Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 19:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
40f7e8ca2e7095ceab3b9b5e54ea6ab4652ebb7120d53e267f42d2826ed85ac0.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
40f7e8ca2e7095ceab3b9b5e54ea6ab4652ebb7120d53e267f42d2826ed85ac0.exe
-
Size
453KB
-
MD5
39b141b964ebc93208d4a64703609546
-
SHA1
8de3eb382f5d4d4a857a0d9dbdf9775b8d52e60c
-
SHA256
40f7e8ca2e7095ceab3b9b5e54ea6ab4652ebb7120d53e267f42d2826ed85ac0
-
SHA512
d3e660f7d3e23653a9c7014990f3b227dc17c5aa079086f680228b63fc0be5b15d8f50afe1a419e3b99dccf2b862ca9e72f288764904eeec3ec926fe3f531dd0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet:q7Tc2NYHUrAwfMp3CDt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2448-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/524-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1384-267-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1384-297-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2032-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-327-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1376-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/396-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-651-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2936-673-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2360-694-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2848-702-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-749-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2524-750-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-765-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2448 fttprf.exe 2956 lvdnndf.exe 2872 hxffnfv.exe 2944 vjlpr.exe 2924 tdrfdnj.exe 2792 djpjnv.exe 2780 ldvdf.exe 2172 rfltp.exe 2080 pjjpd.exe 2012 bfdtlh.exe 2816 prtprv.exe 2184 bjxpfl.exe 2188 nxvvtb.exe 2296 hnhnp.exe 2704 ffrbfv.exe 692 rnvbvv.exe 1776 xfjhxnx.exe 2456 fhhxnr.exe 2284 pbxprvj.exe 2144 bhdhvfv.exe 1844 tpvnt.exe 1096 rnxdp.exe 2084 tbhrnth.exe 2056 jntpn.exe 524 frpbjhj.exe 1372 lvplbxf.exe 1088 vdpjnfj.exe 1384 bfvblr.exe 2000 jjxdnxx.exe 2396 fbvbr.exe 2032 rtvtp.exe 2664 nfptft.exe 1608 hxnxl.exe 2968 pddrbv.exe 2980 rlvntdl.exe 2964 pdrtjf.exe 2900 nvbxh.exe 3040 pntdbpf.exe 308 lpnlxf.exe 2884 tfpbvfb.exe 1376 thjrx.exe 2868 tjnxhrj.exe 2780 ttvnddl.exe 2068 xnnhf.exe 2064 txbpvl.exe 2080 hrlhfvv.exe 3044 tndtjbp.exe 2816 dvlbb.exe 2444 dtrpnpf.exe 2508 hpxprfr.exe 2696 ltrtvrl.exe 2932 ljjjnhn.exe 836 lhldfh.exe 1548 thrrn.exe 2260 bhptprb.exe 2200 dpbndhj.exe 2564 hvdjjfp.exe 396 xbfdbt.exe 908 tfpbvh.exe 320 xjbpx.exe 1992 rpbpx.exe 2480 hlrjdtr.exe 2644 dvtrf.exe 2056 vpvhh.exe -
resource yara_rule behavioral1/memory/2448-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/524-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-750-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-765-0x00000000001B0000-0x00000000001DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbvbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdrfdnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvxtrdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnpltr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhtdvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lphhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrjft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbvbtll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbvppxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dntvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvtddhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phhlhjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htfjnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlnrvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhhrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfvvnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjjxhvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lftnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvtbxdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxljfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxbhpnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrjbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxpxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrnlfvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrjtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfrfffb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjbnnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttvnddl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfrfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftrnnft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dndhxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbnjph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfdvdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdltd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbvfh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2448 2244 40f7e8ca2e7095ceab3b9b5e54ea6ab4652ebb7120d53e267f42d2826ed85ac0.exe 30 PID 2244 wrote to memory of 2448 2244 40f7e8ca2e7095ceab3b9b5e54ea6ab4652ebb7120d53e267f42d2826ed85ac0.exe 30 PID 2244 wrote to memory of 2448 2244 40f7e8ca2e7095ceab3b9b5e54ea6ab4652ebb7120d53e267f42d2826ed85ac0.exe 30 PID 2244 wrote to memory of 2448 2244 40f7e8ca2e7095ceab3b9b5e54ea6ab4652ebb7120d53e267f42d2826ed85ac0.exe 30 PID 2448 wrote to memory of 2956 2448 fttprf.exe 31 PID 2448 wrote to memory of 2956 2448 fttprf.exe 31 PID 2448 wrote to memory of 2956 2448 fttprf.exe 31 PID 2448 wrote to memory of 2956 2448 fttprf.exe 31 PID 2956 wrote to memory of 2872 2956 lvdnndf.exe 32 PID 2956 wrote to memory of 2872 2956 lvdnndf.exe 32 PID 2956 wrote to memory of 2872 2956 lvdnndf.exe 32 PID 2956 wrote to memory of 2872 2956 lvdnndf.exe 32 PID 2872 wrote to memory of 2944 2872 hxffnfv.exe 33 PID 2872 wrote to memory of 2944 2872 hxffnfv.exe 33 PID 2872 wrote to memory of 2944 2872 hxffnfv.exe 33 PID 2872 wrote to memory of 2944 2872 hxffnfv.exe 33 PID 2944 wrote to memory of 2924 2944 vjlpr.exe 34 PID 2944 wrote to memory of 2924 2944 vjlpr.exe 34 PID 2944 wrote to memory of 2924 2944 vjlpr.exe 34 PID 2944 wrote to memory of 2924 2944 vjlpr.exe 34 PID 2924 wrote to memory of 2792 2924 tdrfdnj.exe 35 PID 2924 wrote to memory of 2792 2924 tdrfdnj.exe 35 PID 2924 wrote to memory of 2792 2924 tdrfdnj.exe 35 PID 2924 wrote to memory of 2792 2924 tdrfdnj.exe 35 PID 2792 wrote to memory of 2780 2792 djpjnv.exe 36 PID 2792 wrote to memory of 2780 2792 djpjnv.exe 36 PID 2792 wrote to memory of 2780 2792 djpjnv.exe 36 PID 2792 wrote to memory of 2780 2792 djpjnv.exe 36 PID 2780 wrote to memory of 2172 2780 ldvdf.exe 37 PID 2780 wrote to memory of 2172 2780 ldvdf.exe 37 PID 2780 wrote to memory of 2172 2780 ldvdf.exe 37 PID 2780 wrote to memory of 2172 2780 ldvdf.exe 37 PID 2172 wrote to memory of 2080 2172 rfltp.exe 38 PID 2172 wrote to memory of 2080 2172 rfltp.exe 38 PID 2172 wrote to memory of 2080 2172 rfltp.exe 38 PID 2172 wrote to memory of 2080 2172 rfltp.exe 38 PID 2080 wrote to memory of 2012 2080 pjjpd.exe 39 PID 2080 wrote to memory of 2012 2080 pjjpd.exe 39 PID 2080 wrote to memory of 2012 2080 pjjpd.exe 39 PID 2080 wrote to memory of 2012 2080 pjjpd.exe 39 PID 2012 wrote to memory of 2816 2012 bfdtlh.exe 40 PID 2012 wrote to memory of 2816 2012 bfdtlh.exe 40 PID 2012 wrote to memory of 2816 2012 bfdtlh.exe 40 PID 2012 wrote to memory of 2816 2012 bfdtlh.exe 40 PID 2816 wrote to memory of 2184 2816 prtprv.exe 41 PID 2816 wrote to memory of 2184 2816 prtprv.exe 41 PID 2816 wrote to memory of 2184 2816 prtprv.exe 41 PID 2816 wrote to memory of 2184 2816 prtprv.exe 41 PID 2184 wrote to memory of 2188 2184 bjxpfl.exe 42 PID 2184 wrote to memory of 2188 2184 bjxpfl.exe 42 PID 2184 wrote to memory of 2188 2184 bjxpfl.exe 42 PID 2184 wrote to memory of 2188 2184 bjxpfl.exe 42 PID 2188 wrote to memory of 2296 2188 nxvvtb.exe 43 PID 2188 wrote to memory of 2296 2188 nxvvtb.exe 43 PID 2188 wrote to memory of 2296 2188 nxvvtb.exe 43 PID 2188 wrote to memory of 2296 2188 nxvvtb.exe 43 PID 2296 wrote to memory of 2704 2296 hnhnp.exe 44 PID 2296 wrote to memory of 2704 2296 hnhnp.exe 44 PID 2296 wrote to memory of 2704 2296 hnhnp.exe 44 PID 2296 wrote to memory of 2704 2296 hnhnp.exe 44 PID 2704 wrote to memory of 692 2704 ffrbfv.exe 45 PID 2704 wrote to memory of 692 2704 ffrbfv.exe 45 PID 2704 wrote to memory of 692 2704 ffrbfv.exe 45 PID 2704 wrote to memory of 692 2704 ffrbfv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\40f7e8ca2e7095ceab3b9b5e54ea6ab4652ebb7120d53e267f42d2826ed85ac0.exe"C:\Users\Admin\AppData\Local\Temp\40f7e8ca2e7095ceab3b9b5e54ea6ab4652ebb7120d53e267f42d2826ed85ac0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\fttprf.exec:\fttprf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\lvdnndf.exec:\lvdnndf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\hxffnfv.exec:\hxffnfv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\vjlpr.exec:\vjlpr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\tdrfdnj.exec:\tdrfdnj.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\djpjnv.exec:\djpjnv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\ldvdf.exec:\ldvdf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\rfltp.exec:\rfltp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\pjjpd.exec:\pjjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\bfdtlh.exec:\bfdtlh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\prtprv.exec:\prtprv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\bjxpfl.exec:\bjxpfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\nxvvtb.exec:\nxvvtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\hnhnp.exec:\hnhnp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\ffrbfv.exec:\ffrbfv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\rnvbvv.exec:\rnvbvv.exe17⤵
- Executes dropped EXE
PID:692 -
\??\c:\xfjhxnx.exec:\xfjhxnx.exe18⤵
- Executes dropped EXE
PID:1776 -
\??\c:\fhhxnr.exec:\fhhxnr.exe19⤵
- Executes dropped EXE
PID:2456 -
\??\c:\pbxprvj.exec:\pbxprvj.exe20⤵
- Executes dropped EXE
PID:2284 -
\??\c:\bhdhvfv.exec:\bhdhvfv.exe21⤵
- Executes dropped EXE
PID:2144 -
\??\c:\tpvnt.exec:\tpvnt.exe22⤵
- Executes dropped EXE
PID:1844 -
\??\c:\rnxdp.exec:\rnxdp.exe23⤵
- Executes dropped EXE
PID:1096 -
\??\c:\tbhrnth.exec:\tbhrnth.exe24⤵
- Executes dropped EXE
PID:2084 -
\??\c:\jntpn.exec:\jntpn.exe25⤵
- Executes dropped EXE
PID:2056 -
\??\c:\frpbjhj.exec:\frpbjhj.exe26⤵
- Executes dropped EXE
PID:524 -
\??\c:\lvplbxf.exec:\lvplbxf.exe27⤵
- Executes dropped EXE
PID:1372 -
\??\c:\vdpjnfj.exec:\vdpjnfj.exe28⤵
- Executes dropped EXE
PID:1088 -
\??\c:\bfvblr.exec:\bfvblr.exe29⤵
- Executes dropped EXE
PID:1384 -
\??\c:\jjxdnxx.exec:\jjxdnxx.exe30⤵
- Executes dropped EXE
PID:2000 -
\??\c:\fbvbr.exec:\fbvbr.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2396 -
\??\c:\rtvtp.exec:\rtvtp.exe32⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nfptft.exec:\nfptft.exe33⤵
- Executes dropped EXE
PID:2664 -
\??\c:\hxnxl.exec:\hxnxl.exe34⤵
- Executes dropped EXE
PID:1608 -
\??\c:\pddrbv.exec:\pddrbv.exe35⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rlvntdl.exec:\rlvntdl.exe36⤵
- Executes dropped EXE
PID:2980 -
\??\c:\pdrtjf.exec:\pdrtjf.exe37⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nvbxh.exec:\nvbxh.exe38⤵
- Executes dropped EXE
PID:2900 -
\??\c:\pntdbpf.exec:\pntdbpf.exe39⤵
- Executes dropped EXE
PID:3040 -
\??\c:\lpnlxf.exec:\lpnlxf.exe40⤵
- Executes dropped EXE
PID:308 -
\??\c:\tfpbvfb.exec:\tfpbvfb.exe41⤵
- Executes dropped EXE
PID:2884 -
\??\c:\thjrx.exec:\thjrx.exe42⤵
- Executes dropped EXE
PID:1376 -
\??\c:\tjnxhrj.exec:\tjnxhrj.exe43⤵
- Executes dropped EXE
PID:2868 -
\??\c:\ttvnddl.exec:\ttvnddl.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2780 -
\??\c:\xnnhf.exec:\xnnhf.exe45⤵
- Executes dropped EXE
PID:2068 -
\??\c:\txbpvl.exec:\txbpvl.exe46⤵
- Executes dropped EXE
PID:2064 -
\??\c:\hrlhfvv.exec:\hrlhfvv.exe47⤵
- Executes dropped EXE
PID:2080 -
\??\c:\tndtjbp.exec:\tndtjbp.exe48⤵
- Executes dropped EXE
PID:3044 -
\??\c:\dvlbb.exec:\dvlbb.exe49⤵
- Executes dropped EXE
PID:2816 -
\??\c:\dtrpnpf.exec:\dtrpnpf.exe50⤵
- Executes dropped EXE
PID:2444 -
\??\c:\hpxprfr.exec:\hpxprfr.exe51⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ltrtvrl.exec:\ltrtvrl.exe52⤵
- Executes dropped EXE
PID:2696 -
\??\c:\ljjjnhn.exec:\ljjjnhn.exe53⤵
- Executes dropped EXE
PID:2932 -
\??\c:\lhldfh.exec:\lhldfh.exe54⤵
- Executes dropped EXE
PID:836 -
\??\c:\thrrn.exec:\thrrn.exe55⤵
- Executes dropped EXE
PID:1548 -
\??\c:\bhptprb.exec:\bhptprb.exe56⤵
- Executes dropped EXE
PID:2260 -
\??\c:\dpbndhj.exec:\dpbndhj.exe57⤵
- Executes dropped EXE
PID:2200 -
\??\c:\hvdjjfp.exec:\hvdjjfp.exe58⤵
- Executes dropped EXE
PID:2564 -
\??\c:\xbfdbt.exec:\xbfdbt.exe59⤵
- Executes dropped EXE
PID:396 -
\??\c:\tfpbvh.exec:\tfpbvh.exe60⤵
- Executes dropped EXE
PID:908 -
\??\c:\xjbpx.exec:\xjbpx.exe61⤵
- Executes dropped EXE
PID:320 -
\??\c:\rpbpx.exec:\rpbpx.exe62⤵
- Executes dropped EXE
PID:1992 -
\??\c:\hlrjdtr.exec:\hlrjdtr.exe63⤵
- Executes dropped EXE
PID:2480 -
\??\c:\dvtrf.exec:\dvtrf.exe64⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vpvhh.exec:\vpvhh.exe65⤵
- Executes dropped EXE
PID:2056 -
\??\c:\htpbn.exec:\htpbn.exe66⤵PID:1748
-
\??\c:\ptdltxj.exec:\ptdltxj.exe67⤵PID:1192
-
\??\c:\llpdfj.exec:\llpdfj.exe68⤵PID:112
-
\??\c:\xddvdp.exec:\xddvdp.exe69⤵PID:1544
-
\??\c:\pllfbr.exec:\pllfbr.exe70⤵PID:2440
-
\??\c:\vpbplf.exec:\vpbplf.exe71⤵PID:2384
-
\??\c:\lbnhx.exec:\lbnhx.exe72⤵PID:1152
-
\??\c:\dddxx.exec:\dddxx.exe73⤵PID:884
-
\??\c:\tnjdbbr.exec:\tnjdbbr.exe74⤵PID:1524
-
\??\c:\ndxfjph.exec:\ndxfjph.exe75⤵PID:2240
-
\??\c:\tlvbv.exec:\tlvbv.exe76⤵PID:1480
-
\??\c:\phlvl.exec:\phlvl.exe77⤵PID:2448
-
\??\c:\fnjhxnb.exec:\fnjhxnb.exe78⤵PID:2888
-
\??\c:\phjttjl.exec:\phjttjl.exe79⤵PID:2856
-
\??\c:\jhtxbv.exec:\jhtxbv.exe80⤵PID:2956
-
\??\c:\pxbhpnh.exec:\pxbhpnh.exe81⤵
- System Location Discovery: System Language Discovery
PID:2864 -
\??\c:\lxfnbff.exec:\lxfnbff.exe82⤵PID:2776
-
\??\c:\xtvhjpj.exec:\xtvhjpj.exe83⤵PID:2972
-
\??\c:\vbfhp.exec:\vbfhp.exe84⤵PID:2596
-
\??\c:\fpnnb.exec:\fpnnb.exe85⤵PID:2936
-
\??\c:\ffbpdr.exec:\ffbpdr.exe86⤵PID:2624
-
\??\c:\rxrrj.exec:\rxrrj.exe87⤵PID:388
-
\??\c:\xvllfjb.exec:\xvllfjb.exe88⤵PID:2024
-
\??\c:\thrbdh.exec:\thrbdh.exe89⤵PID:588
-
\??\c:\hrjjh.exec:\hrjjh.exe90⤵PID:2092
-
\??\c:\xjnftlt.exec:\xjnftlt.exe91⤵PID:2360
-
\??\c:\pbpvvp.exec:\pbpvvp.exe92⤵PID:1968
-
\??\c:\rnvrp.exec:\rnvrp.exe93⤵PID:2848
-
\??\c:\dhbhpp.exec:\dhbhpp.exe94⤵PID:2368
-
\??\c:\xfdnb.exec:\xfdnb.exe95⤵PID:1972
-
\??\c:\jfdxpp.exec:\jfdxpp.exe96⤵PID:1176
-
\??\c:\fldll.exec:\fldll.exe97⤵PID:612
-
\??\c:\jpjnvl.exec:\jpjnvl.exe98⤵PID:2116
-
\??\c:\bjjxhvr.exec:\bjjxhvr.exe99⤵
- System Location Discovery: System Language Discovery
PID:2460 -
\??\c:\fnrldnv.exec:\fnrldnv.exe100⤵PID:2524
-
\??\c:\nnvvtfb.exec:\nnvvtfb.exe101⤵PID:2272
-
\??\c:\bjhxlf.exec:\bjhxlf.exe102⤵PID:2476
-
\??\c:\fhhbjb.exec:\fhhbjb.exe103⤵PID:1072
-
\??\c:\rhppnl.exec:\rhppnl.exe104⤵PID:2636
-
\??\c:\fjdxdh.exec:\fjdxdh.exe105⤵PID:1724
-
\??\c:\drtvlp.exec:\drtvlp.exe106⤵PID:948
-
\??\c:\pljhln.exec:\pljhln.exe107⤵PID:792
-
\??\c:\jdvphx.exec:\jdvphx.exe108⤵PID:2724
-
\??\c:\tdrdbvv.exec:\tdrdbvv.exe109⤵PID:1944
-
\??\c:\tvbltld.exec:\tvbltld.exe110⤵PID:1216
-
\??\c:\hhldjfv.exec:\hhldjfv.exe111⤵PID:1924
-
\??\c:\nrnddv.exec:\nrnddv.exe112⤵PID:1544
-
\??\c:\jrjvrhv.exec:\jrjvrhv.exe113⤵PID:1384
-
\??\c:\xbrnf.exec:\xbrnf.exe114⤵PID:2000
-
\??\c:\bdjnj.exec:\bdjnj.exe115⤵PID:2676
-
\??\c:\vrrttpl.exec:\vrrttpl.exe116⤵PID:884
-
\??\c:\ndfbtlb.exec:\ndfbtlb.exe117⤵PID:1524
-
\??\c:\xvlxxr.exec:\xvlxxr.exe118⤵PID:1584
-
\??\c:\vfnrdvr.exec:\vfnrdvr.exe119⤵PID:2892
-
\??\c:\dnfvlf.exec:\dnfvlf.exe120⤵PID:2448
-
\??\c:\hpttvxt.exec:\hpttvxt.exe121⤵PID:2888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-