Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 16:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e978886241331efeea5fd92fcb47848d193bfe06fea507cde1487714092ff757N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e978886241331efeea5fd92fcb47848d193bfe06fea507cde1487714092ff757N.exe
-
Size
454KB
-
MD5
8eb9f195a8662417fe6edcfcaa8ea250
-
SHA1
5fdebc333cfa9cc63444f4eae7c7b9063f79e094
-
SHA256
e978886241331efeea5fd92fcb47848d193bfe06fea507cde1487714092ff757
-
SHA512
f66c8ab79b2fb4599222d2733815b97aad7a5edfb0aefd5ce8c67ce3ce8c5204df4662611510b92acfd15e201cc9b5357441d12437dba820121c6702342c3fd6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbez:q7Tc2NYHUrAwfMp3CDz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2268-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1116-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/648-246-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/676-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-329-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2876-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-356-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1192-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-363-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2124-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-437-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2232-462-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/3064-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-622-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2624-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-706-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-709-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/952-796-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-809-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1060-840-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1116 jjjlxhd.exe 1708 tnfflfv.exe 2448 jhdptb.exe 2940 ntphl.exe 1192 npfxptv.exe 3012 tplph.exe 2784 vnfpfbj.exe 2616 jlxxj.exe 2124 lhjljbh.exe 2088 xxbttnd.exe 1648 lhnjlb.exe 3000 dhxptf.exe 2916 hlrxrfh.exe 1980 tfjnr.exe 2820 fbhrlrb.exe 1884 dbvvtvt.exe 1888 dddpvhp.exe 2076 tbfrjt.exe 2248 rlllb.exe 2288 fbvtx.exe 1348 hlhll.exe 3052 nxbtr.exe 688 rdhhnl.exe 1184 vprdj.exe 1716 jvbplnb.exe 648 ftdtvb.exe 676 xrjld.exe 1212 vflbd.exe 2704 nvdjlh.exe 2216 hvdnfr.exe 856 xptfp.exe 1672 bxlpn.exe 2268 xjnnp.exe 2336 xlpjt.exe 2188 prfrfn.exe 2208 xphtvbx.exe 2728 jrpjbl.exe 2876 rbhht.exe 2192 vnhlrl.exe 2780 hfpxtd.exe 1192 plvxflj.exe 3020 jptxn.exe 2624 tjlpd.exe 2616 vddvnrr.exe 2324 frfdtn.exe 2124 rnxlp.exe 2688 rfhxjx.exe 2800 rthtx.exe 2828 xnnrdh.exe 2860 rhftrnp.exe 2720 pptdxj.exe 1980 vdtrr.exe 2516 pvlpffj.exe 1624 dtbbf.exe 2476 fxfbbp.exe 2232 tlhhjd.exe 2076 ptfdtt.exe 2716 rlvlf.exe 2248 nbdfphf.exe 1052 lxtdxl.exe 1352 lpjnhhh.exe 756 hnhdxft.exe 1164 hdfpl.exe 2424 hjxxhln.exe -
resource yara_rule behavioral1/memory/2268-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-622-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/872-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-709-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2796-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-733-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-861-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-888-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-897-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pthhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjrvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tprxvrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhxdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdfbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhxptf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxfpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjvntvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxjtbtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttfjvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvnvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnjrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxvvph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddljn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfnlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhxvjxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpxbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbddrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvnfldx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvnjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxdtrnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phthrnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xprhhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tndxvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdrlnbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnhpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjhtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjflh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plhvbdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pphxpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lttfh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2268 wrote to memory of 1116 2268 e978886241331efeea5fd92fcb47848d193bfe06fea507cde1487714092ff757N.exe 31 PID 2268 wrote to memory of 1116 2268 e978886241331efeea5fd92fcb47848d193bfe06fea507cde1487714092ff757N.exe 31 PID 2268 wrote to memory of 1116 2268 e978886241331efeea5fd92fcb47848d193bfe06fea507cde1487714092ff757N.exe 31 PID 2268 wrote to memory of 1116 2268 e978886241331efeea5fd92fcb47848d193bfe06fea507cde1487714092ff757N.exe 31 PID 1116 wrote to memory of 1708 1116 jjjlxhd.exe 32 PID 1116 wrote to memory of 1708 1116 jjjlxhd.exe 32 PID 1116 wrote to memory of 1708 1116 jjjlxhd.exe 32 PID 1116 wrote to memory of 1708 1116 jjjlxhd.exe 32 PID 1708 wrote to memory of 2448 1708 tnfflfv.exe 33 PID 1708 wrote to memory of 2448 1708 tnfflfv.exe 33 PID 1708 wrote to memory of 2448 1708 tnfflfv.exe 33 PID 1708 wrote to memory of 2448 1708 tnfflfv.exe 33 PID 2448 wrote to memory of 2940 2448 jhdptb.exe 34 PID 2448 wrote to memory of 2940 2448 jhdptb.exe 34 PID 2448 wrote to memory of 2940 2448 jhdptb.exe 34 PID 2448 wrote to memory of 2940 2448 jhdptb.exe 34 PID 2940 wrote to memory of 1192 2940 ntphl.exe 35 PID 2940 wrote to memory of 1192 2940 ntphl.exe 35 PID 2940 wrote to memory of 1192 2940 ntphl.exe 35 PID 2940 wrote to memory of 1192 2940 ntphl.exe 35 PID 1192 wrote to memory of 3012 1192 npfxptv.exe 36 PID 1192 wrote to memory of 3012 1192 npfxptv.exe 36 PID 1192 wrote to memory of 3012 1192 npfxptv.exe 36 PID 1192 wrote to memory of 3012 1192 npfxptv.exe 36 PID 3012 wrote to memory of 2784 3012 tplph.exe 37 PID 3012 wrote to memory of 2784 3012 tplph.exe 37 PID 3012 wrote to memory of 2784 3012 tplph.exe 37 PID 3012 wrote to memory of 2784 3012 tplph.exe 37 PID 2784 wrote to memory of 2616 2784 vnfpfbj.exe 38 PID 2784 wrote to memory of 2616 2784 vnfpfbj.exe 38 PID 2784 wrote to memory of 2616 2784 vnfpfbj.exe 38 PID 2784 wrote to memory of 2616 2784 vnfpfbj.exe 38 PID 2616 wrote to memory of 2124 2616 jlxxj.exe 39 PID 2616 wrote to memory of 2124 2616 jlxxj.exe 39 PID 2616 wrote to memory of 2124 2616 jlxxj.exe 39 PID 2616 wrote to memory of 2124 2616 jlxxj.exe 39 PID 2124 wrote to memory of 2088 2124 lhjljbh.exe 40 PID 2124 wrote to memory of 2088 2124 lhjljbh.exe 40 PID 2124 wrote to memory of 2088 2124 lhjljbh.exe 40 PID 2124 wrote to memory of 2088 2124 lhjljbh.exe 40 PID 2088 wrote to memory of 1648 2088 xxbttnd.exe 41 PID 2088 wrote to memory of 1648 2088 xxbttnd.exe 41 PID 2088 wrote to memory of 1648 2088 xxbttnd.exe 41 PID 2088 wrote to memory of 1648 2088 xxbttnd.exe 41 PID 1648 wrote to memory of 3000 1648 lhnjlb.exe 42 PID 1648 wrote to memory of 3000 1648 lhnjlb.exe 42 PID 1648 wrote to memory of 3000 1648 lhnjlb.exe 42 PID 1648 wrote to memory of 3000 1648 lhnjlb.exe 42 PID 3000 wrote to memory of 2916 3000 dhxptf.exe 43 PID 3000 wrote to memory of 2916 3000 dhxptf.exe 43 PID 3000 wrote to memory of 2916 3000 dhxptf.exe 43 PID 3000 wrote to memory of 2916 3000 dhxptf.exe 43 PID 2916 wrote to memory of 1980 2916 hlrxrfh.exe 44 PID 2916 wrote to memory of 1980 2916 hlrxrfh.exe 44 PID 2916 wrote to memory of 1980 2916 hlrxrfh.exe 44 PID 2916 wrote to memory of 1980 2916 hlrxrfh.exe 44 PID 1980 wrote to memory of 2820 1980 tfjnr.exe 45 PID 1980 wrote to memory of 2820 1980 tfjnr.exe 45 PID 1980 wrote to memory of 2820 1980 tfjnr.exe 45 PID 1980 wrote to memory of 2820 1980 tfjnr.exe 45 PID 2820 wrote to memory of 1884 2820 fbhrlrb.exe 46 PID 2820 wrote to memory of 1884 2820 fbhrlrb.exe 46 PID 2820 wrote to memory of 1884 2820 fbhrlrb.exe 46 PID 2820 wrote to memory of 1884 2820 fbhrlrb.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\e978886241331efeea5fd92fcb47848d193bfe06fea507cde1487714092ff757N.exe"C:\Users\Admin\AppData\Local\Temp\e978886241331efeea5fd92fcb47848d193bfe06fea507cde1487714092ff757N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\jjjlxhd.exec:\jjjlxhd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\tnfflfv.exec:\tnfflfv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\jhdptb.exec:\jhdptb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\ntphl.exec:\ntphl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\npfxptv.exec:\npfxptv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\tplph.exec:\tplph.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\vnfpfbj.exec:\vnfpfbj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\jlxxj.exec:\jlxxj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\lhjljbh.exec:\lhjljbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\xxbttnd.exec:\xxbttnd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\lhnjlb.exec:\lhnjlb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\dhxptf.exec:\dhxptf.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\hlrxrfh.exec:\hlrxrfh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\tfjnr.exec:\tfjnr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\fbhrlrb.exec:\fbhrlrb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\dbvvtvt.exec:\dbvvtvt.exe17⤵
- Executes dropped EXE
PID:1884 -
\??\c:\dddpvhp.exec:\dddpvhp.exe18⤵
- Executes dropped EXE
PID:1888 -
\??\c:\tbfrjt.exec:\tbfrjt.exe19⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rlllb.exec:\rlllb.exe20⤵
- Executes dropped EXE
PID:2248 -
\??\c:\fbvtx.exec:\fbvtx.exe21⤵
- Executes dropped EXE
PID:2288 -
\??\c:\hlhll.exec:\hlhll.exe22⤵
- Executes dropped EXE
PID:1348 -
\??\c:\nxbtr.exec:\nxbtr.exe23⤵
- Executes dropped EXE
PID:3052 -
\??\c:\rdhhnl.exec:\rdhhnl.exe24⤵
- Executes dropped EXE
PID:688 -
\??\c:\vprdj.exec:\vprdj.exe25⤵
- Executes dropped EXE
PID:1184 -
\??\c:\jvbplnb.exec:\jvbplnb.exe26⤵
- Executes dropped EXE
PID:1716 -
\??\c:\ftdtvb.exec:\ftdtvb.exe27⤵
- Executes dropped EXE
PID:648 -
\??\c:\xrjld.exec:\xrjld.exe28⤵
- Executes dropped EXE
PID:676 -
\??\c:\vflbd.exec:\vflbd.exe29⤵
- Executes dropped EXE
PID:1212 -
\??\c:\nvdjlh.exec:\nvdjlh.exe30⤵
- Executes dropped EXE
PID:2704 -
\??\c:\hvdnfr.exec:\hvdnfr.exe31⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xptfp.exec:\xptfp.exe32⤵
- Executes dropped EXE
PID:856 -
\??\c:\bxlpn.exec:\bxlpn.exe33⤵
- Executes dropped EXE
PID:1672 -
\??\c:\xjnnp.exec:\xjnnp.exe34⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xlpjt.exec:\xlpjt.exe35⤵
- Executes dropped EXE
PID:2336 -
\??\c:\prfrfn.exec:\prfrfn.exe36⤵
- Executes dropped EXE
PID:2188 -
\??\c:\xphtvbx.exec:\xphtvbx.exe37⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jrpjbl.exec:\jrpjbl.exe38⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rbhht.exec:\rbhht.exe39⤵
- Executes dropped EXE
PID:2876 -
\??\c:\vnhlrl.exec:\vnhlrl.exe40⤵
- Executes dropped EXE
PID:2192 -
\??\c:\hfpxtd.exec:\hfpxtd.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\plvxflj.exec:\plvxflj.exe42⤵
- Executes dropped EXE
PID:1192 -
\??\c:\jptxn.exec:\jptxn.exe43⤵
- Executes dropped EXE
PID:3020 -
\??\c:\tjlpd.exec:\tjlpd.exe44⤵
- Executes dropped EXE
PID:2624 -
\??\c:\vddvnrr.exec:\vddvnrr.exe45⤵
- Executes dropped EXE
PID:2616 -
\??\c:\frfdtn.exec:\frfdtn.exe46⤵
- Executes dropped EXE
PID:2324 -
\??\c:\rnxlp.exec:\rnxlp.exe47⤵
- Executes dropped EXE
PID:2124 -
\??\c:\rfhxjx.exec:\rfhxjx.exe48⤵
- Executes dropped EXE
PID:2688 -
\??\c:\rthtx.exec:\rthtx.exe49⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xnnrdh.exec:\xnnrdh.exe50⤵
- Executes dropped EXE
PID:2828 -
\??\c:\rhftrnp.exec:\rhftrnp.exe51⤵
- Executes dropped EXE
PID:2860 -
\??\c:\pptdxj.exec:\pptdxj.exe52⤵
- Executes dropped EXE
PID:2720 -
\??\c:\vdtrr.exec:\vdtrr.exe53⤵
- Executes dropped EXE
PID:1980 -
\??\c:\pvlpffj.exec:\pvlpffj.exe54⤵
- Executes dropped EXE
PID:2516 -
\??\c:\dtbbf.exec:\dtbbf.exe55⤵
- Executes dropped EXE
PID:1624 -
\??\c:\fxfbbp.exec:\fxfbbp.exe56⤵
- Executes dropped EXE
PID:2476 -
\??\c:\tlhhjd.exec:\tlhhjd.exe57⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ptfdtt.exec:\ptfdtt.exe58⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rlvlf.exec:\rlvlf.exe59⤵
- Executes dropped EXE
PID:2716 -
\??\c:\nbdfphf.exec:\nbdfphf.exe60⤵
- Executes dropped EXE
PID:2248 -
\??\c:\lxtdxl.exec:\lxtdxl.exe61⤵
- Executes dropped EXE
PID:1052 -
\??\c:\lpjnhhh.exec:\lpjnhhh.exe62⤵
- Executes dropped EXE
PID:1352 -
\??\c:\hnhdxft.exec:\hnhdxft.exe63⤵
- Executes dropped EXE
PID:756 -
\??\c:\hdfpl.exec:\hdfpl.exe64⤵
- Executes dropped EXE
PID:1164 -
\??\c:\hjxxhln.exec:\hjxxhln.exe65⤵
- Executes dropped EXE
PID:2424 -
\??\c:\nxthvh.exec:\nxthvh.exe66⤵PID:2004
-
\??\c:\fjfvxvb.exec:\fjfvxvb.exe67⤵PID:1716
-
\??\c:\pfbvhn.exec:\pfbvhn.exe68⤵PID:2308
-
\??\c:\htbntxh.exec:\htbntxh.exe69⤵PID:572
-
\??\c:\ttxvp.exec:\ttxvp.exe70⤵PID:3064
-
\??\c:\lbvlxr.exec:\lbvlxr.exe71⤵PID:2320
-
\??\c:\bfpfhtl.exec:\bfpfhtl.exe72⤵PID:2500
-
\??\c:\vpdpxhd.exec:\vpdpxhd.exe73⤵PID:2116
-
\??\c:\rjllrvv.exec:\rjllrvv.exe74⤵PID:1012
-
\??\c:\rhttrdf.exec:\rhttrdf.exe75⤵PID:568
-
\??\c:\hbpntjh.exec:\hbpntjh.exe76⤵PID:2532
-
\??\c:\bllhhll.exec:\bllhhll.exe77⤵PID:1592
-
\??\c:\rbjtd.exec:\rbjtd.exe78⤵PID:2556
-
\??\c:\fjndr.exec:\fjndr.exe79⤵PID:1988
-
\??\c:\jfhvlpt.exec:\jfhvlpt.exe80⤵PID:2388
-
\??\c:\dldfnd.exec:\dldfnd.exe81⤵PID:2884
-
\??\c:\rvddxb.exec:\rvddxb.exe82⤵PID:2764
-
\??\c:\xrfjrfr.exec:\xrfjrfr.exe83⤵PID:2628
-
\??\c:\jxrxhhn.exec:\jxrxhhn.exe84⤵PID:872
-
\??\c:\lrjlpxd.exec:\lrjlpxd.exe85⤵PID:2468
-
\??\c:\xhddd.exec:\xhddd.exe86⤵PID:2788
-
\??\c:\thjxr.exec:\thjxr.exe87⤵PID:2640
-
\??\c:\hhbhdrx.exec:\hhbhdrx.exe88⤵PID:2624
-
\??\c:\rvtjj.exec:\rvtjj.exe89⤵PID:2740
-
\??\c:\tvrxxr.exec:\tvrxxr.exe90⤵PID:2296
-
\??\c:\hvptd.exec:\hvptd.exe91⤵PID:2844
-
\??\c:\tfldnlh.exec:\tfldnlh.exe92⤵PID:2952
-
\??\c:\ffrlpl.exec:\ffrlpl.exe93⤵PID:2608
-
\??\c:\nrrjrb.exec:\nrrjrb.exe94⤵PID:2828
-
\??\c:\lvxvbb.exec:\lvxvbb.exe95⤵PID:800
-
\??\c:\vlndfvp.exec:\vlndfvp.exe96⤵PID:2676
-
\??\c:\npdjfv.exec:\npdjfv.exe97⤵PID:2796
-
\??\c:\pnnnrr.exec:\pnnnrr.exe98⤵PID:1900
-
\??\c:\pxjtbtf.exec:\pxjtbtf.exe99⤵
- System Location Discovery: System Language Discovery
PID:2384 -
\??\c:\ftdhv.exec:\ftdhv.exe100⤵PID:940
-
\??\c:\hrbdbjt.exec:\hrbdbjt.exe101⤵PID:1484
-
\??\c:\hdnpvp.exec:\hdnpvp.exe102⤵PID:2076
-
\??\c:\vnxtvn.exec:\vnxtvn.exe103⤵PID:2056
-
\??\c:\lnndbl.exec:\lnndbl.exe104⤵PID:1076
-
\??\c:\lxlrd.exec:\lxlrd.exe105⤵PID:1052
-
\??\c:\xhxrpvn.exec:\xhxrpvn.exe106⤵PID:3060
-
\??\c:\bptrrvt.exec:\bptrrvt.exe107⤵PID:1804
-
\??\c:\bnrfbl.exec:\bnrfbl.exe108⤵PID:952
-
\??\c:\rdjdrxr.exec:\rdjdrxr.exe109⤵PID:2120
-
\??\c:\xxxpjbr.exec:\xxxpjbr.exe110⤵PID:2592
-
\??\c:\xthjl.exec:\xthjl.exe111⤵PID:1060
-
\??\c:\djthj.exec:\djthj.exe112⤵PID:1524
-
\??\c:\xvdvhh.exec:\xvdvhh.exe113⤵PID:1488
-
\??\c:\ttvjbp.exec:\ttvjbp.exe114⤵PID:2372
-
\??\c:\plfdr.exec:\plfdr.exe115⤵PID:2700
-
\??\c:\rdxdb.exec:\rdxdb.exe116⤵PID:2320
-
\??\c:\jlxhxhp.exec:\jlxhxhp.exe117⤵PID:864
-
\??\c:\lfhff.exec:\lfhff.exe118⤵PID:2408
-
\??\c:\btrtl.exec:\btrtl.exe119⤵PID:1188
-
\??\c:\rvlpxh.exec:\rvlpxh.exe120⤵PID:804
-
\??\c:\pxnxrrd.exec:\pxnxrrd.exe121⤵PID:2268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-