Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 15:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a329da412d79fda5b7f1a67b901f471e399111de884263e0a508ca53e9d1978f.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a329da412d79fda5b7f1a67b901f471e399111de884263e0a508ca53e9d1978f.exe
-
Size
454KB
-
MD5
c0392c0ff101d60b76bfb77cc11a67e5
-
SHA1
e01deb98191bc1816ffc673dd02f4a3f6214e4c6
-
SHA256
a329da412d79fda5b7f1a67b901f471e399111de884263e0a508ca53e9d1978f
-
SHA512
3051f5e8afe40ec5e8ce33ceba06f491dde3df1e27428419545c09086f0667642adbecbd827c6eeb6ee9047ced2b3c048542940de06ffd5700ed3ceb1db950ec
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTl:q7Tc2NYHUrAwfMp3CDJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2864-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-140-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1924-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-362-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2616-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-384-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1924-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-529-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1028-551-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2052-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-565-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2280-572-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1396-579-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2056-587-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2280-595-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2844-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/364-779-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2876 jlxrhjl.exe 2852 jpjjpll.exe 2752 jbpffp.exe 2808 jnjvp.exe 1780 tbdxpfp.exe 2168 ddhpb.exe 2228 bllnv.exe 2344 rnjjttj.exe 2456 xrhbj.exe 2356 ldvfh.exe 2936 rvrdrn.exe 1208 vlhjjb.exe 2972 bvdthd.exe 2140 dfnljr.exe 1632 pndbh.exe 1924 ppdrdbl.exe 2464 rrrvp.exe 2104 bdrxxn.exe 1896 tbxbpt.exe 1964 blnxb.exe 1792 pllljtl.exe 2532 npjjr.exe 1952 lrfdxlp.exe 916 rpxltt.exe 2380 fdhrtl.exe 2084 bltpl.exe 2052 tfvvfhj.exe 812 fjddt.exe 2408 tvphnfl.exe 1876 hnpdpvb.exe 1948 rxxvn.exe 1812 dhtlxt.exe 2860 ntvvx.exe 1552 ddbvbnf.exe 2744 lpjfj.exe 2832 lhjtlfj.exe 2844 xhlrb.exe 2664 hlntjtt.exe 2900 txrnb.exe 2668 pxxrd.exe 2680 pjnvdb.exe 2616 bxbvj.exe 1820 rvbblrd.exe 2732 jlhldph.exe 2496 ddvjrrb.exe 1444 hpnhbdp.exe 1260 pblbjx.exe 2260 dbdtdbn.exe 2448 ttnjrrn.exe 1736 jhrxrxl.exe 2376 hhbrt.exe 1984 hnxxj.exe 2372 dxdrrb.exe 1560 dptnx.exe 1924 nvdhvff.exe 2588 ntfth.exe 368 hfjpndr.exe 2452 txhjpb.exe 2120 tvtlj.exe 1468 dfjpthh.exe 1592 pdbrhfd.exe 2536 htbbl.exe 2152 dxpjrp.exe 1028 fbjnll.exe -
resource yara_rule behavioral1/memory/2864-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/368-473-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1468-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-529-0x00000000002C0000-0x00000000002EA000-memory.dmp upx behavioral1/memory/908-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-551-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2052-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/364-779-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-794-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnrtftx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrflnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtxlpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtdprfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvfbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxtphhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvxjbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxjjdfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrhfphp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dblfbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhhvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxxtbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drfttbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjnbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xltjhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvhhlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpfnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvtltv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbdxldb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntdlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbjnjbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrdtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prfnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhhpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtjlfnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flpbdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrvdvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxpjrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpftfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbdhtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lphdxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvdhvff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnvtlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxnnlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvvvjlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfdlrl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2864 wrote to memory of 2876 2864 a329da412d79fda5b7f1a67b901f471e399111de884263e0a508ca53e9d1978f.exe 30 PID 2864 wrote to memory of 2876 2864 a329da412d79fda5b7f1a67b901f471e399111de884263e0a508ca53e9d1978f.exe 30 PID 2864 wrote to memory of 2876 2864 a329da412d79fda5b7f1a67b901f471e399111de884263e0a508ca53e9d1978f.exe 30 PID 2864 wrote to memory of 2876 2864 a329da412d79fda5b7f1a67b901f471e399111de884263e0a508ca53e9d1978f.exe 30 PID 2876 wrote to memory of 2852 2876 jlxrhjl.exe 31 PID 2876 wrote to memory of 2852 2876 jlxrhjl.exe 31 PID 2876 wrote to memory of 2852 2876 jlxrhjl.exe 31 PID 2876 wrote to memory of 2852 2876 jlxrhjl.exe 31 PID 2852 wrote to memory of 2752 2852 jpjjpll.exe 32 PID 2852 wrote to memory of 2752 2852 jpjjpll.exe 32 PID 2852 wrote to memory of 2752 2852 jpjjpll.exe 32 PID 2852 wrote to memory of 2752 2852 jpjjpll.exe 32 PID 2752 wrote to memory of 2808 2752 jbpffp.exe 33 PID 2752 wrote to memory of 2808 2752 jbpffp.exe 33 PID 2752 wrote to memory of 2808 2752 jbpffp.exe 33 PID 2752 wrote to memory of 2808 2752 jbpffp.exe 33 PID 2808 wrote to memory of 1780 2808 jnjvp.exe 34 PID 2808 wrote to memory of 1780 2808 jnjvp.exe 34 PID 2808 wrote to memory of 1780 2808 jnjvp.exe 34 PID 2808 wrote to memory of 1780 2808 jnjvp.exe 34 PID 1780 wrote to memory of 2168 1780 tbdxpfp.exe 35 PID 1780 wrote to memory of 2168 1780 tbdxpfp.exe 35 PID 1780 wrote to memory of 2168 1780 tbdxpfp.exe 35 PID 1780 wrote to memory of 2168 1780 tbdxpfp.exe 35 PID 2168 wrote to memory of 2228 2168 ddhpb.exe 36 PID 2168 wrote to memory of 2228 2168 ddhpb.exe 36 PID 2168 wrote to memory of 2228 2168 ddhpb.exe 36 PID 2168 wrote to memory of 2228 2168 ddhpb.exe 36 PID 2228 wrote to memory of 2344 2228 bllnv.exe 37 PID 2228 wrote to memory of 2344 2228 bllnv.exe 37 PID 2228 wrote to memory of 2344 2228 bllnv.exe 37 PID 2228 wrote to memory of 2344 2228 bllnv.exe 37 PID 2344 wrote to memory of 2456 2344 rnjjttj.exe 38 PID 2344 wrote to memory of 2456 2344 rnjjttj.exe 38 PID 2344 wrote to memory of 2456 2344 rnjjttj.exe 38 PID 2344 wrote to memory of 2456 2344 rnjjttj.exe 38 PID 2456 wrote to memory of 2356 2456 xrhbj.exe 39 PID 2456 wrote to memory of 2356 2456 xrhbj.exe 39 PID 2456 wrote to memory of 2356 2456 xrhbj.exe 39 PID 2456 wrote to memory of 2356 2456 xrhbj.exe 39 PID 2356 wrote to memory of 2936 2356 ldvfh.exe 40 PID 2356 wrote to memory of 2936 2356 ldvfh.exe 40 PID 2356 wrote to memory of 2936 2356 ldvfh.exe 40 PID 2356 wrote to memory of 2936 2356 ldvfh.exe 40 PID 2936 wrote to memory of 1208 2936 rvrdrn.exe 41 PID 2936 wrote to memory of 1208 2936 rvrdrn.exe 41 PID 2936 wrote to memory of 1208 2936 rvrdrn.exe 41 PID 2936 wrote to memory of 1208 2936 rvrdrn.exe 41 PID 1208 wrote to memory of 2972 1208 vlhjjb.exe 42 PID 1208 wrote to memory of 2972 1208 vlhjjb.exe 42 PID 1208 wrote to memory of 2972 1208 vlhjjb.exe 42 PID 1208 wrote to memory of 2972 1208 vlhjjb.exe 42 PID 2972 wrote to memory of 2140 2972 bvdthd.exe 43 PID 2972 wrote to memory of 2140 2972 bvdthd.exe 43 PID 2972 wrote to memory of 2140 2972 bvdthd.exe 43 PID 2972 wrote to memory of 2140 2972 bvdthd.exe 43 PID 2140 wrote to memory of 1632 2140 dfnljr.exe 44 PID 2140 wrote to memory of 1632 2140 dfnljr.exe 44 PID 2140 wrote to memory of 1632 2140 dfnljr.exe 44 PID 2140 wrote to memory of 1632 2140 dfnljr.exe 44 PID 1632 wrote to memory of 1924 1632 pndbh.exe 45 PID 1632 wrote to memory of 1924 1632 pndbh.exe 45 PID 1632 wrote to memory of 1924 1632 pndbh.exe 45 PID 1632 wrote to memory of 1924 1632 pndbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a329da412d79fda5b7f1a67b901f471e399111de884263e0a508ca53e9d1978f.exe"C:\Users\Admin\AppData\Local\Temp\a329da412d79fda5b7f1a67b901f471e399111de884263e0a508ca53e9d1978f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\jlxrhjl.exec:\jlxrhjl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\jpjjpll.exec:\jpjjpll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\jbpffp.exec:\jbpffp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\jnjvp.exec:\jnjvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\tbdxpfp.exec:\tbdxpfp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\ddhpb.exec:\ddhpb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\bllnv.exec:\bllnv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\rnjjttj.exec:\rnjjttj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\xrhbj.exec:\xrhbj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\ldvfh.exec:\ldvfh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\rvrdrn.exec:\rvrdrn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\vlhjjb.exec:\vlhjjb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\bvdthd.exec:\bvdthd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\dfnljr.exec:\dfnljr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\pndbh.exec:\pndbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\ppdrdbl.exec:\ppdrdbl.exe17⤵
- Executes dropped EXE
PID:1924 -
\??\c:\rrrvp.exec:\rrrvp.exe18⤵
- Executes dropped EXE
PID:2464 -
\??\c:\bdrxxn.exec:\bdrxxn.exe19⤵
- Executes dropped EXE
PID:2104 -
\??\c:\tbxbpt.exec:\tbxbpt.exe20⤵
- Executes dropped EXE
PID:1896 -
\??\c:\blnxb.exec:\blnxb.exe21⤵
- Executes dropped EXE
PID:1964 -
\??\c:\pllljtl.exec:\pllljtl.exe22⤵
- Executes dropped EXE
PID:1792 -
\??\c:\npjjr.exec:\npjjr.exe23⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lrfdxlp.exec:\lrfdxlp.exe24⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rpxltt.exec:\rpxltt.exe25⤵
- Executes dropped EXE
PID:916 -
\??\c:\fdhrtl.exec:\fdhrtl.exe26⤵
- Executes dropped EXE
PID:2380 -
\??\c:\bltpl.exec:\bltpl.exe27⤵
- Executes dropped EXE
PID:2084 -
\??\c:\tfvvfhj.exec:\tfvvfhj.exe28⤵
- Executes dropped EXE
PID:2052 -
\??\c:\fjddt.exec:\fjddt.exe29⤵
- Executes dropped EXE
PID:812 -
\??\c:\tvphnfl.exec:\tvphnfl.exe30⤵
- Executes dropped EXE
PID:2408 -
\??\c:\hnpdpvb.exec:\hnpdpvb.exe31⤵
- Executes dropped EXE
PID:1876 -
\??\c:\rxxvn.exec:\rxxvn.exe32⤵
- Executes dropped EXE
PID:1948 -
\??\c:\dhtlxt.exec:\dhtlxt.exe33⤵
- Executes dropped EXE
PID:1812 -
\??\c:\ntvvx.exec:\ntvvx.exe34⤵
- Executes dropped EXE
PID:2860 -
\??\c:\ddbvbnf.exec:\ddbvbnf.exe35⤵
- Executes dropped EXE
PID:1552 -
\??\c:\lpjfj.exec:\lpjfj.exe36⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lhjtlfj.exec:\lhjtlfj.exe37⤵
- Executes dropped EXE
PID:2832 -
\??\c:\xhlrb.exec:\xhlrb.exe38⤵
- Executes dropped EXE
PID:2844 -
\??\c:\hlntjtt.exec:\hlntjtt.exe39⤵
- Executes dropped EXE
PID:2664 -
\??\c:\txrnb.exec:\txrnb.exe40⤵
- Executes dropped EXE
PID:2900 -
\??\c:\pxxrd.exec:\pxxrd.exe41⤵
- Executes dropped EXE
PID:2668 -
\??\c:\pjnvdb.exec:\pjnvdb.exe42⤵
- Executes dropped EXE
PID:2680 -
\??\c:\bxbvj.exec:\bxbvj.exe43⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rvbblrd.exec:\rvbblrd.exe44⤵
- Executes dropped EXE
PID:1820 -
\??\c:\jlhldph.exec:\jlhldph.exe45⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ddvjrrb.exec:\ddvjrrb.exe46⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hpnhbdp.exec:\hpnhbdp.exe47⤵
- Executes dropped EXE
PID:1444 -
\??\c:\pblbjx.exec:\pblbjx.exe48⤵
- Executes dropped EXE
PID:1260 -
\??\c:\dbdtdbn.exec:\dbdtdbn.exe49⤵
- Executes dropped EXE
PID:2260 -
\??\c:\ttnjrrn.exec:\ttnjrrn.exe50⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jhrxrxl.exec:\jhrxrxl.exe51⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hhbrt.exec:\hhbrt.exe52⤵
- Executes dropped EXE
PID:2376 -
\??\c:\hnxxj.exec:\hnxxj.exe53⤵
- Executes dropped EXE
PID:1984 -
\??\c:\dxdrrb.exec:\dxdrrb.exe54⤵
- Executes dropped EXE
PID:2372 -
\??\c:\dptnx.exec:\dptnx.exe55⤵
- Executes dropped EXE
PID:1560 -
\??\c:\nvdhvff.exec:\nvdhvff.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1924 -
\??\c:\ntfth.exec:\ntfth.exe57⤵
- Executes dropped EXE
PID:2588 -
\??\c:\hfjpndr.exec:\hfjpndr.exe58⤵
- Executes dropped EXE
PID:368 -
\??\c:\txhjpb.exec:\txhjpb.exe59⤵
- Executes dropped EXE
PID:2452 -
\??\c:\tvtlj.exec:\tvtlj.exe60⤵
- Executes dropped EXE
PID:2120 -
\??\c:\dfjpthh.exec:\dfjpthh.exe61⤵
- Executes dropped EXE
PID:1468 -
\??\c:\pdbrhfd.exec:\pdbrhfd.exe62⤵
- Executes dropped EXE
PID:1592 -
\??\c:\htbbl.exec:\htbbl.exe63⤵
- Executes dropped EXE
PID:2536 -
\??\c:\dxpjrp.exec:\dxpjrp.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2152 -
\??\c:\fbjnll.exec:\fbjnll.exe65⤵
- Executes dropped EXE
PID:1028 -
\??\c:\pbhdjb.exec:\pbhdjb.exe66⤵PID:1540
-
\??\c:\tbvpjv.exec:\tbvpjv.exe67⤵PID:908
-
\??\c:\jjjvbd.exec:\jjjvbd.exe68⤵PID:2612
-
\??\c:\dnntltb.exec:\dnntltb.exe69⤵PID:2100
-
\??\c:\lvvlln.exec:\lvvlln.exe70⤵PID:2052
-
\??\c:\lrpprxr.exec:\lrpprxr.exe71⤵PID:2056
-
\??\c:\bfbjnv.exec:\bfbjnv.exe72⤵PID:2280
-
\??\c:\vjfbld.exec:\vjfbld.exe73⤵PID:1396
-
\??\c:\tvptfb.exec:\tvptfb.exe74⤵PID:1932
-
\??\c:\rbtxf.exec:\rbtxf.exe75⤵PID:1812
-
\??\c:\txjnb.exec:\txjnb.exe76⤵PID:2428
-
\??\c:\fvvlj.exec:\fvvlj.exe77⤵PID:2888
-
\??\c:\nhvlhp.exec:\nhvlhp.exe78⤵PID:2788
-
\??\c:\ppvrrrl.exec:\ppvrrrl.exe79⤵PID:2068
-
\??\c:\xtjpl.exec:\xtjpl.exe80⤵PID:2952
-
\??\c:\dflxltt.exec:\dflxltt.exe81⤵PID:2844
-
\??\c:\dllvl.exec:\dllvl.exe82⤵PID:2648
-
\??\c:\rvxnvlr.exec:\rvxnvlr.exe83⤵PID:2900
-
\??\c:\dptjpx.exec:\dptjpx.exe84⤵PID:2012
-
\??\c:\vftbb.exec:\vftbb.exe85⤵PID:2620
-
\??\c:\xbltrt.exec:\xbltrt.exe86⤵PID:1068
-
\??\c:\rnjbxd.exec:\rnjbxd.exe87⤵PID:1624
-
\??\c:\htfvfdp.exec:\htfvfdp.exe88⤵PID:1060
-
\??\c:\bbhnv.exec:\bbhnv.exe89⤵PID:2456
-
\??\c:\vfftbp.exec:\vfftbp.exe90⤵PID:2988
-
\??\c:\prbxn.exec:\prbxn.exe91⤵PID:2904
-
\??\c:\xjbbbpr.exec:\xjbbbpr.exe92⤵PID:1440
-
\??\c:\hntprjv.exec:\hntprjv.exe93⤵PID:1208
-
\??\c:\frrrblj.exec:\frrrblj.exe94⤵PID:1140
-
\??\c:\jxnfdxb.exec:\jxnfdxb.exe95⤵PID:2960
-
\??\c:\ntnrpft.exec:\ntnrpft.exe96⤵PID:1148
-
\??\c:\jhflvvv.exec:\jhflvvv.exe97⤵PID:2984
-
\??\c:\xpvpd.exec:\xpvpd.exe98⤵PID:1748
-
\??\c:\prdptpl.exec:\prdptpl.exe99⤵PID:832
-
\??\c:\lbjxl.exec:\lbjxl.exe100⤵PID:2388
-
\??\c:\vrtddr.exec:\vrtddr.exe101⤵PID:2136
-
\??\c:\vdtpv.exec:\vdtpv.exe102⤵PID:3068
-
\??\c:\dtnjn.exec:\dtnjn.exe103⤵PID:3012
-
\??\c:\vbddrb.exec:\vbddrb.exe104⤵PID:1160
-
\??\c:\tbdfh.exec:\tbdfh.exe105⤵PID:364
-
\??\c:\dlbjlvx.exec:\dlbjlvx.exe106⤵PID:2232
-
\??\c:\jhhfdp.exec:\jhhfdp.exe107⤵PID:900
-
\??\c:\bbthhvt.exec:\bbthhvt.exe108⤵PID:1800
-
\??\c:\nnhtlhl.exec:\nnhtlhl.exe109⤵PID:1568
-
\??\c:\blbpdv.exec:\blbpdv.exe110⤵PID:1540
-
\??\c:\dvhbtv.exec:\dvhbtv.exe111⤵PID:1020
-
\??\c:\dnbhrj.exec:\dnbhrj.exe112⤵PID:1760
-
\??\c:\fpftfd.exec:\fpftfd.exe113⤵
- System Location Discovery: System Language Discovery
PID:2272 -
\??\c:\nvtnnh.exec:\nvtnnh.exe114⤵
- System Location Discovery: System Language Discovery
PID:2052 -
\??\c:\xntlxvx.exec:\xntlxvx.exe115⤵PID:2564
-
\??\c:\dnhfb.exec:\dnhfb.exe116⤵PID:2324
-
\??\c:\jptbxd.exec:\jptbxd.exe117⤵PID:1720
-
\??\c:\lhhlxx.exec:\lhhlxx.exe118⤵PID:2328
-
\??\c:\dfxppl.exec:\dfxppl.exe119⤵PID:1576
-
\??\c:\rvprjp.exec:\rvprjp.exe120⤵PID:1884
-
\??\c:\hvhrd.exec:\hvhrd.exe121⤵PID:2740
-
\??\c:\ffhlj.exec:\ffhlj.exe122⤵PID:2744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-