Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 00:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
70d81a865280be421d6c6b1744cef51938c6213c80044b1e5566b26deac0ec10N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
70d81a865280be421d6c6b1744cef51938c6213c80044b1e5566b26deac0ec10N.exe
-
Size
456KB
-
MD5
2918e261ffce1b0b12fd1563328ddf10
-
SHA1
77eacb20ad60fb98a131b42257fe1d251d9f22b0
-
SHA256
70d81a865280be421d6c6b1744cef51938c6213c80044b1e5566b26deac0ec10
-
SHA512
b66c1a473af4e1823f1fd826d2a3c9a7b69bd208f88adeb64dca0a4057b53033d0409ba2329cb3b18e0c98f929da0ac08194078318ea059ff6f3e97b4c28770e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbex6:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2592-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-59-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2744-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-91-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/896-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/780-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-303-0x00000000771F0000-0x00000000772EA000-memory.dmp family_blackmoon behavioral1/memory/1780-302-0x00000000770D0000-0x00000000771EF000-memory.dmp family_blackmoon behavioral1/memory/1480-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-317-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2944-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/928-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-436-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2120-441-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2808-452-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1060-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-635-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1116-688-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2112-760-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-857-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/676-851-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3000 jnjxth.exe 2896 tbxrd.exe 2952 bjxnpx.exe 3020 jjlrp.exe 2372 tltxv.exe 2744 lxjfrf.exe 2604 rbffnv.exe 2928 bxfvhtp.exe 2380 ldjnt.exe 1684 pfnlb.exe 896 hdjxpl.exe 3036 xnjbj.exe 2444 bblxt.exe 3024 rltjhd.exe 1972 trtxblt.exe 2420 ddlptjb.exe 1932 dfrtxbn.exe 2292 hltjvn.exe 2500 vjjxldj.exe 2288 bnttthp.exe 908 thfjrf.exe 1900 jtxbn.exe 780 hhbtpx.exe 1724 prtlxfv.exe 1572 ptthbfv.exe 1552 txlhr.exe 1084 vnhtnd.exe 1924 rdpjrb.exe 2364 jbrpd.exe 1700 hjnbjj.exe 2344 rrvthnr.exe 2032 fxxnhn.exe 1780 lhblrh.exe 2448 rtbnt.exe 2988 fttdpnx.exe 2892 xptbhp.exe 2944 rfffhhp.exe 3020 rvlffpf.exe 2764 rnnrnfh.exe 928 nvjvb.exe 2796 brdnhj.exe 1744 vxbvn.exe 2172 djlxx.exe 2068 fvbfj.exe 1116 nlhpn.exe 1736 ffpvvxt.exe 2816 plfjj.exe 316 pxtvxb.exe 2496 hrxlnxr.exe 2808 tpxdt.exe 3032 jxjfpnx.exe 2120 xflbrnd.exe 856 vvxrd.exe 1548 ljffbjj.exe 1776 nxftpdv.exe 2264 lnhfxpf.exe 1204 lxntl.exe 2576 tflhr.exe 2212 plrdjpf.exe 1844 frhdntl.exe 908 nxhvfj.exe 760 xxnvnjj.exe 1052 vvlvrr.exe 1184 fjvrdl.exe -
resource yara_rule behavioral1/memory/2592-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-59-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2744-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/780-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/928-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/928-681-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/856-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-760-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-785-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-830-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-837-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-857-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-870-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brlfnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trrrbrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfjvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxvttx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frljx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfxrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prffvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llhfbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpnnrtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjrtftl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvbxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnlvrxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplltdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvnbdhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vblhvtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vntfbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nndnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvrdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtnfpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnxdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbrvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljffbjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnrtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhbthhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prxlxrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhlfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tflhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hldxxxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlrtpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jptflhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvhbxpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdtnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnfrvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2592 wrote to memory of 3000 2592 70d81a865280be421d6c6b1744cef51938c6213c80044b1e5566b26deac0ec10N.exe 30 PID 2592 wrote to memory of 3000 2592 70d81a865280be421d6c6b1744cef51938c6213c80044b1e5566b26deac0ec10N.exe 30 PID 2592 wrote to memory of 3000 2592 70d81a865280be421d6c6b1744cef51938c6213c80044b1e5566b26deac0ec10N.exe 30 PID 2592 wrote to memory of 3000 2592 70d81a865280be421d6c6b1744cef51938c6213c80044b1e5566b26deac0ec10N.exe 30 PID 3000 wrote to memory of 2896 3000 jnjxth.exe 31 PID 3000 wrote to memory of 2896 3000 jnjxth.exe 31 PID 3000 wrote to memory of 2896 3000 jnjxth.exe 31 PID 3000 wrote to memory of 2896 3000 jnjxth.exe 31 PID 2896 wrote to memory of 2952 2896 tbxrd.exe 32 PID 2896 wrote to memory of 2952 2896 tbxrd.exe 32 PID 2896 wrote to memory of 2952 2896 tbxrd.exe 32 PID 2896 wrote to memory of 2952 2896 tbxrd.exe 32 PID 2952 wrote to memory of 3020 2952 bjxnpx.exe 33 PID 2952 wrote to memory of 3020 2952 bjxnpx.exe 33 PID 2952 wrote to memory of 3020 2952 bjxnpx.exe 33 PID 2952 wrote to memory of 3020 2952 bjxnpx.exe 33 PID 3020 wrote to memory of 2372 3020 jjlrp.exe 34 PID 3020 wrote to memory of 2372 3020 jjlrp.exe 34 PID 3020 wrote to memory of 2372 3020 jjlrp.exe 34 PID 3020 wrote to memory of 2372 3020 jjlrp.exe 34 PID 2372 wrote to memory of 2744 2372 tltxv.exe 35 PID 2372 wrote to memory of 2744 2372 tltxv.exe 35 PID 2372 wrote to memory of 2744 2372 tltxv.exe 35 PID 2372 wrote to memory of 2744 2372 tltxv.exe 35 PID 2744 wrote to memory of 2604 2744 lxjfrf.exe 36 PID 2744 wrote to memory of 2604 2744 lxjfrf.exe 36 PID 2744 wrote to memory of 2604 2744 lxjfrf.exe 36 PID 2744 wrote to memory of 2604 2744 lxjfrf.exe 36 PID 2604 wrote to memory of 2928 2604 rbffnv.exe 37 PID 2604 wrote to memory of 2928 2604 rbffnv.exe 37 PID 2604 wrote to memory of 2928 2604 rbffnv.exe 37 PID 2604 wrote to memory of 2928 2604 rbffnv.exe 37 PID 2928 wrote to memory of 2380 2928 bxfvhtp.exe 38 PID 2928 wrote to memory of 2380 2928 bxfvhtp.exe 38 PID 2928 wrote to memory of 2380 2928 bxfvhtp.exe 38 PID 2928 wrote to memory of 2380 2928 bxfvhtp.exe 38 PID 2380 wrote to memory of 1684 2380 ldjnt.exe 39 PID 2380 wrote to memory of 1684 2380 ldjnt.exe 39 PID 2380 wrote to memory of 1684 2380 ldjnt.exe 39 PID 2380 wrote to memory of 1684 2380 ldjnt.exe 39 PID 1684 wrote to memory of 896 1684 pfnlb.exe 40 PID 1684 wrote to memory of 896 1684 pfnlb.exe 40 PID 1684 wrote to memory of 896 1684 pfnlb.exe 40 PID 1684 wrote to memory of 896 1684 pfnlb.exe 40 PID 896 wrote to memory of 3036 896 hdjxpl.exe 41 PID 896 wrote to memory of 3036 896 hdjxpl.exe 41 PID 896 wrote to memory of 3036 896 hdjxpl.exe 41 PID 896 wrote to memory of 3036 896 hdjxpl.exe 41 PID 3036 wrote to memory of 2444 3036 xnjbj.exe 42 PID 3036 wrote to memory of 2444 3036 xnjbj.exe 42 PID 3036 wrote to memory of 2444 3036 xnjbj.exe 42 PID 3036 wrote to memory of 2444 3036 xnjbj.exe 42 PID 2444 wrote to memory of 3024 2444 bblxt.exe 43 PID 2444 wrote to memory of 3024 2444 bblxt.exe 43 PID 2444 wrote to memory of 3024 2444 bblxt.exe 43 PID 2444 wrote to memory of 3024 2444 bblxt.exe 43 PID 3024 wrote to memory of 1972 3024 rltjhd.exe 44 PID 3024 wrote to memory of 1972 3024 rltjhd.exe 44 PID 3024 wrote to memory of 1972 3024 rltjhd.exe 44 PID 3024 wrote to memory of 1972 3024 rltjhd.exe 44 PID 1972 wrote to memory of 2420 1972 trtxblt.exe 45 PID 1972 wrote to memory of 2420 1972 trtxblt.exe 45 PID 1972 wrote to memory of 2420 1972 trtxblt.exe 45 PID 1972 wrote to memory of 2420 1972 trtxblt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\70d81a865280be421d6c6b1744cef51938c6213c80044b1e5566b26deac0ec10N.exe"C:\Users\Admin\AppData\Local\Temp\70d81a865280be421d6c6b1744cef51938c6213c80044b1e5566b26deac0ec10N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\jnjxth.exec:\jnjxth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\tbxrd.exec:\tbxrd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\bjxnpx.exec:\bjxnpx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\jjlrp.exec:\jjlrp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\tltxv.exec:\tltxv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\lxjfrf.exec:\lxjfrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\rbffnv.exec:\rbffnv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\bxfvhtp.exec:\bxfvhtp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\ldjnt.exec:\ldjnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\pfnlb.exec:\pfnlb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\hdjxpl.exec:\hdjxpl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\xnjbj.exec:\xnjbj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\bblxt.exec:\bblxt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\rltjhd.exec:\rltjhd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\trtxblt.exec:\trtxblt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\ddlptjb.exec:\ddlptjb.exe17⤵
- Executes dropped EXE
PID:2420 -
\??\c:\dfrtxbn.exec:\dfrtxbn.exe18⤵
- Executes dropped EXE
PID:1932 -
\??\c:\hltjvn.exec:\hltjvn.exe19⤵
- Executes dropped EXE
PID:2292 -
\??\c:\vjjxldj.exec:\vjjxldj.exe20⤵
- Executes dropped EXE
PID:2500 -
\??\c:\bnttthp.exec:\bnttthp.exe21⤵
- Executes dropped EXE
PID:2288 -
\??\c:\thfjrf.exec:\thfjrf.exe22⤵
- Executes dropped EXE
PID:908 -
\??\c:\jtxbn.exec:\jtxbn.exe23⤵
- Executes dropped EXE
PID:1900 -
\??\c:\hhbtpx.exec:\hhbtpx.exe24⤵
- Executes dropped EXE
PID:780 -
\??\c:\prtlxfv.exec:\prtlxfv.exe25⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ptthbfv.exec:\ptthbfv.exe26⤵
- Executes dropped EXE
PID:1572 -
\??\c:\txlhr.exec:\txlhr.exe27⤵
- Executes dropped EXE
PID:1552 -
\??\c:\vnhtnd.exec:\vnhtnd.exe28⤵
- Executes dropped EXE
PID:1084 -
\??\c:\rdpjrb.exec:\rdpjrb.exe29⤵
- Executes dropped EXE
PID:1924 -
\??\c:\jbrpd.exec:\jbrpd.exe30⤵
- Executes dropped EXE
PID:2364 -
\??\c:\hjnbjj.exec:\hjnbjj.exe31⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rrvthnr.exec:\rrvthnr.exe32⤵
- Executes dropped EXE
PID:2344 -
\??\c:\fxxnhn.exec:\fxxnhn.exe33⤵
- Executes dropped EXE
PID:2032 -
\??\c:\lhblrh.exec:\lhblrh.exe34⤵
- Executes dropped EXE
PID:1780 -
\??\c:\rjftjlh.exec:\rjftjlh.exe35⤵PID:1480
-
\??\c:\rtbnt.exec:\rtbnt.exe36⤵
- Executes dropped EXE
PID:2448 -
\??\c:\fttdpnx.exec:\fttdpnx.exe37⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xptbhp.exec:\xptbhp.exe38⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rfffhhp.exec:\rfffhhp.exe39⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rvlffpf.exec:\rvlffpf.exe40⤵
- Executes dropped EXE
PID:3020 -
\??\c:\rnnrnfh.exec:\rnnrnfh.exe41⤵
- Executes dropped EXE
PID:2764 -
\??\c:\nvjvb.exec:\nvjvb.exe42⤵
- Executes dropped EXE
PID:928 -
\??\c:\brdnhj.exec:\brdnhj.exe43⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vxbvn.exec:\vxbvn.exe44⤵
- Executes dropped EXE
PID:1744 -
\??\c:\djlxx.exec:\djlxx.exe45⤵
- Executes dropped EXE
PID:2172 -
\??\c:\fvbfj.exec:\fvbfj.exe46⤵
- Executes dropped EXE
PID:2068 -
\??\c:\nlhpn.exec:\nlhpn.exe47⤵
- Executes dropped EXE
PID:1116 -
\??\c:\ffpvvxt.exec:\ffpvvxt.exe48⤵
- Executes dropped EXE
PID:1736 -
\??\c:\plfjj.exec:\plfjj.exe49⤵
- Executes dropped EXE
PID:2816 -
\??\c:\pxtvxb.exec:\pxtvxb.exe50⤵
- Executes dropped EXE
PID:316 -
\??\c:\hrxlnxr.exec:\hrxlnxr.exe51⤵
- Executes dropped EXE
PID:2496 -
\??\c:\tpxdt.exec:\tpxdt.exe52⤵
- Executes dropped EXE
PID:2808 -
\??\c:\jxjfpnx.exec:\jxjfpnx.exe53⤵
- Executes dropped EXE
PID:3032 -
\??\c:\xflbrnd.exec:\xflbrnd.exe54⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vvxrd.exec:\vvxrd.exe55⤵
- Executes dropped EXE
PID:856 -
\??\c:\ljffbjj.exec:\ljffbjj.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1548 -
\??\c:\nxftpdv.exec:\nxftpdv.exe57⤵
- Executes dropped EXE
PID:1776 -
\??\c:\lnhfxpf.exec:\lnhfxpf.exe58⤵
- Executes dropped EXE
PID:2264 -
\??\c:\lxntl.exec:\lxntl.exe59⤵
- Executes dropped EXE
PID:1204 -
\??\c:\tflhr.exec:\tflhr.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2576 -
\??\c:\plrdjpf.exec:\plrdjpf.exe61⤵
- Executes dropped EXE
PID:2212 -
\??\c:\frhdntl.exec:\frhdntl.exe62⤵
- Executes dropped EXE
PID:1844 -
\??\c:\nxhvfj.exec:\nxhvfj.exe63⤵
- Executes dropped EXE
PID:908 -
\??\c:\xxnvnjj.exec:\xxnvnjj.exe64⤵
- Executes dropped EXE
PID:760 -
\??\c:\vvlvrr.exec:\vvlvrr.exe65⤵
- Executes dropped EXE
PID:1052 -
\??\c:\fjvrdl.exec:\fjvrdl.exe66⤵
- Executes dropped EXE
PID:1184 -
\??\c:\ddjrdjr.exec:\ddjrdjr.exe67⤵PID:1504
-
\??\c:\rfpxpbf.exec:\rfpxpbf.exe68⤵PID:1680
-
\??\c:\xjftt.exec:\xjftt.exe69⤵PID:776
-
\??\c:\hbhvrp.exec:\hbhvrp.exe70⤵PID:1132
-
\??\c:\xnlvrxt.exec:\xnlvrxt.exe71⤵
- System Location Discovery: System Language Discovery
PID:1544 -
\??\c:\lnpfv.exec:\lnpfv.exe72⤵PID:2660
-
\??\c:\rlxhdf.exec:\rlxhdf.exe73⤵PID:2676
-
\??\c:\hfjjpnf.exec:\hfjjpnf.exe74⤵PID:1060
-
\??\c:\rxlbxr.exec:\rxlbxr.exe75⤵PID:892
-
\??\c:\vjpbhlh.exec:\vjpbhlh.exe76⤵PID:1524
-
\??\c:\hnbnt.exec:\hnbnt.exe77⤵PID:2240
-
\??\c:\dftvvvd.exec:\dftvvvd.exe78⤵PID:1480
-
\??\c:\jvthpvh.exec:\jvthpvh.exe79⤵PID:2984
-
\??\c:\jbtxhxr.exec:\jbtxhxr.exe80⤵PID:2324
-
\??\c:\hvrfnpx.exec:\hvrfnpx.exe81⤵PID:2756
-
\??\c:\vhnrxxn.exec:\vhnrxxn.exe82⤵PID:3016
-
\??\c:\rjrhlbx.exec:\rjrhlbx.exe83⤵PID:2916
-
\??\c:\pntnj.exec:\pntnj.exe84⤵PID:3020
-
\??\c:\jlxlt.exec:\jlxlt.exe85⤵PID:2800
-
\??\c:\ltrxtfl.exec:\ltrxtfl.exe86⤵PID:928
-
\??\c:\hbflbtv.exec:\hbflbtv.exe87⤵PID:2648
-
\??\c:\htnvh.exec:\htnvh.exe88⤵PID:944
-
\??\c:\ffbjlh.exec:\ffbjlh.exe89⤵PID:1672
-
\??\c:\hdtnjh.exec:\hdtnjh.exe90⤵PID:2380
-
\??\c:\nprblp.exec:\nprblp.exe91⤵PID:1116
-
\??\c:\vthlt.exec:\vthlt.exe92⤵PID:1736
-
\??\c:\jxnvxhb.exec:\jxnvxhb.exe93⤵PID:3052
-
\??\c:\btbhlhl.exec:\btbhlhl.exe94⤵PID:316
-
\??\c:\xlnxt.exec:\xlnxt.exe95⤵PID:2496
-
\??\c:\xjrnjv.exec:\xjrnjv.exe96⤵PID:2808
-
\??\c:\bltnbrf.exec:\bltnbrf.exe97⤵PID:3032
-
\??\c:\nvbxl.exec:\nvbxl.exe98⤵PID:2932
-
\??\c:\bhrbd.exec:\bhrbd.exe99⤵PID:856
-
\??\c:\pjfxxrx.exec:\pjfxxrx.exe100⤵PID:1548
-
\??\c:\phdpjvt.exec:\phdpjvt.exe101⤵PID:2464
-
\??\c:\blplnj.exec:\blplnj.exe102⤵PID:2112
-
\??\c:\lxhvjd.exec:\lxhvjd.exe103⤵PID:2280
-
\??\c:\lvddj.exec:\lvddj.exe104⤵PID:2500
-
\??\c:\vhnttbf.exec:\vhnttbf.exe105⤵PID:1540
-
\??\c:\vlvvhxv.exec:\vlvvhxv.exe106⤵PID:1592
-
\??\c:\bnrtt.exec:\bnrtt.exe107⤵
- System Location Discovery: System Language Discovery
PID:908 -
\??\c:\bjphl.exec:\bjphl.exe108⤵PID:1556
-
\??\c:\rfddvl.exec:\rfddvl.exe109⤵PID:704
-
\??\c:\txpvxx.exec:\txpvxx.exe110⤵PID:1828
-
\??\c:\jbdfr.exec:\jbdfr.exe111⤵PID:2056
-
\??\c:\nhbxdjv.exec:\nhbxdjv.exe112⤵PID:936
-
\??\c:\ftfjjpp.exec:\ftfjjpp.exe113⤵PID:676
-
\??\c:\dbxtnff.exec:\dbxtnff.exe114⤵PID:1768
-
\??\c:\lbnjv.exec:\lbnjv.exe115⤵PID:2440
-
\??\c:\rbpxn.exec:\rbpxn.exe116⤵PID:2660
-
\??\c:\dbdhxx.exec:\dbdhxx.exe117⤵PID:2364
-
\??\c:\rhnpd.exec:\rhnpd.exe118⤵PID:1740
-
\??\c:\ptxpl.exec:\ptxpl.exe119⤵PID:1716
-
\??\c:\plxtfx.exec:\plxtfx.exe120⤵PID:2224
-
\??\c:\hfjxh.exec:\hfjxh.exe121⤵PID:1604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-