Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 18:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
75b8cec517b6b471073e3cad11cea785f3bd7a813f8b52fe8ee2b9b1eee027e6N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
75b8cec517b6b471073e3cad11cea785f3bd7a813f8b52fe8ee2b9b1eee027e6N.exe
-
Size
454KB
-
MD5
771da170f23dba886528cc3a03963340
-
SHA1
91bf98d83f4328c2d300059af58cbc33bc2bf164
-
SHA256
75b8cec517b6b471073e3cad11cea785f3bd7a813f8b52fe8ee2b9b1eee027e6
-
SHA512
5383160e325fcab7eb81ad35daac2727cc3eec6c3705d71ac487b97cfea61cf0c11d4d15bb7670457b186d5aa8ea5828b68078166f74b1a9ac13d382068295a3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeOo:q7Tc2NYHUrAwfMp3CDOo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2880-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-107-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2444-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1204-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1204-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/472-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/812-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-284-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/940-286-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2796-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-528-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2492-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-603-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2972-724-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2176-731-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2464-739-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2892 ljfvb.exe 2836 xxvbx.exe 2672 rfhbh.exe 2572 brbffv.exe 2648 nlfrph.exe 572 dhtnh.exe 2548 jdllbf.exe 2508 nvjlh.exe 2268 pdbtvn.exe 2924 hlbjlv.exe 2444 xrdrj.exe 2500 pprjrn.exe 1492 jtfpjt.exe 1204 ffvvn.exe 472 fbtjndt.exe 2464 dbjxph.exe 1264 tjnxn.exe 2208 hvpjvh.exe 1964 flvpjj.exe 2552 lnrbh.exe 2536 drpxlxf.exe 1960 hlxnld.exe 2468 xjjjxh.exe 1612 nxlnt.exe 1288 jdhdt.exe 940 dxbpxlv.exe 812 bfvprlp.exe 1684 vjfttt.exe 2004 bnbvtn.exe 1812 trfrp.exe 2028 lbjtj.exe 2792 pdjrthv.exe 2728 bjxrhlp.exe 2896 vthxlj.exe 2796 hhxfjr.exe 2952 brxjvp.exe 2828 bnfrfhv.exe 2572 tnxtld.exe 2340 rptrf.exe 2648 nbtdh.exe 2620 tvbrfj.exe 2012 nbjnvr.exe 1944 fpnfr.exe 1016 xtxxp.exe 2928 xdltrbj.exe 1116 dpfpx.exe 2032 bbdbxb.exe 1736 dtdpl.exe 2500 prjnfvd.exe 1984 hvxjpd.exe 1556 ptdhbr.exe 2348 djfjfx.exe 1924 bjhrdhb.exe 2392 jnfxp.exe 1896 jlfjd.exe 3068 nvdpttv.exe 632 vjbvvl.exe 984 blpprx.exe 1468 tbblx.exe 1980 lxrdx.exe 1700 hjdjtbp.exe 1472 jxfpj.exe 2380 lvhjnb.exe 2368 phlddv.exe -
resource yara_rule behavioral1/memory/2880-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/472-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/472-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-695-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1748-723-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1912-740-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnxnjxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjrrvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxtvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfbbfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxnxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnjbxdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxpjbvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vffjnlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvrxhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lprfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brhtvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjjvtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhdtpnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxjfbbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfhhxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plnrnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtlpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrtrbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxnbnbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnrbnxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlbjlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlvfjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdhlvld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbvdrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptnfnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjnbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdfrdtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhplflh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjbptx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdfdhbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnfdrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fppdrhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpttd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrvbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhlrxdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2880 wrote to memory of 2892 2880 75b8cec517b6b471073e3cad11cea785f3bd7a813f8b52fe8ee2b9b1eee027e6N.exe 30 PID 2880 wrote to memory of 2892 2880 75b8cec517b6b471073e3cad11cea785f3bd7a813f8b52fe8ee2b9b1eee027e6N.exe 30 PID 2880 wrote to memory of 2892 2880 75b8cec517b6b471073e3cad11cea785f3bd7a813f8b52fe8ee2b9b1eee027e6N.exe 30 PID 2880 wrote to memory of 2892 2880 75b8cec517b6b471073e3cad11cea785f3bd7a813f8b52fe8ee2b9b1eee027e6N.exe 30 PID 2892 wrote to memory of 2836 2892 ljfvb.exe 31 PID 2892 wrote to memory of 2836 2892 ljfvb.exe 31 PID 2892 wrote to memory of 2836 2892 ljfvb.exe 31 PID 2892 wrote to memory of 2836 2892 ljfvb.exe 31 PID 2836 wrote to memory of 2672 2836 xxvbx.exe 32 PID 2836 wrote to memory of 2672 2836 xxvbx.exe 32 PID 2836 wrote to memory of 2672 2836 xxvbx.exe 32 PID 2836 wrote to memory of 2672 2836 xxvbx.exe 32 PID 2672 wrote to memory of 2572 2672 rfhbh.exe 33 PID 2672 wrote to memory of 2572 2672 rfhbh.exe 33 PID 2672 wrote to memory of 2572 2672 rfhbh.exe 33 PID 2672 wrote to memory of 2572 2672 rfhbh.exe 33 PID 2572 wrote to memory of 2648 2572 brbffv.exe 34 PID 2572 wrote to memory of 2648 2572 brbffv.exe 34 PID 2572 wrote to memory of 2648 2572 brbffv.exe 34 PID 2572 wrote to memory of 2648 2572 brbffv.exe 34 PID 2648 wrote to memory of 572 2648 nlfrph.exe 35 PID 2648 wrote to memory of 572 2648 nlfrph.exe 35 PID 2648 wrote to memory of 572 2648 nlfrph.exe 35 PID 2648 wrote to memory of 572 2648 nlfrph.exe 35 PID 572 wrote to memory of 2548 572 dhtnh.exe 36 PID 572 wrote to memory of 2548 572 dhtnh.exe 36 PID 572 wrote to memory of 2548 572 dhtnh.exe 36 PID 572 wrote to memory of 2548 572 dhtnh.exe 36 PID 2548 wrote to memory of 2508 2548 jdllbf.exe 37 PID 2548 wrote to memory of 2508 2548 jdllbf.exe 37 PID 2548 wrote to memory of 2508 2548 jdllbf.exe 37 PID 2548 wrote to memory of 2508 2548 jdllbf.exe 37 PID 2508 wrote to memory of 2268 2508 nvjlh.exe 38 PID 2508 wrote to memory of 2268 2508 nvjlh.exe 38 PID 2508 wrote to memory of 2268 2508 nvjlh.exe 38 PID 2508 wrote to memory of 2268 2508 nvjlh.exe 38 PID 2268 wrote to memory of 2924 2268 pdbtvn.exe 39 PID 2268 wrote to memory of 2924 2268 pdbtvn.exe 39 PID 2268 wrote to memory of 2924 2268 pdbtvn.exe 39 PID 2268 wrote to memory of 2924 2268 pdbtvn.exe 39 PID 2924 wrote to memory of 2444 2924 hlbjlv.exe 40 PID 2924 wrote to memory of 2444 2924 hlbjlv.exe 40 PID 2924 wrote to memory of 2444 2924 hlbjlv.exe 40 PID 2924 wrote to memory of 2444 2924 hlbjlv.exe 40 PID 2444 wrote to memory of 2500 2444 xrdrj.exe 41 PID 2444 wrote to memory of 2500 2444 xrdrj.exe 41 PID 2444 wrote to memory of 2500 2444 xrdrj.exe 41 PID 2444 wrote to memory of 2500 2444 xrdrj.exe 41 PID 2500 wrote to memory of 1492 2500 pprjrn.exe 42 PID 2500 wrote to memory of 1492 2500 pprjrn.exe 42 PID 2500 wrote to memory of 1492 2500 pprjrn.exe 42 PID 2500 wrote to memory of 1492 2500 pprjrn.exe 42 PID 1492 wrote to memory of 1204 1492 jtfpjt.exe 43 PID 1492 wrote to memory of 1204 1492 jtfpjt.exe 43 PID 1492 wrote to memory of 1204 1492 jtfpjt.exe 43 PID 1492 wrote to memory of 1204 1492 jtfpjt.exe 43 PID 1204 wrote to memory of 472 1204 ffvvn.exe 44 PID 1204 wrote to memory of 472 1204 ffvvn.exe 44 PID 1204 wrote to memory of 472 1204 ffvvn.exe 44 PID 1204 wrote to memory of 472 1204 ffvvn.exe 44 PID 472 wrote to memory of 2464 472 fbtjndt.exe 45 PID 472 wrote to memory of 2464 472 fbtjndt.exe 45 PID 472 wrote to memory of 2464 472 fbtjndt.exe 45 PID 472 wrote to memory of 2464 472 fbtjndt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\75b8cec517b6b471073e3cad11cea785f3bd7a813f8b52fe8ee2b9b1eee027e6N.exe"C:\Users\Admin\AppData\Local\Temp\75b8cec517b6b471073e3cad11cea785f3bd7a813f8b52fe8ee2b9b1eee027e6N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\ljfvb.exec:\ljfvb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\xxvbx.exec:\xxvbx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\rfhbh.exec:\rfhbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\brbffv.exec:\brbffv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\nlfrph.exec:\nlfrph.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\dhtnh.exec:\dhtnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\jdllbf.exec:\jdllbf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\nvjlh.exec:\nvjlh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\pdbtvn.exec:\pdbtvn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\hlbjlv.exec:\hlbjlv.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\xrdrj.exec:\xrdrj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\pprjrn.exec:\pprjrn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\jtfpjt.exec:\jtfpjt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\ffvvn.exec:\ffvvn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\fbtjndt.exec:\fbtjndt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
\??\c:\dbjxph.exec:\dbjxph.exe17⤵
- Executes dropped EXE
PID:2464 -
\??\c:\tjnxn.exec:\tjnxn.exe18⤵
- Executes dropped EXE
PID:1264 -
\??\c:\hvpjvh.exec:\hvpjvh.exe19⤵
- Executes dropped EXE
PID:2208 -
\??\c:\flvpjj.exec:\flvpjj.exe20⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lnrbh.exec:\lnrbh.exe21⤵
- Executes dropped EXE
PID:2552 -
\??\c:\drpxlxf.exec:\drpxlxf.exe22⤵
- Executes dropped EXE
PID:2536 -
\??\c:\hlxnld.exec:\hlxnld.exe23⤵
- Executes dropped EXE
PID:1960 -
\??\c:\xjjjxh.exec:\xjjjxh.exe24⤵
- Executes dropped EXE
PID:2468 -
\??\c:\nxlnt.exec:\nxlnt.exe25⤵
- Executes dropped EXE
PID:1612 -
\??\c:\jdhdt.exec:\jdhdt.exe26⤵
- Executes dropped EXE
PID:1288 -
\??\c:\dxbpxlv.exec:\dxbpxlv.exe27⤵
- Executes dropped EXE
PID:940 -
\??\c:\bfvprlp.exec:\bfvprlp.exe28⤵
- Executes dropped EXE
PID:812 -
\??\c:\vjfttt.exec:\vjfttt.exe29⤵
- Executes dropped EXE
PID:1684 -
\??\c:\bnbvtn.exec:\bnbvtn.exe30⤵
- Executes dropped EXE
PID:2004 -
\??\c:\trfrp.exec:\trfrp.exe31⤵
- Executes dropped EXE
PID:1812 -
\??\c:\lbjtj.exec:\lbjtj.exe32⤵
- Executes dropped EXE
PID:2028 -
\??\c:\pdjrthv.exec:\pdjrthv.exe33⤵
- Executes dropped EXE
PID:2792 -
\??\c:\bjxrhlp.exec:\bjxrhlp.exe34⤵
- Executes dropped EXE
PID:2728 -
\??\c:\vthxlj.exec:\vthxlj.exe35⤵
- Executes dropped EXE
PID:2896 -
\??\c:\hhxfjr.exec:\hhxfjr.exe36⤵
- Executes dropped EXE
PID:2796 -
\??\c:\brxjvp.exec:\brxjvp.exe37⤵
- Executes dropped EXE
PID:2952 -
\??\c:\bnfrfhv.exec:\bnfrfhv.exe38⤵
- Executes dropped EXE
PID:2828 -
\??\c:\tnxtld.exec:\tnxtld.exe39⤵
- Executes dropped EXE
PID:2572 -
\??\c:\rptrf.exec:\rptrf.exe40⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nbtdh.exec:\nbtdh.exe41⤵
- Executes dropped EXE
PID:2648 -
\??\c:\tvbrfj.exec:\tvbrfj.exe42⤵
- Executes dropped EXE
PID:2620 -
\??\c:\nbjnvr.exec:\nbjnvr.exe43⤵
- Executes dropped EXE
PID:2012 -
\??\c:\fpnfr.exec:\fpnfr.exe44⤵
- Executes dropped EXE
PID:1944 -
\??\c:\xtxxp.exec:\xtxxp.exe45⤵
- Executes dropped EXE
PID:1016 -
\??\c:\xdltrbj.exec:\xdltrbj.exe46⤵
- Executes dropped EXE
PID:2928 -
\??\c:\dpfpx.exec:\dpfpx.exe47⤵
- Executes dropped EXE
PID:1116 -
\??\c:\bbdbxb.exec:\bbdbxb.exe48⤵
- Executes dropped EXE
PID:2032 -
\??\c:\dtdpl.exec:\dtdpl.exe49⤵
- Executes dropped EXE
PID:1736 -
\??\c:\prjnfvd.exec:\prjnfvd.exe50⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hvxjpd.exec:\hvxjpd.exe51⤵
- Executes dropped EXE
PID:1984 -
\??\c:\ptdhbr.exec:\ptdhbr.exe52⤵
- Executes dropped EXE
PID:1556 -
\??\c:\djfjfx.exec:\djfjfx.exe53⤵
- Executes dropped EXE
PID:2348 -
\??\c:\bjhrdhb.exec:\bjhrdhb.exe54⤵
- Executes dropped EXE
PID:1924 -
\??\c:\jnfxp.exec:\jnfxp.exe55⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jlfjd.exec:\jlfjd.exe56⤵
- Executes dropped EXE
PID:1896 -
\??\c:\nvdpttv.exec:\nvdpttv.exe57⤵
- Executes dropped EXE
PID:3068 -
\??\c:\vjbvvl.exec:\vjbvvl.exe58⤵
- Executes dropped EXE
PID:632 -
\??\c:\blpprx.exec:\blpprx.exe59⤵
- Executes dropped EXE
PID:984 -
\??\c:\tbblx.exec:\tbblx.exe60⤵
- Executes dropped EXE
PID:1468 -
\??\c:\lxrdx.exec:\lxrdx.exe61⤵
- Executes dropped EXE
PID:1980 -
\??\c:\hjdjtbp.exec:\hjdjtbp.exe62⤵
- Executes dropped EXE
PID:1700 -
\??\c:\jxfpj.exec:\jxfpj.exe63⤵
- Executes dropped EXE
PID:1472 -
\??\c:\lvhjnb.exec:\lvhjnb.exe64⤵
- Executes dropped EXE
PID:2380 -
\??\c:\phlddv.exec:\phlddv.exe65⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vtlprj.exec:\vtlprj.exe66⤵PID:1696
-
\??\c:\hhhbf.exec:\hhhbf.exe67⤵PID:2360
-
\??\c:\hthlv.exec:\hthlv.exe68⤵PID:940
-
\??\c:\lxrxbp.exec:\lxrxbp.exe69⤵PID:2056
-
\??\c:\rfdvvb.exec:\rfdvvb.exe70⤵PID:2564
-
\??\c:\dfptt.exec:\dfptt.exe71⤵PID:2316
-
\??\c:\bxdnnn.exec:\bxdnnn.exe72⤵PID:2720
-
\??\c:\jjtffr.exec:\jjtffr.exe73⤵PID:1812
-
\??\c:\xjhbn.exec:\xjhbn.exe74⤵PID:888
-
\??\c:\fbnnjd.exec:\fbnnjd.exe75⤵PID:1552
-
\??\c:\fnhjp.exec:\fnhjp.exe76⤵PID:2840
-
\??\c:\njbhxr.exec:\njbhxr.exe77⤵PID:2492
-
\??\c:\dblrb.exec:\dblrb.exe78⤵PID:3016
-
\??\c:\lxfrjx.exec:\lxfrjx.exe79⤵PID:2948
-
\??\c:\ptnhxnd.exec:\ptnhxnd.exe80⤵PID:2952
-
\??\c:\rtlpl.exec:\rtlpl.exe81⤵
- System Location Discovery: System Language Discovery
PID:2672 -
\??\c:\bnblr.exec:\bnblr.exe82⤵PID:2632
-
\??\c:\lhbtxl.exec:\lhbtxl.exe83⤵PID:2476
-
\??\c:\jbrxxbl.exec:\jbrxxbl.exe84⤵PID:2648
-
\??\c:\lntdfbt.exec:\lntdfbt.exe85⤵PID:2676
-
\??\c:\pfnprh.exec:\pfnprh.exe86⤵PID:2496
-
\??\c:\htpxnnv.exec:\htpxnnv.exe87⤵PID:1444
-
\??\c:\vrbrln.exec:\vrbrln.exe88⤵PID:2904
-
\??\c:\jbfbjl.exec:\jbfbjl.exe89⤵PID:2696
-
\??\c:\jprffrt.exec:\jprffrt.exe90⤵PID:1440
-
\??\c:\lhjfr.exec:\lhjfr.exe91⤵PID:2036
-
\??\c:\pjnthl.exec:\pjnthl.exe92⤵PID:2972
-
\??\c:\nrjtp.exec:\nrjtp.exe93⤵PID:2140
-
\??\c:\dpjdbh.exec:\dpjdbh.exe94⤵PID:320
-
\??\c:\bhbbf.exec:\bhbbf.exe95⤵PID:1748
-
\??\c:\xhnxj.exec:\xhnxj.exe96⤵PID:2176
-
\??\c:\xbblrr.exec:\xbblrr.exe97⤵PID:2464
-
\??\c:\rpxfpnn.exec:\rpxfpnn.exe98⤵PID:1912
-
\??\c:\rrdxj.exec:\rrdxj.exe99⤵PID:2076
-
\??\c:\rbfbdfx.exec:\rbfbdfx.exe100⤵PID:3068
-
\??\c:\ttjldtf.exec:\ttjldtf.exe101⤵PID:3012
-
\??\c:\ltljvl.exec:\ltljvl.exe102⤵PID:1160
-
\??\c:\nvjtxbt.exec:\nvjtxbt.exe103⤵PID:980
-
\??\c:\lptpn.exec:\lptpn.exe104⤵PID:1980
-
\??\c:\bhjtrl.exec:\bhjtrl.exe105⤵PID:1700
-
\??\c:\jnbpjt.exec:\jnbpjt.exe106⤵PID:2436
-
\??\c:\pxtdhn.exec:\pxtdhn.exe107⤵PID:1656
-
\??\c:\hfjrjl.exec:\hfjrjl.exe108⤵PID:288
-
\??\c:\xljndpn.exec:\xljndpn.exe109⤵PID:3064
-
\??\c:\bxjfdvj.exec:\bxjfdvj.exe110⤵PID:2052
-
\??\c:\fttjhn.exec:\fttjhn.exe111⤵PID:3008
-
\??\c:\pnlbhn.exec:\pnlbhn.exe112⤵PID:2056
-
\??\c:\htvpr.exec:\htvpr.exe113⤵PID:2564
-
\??\c:\fpfxf.exec:\fpfxf.exe114⤵PID:1112
-
\??\c:\rrnjppd.exec:\rrnjppd.exe115⤵PID:2164
-
\??\c:\nbnfvpb.exec:\nbnfvpb.exe116⤵PID:2296
-
\??\c:\jjxdvtn.exec:\jjxdvtn.exe117⤵PID:888
-
\??\c:\dhvnrl.exec:\dhvnrl.exe118⤵PID:1552
-
\??\c:\jpffb.exec:\jpffb.exe119⤵PID:2644
-
\??\c:\vlxvbj.exec:\vlxvbj.exe120⤵PID:2836
-
\??\c:\tntljj.exec:\tntljj.exe121⤵PID:3016
-
\??\c:\xjprpl.exec:\xjprpl.exe122⤵PID:1780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-