Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 21:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b61459d8afacc8fb9a8f6c0fc5686f44baaed1ada0573bca616d3ed05f0b3ad8N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b61459d8afacc8fb9a8f6c0fc5686f44baaed1ada0573bca616d3ed05f0b3ad8N.exe
-
Size
346KB
-
MD5
2a122b8b62b136679869ec3600067c80
-
SHA1
640270824e9956d9369e23dc8d1b85cb9d478875
-
SHA256
b61459d8afacc8fb9a8f6c0fc5686f44baaed1ada0573bca616d3ed05f0b3ad8
-
SHA512
ca9130936d1a4c7d524a2c1d38e0c753b6a3aaf2d17a820267b72f60b845e13db40c36fdb2dece400a614ca950bb112b01da05e7e988d6242a6999bb29dd12a4
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAu:l7TcbWXZshJX2VGdu
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2024-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1952-17-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2880-26-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1852-35-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2796-45-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2748-53-0x00000000001C0000-0x00000000001E8000-memory.dmp family_blackmoon behavioral1/memory/2748-55-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2844-63-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/576-76-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2892-73-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2236-91-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2572-100-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2888-117-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/832-152-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1924-164-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1116-180-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2204-189-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3008-198-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1612-216-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1476-243-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1464-279-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/548-289-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/684-299-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/684-298-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1596-313-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2800-344-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3040-352-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3040-359-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/752-388-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2836-412-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2632-427-0x00000000003C0000-0x00000000003E8000-memory.dmp family_blackmoon behavioral1/memory/2632-432-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2060-469-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2216-479-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/808-491-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/808-510-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1484-517-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1976-549-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2980-672-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2836-689-0x00000000002A0000-0x00000000002C8000-memory.dmp family_blackmoon behavioral1/memory/2520-744-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1116-750-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/556-860-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2724-886-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2856-894-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/772-971-0x00000000003B0000-0x00000000003D8000-memory.dmp family_blackmoon behavioral1/memory/2040-1047-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1932-1067-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1952 fhxdpvx.exe 2880 vjhbxpb.exe 1852 pllxh.exe 2796 xrrdv.exe 2748 jvvplhf.exe 2844 bvdlnh.exe 2892 rdvdpf.exe 576 nfhhxp.exe 2236 rtdpbf.exe 2572 lfrndv.exe 2900 brblhrr.exe 2888 bfbxtrt.exe 2940 bnlbx.exe 2984 ddrxrb.exe 1640 tltfrfn.exe 832 pvhvfvv.exe 1924 jjrrh.exe 2068 bbdlbb.exe 1116 xrjtp.exe 2204 rjvbn.exe 3008 tpltlp.exe 1392 fdjjv.exe 1612 fhfnpf.exe 904 drhrdr.exe 932 nrpnlf.exe 1476 rjxrln.exe 1324 hvxdbvt.exe 548 xfrjrxp.exe 2480 lhjnj.exe 1464 pfxdh.exe 112 dxltx.exe 684 pfrlrbt.exe 2536 txlvtf.exe 1596 txjvh.exe 2056 hxfjxdd.exe 2368 vxrnl.exe 2740 hnbppt.exe 2856 xlhfn.exe 2800 fxtrt.exe 2876 ddffvn.exe 3040 bttbrtl.exe 2864 rvpnvjv.exe 2768 blldrhf.exe 2624 txvjrh.exe 1064 xllpprb.exe 752 ddhvnd.exe 568 hvlppx.exe 2996 ddhhrx.exe 2836 lvfjb.exe 2964 blnvt.exe 1460 vfhdhd.exe 2632 dfdvbj.exe 1072 ddvpnd.exe 832 bvvvj.exe 2216 hdvrx.exe 1608 jvtbfj.exe 2000 jftjtp.exe 2060 pjjbnrj.exe 3016 vndvp.exe 940 tbpxd.exe 808 djrth.exe 988 rfthfrj.exe 600 bnpxd.exe 452 jdlrj.exe -
resource yara_rule behavioral1/memory/2024-0-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2024-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1952-17-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2880-26-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1852-35-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2796-45-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2748-55-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2892-65-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/576-76-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2892-73-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2236-91-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2572-100-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2888-117-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/832-152-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1924-155-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1924-164-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1116-180-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2204-189-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3008-198-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1612-216-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1476-235-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1476-243-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/548-254-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1464-279-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/684-298-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1596-313-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2800-344-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3040-352-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/3040-359-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2836-412-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2632-427-0x00000000003C0000-0x00000000003E8000-memory.dmp upx behavioral1/memory/2632-432-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/832-441-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/808-491-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1484-517-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1976-549-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/568-673-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/600-778-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1400-824-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1996-831-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1724-861-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/556-860-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2856-894-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2228-1074-0x00000000002C0000-0x00000000002E8000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdhhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlvdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhdbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffttfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnxddt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthfvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffhfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxrxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drrrhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvfpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfvrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdvrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btvhpjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvxhdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrndjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvdjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnlxtpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhpbbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltlvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrvtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndtppdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbfrlnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvhvnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbhjpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvdhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjhlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tldvjrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvtbfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjrfhxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nllnhhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxptrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhnjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpfdfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nprxrvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxhdnhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbhlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtnnvft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxdbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dftpvtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpxbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftlhhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lntbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvdlnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2024 wrote to memory of 1952 2024 b61459d8afacc8fb9a8f6c0fc5686f44baaed1ada0573bca616d3ed05f0b3ad8N.exe 31 PID 2024 wrote to memory of 1952 2024 b61459d8afacc8fb9a8f6c0fc5686f44baaed1ada0573bca616d3ed05f0b3ad8N.exe 31 PID 2024 wrote to memory of 1952 2024 b61459d8afacc8fb9a8f6c0fc5686f44baaed1ada0573bca616d3ed05f0b3ad8N.exe 31 PID 2024 wrote to memory of 1952 2024 b61459d8afacc8fb9a8f6c0fc5686f44baaed1ada0573bca616d3ed05f0b3ad8N.exe 31 PID 1952 wrote to memory of 2880 1952 fhxdpvx.exe 32 PID 1952 wrote to memory of 2880 1952 fhxdpvx.exe 32 PID 1952 wrote to memory of 2880 1952 fhxdpvx.exe 32 PID 1952 wrote to memory of 2880 1952 fhxdpvx.exe 32 PID 2880 wrote to memory of 1852 2880 vjhbxpb.exe 33 PID 2880 wrote to memory of 1852 2880 vjhbxpb.exe 33 PID 2880 wrote to memory of 1852 2880 vjhbxpb.exe 33 PID 2880 wrote to memory of 1852 2880 vjhbxpb.exe 33 PID 1852 wrote to memory of 2796 1852 pllxh.exe 34 PID 1852 wrote to memory of 2796 1852 pllxh.exe 34 PID 1852 wrote to memory of 2796 1852 pllxh.exe 34 PID 1852 wrote to memory of 2796 1852 pllxh.exe 34 PID 2796 wrote to memory of 2748 2796 xrrdv.exe 35 PID 2796 wrote to memory of 2748 2796 xrrdv.exe 35 PID 2796 wrote to memory of 2748 2796 xrrdv.exe 35 PID 2796 wrote to memory of 2748 2796 xrrdv.exe 35 PID 2748 wrote to memory of 2844 2748 jvvplhf.exe 36 PID 2748 wrote to memory of 2844 2748 jvvplhf.exe 36 PID 2748 wrote to memory of 2844 2748 jvvplhf.exe 36 PID 2748 wrote to memory of 2844 2748 jvvplhf.exe 36 PID 2844 wrote to memory of 2892 2844 bvdlnh.exe 37 PID 2844 wrote to memory of 2892 2844 bvdlnh.exe 37 PID 2844 wrote to memory of 2892 2844 bvdlnh.exe 37 PID 2844 wrote to memory of 2892 2844 bvdlnh.exe 37 PID 2892 wrote to memory of 576 2892 rdvdpf.exe 38 PID 2892 wrote to memory of 576 2892 rdvdpf.exe 38 PID 2892 wrote to memory of 576 2892 rdvdpf.exe 38 PID 2892 wrote to memory of 576 2892 rdvdpf.exe 38 PID 576 wrote to memory of 2236 576 nfhhxp.exe 39 PID 576 wrote to memory of 2236 576 nfhhxp.exe 39 PID 576 wrote to memory of 2236 576 nfhhxp.exe 39 PID 576 wrote to memory of 2236 576 nfhhxp.exe 39 PID 2236 wrote to memory of 2572 2236 rtdpbf.exe 40 PID 2236 wrote to memory of 2572 2236 rtdpbf.exe 40 PID 2236 wrote to memory of 2572 2236 rtdpbf.exe 40 PID 2236 wrote to memory of 2572 2236 rtdpbf.exe 40 PID 2572 wrote to memory of 2900 2572 lfrndv.exe 41 PID 2572 wrote to memory of 2900 2572 lfrndv.exe 41 PID 2572 wrote to memory of 2900 2572 lfrndv.exe 41 PID 2572 wrote to memory of 2900 2572 lfrndv.exe 41 PID 2900 wrote to memory of 2888 2900 brblhrr.exe 42 PID 2900 wrote to memory of 2888 2900 brblhrr.exe 42 PID 2900 wrote to memory of 2888 2900 brblhrr.exe 42 PID 2900 wrote to memory of 2888 2900 brblhrr.exe 42 PID 2888 wrote to memory of 2940 2888 bfbxtrt.exe 43 PID 2888 wrote to memory of 2940 2888 bfbxtrt.exe 43 PID 2888 wrote to memory of 2940 2888 bfbxtrt.exe 43 PID 2888 wrote to memory of 2940 2888 bfbxtrt.exe 43 PID 2940 wrote to memory of 2984 2940 bnlbx.exe 44 PID 2940 wrote to memory of 2984 2940 bnlbx.exe 44 PID 2940 wrote to memory of 2984 2940 bnlbx.exe 44 PID 2940 wrote to memory of 2984 2940 bnlbx.exe 44 PID 2984 wrote to memory of 1640 2984 ddrxrb.exe 45 PID 2984 wrote to memory of 1640 2984 ddrxrb.exe 45 PID 2984 wrote to memory of 1640 2984 ddrxrb.exe 45 PID 2984 wrote to memory of 1640 2984 ddrxrb.exe 45 PID 1640 wrote to memory of 832 1640 tltfrfn.exe 46 PID 1640 wrote to memory of 832 1640 tltfrfn.exe 46 PID 1640 wrote to memory of 832 1640 tltfrfn.exe 46 PID 1640 wrote to memory of 832 1640 tltfrfn.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b61459d8afacc8fb9a8f6c0fc5686f44baaed1ada0573bca616d3ed05f0b3ad8N.exe"C:\Users\Admin\AppData\Local\Temp\b61459d8afacc8fb9a8f6c0fc5686f44baaed1ada0573bca616d3ed05f0b3ad8N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\fhxdpvx.exec:\fhxdpvx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\vjhbxpb.exec:\vjhbxpb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\pllxh.exec:\pllxh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\xrrdv.exec:\xrrdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\jvvplhf.exec:\jvvplhf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\bvdlnh.exec:\bvdlnh.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\rdvdpf.exec:\rdvdpf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\nfhhxp.exec:\nfhhxp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\rtdpbf.exec:\rtdpbf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\lfrndv.exec:\lfrndv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\brblhrr.exec:\brblhrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\bfbxtrt.exec:\bfbxtrt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\bnlbx.exec:\bnlbx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\ddrxrb.exec:\ddrxrb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\tltfrfn.exec:\tltfrfn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\pvhvfvv.exec:\pvhvfvv.exe17⤵
- Executes dropped EXE
PID:832 -
\??\c:\jjrrh.exec:\jjrrh.exe18⤵
- Executes dropped EXE
PID:1924 -
\??\c:\bbdlbb.exec:\bbdlbb.exe19⤵
- Executes dropped EXE
PID:2068 -
\??\c:\xrjtp.exec:\xrjtp.exe20⤵
- Executes dropped EXE
PID:1116 -
\??\c:\rjvbn.exec:\rjvbn.exe21⤵
- Executes dropped EXE
PID:2204 -
\??\c:\tpltlp.exec:\tpltlp.exe22⤵
- Executes dropped EXE
PID:3008 -
\??\c:\fdjjv.exec:\fdjjv.exe23⤵
- Executes dropped EXE
PID:1392 -
\??\c:\fhfnpf.exec:\fhfnpf.exe24⤵
- Executes dropped EXE
PID:1612 -
\??\c:\drhrdr.exec:\drhrdr.exe25⤵
- Executes dropped EXE
PID:904 -
\??\c:\nrpnlf.exec:\nrpnlf.exe26⤵
- Executes dropped EXE
PID:932 -
\??\c:\rjxrln.exec:\rjxrln.exe27⤵
- Executes dropped EXE
PID:1476 -
\??\c:\hvxdbvt.exec:\hvxdbvt.exe28⤵
- Executes dropped EXE
PID:1324 -
\??\c:\xfrjrxp.exec:\xfrjrxp.exe29⤵
- Executes dropped EXE
PID:548 -
\??\c:\lhjnj.exec:\lhjnj.exe30⤵
- Executes dropped EXE
PID:2480 -
\??\c:\pfxdh.exec:\pfxdh.exe31⤵
- Executes dropped EXE
PID:1464 -
\??\c:\dxltx.exec:\dxltx.exe32⤵
- Executes dropped EXE
PID:112 -
\??\c:\pfrlrbt.exec:\pfrlrbt.exe33⤵
- Executes dropped EXE
PID:684 -
\??\c:\txlvtf.exec:\txlvtf.exe34⤵
- Executes dropped EXE
PID:2536 -
\??\c:\txjvh.exec:\txjvh.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\hxfjxdd.exec:\hxfjxdd.exe36⤵
- Executes dropped EXE
PID:2056 -
\??\c:\vxrnl.exec:\vxrnl.exe37⤵
- Executes dropped EXE
PID:2368 -
\??\c:\hnbppt.exec:\hnbppt.exe38⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xlhfn.exec:\xlhfn.exe39⤵
- Executes dropped EXE
PID:2856 -
\??\c:\fxtrt.exec:\fxtrt.exe40⤵
- Executes dropped EXE
PID:2800 -
\??\c:\ddffvn.exec:\ddffvn.exe41⤵
- Executes dropped EXE
PID:2876 -
\??\c:\bttbrtl.exec:\bttbrtl.exe42⤵
- Executes dropped EXE
PID:3040 -
\??\c:\rvpnvjv.exec:\rvpnvjv.exe43⤵
- Executes dropped EXE
PID:2864 -
\??\c:\blldrhf.exec:\blldrhf.exe44⤵
- Executes dropped EXE
PID:2768 -
\??\c:\txvjrh.exec:\txvjrh.exe45⤵
- Executes dropped EXE
PID:2624 -
\??\c:\xllpprb.exec:\xllpprb.exe46⤵
- Executes dropped EXE
PID:1064 -
\??\c:\ddhvnd.exec:\ddhvnd.exe47⤵
- Executes dropped EXE
PID:752 -
\??\c:\hvlppx.exec:\hvlppx.exe48⤵
- Executes dropped EXE
PID:568 -
\??\c:\ddhhrx.exec:\ddhhrx.exe49⤵
- Executes dropped EXE
PID:2996 -
\??\c:\lvfjb.exec:\lvfjb.exe50⤵
- Executes dropped EXE
PID:2836 -
\??\c:\blnvt.exec:\blnvt.exe51⤵
- Executes dropped EXE
PID:2964 -
\??\c:\vfhdhd.exec:\vfhdhd.exe52⤵
- Executes dropped EXE
PID:1460 -
\??\c:\dfdvbj.exec:\dfdvbj.exe53⤵
- Executes dropped EXE
PID:2632 -
\??\c:\ddvpnd.exec:\ddvpnd.exe54⤵
- Executes dropped EXE
PID:1072 -
\??\c:\bvvvj.exec:\bvvvj.exe55⤵
- Executes dropped EXE
PID:832 -
\??\c:\hdvrx.exec:\hdvrx.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2216 -
\??\c:\jvtbfj.exec:\jvtbfj.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1608 -
\??\c:\jftjtp.exec:\jftjtp.exe58⤵
- Executes dropped EXE
PID:2000 -
\??\c:\pjjbnrj.exec:\pjjbnrj.exe59⤵
- Executes dropped EXE
PID:2060 -
\??\c:\vndvp.exec:\vndvp.exe60⤵
- Executes dropped EXE
PID:3016 -
\??\c:\tbpxd.exec:\tbpxd.exe61⤵
- Executes dropped EXE
PID:940 -
\??\c:\djrth.exec:\djrth.exe62⤵
- Executes dropped EXE
PID:808 -
\??\c:\rfthfrj.exec:\rfthfrj.exe63⤵
- Executes dropped EXE
PID:988 -
\??\c:\bnpxd.exec:\bnpxd.exe64⤵
- Executes dropped EXE
PID:600 -
\??\c:\jdlrj.exec:\jdlrj.exe65⤵
- Executes dropped EXE
PID:452 -
\??\c:\pljtjbd.exec:\pljtjbd.exe66⤵PID:1484
-
\??\c:\hfbtp.exec:\hfbtp.exe67⤵PID:3032
-
\??\c:\dhjfd.exec:\dhjfd.exe68⤵PID:2012
-
\??\c:\brhvf.exec:\brhvf.exe69⤵PID:2384
-
\??\c:\xltdx.exec:\xltdx.exe70⤵PID:564
-
\??\c:\ndhfrjj.exec:\ndhfrjj.exe71⤵PID:1976
-
\??\c:\hlnrxhn.exec:\hlnrxhn.exe72⤵PID:2284
-
\??\c:\nbnfhd.exec:\nbnfhd.exe73⤵PID:2412
-
\??\c:\vxpjjlt.exec:\vxpjjlt.exe74⤵PID:880
-
\??\c:\ptddb.exec:\ptddb.exe75⤵PID:1216
-
\??\c:\pnhxv.exec:\pnhxv.exe76⤵PID:556
-
\??\c:\dfhllv.exec:\dfhllv.exe77⤵PID:1696
-
\??\c:\dtjjvd.exec:\dtjjvd.exe78⤵PID:2780
-
\??\c:\plvhdd.exec:\plvhdd.exe79⤵PID:2364
-
\??\c:\djnhldt.exec:\djnhldt.exe80⤵PID:2704
-
\??\c:\flnld.exec:\flnld.exe81⤵PID:2808
-
\??\c:\tfdvf.exec:\tfdvf.exe82⤵PID:2804
-
\??\c:\drrltpp.exec:\drrltpp.exe83⤵PID:2868
-
\??\c:\frfjbfr.exec:\frfjbfr.exe84⤵PID:2848
-
\??\c:\tbhlph.exec:\tbhlph.exe85⤵PID:3036
-
\??\c:\fjxvv.exec:\fjxvv.exe86⤵PID:2852
-
\??\c:\rhvpppv.exec:\rhvpppv.exe87⤵PID:2588
-
\??\c:\dfdtdr.exec:\dfdtdr.exe88⤵PID:2768
-
\??\c:\vjnxjj.exec:\vjnxjj.exe89⤵PID:2624
-
\??\c:\tlptbp.exec:\tlptbp.exe90⤵PID:1064
-
\??\c:\fphtb.exec:\fphtb.exe91⤵PID:2980
-
\??\c:\npdrrlv.exec:\npdrrlv.exe92⤵PID:568
-
\??\c:\thfrdxn.exec:\thfrdxn.exe93⤵PID:2908
-
\??\c:\ftbfn.exec:\ftbfn.exe94⤵PID:2836
-
\??\c:\dxfxbtb.exec:\dxfxbtb.exe95⤵PID:2664
-
\??\c:\frrrxv.exec:\frrrxv.exe96⤵PID:1672
-
\??\c:\xjpvpd.exec:\xjpvpd.exe97⤵PID:2064
-
\??\c:\brppvtl.exec:\brppvtl.exe98⤵PID:828
-
\??\c:\hnxtnvj.exec:\hnxtnvj.exe99⤵PID:1900
-
\??\c:\ffplfp.exec:\ffplfp.exe100⤵PID:2192
-
\??\c:\ddhlxv.exec:\ddhlxv.exe101⤵PID:2084
-
\??\c:\fhrdrx.exec:\fhrdrx.exe102⤵PID:2520
-
\??\c:\rfnvxdn.exec:\rfnvxdn.exe103⤵PID:1116
-
\??\c:\drrrhf.exec:\drrrhf.exe104⤵
- System Location Discovery: System Language Discovery
PID:936 -
\??\c:\brnbf.exec:\brnbf.exe105⤵PID:844
-
\??\c:\nthxnjv.exec:\nthxnjv.exe106⤵PID:808
-
\??\c:\xljbbp.exec:\xljbbp.exe107⤵PID:288
-
\??\c:\ppbth.exec:\ppbth.exe108⤵PID:600
-
\??\c:\vlpdrh.exec:\vlpdrh.exe109⤵PID:764
-
\??\c:\vrbpxj.exec:\vrbpxj.exe110⤵PID:1484
-
\??\c:\xrnjp.exec:\xrnjp.exe111⤵PID:2432
-
\??\c:\dxxfjb.exec:\dxxfjb.exe112⤵PID:268
-
\??\c:\pfrjrn.exec:\pfrjrn.exe113⤵PID:2384
-
\??\c:\tfjjvx.exec:\tfjjvx.exe114⤵PID:2444
-
\??\c:\hrpjb.exec:\hrpjb.exe115⤵PID:1400
-
\??\c:\xvdbx.exec:\xvdbx.exe116⤵PID:1996
-
\??\c:\pjttjt.exec:\pjttjt.exe117⤵PID:2528
-
\??\c:\dxpvlhb.exec:\dxpvlhb.exe118⤵PID:2496
-
\??\c:\jxvxtl.exec:\jxvxtl.exe119⤵PID:1560
-
\??\c:\jdnhb.exec:\jdnhb.exe120⤵PID:556
-
\??\c:\ldvpv.exec:\ldvpv.exe121⤵PID:1724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-