Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 18:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
84200848d084711eaec802779f6b34e23ebe33e5af548d91c8cbd011ca4e2ad8N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
84200848d084711eaec802779f6b34e23ebe33e5af548d91c8cbd011ca4e2ad8N.exe
-
Size
456KB
-
MD5
c8a114ce78d29dae7100cc6d9215daf0
-
SHA1
9a46d3d6953bf26ef8a3f7557370a51b2dcde14b
-
SHA256
84200848d084711eaec802779f6b34e23ebe33e5af548d91c8cbd011ca4e2ad8
-
SHA512
611b4e45810f85c8ecd258ccd102fefb60198e3f2bd57af76ebb74721f81bbafe3d95974a6fc85f68a4e6cce58b1a7ba3016d11cae8ee7a7a5f0ec3f847a4fe4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRc:q7Tc2NYHUrAwfMp3CDRc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2044-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-46-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2168-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-67-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2820-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-80-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2564-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/608-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-263-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1312-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-307-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1984-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-535-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2584-555-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/932-563-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1668-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-584-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2164-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-684-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2044 bvtfjht.exe 1456 pphrjb.exe 2936 drblxrl.exe 2168 frdlpvb.exe 3048 nnlpjt.exe 2512 vjnph.exe 2820 djfjndd.exe 2564 nnrdhfr.exe 2784 ntlld.exe 1492 pjvtx.exe 2332 nffdftd.exe 2996 ddxpv.exe 2664 tdjnjtj.exe 2344 nbbdd.exe 608 xpdvhd.exe 1632 phxnvdt.exe 2352 fnrdfb.exe 2216 jrfhxf.exe 2384 ppttjb.exe 2456 fnlbx.exe 2284 hxxtvv.exe 900 jnjfdtv.exe 2000 ltnndd.exe 1812 hllvxl.exe 1600 tdbhfn.exe 2568 drbrntd.exe 1308 prhrvh.exe 1312 bhtxb.exe 2808 njvxdh.exe 1820 xffjht.exe 2616 npxnvd.exe 2288 hnltrx.exe 2596 llltx.exe 1984 dfxdb.exe 2040 jhbptbx.exe 2936 pftrbfb.exe 2144 dlhddvh.exe 2168 jvffpbp.exe 2220 xbvtdp.exe 3048 lpvhnd.exe 2920 jlvjtdn.exe 2840 jxvfb.exe 2524 bvxrfxf.exe 1968 nrbnnf.exe 2988 fxdjltp.exe 2784 ftttbrr.exe 2904 bvndptn.exe 2868 hfvnjp.exe 1460 lfdbhpt.exe 1952 bddvl.exe 1500 xlxjbh.exe 1780 djhdbhj.exe 2032 prdxnnn.exe 1148 hdtxnf.exe 1632 bjndbh.exe 2268 pxhhdn.exe 2060 jxvvxl.exe 864 rtvvhdv.exe 2404 xnnlrhj.exe 2280 rtllhnn.exe 2064 vlvblvn.exe 836 dbdlbpr.exe 2776 hxvvhrf.exe 1320 vvdffhx.exe -
resource yara_rule behavioral1/memory/2044-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-563-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1668-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-584-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2164-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-769-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvlxjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdxvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbdnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbfxvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfnxplb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vndhfrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vntptr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdtpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbpxvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltdxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvjfdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfhdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvbdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpdvhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjjrrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phlvrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrbhjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpjjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhvhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxxjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbfbptx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rldlfnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjbpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffdffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rppxfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frdrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npnvhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfltxlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjbfpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhljrfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxjht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvfprp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npfxfrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjbvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xljtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdrn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1880 wrote to memory of 2044 1880 84200848d084711eaec802779f6b34e23ebe33e5af548d91c8cbd011ca4e2ad8N.exe 30 PID 1880 wrote to memory of 2044 1880 84200848d084711eaec802779f6b34e23ebe33e5af548d91c8cbd011ca4e2ad8N.exe 30 PID 1880 wrote to memory of 2044 1880 84200848d084711eaec802779f6b34e23ebe33e5af548d91c8cbd011ca4e2ad8N.exe 30 PID 1880 wrote to memory of 2044 1880 84200848d084711eaec802779f6b34e23ebe33e5af548d91c8cbd011ca4e2ad8N.exe 30 PID 2044 wrote to memory of 1456 2044 bvtfjht.exe 31 PID 2044 wrote to memory of 1456 2044 bvtfjht.exe 31 PID 2044 wrote to memory of 1456 2044 bvtfjht.exe 31 PID 2044 wrote to memory of 1456 2044 bvtfjht.exe 31 PID 1456 wrote to memory of 2936 1456 pphrjb.exe 32 PID 1456 wrote to memory of 2936 1456 pphrjb.exe 32 PID 1456 wrote to memory of 2936 1456 pphrjb.exe 32 PID 1456 wrote to memory of 2936 1456 pphrjb.exe 32 PID 2936 wrote to memory of 2168 2936 drblxrl.exe 33 PID 2936 wrote to memory of 2168 2936 drblxrl.exe 33 PID 2936 wrote to memory of 2168 2936 drblxrl.exe 33 PID 2936 wrote to memory of 2168 2936 drblxrl.exe 33 PID 2168 wrote to memory of 3048 2168 frdlpvb.exe 34 PID 2168 wrote to memory of 3048 2168 frdlpvb.exe 34 PID 2168 wrote to memory of 3048 2168 frdlpvb.exe 34 PID 2168 wrote to memory of 3048 2168 frdlpvb.exe 34 PID 3048 wrote to memory of 2512 3048 nnlpjt.exe 35 PID 3048 wrote to memory of 2512 3048 nnlpjt.exe 35 PID 3048 wrote to memory of 2512 3048 nnlpjt.exe 35 PID 3048 wrote to memory of 2512 3048 nnlpjt.exe 35 PID 2512 wrote to memory of 2820 2512 vjnph.exe 36 PID 2512 wrote to memory of 2820 2512 vjnph.exe 36 PID 2512 wrote to memory of 2820 2512 vjnph.exe 36 PID 2512 wrote to memory of 2820 2512 vjnph.exe 36 PID 2820 wrote to memory of 2564 2820 djfjndd.exe 37 PID 2820 wrote to memory of 2564 2820 djfjndd.exe 37 PID 2820 wrote to memory of 2564 2820 djfjndd.exe 37 PID 2820 wrote to memory of 2564 2820 djfjndd.exe 37 PID 2564 wrote to memory of 2784 2564 nnrdhfr.exe 38 PID 2564 wrote to memory of 2784 2564 nnrdhfr.exe 38 PID 2564 wrote to memory of 2784 2564 nnrdhfr.exe 38 PID 2564 wrote to memory of 2784 2564 nnrdhfr.exe 38 PID 2784 wrote to memory of 1492 2784 ntlld.exe 39 PID 2784 wrote to memory of 1492 2784 ntlld.exe 39 PID 2784 wrote to memory of 1492 2784 ntlld.exe 39 PID 2784 wrote to memory of 1492 2784 ntlld.exe 39 PID 1492 wrote to memory of 2332 1492 pjvtx.exe 40 PID 1492 wrote to memory of 2332 1492 pjvtx.exe 40 PID 1492 wrote to memory of 2332 1492 pjvtx.exe 40 PID 1492 wrote to memory of 2332 1492 pjvtx.exe 40 PID 2332 wrote to memory of 2996 2332 nffdftd.exe 41 PID 2332 wrote to memory of 2996 2332 nffdftd.exe 41 PID 2332 wrote to memory of 2996 2332 nffdftd.exe 41 PID 2332 wrote to memory of 2996 2332 nffdftd.exe 41 PID 2996 wrote to memory of 2664 2996 ddxpv.exe 42 PID 2996 wrote to memory of 2664 2996 ddxpv.exe 42 PID 2996 wrote to memory of 2664 2996 ddxpv.exe 42 PID 2996 wrote to memory of 2664 2996 ddxpv.exe 42 PID 2664 wrote to memory of 2344 2664 tdjnjtj.exe 43 PID 2664 wrote to memory of 2344 2664 tdjnjtj.exe 43 PID 2664 wrote to memory of 2344 2664 tdjnjtj.exe 43 PID 2664 wrote to memory of 2344 2664 tdjnjtj.exe 43 PID 2344 wrote to memory of 608 2344 nbbdd.exe 44 PID 2344 wrote to memory of 608 2344 nbbdd.exe 44 PID 2344 wrote to memory of 608 2344 nbbdd.exe 44 PID 2344 wrote to memory of 608 2344 nbbdd.exe 44 PID 608 wrote to memory of 1632 608 xpdvhd.exe 45 PID 608 wrote to memory of 1632 608 xpdvhd.exe 45 PID 608 wrote to memory of 1632 608 xpdvhd.exe 45 PID 608 wrote to memory of 1632 608 xpdvhd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\84200848d084711eaec802779f6b34e23ebe33e5af548d91c8cbd011ca4e2ad8N.exe"C:\Users\Admin\AppData\Local\Temp\84200848d084711eaec802779f6b34e23ebe33e5af548d91c8cbd011ca4e2ad8N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\bvtfjht.exec:\bvtfjht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\pphrjb.exec:\pphrjb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\drblxrl.exec:\drblxrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\frdlpvb.exec:\frdlpvb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\nnlpjt.exec:\nnlpjt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\vjnph.exec:\vjnph.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\djfjndd.exec:\djfjndd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\nnrdhfr.exec:\nnrdhfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\ntlld.exec:\ntlld.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\pjvtx.exec:\pjvtx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\nffdftd.exec:\nffdftd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\ddxpv.exec:\ddxpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\tdjnjtj.exec:\tdjnjtj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\nbbdd.exec:\nbbdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\xpdvhd.exec:\xpdvhd.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:608 -
\??\c:\phxnvdt.exec:\phxnvdt.exe17⤵
- Executes dropped EXE
PID:1632 -
\??\c:\fnrdfb.exec:\fnrdfb.exe18⤵
- Executes dropped EXE
PID:2352 -
\??\c:\jrfhxf.exec:\jrfhxf.exe19⤵
- Executes dropped EXE
PID:2216 -
\??\c:\ppttjb.exec:\ppttjb.exe20⤵
- Executes dropped EXE
PID:2384 -
\??\c:\fnlbx.exec:\fnlbx.exe21⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hxxtvv.exec:\hxxtvv.exe22⤵
- Executes dropped EXE
PID:2284 -
\??\c:\jnjfdtv.exec:\jnjfdtv.exe23⤵
- Executes dropped EXE
PID:900 -
\??\c:\ltnndd.exec:\ltnndd.exe24⤵
- Executes dropped EXE
PID:2000 -
\??\c:\hllvxl.exec:\hllvxl.exe25⤵
- Executes dropped EXE
PID:1812 -
\??\c:\tdbhfn.exec:\tdbhfn.exe26⤵
- Executes dropped EXE
PID:1600 -
\??\c:\drbrntd.exec:\drbrntd.exe27⤵
- Executes dropped EXE
PID:2568 -
\??\c:\prhrvh.exec:\prhrvh.exe28⤵
- Executes dropped EXE
PID:1308 -
\??\c:\bhtxb.exec:\bhtxb.exe29⤵
- Executes dropped EXE
PID:1312 -
\??\c:\njvxdh.exec:\njvxdh.exe30⤵
- Executes dropped EXE
PID:2808 -
\??\c:\xffjht.exec:\xffjht.exe31⤵
- Executes dropped EXE
PID:1820 -
\??\c:\npxnvd.exec:\npxnvd.exe32⤵
- Executes dropped EXE
PID:2616 -
\??\c:\hnltrx.exec:\hnltrx.exe33⤵
- Executes dropped EXE
PID:2288 -
\??\c:\llltx.exec:\llltx.exe34⤵
- Executes dropped EXE
PID:2596 -
\??\c:\dfxdb.exec:\dfxdb.exe35⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jhbptbx.exec:\jhbptbx.exe36⤵
- Executes dropped EXE
PID:2040 -
\??\c:\pftrbfb.exec:\pftrbfb.exe37⤵
- Executes dropped EXE
PID:2936 -
\??\c:\dlhddvh.exec:\dlhddvh.exe38⤵
- Executes dropped EXE
PID:2144 -
\??\c:\jvffpbp.exec:\jvffpbp.exe39⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xbvtdp.exec:\xbvtdp.exe40⤵
- Executes dropped EXE
PID:2220 -
\??\c:\lpvhnd.exec:\lpvhnd.exe41⤵
- Executes dropped EXE
PID:3048 -
\??\c:\jlvjtdn.exec:\jlvjtdn.exe42⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jxvfb.exec:\jxvfb.exe43⤵
- Executes dropped EXE
PID:2840 -
\??\c:\bvxrfxf.exec:\bvxrfxf.exe44⤵
- Executes dropped EXE
PID:2524 -
\??\c:\nrbnnf.exec:\nrbnnf.exe45⤵
- Executes dropped EXE
PID:1968 -
\??\c:\fxdjltp.exec:\fxdjltp.exe46⤵
- Executes dropped EXE
PID:2988 -
\??\c:\ftttbrr.exec:\ftttbrr.exe47⤵
- Executes dropped EXE
PID:2784 -
\??\c:\bvndptn.exec:\bvndptn.exe48⤵
- Executes dropped EXE
PID:2904 -
\??\c:\hfvnjp.exec:\hfvnjp.exe49⤵
- Executes dropped EXE
PID:2868 -
\??\c:\lfdbhpt.exec:\lfdbhpt.exe50⤵
- Executes dropped EXE
PID:1460 -
\??\c:\bddvl.exec:\bddvl.exe51⤵
- Executes dropped EXE
PID:1952 -
\??\c:\xlxjbh.exec:\xlxjbh.exe52⤵
- Executes dropped EXE
PID:1500 -
\??\c:\djhdbhj.exec:\djhdbhj.exe53⤵
- Executes dropped EXE
PID:1780 -
\??\c:\prdxnnn.exec:\prdxnnn.exe54⤵
- Executes dropped EXE
PID:2032 -
\??\c:\hdtxnf.exec:\hdtxnf.exe55⤵
- Executes dropped EXE
PID:1148 -
\??\c:\bjndbh.exec:\bjndbh.exe56⤵
- Executes dropped EXE
PID:1632 -
\??\c:\pxhhdn.exec:\pxhhdn.exe57⤵
- Executes dropped EXE
PID:2268 -
\??\c:\jxvvxl.exec:\jxvvxl.exe58⤵
- Executes dropped EXE
PID:2060 -
\??\c:\rtvvhdv.exec:\rtvvhdv.exe59⤵
- Executes dropped EXE
PID:864 -
\??\c:\xnnlrhj.exec:\xnnlrhj.exe60⤵
- Executes dropped EXE
PID:2404 -
\??\c:\rtllhnn.exec:\rtllhnn.exe61⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vlvblvn.exec:\vlvblvn.exe62⤵
- Executes dropped EXE
PID:2064 -
\??\c:\dbdlbpr.exec:\dbdlbpr.exe63⤵
- Executes dropped EXE
PID:836 -
\??\c:\hxvvhrf.exec:\hxvvhrf.exe64⤵
- Executes dropped EXE
PID:2776 -
\??\c:\vvdffhx.exec:\vvdffhx.exe65⤵
- Executes dropped EXE
PID:1320 -
\??\c:\rflvhhb.exec:\rflvhhb.exe66⤵PID:1972
-
\??\c:\bbrrdnb.exec:\bbrrdnb.exe67⤵PID:2584
-
\??\c:\jlxthb.exec:\jlxthb.exe68⤵PID:2520
-
\??\c:\xvjrl.exec:\xvjrl.exe69⤵PID:1708
-
\??\c:\xvddv.exec:\xvddv.exe70⤵PID:2072
-
\??\c:\pdhbvpd.exec:\pdhbvpd.exe71⤵PID:932
-
\??\c:\rppxfn.exec:\rppxfn.exe72⤵
- System Location Discovery: System Language Discovery
PID:1808 -
\??\c:\tjbdnlp.exec:\tjbdnlp.exe73⤵PID:1668
-
\??\c:\rhbrxp.exec:\rhbrxp.exe74⤵PID:888
-
\??\c:\nlpvfpf.exec:\nlpvfpf.exe75⤵PID:1688
-
\??\c:\hlrxbtv.exec:\hlrxbtv.exe76⤵PID:2164
-
\??\c:\fdprhx.exec:\fdprhx.exe77⤵PID:2948
-
\??\c:\xxrtb.exec:\xxrtb.exe78⤵
- System Location Discovery: System Language Discovery
PID:1984 -
\??\c:\ntbbnj.exec:\ntbbnj.exe79⤵PID:584
-
\??\c:\vthhx.exec:\vthhx.exe80⤵PID:2004
-
\??\c:\rxffv.exec:\rxffv.exe81⤵PID:2008
-
\??\c:\bbfjvr.exec:\bbfjvr.exe82⤵PID:2940
-
\??\c:\xhvnr.exec:\xhvnr.exe83⤵PID:3060
-
\??\c:\blrtnvh.exec:\blrtnvh.exe84⤵PID:2016
-
\??\c:\fvjhv.exec:\fvjhv.exe85⤵PID:2812
-
\??\c:\jbjbd.exec:\jbjbd.exe86⤵PID:2444
-
\??\c:\rhnttd.exec:\rhnttd.exe87⤵PID:1552
-
\??\c:\vnrhhnh.exec:\vnrhhnh.exe88⤵PID:984
-
\??\c:\fvjpn.exec:\fvjpn.exe89⤵PID:3004
-
\??\c:\fbfbptx.exec:\fbfbptx.exe90⤵
- System Location Discovery: System Language Discovery
PID:944 -
\??\c:\tnpbf.exec:\tnpbf.exe91⤵PID:2904
-
\??\c:\rtdhdtj.exec:\rtdhdtj.exe92⤵PID:3056
-
\??\c:\fntphp.exec:\fntphp.exe93⤵PID:2740
-
\??\c:\fvbvj.exec:\fvbvj.exe94⤵PID:1108
-
\??\c:\bltntx.exec:\bltntx.exe95⤵PID:2560
-
\??\c:\bfhjpjh.exec:\bfhjpjh.exe96⤵PID:1324
-
\??\c:\flntxx.exec:\flntxx.exe97⤵PID:1548
-
\??\c:\brljbp.exec:\brljbp.exe98⤵PID:580
-
\??\c:\vfxlf.exec:\vfxlf.exe99⤵PID:588
-
\??\c:\ltddnd.exec:\ltddnd.exe100⤵PID:2292
-
\??\c:\brfpppj.exec:\brfpppj.exe101⤵PID:2124
-
\??\c:\xrhtvpd.exec:\xrhtvpd.exe102⤵PID:2412
-
\??\c:\rvbllrt.exec:\rvbllrt.exe103⤵PID:2428
-
\??\c:\vbltt.exec:\vbltt.exe104⤵PID:2328
-
\??\c:\pjltx.exec:\pjltx.exe105⤵PID:1164
-
\??\c:\ffhvbd.exec:\ffhvbd.exe106⤵PID:1992
-
\??\c:\ffhnvnb.exec:\ffhnvnb.exe107⤵PID:756
-
\??\c:\dxfvn.exec:\dxfvn.exe108⤵PID:1812
-
\??\c:\vlxjff.exec:\vlxjff.exe109⤵PID:1972
-
\??\c:\jddrnvr.exec:\jddrnvr.exe110⤵PID:2576
-
\??\c:\vndhfrp.exec:\vndhfrp.exe111⤵
- System Location Discovery: System Language Discovery
PID:1656 -
\??\c:\vbdrlj.exec:\vbdrlj.exe112⤵PID:1744
-
\??\c:\vrppjx.exec:\vrppjx.exe113⤵PID:1308
-
\??\c:\tfvljbx.exec:\tfvljbx.exe114⤵PID:2604
-
\??\c:\lflhjnx.exec:\lflhjnx.exe115⤵PID:1748
-
\??\c:\fndph.exec:\fndph.exe116⤵PID:1528
-
\??\c:\lrvvd.exec:\lrvvd.exe117⤵PID:2116
-
\??\c:\jjnnlft.exec:\jjnnlft.exe118⤵PID:2368
-
\??\c:\jhfdjx.exec:\jhfdjx.exe119⤵PID:2192
-
\??\c:\djhph.exec:\djhph.exe120⤵PID:2956
-
\??\c:\fvjxx.exec:\fvjxx.exe121⤵PID:1620
-
\??\c:\ljbtbhn.exec:\ljbtbhn.exe122⤵PID:1224
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-