Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 17:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e4b862b97d99e215037a91c2f5521397659e74a0c8f799472a06fcd26c11a45b.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e4b862b97d99e215037a91c2f5521397659e74a0c8f799472a06fcd26c11a45b.exe
-
Size
454KB
-
MD5
69646fb445a679869d2742383a19a98f
-
SHA1
ad82a79a01e7895d856b29a1cd52360e81b37d53
-
SHA256
e4b862b97d99e215037a91c2f5521397659e74a0c8f799472a06fcd26c11a45b
-
SHA512
dd965dc1d901c3889dc3db17e6037a327218b032c0fc2cf7c1b09fbb3e1f6c9e4048a3f87e40790960ad8344656bd51fac7bdf7baaf7ab1b598751c08126dee5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2856-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1412-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-75-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2544-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/516-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-172-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2156-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/828-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/732-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-276-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2336-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1008-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-360-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1172-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-401-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2728-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/516-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/676-478-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2244-518-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2536-540-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2352-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-643-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2372-728-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2516-781-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1680-800-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2856 rpvptpf.exe 3052 npphdpp.exe 2916 nnbxjxp.exe 3028 xhjft.exe 1412 ljdxf.exe 2404 xfvff.exe 2976 fpxjpfd.exe 1804 hljtn.exe 2072 hfndjv.exe 2544 fphjbvr.exe 3004 vtlrb.exe 1156 hfvdx.exe 2992 tlvpvjj.exe 2396 ntvjx.exe 1928 rdddp.exe 2376 hpbbltd.exe 516 pbnbdl.exe 2156 bpvlv.exe 2236 pjvxh.exe 2548 vnlhv.exe 2244 drvflxx.exe 828 brdvjlx.exe 732 xxnvrxf.exe 2272 nvjrdjv.exe 1512 lhjbv.exe 2536 ppdxtlj.exe 1736 hdllnxv.exe 1956 ppjvrl.exe 2336 hvfrn.exe 1808 pvtpblf.exe 1008 pdjrhhn.exe 1048 dxttn.exe 2824 vtrvfp.exe 2816 trhldhb.exe 2820 hjfdnnd.exe 2792 fpldn.exe 2900 fnhbrxn.exe 2908 prtxxhj.exe 2932 htvptll.exe 2732 nbdfd.exe 1668 hjxhl.exe 1172 hbrxx.exe 1596 xlrdbh.exe 1996 pvphpj.exe 1932 nxdtb.exe 2852 jplftx.exe 2616 fphfb.exe 2544 dtxvlxh.exe 2728 hptrh.exe 2960 xdffftd.exe 2252 ldxxdpj.exe 1484 rppth.exe 760 jpprbnf.exe 1084 dlvvn.exe 676 llprr.exe 516 nvhlvl.exe 2064 bnplhh.exe 1648 jhxjjbx.exe 1980 blhxvfv.exe 2516 hntbp.exe 2244 dhpfdp.exe 936 lnnvv.exe 1320 ntndh.exe 1884 ptlbv.exe -
resource yara_rule behavioral1/memory/2856-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/516-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-172-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2156-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/732-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-360-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1172-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-401-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2728-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/516-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-635-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2520-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-800-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-803-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlnblv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vprnnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvpdffj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxvfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbjhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhxvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pffrntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbjxvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlpxdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtrjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdxflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdbpxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvtpblf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtxvlxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxnnxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pttnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trxnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thvpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjtrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxjddt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xprfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxfhtrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjpjvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjvtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxbrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbjnfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxtflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhxlpbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhdrbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llvvldt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbbvhpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfhrvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlbxjjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnnlnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thpbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbddpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfnbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplrlvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhvbhrv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2808 wrote to memory of 2856 2808 e4b862b97d99e215037a91c2f5521397659e74a0c8f799472a06fcd26c11a45b.exe 30 PID 2808 wrote to memory of 2856 2808 e4b862b97d99e215037a91c2f5521397659e74a0c8f799472a06fcd26c11a45b.exe 30 PID 2808 wrote to memory of 2856 2808 e4b862b97d99e215037a91c2f5521397659e74a0c8f799472a06fcd26c11a45b.exe 30 PID 2808 wrote to memory of 2856 2808 e4b862b97d99e215037a91c2f5521397659e74a0c8f799472a06fcd26c11a45b.exe 30 PID 2856 wrote to memory of 3052 2856 rpvptpf.exe 31 PID 2856 wrote to memory of 3052 2856 rpvptpf.exe 31 PID 2856 wrote to memory of 3052 2856 rpvptpf.exe 31 PID 2856 wrote to memory of 3052 2856 rpvptpf.exe 31 PID 3052 wrote to memory of 2916 3052 npphdpp.exe 32 PID 3052 wrote to memory of 2916 3052 npphdpp.exe 32 PID 3052 wrote to memory of 2916 3052 npphdpp.exe 32 PID 3052 wrote to memory of 2916 3052 npphdpp.exe 32 PID 2916 wrote to memory of 3028 2916 nnbxjxp.exe 33 PID 2916 wrote to memory of 3028 2916 nnbxjxp.exe 33 PID 2916 wrote to memory of 3028 2916 nnbxjxp.exe 33 PID 2916 wrote to memory of 3028 2916 nnbxjxp.exe 33 PID 3028 wrote to memory of 1412 3028 xhjft.exe 34 PID 3028 wrote to memory of 1412 3028 xhjft.exe 34 PID 3028 wrote to memory of 1412 3028 xhjft.exe 34 PID 3028 wrote to memory of 1412 3028 xhjft.exe 34 PID 1412 wrote to memory of 2404 1412 ljdxf.exe 35 PID 1412 wrote to memory of 2404 1412 ljdxf.exe 35 PID 1412 wrote to memory of 2404 1412 ljdxf.exe 35 PID 1412 wrote to memory of 2404 1412 ljdxf.exe 35 PID 2404 wrote to memory of 2976 2404 xfvff.exe 36 PID 2404 wrote to memory of 2976 2404 xfvff.exe 36 PID 2404 wrote to memory of 2976 2404 xfvff.exe 36 PID 2404 wrote to memory of 2976 2404 xfvff.exe 36 PID 2976 wrote to memory of 1804 2976 fpxjpfd.exe 37 PID 2976 wrote to memory of 1804 2976 fpxjpfd.exe 37 PID 2976 wrote to memory of 1804 2976 fpxjpfd.exe 37 PID 2976 wrote to memory of 1804 2976 fpxjpfd.exe 37 PID 1804 wrote to memory of 2072 1804 hljtn.exe 38 PID 1804 wrote to memory of 2072 1804 hljtn.exe 38 PID 1804 wrote to memory of 2072 1804 hljtn.exe 38 PID 1804 wrote to memory of 2072 1804 hljtn.exe 38 PID 2072 wrote to memory of 2544 2072 hfndjv.exe 39 PID 2072 wrote to memory of 2544 2072 hfndjv.exe 39 PID 2072 wrote to memory of 2544 2072 hfndjv.exe 39 PID 2072 wrote to memory of 2544 2072 hfndjv.exe 39 PID 2544 wrote to memory of 3004 2544 fphjbvr.exe 40 PID 2544 wrote to memory of 3004 2544 fphjbvr.exe 40 PID 2544 wrote to memory of 3004 2544 fphjbvr.exe 40 PID 2544 wrote to memory of 3004 2544 fphjbvr.exe 40 PID 3004 wrote to memory of 1156 3004 vtlrb.exe 41 PID 3004 wrote to memory of 1156 3004 vtlrb.exe 41 PID 3004 wrote to memory of 1156 3004 vtlrb.exe 41 PID 3004 wrote to memory of 1156 3004 vtlrb.exe 41 PID 1156 wrote to memory of 2992 1156 hfvdx.exe 42 PID 1156 wrote to memory of 2992 1156 hfvdx.exe 42 PID 1156 wrote to memory of 2992 1156 hfvdx.exe 42 PID 1156 wrote to memory of 2992 1156 hfvdx.exe 42 PID 2992 wrote to memory of 2396 2992 tlvpvjj.exe 43 PID 2992 wrote to memory of 2396 2992 tlvpvjj.exe 43 PID 2992 wrote to memory of 2396 2992 tlvpvjj.exe 43 PID 2992 wrote to memory of 2396 2992 tlvpvjj.exe 43 PID 2396 wrote to memory of 1928 2396 ntvjx.exe 44 PID 2396 wrote to memory of 1928 2396 ntvjx.exe 44 PID 2396 wrote to memory of 1928 2396 ntvjx.exe 44 PID 2396 wrote to memory of 1928 2396 ntvjx.exe 44 PID 1928 wrote to memory of 2376 1928 rdddp.exe 45 PID 1928 wrote to memory of 2376 1928 rdddp.exe 45 PID 1928 wrote to memory of 2376 1928 rdddp.exe 45 PID 1928 wrote to memory of 2376 1928 rdddp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4b862b97d99e215037a91c2f5521397659e74a0c8f799472a06fcd26c11a45b.exe"C:\Users\Admin\AppData\Local\Temp\e4b862b97d99e215037a91c2f5521397659e74a0c8f799472a06fcd26c11a45b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\rpvptpf.exec:\rpvptpf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\npphdpp.exec:\npphdpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\nnbxjxp.exec:\nnbxjxp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\xhjft.exec:\xhjft.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\ljdxf.exec:\ljdxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\xfvff.exec:\xfvff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\fpxjpfd.exec:\fpxjpfd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\hljtn.exec:\hljtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\hfndjv.exec:\hfndjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\fphjbvr.exec:\fphjbvr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\vtlrb.exec:\vtlrb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\hfvdx.exec:\hfvdx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\tlvpvjj.exec:\tlvpvjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\ntvjx.exec:\ntvjx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\rdddp.exec:\rdddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\hpbbltd.exec:\hpbbltd.exe17⤵
- Executes dropped EXE
PID:2376 -
\??\c:\pbnbdl.exec:\pbnbdl.exe18⤵
- Executes dropped EXE
PID:516 -
\??\c:\bpvlv.exec:\bpvlv.exe19⤵
- Executes dropped EXE
PID:2156 -
\??\c:\pjvxh.exec:\pjvxh.exe20⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vnlhv.exec:\vnlhv.exe21⤵
- Executes dropped EXE
PID:2548 -
\??\c:\drvflxx.exec:\drvflxx.exe22⤵
- Executes dropped EXE
PID:2244 -
\??\c:\brdvjlx.exec:\brdvjlx.exe23⤵
- Executes dropped EXE
PID:828 -
\??\c:\xxnvrxf.exec:\xxnvrxf.exe24⤵
- Executes dropped EXE
PID:732 -
\??\c:\nvjrdjv.exec:\nvjrdjv.exe25⤵
- Executes dropped EXE
PID:2272 -
\??\c:\lhjbv.exec:\lhjbv.exe26⤵
- Executes dropped EXE
PID:1512 -
\??\c:\ppdxtlj.exec:\ppdxtlj.exe27⤵
- Executes dropped EXE
PID:2536 -
\??\c:\hdllnxv.exec:\hdllnxv.exe28⤵
- Executes dropped EXE
PID:1736 -
\??\c:\ppjvrl.exec:\ppjvrl.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1956 -
\??\c:\hvfrn.exec:\hvfrn.exe30⤵
- Executes dropped EXE
PID:2336 -
\??\c:\pvtpblf.exec:\pvtpblf.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1808 -
\??\c:\pdjrhhn.exec:\pdjrhhn.exe32⤵
- Executes dropped EXE
PID:1008 -
\??\c:\dxttn.exec:\dxttn.exe33⤵
- Executes dropped EXE
PID:1048 -
\??\c:\vtrvfp.exec:\vtrvfp.exe34⤵
- Executes dropped EXE
PID:2824 -
\??\c:\trhldhb.exec:\trhldhb.exe35⤵
- Executes dropped EXE
PID:2816 -
\??\c:\hjfdnnd.exec:\hjfdnnd.exe36⤵
- Executes dropped EXE
PID:2820 -
\??\c:\fpldn.exec:\fpldn.exe37⤵
- Executes dropped EXE
PID:2792 -
\??\c:\fnhbrxn.exec:\fnhbrxn.exe38⤵
- Executes dropped EXE
PID:2900 -
\??\c:\prtxxhj.exec:\prtxxhj.exe39⤵
- Executes dropped EXE
PID:2908 -
\??\c:\htvptll.exec:\htvptll.exe40⤵
- Executes dropped EXE
PID:2932 -
\??\c:\nbdfd.exec:\nbdfd.exe41⤵
- Executes dropped EXE
PID:2732 -
\??\c:\hjxhl.exec:\hjxhl.exe42⤵
- Executes dropped EXE
PID:1668 -
\??\c:\hbrxx.exec:\hbrxx.exe43⤵
- Executes dropped EXE
PID:1172 -
\??\c:\xlrdbh.exec:\xlrdbh.exe44⤵
- Executes dropped EXE
PID:1596 -
\??\c:\pvphpj.exec:\pvphpj.exe45⤵
- Executes dropped EXE
PID:1996 -
\??\c:\nxdtb.exec:\nxdtb.exe46⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jplftx.exec:\jplftx.exe47⤵
- Executes dropped EXE
PID:2852 -
\??\c:\fphfb.exec:\fphfb.exe48⤵
- Executes dropped EXE
PID:2616 -
\??\c:\dtxvlxh.exec:\dtxvlxh.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2544 -
\??\c:\hptrh.exec:\hptrh.exe50⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xdffftd.exec:\xdffftd.exe51⤵
- Executes dropped EXE
PID:2960 -
\??\c:\ldxxdpj.exec:\ldxxdpj.exe52⤵
- Executes dropped EXE
PID:2252 -
\??\c:\rppth.exec:\rppth.exe53⤵
- Executes dropped EXE
PID:1484 -
\??\c:\jpprbnf.exec:\jpprbnf.exe54⤵
- Executes dropped EXE
PID:760 -
\??\c:\dlvvn.exec:\dlvvn.exe55⤵
- Executes dropped EXE
PID:1084 -
\??\c:\llprr.exec:\llprr.exe56⤵
- Executes dropped EXE
PID:676 -
\??\c:\nvhlvl.exec:\nvhlvl.exe57⤵
- Executes dropped EXE
PID:516 -
\??\c:\bnplhh.exec:\bnplhh.exe58⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jhxjjbx.exec:\jhxjjbx.exe59⤵
- Executes dropped EXE
PID:1648 -
\??\c:\blhxvfv.exec:\blhxvfv.exe60⤵
- Executes dropped EXE
PID:1980 -
\??\c:\hntbp.exec:\hntbp.exe61⤵
- Executes dropped EXE
PID:2516 -
\??\c:\dhpfdp.exec:\dhpfdp.exe62⤵
- Executes dropped EXE
PID:2244 -
\??\c:\lnnvv.exec:\lnnvv.exe63⤵
- Executes dropped EXE
PID:936 -
\??\c:\ntndh.exec:\ntndh.exe64⤵
- Executes dropped EXE
PID:1320 -
\??\c:\ptlbv.exec:\ptlbv.exe65⤵
- Executes dropped EXE
PID:1884 -
\??\c:\thvxh.exec:\thvxh.exe66⤵PID:1388
-
\??\c:\jvndp.exec:\jvndp.exe67⤵PID:740
-
\??\c:\vdndhrb.exec:\vdndhrb.exe68⤵PID:1356
-
\??\c:\nhddf.exec:\nhddf.exe69⤵PID:2536
-
\??\c:\vjlbp.exec:\vjlbp.exe70⤵PID:612
-
\??\c:\lxlvhpj.exec:\lxlvhpj.exe71⤵PID:2352
-
\??\c:\dnrtfr.exec:\dnrtfr.exe72⤵PID:1968
-
\??\c:\tldhn.exec:\tldhn.exe73⤵PID:2664
-
\??\c:\nlpbtxx.exec:\nlpbtxx.exe74⤵PID:1768
-
\??\c:\vlpjh.exec:\vlpjh.exe75⤵PID:2580
-
\??\c:\rnfpbr.exec:\rnfpbr.exe76⤵PID:1988
-
\??\c:\pbbvhpl.exec:\pbbvhpl.exe77⤵
- System Location Discovery: System Language Discovery
PID:1556 -
\??\c:\xxdfjd.exec:\xxdfjd.exe78⤵PID:2872
-
\??\c:\xvdvlt.exec:\xvdvlt.exe79⤵PID:1232
-
\??\c:\pfrdf.exec:\pfrdf.exe80⤵PID:2492
-
\??\c:\hbhbv.exec:\hbhbv.exe81⤵PID:2912
-
\??\c:\xftfjx.exec:\xftfjx.exe82⤵PID:3012
-
\??\c:\xplrlvl.exec:\xplrlvl.exe83⤵
- System Location Discovery: System Language Discovery
PID:2780 -
\??\c:\jxjdrxl.exec:\jxjdrxl.exe84⤵PID:2096
-
\??\c:\hfpln.exec:\hfpln.exe85⤵PID:1668
-
\??\c:\rvvjtpp.exec:\rvvjtpp.exe86⤵PID:2644
-
\??\c:\rnvpd.exec:\rnvpd.exe87⤵PID:2976
-
\??\c:\hphljpd.exec:\hphljpd.exe88⤵PID:1184
-
\??\c:\pfnrf.exec:\pfnrf.exe89⤵PID:2476
-
\??\c:\vlrndph.exec:\vlrndph.exe90⤵PID:2652
-
\??\c:\thhxvn.exec:\thhxvn.exe91⤵
- System Location Discovery: System Language Discovery
PID:2520 -
\??\c:\xrrfjfv.exec:\xrrfjfv.exe92⤵PID:2512
-
\??\c:\vxtfrld.exec:\vxtfrld.exe93⤵PID:2956
-
\??\c:\vbdpx.exec:\vbdpx.exe94⤵PID:3008
-
\??\c:\pfrrj.exec:\pfrrj.exe95⤵PID:3000
-
\??\c:\hxlxbfl.exec:\hxlxbfl.exe96⤵PID:1460
-
\??\c:\tjhll.exec:\tjhll.exe97⤵PID:2372
-
\??\c:\fvpdffj.exec:\fvpdffj.exe98⤵
- System Location Discovery: System Language Discovery
PID:1188 -
\??\c:\thpnnxh.exec:\thpnnxh.exe99⤵PID:2168
-
\??\c:\dbrpr.exec:\dbrpr.exe100⤵PID:2528
-
\??\c:\ffpprn.exec:\ffpprn.exe101⤵PID:3056
-
\??\c:\lxbxfl.exec:\lxbxfl.exe102⤵PID:2540
-
\??\c:\httfhxb.exec:\httfhxb.exe103⤵PID:1868
-
\??\c:\nxpnjrj.exec:\nxpnjrj.exe104⤵PID:1980
-
\??\c:\ttrnjrh.exec:\ttrnjrh.exe105⤵PID:2516
-
\??\c:\hhvhjdh.exec:\hhvhjdh.exe106⤵PID:828
-
\??\c:\vxbpfh.exec:\vxbpfh.exe107⤵PID:2016
-
\??\c:\hbrvl.exec:\hbrvl.exe108⤵PID:1680
-
\??\c:\jnhpt.exec:\jnhpt.exe109⤵PID:1916
-
\??\c:\pdjhdth.exec:\pdjhdth.exe110⤵PID:1228
-
\??\c:\txnhvpp.exec:\txnhvpp.exe111⤵PID:2448
-
\??\c:\xxjnl.exec:\xxjnl.exe112⤵PID:1692
-
\??\c:\rfdvfnb.exec:\rfdvfnb.exe113⤵PID:2764
-
\??\c:\vnfpj.exec:\vnfpj.exe114⤵PID:1688
-
\??\c:\hjxxr.exec:\hjxxr.exe115⤵PID:2588
-
\??\c:\lrxlpfb.exec:\lrxlpfb.exe116⤵PID:1876
-
\??\c:\dlddxbj.exec:\dlddxbj.exe117⤵PID:1708
-
\??\c:\tfjbxl.exec:\tfjbxl.exe118⤵PID:2600
-
\??\c:\xtxpj.exec:\xtxpj.exe119⤵PID:1048
-
\??\c:\fhvjvxf.exec:\fhvjvxf.exe120⤵PID:2824
-
\??\c:\fjvdbf.exec:\fjvdbf.exe121⤵PID:3064
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-