:2844
-
\??\c:\bdpjd.exec:\bdpjd.exe104⤵PID:824
-
\??\c:\vlvpnh.exec:\vlvpnh.exe105⤵PID:2320
-
\??\c:\jdhnj.exec:\jdhnj.exe106⤵PID:2636
-
\??\c:\hpvdfn.exec:\hpvdfn.exe107⤵PID:2564
-
\??\c:\jhfjdlv.exec:\jhfjdlv.exe108⤵PID:1672
-
\??\c:\trdptl.exec:\trdptl.exe109⤵PID:1092
-
\??\c:\lxxtx.exec:\lxxtx.exe110⤵PID:1960
-
\??\c:\tlnxbx.exec:\tlnxbx.exe111⤵PID:1584
-
\??\c:\nnvxj.exec:\nnvxj.exe112⤵PID:856
-
\??\c:\lxxrhlx.exec:\lxxrhlx.exe113⤵PID:2508
-
\??\c:\fxbpp.exec:\fxbpp.exe114⤵PID:2020
-
\??\c:\xljhlp.exec:\xljhlp.exe115⤵PID:320
-
\??\c:\nbjhd.exec:\nbjhd.exe116⤵PID:1124
-
\??\c:\jtvpt.exec:\jtvpt.exe117⤵PID:904
-
\??\c:\xjxjr.exec:\xjxjr.exe118⤵
- System Location Discovery: System Language Discovery
PID:2620 -
\??\c:\vjvrvd.exec:\vjvrvd.exe119⤵PID:2376
-
\??\c:\njvvlp.exec:\njvvlp.exe120⤵PID:2592
-
\??\c:\bjpnb.exec:\bjpnb.exe121⤵PID:2176
-
\??\c:\rxvjd.exec:\rxvjd.exe122⤵PID:644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-