Analysis
-
max time kernel
120s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 20:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ce8225feb6e8ff0a4006e0148f21d20debbdbb7531b48aa04eec557059bb7206N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
ce8225feb6e8ff0a4006e0148f21d20debbdbb7531b48aa04eec557059bb7206N.exe
-
Size
456KB
-
MD5
d713f0c27181112e9f2514f8bc0431d0
-
SHA1
621541a57f389516fe9d0097adb82e039d0fc1c2
-
SHA256
ce8225feb6e8ff0a4006e0148f21d20debbdbb7531b48aa04eec557059bb7206
-
SHA512
16cff9b262f11958aa79cf354f7c0deea6244bad553d5698bc70c0b55d72e1d8f1be9abbaeb3d73b8ebee8391dff6b6190535eee973aed0f1e8861b505587a48
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2524-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-25-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2980-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-79-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2364-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-157-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1016-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/880-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-377-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1652-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1412-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-448-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2152-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-477-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2408-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-527-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1356-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-630-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2316-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-686-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1880-739-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1716-790-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2076 ltjvtjr.exe 1476 fnfxbvt.exe 2980 bbfdpj.exe 2776 drdld.exe 2964 nhjrhvb.exe 2824 vppxxhd.exe 2892 bvlvh.exe 2364 pnnxpv.exe 1388 npvbdbr.exe 2316 xrrdrv.exe 2628 bnjjlb.exe 1948 ddhvlv.exe 2416 ljhxdp.exe 2872 bhlpf.exe 3052 xvhvdvh.exe 2448 tblvpn.exe 1016 rbbbpbb.exe 1768 frbrl.exe 1524 lvpfdrf.exe 2404 rbnhdjh.exe 2440 hlptj.exe 1820 nnfbhjh.exe 2108 xffxp.exe 1964 rvrbxvl.exe 1356 lnjfj.exe 880 vffhnjj.exe 2484 nvvfhv.exe 1172 dvrfffd.exe 1300 tjvth.exe 1960 tbrjxbr.exe 1020 tvftp.exe 1808 lnvxlh.exe 2388 lljffnr.exe 3048 dvvxnj.exe 1616 vvftxpl.exe 1288 dbnvdh.exe 3032 hdbbdrb.exe 1500 txthjp.exe 3056 plfdppd.exe 3060 tfdlf.exe 2772 thljxpn.exe 2812 hxhnb.exe 1336 rvfdbbj.exe 644 hhnvj.exe 1652 prltx.exe 1044 prhdlb.exe 932 lthnnn.exe 2240 nrvbf.exe 436 rjfxdhr.exe 1948 jvhhnjj.exe 3004 rfpxnpn.exe 2832 fnrfnvr.exe 1412 jdjbr.exe 980 bxbxv.exe 384 lpjnb.exe 2380 jjhlvrf.exe 2152 pxtjdvb.exe 2408 llrxrj.exe 1524 jtxlfj.exe 2468 vxvhxdt.exe 2384 ltlvlrh.exe 904 btlhrnf.exe 2444 tbpjv.exe 1684 tjbhxfl.exe -
resource yara_rule behavioral1/memory/2076-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-477-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2408-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-476-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2444-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-630-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2316-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-686-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2832-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-790-0x00000000003D0000-0x00000000003FA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpxdtnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhdln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnxhftb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjvdlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njjbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrvvjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtxhlnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvbfddf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbvtdvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdxnddn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjptrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xftfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppltv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvpfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjnpnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbpjfjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlthpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thphlnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blvnjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvvhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxvll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxldxjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlhfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blfnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnftnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljhnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtnvlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnjdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvlpdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpxvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlbvpfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brptfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvvhxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nndrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpfvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvxjfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvljbr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2076 2524 ce8225feb6e8ff0a4006e0148f21d20debbdbb7531b48aa04eec557059bb7206N.exe 30 PID 2524 wrote to memory of 2076 2524 ce8225feb6e8ff0a4006e0148f21d20debbdbb7531b48aa04eec557059bb7206N.exe 30 PID 2524 wrote to memory of 2076 2524 ce8225feb6e8ff0a4006e0148f21d20debbdbb7531b48aa04eec557059bb7206N.exe 30 PID 2524 wrote to memory of 2076 2524 ce8225feb6e8ff0a4006e0148f21d20debbdbb7531b48aa04eec557059bb7206N.exe 30 PID 2076 wrote to memory of 1476 2076 ltjvtjr.exe 31 PID 2076 wrote to memory of 1476 2076 ltjvtjr.exe 31 PID 2076 wrote to memory of 1476 2076 ltjvtjr.exe 31 PID 2076 wrote to memory of 1476 2076 ltjvtjr.exe 31 PID 1476 wrote to memory of 2980 1476 fnfxbvt.exe 32 PID 1476 wrote to memory of 2980 1476 fnfxbvt.exe 32 PID 1476 wrote to memory of 2980 1476 fnfxbvt.exe 32 PID 1476 wrote to memory of 2980 1476 fnfxbvt.exe 32 PID 2980 wrote to memory of 2776 2980 bbfdpj.exe 33 PID 2980 wrote to memory of 2776 2980 bbfdpj.exe 33 PID 2980 wrote to memory of 2776 2980 bbfdpj.exe 33 PID 2980 wrote to memory of 2776 2980 bbfdpj.exe 33 PID 2776 wrote to memory of 2964 2776 drdld.exe 34 PID 2776 wrote to memory of 2964 2776 drdld.exe 34 PID 2776 wrote to memory of 2964 2776 drdld.exe 34 PID 2776 wrote to memory of 2964 2776 drdld.exe 34 PID 2964 wrote to memory of 2824 2964 nhjrhvb.exe 35 PID 2964 wrote to memory of 2824 2964 nhjrhvb.exe 35 PID 2964 wrote to memory of 2824 2964 nhjrhvb.exe 35 PID 2964 wrote to memory of 2824 2964 nhjrhvb.exe 35 PID 2824 wrote to memory of 2892 2824 vppxxhd.exe 36 PID 2824 wrote to memory of 2892 2824 vppxxhd.exe 36 PID 2824 wrote to memory of 2892 2824 vppxxhd.exe 36 PID 2824 wrote to memory of 2892 2824 vppxxhd.exe 36 PID 2892 wrote to memory of 2364 2892 bvlvh.exe 37 PID 2892 wrote to memory of 2364 2892 bvlvh.exe 37 PID 2892 wrote to memory of 2364 2892 bvlvh.exe 37 PID 2892 wrote to memory of 2364 2892 bvlvh.exe 37 PID 2364 wrote to memory of 1388 2364 pnnxpv.exe 38 PID 2364 wrote to memory of 1388 2364 pnnxpv.exe 38 PID 2364 wrote to memory of 1388 2364 pnnxpv.exe 38 PID 2364 wrote to memory of 1388 2364 pnnxpv.exe 38 PID 1388 wrote to memory of 2316 1388 npvbdbr.exe 39 PID 1388 wrote to memory of 2316 1388 npvbdbr.exe 39 PID 1388 wrote to memory of 2316 1388 npvbdbr.exe 39 PID 1388 wrote to memory of 2316 1388 npvbdbr.exe 39 PID 2316 wrote to memory of 2628 2316 xrrdrv.exe 40 PID 2316 wrote to memory of 2628 2316 xrrdrv.exe 40 PID 2316 wrote to memory of 2628 2316 xrrdrv.exe 40 PID 2316 wrote to memory of 2628 2316 xrrdrv.exe 40 PID 2628 wrote to memory of 1948 2628 bnjjlb.exe 41 PID 2628 wrote to memory of 1948 2628 bnjjlb.exe 41 PID 2628 wrote to memory of 1948 2628 bnjjlb.exe 41 PID 2628 wrote to memory of 1948 2628 bnjjlb.exe 41 PID 1948 wrote to memory of 2416 1948 ddhvlv.exe 42 PID 1948 wrote to memory of 2416 1948 ddhvlv.exe 42 PID 1948 wrote to memory of 2416 1948 ddhvlv.exe 42 PID 1948 wrote to memory of 2416 1948 ddhvlv.exe 42 PID 2416 wrote to memory of 2872 2416 ljhxdp.exe 43 PID 2416 wrote to memory of 2872 2416 ljhxdp.exe 43 PID 2416 wrote to memory of 2872 2416 ljhxdp.exe 43 PID 2416 wrote to memory of 2872 2416 ljhxdp.exe 43 PID 2872 wrote to memory of 3052 2872 bhlpf.exe 44 PID 2872 wrote to memory of 3052 2872 bhlpf.exe 44 PID 2872 wrote to memory of 3052 2872 bhlpf.exe 44 PID 2872 wrote to memory of 3052 2872 bhlpf.exe 44 PID 3052 wrote to memory of 2448 3052 xvhvdvh.exe 45 PID 3052 wrote to memory of 2448 3052 xvhvdvh.exe 45 PID 3052 wrote to memory of 2448 3052 xvhvdvh.exe 45 PID 3052 wrote to memory of 2448 3052 xvhvdvh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce8225feb6e8ff0a4006e0148f21d20debbdbb7531b48aa04eec557059bb7206N.exe"C:\Users\Admin\AppData\Local\Temp\ce8225feb6e8ff0a4006e0148f21d20debbdbb7531b48aa04eec557059bb7206N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\ltjvtjr.exec:\ltjvtjr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\fnfxbvt.exec:\fnfxbvt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\bbfdpj.exec:\bbfdpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\drdld.exec:\drdld.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\nhjrhvb.exec:\nhjrhvb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\vppxxhd.exec:\vppxxhd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\bvlvh.exec:\bvlvh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\pnnxpv.exec:\pnnxpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\npvbdbr.exec:\npvbdbr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\xrrdrv.exec:\xrrdrv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\bnjjlb.exec:\bnjjlb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\ddhvlv.exec:\ddhvlv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\ljhxdp.exec:\ljhxdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\bhlpf.exec:\bhlpf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\xvhvdvh.exec:\xvhvdvh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\tblvpn.exec:\tblvpn.exe17⤵
- Executes dropped EXE
PID:2448 -
\??\c:\rbbbpbb.exec:\rbbbpbb.exe18⤵
- Executes dropped EXE
PID:1016 -
\??\c:\frbrl.exec:\frbrl.exe19⤵
- Executes dropped EXE
PID:1768 -
\??\c:\lvpfdrf.exec:\lvpfdrf.exe20⤵
- Executes dropped EXE
PID:1524 -
\??\c:\rbnhdjh.exec:\rbnhdjh.exe21⤵
- Executes dropped EXE
PID:2404 -
\??\c:\hlptj.exec:\hlptj.exe22⤵
- Executes dropped EXE
PID:2440 -
\??\c:\nnfbhjh.exec:\nnfbhjh.exe23⤵
- Executes dropped EXE
PID:1820 -
\??\c:\xffxp.exec:\xffxp.exe24⤵
- Executes dropped EXE
PID:2108 -
\??\c:\rvrbxvl.exec:\rvrbxvl.exe25⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lnjfj.exec:\lnjfj.exe26⤵
- Executes dropped EXE
PID:1356 -
\??\c:\vffhnjj.exec:\vffhnjj.exe27⤵
- Executes dropped EXE
PID:880 -
\??\c:\nvvfhv.exec:\nvvfhv.exe28⤵
- Executes dropped EXE
PID:2484 -
\??\c:\dvrfffd.exec:\dvrfffd.exe29⤵
- Executes dropped EXE
PID:1172 -
\??\c:\tjvth.exec:\tjvth.exe30⤵
- Executes dropped EXE
PID:1300 -
\??\c:\tbrjxbr.exec:\tbrjxbr.exe31⤵
- Executes dropped EXE
PID:1960 -
\??\c:\tvftp.exec:\tvftp.exe32⤵
- Executes dropped EXE
PID:1020 -
\??\c:\lnvxlh.exec:\lnvxlh.exe33⤵
- Executes dropped EXE
PID:1808 -
\??\c:\lljffnr.exec:\lljffnr.exe34⤵
- Executes dropped EXE
PID:2388 -
\??\c:\dvvxnj.exec:\dvvxnj.exe35⤵
- Executes dropped EXE
PID:3048 -
\??\c:\vvftxpl.exec:\vvftxpl.exe36⤵
- Executes dropped EXE
PID:1616 -
\??\c:\dbnvdh.exec:\dbnvdh.exe37⤵
- Executes dropped EXE
PID:1288 -
\??\c:\hdbbdrb.exec:\hdbbdrb.exe38⤵
- Executes dropped EXE
PID:3032 -
\??\c:\txthjp.exec:\txthjp.exe39⤵
- Executes dropped EXE
PID:1500 -
\??\c:\plfdppd.exec:\plfdppd.exe40⤵
- Executes dropped EXE
PID:3056 -
\??\c:\tfdlf.exec:\tfdlf.exe41⤵
- Executes dropped EXE
PID:3060 -
\??\c:\thljxpn.exec:\thljxpn.exe42⤵
- Executes dropped EXE
PID:2772 -
\??\c:\hxhnb.exec:\hxhnb.exe43⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rvfdbbj.exec:\rvfdbbj.exe44⤵
- Executes dropped EXE
PID:1336 -
\??\c:\hhnvj.exec:\hhnvj.exe45⤵
- Executes dropped EXE
PID:644 -
\??\c:\prltx.exec:\prltx.exe46⤵
- Executes dropped EXE
PID:1652 -
\??\c:\prhdlb.exec:\prhdlb.exe47⤵
- Executes dropped EXE
PID:1044 -
\??\c:\lthnnn.exec:\lthnnn.exe48⤵
- Executes dropped EXE
PID:932 -
\??\c:\nrvbf.exec:\nrvbf.exe49⤵
- Executes dropped EXE
PID:2240 -
\??\c:\rjfxdhr.exec:\rjfxdhr.exe50⤵
- Executes dropped EXE
PID:436 -
\??\c:\jvhhnjj.exec:\jvhhnjj.exe51⤵
- Executes dropped EXE
PID:1948 -
\??\c:\rfpxnpn.exec:\rfpxnpn.exe52⤵
- Executes dropped EXE
PID:3004 -
\??\c:\fnrfnvr.exec:\fnrfnvr.exe53⤵
- Executes dropped EXE
PID:2832 -
\??\c:\jdjbr.exec:\jdjbr.exe54⤵
- Executes dropped EXE
PID:1412 -
\??\c:\bxbxv.exec:\bxbxv.exe55⤵
- Executes dropped EXE
PID:980 -
\??\c:\lpjnb.exec:\lpjnb.exe56⤵
- Executes dropped EXE
PID:384 -
\??\c:\jjhlvrf.exec:\jjhlvrf.exe57⤵
- Executes dropped EXE
PID:2380 -
\??\c:\pxtjdvb.exec:\pxtjdvb.exe58⤵
- Executes dropped EXE
PID:2152 -
\??\c:\llrxrj.exec:\llrxrj.exe59⤵
- Executes dropped EXE
PID:2408 -
\??\c:\jtxlfj.exec:\jtxlfj.exe60⤵
- Executes dropped EXE
PID:1524 -
\??\c:\vxvhxdt.exec:\vxvhxdt.exe61⤵
- Executes dropped EXE
PID:2468 -
\??\c:\ltlvlrh.exec:\ltlvlrh.exe62⤵
- Executes dropped EXE
PID:2384 -
\??\c:\btlhrnf.exec:\btlhrnf.exe63⤵
- Executes dropped EXE
PID:904 -
\??\c:\tbpjv.exec:\tbpjv.exe64⤵
- Executes dropped EXE
PID:2444 -
\??\c:\tjbhxfl.exec:\tjbhxfl.exe65⤵
- Executes dropped EXE
PID:1684 -
\??\c:\hvljbr.exec:\hvljbr.exe66⤵
- System Location Discovery: System Language Discovery
PID:2204 -
\??\c:\brjprdt.exec:\brjprdt.exe67⤵PID:1508
-
\??\c:\bxhdl.exec:\bxhdl.exe68⤵PID:1356
-
\??\c:\nlxjvvb.exec:\nlxjvvb.exe69⤵PID:880
-
\??\c:\nlhlrh.exec:\nlhlrh.exe70⤵PID:1436
-
\??\c:\jlljpx.exec:\jlljpx.exe71⤵PID:2296
-
\??\c:\bfhddn.exec:\bfhddn.exe72⤵PID:524
-
\??\c:\pdvdtv.exec:\pdvdtv.exe73⤵PID:940
-
\??\c:\fbrbp.exec:\fbrbp.exe74⤵PID:1028
-
\??\c:\phdrrvl.exec:\phdrrvl.exe75⤵PID:1580
-
\??\c:\ntfxh.exec:\ntfxh.exe76⤵PID:804
-
\??\c:\xdlfdn.exec:\xdlfdn.exe77⤵PID:2956
-
\??\c:\pbjdjhh.exec:\pbjdjhh.exe78⤵PID:2292
-
\??\c:\vtpfbl.exec:\vtpfbl.exe79⤵PID:2928
-
\??\c:\nxhrr.exec:\nxhrr.exe80⤵PID:1476
-
\??\c:\xbhjh.exec:\xbhjh.exe81⤵PID:2988
-
\??\c:\nnlvtvr.exec:\nnlvtvr.exe82⤵PID:1048
-
\??\c:\bndbf.exec:\bndbf.exe83⤵PID:2888
-
\??\c:\jpjxpb.exec:\jpjxpb.exe84⤵PID:2944
-
\??\c:\hvrhv.exec:\hvrhv.exe85⤵PID:2836
-
\??\c:\lhntjbx.exec:\lhntjbx.exe86⤵PID:2940
-
\??\c:\jnpdv.exec:\jnpdv.exe87⤵PID:1620
-
\??\c:\jnnjxbx.exec:\jnnjxbx.exe88⤵PID:832
-
\??\c:\vdtddd.exec:\vdtddd.exe89⤵PID:2324
-
\??\c:\xhnbd.exec:\xhnbd.exe90⤵PID:2316
-
\??\c:\lntrhx.exec:\lntrhx.exe91⤵PID:932
-
\??\c:\dffvv.exec:\dffvv.exe92⤵PID:2276
-
\??\c:\bdrtxx.exec:\bdrtxx.exe93⤵PID:436
-
\??\c:\bnrblnx.exec:\bnrblnx.exe94⤵PID:1948
-
\??\c:\vdxbrbv.exec:\vdxbrbv.exe95⤵PID:2368
-
\??\c:\hfpnrhr.exec:\hfpnrhr.exe96⤵PID:2832
-
\??\c:\vvffxr.exec:\vvffxr.exe97⤵PID:1412
-
\??\c:\bvvxbv.exec:\bvvxbv.exe98⤵PID:1880
-
\??\c:\jxtbnpv.exec:\jxtbnpv.exe99⤵PID:2348
-
\??\c:\nbvndb.exec:\nbvndb.exe100⤵PID:2380
-
\??\c:\vbrlbp.exec:\vbrlbp.exe101⤵PID:2152
-
\??\c:\xldlr.exec:\xldlr.exe102⤵PID:2504
-
\??\c:\pbdpljf.exec:\pbdpljf.exe103⤵PID:2176
-
\??\c:\ffxvdtv.exec:\ffxvdtv.exe104⤵PID:2220
-
\??\c:\dffxjd.exec:\dffxjd.exe105⤵PID:1972
-
\??\c:\vtnvp.exec:\vtnvp.exe106⤵PID:1716
-
\??\c:\hnxrjf.exec:\hnxrjf.exe107⤵PID:1804
-
\??\c:\nbbjb.exec:\nbbjb.exe108⤵PID:1924
-
\??\c:\rfdvvt.exec:\rfdvvt.exe109⤵PID:2572
-
\??\c:\pdvrd.exec:\pdvrd.exe110⤵PID:368
-
\??\c:\xxxlh.exec:\xxxlh.exe111⤵PID:1284
-
\??\c:\bjnbvp.exec:\bjnbvp.exe112⤵PID:668
-
\??\c:\dvdtfh.exec:\dvdtfh.exe113⤵PID:1936
-
\??\c:\jpbnv.exec:\jpbnv.exe114⤵PID:1324
-
\??\c:\fpbtjd.exec:\fpbtjd.exe115⤵PID:2604
-
\??\c:\rhntrp.exec:\rhntrp.exe116⤵PID:1960
-
\??\c:\xvjhtrn.exec:\xvjhtrn.exe117⤵PID:1020
-
\??\c:\nvjvp.exec:\nvjvp.exe118⤵PID:2548
-
\??\c:\txrbr.exec:\txrbr.exe119⤵PID:1812
-
\??\c:\vlbtfpr.exec:\vlbtfpr.exe120⤵PID:1612
-
\??\c:\txnndf.exec:\txnndf.exe121⤵PID:2912
-
\??\c:\plprtt.exec:\plprtt.exe122⤵PID:2976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-