Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 22:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ec98b1cd958f44fabf89f07abbba3720fc1570518db27ad209269989673f4ae0N.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
ec98b1cd958f44fabf89f07abbba3720fc1570518db27ad209269989673f4ae0N.exe
-
Size
452KB
-
MD5
8a6602ec10ed9cfb6af6a56271242100
-
SHA1
f57d7cccb3f2a7f54b5632059f322b60ee43ee6e
-
SHA256
ec98b1cd958f44fabf89f07abbba3720fc1570518db27ad209269989673f4ae0
-
SHA512
5c78b34777afd24861b2223267efd6c26ec2c7347b123c49edbbdd0bf096c538247af0fbefbb06a74ee6af1df3097b0d034a79fc5992ea8d559331a38f2c1cb5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/844-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-79-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2924-97-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2228-107-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2228-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1472-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/364-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/108-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-413-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2344-474-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2292-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/388-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/388-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-620-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1364-667-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1784-715-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-714-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/592-743-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/980-789-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2156-796-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-837-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2684 rvntlbl.exe 2740 xrdpn.exe 2788 dxpxx.exe 2976 rddvf.exe 2764 ltvlxrp.exe 2608 pxrff.exe 1620 tvdrv.exe 2576 dlxjnx.exe 272 rhptt.exe 2924 jfhll.exe 2228 lbtrtn.exe 2904 ndpnjj.exe 2396 lfvffxd.exe 2220 hjtxh.exe 2632 hpfrf.exe 592 rrrnjlp.exe 2212 xpptxvp.exe 2344 hvlnjlj.exe 2416 bpbhv.exe 2400 vjfnj.exe 2108 xttbxh.exe 1704 tvfjxt.exe 2480 htxvjp.exe 2880 jtvxfxl.exe 2004 fjnfvrf.exe 1472 vrljdh.exe 1964 vjbjt.exe 364 dxvjlpd.exe 1616 fvjjf.exe 2512 xdpxdj.exe 108 rrbvltp.exe 892 tjtlfhr.exe 2260 vnprvhn.exe 2876 dnvnn.exe 1588 ddntfn.exe 2720 hlbnlh.exe 2860 hltbtp.exe 2748 rhffpp.exe 2628 fnbhb.exe 2332 jdbdxtf.exe 2588 pfhppjx.exe 2560 ffvjvvf.exe 1200 jfnlbt.exe 1072 ldndthh.exe 1660 nddtn.exe 3008 fvlvjpt.exe 1988 tbrrrdx.exe 2580 xnfjrv.exe 1776 bjnrtvv.exe 648 jlfphpl.exe 1924 pdbvll.exe 1380 hrjtn.exe 2240 drvlptt.exe 1968 dtljpt.exe 600 frxrh.exe 2432 pjnnfd.exe 1056 phdfb.exe 2344 lhdhpx.exe 2292 xxjnvr.exe 2104 jpdxh.exe 388 dntbr.exe 708 jrtxt.exe 236 lnnrbv.exe 1908 xphfbjd.exe -
resource yara_rule behavioral1/memory/844-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/364-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/388-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/388-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-776-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-789-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1848-837-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xttbxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlpxhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfjhnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhfvlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnpdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brjnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lptfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfpljb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhvvdbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxdrfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbddfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhtjjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhllb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnrjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdpfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfbptfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhpnvdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvjjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhxlfbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlhtln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftnlfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttvjrfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftnrdbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvnrxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdhtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndrtthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxppjhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnbjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnlvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxntv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txdxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjxlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvfdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpxbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvldthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prphtdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hllph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlxjnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbtxvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 844 wrote to memory of 2684 844 ec98b1cd958f44fabf89f07abbba3720fc1570518db27ad209269989673f4ae0N.exe 30 PID 844 wrote to memory of 2684 844 ec98b1cd958f44fabf89f07abbba3720fc1570518db27ad209269989673f4ae0N.exe 30 PID 844 wrote to memory of 2684 844 ec98b1cd958f44fabf89f07abbba3720fc1570518db27ad209269989673f4ae0N.exe 30 PID 844 wrote to memory of 2684 844 ec98b1cd958f44fabf89f07abbba3720fc1570518db27ad209269989673f4ae0N.exe 30 PID 2684 wrote to memory of 2740 2684 rvntlbl.exe 31 PID 2684 wrote to memory of 2740 2684 rvntlbl.exe 31 PID 2684 wrote to memory of 2740 2684 rvntlbl.exe 31 PID 2684 wrote to memory of 2740 2684 rvntlbl.exe 31 PID 2740 wrote to memory of 2788 2740 xrdpn.exe 32 PID 2740 wrote to memory of 2788 2740 xrdpn.exe 32 PID 2740 wrote to memory of 2788 2740 xrdpn.exe 32 PID 2740 wrote to memory of 2788 2740 xrdpn.exe 32 PID 2788 wrote to memory of 2976 2788 dxpxx.exe 33 PID 2788 wrote to memory of 2976 2788 dxpxx.exe 33 PID 2788 wrote to memory of 2976 2788 dxpxx.exe 33 PID 2788 wrote to memory of 2976 2788 dxpxx.exe 33 PID 2976 wrote to memory of 2764 2976 rddvf.exe 34 PID 2976 wrote to memory of 2764 2976 rddvf.exe 34 PID 2976 wrote to memory of 2764 2976 rddvf.exe 34 PID 2976 wrote to memory of 2764 2976 rddvf.exe 34 PID 2764 wrote to memory of 2608 2764 ltvlxrp.exe 35 PID 2764 wrote to memory of 2608 2764 ltvlxrp.exe 35 PID 2764 wrote to memory of 2608 2764 ltvlxrp.exe 35 PID 2764 wrote to memory of 2608 2764 ltvlxrp.exe 35 PID 2608 wrote to memory of 1620 2608 pxrff.exe 36 PID 2608 wrote to memory of 1620 2608 pxrff.exe 36 PID 2608 wrote to memory of 1620 2608 pxrff.exe 36 PID 2608 wrote to memory of 1620 2608 pxrff.exe 36 PID 1620 wrote to memory of 2576 1620 tvdrv.exe 37 PID 1620 wrote to memory of 2576 1620 tvdrv.exe 37 PID 1620 wrote to memory of 2576 1620 tvdrv.exe 37 PID 1620 wrote to memory of 2576 1620 tvdrv.exe 37 PID 2576 wrote to memory of 272 2576 dlxjnx.exe 38 PID 2576 wrote to memory of 272 2576 dlxjnx.exe 38 PID 2576 wrote to memory of 272 2576 dlxjnx.exe 38 PID 2576 wrote to memory of 272 2576 dlxjnx.exe 38 PID 272 wrote to memory of 2924 272 rhptt.exe 39 PID 272 wrote to memory of 2924 272 rhptt.exe 39 PID 272 wrote to memory of 2924 272 rhptt.exe 39 PID 272 wrote to memory of 2924 272 rhptt.exe 39 PID 2924 wrote to memory of 2228 2924 jfhll.exe 40 PID 2924 wrote to memory of 2228 2924 jfhll.exe 40 PID 2924 wrote to memory of 2228 2924 jfhll.exe 40 PID 2924 wrote to memory of 2228 2924 jfhll.exe 40 PID 2228 wrote to memory of 2904 2228 lbtrtn.exe 41 PID 2228 wrote to memory of 2904 2228 lbtrtn.exe 41 PID 2228 wrote to memory of 2904 2228 lbtrtn.exe 41 PID 2228 wrote to memory of 2904 2228 lbtrtn.exe 41 PID 2904 wrote to memory of 2396 2904 ndpnjj.exe 42 PID 2904 wrote to memory of 2396 2904 ndpnjj.exe 42 PID 2904 wrote to memory of 2396 2904 ndpnjj.exe 42 PID 2904 wrote to memory of 2396 2904 ndpnjj.exe 42 PID 2396 wrote to memory of 2220 2396 lfvffxd.exe 43 PID 2396 wrote to memory of 2220 2396 lfvffxd.exe 43 PID 2396 wrote to memory of 2220 2396 lfvffxd.exe 43 PID 2396 wrote to memory of 2220 2396 lfvffxd.exe 43 PID 2220 wrote to memory of 2632 2220 hjtxh.exe 44 PID 2220 wrote to memory of 2632 2220 hjtxh.exe 44 PID 2220 wrote to memory of 2632 2220 hjtxh.exe 44 PID 2220 wrote to memory of 2632 2220 hjtxh.exe 44 PID 2632 wrote to memory of 592 2632 hpfrf.exe 45 PID 2632 wrote to memory of 592 2632 hpfrf.exe 45 PID 2632 wrote to memory of 592 2632 hpfrf.exe 45 PID 2632 wrote to memory of 592 2632 hpfrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec98b1cd958f44fabf89f07abbba3720fc1570518db27ad209269989673f4ae0N.exe"C:\Users\Admin\AppData\Local\Temp\ec98b1cd958f44fabf89f07abbba3720fc1570518db27ad209269989673f4ae0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\rvntlbl.exec:\rvntlbl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\xrdpn.exec:\xrdpn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\dxpxx.exec:\dxpxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\rddvf.exec:\rddvf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\ltvlxrp.exec:\ltvlxrp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\pxrff.exec:\pxrff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\tvdrv.exec:\tvdrv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\dlxjnx.exec:\dlxjnx.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\rhptt.exec:\rhptt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:272 -
\??\c:\jfhll.exec:\jfhll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\lbtrtn.exec:\lbtrtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\ndpnjj.exec:\ndpnjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\lfvffxd.exec:\lfvffxd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\hjtxh.exec:\hjtxh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\hpfrf.exec:\hpfrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\rrrnjlp.exec:\rrrnjlp.exe17⤵
- Executes dropped EXE
PID:592 -
\??\c:\xpptxvp.exec:\xpptxvp.exe18⤵
- Executes dropped EXE
PID:2212 -
\??\c:\hvlnjlj.exec:\hvlnjlj.exe19⤵
- Executes dropped EXE
PID:2344 -
\??\c:\bpbhv.exec:\bpbhv.exe20⤵
- Executes dropped EXE
PID:2416 -
\??\c:\vjfnj.exec:\vjfnj.exe21⤵
- Executes dropped EXE
PID:2400 -
\??\c:\xttbxh.exec:\xttbxh.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2108 -
\??\c:\tvfjxt.exec:\tvfjxt.exe23⤵
- Executes dropped EXE
PID:1704 -
\??\c:\htxvjp.exec:\htxvjp.exe24⤵
- Executes dropped EXE
PID:2480 -
\??\c:\jtvxfxl.exec:\jtvxfxl.exe25⤵
- Executes dropped EXE
PID:2880 -
\??\c:\fjnfvrf.exec:\fjnfvrf.exe26⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vrljdh.exec:\vrljdh.exe27⤵
- Executes dropped EXE
PID:1472 -
\??\c:\vjbjt.exec:\vjbjt.exe28⤵
- Executes dropped EXE
PID:1964 -
\??\c:\dxvjlpd.exec:\dxvjlpd.exe29⤵
- Executes dropped EXE
PID:364 -
\??\c:\fvjjf.exec:\fvjjf.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1616 -
\??\c:\xdpxdj.exec:\xdpxdj.exe31⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rrbvltp.exec:\rrbvltp.exe32⤵
- Executes dropped EXE
PID:108 -
\??\c:\tjtlfhr.exec:\tjtlfhr.exe33⤵
- Executes dropped EXE
PID:892 -
\??\c:\vnprvhn.exec:\vnprvhn.exe34⤵
- Executes dropped EXE
PID:2260 -
\??\c:\dnvnn.exec:\dnvnn.exe35⤵
- Executes dropped EXE
PID:2876 -
\??\c:\ddntfn.exec:\ddntfn.exe36⤵
- Executes dropped EXE
PID:1588 -
\??\c:\hlbnlh.exec:\hlbnlh.exe37⤵
- Executes dropped EXE
PID:2720 -
\??\c:\hltbtp.exec:\hltbtp.exe38⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rhffpp.exec:\rhffpp.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\fnbhb.exec:\fnbhb.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jdbdxtf.exec:\jdbdxtf.exe41⤵
- Executes dropped EXE
PID:2332 -
\??\c:\pfhppjx.exec:\pfhppjx.exe42⤵
- Executes dropped EXE
PID:2588 -
\??\c:\ffvjvvf.exec:\ffvjvvf.exe43⤵
- Executes dropped EXE
PID:2560 -
\??\c:\jfnlbt.exec:\jfnlbt.exe44⤵
- Executes dropped EXE
PID:1200 -
\??\c:\ldndthh.exec:\ldndthh.exe45⤵
- Executes dropped EXE
PID:1072 -
\??\c:\nddtn.exec:\nddtn.exe46⤵
- Executes dropped EXE
PID:1660 -
\??\c:\fvlvjpt.exec:\fvlvjpt.exe47⤵
- Executes dropped EXE
PID:3008 -
\??\c:\tbrrrdx.exec:\tbrrrdx.exe48⤵
- Executes dropped EXE
PID:1988 -
\??\c:\xnfjrv.exec:\xnfjrv.exe49⤵
- Executes dropped EXE
PID:2580 -
\??\c:\bjnrtvv.exec:\bjnrtvv.exe50⤵
- Executes dropped EXE
PID:1776 -
\??\c:\jlfphpl.exec:\jlfphpl.exe51⤵
- Executes dropped EXE
PID:648 -
\??\c:\pdbvll.exec:\pdbvll.exe52⤵
- Executes dropped EXE
PID:1924 -
\??\c:\hrjtn.exec:\hrjtn.exe53⤵
- Executes dropped EXE
PID:1380 -
\??\c:\drvlptt.exec:\drvlptt.exe54⤵
- Executes dropped EXE
PID:2240 -
\??\c:\dtljpt.exec:\dtljpt.exe55⤵
- Executes dropped EXE
PID:1968 -
\??\c:\frxrh.exec:\frxrh.exe56⤵
- Executes dropped EXE
PID:600 -
\??\c:\pjnnfd.exec:\pjnnfd.exe57⤵
- Executes dropped EXE
PID:2432 -
\??\c:\phdfb.exec:\phdfb.exe58⤵
- Executes dropped EXE
PID:1056 -
\??\c:\lhdhpx.exec:\lhdhpx.exe59⤵
- Executes dropped EXE
PID:2344 -
\??\c:\xxjnvr.exec:\xxjnvr.exe60⤵
- Executes dropped EXE
PID:2292 -
\??\c:\jpdxh.exec:\jpdxh.exe61⤵
- Executes dropped EXE
PID:2104 -
\??\c:\dntbr.exec:\dntbr.exe62⤵
- Executes dropped EXE
PID:388 -
\??\c:\jrtxt.exec:\jrtxt.exe63⤵
- Executes dropped EXE
PID:708 -
\??\c:\lnnrbv.exec:\lnnrbv.exe64⤵
- Executes dropped EXE
PID:236 -
\??\c:\xphfbjd.exec:\xphfbjd.exe65⤵
- Executes dropped EXE
PID:1908 -
\??\c:\phtvp.exec:\phtvp.exe66⤵PID:2324
-
\??\c:\rnxdnpj.exec:\rnxdnpj.exe67⤵PID:2004
-
\??\c:\frlndt.exec:\frlndt.exe68⤵PID:1508
-
\??\c:\dhxtlnr.exec:\dhxtlnr.exe69⤵PID:3024
-
\??\c:\bdvbt.exec:\bdvbt.exe70⤵PID:2524
-
\??\c:\jrhxv.exec:\jrhxv.exe71⤵PID:1312
-
\??\c:\lhdjd.exec:\lhdjd.exe72⤵PID:2500
-
\??\c:\dlrfh.exec:\dlrfh.exe73⤵PID:2456
-
\??\c:\nvbxfjb.exec:\nvbxfjb.exe74⤵PID:1188
-
\??\c:\vbtvx.exec:\vbtvx.exe75⤵PID:108
-
\??\c:\htpjn.exec:\htpjn.exe76⤵PID:1996
-
\??\c:\jnrxv.exec:\jnrxv.exe77⤵PID:2508
-
\??\c:\dlfftn.exec:\dlfftn.exe78⤵PID:1564
-
\??\c:\vvjrnpl.exec:\vvjrnpl.exe79⤵PID:2792
-
\??\c:\xnfxr.exec:\xnfxr.exe80⤵PID:2700
-
\??\c:\hllpxnx.exec:\hllpxnx.exe81⤵PID:2164
-
\??\c:\jlvxhlb.exec:\jlvxhlb.exe82⤵PID:2744
-
\??\c:\nfpljb.exec:\nfpljb.exe83⤵
- System Location Discovery: System Language Discovery
PID:2856 -
\??\c:\nxfbxr.exec:\nxfbxr.exe84⤵PID:2704
-
\??\c:\pdlfvt.exec:\pdlfvt.exe85⤵PID:2656
-
\??\c:\xttxrdn.exec:\xttxrdn.exe86⤵PID:2588
-
\??\c:\txdxflr.exec:\txdxflr.exe87⤵
- System Location Discovery: System Language Discovery
PID:1104 -
\??\c:\plnhd.exec:\plnhd.exe88⤵PID:1364
-
\??\c:\djpnxn.exec:\djpnxn.exe89⤵PID:2688
-
\??\c:\vjlrl.exec:\vjlrl.exe90⤵PID:272
-
\??\c:\brvbvvf.exec:\brvbvvf.exe91⤵PID:3008
-
\??\c:\bhnxbht.exec:\bhnxbht.exe92⤵PID:2496
-
\??\c:\dblbtd.exec:\dblbtd.exe93⤵PID:876
-
\??\c:\rnldf.exec:\rnldf.exe94⤵PID:2044
-
\??\c:\pvlrdt.exec:\pvlrdt.exe95⤵PID:1156
-
\??\c:\vrxhrxr.exec:\vrxhrxr.exe96⤵PID:1784
-
\??\c:\dtxnfj.exec:\dtxnfj.exe97⤵PID:2956
-
\??\c:\nlrnfdf.exec:\nlrnfdf.exe98⤵PID:2632
-
\??\c:\dnrvjn.exec:\dnrvjn.exe99⤵PID:592
-
\??\c:\vbhbpdp.exec:\vbhbpdp.exe100⤵PID:2336
-
\??\c:\pnhnnv.exec:\pnhnnv.exe101⤵PID:2472
-
\??\c:\nprhj.exec:\nprhj.exe102⤵PID:2128
-
\??\c:\vhbddx.exec:\vhbddx.exe103⤵PID:2356
-
\??\c:\ftnlfd.exec:\ftnlfd.exe104⤵
- System Location Discovery: System Language Discovery
PID:2292 -
\??\c:\vvvhpjb.exec:\vvvhpjb.exe105⤵PID:2400
-
\??\c:\nxpjj.exec:\nxpjj.exe106⤵
- System Location Discovery: System Language Discovery
PID:980 -
\??\c:\vjfdxrd.exec:\vjfdxrd.exe107⤵PID:1536
-
\??\c:\lrfvdx.exec:\lrfvdx.exe108⤵PID:2156
-
\??\c:\tjdvrjl.exec:\tjdvrjl.exe109⤵PID:2880
-
\??\c:\vddtddd.exec:\vddtddd.exe110⤵PID:1716
-
\??\c:\lbhjtl.exec:\lbhjtl.exe111⤵PID:1472
-
\??\c:\hpjxt.exec:\hpjxt.exe112⤵PID:1080
-
\??\c:\xrlpvbb.exec:\xrlpvbb.exe113⤵PID:1848
-
\??\c:\bjnjlf.exec:\bjnjlf.exe114⤵PID:2040
-
\??\c:\vfdvph.exec:\vfdvph.exe115⤵PID:848
-
\??\c:\tfrjf.exec:\tfrjf.exe116⤵PID:2024
-
\??\c:\tlxbp.exec:\tlxbp.exe117⤵PID:2456
-
\??\c:\lflhdj.exec:\lflhdj.exe118⤵PID:1188
-
\??\c:\nddxbhp.exec:\nddxbhp.exe119⤵PID:2000
-
\??\c:\xndrf.exec:\xndrf.exe120⤵PID:2316
-
\??\c:\ftdpxhp.exec:\ftdpxhp.exe121⤵PID:2696
-
\??\c:\lbdlr.exec:\lbdlr.exe122⤵PID:1588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-