Analysis
-
max time kernel
151s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 16:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe
-
Size
453KB
-
MD5
4a7c807614c9973ab3156b4538a13d2a
-
SHA1
d4b88b9d2a3146583e1c60642f3a09e82359cdd0
-
SHA256
baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f
-
SHA512
37fd621f2af3f4c6e6ac02cd413270e749dc0dd2925e04f1d3808515ebccc9ebd3fa0055611359e5d05e51147b4a06024e48dc6e9f34d813a03716f66561ffd9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2328-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-47-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2760-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-92-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2248-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-190-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2176-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/288-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/744-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-469-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2280-484-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2280-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-497-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2112-517-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1004-532-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2196-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1008-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-861-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-919-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-926-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-931-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2916 nnndv.exe 2836 nxdbt.exe 2972 lnxtbf.exe 2116 hbfthtt.exe 2760 fnvjpl.exe 2720 fnvfhb.exe 2848 fhfdhj.exe 2224 ddnnr.exe 1668 nfbnd.exe 2248 flfdtbj.exe 2660 nlvbxdp.exe 3052 njfjt.exe 2552 lnjnh.exe 2816 vbxdfh.exe 1036 lvrrb.exe 2212 dnplxjr.exe 844 ttrhnxp.exe 2044 vjrbfdb.exe 2352 rvbbvhl.exe 2208 rdxtl.exe 2176 jnpfp.exe 2480 xvxdflp.exe 1056 hpllfl.exe 1792 fvpdl.exe 1304 pbltth.exe 1508 jpxdjj.exe 1732 ffttjnn.exe 1016 jbjrptb.exe 1992 vbxvdr.exe 804 dbfffd.exe 2060 xxtdrt.exe 944 vhjfvpr.exe 2616 ttdxf.exe 1820 rrtxjn.exe 2140 vplvn.exe 1860 rdljft.exe 2960 tnnljf.exe 2876 rfpjd.exe 2940 jjttvlf.exe 2928 rxdnldh.exe 1084 xtfrphr.exe 2768 xjlxn.exe 2736 fjrxpd.exe 2896 drxdd.exe 288 djfnp.exe 2388 njbnl.exe 744 rbfjnh.exe 1748 jjjdtbj.exe 2356 bfdflbf.exe 2132 ptlfdph.exe 2612 bxhbj.exe 1340 fbrdll.exe 3016 rjnpp.exe 2500 xjdxt.exe 3064 xtphb.exe 2212 tvtft.exe 2040 bljrxnx.exe 2144 hhthx.exe 2676 dfxdb.exe 2280 bbhpjjh.exe 2076 btjnv.exe 2112 drhvbhr.exe 1328 hlxrnx.exe 1004 jjnblpv.exe -
resource yara_rule behavioral1/memory/2328-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/744-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-777-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-824-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-861-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-919-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-916-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2928-926-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njfjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbxrpjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhldf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhhxnhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrnxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njthj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhbntdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbbft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhdhnvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tplxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btxlltt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrjhrpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jntnhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trfjtlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhxxdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfjprd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxtnppb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhvbxnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlhrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njtll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxtjld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlthdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjxddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbdjhrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrprt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjnpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfjrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfnvxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxvbjln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrpthf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjtbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2916 2328 baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe 29 PID 2328 wrote to memory of 2916 2328 baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe 29 PID 2328 wrote to memory of 2916 2328 baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe 29 PID 2328 wrote to memory of 2916 2328 baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe 29 PID 2916 wrote to memory of 2836 2916 nnndv.exe 30 PID 2916 wrote to memory of 2836 2916 nnndv.exe 30 PID 2916 wrote to memory of 2836 2916 nnndv.exe 30 PID 2916 wrote to memory of 2836 2916 nnndv.exe 30 PID 2836 wrote to memory of 2972 2836 nxdbt.exe 31 PID 2836 wrote to memory of 2972 2836 nxdbt.exe 31 PID 2836 wrote to memory of 2972 2836 nxdbt.exe 31 PID 2836 wrote to memory of 2972 2836 nxdbt.exe 31 PID 2972 wrote to memory of 2116 2972 lnxtbf.exe 32 PID 2972 wrote to memory of 2116 2972 lnxtbf.exe 32 PID 2972 wrote to memory of 2116 2972 lnxtbf.exe 32 PID 2972 wrote to memory of 2116 2972 lnxtbf.exe 32 PID 2116 wrote to memory of 2760 2116 hbfthtt.exe 33 PID 2116 wrote to memory of 2760 2116 hbfthtt.exe 33 PID 2116 wrote to memory of 2760 2116 hbfthtt.exe 33 PID 2116 wrote to memory of 2760 2116 hbfthtt.exe 33 PID 2760 wrote to memory of 2720 2760 fnvjpl.exe 34 PID 2760 wrote to memory of 2720 2760 fnvjpl.exe 34 PID 2760 wrote to memory of 2720 2760 fnvjpl.exe 34 PID 2760 wrote to memory of 2720 2760 fnvjpl.exe 34 PID 2720 wrote to memory of 2848 2720 fnvfhb.exe 35 PID 2720 wrote to memory of 2848 2720 fnvfhb.exe 35 PID 2720 wrote to memory of 2848 2720 fnvfhb.exe 35 PID 2720 wrote to memory of 2848 2720 fnvfhb.exe 35 PID 2848 wrote to memory of 2224 2848 fhfdhj.exe 36 PID 2848 wrote to memory of 2224 2848 fhfdhj.exe 36 PID 2848 wrote to memory of 2224 2848 fhfdhj.exe 36 PID 2848 wrote to memory of 2224 2848 fhfdhj.exe 36 PID 2224 wrote to memory of 1668 2224 ddnnr.exe 37 PID 2224 wrote to memory of 1668 2224 ddnnr.exe 37 PID 2224 wrote to memory of 1668 2224 ddnnr.exe 37 PID 2224 wrote to memory of 1668 2224 ddnnr.exe 37 PID 1668 wrote to memory of 2248 1668 nfbnd.exe 38 PID 1668 wrote to memory of 2248 1668 nfbnd.exe 38 PID 1668 wrote to memory of 2248 1668 nfbnd.exe 38 PID 1668 wrote to memory of 2248 1668 nfbnd.exe 38 PID 2248 wrote to memory of 2660 2248 flfdtbj.exe 39 PID 2248 wrote to memory of 2660 2248 flfdtbj.exe 39 PID 2248 wrote to memory of 2660 2248 flfdtbj.exe 39 PID 2248 wrote to memory of 2660 2248 flfdtbj.exe 39 PID 2660 wrote to memory of 3052 2660 nlvbxdp.exe 40 PID 2660 wrote to memory of 3052 2660 nlvbxdp.exe 40 PID 2660 wrote to memory of 3052 2660 nlvbxdp.exe 40 PID 2660 wrote to memory of 3052 2660 nlvbxdp.exe 40 PID 3052 wrote to memory of 2552 3052 njfjt.exe 41 PID 3052 wrote to memory of 2552 3052 njfjt.exe 41 PID 3052 wrote to memory of 2552 3052 njfjt.exe 41 PID 3052 wrote to memory of 2552 3052 njfjt.exe 41 PID 2552 wrote to memory of 2816 2552 lnjnh.exe 42 PID 2552 wrote to memory of 2816 2552 lnjnh.exe 42 PID 2552 wrote to memory of 2816 2552 lnjnh.exe 42 PID 2552 wrote to memory of 2816 2552 lnjnh.exe 42 PID 2816 wrote to memory of 1036 2816 vbxdfh.exe 43 PID 2816 wrote to memory of 1036 2816 vbxdfh.exe 43 PID 2816 wrote to memory of 1036 2816 vbxdfh.exe 43 PID 2816 wrote to memory of 1036 2816 vbxdfh.exe 43 PID 1036 wrote to memory of 2212 1036 lvrrb.exe 44 PID 1036 wrote to memory of 2212 1036 lvrrb.exe 44 PID 1036 wrote to memory of 2212 1036 lvrrb.exe 44 PID 1036 wrote to memory of 2212 1036 lvrrb.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe"C:\Users\Admin\AppData\Local\Temp\baa3df1efad2f7144d96533fbf6981db04264fb53ff97a26f878171a3956a89f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\nnndv.exec:\nnndv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\nxdbt.exec:\nxdbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\lnxtbf.exec:\lnxtbf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\hbfthtt.exec:\hbfthtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\fnvjpl.exec:\fnvjpl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\fnvfhb.exec:\fnvfhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\fhfdhj.exec:\fhfdhj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\ddnnr.exec:\ddnnr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\nfbnd.exec:\nfbnd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\flfdtbj.exec:\flfdtbj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\nlvbxdp.exec:\nlvbxdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\njfjt.exec:\njfjt.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\lnjnh.exec:\lnjnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\vbxdfh.exec:\vbxdfh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\lvrrb.exec:\lvrrb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\dnplxjr.exec:\dnplxjr.exe17⤵
- Executes dropped EXE
PID:2212 -
\??\c:\ttrhnxp.exec:\ttrhnxp.exe18⤵
- Executes dropped EXE
PID:844 -
\??\c:\vjrbfdb.exec:\vjrbfdb.exe19⤵
- Executes dropped EXE
PID:2044 -
\??\c:\rvbbvhl.exec:\rvbbvhl.exe20⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rdxtl.exec:\rdxtl.exe21⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jnpfp.exec:\jnpfp.exe22⤵
- Executes dropped EXE
PID:2176 -
\??\c:\xvxdflp.exec:\xvxdflp.exe23⤵
- Executes dropped EXE
PID:2480 -
\??\c:\hpllfl.exec:\hpllfl.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1056 -
\??\c:\fvpdl.exec:\fvpdl.exe25⤵
- Executes dropped EXE
PID:1792 -
\??\c:\pbltth.exec:\pbltth.exe26⤵
- Executes dropped EXE
PID:1304 -
\??\c:\jpxdjj.exec:\jpxdjj.exe27⤵
- Executes dropped EXE
PID:1508 -
\??\c:\ffttjnn.exec:\ffttjnn.exe28⤵
- Executes dropped EXE
PID:1732 -
\??\c:\jbjrptb.exec:\jbjrptb.exe29⤵
- Executes dropped EXE
PID:1016 -
\??\c:\vbxvdr.exec:\vbxvdr.exe30⤵
- Executes dropped EXE
PID:1992 -
\??\c:\dbfffd.exec:\dbfffd.exe31⤵
- Executes dropped EXE
PID:804 -
\??\c:\xxtdrt.exec:\xxtdrt.exe32⤵
- Executes dropped EXE
PID:2060 -
\??\c:\vhjfvpr.exec:\vhjfvpr.exe33⤵
- Executes dropped EXE
PID:944 -
\??\c:\ttdxf.exec:\ttdxf.exe34⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rrtxjn.exec:\rrtxjn.exe35⤵
- Executes dropped EXE
PID:1820 -
\??\c:\vplvn.exec:\vplvn.exe36⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rdljft.exec:\rdljft.exe37⤵
- Executes dropped EXE
PID:1860 -
\??\c:\tnnljf.exec:\tnnljf.exe38⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rfpjd.exec:\rfpjd.exe39⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jjttvlf.exec:\jjttvlf.exe40⤵
- Executes dropped EXE
PID:2940 -
\??\c:\rxdnldh.exec:\rxdnldh.exe41⤵
- Executes dropped EXE
PID:2928 -
\??\c:\xtfrphr.exec:\xtfrphr.exe42⤵
- Executes dropped EXE
PID:1084 -
\??\c:\xjlxn.exec:\xjlxn.exe43⤵
- Executes dropped EXE
PID:2768 -
\??\c:\fjrxpd.exec:\fjrxpd.exe44⤵
- Executes dropped EXE
PID:2736 -
\??\c:\drxdd.exec:\drxdd.exe45⤵
- Executes dropped EXE
PID:2896 -
\??\c:\djfnp.exec:\djfnp.exe46⤵
- Executes dropped EXE
PID:288 -
\??\c:\njbnl.exec:\njbnl.exe47⤵
- Executes dropped EXE
PID:2388 -
\??\c:\rbfjnh.exec:\rbfjnh.exe48⤵
- Executes dropped EXE
PID:744 -
\??\c:\jjjdtbj.exec:\jjjdtbj.exe49⤵
- Executes dropped EXE
PID:1748 -
\??\c:\bfdflbf.exec:\bfdflbf.exe50⤵
- Executes dropped EXE
PID:2356 -
\??\c:\ptlfdph.exec:\ptlfdph.exe51⤵
- Executes dropped EXE
PID:2132 -
\??\c:\bxhbj.exec:\bxhbj.exe52⤵
- Executes dropped EXE
PID:2612 -
\??\c:\fbrdll.exec:\fbrdll.exe53⤵
- Executes dropped EXE
PID:1340 -
\??\c:\rjnpp.exec:\rjnpp.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3016 -
\??\c:\xjdxt.exec:\xjdxt.exe55⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xtphb.exec:\xtphb.exe56⤵
- Executes dropped EXE
PID:3064 -
\??\c:\tvtft.exec:\tvtft.exe57⤵
- Executes dropped EXE
PID:2212 -
\??\c:\bljrxnx.exec:\bljrxnx.exe58⤵
- Executes dropped EXE
PID:2040 -
\??\c:\hhthx.exec:\hhthx.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2144 -
\??\c:\dfxdb.exec:\dfxdb.exe60⤵
- Executes dropped EXE
PID:2676 -
\??\c:\bbhpjjh.exec:\bbhpjjh.exe61⤵
- Executes dropped EXE
PID:2280 -
\??\c:\btjnv.exec:\btjnv.exe62⤵
- Executes dropped EXE
PID:2076 -
\??\c:\drhvbhr.exec:\drhvbhr.exe63⤵
- Executes dropped EXE
PID:2112 -
\??\c:\hlxrnx.exec:\hlxrnx.exe64⤵
- Executes dropped EXE
PID:1328 -
\??\c:\jjnblpv.exec:\jjnblpv.exe65⤵
- Executes dropped EXE
PID:1004 -
\??\c:\jvhhfb.exec:\jvhhfb.exe66⤵PID:1056
-
\??\c:\nbrrnlj.exec:\nbrrnlj.exe67⤵PID:1052
-
\??\c:\nbpjvh.exec:\nbpjvh.exe68⤵PID:1360
-
\??\c:\hjbnlj.exec:\hjbnlj.exe69⤵PID:756
-
\??\c:\fttpnf.exec:\fttpnf.exe70⤵PID:2196
-
\??\c:\tddnhjd.exec:\tddnhjd.exe71⤵PID:1772
-
\??\c:\rlvnh.exec:\rlvnh.exe72⤵PID:1008
-
\??\c:\vfdvxl.exec:\vfdvxl.exe73⤵PID:320
-
\??\c:\nvxvd.exec:\nvxvd.exe74⤵PID:2564
-
\??\c:\hhtjbt.exec:\hhtjbt.exe75⤵PID:672
-
\??\c:\tbdbtxf.exec:\tbdbtxf.exe76⤵PID:2340
-
\??\c:\rhvdfx.exec:\rhvdfx.exe77⤵PID:944
-
\??\c:\fnfbx.exec:\fnfbx.exe78⤵PID:652
-
\??\c:\tnxvt.exec:\tnxvt.exe79⤵PID:792
-
\??\c:\lvlpx.exec:\lvlpx.exe80⤵PID:2216
-
\??\c:\rfjrrx.exec:\rfjrrx.exe81⤵
- System Location Discovery: System Language Discovery
PID:700 -
\??\c:\jtbbn.exec:\jtbbn.exe82⤵PID:2072
-
\??\c:\trjdfdn.exec:\trjdfdn.exe83⤵PID:2884
-
\??\c:\vxflh.exec:\vxflh.exe84⤵PID:2860
-
\??\c:\xxftpfd.exec:\xxftpfd.exe85⤵PID:2440
-
\??\c:\tdthldp.exec:\tdthldp.exe86⤵PID:2840
-
\??\c:\rtbfdd.exec:\rtbfdd.exe87⤵PID:2792
-
\??\c:\ddrfl.exec:\ddrfl.exe88⤵PID:2460
-
\??\c:\jblhxv.exec:\jblhxv.exe89⤵PID:2720
-
\??\c:\nvhdbtp.exec:\nvhdbtp.exe90⤵PID:2896
-
\??\c:\dnbbtb.exec:\dnbbtb.exe91⤵PID:540
-
\??\c:\lddvlb.exec:\lddvlb.exe92⤵PID:2388
-
\??\c:\dtpvf.exec:\dtpvf.exe93⤵PID:884
-
\??\c:\tnjhlf.exec:\tnjhlf.exe94⤵PID:1748
-
\??\c:\hdvbjdn.exec:\hdvbjdn.exe95⤵PID:2356
-
\??\c:\ndnrvdl.exec:\ndnrvdl.exe96⤵PID:2192
-
\??\c:\rlrdp.exec:\rlrdp.exe97⤵PID:3040
-
\??\c:\njthj.exec:\njthj.exe98⤵
- System Location Discovery: System Language Discovery
PID:2816 -
\??\c:\nbxvxd.exec:\nbxvxd.exe99⤵PID:2392
-
\??\c:\ppfjp.exec:\ppfjp.exe100⤵PID:3032
-
\??\c:\hhdhnvb.exec:\hhdhnvb.exe101⤵
- System Location Discovery: System Language Discovery
PID:1848 -
\??\c:\htlrhp.exec:\htlrhp.exe102⤵PID:2204
-
\??\c:\bnrhdvb.exec:\bnrhdvb.exe103⤵PID:2044
-
\??\c:\xdvjtjj.exec:\xdvjtjj.exe104⤵PID:2064
-
\??\c:\dlvph.exec:\dlvph.exe105⤵PID:2364
-
\??\c:\rldhpd.exec:\rldhpd.exe106⤵PID:2524
-
\??\c:\lrdrvh.exec:\lrdrvh.exe107⤵PID:1148
-
\??\c:\nrtlld.exec:\nrtlld.exe108⤵PID:2520
-
\??\c:\drjvfp.exec:\drjvfp.exe109⤵PID:2636
-
\??\c:\dvbjj.exec:\dvbjj.exe110⤵PID:2988
-
\??\c:\rdntb.exec:\rdntb.exe111⤵PID:2252
-
\??\c:\ldnrft.exec:\ldnrft.exe112⤵PID:1052
-
\??\c:\trrtlnn.exec:\trrtlnn.exe113⤵PID:1752
-
\??\c:\bbvhn.exec:\bbvhn.exe114⤵PID:756
-
\??\c:\jndhnxb.exec:\jndhnxb.exe115⤵PID:1704
-
\??\c:\fhrlv.exec:\fhrlv.exe116⤵PID:1092
-
\??\c:\bdhpbpx.exec:\bdhpbpx.exe117⤵PID:1016
-
\??\c:\lrxvlbj.exec:\lrxvlbj.exe118⤵PID:1740
-
\??\c:\jdpfjj.exec:\jdpfjj.exe119⤵PID:2532
-
\??\c:\lpdbltv.exec:\lpdbltv.exe120⤵PID:2060
-
\??\c:\rvvhr.exec:\rvvhr.exe121⤵PID:2264
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-