Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 15:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
495b6a5ed851b7f9f546c678fa1ec2d8cbbe192c5fd226689fc4240d303d5ef2N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
495b6a5ed851b7f9f546c678fa1ec2d8cbbe192c5fd226689fc4240d303d5ef2N.exe
-
Size
453KB
-
MD5
0a934ccef2ab6b50cb57efd237e0c220
-
SHA1
34a6e1d72e63cc4e61da2b458f8491fbbab60364
-
SHA256
495b6a5ed851b7f9f546c678fa1ec2d8cbbe192c5fd226689fc4240d303d5ef2
-
SHA512
4fbd04e2d512845d2945ba52d591cbd0e74640c5363245278d792c3c71a094a4db757b97510c1c8df08e2ad7cb902ff2792f001e41d36a0a70c9b6c0fc502164
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeY:q7Tc2NYHUrAwfMp3CDY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/3004-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-22-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2992-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-46-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2984-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-120-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2192-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1280-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/616-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/304-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/792-315-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2288-316-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/924-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-538-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2260-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-623-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-728-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-759-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1872-860-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2436 lhvdxf.exe 2868 hbhfjtb.exe 2992 vddtrb.exe 2316 vltbxr.exe 2984 rhxll.exe 2772 vxnhbd.exe 2740 xljxht.exe 2608 xpfnt.exe 2672 bltxjfj.exe 1760 bdtfvll.exe 1240 fnvppf.exe 2128 xdttlv.exe 2192 vtbjvlx.exe 2500 lhrtjpb.exe 2392 vxdrt.exe 3036 xpllht.exe 1616 bttvn.exe 1280 hvhhnt.exe 2644 tvprxj.exe 2164 npfpr.exe 2684 tvpxlp.exe 616 lpltr.exe 2516 jjjbbx.exe 2256 xntrdpd.exe 2244 pxxxpt.exe 592 vlpfvrh.exe 2024 vxxndl.exe 304 phlbf.exe 1104 fdtjj.exe 2564 jvxrbl.exe 2288 djnxv.exe 872 ltvtbb.exe 2424 tntdbxt.exe 792 ldnbrb.exe 2872 xnpndxn.exe 2948 vvhljn.exe 924 xxjxx.exe 2928 npvdlh.exe 3000 vbpfjt.exe 2936 vjjhntp.exe 2728 nltbplb.exe 2800 rhfrh.exe 1388 vrvjdv.exe 2824 xlnjdp.exe 1620 fbhrdn.exe 2828 fdbhnrr.exe 3060 dvnvblx.exe 2552 nrdbhn.exe 2128 tlxdtl.exe 2300 nrdbvvr.exe 2400 jhvdpr.exe 2384 tnbjxpf.exe 1648 tbxxtnl.exe 3036 jppxdb.exe 2368 rrxvd.exe 1864 nvbrdf.exe 1680 tntpd.exe 2180 htrvjxt.exe 900 nxhnt.exe 2292 hfdnv.exe 2520 tllhlpt.exe 1868 tvxhj.exe 1792 frhrd.exe 2700 xfnfhvh.exe -
resource yara_rule behavioral1/memory/2436-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/616-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-775-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-846-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-860-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxxndl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtvpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djbjtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhnnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlppdvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvxbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlrvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dllvbpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtnrbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltntjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phjhdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlrpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjrlljx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvlphl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfbjjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpjjhbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdvlln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpphhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjxbnbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjhdlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnfhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxndjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhptxtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpdpvdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htftfdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbrtln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvrfvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vljtdnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rftjpbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btfbtlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnrjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drvdrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrxxfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnrnpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hphhpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftlfdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvbtbjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbhrdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvtpbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvphrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htntx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjrpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvjvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2436 3004 495b6a5ed851b7f9f546c678fa1ec2d8cbbe192c5fd226689fc4240d303d5ef2N.exe 29 PID 3004 wrote to memory of 2436 3004 495b6a5ed851b7f9f546c678fa1ec2d8cbbe192c5fd226689fc4240d303d5ef2N.exe 29 PID 3004 wrote to memory of 2436 3004 495b6a5ed851b7f9f546c678fa1ec2d8cbbe192c5fd226689fc4240d303d5ef2N.exe 29 PID 3004 wrote to memory of 2436 3004 495b6a5ed851b7f9f546c678fa1ec2d8cbbe192c5fd226689fc4240d303d5ef2N.exe 29 PID 2436 wrote to memory of 2868 2436 lhvdxf.exe 30 PID 2436 wrote to memory of 2868 2436 lhvdxf.exe 30 PID 2436 wrote to memory of 2868 2436 lhvdxf.exe 30 PID 2436 wrote to memory of 2868 2436 lhvdxf.exe 30 PID 2868 wrote to memory of 2992 2868 hbhfjtb.exe 31 PID 2868 wrote to memory of 2992 2868 hbhfjtb.exe 31 PID 2868 wrote to memory of 2992 2868 hbhfjtb.exe 31 PID 2868 wrote to memory of 2992 2868 hbhfjtb.exe 31 PID 2992 wrote to memory of 2316 2992 vddtrb.exe 32 PID 2992 wrote to memory of 2316 2992 vddtrb.exe 32 PID 2992 wrote to memory of 2316 2992 vddtrb.exe 32 PID 2992 wrote to memory of 2316 2992 vddtrb.exe 32 PID 2316 wrote to memory of 2984 2316 vltbxr.exe 33 PID 2316 wrote to memory of 2984 2316 vltbxr.exe 33 PID 2316 wrote to memory of 2984 2316 vltbxr.exe 33 PID 2316 wrote to memory of 2984 2316 vltbxr.exe 33 PID 2984 wrote to memory of 2772 2984 rhxll.exe 34 PID 2984 wrote to memory of 2772 2984 rhxll.exe 34 PID 2984 wrote to memory of 2772 2984 rhxll.exe 34 PID 2984 wrote to memory of 2772 2984 rhxll.exe 34 PID 2772 wrote to memory of 2740 2772 vxnhbd.exe 35 PID 2772 wrote to memory of 2740 2772 vxnhbd.exe 35 PID 2772 wrote to memory of 2740 2772 vxnhbd.exe 35 PID 2772 wrote to memory of 2740 2772 vxnhbd.exe 35 PID 2740 wrote to memory of 2608 2740 xljxht.exe 36 PID 2740 wrote to memory of 2608 2740 xljxht.exe 36 PID 2740 wrote to memory of 2608 2740 xljxht.exe 36 PID 2740 wrote to memory of 2608 2740 xljxht.exe 36 PID 2608 wrote to memory of 2672 2608 xpfnt.exe 37 PID 2608 wrote to memory of 2672 2608 xpfnt.exe 37 PID 2608 wrote to memory of 2672 2608 xpfnt.exe 37 PID 2608 wrote to memory of 2672 2608 xpfnt.exe 37 PID 2672 wrote to memory of 1760 2672 bltxjfj.exe 38 PID 2672 wrote to memory of 1760 2672 bltxjfj.exe 38 PID 2672 wrote to memory of 1760 2672 bltxjfj.exe 38 PID 2672 wrote to memory of 1760 2672 bltxjfj.exe 38 PID 1760 wrote to memory of 1240 1760 bdtfvll.exe 39 PID 1760 wrote to memory of 1240 1760 bdtfvll.exe 39 PID 1760 wrote to memory of 1240 1760 bdtfvll.exe 39 PID 1760 wrote to memory of 1240 1760 bdtfvll.exe 39 PID 1240 wrote to memory of 2128 1240 fnvppf.exe 40 PID 1240 wrote to memory of 2128 1240 fnvppf.exe 40 PID 1240 wrote to memory of 2128 1240 fnvppf.exe 40 PID 1240 wrote to memory of 2128 1240 fnvppf.exe 40 PID 2128 wrote to memory of 2192 2128 xdttlv.exe 41 PID 2128 wrote to memory of 2192 2128 xdttlv.exe 41 PID 2128 wrote to memory of 2192 2128 xdttlv.exe 41 PID 2128 wrote to memory of 2192 2128 xdttlv.exe 41 PID 2192 wrote to memory of 2500 2192 vtbjvlx.exe 42 PID 2192 wrote to memory of 2500 2192 vtbjvlx.exe 42 PID 2192 wrote to memory of 2500 2192 vtbjvlx.exe 42 PID 2192 wrote to memory of 2500 2192 vtbjvlx.exe 42 PID 2500 wrote to memory of 2392 2500 lhrtjpb.exe 43 PID 2500 wrote to memory of 2392 2500 lhrtjpb.exe 43 PID 2500 wrote to memory of 2392 2500 lhrtjpb.exe 43 PID 2500 wrote to memory of 2392 2500 lhrtjpb.exe 43 PID 2392 wrote to memory of 3036 2392 vxdrt.exe 44 PID 2392 wrote to memory of 3036 2392 vxdrt.exe 44 PID 2392 wrote to memory of 3036 2392 vxdrt.exe 44 PID 2392 wrote to memory of 3036 2392 vxdrt.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\495b6a5ed851b7f9f546c678fa1ec2d8cbbe192c5fd226689fc4240d303d5ef2N.exe"C:\Users\Admin\AppData\Local\Temp\495b6a5ed851b7f9f546c678fa1ec2d8cbbe192c5fd226689fc4240d303d5ef2N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\lhvdxf.exec:\lhvdxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\hbhfjtb.exec:\hbhfjtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\vddtrb.exec:\vddtrb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\vltbxr.exec:\vltbxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\rhxll.exec:\rhxll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\vxnhbd.exec:\vxnhbd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\xljxht.exec:\xljxht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\xpfnt.exec:\xpfnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\bltxjfj.exec:\bltxjfj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\bdtfvll.exec:\bdtfvll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\fnvppf.exec:\fnvppf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\xdttlv.exec:\xdttlv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\vtbjvlx.exec:\vtbjvlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\lhrtjpb.exec:\lhrtjpb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\vxdrt.exec:\vxdrt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\xpllht.exec:\xpllht.exe17⤵
- Executes dropped EXE
PID:3036 -
\??\c:\bttvn.exec:\bttvn.exe18⤵
- Executes dropped EXE
PID:1616 -
\??\c:\hvhhnt.exec:\hvhhnt.exe19⤵
- Executes dropped EXE
PID:1280 -
\??\c:\tvprxj.exec:\tvprxj.exe20⤵
- Executes dropped EXE
PID:2644 -
\??\c:\npfpr.exec:\npfpr.exe21⤵
- Executes dropped EXE
PID:2164 -
\??\c:\tvpxlp.exec:\tvpxlp.exe22⤵
- Executes dropped EXE
PID:2684 -
\??\c:\lpltr.exec:\lpltr.exe23⤵
- Executes dropped EXE
PID:616 -
\??\c:\jjjbbx.exec:\jjjbbx.exe24⤵
- Executes dropped EXE
PID:2516 -
\??\c:\xntrdpd.exec:\xntrdpd.exe25⤵
- Executes dropped EXE
PID:2256 -
\??\c:\pxxxpt.exec:\pxxxpt.exe26⤵
- Executes dropped EXE
PID:2244 -
\??\c:\vlpfvrh.exec:\vlpfvrh.exe27⤵
- Executes dropped EXE
PID:592 -
\??\c:\vxxndl.exec:\vxxndl.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2024 -
\??\c:\phlbf.exec:\phlbf.exe29⤵
- Executes dropped EXE
PID:304 -
\??\c:\fdtjj.exec:\fdtjj.exe30⤵
- Executes dropped EXE
PID:1104 -
\??\c:\jvxrbl.exec:\jvxrbl.exe31⤵
- Executes dropped EXE
PID:2564 -
\??\c:\djnxv.exec:\djnxv.exe32⤵
- Executes dropped EXE
PID:2288 -
\??\c:\ltvtbb.exec:\ltvtbb.exe33⤵
- Executes dropped EXE
PID:872 -
\??\c:\tntdbxt.exec:\tntdbxt.exe34⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ldnbrb.exec:\ldnbrb.exe35⤵
- Executes dropped EXE
PID:792 -
\??\c:\xnpndxn.exec:\xnpndxn.exe36⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vvhljn.exec:\vvhljn.exe37⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xxjxx.exec:\xxjxx.exe38⤵
- Executes dropped EXE
PID:924 -
\??\c:\npvdlh.exec:\npvdlh.exe39⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vbpfjt.exec:\vbpfjt.exe40⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vjjhntp.exec:\vjjhntp.exe41⤵
- Executes dropped EXE
PID:2936 -
\??\c:\nltbplb.exec:\nltbplb.exe42⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rhfrh.exec:\rhfrh.exe43⤵
- Executes dropped EXE
PID:2800 -
\??\c:\vrvjdv.exec:\vrvjdv.exe44⤵
- Executes dropped EXE
PID:1388 -
\??\c:\xlnjdp.exec:\xlnjdp.exe45⤵
- Executes dropped EXE
PID:2824 -
\??\c:\fbhrdn.exec:\fbhrdn.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1620 -
\??\c:\fdbhnrr.exec:\fdbhnrr.exe47⤵
- Executes dropped EXE
PID:2828 -
\??\c:\dvnvblx.exec:\dvnvblx.exe48⤵
- Executes dropped EXE
PID:3060 -
\??\c:\nrdbhn.exec:\nrdbhn.exe49⤵
- Executes dropped EXE
PID:2552 -
\??\c:\tlxdtl.exec:\tlxdtl.exe50⤵
- Executes dropped EXE
PID:2128 -
\??\c:\nrdbvvr.exec:\nrdbvvr.exe51⤵
- Executes dropped EXE
PID:2300 -
\??\c:\jhvdpr.exec:\jhvdpr.exe52⤵
- Executes dropped EXE
PID:2400 -
\??\c:\tnbjxpf.exec:\tnbjxpf.exe53⤵
- Executes dropped EXE
PID:2384 -
\??\c:\tbxxtnl.exec:\tbxxtnl.exe54⤵
- Executes dropped EXE
PID:1648 -
\??\c:\jppxdb.exec:\jppxdb.exe55⤵
- Executes dropped EXE
PID:3036 -
\??\c:\rrxvd.exec:\rrxvd.exe56⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nvbrdf.exec:\nvbrdf.exe57⤵
- Executes dropped EXE
PID:1864 -
\??\c:\tntpd.exec:\tntpd.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1680 -
\??\c:\htrvjxt.exec:\htrvjxt.exe59⤵
- Executes dropped EXE
PID:2180 -
\??\c:\nxhnt.exec:\nxhnt.exe60⤵
- Executes dropped EXE
PID:900 -
\??\c:\hfdnv.exec:\hfdnv.exe61⤵
- Executes dropped EXE
PID:2292 -
\??\c:\tllhlpt.exec:\tllhlpt.exe62⤵
- Executes dropped EXE
PID:2520 -
\??\c:\tvxhj.exec:\tvxhj.exe63⤵
- Executes dropped EXE
PID:1868 -
\??\c:\frhrd.exec:\frhrd.exe64⤵
- Executes dropped EXE
PID:1792 -
\??\c:\xfnfhvh.exec:\xfnfhvh.exe65⤵
- Executes dropped EXE
PID:2700 -
\??\c:\tvrvj.exec:\tvrvj.exe66⤵PID:1780
-
\??\c:\tvxdhd.exec:\tvxdhd.exe67⤵PID:2244
-
\??\c:\bhvfn.exec:\bhvfn.exe68⤵PID:1732
-
\??\c:\txrvbdn.exec:\txrvbdn.exe69⤵PID:1252
-
\??\c:\vdrvd.exec:\vdrvd.exe70⤵PID:2484
-
\??\c:\hjplbb.exec:\hjplbb.exe71⤵PID:2100
-
\??\c:\rlxfph.exec:\rlxfph.exe72⤵PID:2260
-
\??\c:\bjhtp.exec:\bjhtp.exe73⤵PID:2564
-
\??\c:\tflphtf.exec:\tflphtf.exe74⤵PID:2288
-
\??\c:\bhnph.exec:\bhnph.exe75⤵PID:1692
-
\??\c:\fbjfhnp.exec:\fbjfhnp.exe76⤵PID:2556
-
\??\c:\bxntn.exec:\bxntn.exe77⤵PID:2836
-
\??\c:\pjhvv.exec:\pjhvv.exe78⤵PID:2976
-
\??\c:\npljlnx.exec:\npljlnx.exe79⤵PID:2868
-
\??\c:\jjhvtvd.exec:\jjhvtvd.exe80⤵PID:2996
-
\??\c:\pndln.exec:\pndln.exe81⤵PID:1604
-
\??\c:\txvpppx.exec:\txvpppx.exe82⤵PID:1380
-
\??\c:\rnhlhp.exec:\rnhlhp.exe83⤵PID:2892
-
\??\c:\pnnpphx.exec:\pnnpphx.exe84⤵PID:2920
-
\??\c:\jhndfh.exec:\jhndfh.exe85⤵PID:2768
-
\??\c:\pptnpn.exec:\pptnpn.exe86⤵PID:288
-
\??\c:\fnnjpl.exec:\fnnjpl.exe87⤵PID:2804
-
\??\c:\dvprphf.exec:\dvprphf.exe88⤵PID:744
-
\??\c:\txbvphb.exec:\txbvphb.exe89⤵PID:2824
-
\??\c:\ppbtxlj.exec:\ppbtxlj.exe90⤵PID:2536
-
\??\c:\rpdddl.exec:\rpdddl.exe91⤵PID:1384
-
\??\c:\pjdpv.exec:\pjdpv.exe92⤵PID:2240
-
\??\c:\rtxbh.exec:\rtxbh.exe93⤵PID:2084
-
\??\c:\vjhdnt.exec:\vjhdnt.exe94⤵PID:2416
-
\??\c:\fjvjpfh.exec:\fjvjpfh.exe95⤵PID:2300
-
\??\c:\drrhfpx.exec:\drrhfpx.exe96⤵PID:3028
-
\??\c:\lrndf.exec:\lrndf.exe97⤵PID:2344
-
\??\c:\tpxtlll.exec:\tpxtlll.exe98⤵PID:1648
-
\??\c:\ppfpjl.exec:\ppfpjl.exe99⤵PID:2640
-
\??\c:\tdddt.exec:\tdddt.exe100⤵PID:2280
-
\??\c:\nrpxbjj.exec:\nrpxbjj.exe101⤵PID:2644
-
\??\c:\pntxfx.exec:\pntxfx.exe102⤵PID:2104
-
\??\c:\bxndjl.exec:\bxndjl.exe103⤵
- System Location Discovery: System Language Discovery
PID:2076 -
\??\c:\xbftn.exec:\xbftn.exe104⤵PID:572
-
\??\c:\thdtxj.exec:\thdtxj.exe105⤵PID:2620
-
\??\c:\hdxhjx.exec:\hdxhjx.exe106⤵PID:1056
-
\??\c:\ddjjjv.exec:\ddjjjv.exe107⤵PID:896
-
\??\c:\fjllh.exec:\fjllh.exe108⤵PID:2256
-
\??\c:\txvljph.exec:\txvljph.exe109⤵PID:1704
-
\??\c:\vtrrrxp.exec:\vtrrrxp.exe110⤵PID:2196
-
\??\c:\vtrnnl.exec:\vtrnnl.exe111⤵PID:1400
-
\??\c:\htftfdv.exec:\htftfdv.exe112⤵
- System Location Discovery: System Language Discovery
PID:2024 -
\??\c:\nvnfj.exec:\nvnfj.exe113⤵PID:304
-
\??\c:\xfdtvrv.exec:\xfdtvrv.exe114⤵PID:1740
-
\??\c:\xlppdvx.exec:\xlppdvx.exe115⤵
- System Location Discovery: System Language Discovery
PID:816 -
\??\c:\rjfdpf.exec:\rjfdpf.exe116⤵PID:2528
-
\??\c:\jbpfvr.exec:\jbpfvr.exe117⤵PID:1872
-
\??\c:\dnltrf.exec:\dnltrf.exe118⤵PID:2264
-
\??\c:\vvddtn.exec:\vvddtn.exe119⤵PID:652
-
\??\c:\vxbpd.exec:\vxbpd.exe120⤵PID:2952
-
\??\c:\tphfdpd.exec:\tphfdpd.exe121⤵PID:2972
-
\??\c:\phjhrxb.exec:\phjhrxb.exe122⤵PID:2072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-