Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 14:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
88ace0444fdff6f55482daa7fef351d5eaaa07670062f10501ef80031c7f4cafN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
88ace0444fdff6f55482daa7fef351d5eaaa07670062f10501ef80031c7f4cafN.exe
-
Size
454KB
-
MD5
72da5e94ffea238f686807b1cb7d58e0
-
SHA1
f97dfa238ec70d8262d3e4bef105db3ccd33d17d
-
SHA256
88ace0444fdff6f55482daa7fef351d5eaaa07670062f10501ef80031c7f4caf
-
SHA512
2653cfaaa075313ed4c3815f8bfd0ee1127646c5115cc1255788455aa63f906669860789f35f26c81ef2a60e3751a1d56217c5258291c0e26228e60d8b36aade
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeD9:q7Tc2NYHUrAwfMp3CDh
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2904-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-26-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2976-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/328-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-285-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2376-302-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2376-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-340-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2896-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-368-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2788-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-394-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2080-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/824-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-519-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2340-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-639-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2136-640-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2308-701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2432 pjjhplx.exe 2976 vdldtrj.exe 2868 bndhjd.exe 2264 ptxphl.exe 2184 ttbfntp.exe 2748 jlrfxj.exe 2560 fjntdbf.exe 328 bnblf.exe 2080 lrnbhp.exe 1736 xxlhlpd.exe 2180 vvpfbv.exe 2920 dvlft.exe 1704 jlnljv.exe 2292 lxrdtpd.exe 2396 trnnt.exe 1792 nvhfb.exe 1796 dlxftx.exe 2140 llthnlv.exe 2108 xvpdtf.exe 2084 ndvfd.exe 2408 djjrt.exe 2244 lnjrdh.exe 944 vrrhlxh.exe 1872 llxfhx.exe 2384 vfnpjrp.exe 1332 lfphh.exe 2800 flrpb.exe 540 njvjdr.exe 916 vbblxp.exe 2388 hbhxhxr.exe 688 xffdl.exe 2376 xhhxj.exe 2640 dbfnhtt.exe 2808 rdhtdlr.exe 2236 rfrlx.exe 2432 thhpn.exe 2096 vpjbnl.exe 3024 xfllttb.exe 2804 pppvl.exe 2896 hftnpvf.exe 2788 hhbnt.exe 2572 bpffd.exe 2696 drntpp.exe 3048 lfrvx.exe 2700 tprdlxp.exe 2080 lbnnfh.exe 2948 lhxvnff.exe 2496 xnxhnhv.exe 2956 ldrfln.exe 2960 hphnrrv.exe 2892 hfxrdtv.exe 1704 drnrdfp.exe 2488 trpjll.exe 1636 jflhf.exe 1084 jpnrdt.exe 2124 jvvvtt.exe 2232 ljtpjf.exe 2412 hxjntfl.exe 2452 htpxxbd.exe 2060 rtvdhx.exe 2556 lvlrjp.exe 1688 nhxfbhf.exe 824 xtrtnfd.exe 2692 jnrhxxv.exe -
resource yara_rule behavioral1/memory/2904-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-101-0x0000000001C50000-0x0000000001C7A000-memory.dmp upx behavioral1/memory/2920-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-264-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2376-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-611-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2868-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-724-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-774-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhjbrtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhdlvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pttlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fljrbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blpxvln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfhtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjhvjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdppnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldvlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blxhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbphxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxjfxxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnbdhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhtdxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlfthjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflrfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxnhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhddh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fljxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpnbhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbtfthj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdhpjvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phlfvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htfbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrjnflv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxbppn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbfrbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbjxln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frbnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pplxjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbblxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjvht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbptpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvlft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vltdrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjtxbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfvlrjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlnhdfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljlht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frtxnrr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2432 2904 88ace0444fdff6f55482daa7fef351d5eaaa07670062f10501ef80031c7f4cafN.exe 29 PID 2904 wrote to memory of 2432 2904 88ace0444fdff6f55482daa7fef351d5eaaa07670062f10501ef80031c7f4cafN.exe 29 PID 2904 wrote to memory of 2432 2904 88ace0444fdff6f55482daa7fef351d5eaaa07670062f10501ef80031c7f4cafN.exe 29 PID 2904 wrote to memory of 2432 2904 88ace0444fdff6f55482daa7fef351d5eaaa07670062f10501ef80031c7f4cafN.exe 29 PID 2432 wrote to memory of 2976 2432 pjjhplx.exe 30 PID 2432 wrote to memory of 2976 2432 pjjhplx.exe 30 PID 2432 wrote to memory of 2976 2432 pjjhplx.exe 30 PID 2432 wrote to memory of 2976 2432 pjjhplx.exe 30 PID 2976 wrote to memory of 2868 2976 vdldtrj.exe 31 PID 2976 wrote to memory of 2868 2976 vdldtrj.exe 31 PID 2976 wrote to memory of 2868 2976 vdldtrj.exe 31 PID 2976 wrote to memory of 2868 2976 vdldtrj.exe 31 PID 2868 wrote to memory of 2264 2868 bndhjd.exe 32 PID 2868 wrote to memory of 2264 2868 bndhjd.exe 32 PID 2868 wrote to memory of 2264 2868 bndhjd.exe 32 PID 2868 wrote to memory of 2264 2868 bndhjd.exe 32 PID 2264 wrote to memory of 2184 2264 ptxphl.exe 33 PID 2264 wrote to memory of 2184 2264 ptxphl.exe 33 PID 2264 wrote to memory of 2184 2264 ptxphl.exe 33 PID 2264 wrote to memory of 2184 2264 ptxphl.exe 33 PID 2184 wrote to memory of 2748 2184 ttbfntp.exe 34 PID 2184 wrote to memory of 2748 2184 ttbfntp.exe 34 PID 2184 wrote to memory of 2748 2184 ttbfntp.exe 34 PID 2184 wrote to memory of 2748 2184 ttbfntp.exe 34 PID 2748 wrote to memory of 2560 2748 jlrfxj.exe 35 PID 2748 wrote to memory of 2560 2748 jlrfxj.exe 35 PID 2748 wrote to memory of 2560 2748 jlrfxj.exe 35 PID 2748 wrote to memory of 2560 2748 jlrfxj.exe 35 PID 2560 wrote to memory of 328 2560 fjntdbf.exe 36 PID 2560 wrote to memory of 328 2560 fjntdbf.exe 36 PID 2560 wrote to memory of 328 2560 fjntdbf.exe 36 PID 2560 wrote to memory of 328 2560 fjntdbf.exe 36 PID 328 wrote to memory of 2080 328 bnblf.exe 37 PID 328 wrote to memory of 2080 328 bnblf.exe 37 PID 328 wrote to memory of 2080 328 bnblf.exe 37 PID 328 wrote to memory of 2080 328 bnblf.exe 37 PID 2080 wrote to memory of 1736 2080 lrnbhp.exe 38 PID 2080 wrote to memory of 1736 2080 lrnbhp.exe 38 PID 2080 wrote to memory of 1736 2080 lrnbhp.exe 38 PID 2080 wrote to memory of 1736 2080 lrnbhp.exe 38 PID 1736 wrote to memory of 2180 1736 xxlhlpd.exe 39 PID 1736 wrote to memory of 2180 1736 xxlhlpd.exe 39 PID 1736 wrote to memory of 2180 1736 xxlhlpd.exe 39 PID 1736 wrote to memory of 2180 1736 xxlhlpd.exe 39 PID 2180 wrote to memory of 2920 2180 vvpfbv.exe 40 PID 2180 wrote to memory of 2920 2180 vvpfbv.exe 40 PID 2180 wrote to memory of 2920 2180 vvpfbv.exe 40 PID 2180 wrote to memory of 2920 2180 vvpfbv.exe 40 PID 2920 wrote to memory of 1704 2920 dvlft.exe 41 PID 2920 wrote to memory of 1704 2920 dvlft.exe 41 PID 2920 wrote to memory of 1704 2920 dvlft.exe 41 PID 2920 wrote to memory of 1704 2920 dvlft.exe 41 PID 1704 wrote to memory of 2292 1704 jlnljv.exe 42 PID 1704 wrote to memory of 2292 1704 jlnljv.exe 42 PID 1704 wrote to memory of 2292 1704 jlnljv.exe 42 PID 1704 wrote to memory of 2292 1704 jlnljv.exe 42 PID 2292 wrote to memory of 2396 2292 lxrdtpd.exe 43 PID 2292 wrote to memory of 2396 2292 lxrdtpd.exe 43 PID 2292 wrote to memory of 2396 2292 lxrdtpd.exe 43 PID 2292 wrote to memory of 2396 2292 lxrdtpd.exe 43 PID 2396 wrote to memory of 1792 2396 trnnt.exe 44 PID 2396 wrote to memory of 1792 2396 trnnt.exe 44 PID 2396 wrote to memory of 1792 2396 trnnt.exe 44 PID 2396 wrote to memory of 1792 2396 trnnt.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\88ace0444fdff6f55482daa7fef351d5eaaa07670062f10501ef80031c7f4cafN.exe"C:\Users\Admin\AppData\Local\Temp\88ace0444fdff6f55482daa7fef351d5eaaa07670062f10501ef80031c7f4cafN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\pjjhplx.exec:\pjjhplx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\vdldtrj.exec:\vdldtrj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\bndhjd.exec:\bndhjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\ptxphl.exec:\ptxphl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\ttbfntp.exec:\ttbfntp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\jlrfxj.exec:\jlrfxj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\fjntdbf.exec:\fjntdbf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\bnblf.exec:\bnblf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:328 -
\??\c:\lrnbhp.exec:\lrnbhp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\xxlhlpd.exec:\xxlhlpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\vvpfbv.exec:\vvpfbv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\dvlft.exec:\dvlft.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\jlnljv.exec:\jlnljv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\lxrdtpd.exec:\lxrdtpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\trnnt.exec:\trnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\nvhfb.exec:\nvhfb.exe17⤵
- Executes dropped EXE
PID:1792 -
\??\c:\dlxftx.exec:\dlxftx.exe18⤵
- Executes dropped EXE
PID:1796 -
\??\c:\llthnlv.exec:\llthnlv.exe19⤵
- Executes dropped EXE
PID:2140 -
\??\c:\xvpdtf.exec:\xvpdtf.exe20⤵
- Executes dropped EXE
PID:2108 -
\??\c:\ndvfd.exec:\ndvfd.exe21⤵
- Executes dropped EXE
PID:2084 -
\??\c:\djjrt.exec:\djjrt.exe22⤵
- Executes dropped EXE
PID:2408 -
\??\c:\lnjrdh.exec:\lnjrdh.exe23⤵
- Executes dropped EXE
PID:2244 -
\??\c:\vrrhlxh.exec:\vrrhlxh.exe24⤵
- Executes dropped EXE
PID:944 -
\??\c:\llxfhx.exec:\llxfhx.exe25⤵
- Executes dropped EXE
PID:1872 -
\??\c:\vfnpjrp.exec:\vfnpjrp.exe26⤵
- Executes dropped EXE
PID:2384 -
\??\c:\lfphh.exec:\lfphh.exe27⤵
- Executes dropped EXE
PID:1332 -
\??\c:\flrpb.exec:\flrpb.exe28⤵
- Executes dropped EXE
PID:2800 -
\??\c:\njvjdr.exec:\njvjdr.exe29⤵
- Executes dropped EXE
PID:540 -
\??\c:\vbblxp.exec:\vbblxp.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:916 -
\??\c:\hbhxhxr.exec:\hbhxhxr.exe31⤵
- Executes dropped EXE
PID:2388 -
\??\c:\xffdl.exec:\xffdl.exe32⤵
- Executes dropped EXE
PID:688 -
\??\c:\xhhxj.exec:\xhhxj.exe33⤵
- Executes dropped EXE
PID:2376 -
\??\c:\dbfnhtt.exec:\dbfnhtt.exe34⤵
- Executes dropped EXE
PID:2640 -
\??\c:\rdhtdlr.exec:\rdhtdlr.exe35⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rfrlx.exec:\rfrlx.exe36⤵
- Executes dropped EXE
PID:2236 -
\??\c:\thhpn.exec:\thhpn.exe37⤵
- Executes dropped EXE
PID:2432 -
\??\c:\vpjbnl.exec:\vpjbnl.exe38⤵
- Executes dropped EXE
PID:2096 -
\??\c:\xfllttb.exec:\xfllttb.exe39⤵
- Executes dropped EXE
PID:3024 -
\??\c:\pppvl.exec:\pppvl.exe40⤵
- Executes dropped EXE
PID:2804 -
\??\c:\hftnpvf.exec:\hftnpvf.exe41⤵
- Executes dropped EXE
PID:2896 -
\??\c:\hhbnt.exec:\hhbnt.exe42⤵
- Executes dropped EXE
PID:2788 -
\??\c:\bpffd.exec:\bpffd.exe43⤵
- Executes dropped EXE
PID:2572 -
\??\c:\drntpp.exec:\drntpp.exe44⤵
- Executes dropped EXE
PID:2696 -
\??\c:\lfrvx.exec:\lfrvx.exe45⤵
- Executes dropped EXE
PID:3048 -
\??\c:\tprdlxp.exec:\tprdlxp.exe46⤵
- Executes dropped EXE
PID:2700 -
\??\c:\lbnnfh.exec:\lbnnfh.exe47⤵
- Executes dropped EXE
PID:2080 -
\??\c:\lhxvnff.exec:\lhxvnff.exe48⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xnxhnhv.exec:\xnxhnhv.exe49⤵
- Executes dropped EXE
PID:2496 -
\??\c:\ldrfln.exec:\ldrfln.exe50⤵
- Executes dropped EXE
PID:2956 -
\??\c:\hphnrrv.exec:\hphnrrv.exe51⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hfxrdtv.exec:\hfxrdtv.exe52⤵
- Executes dropped EXE
PID:2892 -
\??\c:\drnrdfp.exec:\drnrdfp.exe53⤵
- Executes dropped EXE
PID:1704 -
\??\c:\trpjll.exec:\trpjll.exe54⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jflhf.exec:\jflhf.exe55⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jpnrdt.exec:\jpnrdt.exe56⤵
- Executes dropped EXE
PID:1084 -
\??\c:\jvvvtt.exec:\jvvvtt.exe57⤵
- Executes dropped EXE
PID:2124 -
\??\c:\ljtpjf.exec:\ljtpjf.exe58⤵
- Executes dropped EXE
PID:2232 -
\??\c:\hxjntfl.exec:\hxjntfl.exe59⤵
- Executes dropped EXE
PID:2412 -
\??\c:\htpxxbd.exec:\htpxxbd.exe60⤵
- Executes dropped EXE
PID:2452 -
\??\c:\rtvdhx.exec:\rtvdhx.exe61⤵
- Executes dropped EXE
PID:2060 -
\??\c:\lvlrjp.exec:\lvlrjp.exe62⤵
- Executes dropped EXE
PID:2556 -
\??\c:\nhxfbhf.exec:\nhxfbhf.exe63⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xtrtnfd.exec:\xtrtnfd.exe64⤵
- Executes dropped EXE
PID:824 -
\??\c:\jnrhxxv.exec:\jnrhxxv.exe65⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lvjfhhr.exec:\lvjfhhr.exe66⤵PID:1600
-
\??\c:\thvjfd.exec:\thvjfd.exe67⤵PID:2540
-
\??\c:\vflvxn.exec:\vflvxn.exe68⤵PID:2672
-
\??\c:\blxhn.exec:\blxhn.exe69⤵
- System Location Discovery: System Language Discovery
PID:1364 -
\??\c:\hhjvt.exec:\hhjvt.exe70⤵PID:1020
-
\??\c:\fpvpx.exec:\fpvpx.exe71⤵PID:1288
-
\??\c:\tlblh.exec:\tlblh.exe72⤵PID:1056
-
\??\c:\hnltxhd.exec:\hnltxhd.exe73⤵PID:916
-
\??\c:\nvdxf.exec:\nvdxf.exe74⤵PID:2388
-
\??\c:\pfdrvf.exec:\pfdrvf.exe75⤵PID:2340
-
\??\c:\npfxvf.exec:\npfxvf.exe76⤵PID:2068
-
\??\c:\hhnpnx.exec:\hhnpnx.exe77⤵PID:2344
-
\??\c:\ttvxh.exec:\ttvxh.exe78⤵PID:2680
-
\??\c:\nbdlfxh.exec:\nbdlfxh.exe79⤵PID:2276
-
\??\c:\tjjln.exec:\tjjln.exe80⤵PID:2424
-
\??\c:\hldpxd.exec:\hldpxd.exe81⤵PID:2840
-
\??\c:\rxxdf.exec:\rxxdf.exe82⤵PID:2868
-
\??\c:\nhndjx.exec:\nhndjx.exe83⤵PID:2136
-
\??\c:\pxnxpl.exec:\pxnxpl.exe84⤵PID:2804
-
\??\c:\jtvhv.exec:\jtvhv.exe85⤵PID:2780
-
\??\c:\vhdfxv.exec:\vhdfxv.exe86⤵PID:2576
-
\??\c:\xfnjdrd.exec:\xfnjdrd.exe87⤵PID:2268
-
\??\c:\pltfldd.exec:\pltfldd.exe88⤵PID:872
-
\??\c:\lbhjpj.exec:\lbhjpj.exe89⤵PID:1576
-
\??\c:\ptlttbh.exec:\ptlttbh.exe90⤵PID:328
-
\??\c:\fbldjj.exec:\fbldjj.exe91⤵PID:1580
-
\??\c:\ffljbjn.exec:\ffljbjn.exe92⤵PID:2308
-
\??\c:\bppthx.exec:\bppthx.exe93⤵PID:2924
-
\??\c:\jplhnd.exec:\jplhnd.exe94⤵PID:2956
-
\??\c:\tjnpx.exec:\tjnpx.exe95⤵PID:2960
-
\??\c:\fdhvd.exec:\fdhvd.exe96⤵PID:1952
-
\??\c:\djnntv.exec:\djnntv.exe97⤵PID:1868
-
\??\c:\pvbfpn.exec:\pvbfpn.exe98⤵PID:1028
-
\??\c:\vflpr.exec:\vflpr.exe99⤵PID:2132
-
\??\c:\fldpjlr.exec:\fldpjlr.exe100⤵PID:1824
-
\??\c:\pvjppr.exec:\pvjppr.exe101⤵PID:2464
-
\??\c:\ppxrrxj.exec:\ppxrrxj.exe102⤵PID:2140
-
\??\c:\pvttbp.exec:\pvttbp.exe103⤵PID:2160
-
\??\c:\hvtdv.exec:\hvtdv.exe104⤵PID:316
-
\??\c:\dntdt.exec:\dntdt.exe105⤵PID:2060
-
\??\c:\ffvftx.exec:\ffvftx.exe106⤵PID:528
-
\??\c:\vtfxvt.exec:\vtfxvt.exe107⤵PID:600
-
\??\c:\plxfl.exec:\plxfl.exe108⤵PID:1272
-
\??\c:\pbfhjhh.exec:\pbfhjhh.exe109⤵PID:1148
-
\??\c:\nphtb.exec:\nphtb.exe110⤵PID:1600
-
\??\c:\ttnvf.exec:\ttnvf.exe111⤵
- System Location Discovery: System Language Discovery
PID:764 -
\??\c:\jvxfrbt.exec:\jvxfrbt.exe112⤵PID:748
-
\??\c:\dxfbt.exec:\dxfbt.exe113⤵PID:2800
-
\??\c:\nrvrfp.exec:\nrvrfp.exe114⤵PID:540
-
\??\c:\rjbthx.exec:\rjbthx.exe115⤵PID:956
-
\??\c:\vtfnt.exec:\vtfnt.exe116⤵PID:2012
-
\??\c:\rhjbrtd.exec:\rhjbrtd.exe117⤵
- System Location Discovery: System Language Discovery
PID:916 -
\??\c:\xdlntn.exec:\xdlntn.exe118⤵PID:868
-
\??\c:\jhfxbh.exec:\jhfxbh.exe119⤵PID:2376
-
\??\c:\dvbpx.exec:\dvbpx.exe120⤵PID:1568
-
\??\c:\dnddxd.exec:\dnddxd.exe121⤵PID:1572
-
\??\c:\rtlbv.exec:\rtlbv.exe122⤵PID:2824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-