Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 17:45
Behavioral task
behavioral1
Sample
7ca8035f82649ace2568d72281919289e12d7f7628ee64d4fd0cc014dd3ad89e.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
7ca8035f82649ace2568d72281919289e12d7f7628ee64d4fd0cc014dd3ad89e.exe
-
Size
97KB
-
MD5
5edadfd1abb63bbec55a6853de1eb46d
-
SHA1
00d79841b80e66268f2638d6649708eef273e9f4
-
SHA256
7ca8035f82649ace2568d72281919289e12d7f7628ee64d4fd0cc014dd3ad89e
-
SHA512
74fbaf462fb08cf2e1b528e2d2e6d195153a2c685d836f2582d50e9de2b6938ee4f458072283be35e2ce6967dc9196111e253d5fd189a61190d3bcf7fefcd47a
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzgRy:8cm4FmowdHoSgWrXUgs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2336-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-51-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2848-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-66-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2916-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/676-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1304-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3000-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2140-117-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1192-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1140-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/956-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-193-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/852-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1428-227-0x00000000002D0000-0x00000000002F7000-memory.dmp family_blackmoon behavioral1/memory/1520-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-368-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2340-385-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1192-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1832-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1280-433-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/560-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/560-441-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/560-458-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2392-464-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2380-475-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1796-502-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-543-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-549-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/884-555-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/932-820-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/844-841-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2604 vbndlrv.exe 1736 nnpdp.exe 2476 bldrpr.exe 2956 hfdttdv.exe 2848 txdbjd.exe 2928 jxdjd.exe 2916 dblbt.exe 2780 tdbnft.exe 2752 fbrdrrx.exe 676 vbjvp.exe 1304 dnnnr.exe 3000 pbbfdlf.exe 2140 lthprpd.exe 1192 lfnvxht.exe 2448 plbnh.exe 2036 pbvnfnd.exe 1140 fnptn.exe 956 ljdvf.exe 2464 nttxtnl.exe 2300 nfbvr.exe 2264 pjxvnd.exe 2176 tbvhpb.exe 320 bhbjlt.exe 852 vhjtjt.exe 1532 bxjpdtt.exe 2612 htfrbnr.exe 1428 ntjvj.exe 772 rhpbfd.exe 1060 hfhftlp.exe 1684 lvxvvxd.exe 1356 bxjtb.exe 2620 pvjhxnb.exe 1108 djjprfx.exe 2668 pjrxdn.exe 1520 frfpf.exe 1696 lxdfplh.exe 1704 pttxn.exe 1588 fthnl.exe 3032 tvbhvhn.exe 2932 ndnxxlr.exe 2888 lflfb.exe 2984 xrbnlh.exe 2896 vbdxj.exe 2884 lftxxvf.exe 2876 jlhjd.exe 2860 bhddpff.exe 2224 nldrxvl.exe 2908 vfxftv.exe 2736 tvprv.exe 2340 hnhbxt.exe 2756 vhldd.exe 2356 bllxf.exe 2212 hjpfnnh.exe 960 frpvn.exe 2844 rdbpb.exe 592 ldxfljd.exe 2132 fnphxh.exe 1192 lvnrh.exe 1832 ldbtf.exe 1100 xvxjht.exe 2288 fxftb.exe 1280 lfhfv.exe 560 ddjlbp.exe 2272 lphhv.exe -
resource yara_rule behavioral1/memory/2336-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000012263-7.dat upx behavioral1/memory/2604-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2336-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000019515-18.dat upx behavioral1/memory/1736-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000195ab-27.dat upx behavioral1/memory/2604-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000195ad-34.dat upx behavioral1/memory/2956-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000195b1-42.dat upx behavioral1/memory/2848-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000195b3-49.dat upx behavioral1/files/0x00060000000195b5-59.dat upx behavioral1/memory/2928-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000195b7-69.dat upx behavioral1/memory/2916-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000195bb-76.dat upx behavioral1/memory/2780-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001957c-83.dat upx behavioral1/files/0x000500000001a469-93.dat upx behavioral1/memory/676-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2752-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a46d-99.dat upx behavioral1/memory/1304-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a46f-110.dat upx behavioral1/memory/3000-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a471-118.dat upx behavioral1/memory/2140-117-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1192-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a473-127.dat upx behavioral1/files/0x000500000001a475-135.dat upx behavioral1/memory/2448-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a477-142.dat upx behavioral1/files/0x000500000001a479-150.dat upx behavioral1/memory/1140-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a47b-158.dat upx behavioral1/memory/956-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a47d-166.dat upx behavioral1/memory/2464-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a480-174.dat upx behavioral1/memory/2300-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a482-181.dat upx behavioral1/memory/2264-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a484-189.dat upx behavioral1/memory/320-193-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001a488-206.dat upx behavioral1/memory/852-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a486-199.dat upx behavioral1/memory/852-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a48a-213.dat upx behavioral1/files/0x000500000001a48d-220.dat upx behavioral1/files/0x000500000001a48f-229.dat upx behavioral1/memory/772-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a491-237.dat upx behavioral1/files/0x000500000001a493-246.dat upx behavioral1/memory/1684-253-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x000500000001a499-255.dat upx behavioral1/files/0x000500000001a49a-264.dat upx behavioral1/memory/1520-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1696-291-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1704-297-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3032-308-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2860-340-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjtbjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdlfbjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxtxdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddrhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dffjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvxpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhxppnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhdftf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjldtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxrxrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxdrtpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhvtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhfljj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhtjtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrrdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxftb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhfbfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvphn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjnbdth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npvndtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnxfxjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pptrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhtpdrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjpfnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvrxbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdtpbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrphhxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrrbjlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvfpjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvhpjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvftpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npdll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntlhnnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xldltfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2604 2336 7ca8035f82649ace2568d72281919289e12d7f7628ee64d4fd0cc014dd3ad89e.exe 29 PID 2336 wrote to memory of 2604 2336 7ca8035f82649ace2568d72281919289e12d7f7628ee64d4fd0cc014dd3ad89e.exe 29 PID 2336 wrote to memory of 2604 2336 7ca8035f82649ace2568d72281919289e12d7f7628ee64d4fd0cc014dd3ad89e.exe 29 PID 2336 wrote to memory of 2604 2336 7ca8035f82649ace2568d72281919289e12d7f7628ee64d4fd0cc014dd3ad89e.exe 29 PID 2604 wrote to memory of 1736 2604 vbndlrv.exe 30 PID 2604 wrote to memory of 1736 2604 vbndlrv.exe 30 PID 2604 wrote to memory of 1736 2604 vbndlrv.exe 30 PID 2604 wrote to memory of 1736 2604 vbndlrv.exe 30 PID 1736 wrote to memory of 2476 1736 nnpdp.exe 31 PID 1736 wrote to memory of 2476 1736 nnpdp.exe 31 PID 1736 wrote to memory of 2476 1736 nnpdp.exe 31 PID 1736 wrote to memory of 2476 1736 nnpdp.exe 31 PID 2476 wrote to memory of 2956 2476 bldrpr.exe 32 PID 2476 wrote to memory of 2956 2476 bldrpr.exe 32 PID 2476 wrote to memory of 2956 2476 bldrpr.exe 32 PID 2476 wrote to memory of 2956 2476 bldrpr.exe 32 PID 2956 wrote to memory of 2848 2956 hfdttdv.exe 33 PID 2956 wrote to memory of 2848 2956 hfdttdv.exe 33 PID 2956 wrote to memory of 2848 2956 hfdttdv.exe 33 PID 2956 wrote to memory of 2848 2956 hfdttdv.exe 33 PID 2848 wrote to memory of 2928 2848 txdbjd.exe 34 PID 2848 wrote to memory of 2928 2848 txdbjd.exe 34 PID 2848 wrote to memory of 2928 2848 txdbjd.exe 34 PID 2848 wrote to memory of 2928 2848 txdbjd.exe 34 PID 2928 wrote to memory of 2916 2928 jxdjd.exe 35 PID 2928 wrote to memory of 2916 2928 jxdjd.exe 35 PID 2928 wrote to memory of 2916 2928 jxdjd.exe 35 PID 2928 wrote to memory of 2916 2928 jxdjd.exe 35 PID 2916 wrote to memory of 2780 2916 dblbt.exe 36 PID 2916 wrote to memory of 2780 2916 dblbt.exe 36 PID 2916 wrote to memory of 2780 2916 dblbt.exe 36 PID 2916 wrote to memory of 2780 2916 dblbt.exe 36 PID 2780 wrote to memory of 2752 2780 tdbnft.exe 37 PID 2780 wrote to memory of 2752 2780 tdbnft.exe 37 PID 2780 wrote to memory of 2752 2780 tdbnft.exe 37 PID 2780 wrote to memory of 2752 2780 tdbnft.exe 37 PID 2752 wrote to memory of 676 2752 fbrdrrx.exe 38 PID 2752 wrote to memory of 676 2752 fbrdrrx.exe 38 PID 2752 wrote to memory of 676 2752 fbrdrrx.exe 38 PID 2752 wrote to memory of 676 2752 fbrdrrx.exe 38 PID 676 wrote to memory of 1304 676 vbjvp.exe 39 PID 676 wrote to memory of 1304 676 vbjvp.exe 39 PID 676 wrote to memory of 1304 676 vbjvp.exe 39 PID 676 wrote to memory of 1304 676 vbjvp.exe 39 PID 1304 wrote to memory of 3000 1304 dnnnr.exe 40 PID 1304 wrote to memory of 3000 1304 dnnnr.exe 40 PID 1304 wrote to memory of 3000 1304 dnnnr.exe 40 PID 1304 wrote to memory of 3000 1304 dnnnr.exe 40 PID 3000 wrote to memory of 2140 3000 pbbfdlf.exe 41 PID 3000 wrote to memory of 2140 3000 pbbfdlf.exe 41 PID 3000 wrote to memory of 2140 3000 pbbfdlf.exe 41 PID 3000 wrote to memory of 2140 3000 pbbfdlf.exe 41 PID 2140 wrote to memory of 1192 2140 lthprpd.exe 42 PID 2140 wrote to memory of 1192 2140 lthprpd.exe 42 PID 2140 wrote to memory of 1192 2140 lthprpd.exe 42 PID 2140 wrote to memory of 1192 2140 lthprpd.exe 42 PID 1192 wrote to memory of 2448 1192 lfnvxht.exe 43 PID 1192 wrote to memory of 2448 1192 lfnvxht.exe 43 PID 1192 wrote to memory of 2448 1192 lfnvxht.exe 43 PID 1192 wrote to memory of 2448 1192 lfnvxht.exe 43 PID 2448 wrote to memory of 2036 2448 plbnh.exe 44 PID 2448 wrote to memory of 2036 2448 plbnh.exe 44 PID 2448 wrote to memory of 2036 2448 plbnh.exe 44 PID 2448 wrote to memory of 2036 2448 plbnh.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ca8035f82649ace2568d72281919289e12d7f7628ee64d4fd0cc014dd3ad89e.exe"C:\Users\Admin\AppData\Local\Temp\7ca8035f82649ace2568d72281919289e12d7f7628ee64d4fd0cc014dd3ad89e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\vbndlrv.exec:\vbndlrv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\nnpdp.exec:\nnpdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\bldrpr.exec:\bldrpr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\hfdttdv.exec:\hfdttdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\txdbjd.exec:\txdbjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\jxdjd.exec:\jxdjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\dblbt.exec:\dblbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\tdbnft.exec:\tdbnft.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\fbrdrrx.exec:\fbrdrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\vbjvp.exec:\vbjvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\dnnnr.exec:\dnnnr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\pbbfdlf.exec:\pbbfdlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\lthprpd.exec:\lthprpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\lfnvxht.exec:\lfnvxht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\plbnh.exec:\plbnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\pbvnfnd.exec:\pbvnfnd.exe17⤵
- Executes dropped EXE
PID:2036 -
\??\c:\fnptn.exec:\fnptn.exe18⤵
- Executes dropped EXE
PID:1140 -
\??\c:\ljdvf.exec:\ljdvf.exe19⤵
- Executes dropped EXE
PID:956 -
\??\c:\nttxtnl.exec:\nttxtnl.exe20⤵
- Executes dropped EXE
PID:2464 -
\??\c:\nfbvr.exec:\nfbvr.exe21⤵
- Executes dropped EXE
PID:2300 -
\??\c:\pjxvnd.exec:\pjxvnd.exe22⤵
- Executes dropped EXE
PID:2264 -
\??\c:\tbvhpb.exec:\tbvhpb.exe23⤵
- Executes dropped EXE
PID:2176 -
\??\c:\bhbjlt.exec:\bhbjlt.exe24⤵
- Executes dropped EXE
PID:320 -
\??\c:\vhjtjt.exec:\vhjtjt.exe25⤵
- Executes dropped EXE
PID:852 -
\??\c:\bxjpdtt.exec:\bxjpdtt.exe26⤵
- Executes dropped EXE
PID:1532 -
\??\c:\htfrbnr.exec:\htfrbnr.exe27⤵
- Executes dropped EXE
PID:2612 -
\??\c:\ntjvj.exec:\ntjvj.exe28⤵
- Executes dropped EXE
PID:1428 -
\??\c:\rhpbfd.exec:\rhpbfd.exe29⤵
- Executes dropped EXE
PID:772 -
\??\c:\hfhftlp.exec:\hfhftlp.exe30⤵
- Executes dropped EXE
PID:1060 -
\??\c:\lvxvvxd.exec:\lvxvvxd.exe31⤵
- Executes dropped EXE
PID:1684 -
\??\c:\bxjtb.exec:\bxjtb.exe32⤵
- Executes dropped EXE
PID:1356 -
\??\c:\pvjhxnb.exec:\pvjhxnb.exe33⤵
- Executes dropped EXE
PID:2620 -
\??\c:\djjprfx.exec:\djjprfx.exe34⤵
- Executes dropped EXE
PID:1108 -
\??\c:\pjrxdn.exec:\pjrxdn.exe35⤵
- Executes dropped EXE
PID:2668 -
\??\c:\frfpf.exec:\frfpf.exe36⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lxdfplh.exec:\lxdfplh.exe37⤵
- Executes dropped EXE
PID:1696 -
\??\c:\pttxn.exec:\pttxn.exe38⤵
- Executes dropped EXE
PID:1704 -
\??\c:\fthnl.exec:\fthnl.exe39⤵
- Executes dropped EXE
PID:1588 -
\??\c:\tvbhvhn.exec:\tvbhvhn.exe40⤵
- Executes dropped EXE
PID:3032 -
\??\c:\ndnxxlr.exec:\ndnxxlr.exe41⤵
- Executes dropped EXE
PID:2932 -
\??\c:\lflfb.exec:\lflfb.exe42⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xrbnlh.exec:\xrbnlh.exe43⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vbdxj.exec:\vbdxj.exe44⤵
- Executes dropped EXE
PID:2896 -
\??\c:\lftxxvf.exec:\lftxxvf.exe45⤵
- Executes dropped EXE
PID:2884 -
\??\c:\jlhjd.exec:\jlhjd.exe46⤵
- Executes dropped EXE
PID:2876 -
\??\c:\bhddpff.exec:\bhddpff.exe47⤵
- Executes dropped EXE
PID:2860 -
\??\c:\nldrxvl.exec:\nldrxvl.exe48⤵
- Executes dropped EXE
PID:2224 -
\??\c:\vfxftv.exec:\vfxftv.exe49⤵
- Executes dropped EXE
PID:2908 -
\??\c:\tvprv.exec:\tvprv.exe50⤵
- Executes dropped EXE
PID:2736 -
\??\c:\hnhbxt.exec:\hnhbxt.exe51⤵
- Executes dropped EXE
PID:2340 -
\??\c:\vhldd.exec:\vhldd.exe52⤵
- Executes dropped EXE
PID:2756 -
\??\c:\bllxf.exec:\bllxf.exe53⤵
- Executes dropped EXE
PID:2356 -
\??\c:\hjpfnnh.exec:\hjpfnnh.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2212 -
\??\c:\frpvn.exec:\frpvn.exe55⤵
- Executes dropped EXE
PID:960 -
\??\c:\rdbpb.exec:\rdbpb.exe56⤵
- Executes dropped EXE
PID:2844 -
\??\c:\ldxfljd.exec:\ldxfljd.exe57⤵
- Executes dropped EXE
PID:592 -
\??\c:\fnphxh.exec:\fnphxh.exe58⤵
- Executes dropped EXE
PID:2132 -
\??\c:\lvnrh.exec:\lvnrh.exe59⤵
- Executes dropped EXE
PID:1192 -
\??\c:\ldbtf.exec:\ldbtf.exe60⤵
- Executes dropped EXE
PID:1832 -
\??\c:\xvxjht.exec:\xvxjht.exe61⤵
- Executes dropped EXE
PID:1100 -
\??\c:\fxftb.exec:\fxftb.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2288 -
\??\c:\lfhfv.exec:\lfhfv.exe63⤵
- Executes dropped EXE
PID:1280 -
\??\c:\ddjlbp.exec:\ddjlbp.exe64⤵
- Executes dropped EXE
PID:560 -
\??\c:\lphhv.exec:\lphhv.exe65⤵
- Executes dropped EXE
PID:2272 -
\??\c:\htjrpfh.exec:\htjrpfh.exe66⤵PID:2420
-
\??\c:\nbbjn.exec:\nbbjn.exe67⤵PID:2532
-
\??\c:\drvhln.exec:\drvhln.exe68⤵PID:2392
-
\??\c:\vhdndh.exec:\vhdndh.exe69⤵PID:712
-
\??\c:\nxpnl.exec:\nxpnl.exe70⤵PID:2380
-
\??\c:\lphnbf.exec:\lphnbf.exe71⤵PID:2696
-
\??\c:\rxtxdr.exec:\rxtxdr.exe72⤵
- System Location Discovery: System Language Discovery
PID:700 -
\??\c:\fpjbjfr.exec:\fpjbjfr.exe73⤵PID:1008
-
\??\c:\fhxlrp.exec:\fhxlrp.exe74⤵PID:2196
-
\??\c:\ntfvtd.exec:\ntfvtd.exe75⤵PID:1796
-
\??\c:\xtnjhx.exec:\xtnjhx.exe76⤵PID:1540
-
\??\c:\fxhpt.exec:\fxhpt.exe77⤵PID:616
-
\??\c:\lpdxlxt.exec:\lpdxlxt.exe78⤵PID:1060
-
\??\c:\ljxbr.exec:\ljxbr.exe79⤵PID:1176
-
\??\c:\lnnjdp.exec:\lnnjdp.exe80⤵PID:932
-
\??\c:\lnlhpll.exec:\lnlhpll.exe81⤵PID:1916
-
\??\c:\jtjlpdj.exec:\jtjlpdj.exe82⤵PID:2252
-
\??\c:\rxvvv.exec:\rxvvv.exe83⤵PID:2276
-
\??\c:\ljdfb.exec:\ljdfb.exe84⤵PID:2292
-
\??\c:\hnlxflh.exec:\hnlxflh.exe85⤵PID:884
-
\??\c:\hjndrpt.exec:\hjndrpt.exe86⤵PID:2616
-
\??\c:\rdxlt.exec:\rdxlt.exe87⤵PID:2600
-
\??\c:\fpnljlx.exec:\fpnljlx.exe88⤵PID:1592
-
\??\c:\vjplbx.exec:\vjplbx.exe89⤵PID:1824
-
\??\c:\vhnxpv.exec:\vhnxpv.exe90⤵PID:3032
-
\??\c:\phjdh.exec:\phjdh.exe91⤵PID:2936
-
\??\c:\bbnjp.exec:\bbnjp.exe92⤵PID:2888
-
\??\c:\dhfljj.exec:\dhfljj.exe93⤵
- System Location Discovery: System Language Discovery
PID:2900 -
\??\c:\njnlxx.exec:\njnlxx.exe94⤵PID:3016
-
\??\c:\vhnjp.exec:\vhnjp.exe95⤵PID:2848
-
\??\c:\vfbpv.exec:\vfbpv.exe96⤵PID:1528
-
\??\c:\dnjfn.exec:\dnjfn.exe97⤵PID:2412
-
\??\c:\bxljlfp.exec:\bxljlfp.exe98⤵PID:2856
-
\??\c:\rplhnn.exec:\rplhnn.exe99⤵PID:2780
-
\??\c:\lfrnfbj.exec:\lfrnfbj.exe100⤵PID:2564
-
\??\c:\pjfnb.exec:\pjfnb.exe101⤵PID:2820
-
\??\c:\jhldjpp.exec:\jhldjpp.exe102⤵PID:2704
-
\??\c:\ffxrb.exec:\ffxrb.exe103⤵PID:2356
-
\??\c:\hrxht.exec:\hrxht.exe104⤵PID:2212
-
\??\c:\phxvlx.exec:\phxvlx.exe105⤵PID:2148
-
\??\c:\htnpnf.exec:\htnpnf.exe106⤵PID:1508
-
\??\c:\hxvdfr.exec:\hxvdfr.exe107⤵PID:2316
-
\??\c:\nnhvxlt.exec:\nnhvxlt.exe108⤵PID:2000
-
\??\c:\jhtbnhv.exec:\jhtbnhv.exe109⤵PID:2032
-
\??\c:\jfbxtl.exec:\jfbxtl.exe110⤵PID:1364
-
\??\c:\bxxpbvb.exec:\bxxpbvb.exe111⤵PID:2036
-
\??\c:\pvvll.exec:\pvvll.exe112⤵PID:2400
-
\??\c:\nvbxv.exec:\nvbxv.exe113⤵PID:2424
-
\??\c:\xxvbvvd.exec:\xxvbvvd.exe114⤵PID:2256
-
\??\c:\jjrblt.exec:\jjrblt.exe115⤵PID:2920
-
\??\c:\hvxttt.exec:\hvxttt.exe116⤵PID:2416
-
\??\c:\dhxfrxh.exec:\dhxfrxh.exe117⤵PID:272
-
\??\c:\rtvhxr.exec:\rtvhxr.exe118⤵PID:1544
-
\??\c:\plnrdvd.exec:\plnrdvd.exe119⤵PID:1420
-
\??\c:\npdll.exec:\npdll.exe120⤵
- System Location Discovery: System Language Discovery
PID:856 -
\??\c:\ppthr.exec:\ppthr.exe121⤵PID:852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-