Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 17:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b53bf9f48fd6c6e60beb8d83bfb342469683ff63800cc6aead992d9f91b89218N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b53bf9f48fd6c6e60beb8d83bfb342469683ff63800cc6aead992d9f91b89218N.exe
-
Size
347KB
-
MD5
e67456807eec1556ff8ac3ab1fb0e730
-
SHA1
764672441abefe7fc52d44a59e9a0730a8ba1937
-
SHA256
b53bf9f48fd6c6e60beb8d83bfb342469683ff63800cc6aead992d9f91b89218
-
SHA512
b03fc8333717f7e9ad7d2aadc10c8d01e8ff5c247fe7aec150565ace1d050f6b501c5c67eaaef524a05bb218584481b088a9834fcc09876a286e66c5dd334db0
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYA1:l7TcbWXZshJX2VGd1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2592-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2896-19-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3000-16-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3020-43-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2744-66-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2772-55-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1476-52-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2648-81-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1660-93-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2092-102-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2128-110-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2836-134-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2152-152-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2252-172-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2272-184-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2228-181-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1540-193-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2252-210-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/320-209-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/948-226-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1552-237-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1752-235-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1544-262-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2592-298-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2592-302-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2868-365-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2928-378-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1144-392-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2188-417-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/856-438-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1536-444-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1776-453-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2144-474-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/704-502-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1840-515-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2632-590-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2948-609-0x0000000000430000-0x0000000000458000-memory.dmp family_blackmoon behavioral1/memory/2804-657-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2940-720-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/980-768-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/2148-856-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3024-977-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3000 vtddff.exe 2896 rbxptvh.exe 2900 ddfnj.exe 3020 jhdvrd.exe 1476 ldfph.exe 2772 xvhldl.exe 2744 rpfxdlv.exe 2648 hjhpbfb.exe 1744 hdhftj.exe 1660 blpdvh.exe 2092 rhfjj.exe 2128 pjtjpbd.exe 2368 blnlrld.exe 2836 xnhxvh.exe 2504 lndtt.exe 2152 xfjhv.exe 1548 lpfvj.exe 2252 jjrlb.exe 2228 dfxdxv.exe 2272 tdplp.exe 1540 nrnvjj.exe 320 rjxnl.exe 760 nbplnfd.exe 948 xvlbtdx.exe 1752 nxjhx.exe 1552 bnhfx.exe 1084 hhftdn.exe 1544 lrjxf.exe 2364 jpbtxff.exe 1060 vddjhlj.exe 1200 rdnbb.exe 2652 lljht.exe 2592 htpdftp.exe 2632 dtxnpf.exe 2472 rffbf.exe 2960 bnjdx.exe 2856 ptfvfbl.exe 2324 flrffbh.exe 2372 hprlnh.exe 3068 pvdjt.exe 2672 bhndrpv.exe 1376 xbxdnpv.exe 2868 thlpn.exe 2436 thtlpjf.exe 2928 fnpbtr.exe 388 hvfrv.exe 1144 xrdffj.exe 2080 bnvfph.exe 928 vvxxb.exe 2444 nnlvd.exe 2188 pxfhnl.exe 2844 dvvbtjb.exe 2940 nrvlxrr.exe 856 drrxtl.exe 1536 vvjpfh.exe 1776 pfjdf.exe 2708 hlnflhd.exe 1204 ldxxh.exe 2144 xjvjl.exe 2276 hbbln.exe 980 thjvnd.exe 1992 nrhdr.exe 2428 fdxld.exe 704 xnhnxfv.exe -
resource yara_rule behavioral1/memory/2592-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2896-19-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3000-16-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3020-36-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1476-45-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3020-43-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2744-66-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2772-55-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1476-52-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2648-81-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1660-93-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2092-102-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2128-110-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2836-134-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2152-152-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2252-163-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2228-173-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2252-172-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2272-184-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2228-181-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1540-193-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/320-209-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/948-226-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1552-237-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1752-235-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1544-254-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1544-262-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2592-302-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2672-346-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2868-365-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2928-378-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/388-379-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1144-392-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2844-418-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1536-444-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1776-453-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2144-474-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/704-502-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1840-515-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2148-570-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2216-583-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2632-590-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2916-616-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2804-657-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2700-688-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1956-721-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1096-773-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2208-780-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/792-787-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2268-831-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2148-856-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/592-943-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2624-946-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3024-971-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2520-1028-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/900-1080-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxbrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfdxrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftldf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhjvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfnbtnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpxjpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvbtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxtlrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxhrtrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xltvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txphtfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndlfpfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjhvjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlndlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rppjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldjlptr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbfpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnbhfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jllnfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrhxvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtldjtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvtpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjfvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htjnnhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thjvnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrvfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnphhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddxhllb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdjxphj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blbxfdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thlpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnvvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thprr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtfhbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvtvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjdfbxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjfxbl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2592 wrote to memory of 3000 2592 b53bf9f48fd6c6e60beb8d83bfb342469683ff63800cc6aead992d9f91b89218N.exe 30 PID 2592 wrote to memory of 3000 2592 b53bf9f48fd6c6e60beb8d83bfb342469683ff63800cc6aead992d9f91b89218N.exe 30 PID 2592 wrote to memory of 3000 2592 b53bf9f48fd6c6e60beb8d83bfb342469683ff63800cc6aead992d9f91b89218N.exe 30 PID 2592 wrote to memory of 3000 2592 b53bf9f48fd6c6e60beb8d83bfb342469683ff63800cc6aead992d9f91b89218N.exe 30 PID 3000 wrote to memory of 2896 3000 vtddff.exe 31 PID 3000 wrote to memory of 2896 3000 vtddff.exe 31 PID 3000 wrote to memory of 2896 3000 vtddff.exe 31 PID 3000 wrote to memory of 2896 3000 vtddff.exe 31 PID 2896 wrote to memory of 2900 2896 rbxptvh.exe 32 PID 2896 wrote to memory of 2900 2896 rbxptvh.exe 32 PID 2896 wrote to memory of 2900 2896 rbxptvh.exe 32 PID 2896 wrote to memory of 2900 2896 rbxptvh.exe 32 PID 2900 wrote to memory of 3020 2900 ddfnj.exe 33 PID 2900 wrote to memory of 3020 2900 ddfnj.exe 33 PID 2900 wrote to memory of 3020 2900 ddfnj.exe 33 PID 2900 wrote to memory of 3020 2900 ddfnj.exe 33 PID 3020 wrote to memory of 1476 3020 jhdvrd.exe 34 PID 3020 wrote to memory of 1476 3020 jhdvrd.exe 34 PID 3020 wrote to memory of 1476 3020 jhdvrd.exe 34 PID 3020 wrote to memory of 1476 3020 jhdvrd.exe 34 PID 1476 wrote to memory of 2772 1476 ldfph.exe 35 PID 1476 wrote to memory of 2772 1476 ldfph.exe 35 PID 1476 wrote to memory of 2772 1476 ldfph.exe 35 PID 1476 wrote to memory of 2772 1476 ldfph.exe 35 PID 2772 wrote to memory of 2744 2772 xvhldl.exe 36 PID 2772 wrote to memory of 2744 2772 xvhldl.exe 36 PID 2772 wrote to memory of 2744 2772 xvhldl.exe 36 PID 2772 wrote to memory of 2744 2772 xvhldl.exe 36 PID 2744 wrote to memory of 2648 2744 rpfxdlv.exe 37 PID 2744 wrote to memory of 2648 2744 rpfxdlv.exe 37 PID 2744 wrote to memory of 2648 2744 rpfxdlv.exe 37 PID 2744 wrote to memory of 2648 2744 rpfxdlv.exe 37 PID 2648 wrote to memory of 1744 2648 hjhpbfb.exe 38 PID 2648 wrote to memory of 1744 2648 hjhpbfb.exe 38 PID 2648 wrote to memory of 1744 2648 hjhpbfb.exe 38 PID 2648 wrote to memory of 1744 2648 hjhpbfb.exe 38 PID 1744 wrote to memory of 1660 1744 hdhftj.exe 39 PID 1744 wrote to memory of 1660 1744 hdhftj.exe 39 PID 1744 wrote to memory of 1660 1744 hdhftj.exe 39 PID 1744 wrote to memory of 1660 1744 hdhftj.exe 39 PID 1660 wrote to memory of 2092 1660 blpdvh.exe 40 PID 1660 wrote to memory of 2092 1660 blpdvh.exe 40 PID 1660 wrote to memory of 2092 1660 blpdvh.exe 40 PID 1660 wrote to memory of 2092 1660 blpdvh.exe 40 PID 2092 wrote to memory of 2128 2092 rhfjj.exe 41 PID 2092 wrote to memory of 2128 2092 rhfjj.exe 41 PID 2092 wrote to memory of 2128 2092 rhfjj.exe 41 PID 2092 wrote to memory of 2128 2092 rhfjj.exe 41 PID 2128 wrote to memory of 2368 2128 pjtjpbd.exe 42 PID 2128 wrote to memory of 2368 2128 pjtjpbd.exe 42 PID 2128 wrote to memory of 2368 2128 pjtjpbd.exe 42 PID 2128 wrote to memory of 2368 2128 pjtjpbd.exe 42 PID 2368 wrote to memory of 2836 2368 blnlrld.exe 43 PID 2368 wrote to memory of 2836 2368 blnlrld.exe 43 PID 2368 wrote to memory of 2836 2368 blnlrld.exe 43 PID 2368 wrote to memory of 2836 2368 blnlrld.exe 43 PID 2836 wrote to memory of 2504 2836 xnhxvh.exe 44 PID 2836 wrote to memory of 2504 2836 xnhxvh.exe 44 PID 2836 wrote to memory of 2504 2836 xnhxvh.exe 44 PID 2836 wrote to memory of 2504 2836 xnhxvh.exe 44 PID 2504 wrote to memory of 2152 2504 lndtt.exe 45 PID 2504 wrote to memory of 2152 2504 lndtt.exe 45 PID 2504 wrote to memory of 2152 2504 lndtt.exe 45 PID 2504 wrote to memory of 2152 2504 lndtt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b53bf9f48fd6c6e60beb8d83bfb342469683ff63800cc6aead992d9f91b89218N.exe"C:\Users\Admin\AppData\Local\Temp\b53bf9f48fd6c6e60beb8d83bfb342469683ff63800cc6aead992d9f91b89218N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\vtddff.exec:\vtddff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\rbxptvh.exec:\rbxptvh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\ddfnj.exec:\ddfnj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\jhdvrd.exec:\jhdvrd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\ldfph.exec:\ldfph.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\xvhldl.exec:\xvhldl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\rpfxdlv.exec:\rpfxdlv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\hjhpbfb.exec:\hjhpbfb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\hdhftj.exec:\hdhftj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\blpdvh.exec:\blpdvh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\rhfjj.exec:\rhfjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\pjtjpbd.exec:\pjtjpbd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\blnlrld.exec:\blnlrld.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\xnhxvh.exec:\xnhxvh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\lndtt.exec:\lndtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\xfjhv.exec:\xfjhv.exe17⤵
- Executes dropped EXE
PID:2152 -
\??\c:\lpfvj.exec:\lpfvj.exe18⤵
- Executes dropped EXE
PID:1548 -
\??\c:\jjrlb.exec:\jjrlb.exe19⤵
- Executes dropped EXE
PID:2252 -
\??\c:\dfxdxv.exec:\dfxdxv.exe20⤵
- Executes dropped EXE
PID:2228 -
\??\c:\tdplp.exec:\tdplp.exe21⤵
- Executes dropped EXE
PID:2272 -
\??\c:\nrnvjj.exec:\nrnvjj.exe22⤵
- Executes dropped EXE
PID:1540 -
\??\c:\rjxnl.exec:\rjxnl.exe23⤵
- Executes dropped EXE
PID:320 -
\??\c:\nbplnfd.exec:\nbplnfd.exe24⤵
- Executes dropped EXE
PID:760 -
\??\c:\xvlbtdx.exec:\xvlbtdx.exe25⤵
- Executes dropped EXE
PID:948 -
\??\c:\nxjhx.exec:\nxjhx.exe26⤵
- Executes dropped EXE
PID:1752 -
\??\c:\bnhfx.exec:\bnhfx.exe27⤵
- Executes dropped EXE
PID:1552 -
\??\c:\hhftdn.exec:\hhftdn.exe28⤵
- Executes dropped EXE
PID:1084 -
\??\c:\lrjxf.exec:\lrjxf.exe29⤵
- Executes dropped EXE
PID:1544 -
\??\c:\jpbtxff.exec:\jpbtxff.exe30⤵
- Executes dropped EXE
PID:2364 -
\??\c:\vddjhlj.exec:\vddjhlj.exe31⤵
- Executes dropped EXE
PID:1060 -
\??\c:\rdnbb.exec:\rdnbb.exe32⤵
- Executes dropped EXE
PID:1200 -
\??\c:\lljht.exec:\lljht.exe33⤵
- Executes dropped EXE
PID:2652 -
\??\c:\htpdftp.exec:\htpdftp.exe34⤵
- Executes dropped EXE
PID:2592 -
\??\c:\dtxnpf.exec:\dtxnpf.exe35⤵
- Executes dropped EXE
PID:2632 -
\??\c:\rffbf.exec:\rffbf.exe36⤵
- Executes dropped EXE
PID:2472 -
\??\c:\bnjdx.exec:\bnjdx.exe37⤵
- Executes dropped EXE
PID:2960 -
\??\c:\ptfvfbl.exec:\ptfvfbl.exe38⤵
- Executes dropped EXE
PID:2856 -
\??\c:\flrffbh.exec:\flrffbh.exe39⤵
- Executes dropped EXE
PID:2324 -
\??\c:\hprlnh.exec:\hprlnh.exe40⤵
- Executes dropped EXE
PID:2372 -
\??\c:\pvdjt.exec:\pvdjt.exe41⤵
- Executes dropped EXE
PID:3068 -
\??\c:\bhndrpv.exec:\bhndrpv.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\xbxdnpv.exec:\xbxdnpv.exe43⤵
- Executes dropped EXE
PID:1376 -
\??\c:\thlpn.exec:\thlpn.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2868 -
\??\c:\thtlpjf.exec:\thtlpjf.exe45⤵
- Executes dropped EXE
PID:2436 -
\??\c:\fnpbtr.exec:\fnpbtr.exe46⤵
- Executes dropped EXE
PID:2928 -
\??\c:\hvfrv.exec:\hvfrv.exe47⤵
- Executes dropped EXE
PID:388 -
\??\c:\xrdffj.exec:\xrdffj.exe48⤵
- Executes dropped EXE
PID:1144 -
\??\c:\bnvfph.exec:\bnvfph.exe49⤵
- Executes dropped EXE
PID:2080 -
\??\c:\vvxxb.exec:\vvxxb.exe50⤵
- Executes dropped EXE
PID:928 -
\??\c:\nnlvd.exec:\nnlvd.exe51⤵
- Executes dropped EXE
PID:2444 -
\??\c:\pxfhnl.exec:\pxfhnl.exe52⤵
- Executes dropped EXE
PID:2188 -
\??\c:\dvvbtjb.exec:\dvvbtjb.exe53⤵
- Executes dropped EXE
PID:2844 -
\??\c:\nrvlxrr.exec:\nrvlxrr.exe54⤵
- Executes dropped EXE
PID:2940 -
\??\c:\drrxtl.exec:\drrxtl.exe55⤵
- Executes dropped EXE
PID:856 -
\??\c:\vvjpfh.exec:\vvjpfh.exe56⤵
- Executes dropped EXE
PID:1536 -
\??\c:\pfjdf.exec:\pfjdf.exe57⤵
- Executes dropped EXE
PID:1776 -
\??\c:\hlnflhd.exec:\hlnflhd.exe58⤵
- Executes dropped EXE
PID:2708 -
\??\c:\ldxxh.exec:\ldxxh.exe59⤵
- Executes dropped EXE
PID:1204 -
\??\c:\xjvjl.exec:\xjvjl.exe60⤵
- Executes dropped EXE
PID:2144 -
\??\c:\hbbln.exec:\hbbln.exe61⤵
- Executes dropped EXE
PID:2276 -
\??\c:\thjvnd.exec:\thjvnd.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:980 -
\??\c:\nrhdr.exec:\nrhdr.exe63⤵
- Executes dropped EXE
PID:1992 -
\??\c:\fdxld.exec:\fdxld.exe64⤵
- Executes dropped EXE
PID:2428 -
\??\c:\xnhnxfv.exec:\xnhnxfv.exe65⤵
- Executes dropped EXE
PID:704 -
\??\c:\tllvjrx.exec:\tllvjrx.exe66⤵PID:1840
-
\??\c:\vnbhrp.exec:\vnbhrp.exe67⤵PID:1572
-
\??\c:\ttpfrbh.exec:\ttpfrbh.exe68⤵PID:776
-
\??\c:\thvjddb.exec:\thvjddb.exe69⤵PID:112
-
\??\c:\lphxdd.exec:\lphxdd.exe70⤵PID:1384
-
\??\c:\rhdbp.exec:\rhdbp.exe71⤵PID:2600
-
\??\c:\rflbjpv.exec:\rflbjpv.exe72⤵PID:2660
-
\??\c:\vvllbjp.exec:\vvllbjp.exe73⤵PID:2492
-
\??\c:\nxxprd.exec:\nxxprd.exe74⤵PID:1060
-
\??\c:\hbjbf.exec:\hbjbf.exe75⤵PID:2336
-
\??\c:\dxjxhh.exec:\dxjxhh.exe76⤵PID:2148
-
\??\c:\tvvjdfh.exec:\tvvjdfh.exe77⤵PID:1604
-
\??\c:\ljplnj.exec:\ljplnj.exe78⤵PID:2216
-
\??\c:\rnpjv.exec:\rnpjv.exe79⤵PID:2632
-
\??\c:\jhtdb.exec:\jhtdb.exe80⤵PID:2888
-
\??\c:\hddfx.exec:\hddfx.exe81⤵PID:2948
-
\??\c:\frpldnv.exec:\frpldnv.exe82⤵PID:2944
-
\??\c:\bxhphf.exec:\bxhphf.exe83⤵PID:2916
-
\??\c:\htxxp.exec:\htxxp.exe84⤵PID:2176
-
\??\c:\hdjxh.exec:\hdjxh.exe85⤵PID:2768
-
\??\c:\fvfpjd.exec:\fvfpjd.exe86⤵PID:2804
-
\??\c:\xllxl.exec:\xllxl.exe87⤵PID:2612
-
\??\c:\dddbhbj.exec:\dddbhbj.exe88⤵PID:2608
-
\??\c:\xtptj.exec:\xtptj.exe89⤵PID:2180
-
\??\c:\pxhxvt.exec:\pxhxvt.exe90⤵PID:568
-
\??\c:\drnvrrv.exec:\drnvrrv.exe91⤵PID:2360
-
\??\c:\bfjrdr.exec:\bfjrdr.exe92⤵PID:3056
-
\??\c:\pxnvvb.exec:\pxnvvb.exe93⤵PID:2196
-
\??\c:\ljpjvff.exec:\ljpjvff.exe94⤵PID:2700
-
\??\c:\dhdtn.exec:\dhdtn.exe95⤵PID:3032
-
\??\c:\xltbnx.exec:\xltbnx.exe96⤵PID:1972
-
\??\c:\bffvxv.exec:\bffvxv.exe97⤵PID:2420
-
\??\c:\hdbjl.exec:\hdbjl.exe98⤵PID:2940
-
\??\c:\pplvhlp.exec:\pplvhlp.exe99⤵PID:1956
-
\??\c:\vdlxf.exec:\vdlxf.exe100⤵PID:2260
-
\??\c:\bltftdf.exec:\bltftdf.exe101⤵PID:2252
-
\??\c:\bxhjpd.exec:\bxhjpd.exe102⤵PID:2568
-
\??\c:\lbpnrt.exec:\lbpnrt.exe103⤵PID:1204
-
\??\c:\nlnhb.exec:\nlnhb.exe104⤵PID:2212
-
\??\c:\lxpnp.exec:\lxpnp.exe105⤵PID:2272
-
\??\c:\phxhdb.exec:\phxhdb.exe106⤵PID:980
-
\??\c:\vdjtbdd.exec:\vdjtbdd.exe107⤵PID:1096
-
\??\c:\bdlffb.exec:\bdlffb.exe108⤵PID:2208
-
\??\c:\hlrbbpt.exec:\hlrbbpt.exe109⤵PID:792
-
\??\c:\hhvjt.exec:\hhvjt.exe110⤵PID:1380
-
\??\c:\djlhftl.exec:\djlhftl.exe111⤵PID:1472
-
\??\c:\hhdlllh.exec:\hhdlllh.exe112⤵PID:1128
-
\??\c:\jxdbtt.exec:\jxdbtt.exe113⤵PID:112
-
\??\c:\brrjj.exec:\brrjj.exe114⤵PID:1768
-
\??\c:\lfphbn.exec:\lfphbn.exe115⤵PID:1544
-
\??\c:\rvlllp.exec:\rvlllp.exe116⤵PID:2268
-
\??\c:\rrndvr.exec:\rrndvr.exe117⤵PID:1156
-
\??\c:\pfjhhr.exec:\pfjhhr.exe118⤵PID:1060
-
\??\c:\hrhhvbd.exec:\hrhhvbd.exe119⤵PID:1780
-
\??\c:\fpxxhj.exec:\fpxxhj.exe120⤵PID:2148
-
\??\c:\fdpxrf.exec:\fdpxrf.exe121⤵PID:2876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-