Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 20:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dbe561b54572231af5d4ca23ae2d2e3be4725a9afd4186805294fe8eaa7c3ce7.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
dbe561b54572231af5d4ca23ae2d2e3be4725a9afd4186805294fe8eaa7c3ce7.exe
-
Size
454KB
-
MD5
ac1031712657a0225e4cb99309b544e8
-
SHA1
e5a6beff96707e423ae76434bbc348663a91ad1c
-
SHA256
dbe561b54572231af5d4ca23ae2d2e3be4725a9afd4186805294fe8eaa7c3ce7
-
SHA512
26b05f3db7a48e93d8020985704434a80f8a257176631ca1989573c8c882828c2a19213698fc23b7c6c269030418938253c1eb997dc3da8561304a07ad0950b8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbef:q7Tc2NYHUrAwfMp3CDf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2240-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-50-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2828-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-79-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2848-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-100-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2708-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-236-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1828-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/640-292-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2468-302-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2468-304-0x0000000077580000-0x000000007769F000-memory.dmp family_blackmoon behavioral1/memory/2408-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-341-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2924-351-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2924-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1180-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-434-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1328-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-529-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/2468-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-753-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/3028-752-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/3028-773-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1064-787-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/744-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1560 rxdtj.exe 1104 xhljfjb.exe 2108 ntnbrfx.exe 2152 pnxlhr.exe 2828 rjfph.exe 2832 vxfxljl.exe 2932 bllnh.exe 2704 dnpth.exe 2848 pjbnxn.exe 2708 vbdlh.exe 2720 bhxvdtb.exe 1200 lfprvl.exe 2644 hhblfv.exe 1948 ffjfxp.exe 2332 xnnfvlf.exe 2024 vvhnxhp.exe 2988 rttdj.exe 836 rbbrp.exe 2636 fjvrhdl.exe 1908 ntrxprn.exe 880 hrxbtr.exe 1700 dlfhj.exe 2992 vjndv.exe 1516 bxrhv.exe 1828 btfnfrt.exe 1184 bddxdbb.exe 640 vthpfbb.exe 2540 bvhfpv.exe 1768 nxpnffv.exe 2432 bvjnpln.exe 900 fjphv.exe 2468 bxhrx.exe 2408 vxtbdph.exe 2620 vvtnvhv.exe 2304 vpljj.exe 2228 btxxf.exe 2488 thxtr.exe 2924 hrbhh.exe 3056 ftppprr.exe 2936 lbdflp.exe 2712 trbjvd.exe 2852 xdrnd.exe 2676 rvvjdh.exe 2896 bnxxtf.exe 2204 fdjhprr.exe 1832 nnlhtjd.exe 1180 xnxhf.exe 2980 hfvdnbf.exe 1196 vvpprjh.exe 1328 pbjfb.exe 1948 blrxrh.exe 1636 hftxr.exe 1484 pdjnrr.exe 1976 bvnrbb.exe 2940 ndtrh.exe 612 dthxjtd.exe 1696 hxhvhx.exe 2236 prxrlb.exe 2132 bddvhp.exe 880 vfntbb.exe 1816 bfpfxj.exe 1788 blbbl.exe 2992 pfxtx.exe 1516 nlrpdnl.exe -
resource yara_rule behavioral1/memory/2240-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-181-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/836-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-304-0x0000000077580000-0x000000007769F000-memory.dmp upx behavioral1/memory/2408-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-503-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2992-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-760-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/744-794-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjrbtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plrblhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhjfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfljd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bddxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxflhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lltff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxjpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhlhdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phdxtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljtxvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fttfhlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njnrldf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhfjtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjrhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnrvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjrjlpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnrvdff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxpplf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btpjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhxtnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brnlvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffjfxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljlhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnfbdft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfnpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjprvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbrdhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjxnvrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjbnvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txdxhfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlldbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxbjvht.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1560 2240 dbe561b54572231af5d4ca23ae2d2e3be4725a9afd4186805294fe8eaa7c3ce7.exe 30 PID 2240 wrote to memory of 1560 2240 dbe561b54572231af5d4ca23ae2d2e3be4725a9afd4186805294fe8eaa7c3ce7.exe 30 PID 2240 wrote to memory of 1560 2240 dbe561b54572231af5d4ca23ae2d2e3be4725a9afd4186805294fe8eaa7c3ce7.exe 30 PID 2240 wrote to memory of 1560 2240 dbe561b54572231af5d4ca23ae2d2e3be4725a9afd4186805294fe8eaa7c3ce7.exe 30 PID 1560 wrote to memory of 1104 1560 rxdtj.exe 31 PID 1560 wrote to memory of 1104 1560 rxdtj.exe 31 PID 1560 wrote to memory of 1104 1560 rxdtj.exe 31 PID 1560 wrote to memory of 1104 1560 rxdtj.exe 31 PID 1104 wrote to memory of 2108 1104 xhljfjb.exe 32 PID 1104 wrote to memory of 2108 1104 xhljfjb.exe 32 PID 1104 wrote to memory of 2108 1104 xhljfjb.exe 32 PID 1104 wrote to memory of 2108 1104 xhljfjb.exe 32 PID 2108 wrote to memory of 2152 2108 ntnbrfx.exe 33 PID 2108 wrote to memory of 2152 2108 ntnbrfx.exe 33 PID 2108 wrote to memory of 2152 2108 ntnbrfx.exe 33 PID 2108 wrote to memory of 2152 2108 ntnbrfx.exe 33 PID 2152 wrote to memory of 2828 2152 pnxlhr.exe 34 PID 2152 wrote to memory of 2828 2152 pnxlhr.exe 34 PID 2152 wrote to memory of 2828 2152 pnxlhr.exe 34 PID 2152 wrote to memory of 2828 2152 pnxlhr.exe 34 PID 2828 wrote to memory of 2832 2828 rjfph.exe 35 PID 2828 wrote to memory of 2832 2828 rjfph.exe 35 PID 2828 wrote to memory of 2832 2828 rjfph.exe 35 PID 2828 wrote to memory of 2832 2828 rjfph.exe 35 PID 2832 wrote to memory of 2932 2832 vxfxljl.exe 36 PID 2832 wrote to memory of 2932 2832 vxfxljl.exe 36 PID 2832 wrote to memory of 2932 2832 vxfxljl.exe 36 PID 2832 wrote to memory of 2932 2832 vxfxljl.exe 36 PID 2932 wrote to memory of 2704 2932 bllnh.exe 37 PID 2932 wrote to memory of 2704 2932 bllnh.exe 37 PID 2932 wrote to memory of 2704 2932 bllnh.exe 37 PID 2932 wrote to memory of 2704 2932 bllnh.exe 37 PID 2704 wrote to memory of 2848 2704 dnpth.exe 38 PID 2704 wrote to memory of 2848 2704 dnpth.exe 38 PID 2704 wrote to memory of 2848 2704 dnpth.exe 38 PID 2704 wrote to memory of 2848 2704 dnpth.exe 38 PID 2848 wrote to memory of 2708 2848 pjbnxn.exe 39 PID 2848 wrote to memory of 2708 2848 pjbnxn.exe 39 PID 2848 wrote to memory of 2708 2848 pjbnxn.exe 39 PID 2848 wrote to memory of 2708 2848 pjbnxn.exe 39 PID 2708 wrote to memory of 2720 2708 vbdlh.exe 40 PID 2708 wrote to memory of 2720 2708 vbdlh.exe 40 PID 2708 wrote to memory of 2720 2708 vbdlh.exe 40 PID 2708 wrote to memory of 2720 2708 vbdlh.exe 40 PID 2720 wrote to memory of 1200 2720 bhxvdtb.exe 41 PID 2720 wrote to memory of 1200 2720 bhxvdtb.exe 41 PID 2720 wrote to memory of 1200 2720 bhxvdtb.exe 41 PID 2720 wrote to memory of 1200 2720 bhxvdtb.exe 41 PID 1200 wrote to memory of 2644 1200 lfprvl.exe 42 PID 1200 wrote to memory of 2644 1200 lfprvl.exe 42 PID 1200 wrote to memory of 2644 1200 lfprvl.exe 42 PID 1200 wrote to memory of 2644 1200 lfprvl.exe 42 PID 2644 wrote to memory of 1948 2644 hhblfv.exe 43 PID 2644 wrote to memory of 1948 2644 hhblfv.exe 43 PID 2644 wrote to memory of 1948 2644 hhblfv.exe 43 PID 2644 wrote to memory of 1948 2644 hhblfv.exe 43 PID 1948 wrote to memory of 2332 1948 ffjfxp.exe 44 PID 1948 wrote to memory of 2332 1948 ffjfxp.exe 44 PID 1948 wrote to memory of 2332 1948 ffjfxp.exe 44 PID 1948 wrote to memory of 2332 1948 ffjfxp.exe 44 PID 2332 wrote to memory of 2024 2332 xnnfvlf.exe 45 PID 2332 wrote to memory of 2024 2332 xnnfvlf.exe 45 PID 2332 wrote to memory of 2024 2332 xnnfvlf.exe 45 PID 2332 wrote to memory of 2024 2332 xnnfvlf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbe561b54572231af5d4ca23ae2d2e3be4725a9afd4186805294fe8eaa7c3ce7.exe"C:\Users\Admin\AppData\Local\Temp\dbe561b54572231af5d4ca23ae2d2e3be4725a9afd4186805294fe8eaa7c3ce7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\rxdtj.exec:\rxdtj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\xhljfjb.exec:\xhljfjb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\ntnbrfx.exec:\ntnbrfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\pnxlhr.exec:\pnxlhr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\rjfph.exec:\rjfph.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\vxfxljl.exec:\vxfxljl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\bllnh.exec:\bllnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\dnpth.exec:\dnpth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\pjbnxn.exec:\pjbnxn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\vbdlh.exec:\vbdlh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\bhxvdtb.exec:\bhxvdtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\lfprvl.exec:\lfprvl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\hhblfv.exec:\hhblfv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\ffjfxp.exec:\ffjfxp.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\xnnfvlf.exec:\xnnfvlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\vvhnxhp.exec:\vvhnxhp.exe17⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rttdj.exec:\rttdj.exe18⤵
- Executes dropped EXE
PID:2988 -
\??\c:\rbbrp.exec:\rbbrp.exe19⤵
- Executes dropped EXE
PID:836 -
\??\c:\fjvrhdl.exec:\fjvrhdl.exe20⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ntrxprn.exec:\ntrxprn.exe21⤵
- Executes dropped EXE
PID:1908 -
\??\c:\hrxbtr.exec:\hrxbtr.exe22⤵
- Executes dropped EXE
PID:880 -
\??\c:\dlfhj.exec:\dlfhj.exe23⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vjndv.exec:\vjndv.exe24⤵
- Executes dropped EXE
PID:2992 -
\??\c:\bxrhv.exec:\bxrhv.exe25⤵
- Executes dropped EXE
PID:1516 -
\??\c:\btfnfrt.exec:\btfnfrt.exe26⤵
- Executes dropped EXE
PID:1828 -
\??\c:\bddxdbb.exec:\bddxdbb.exe27⤵
- Executes dropped EXE
PID:1184 -
\??\c:\vthpfbb.exec:\vthpfbb.exe28⤵
- Executes dropped EXE
PID:640 -
\??\c:\bvhfpv.exec:\bvhfpv.exe29⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nxpnffv.exec:\nxpnffv.exe30⤵
- Executes dropped EXE
PID:1768 -
\??\c:\bvjnpln.exec:\bvjnpln.exe31⤵
- Executes dropped EXE
PID:2432 -
\??\c:\fjphv.exec:\fjphv.exe32⤵
- Executes dropped EXE
PID:900 -
\??\c:\bxhrx.exec:\bxhrx.exe33⤵
- Executes dropped EXE
PID:2468 -
\??\c:\ftndh.exec:\ftndh.exe34⤵PID:1604
-
\??\c:\vxtbdph.exec:\vxtbdph.exe35⤵
- Executes dropped EXE
PID:2408 -
\??\c:\vvtnvhv.exec:\vvtnvhv.exe36⤵
- Executes dropped EXE
PID:2620 -
\??\c:\vpljj.exec:\vpljj.exe37⤵
- Executes dropped EXE
PID:2304 -
\??\c:\btxxf.exec:\btxxf.exe38⤵
- Executes dropped EXE
PID:2228 -
\??\c:\thxtr.exec:\thxtr.exe39⤵
- Executes dropped EXE
PID:2488 -
\??\c:\hrbhh.exec:\hrbhh.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2924 -
\??\c:\ftppprr.exec:\ftppprr.exe41⤵
- Executes dropped EXE
PID:3056 -
\??\c:\lbdflp.exec:\lbdflp.exe42⤵
- Executes dropped EXE
PID:2936 -
\??\c:\trbjvd.exec:\trbjvd.exe43⤵
- Executes dropped EXE
PID:2712 -
\??\c:\xdrnd.exec:\xdrnd.exe44⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rvvjdh.exec:\rvvjdh.exe45⤵
- Executes dropped EXE
PID:2676 -
\??\c:\bnxxtf.exec:\bnxxtf.exe46⤵
- Executes dropped EXE
PID:2896 -
\??\c:\fdjhprr.exec:\fdjhprr.exe47⤵
- Executes dropped EXE
PID:2204 -
\??\c:\nnlhtjd.exec:\nnlhtjd.exe48⤵
- Executes dropped EXE
PID:1832 -
\??\c:\xnxhf.exec:\xnxhf.exe49⤵
- Executes dropped EXE
PID:1180 -
\??\c:\hfvdnbf.exec:\hfvdnbf.exe50⤵
- Executes dropped EXE
PID:2980 -
\??\c:\vvpprjh.exec:\vvpprjh.exe51⤵
- Executes dropped EXE
PID:1196 -
\??\c:\pbjfb.exec:\pbjfb.exe52⤵
- Executes dropped EXE
PID:1328 -
\??\c:\blrxrh.exec:\blrxrh.exe53⤵
- Executes dropped EXE
PID:1948 -
\??\c:\hftxr.exec:\hftxr.exe54⤵
- Executes dropped EXE
PID:1636 -
\??\c:\pdjnrr.exec:\pdjnrr.exe55⤵
- Executes dropped EXE
PID:1484 -
\??\c:\bvnrbb.exec:\bvnrbb.exe56⤵
- Executes dropped EXE
PID:1976 -
\??\c:\ndtrh.exec:\ndtrh.exe57⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dthxjtd.exec:\dthxjtd.exe58⤵
- Executes dropped EXE
PID:612 -
\??\c:\hxhvhx.exec:\hxhvhx.exe59⤵
- Executes dropped EXE
PID:1696 -
\??\c:\prxrlb.exec:\prxrlb.exe60⤵
- Executes dropped EXE
PID:2236 -
\??\c:\bddvhp.exec:\bddvhp.exe61⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vfntbb.exec:\vfntbb.exe62⤵
- Executes dropped EXE
PID:880 -
\??\c:\bfpfxj.exec:\bfpfxj.exe63⤵
- Executes dropped EXE
PID:1816 -
\??\c:\blbbl.exec:\blbbl.exe64⤵
- Executes dropped EXE
PID:1788 -
\??\c:\pfxtx.exec:\pfxtx.exe65⤵
- Executes dropped EXE
PID:2992 -
\??\c:\nlrpdnl.exec:\nlrpdnl.exe66⤵
- Executes dropped EXE
PID:1516 -
\??\c:\vtrnrj.exec:\vtrnrj.exe67⤵PID:1968
-
\??\c:\bbdvxnx.exec:\bbdvxnx.exe68⤵PID:1884
-
\??\c:\llhtr.exec:\llhtr.exe69⤵PID:2164
-
\??\c:\blrll.exec:\blrll.exe70⤵PID:1088
-
\??\c:\txnvx.exec:\txnvx.exe71⤵PID:3060
-
\??\c:\rbnnv.exec:\rbnnv.exe72⤵PID:820
-
\??\c:\pbbfdn.exec:\pbbfdn.exe73⤵PID:2480
-
\??\c:\hjlfh.exec:\hjlfh.exe74⤵PID:2452
-
\??\c:\pxhpx.exec:\pxhpx.exe75⤵PID:900
-
\??\c:\jhfhf.exec:\jhfhf.exe76⤵PID:2468
-
\??\c:\rxlvhpd.exec:\rxlvhpd.exe77⤵PID:1604
-
\??\c:\rvhhnpx.exec:\rvhhnpx.exe78⤵PID:2408
-
\??\c:\djljtj.exec:\djljtj.exe79⤵PID:2600
-
\??\c:\fjrpbd.exec:\fjrpbd.exe80⤵PID:1104
-
\??\c:\tffjh.exec:\tffjh.exe81⤵PID:1692
-
\??\c:\rtbxhh.exec:\rtbxhh.exe82⤵PID:2876
-
\??\c:\hnlxnvt.exec:\hnlxnvt.exe83⤵PID:2884
-
\??\c:\xhhpbj.exec:\xhhpbj.exe84⤵PID:2684
-
\??\c:\hvbjbjx.exec:\hvbjbjx.exe85⤵PID:2796
-
\??\c:\vxdpnjb.exec:\vxdpnjb.exe86⤵PID:3000
-
\??\c:\bpxrbf.exec:\bpxrbf.exe87⤵PID:1904
-
\??\c:\fprxp.exec:\fprxp.exe88⤵PID:2692
-
\??\c:\fvbrpl.exec:\fvbrpl.exe89⤵PID:2848
-
\??\c:\tjfvph.exec:\tjfvph.exe90⤵PID:2044
-
\??\c:\rbhhtbn.exec:\rbhhtbn.exe91⤵PID:2660
-
\??\c:\lvrpbdt.exec:\lvrpbdt.exe92⤵PID:2316
-
\??\c:\lhpff.exec:\lhpff.exe93⤵PID:1460
-
\??\c:\hdnrr.exec:\hdnrr.exe94⤵PID:1664
-
\??\c:\tfjlt.exec:\tfjlt.exe95⤵PID:2644
-
\??\c:\dlhtxxf.exec:\dlhtxxf.exe96⤵PID:1964
-
\??\c:\xjvpfh.exec:\xjvpfh.exe97⤵PID:1772
-
\??\c:\tpfpr.exec:\tpfpr.exe98⤵PID:2368
-
\??\c:\nlpbbh.exec:\nlpbbh.exe99⤵PID:1484
-
\??\c:\hfrrxv.exec:\hfrrxv.exe100⤵PID:2288
-
\??\c:\xxlxt.exec:\xxlxt.exe101⤵PID:3028
-
\??\c:\xdtpr.exec:\xdtpr.exe102⤵PID:1612
-
\??\c:\jbrnb.exec:\jbrnb.exe103⤵PID:2276
-
\??\c:\tfxvvp.exec:\tfxvvp.exe104⤵PID:1380
-
\??\c:\dllrhpn.exec:\dllrhpn.exe105⤵PID:1908
-
\??\c:\bjljvvd.exec:\bjljvvd.exe106⤵PID:1064
-
\??\c:\hlpvlf.exec:\hlpvlf.exe107⤵PID:744
-
\??\c:\hnxbbpr.exec:\hnxbbpr.exe108⤵PID:1552
-
\??\c:\vfftvfh.exec:\vfftvfh.exe109⤵PID:2992
-
\??\c:\hntvd.exec:\hntvd.exe110⤵PID:1516
-
\??\c:\jldpl.exec:\jldpl.exe111⤵PID:2216
-
\??\c:\jndtv.exec:\jndtv.exe112⤵PID:2072
-
\??\c:\pjjbd.exec:\pjjbd.exe113⤵PID:2540
-
\??\c:\trjxdx.exec:\trjxdx.exe114⤵PID:2160
-
\??\c:\vpvpbd.exec:\vpvpbd.exe115⤵PID:1896
-
\??\c:\tttxb.exec:\tttxb.exe116⤵PID:820
-
\??\c:\vltbtrj.exec:\vltbtrj.exe117⤵PID:2444
-
\??\c:\fnljv.exec:\fnljv.exe118⤵PID:2452
-
\??\c:\fffpt.exec:\fffpt.exe119⤵PID:1220
-
\??\c:\bfrtb.exec:\bfrtb.exe120⤵PID:3044
-
\??\c:\pxtvrh.exec:\pxtvrh.exe121⤵PID:1604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-