Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 18:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b0db4171ff7aea3b44daa0d546adf4292d9460d8d2a82ef0015d32c5feb76acbN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b0db4171ff7aea3b44daa0d546adf4292d9460d8d2a82ef0015d32c5feb76acbN.exe
-
Size
454KB
-
MD5
a80501940b15fcedd3a26cf059787830
-
SHA1
c9e47f6e866fef0c6f05ab2073dc8dde24794a11
-
SHA256
b0db4171ff7aea3b44daa0d546adf4292d9460d8d2a82ef0015d32c5feb76acb
-
SHA512
8b1bd3b5b5908dcc0318d649414c09454122a9a40f72e30316600b4ca55d6d0f1c1669d7665c1b84ebc2f41499a2b7bbcfa6dc26e63aebe4634af2a2b8cd40e0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeL:q7Tc2NYHUrAwfMp3CDL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/760-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-28-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2184-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/940-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-123-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2344-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-155-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2352-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-213-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2064-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-268-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2376-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-385-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2784-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-428-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/840-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/564-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-503-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/912-508-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1312-551-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2204-565-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/932-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-578-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2912-629-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-649-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2852-655-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2132-722-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2676-749-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2292-762-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 760 vxvhrfv.exe 2184 xnxhfj.exe 2912 jnvtbn.exe 3048 fvfhrxt.exe 2844 nnpjx.exe 2848 thvjhlx.exe 2800 jvbnhr.exe 2524 ldtll.exe 1968 dpltxlv.exe 940 tjlvdld.exe 2984 tptxtx.exe 2996 njdttth.exe 2664 blftdt.exe 2344 tvrfvbn.exe 2120 pdhbrt.exe 580 dhndn.exe 2352 vldxf.exe 2292 rpvjrd.exe 2060 dbxttj.exe 1424 npxbh.exe 1644 lttrrfn.exe 2064 hxhtpj.exe 2672 fdthhn.exe 1800 hdfbx.exe 1572 tjxvh.exe 2584 ppnhnp.exe 2520 vbrjprd.exe 112 ddhnxpd.exe 2376 xxhxh.exe 1544 bpfpxj.exe 1828 xvxfvx.exe 2660 lbrldv.exe 2116 vvfhp.exe 872 fbvtlpf.exe 2164 vltxnfx.exe 1612 txththr.exe 2040 fjvtd.exe 2324 tlfpf.exe 2304 hhtrh.exe 3040 fhpvl.exe 2972 bxhjn.exe 2512 fhjdx.exe 2800 jtthj.exe 2880 lvdjf.exe 2784 ptfpd.exe 3004 fftdfjn.exe 2260 nbhtbj.exe 3028 ndfhf.exe 2868 dppfdb.exe 2996 trblfxn.exe 2460 dpphnvn.exe 3036 rfdtlnn.exe 840 jhxxvx.exe 2120 bxdplx.exe 564 tbxbdn.exe 2268 vfdjhrt.exe 2308 fdxtvhb.exe 2656 bdfvdjx.exe 2464 pjrnr.exe 2452 tfxvf.exe 900 lnjtd.exe 912 nxdlrlr.exe 2148 hnxfp.exe 1208 hfpnf.exe -
resource yara_rule behavioral1/memory/760-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-503-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/912-508-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1600-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-715-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2292-762-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlbrdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnphhjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vldxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppbvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phdbftt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrjph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvxhdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvdjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtvhtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvnpph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtblb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfhljh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdbjdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhppftf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxxnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvnjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdhlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nppfpnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjhdlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jprppb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhpjldp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txhpnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjxlnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnxdhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptptj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjxvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndrxnnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxxdbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvhvfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjhjdhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfnfnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tddrhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b0db4171ff7aea3b44daa0d546adf4292d9460d8d2a82ef0015d32c5feb76acbN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfdfjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drrtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnvvnhd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 760 2116 b0db4171ff7aea3b44daa0d546adf4292d9460d8d2a82ef0015d32c5feb76acbN.exe 30 PID 2116 wrote to memory of 760 2116 b0db4171ff7aea3b44daa0d546adf4292d9460d8d2a82ef0015d32c5feb76acbN.exe 30 PID 2116 wrote to memory of 760 2116 b0db4171ff7aea3b44daa0d546adf4292d9460d8d2a82ef0015d32c5feb76acbN.exe 30 PID 2116 wrote to memory of 760 2116 b0db4171ff7aea3b44daa0d546adf4292d9460d8d2a82ef0015d32c5feb76acbN.exe 30 PID 760 wrote to memory of 2184 760 vxvhrfv.exe 31 PID 760 wrote to memory of 2184 760 vxvhrfv.exe 31 PID 760 wrote to memory of 2184 760 vxvhrfv.exe 31 PID 760 wrote to memory of 2184 760 vxvhrfv.exe 31 PID 2184 wrote to memory of 2912 2184 xnxhfj.exe 32 PID 2184 wrote to memory of 2912 2184 xnxhfj.exe 32 PID 2184 wrote to memory of 2912 2184 xnxhfj.exe 32 PID 2184 wrote to memory of 2912 2184 xnxhfj.exe 32 PID 2912 wrote to memory of 3048 2912 jnvtbn.exe 33 PID 2912 wrote to memory of 3048 2912 jnvtbn.exe 33 PID 2912 wrote to memory of 3048 2912 jnvtbn.exe 33 PID 2912 wrote to memory of 3048 2912 jnvtbn.exe 33 PID 3048 wrote to memory of 2844 3048 fvfhrxt.exe 34 PID 3048 wrote to memory of 2844 3048 fvfhrxt.exe 34 PID 3048 wrote to memory of 2844 3048 fvfhrxt.exe 34 PID 3048 wrote to memory of 2844 3048 fvfhrxt.exe 34 PID 2844 wrote to memory of 2848 2844 nnpjx.exe 35 PID 2844 wrote to memory of 2848 2844 nnpjx.exe 35 PID 2844 wrote to memory of 2848 2844 nnpjx.exe 35 PID 2844 wrote to memory of 2848 2844 nnpjx.exe 35 PID 2848 wrote to memory of 2800 2848 thvjhlx.exe 36 PID 2848 wrote to memory of 2800 2848 thvjhlx.exe 36 PID 2848 wrote to memory of 2800 2848 thvjhlx.exe 36 PID 2848 wrote to memory of 2800 2848 thvjhlx.exe 36 PID 2800 wrote to memory of 2524 2800 jvbnhr.exe 37 PID 2800 wrote to memory of 2524 2800 jvbnhr.exe 37 PID 2800 wrote to memory of 2524 2800 jvbnhr.exe 37 PID 2800 wrote to memory of 2524 2800 jvbnhr.exe 37 PID 2524 wrote to memory of 1968 2524 ldtll.exe 38 PID 2524 wrote to memory of 1968 2524 ldtll.exe 38 PID 2524 wrote to memory of 1968 2524 ldtll.exe 38 PID 2524 wrote to memory of 1968 2524 ldtll.exe 38 PID 1968 wrote to memory of 940 1968 dpltxlv.exe 39 PID 1968 wrote to memory of 940 1968 dpltxlv.exe 39 PID 1968 wrote to memory of 940 1968 dpltxlv.exe 39 PID 1968 wrote to memory of 940 1968 dpltxlv.exe 39 PID 940 wrote to memory of 2984 940 tjlvdld.exe 40 PID 940 wrote to memory of 2984 940 tjlvdld.exe 40 PID 940 wrote to memory of 2984 940 tjlvdld.exe 40 PID 940 wrote to memory of 2984 940 tjlvdld.exe 40 PID 2984 wrote to memory of 2996 2984 tptxtx.exe 41 PID 2984 wrote to memory of 2996 2984 tptxtx.exe 41 PID 2984 wrote to memory of 2996 2984 tptxtx.exe 41 PID 2984 wrote to memory of 2996 2984 tptxtx.exe 41 PID 2996 wrote to memory of 2664 2996 njdttth.exe 42 PID 2996 wrote to memory of 2664 2996 njdttth.exe 42 PID 2996 wrote to memory of 2664 2996 njdttth.exe 42 PID 2996 wrote to memory of 2664 2996 njdttth.exe 42 PID 2664 wrote to memory of 2344 2664 blftdt.exe 43 PID 2664 wrote to memory of 2344 2664 blftdt.exe 43 PID 2664 wrote to memory of 2344 2664 blftdt.exe 43 PID 2664 wrote to memory of 2344 2664 blftdt.exe 43 PID 2344 wrote to memory of 2120 2344 tvrfvbn.exe 44 PID 2344 wrote to memory of 2120 2344 tvrfvbn.exe 44 PID 2344 wrote to memory of 2120 2344 tvrfvbn.exe 44 PID 2344 wrote to memory of 2120 2344 tvrfvbn.exe 44 PID 2120 wrote to memory of 580 2120 pdhbrt.exe 45 PID 2120 wrote to memory of 580 2120 pdhbrt.exe 45 PID 2120 wrote to memory of 580 2120 pdhbrt.exe 45 PID 2120 wrote to memory of 580 2120 pdhbrt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0db4171ff7aea3b44daa0d546adf4292d9460d8d2a82ef0015d32c5feb76acbN.exe"C:\Users\Admin\AppData\Local\Temp\b0db4171ff7aea3b44daa0d546adf4292d9460d8d2a82ef0015d32c5feb76acbN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\vxvhrfv.exec:\vxvhrfv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\xnxhfj.exec:\xnxhfj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\jnvtbn.exec:\jnvtbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\fvfhrxt.exec:\fvfhrxt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\nnpjx.exec:\nnpjx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\thvjhlx.exec:\thvjhlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\jvbnhr.exec:\jvbnhr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\ldtll.exec:\ldtll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\dpltxlv.exec:\dpltxlv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\tjlvdld.exec:\tjlvdld.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\tptxtx.exec:\tptxtx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\njdttth.exec:\njdttth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\blftdt.exec:\blftdt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\tvrfvbn.exec:\tvrfvbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\pdhbrt.exec:\pdhbrt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\dhndn.exec:\dhndn.exe17⤵
- Executes dropped EXE
PID:580 -
\??\c:\vldxf.exec:\vldxf.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2352 -
\??\c:\rpvjrd.exec:\rpvjrd.exe19⤵
- Executes dropped EXE
PID:2292 -
\??\c:\dbxttj.exec:\dbxttj.exe20⤵
- Executes dropped EXE
PID:2060 -
\??\c:\npxbh.exec:\npxbh.exe21⤵
- Executes dropped EXE
PID:1424 -
\??\c:\lttrrfn.exec:\lttrrfn.exe22⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hxhtpj.exec:\hxhtpj.exe23⤵
- Executes dropped EXE
PID:2064 -
\??\c:\fdthhn.exec:\fdthhn.exe24⤵
- Executes dropped EXE
PID:2672 -
\??\c:\hdfbx.exec:\hdfbx.exe25⤵
- Executes dropped EXE
PID:1800 -
\??\c:\tjxvh.exec:\tjxvh.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1572 -
\??\c:\ppnhnp.exec:\ppnhnp.exe27⤵
- Executes dropped EXE
PID:2584 -
\??\c:\vbrjprd.exec:\vbrjprd.exe28⤵
- Executes dropped EXE
PID:2520 -
\??\c:\ddhnxpd.exec:\ddhnxpd.exe29⤵
- Executes dropped EXE
PID:112 -
\??\c:\xxhxh.exec:\xxhxh.exe30⤵
- Executes dropped EXE
PID:2376 -
\??\c:\bpfpxj.exec:\bpfpxj.exe31⤵
- Executes dropped EXE
PID:1544 -
\??\c:\xvxfvx.exec:\xvxfvx.exe32⤵
- Executes dropped EXE
PID:1828 -
\??\c:\lbrldv.exec:\lbrldv.exe33⤵
- Executes dropped EXE
PID:2660 -
\??\c:\vvfhp.exec:\vvfhp.exe34⤵
- Executes dropped EXE
PID:2116 -
\??\c:\fbvtlpf.exec:\fbvtlpf.exe35⤵
- Executes dropped EXE
PID:872 -
\??\c:\vltxnfx.exec:\vltxnfx.exe36⤵
- Executes dropped EXE
PID:2164 -
\??\c:\txththr.exec:\txththr.exe37⤵
- Executes dropped EXE
PID:1612 -
\??\c:\fjvtd.exec:\fjvtd.exe38⤵
- Executes dropped EXE
PID:2040 -
\??\c:\tlfpf.exec:\tlfpf.exe39⤵
- Executes dropped EXE
PID:2324 -
\??\c:\hhtrh.exec:\hhtrh.exe40⤵
- Executes dropped EXE
PID:2304 -
\??\c:\fhpvl.exec:\fhpvl.exe41⤵
- Executes dropped EXE
PID:3040 -
\??\c:\bxhjn.exec:\bxhjn.exe42⤵
- Executes dropped EXE
PID:2972 -
\??\c:\fhjdx.exec:\fhjdx.exe43⤵
- Executes dropped EXE
PID:2512 -
\??\c:\jtthj.exec:\jtthj.exe44⤵
- Executes dropped EXE
PID:2800 -
\??\c:\lvdjf.exec:\lvdjf.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2880 -
\??\c:\ptfpd.exec:\ptfpd.exe46⤵
- Executes dropped EXE
PID:2784 -
\??\c:\fftdfjn.exec:\fftdfjn.exe47⤵
- Executes dropped EXE
PID:3004 -
\??\c:\nbhtbj.exec:\nbhtbj.exe48⤵
- Executes dropped EXE
PID:2260 -
\??\c:\ndfhf.exec:\ndfhf.exe49⤵
- Executes dropped EXE
PID:3028 -
\??\c:\dppfdb.exec:\dppfdb.exe50⤵
- Executes dropped EXE
PID:2868 -
\??\c:\trblfxn.exec:\trblfxn.exe51⤵
- Executes dropped EXE
PID:2996 -
\??\c:\dpphnvn.exec:\dpphnvn.exe52⤵
- Executes dropped EXE
PID:2460 -
\??\c:\rfdtlnn.exec:\rfdtlnn.exe53⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jhxxvx.exec:\jhxxvx.exe54⤵
- Executes dropped EXE
PID:840 -
\??\c:\bxdplx.exec:\bxdplx.exe55⤵
- Executes dropped EXE
PID:2120 -
\??\c:\tbxbdn.exec:\tbxbdn.exe56⤵
- Executes dropped EXE
PID:564 -
\??\c:\vfdjhrt.exec:\vfdjhrt.exe57⤵
- Executes dropped EXE
PID:2268 -
\??\c:\fdxtvhb.exec:\fdxtvhb.exe58⤵
- Executes dropped EXE
PID:2308 -
\??\c:\bdfvdjx.exec:\bdfvdjx.exe59⤵
- Executes dropped EXE
PID:2656 -
\??\c:\pjrnr.exec:\pjrnr.exe60⤵
- Executes dropped EXE
PID:2464 -
\??\c:\tfxvf.exec:\tfxvf.exe61⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lnjtd.exec:\lnjtd.exe62⤵
- Executes dropped EXE
PID:900 -
\??\c:\nxdlrlr.exec:\nxdlrlr.exe63⤵
- Executes dropped EXE
PID:912 -
\??\c:\hnxfp.exec:\hnxfp.exe64⤵
- Executes dropped EXE
PID:2148 -
\??\c:\hfpnf.exec:\hfpnf.exe65⤵
- Executes dropped EXE
PID:1208 -
\??\c:\fjrlbhf.exec:\fjrlbhf.exe66⤵PID:1600
-
\??\c:\xvjhddf.exec:\xvjhddf.exe67⤵PID:2544
-
\??\c:\hllhxl.exec:\hllhxl.exe68⤵PID:2204
-
\??\c:\txhtt.exec:\txhtt.exe69⤵
- System Location Discovery: System Language Discovery
PID:1312 -
\??\c:\brpdb.exec:\brpdb.exe70⤵PID:1744
-
\??\c:\lljvnf.exec:\lljvnf.exe71⤵PID:932
-
\??\c:\xtlrxbd.exec:\xtlrxbd.exe72⤵PID:2628
-
\??\c:\jbxfdbp.exec:\jbxfdbp.exe73⤵PID:1824
-
\??\c:\vlrhx.exec:\vlrhx.exe74⤵PID:1748
-
\??\c:\ltfxd.exec:\ltfxd.exe75⤵PID:888
-
\??\c:\jxbjhnv.exec:\jxbjhnv.exe76⤵PID:1236
-
\??\c:\hxdvlv.exec:\hxdvlv.exe77⤵PID:1984
-
\??\c:\xlflhjf.exec:\xlflhjf.exe78⤵PID:2184
-
\??\c:\ffhjjt.exec:\ffhjjt.exe79⤵PID:1624
-
\??\c:\lbntbt.exec:\lbntbt.exe80⤵PID:2008
-
\??\c:\tvjbl.exec:\tvjbl.exe81⤵PID:2912
-
\??\c:\nlfvx.exec:\nlfvx.exe82⤵PID:2968
-
\??\c:\nbjbh.exec:\nbjbh.exe83⤵PID:2944
-
\??\c:\xhpflv.exec:\xhpflv.exe84⤵PID:1804
-
\??\c:\hnxdhh.exec:\hnxdhh.exe85⤵
- System Location Discovery: System Language Discovery
PID:2852 -
\??\c:\bbpxnt.exec:\bbpxnt.exe86⤵PID:2512
-
\??\c:\thxjfx.exec:\thxjfx.exe87⤵PID:2800
-
\??\c:\ldltfhd.exec:\ldltfhd.exe88⤵PID:264
-
\??\c:\bhvtnlj.exec:\bhvtnlj.exe89⤵PID:944
-
\??\c:\lfvttp.exec:\lfvttp.exe90⤵PID:2360
-
\??\c:\dnpdr.exec:\dnpdr.exe91⤵PID:1784
-
\??\c:\nvvnbdv.exec:\nvvnbdv.exe92⤵PID:2132
-
\??\c:\jxdrlj.exec:\jxdrlj.exe93⤵PID:1436
-
\??\c:\nppfn.exec:\nppfn.exe94⤵PID:1056
-
\??\c:\vdtjhxb.exec:\vdtjhxb.exe95⤵PID:1952
-
\??\c:\vvpfjf.exec:\vvpfjf.exe96⤵PID:2676
-
\??\c:\dxhdfjl.exec:\dxhdfjl.exe97⤵PID:1152
-
\??\c:\ffbnhn.exec:\ffbnhn.exe98⤵PID:1400
-
\??\c:\tbtltxb.exec:\tbtltxb.exe99⤵PID:764
-
\??\c:\vpvvvhb.exec:\vpvvvhb.exe100⤵PID:1956
-
\??\c:\dxjtpx.exec:\dxjtpx.exe101⤵PID:2292
-
\??\c:\plvdnvd.exec:\plvdnvd.exe102⤵PID:2308
-
\??\c:\flpnhf.exec:\flpnhf.exe103⤵PID:1424
-
\??\c:\vxrrdnd.exec:\vxrrdnd.exe104⤵PID:624
-
\??\c:\jhnpfh.exec:\jhnpfh.exe105⤵PID:856
-
\??\c:\htbvtvx.exec:\htbvtvx.exe106⤵PID:2000
-
\??\c:\bnlrfv.exec:\bnlrfv.exe107⤵PID:912
-
\??\c:\lptlf.exec:\lptlf.exe108⤵PID:960
-
\??\c:\rrhrnh.exec:\rrhrnh.exe109⤵PID:1972
-
\??\c:\brfnhd.exec:\brfnhd.exe110⤵PID:1600
-
\??\c:\xxdvjh.exec:\xxdvjh.exe111⤵PID:2440
-
\??\c:\ltnjnhl.exec:\ltnjnhl.exe112⤵PID:1712
-
\??\c:\trpjrpl.exec:\trpjrpl.exe113⤵PID:576
-
\??\c:\nlnbjh.exec:\nlnbjh.exe114⤵PID:2172
-
\??\c:\vppppl.exec:\vppppl.exe115⤵PID:1668
-
\??\c:\phlpfvv.exec:\phlpfvv.exe116⤵PID:2628
-
\??\c:\ntlvv.exec:\ntlvv.exe117⤵PID:892
-
\??\c:\ndljfh.exec:\ndljfh.exe118⤵PID:2224
-
\??\c:\htbljr.exec:\htbljr.exe119⤵PID:1456
-
\??\c:\tvlhf.exec:\tvlhf.exe120⤵PID:2424
-
\??\c:\tbvjfdd.exec:\tbvjfdd.exe121⤵PID:2936
-
\??\c:\ppfbjjd.exec:\ppfbjjd.exe122⤵PID:2004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-