Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 18:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bbdc39ce678f645e4a74943152619b566d2a7b593b112bdf06f71a6421984c36.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
bbdc39ce678f645e4a74943152619b566d2a7b593b112bdf06f71a6421984c36.exe
-
Size
454KB
-
MD5
3a60934f3a36726fd73bd87c4505c1b7
-
SHA1
e2b0ad012941fc3e6a15a4b7a0c3bf7cebd2654a
-
SHA256
bbdc39ce678f645e4a74943152619b566d2a7b593b112bdf06f71a6421984c36
-
SHA512
a75f880b37de0ca3c06f9401904576d37d5405b181f3f82af5565b6a07962bbc38402211d5591887b5510c620566200e2c579e9449a55d401252ad94b3cbdc41
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe+:q7Tc2NYHUrAwfMp3CD+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2484-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/932-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-135-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/852-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-173-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2164-184-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2348-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-211-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/984-237-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1476-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/360-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-316-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2860-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-395-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/2964-428-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2964-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-436-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1964-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-559-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2052-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-587-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2848-620-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2324-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-694-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-779-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1492-811-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2816 flnnd.exe 2776 xntrdv.exe 2908 xtrrvxh.exe 2784 ttjlh.exe 2640 brvfbxd.exe 932 ppnrh.exe 1380 ldxbpv.exe 1648 flhdtt.exe 3032 rhjndfh.exe 2148 tvhjxr.exe 1708 rbhvnbj.exe 2956 prnvhfx.exe 2904 lpfdn.exe 2920 blvvd.exe 852 rrhfxxd.exe 1572 hfjxdxb.exe 2108 dfrjbjr.exe 2164 ltdlh.exe 2348 jblflpx.exe 1396 vbhbdp.exe 2496 rfjntln.exe 2156 tjrtvft.exe 972 pvbftpt.exe 984 nlbtv.exe 1476 ndphlx.exe 1984 pbfxv.exe 360 brtpnjd.exe 2228 trbhlt.exe 1108 lrjnx.exe 1372 nxvxd.exe 2336 rdphrr.exe 2116 ddldff.exe 2832 hbrhtv.exe 1548 lvdtx.exe 2820 hdvlhv.exe 2860 ltlxvbl.exe 2656 txldv.exe 2908 xbdhff.exe 2624 djprbf.exe 2092 pldtv.exe 2080 ftfnx.exe 2072 djrbd.exe 1380 lvbfrvr.exe 924 njnthp.exe 2840 lbbnrp.exe 2124 rxjxdtp.exe 2328 rbrvnxj.exe 2936 xhfphlr.exe 2708 tbfhvj.exe 2964 dfhnhfp.exe 2008 jxlhjrr.exe 1964 ttfprlj.exe 2544 nxvlrr.exe 1608 vptpft.exe 752 fbtpl.exe 2192 xxvxfd.exe 2128 djdhdnt.exe 1796 dpdlxn.exe 2272 dxrrb.exe 820 lpxvrfx.exe 1364 ljhbv.exe 1668 jpjfx.exe 1116 dfdljjt.exe 1088 lfhdlj.exe -
resource yara_rule behavioral1/memory/2484-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/360-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-436-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1964-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/688-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/664-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-741-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-805-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jftbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvlfjnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxjvlnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvttln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfjxdxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrtvff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpdbhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnxfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtxxvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpxht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htfjjxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntvxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntvhbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfpxxhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvlrjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnrbfvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vptpft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppfrrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdbhdrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nblfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhjht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdvlhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxxvxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnrhdnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpxvrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jldxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfhflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpndrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdddrnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltfvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvbfrvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjhdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtpjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvprr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txbhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bldxrnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppnrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfbhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thfpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpdvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldxbpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxbjfjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdnjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blrll.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2484 wrote to memory of 2816 2484 bbdc39ce678f645e4a74943152619b566d2a7b593b112bdf06f71a6421984c36.exe 30 PID 2484 wrote to memory of 2816 2484 bbdc39ce678f645e4a74943152619b566d2a7b593b112bdf06f71a6421984c36.exe 30 PID 2484 wrote to memory of 2816 2484 bbdc39ce678f645e4a74943152619b566d2a7b593b112bdf06f71a6421984c36.exe 30 PID 2484 wrote to memory of 2816 2484 bbdc39ce678f645e4a74943152619b566d2a7b593b112bdf06f71a6421984c36.exe 30 PID 2816 wrote to memory of 2776 2816 flnnd.exe 31 PID 2816 wrote to memory of 2776 2816 flnnd.exe 31 PID 2816 wrote to memory of 2776 2816 flnnd.exe 31 PID 2816 wrote to memory of 2776 2816 flnnd.exe 31 PID 2776 wrote to memory of 2908 2776 xntrdv.exe 32 PID 2776 wrote to memory of 2908 2776 xntrdv.exe 32 PID 2776 wrote to memory of 2908 2776 xntrdv.exe 32 PID 2776 wrote to memory of 2908 2776 xntrdv.exe 32 PID 2908 wrote to memory of 2784 2908 xtrrvxh.exe 33 PID 2908 wrote to memory of 2784 2908 xtrrvxh.exe 33 PID 2908 wrote to memory of 2784 2908 xtrrvxh.exe 33 PID 2908 wrote to memory of 2784 2908 xtrrvxh.exe 33 PID 2784 wrote to memory of 2640 2784 ttjlh.exe 34 PID 2784 wrote to memory of 2640 2784 ttjlh.exe 34 PID 2784 wrote to memory of 2640 2784 ttjlh.exe 34 PID 2784 wrote to memory of 2640 2784 ttjlh.exe 34 PID 2640 wrote to memory of 932 2640 brvfbxd.exe 35 PID 2640 wrote to memory of 932 2640 brvfbxd.exe 35 PID 2640 wrote to memory of 932 2640 brvfbxd.exe 35 PID 2640 wrote to memory of 932 2640 brvfbxd.exe 35 PID 932 wrote to memory of 1380 932 ppnrh.exe 36 PID 932 wrote to memory of 1380 932 ppnrh.exe 36 PID 932 wrote to memory of 1380 932 ppnrh.exe 36 PID 932 wrote to memory of 1380 932 ppnrh.exe 36 PID 1380 wrote to memory of 1648 1380 ldxbpv.exe 37 PID 1380 wrote to memory of 1648 1380 ldxbpv.exe 37 PID 1380 wrote to memory of 1648 1380 ldxbpv.exe 37 PID 1380 wrote to memory of 1648 1380 ldxbpv.exe 37 PID 1648 wrote to memory of 3032 1648 flhdtt.exe 38 PID 1648 wrote to memory of 3032 1648 flhdtt.exe 38 PID 1648 wrote to memory of 3032 1648 flhdtt.exe 38 PID 1648 wrote to memory of 3032 1648 flhdtt.exe 38 PID 3032 wrote to memory of 2148 3032 rhjndfh.exe 39 PID 3032 wrote to memory of 2148 3032 rhjndfh.exe 39 PID 3032 wrote to memory of 2148 3032 rhjndfh.exe 39 PID 3032 wrote to memory of 2148 3032 rhjndfh.exe 39 PID 2148 wrote to memory of 1708 2148 tvhjxr.exe 40 PID 2148 wrote to memory of 1708 2148 tvhjxr.exe 40 PID 2148 wrote to memory of 1708 2148 tvhjxr.exe 40 PID 2148 wrote to memory of 1708 2148 tvhjxr.exe 40 PID 1708 wrote to memory of 2956 1708 rbhvnbj.exe 41 PID 1708 wrote to memory of 2956 1708 rbhvnbj.exe 41 PID 1708 wrote to memory of 2956 1708 rbhvnbj.exe 41 PID 1708 wrote to memory of 2956 1708 rbhvnbj.exe 41 PID 2956 wrote to memory of 2904 2956 prnvhfx.exe 42 PID 2956 wrote to memory of 2904 2956 prnvhfx.exe 42 PID 2956 wrote to memory of 2904 2956 prnvhfx.exe 42 PID 2956 wrote to memory of 2904 2956 prnvhfx.exe 42 PID 2904 wrote to memory of 2920 2904 lpfdn.exe 43 PID 2904 wrote to memory of 2920 2904 lpfdn.exe 43 PID 2904 wrote to memory of 2920 2904 lpfdn.exe 43 PID 2904 wrote to memory of 2920 2904 lpfdn.exe 43 PID 2920 wrote to memory of 852 2920 blvvd.exe 44 PID 2920 wrote to memory of 852 2920 blvvd.exe 44 PID 2920 wrote to memory of 852 2920 blvvd.exe 44 PID 2920 wrote to memory of 852 2920 blvvd.exe 44 PID 852 wrote to memory of 1572 852 rrhfxxd.exe 45 PID 852 wrote to memory of 1572 852 rrhfxxd.exe 45 PID 852 wrote to memory of 1572 852 rrhfxxd.exe 45 PID 852 wrote to memory of 1572 852 rrhfxxd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbdc39ce678f645e4a74943152619b566d2a7b593b112bdf06f71a6421984c36.exe"C:\Users\Admin\AppData\Local\Temp\bbdc39ce678f645e4a74943152619b566d2a7b593b112bdf06f71a6421984c36.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\flnnd.exec:\flnnd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\xntrdv.exec:\xntrdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\xtrrvxh.exec:\xtrrvxh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\ttjlh.exec:\ttjlh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\brvfbxd.exec:\brvfbxd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\ppnrh.exec:\ppnrh.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\ldxbpv.exec:\ldxbpv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\flhdtt.exec:\flhdtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\rhjndfh.exec:\rhjndfh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\tvhjxr.exec:\tvhjxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\rbhvnbj.exec:\rbhvnbj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\prnvhfx.exec:\prnvhfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\lpfdn.exec:\lpfdn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\blvvd.exec:\blvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\rrhfxxd.exec:\rrhfxxd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\hfjxdxb.exec:\hfjxdxb.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1572 -
\??\c:\dfrjbjr.exec:\dfrjbjr.exe18⤵
- Executes dropped EXE
PID:2108 -
\??\c:\ltdlh.exec:\ltdlh.exe19⤵
- Executes dropped EXE
PID:2164 -
\??\c:\jblflpx.exec:\jblflpx.exe20⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vbhbdp.exec:\vbhbdp.exe21⤵
- Executes dropped EXE
PID:1396 -
\??\c:\rfjntln.exec:\rfjntln.exe22⤵
- Executes dropped EXE
PID:2496 -
\??\c:\tjrtvft.exec:\tjrtvft.exe23⤵
- Executes dropped EXE
PID:2156 -
\??\c:\pvbftpt.exec:\pvbftpt.exe24⤵
- Executes dropped EXE
PID:972 -
\??\c:\nlbtv.exec:\nlbtv.exe25⤵
- Executes dropped EXE
PID:984 -
\??\c:\ndphlx.exec:\ndphlx.exe26⤵
- Executes dropped EXE
PID:1476 -
\??\c:\pbfxv.exec:\pbfxv.exe27⤵
- Executes dropped EXE
PID:1984 -
\??\c:\brtpnjd.exec:\brtpnjd.exe28⤵
- Executes dropped EXE
PID:360 -
\??\c:\trbhlt.exec:\trbhlt.exe29⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lrjnx.exec:\lrjnx.exe30⤵
- Executes dropped EXE
PID:1108 -
\??\c:\nxvxd.exec:\nxvxd.exe31⤵
- Executes dropped EXE
PID:1372 -
\??\c:\rdphrr.exec:\rdphrr.exe32⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ddldff.exec:\ddldff.exe33⤵
- Executes dropped EXE
PID:2116 -
\??\c:\hbrhtv.exec:\hbrhtv.exe34⤵
- Executes dropped EXE
PID:2832 -
\??\c:\lvdtx.exec:\lvdtx.exe35⤵
- Executes dropped EXE
PID:1548 -
\??\c:\hdvlhv.exec:\hdvlhv.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2820 -
\??\c:\ltlxvbl.exec:\ltlxvbl.exe37⤵
- Executes dropped EXE
PID:2860 -
\??\c:\txldv.exec:\txldv.exe38⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xbdhff.exec:\xbdhff.exe39⤵
- Executes dropped EXE
PID:2908 -
\??\c:\djprbf.exec:\djprbf.exe40⤵
- Executes dropped EXE
PID:2624 -
\??\c:\pldtv.exec:\pldtv.exe41⤵
- Executes dropped EXE
PID:2092 -
\??\c:\ftfnx.exec:\ftfnx.exe42⤵
- Executes dropped EXE
PID:2080 -
\??\c:\djrbd.exec:\djrbd.exe43⤵
- Executes dropped EXE
PID:2072 -
\??\c:\lvbfrvr.exec:\lvbfrvr.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1380 -
\??\c:\njnthp.exec:\njnthp.exe45⤵
- Executes dropped EXE
PID:924 -
\??\c:\lbbnrp.exec:\lbbnrp.exe46⤵
- Executes dropped EXE
PID:2840 -
\??\c:\rxjxdtp.exec:\rxjxdtp.exe47⤵
- Executes dropped EXE
PID:2124 -
\??\c:\rbrvnxj.exec:\rbrvnxj.exe48⤵
- Executes dropped EXE
PID:2328 -
\??\c:\xhfphlr.exec:\xhfphlr.exe49⤵
- Executes dropped EXE
PID:2936 -
\??\c:\tbfhvj.exec:\tbfhvj.exe50⤵
- Executes dropped EXE
PID:2708 -
\??\c:\dfhnhfp.exec:\dfhnhfp.exe51⤵
- Executes dropped EXE
PID:2964 -
\??\c:\jxlhjrr.exec:\jxlhjrr.exe52⤵
- Executes dropped EXE
PID:2008 -
\??\c:\ttfprlj.exec:\ttfprlj.exe53⤵
- Executes dropped EXE
PID:1964 -
\??\c:\nxvlrr.exec:\nxvlrr.exe54⤵
- Executes dropped EXE
PID:2544 -
\??\c:\vptpft.exec:\vptpft.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1608 -
\??\c:\fbtpl.exec:\fbtpl.exe56⤵
- Executes dropped EXE
PID:752 -
\??\c:\xxvxfd.exec:\xxvxfd.exe57⤵
- Executes dropped EXE
PID:2192 -
\??\c:\djdhdnt.exec:\djdhdnt.exe58⤵
- Executes dropped EXE
PID:2128 -
\??\c:\dpdlxn.exec:\dpdlxn.exe59⤵
- Executes dropped EXE
PID:1796 -
\??\c:\dxrrb.exec:\dxrrb.exe60⤵
- Executes dropped EXE
PID:2272 -
\??\c:\lpxvrfx.exec:\lpxvrfx.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:820 -
\??\c:\ljhbv.exec:\ljhbv.exe62⤵
- Executes dropped EXE
PID:1364 -
\??\c:\jpjfx.exec:\jpjfx.exe63⤵
- Executes dropped EXE
PID:1668 -
\??\c:\dfdljjt.exec:\dfdljjt.exe64⤵
- Executes dropped EXE
PID:1116 -
\??\c:\lfhdlj.exec:\lfhdlj.exe65⤵
- Executes dropped EXE
PID:1088 -
\??\c:\pprvfd.exec:\pprvfd.exe66⤵PID:2012
-
\??\c:\jpjbb.exec:\jpjbb.exe67⤵PID:2308
-
\??\c:\hbnvl.exec:\hbnvl.exe68⤵PID:3068
-
\??\c:\dnbdtb.exec:\dnbdtb.exe69⤵PID:1588
-
\??\c:\xtfjl.exec:\xtfjl.exe70⤵PID:2212
-
\??\c:\jrfppfl.exec:\jrfppfl.exe71⤵PID:2052
-
\??\c:\ljtvldr.exec:\ljtvldr.exe72⤵PID:2220
-
\??\c:\xttptr.exec:\xttptr.exe73⤵PID:1636
-
\??\c:\xdtxjnf.exec:\xdtxjnf.exe74⤵PID:2216
-
\??\c:\tftvtxf.exec:\tftvtxf.exe75⤵PID:1940
-
\??\c:\jrtvff.exec:\jrtvff.exe76⤵
- System Location Discovery: System Language Discovery
PID:2856 -
\??\c:\pdvbtpt.exec:\pdvbtpt.exe77⤵PID:2848
-
\??\c:\dvbnh.exec:\dvbnh.exe78⤵PID:2828
-
\??\c:\vtlvdd.exec:\vtlvdd.exe79⤵PID:2892
-
\??\c:\xxvpjj.exec:\xxvpjj.exe80⤵PID:2764
-
\??\c:\xhhrvp.exec:\xhhrvp.exe81⤵PID:2916
-
\??\c:\lhnjrlb.exec:\lhnjrlb.exe82⤵PID:2656
-
\??\c:\bbrpbr.exec:\bbrpbr.exe83⤵PID:2632
-
\??\c:\nbbtlbn.exec:\nbbtlbn.exe84⤵PID:1936
-
\??\c:\ppfrrt.exec:\ppfrrt.exe85⤵
- System Location Discovery: System Language Discovery
PID:2324 -
\??\c:\vljjnh.exec:\vljjnh.exe86⤵PID:688
-
\??\c:\ltbffnd.exec:\ltbffnd.exe87⤵PID:1240
-
\??\c:\vhrhnf.exec:\vhrhnf.exe88⤵PID:1380
-
\??\c:\lbhbdl.exec:\lbhbdl.exe89⤵PID:924
-
\??\c:\blnbb.exec:\blnbb.exe90⤵PID:1132
-
\??\c:\lhpnx.exec:\lhpnx.exe91⤵PID:2148
-
\??\c:\rhllrnd.exec:\rhllrnd.exe92⤵PID:2948
-
\??\c:\pbhllbj.exec:\pbhllbj.exe93⤵PID:2104
-
\??\c:\bbvlv.exec:\bbvlv.exe94⤵PID:1696
-
\??\c:\plfxxj.exec:\plfxxj.exe95⤵PID:2964
-
\??\c:\vtjtrp.exec:\vtjtrp.exe96⤵PID:2296
-
\??\c:\vfxbthd.exec:\vfxbthd.exe97⤵PID:664
-
\??\c:\pvddxrh.exec:\pvddxrh.exe98⤵PID:2020
-
\??\c:\nhjnfdf.exec:\nhjnfdf.exe99⤵PID:1488
-
\??\c:\fdfvrn.exec:\fdfvrn.exe100⤵PID:1572
-
\??\c:\dtnft.exec:\dtnft.exe101⤵PID:2160
-
\??\c:\vdbvffd.exec:\vdbvffd.exe102⤵PID:2356
-
\??\c:\hlftfdv.exec:\hlftfdv.exe103⤵PID:2164
-
\??\c:\hnldfdn.exec:\hnldfdn.exe104⤵PID:768
-
\??\c:\fnhffd.exec:\fnhffd.exe105⤵PID:820
-
\??\c:\pdrjbln.exec:\pdrjbln.exe106⤵PID:2504
-
\??\c:\lplrndv.exec:\lplrndv.exe107⤵PID:2156
-
\??\c:\pfvth.exec:\pfvth.exe108⤵PID:1652
-
\??\c:\vfxrfnn.exec:\vfxrfnn.exe109⤵PID:1492
-
\??\c:\vlbxjd.exec:\vlbxjd.exe110⤵PID:1952
-
\??\c:\dndnvl.exec:\dndnvl.exe111⤵PID:1684
-
\??\c:\hhpbh.exec:\hhpbh.exe112⤵PID:1992
-
\??\c:\frxxd.exec:\frxxd.exe113⤵
- System Location Discovery: System Language Discovery
PID:1312 -
\??\c:\tvrpn.exec:\tvrpn.exe114⤵PID:2184
-
\??\c:\jftlb.exec:\jftlb.exe115⤵PID:1748
-
\??\c:\jvtnnt.exec:\jvtnnt.exe116⤵PID:2220
-
\??\c:\rftrf.exec:\rftrf.exe117⤵PID:1636
-
\??\c:\jvlfjnr.exec:\jvlfjnr.exe118⤵
- System Location Discovery: System Language Discovery
PID:880 -
\??\c:\xbpdl.exec:\xbpdl.exe119⤵PID:1732
-
\??\c:\dlxdjf.exec:\dlxdjf.exe120⤵PID:2728
-
\??\c:\jphnrn.exec:\jphnrn.exe121⤵PID:2724
-
\??\c:\rbxtbbv.exec:\rbxtbbv.exe122⤵PID:2628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-