Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 19:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6ada709b13ddf1b6e2b3ab7a682cd49b36f65bbcfe11f11e37421e5b09dcd9aa.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
6ada709b13ddf1b6e2b3ab7a682cd49b36f65bbcfe11f11e37421e5b09dcd9aa.exe
-
Size
454KB
-
MD5
3417e432e29d44198908240198612d81
-
SHA1
d7023b8746b50d29167d7775e5a3068f8c6f7bc4
-
SHA256
6ada709b13ddf1b6e2b3ab7a682cd49b36f65bbcfe11f11e37421e5b09dcd9aa
-
SHA512
d1416ca8fa1c907a6a559c0797e3caed6779703ab01f67c525cc144a6c4b563c39717b2cf7ac7dcb847192bacc090f1437dbf0325e84c87d8ed1f639c10511be
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2100-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-26-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1892-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/296-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-202-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1336-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-239-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2584-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/940-267-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2188-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-423-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/928-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/960-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-602-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2936-637-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2052-656-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-834-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 912 hhbhnnj.exe 1892 ljljt.exe 1128 rbdvx.exe 2924 rjtth.exe 2088 dblhlr.exe 2680 jpvfdrd.exe 2748 xpdtd.exe 2836 pdtxr.exe 2788 vhxtx.exe 2768 bdjnbht.exe 1784 htxhbr.exe 3032 jnxfvj.exe 1316 jfnlldt.exe 3064 ljfbj.exe 296 rrbnf.exe 2216 jvnxh.exe 1948 rlvfh.exe 2304 rhjpbvv.exe 2148 vjfttl.exe 2144 rttpxx.exe 2512 bndfd.exe 1336 dnnxlx.exe 1044 vjbvtf.exe 1440 xhfnthj.exe 2412 hxjdf.exe 2584 rxtdhpx.exe 1004 rnnnxv.exe 940 tpjbf.exe 2252 lnbxlt.exe 2192 tbthlp.exe 2188 vhdtrdh.exe 1036 hxrtx.exe 2104 xnpdff.exe 1460 fjvpnl.exe 2284 fhdrnd.exe 2804 trftv.exe 1892 bnjbhhn.exe 2624 xfrxft.exe 2948 tdjll.exe 2924 fpbddxl.exe 2980 nfhrbfv.exe 2908 rxlhn.exe 816 lxpbx.exe 2736 lrtxrp.exe 1956 bjdhr.exe 2448 htndjn.exe 2704 dndph.exe 2324 vfpvdxd.exe 3028 jpfxfjh.exe 2108 hhplv.exe 928 fftnt.exe 2544 lvbnprl.exe 3064 xhvjlrf.exe 296 vptpn.exe 1944 fffnnf.exe 2268 xjhjfj.exe 760 trtbb.exe 2304 nnrdtft.exe 1116 xvjxx.exe 2520 xbhff.exe 976 pnldrf.exe 2320 ftvvjx.exe 960 jjprjx.exe 2128 hbljjb.exe -
resource yara_rule behavioral1/memory/912-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/296-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/928-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-466-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/760-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-629-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2052-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-834-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nphfnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttllvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnphnxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnbbrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlfrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbvxvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhdltpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvnbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtjnrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffbtbph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdtlbfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrrpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfrbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddftvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxdffh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drjpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lntnvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdhrpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnvplx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvrhnpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdhdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdjxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdxrvxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvnxxhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbbld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dblbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npjttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnhbrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpfbjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prljppb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnxfdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjlvbfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjljbdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljpxvfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drxdllt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxjtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrdrhfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltjdtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbfrtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhnpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trhrdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thfnrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffjphx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpxdnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhxtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvpbfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbtxpbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlbjdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 912 2100 6ada709b13ddf1b6e2b3ab7a682cd49b36f65bbcfe11f11e37421e5b09dcd9aa.exe 30 PID 2100 wrote to memory of 912 2100 6ada709b13ddf1b6e2b3ab7a682cd49b36f65bbcfe11f11e37421e5b09dcd9aa.exe 30 PID 2100 wrote to memory of 912 2100 6ada709b13ddf1b6e2b3ab7a682cd49b36f65bbcfe11f11e37421e5b09dcd9aa.exe 30 PID 2100 wrote to memory of 912 2100 6ada709b13ddf1b6e2b3ab7a682cd49b36f65bbcfe11f11e37421e5b09dcd9aa.exe 30 PID 912 wrote to memory of 1892 912 hhbhnnj.exe 31 PID 912 wrote to memory of 1892 912 hhbhnnj.exe 31 PID 912 wrote to memory of 1892 912 hhbhnnj.exe 31 PID 912 wrote to memory of 1892 912 hhbhnnj.exe 31 PID 1892 wrote to memory of 1128 1892 ljljt.exe 32 PID 1892 wrote to memory of 1128 1892 ljljt.exe 32 PID 1892 wrote to memory of 1128 1892 ljljt.exe 32 PID 1892 wrote to memory of 1128 1892 ljljt.exe 32 PID 1128 wrote to memory of 2924 1128 rbdvx.exe 33 PID 1128 wrote to memory of 2924 1128 rbdvx.exe 33 PID 1128 wrote to memory of 2924 1128 rbdvx.exe 33 PID 1128 wrote to memory of 2924 1128 rbdvx.exe 33 PID 2924 wrote to memory of 2088 2924 rjtth.exe 34 PID 2924 wrote to memory of 2088 2924 rjtth.exe 34 PID 2924 wrote to memory of 2088 2924 rjtth.exe 34 PID 2924 wrote to memory of 2088 2924 rjtth.exe 34 PID 2088 wrote to memory of 2680 2088 dblhlr.exe 35 PID 2088 wrote to memory of 2680 2088 dblhlr.exe 35 PID 2088 wrote to memory of 2680 2088 dblhlr.exe 35 PID 2088 wrote to memory of 2680 2088 dblhlr.exe 35 PID 2680 wrote to memory of 2748 2680 jpvfdrd.exe 36 PID 2680 wrote to memory of 2748 2680 jpvfdrd.exe 36 PID 2680 wrote to memory of 2748 2680 jpvfdrd.exe 36 PID 2680 wrote to memory of 2748 2680 jpvfdrd.exe 36 PID 2748 wrote to memory of 2836 2748 xpdtd.exe 37 PID 2748 wrote to memory of 2836 2748 xpdtd.exe 37 PID 2748 wrote to memory of 2836 2748 xpdtd.exe 37 PID 2748 wrote to memory of 2836 2748 xpdtd.exe 37 PID 2836 wrote to memory of 2788 2836 pdtxr.exe 38 PID 2836 wrote to memory of 2788 2836 pdtxr.exe 38 PID 2836 wrote to memory of 2788 2836 pdtxr.exe 38 PID 2836 wrote to memory of 2788 2836 pdtxr.exe 38 PID 2788 wrote to memory of 2768 2788 vhxtx.exe 39 PID 2788 wrote to memory of 2768 2788 vhxtx.exe 39 PID 2788 wrote to memory of 2768 2788 vhxtx.exe 39 PID 2788 wrote to memory of 2768 2788 vhxtx.exe 39 PID 2768 wrote to memory of 1784 2768 bdjnbht.exe 40 PID 2768 wrote to memory of 1784 2768 bdjnbht.exe 40 PID 2768 wrote to memory of 1784 2768 bdjnbht.exe 40 PID 2768 wrote to memory of 1784 2768 bdjnbht.exe 40 PID 1784 wrote to memory of 3032 1784 htxhbr.exe 41 PID 1784 wrote to memory of 3032 1784 htxhbr.exe 41 PID 1784 wrote to memory of 3032 1784 htxhbr.exe 41 PID 1784 wrote to memory of 3032 1784 htxhbr.exe 41 PID 3032 wrote to memory of 1316 3032 jnxfvj.exe 42 PID 3032 wrote to memory of 1316 3032 jnxfvj.exe 42 PID 3032 wrote to memory of 1316 3032 jnxfvj.exe 42 PID 3032 wrote to memory of 1316 3032 jnxfvj.exe 42 PID 1316 wrote to memory of 3064 1316 jfnlldt.exe 43 PID 1316 wrote to memory of 3064 1316 jfnlldt.exe 43 PID 1316 wrote to memory of 3064 1316 jfnlldt.exe 43 PID 1316 wrote to memory of 3064 1316 jfnlldt.exe 43 PID 3064 wrote to memory of 296 3064 ljfbj.exe 44 PID 3064 wrote to memory of 296 3064 ljfbj.exe 44 PID 3064 wrote to memory of 296 3064 ljfbj.exe 44 PID 3064 wrote to memory of 296 3064 ljfbj.exe 44 PID 296 wrote to memory of 2216 296 rrbnf.exe 45 PID 296 wrote to memory of 2216 296 rrbnf.exe 45 PID 296 wrote to memory of 2216 296 rrbnf.exe 45 PID 296 wrote to memory of 2216 296 rrbnf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6ada709b13ddf1b6e2b3ab7a682cd49b36f65bbcfe11f11e37421e5b09dcd9aa.exe"C:\Users\Admin\AppData\Local\Temp\6ada709b13ddf1b6e2b3ab7a682cd49b36f65bbcfe11f11e37421e5b09dcd9aa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\hhbhnnj.exec:\hhbhnnj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\ljljt.exec:\ljljt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\rbdvx.exec:\rbdvx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\rjtth.exec:\rjtth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\dblhlr.exec:\dblhlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\jpvfdrd.exec:\jpvfdrd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\xpdtd.exec:\xpdtd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\pdtxr.exec:\pdtxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\vhxtx.exec:\vhxtx.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\bdjnbht.exec:\bdjnbht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\htxhbr.exec:\htxhbr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\jnxfvj.exec:\jnxfvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\jfnlldt.exec:\jfnlldt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\ljfbj.exec:\ljfbj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\rrbnf.exec:\rrbnf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
\??\c:\jvnxh.exec:\jvnxh.exe17⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rlvfh.exec:\rlvfh.exe18⤵
- Executes dropped EXE
PID:1948 -
\??\c:\rhjpbvv.exec:\rhjpbvv.exe19⤵
- Executes dropped EXE
PID:2304 -
\??\c:\vjfttl.exec:\vjfttl.exe20⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rttpxx.exec:\rttpxx.exe21⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bndfd.exec:\bndfd.exe22⤵
- Executes dropped EXE
PID:2512 -
\??\c:\dnnxlx.exec:\dnnxlx.exe23⤵
- Executes dropped EXE
PID:1336 -
\??\c:\vjbvtf.exec:\vjbvtf.exe24⤵
- Executes dropped EXE
PID:1044 -
\??\c:\xhfnthj.exec:\xhfnthj.exe25⤵
- Executes dropped EXE
PID:1440 -
\??\c:\hxjdf.exec:\hxjdf.exe26⤵
- Executes dropped EXE
PID:2412 -
\??\c:\rxtdhpx.exec:\rxtdhpx.exe27⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rnnnxv.exec:\rnnnxv.exe28⤵
- Executes dropped EXE
PID:1004 -
\??\c:\tpjbf.exec:\tpjbf.exe29⤵
- Executes dropped EXE
PID:940 -
\??\c:\lnbxlt.exec:\lnbxlt.exe30⤵
- Executes dropped EXE
PID:2252 -
\??\c:\tbthlp.exec:\tbthlp.exe31⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vhdtrdh.exec:\vhdtrdh.exe32⤵
- Executes dropped EXE
PID:2188 -
\??\c:\hxrtx.exec:\hxrtx.exe33⤵
- Executes dropped EXE
PID:1036 -
\??\c:\xnpdff.exec:\xnpdff.exe34⤵
- Executes dropped EXE
PID:2104 -
\??\c:\fjvpnl.exec:\fjvpnl.exe35⤵
- Executes dropped EXE
PID:1460 -
\??\c:\fhdrnd.exec:\fhdrnd.exe36⤵
- Executes dropped EXE
PID:2284 -
\??\c:\trftv.exec:\trftv.exe37⤵
- Executes dropped EXE
PID:2804 -
\??\c:\bnjbhhn.exec:\bnjbhhn.exe38⤵
- Executes dropped EXE
PID:1892 -
\??\c:\xfrxft.exec:\xfrxft.exe39⤵
- Executes dropped EXE
PID:2624 -
\??\c:\tdjll.exec:\tdjll.exe40⤵
- Executes dropped EXE
PID:2948 -
\??\c:\fpbddxl.exec:\fpbddxl.exe41⤵
- Executes dropped EXE
PID:2924 -
\??\c:\nfhrbfv.exec:\nfhrbfv.exe42⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rxlhn.exec:\rxlhn.exe43⤵
- Executes dropped EXE
PID:2908 -
\??\c:\lxpbx.exec:\lxpbx.exe44⤵
- Executes dropped EXE
PID:816 -
\??\c:\lrtxrp.exec:\lrtxrp.exe45⤵
- Executes dropped EXE
PID:2736 -
\??\c:\bjdhr.exec:\bjdhr.exe46⤵
- Executes dropped EXE
PID:1956 -
\??\c:\htndjn.exec:\htndjn.exe47⤵
- Executes dropped EXE
PID:2448 -
\??\c:\dndph.exec:\dndph.exe48⤵
- Executes dropped EXE
PID:2704 -
\??\c:\vfpvdxd.exec:\vfpvdxd.exe49⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jpfxfjh.exec:\jpfxfjh.exe50⤵
- Executes dropped EXE
PID:3028 -
\??\c:\hhplv.exec:\hhplv.exe51⤵
- Executes dropped EXE
PID:2108 -
\??\c:\fftnt.exec:\fftnt.exe52⤵
- Executes dropped EXE
PID:928 -
\??\c:\lvbnprl.exec:\lvbnprl.exe53⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xhvjlrf.exec:\xhvjlrf.exe54⤵
- Executes dropped EXE
PID:3064 -
\??\c:\vptpn.exec:\vptpn.exe55⤵
- Executes dropped EXE
PID:296 -
\??\c:\fffnnf.exec:\fffnnf.exe56⤵
- Executes dropped EXE
PID:1944 -
\??\c:\xjhjfj.exec:\xjhjfj.exe57⤵
- Executes dropped EXE
PID:2268 -
\??\c:\trtbb.exec:\trtbb.exe58⤵
- Executes dropped EXE
PID:760 -
\??\c:\nnrdtft.exec:\nnrdtft.exe59⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xvjxx.exec:\xvjxx.exe60⤵
- Executes dropped EXE
PID:1116 -
\??\c:\xbhff.exec:\xbhff.exe61⤵
- Executes dropped EXE
PID:2520 -
\??\c:\pnldrf.exec:\pnldrf.exe62⤵
- Executes dropped EXE
PID:976 -
\??\c:\ftvvjx.exec:\ftvvjx.exe63⤵
- Executes dropped EXE
PID:2320 -
\??\c:\jjprjx.exec:\jjprjx.exe64⤵
- Executes dropped EXE
PID:960 -
\??\c:\hbljjb.exec:\hbljjb.exe65⤵
- Executes dropped EXE
PID:2128 -
\??\c:\dbjnxt.exec:\dbjnxt.exe66⤵PID:832
-
\??\c:\vltlv.exec:\vltlv.exe67⤵PID:2064
-
\??\c:\xlxtv.exec:\xlxtv.exe68⤵PID:1704
-
\??\c:\tdnxv.exec:\tdnxv.exe69⤵PID:1788
-
\??\c:\rvnrj.exec:\rvnrj.exe70⤵PID:796
-
\??\c:\ppvrbp.exec:\ppvrbp.exe71⤵PID:1700
-
\??\c:\dtxhr.exec:\dtxhr.exe72⤵PID:1800
-
\??\c:\ljpxvfv.exec:\ljpxvfv.exe73⤵
- System Location Discovery: System Language Discovery
PID:532 -
\??\c:\bnffbrt.exec:\bnffbrt.exe74⤵PID:2480
-
\??\c:\rxdffh.exec:\rxdffh.exe75⤵
- System Location Discovery: System Language Discovery
PID:896 -
\??\c:\rldfb.exec:\rldfb.exe76⤵PID:2672
-
\??\c:\phrvf.exec:\phrvf.exe77⤵PID:2580
-
\??\c:\djdhrpb.exec:\djdhrpb.exe78⤵
- System Location Discovery: System Language Discovery
PID:1524 -
\??\c:\tvhflj.exec:\tvhflj.exe79⤵PID:1272
-
\??\c:\bxjjd.exec:\bxjjd.exe80⤵PID:2396
-
\??\c:\hppbd.exec:\hppbd.exe81⤵PID:2588
-
\??\c:\vdhhvdp.exec:\vdhhvdp.exe82⤵PID:1212
-
\??\c:\tjphd.exec:\tjphd.exe83⤵PID:2936
-
\??\c:\rxxff.exec:\rxxff.exe84⤵PID:2952
-
\??\c:\rbbld.exec:\rbbld.exe85⤵
- System Location Discovery: System Language Discovery
PID:2732 -
\??\c:\lvvfbnt.exec:\lvvfbnt.exe86⤵PID:2052
-
\??\c:\pdrvd.exec:\pdrvd.exe87⤵PID:2984
-
\??\c:\xnfplr.exec:\xnfplr.exe88⤵PID:2748
-
\??\c:\vppdfbx.exec:\vppdfbx.exe89⤵PID:2800
-
\??\c:\prrjpj.exec:\prrjpj.exe90⤵PID:2376
-
\??\c:\btlpxh.exec:\btlpxh.exe91⤵PID:2844
-
\??\c:\tdjvll.exec:\tdjvll.exe92⤵PID:1796
-
\??\c:\pjfxxdp.exec:\pjfxxdp.exe93⤵PID:2420
-
\??\c:\vxffdp.exec:\vxffdp.exe94⤵PID:1520
-
\??\c:\nvxfhj.exec:\nvxfhj.exe95⤵PID:2964
-
\??\c:\nbtdj.exec:\nbtdj.exe96⤵PID:3056
-
\??\c:\ttfhdt.exec:\ttfhdt.exe97⤵PID:1900
-
\??\c:\tlfll.exec:\tlfll.exe98⤵PID:2140
-
\??\c:\dnbxp.exec:\dnbxp.exe99⤵PID:2288
-
\??\c:\xppnx.exec:\xppnx.exe100⤵PID:1964
-
\??\c:\pnbhth.exec:\pnbhth.exe101⤵PID:2356
-
\??\c:\dbfhn.exec:\dbfhn.exe102⤵PID:2268
-
\??\c:\nhtvrb.exec:\nhtvrb.exe103⤵PID:2276
-
\??\c:\tnplr.exec:\tnplr.exe104⤵PID:1552
-
\??\c:\rnrbjhx.exec:\rnrbjhx.exe105⤵PID:1052
-
\??\c:\fxtpdnf.exec:\fxtpdnf.exe106⤵PID:2120
-
\??\c:\rffbjp.exec:\rffbjp.exe107⤵PID:2244
-
\??\c:\nvjnb.exec:\nvjnb.exe108⤵PID:2028
-
\??\c:\hbddhpr.exec:\hbddhpr.exe109⤵PID:764
-
\??\c:\bhjljdb.exec:\bhjljdb.exe110⤵PID:1708
-
\??\c:\rjhdnxb.exec:\rjhdnxb.exe111⤵PID:456
-
\??\c:\nrrnbbr.exec:\nrrnbbr.exe112⤵PID:2412
-
\??\c:\jnfvpnb.exec:\jnfvpnb.exe113⤵PID:2064
-
\??\c:\tdxjff.exec:\tdxjff.exe114⤵PID:2600
-
\??\c:\pjhxdr.exec:\pjhxdr.exe115⤵PID:112
-
\??\c:\rdpjfrf.exec:\rdpjfrf.exe116⤵PID:1312
-
\??\c:\nfhln.exec:\nfhln.exe117⤵PID:940
-
\??\c:\hvrbnn.exec:\hvrbnn.exe118⤵PID:1756
-
\??\c:\trtpnn.exec:\trtpnn.exe119⤵PID:2664
-
\??\c:\dvbvd.exec:\dvbvd.exe120⤵PID:1032
-
\??\c:\ddpdnrd.exec:\ddpdnrd.exe121⤵PID:2176
-
\??\c:\xrhrj.exec:\xrhrj.exe122⤵PID:1236
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-