Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 01:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9b2dca201b20107f2263ef202815d8f0d1a9091b1fcf28d8507965b08a131673.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9b2dca201b20107f2263ef202815d8f0d1a9091b1fcf28d8507965b08a131673.exe
-
Size
454KB
-
MD5
56e75b960fa28cf112e4ec4af67256ac
-
SHA1
8d83c919a3339465ccc53732b176bfc44b3983c9
-
SHA256
9b2dca201b20107f2263ef202815d8f0d1a9091b1fcf28d8507965b08a131673
-
SHA512
190c83660c7de82c2123ce1242a06f70687e721ae09c550d744ac8f87df7d7fbe24615d14f1c8c93d721c40a17b65cd029172faec7545ecedb078ab8e3c4a6e3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeg:q7Tc2NYHUrAwfMp3CDg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/1832-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-130-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1716-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/964-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-402-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2344-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-466-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2868-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/660-724-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-803-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-836-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-1005-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1488-1004-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2564 tdlhf.exe 1936 ldfdp.exe 1980 fdhjd.exe 2532 vvxbnx.exe 2792 ftpbtx.exe 2904 xllxp.exe 2980 dtbbxnn.exe 2680 trjlhv.exe 2700 pxhlv.exe 1664 pntdh.exe 1676 dpvjpbn.exe 2344 hbfjfd.exe 1072 vtrhp.exe 1296 jlttd.exe 2032 pphlpn.exe 1716 jnrfbh.exe 1964 nxdxrl.exe 1956 rfbft.exe 2864 fhhrxjd.exe 2324 lpnpj.exe 2384 frvfffv.exe 916 plfvnhl.exe 2200 xjdxv.exe 1124 hhjbf.exe 964 plhtpx.exe 2008 vpptfnd.exe 1692 trjnflt.exe 1364 dbddxp.exe 760 hbdlbhl.exe 2300 plltn.exe 2252 hrdtdnd.exe 272 dlxfr.exe 2036 vfrxbb.exe 2536 fnvhh.exe 1576 bndhbp.exe 1972 nfthvbd.exe 1800 hjxxlxt.exe 2396 bvbjb.exe 2452 lnrvfv.exe 2440 njvxhd.exe 2760 pxbnj.exe 2220 dxbxrlt.exe 2932 pbntjt.exe 2876 tplpfnv.exe 2676 fjxpjl.exe 2944 hrbxlv.exe 2728 flxjvjd.exe 1960 dfpln.exe 1032 jdpvrx.exe 2344 ddbjflx.exe 1548 fvvxttt.exe 1256 xpfpl.exe 1992 rrbthj.exe 1608 tbpnp.exe 1484 nbhbpxf.exe 2000 xvbdvv.exe 2868 bdxbp.exe 3020 pltjtn.exe 2420 dpbnrxv.exe 2332 tlhlp.exe 3040 tpftp.exe 1696 nftrj.exe 2132 vtxnnpj.exe 820 xxtnfb.exe -
resource yara_rule behavioral1/memory/1832-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-29-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2532-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/964-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-402-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2344-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-711-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/660-724-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-775-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-795-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-803-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-836-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-916-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-973-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-1004-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrdhpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxfjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drnjxnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnddn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfffxbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpnpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbbtrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjvhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pljljl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttxdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hndpxxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnlvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhxhdtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfrhph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrhvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhvtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frvfffv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjnbhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbblh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjpldbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxbxdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plnhlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjnxnnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdxvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldfdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbpnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxxvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbvfvrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttrbvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrxxntl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrbbxxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpfhhpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vptlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvxdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1832 wrote to memory of 2564 1832 9b2dca201b20107f2263ef202815d8f0d1a9091b1fcf28d8507965b08a131673.exe 30 PID 1832 wrote to memory of 2564 1832 9b2dca201b20107f2263ef202815d8f0d1a9091b1fcf28d8507965b08a131673.exe 30 PID 1832 wrote to memory of 2564 1832 9b2dca201b20107f2263ef202815d8f0d1a9091b1fcf28d8507965b08a131673.exe 30 PID 1832 wrote to memory of 2564 1832 9b2dca201b20107f2263ef202815d8f0d1a9091b1fcf28d8507965b08a131673.exe 30 PID 2564 wrote to memory of 1936 2564 tdlhf.exe 31 PID 2564 wrote to memory of 1936 2564 tdlhf.exe 31 PID 2564 wrote to memory of 1936 2564 tdlhf.exe 31 PID 2564 wrote to memory of 1936 2564 tdlhf.exe 31 PID 1936 wrote to memory of 1980 1936 ldfdp.exe 32 PID 1936 wrote to memory of 1980 1936 ldfdp.exe 32 PID 1936 wrote to memory of 1980 1936 ldfdp.exe 32 PID 1936 wrote to memory of 1980 1936 ldfdp.exe 32 PID 1980 wrote to memory of 2532 1980 fdhjd.exe 33 PID 1980 wrote to memory of 2532 1980 fdhjd.exe 33 PID 1980 wrote to memory of 2532 1980 fdhjd.exe 33 PID 1980 wrote to memory of 2532 1980 fdhjd.exe 33 PID 2532 wrote to memory of 2792 2532 vvxbnx.exe 34 PID 2532 wrote to memory of 2792 2532 vvxbnx.exe 34 PID 2532 wrote to memory of 2792 2532 vvxbnx.exe 34 PID 2532 wrote to memory of 2792 2532 vvxbnx.exe 34 PID 2792 wrote to memory of 2904 2792 ftpbtx.exe 35 PID 2792 wrote to memory of 2904 2792 ftpbtx.exe 35 PID 2792 wrote to memory of 2904 2792 ftpbtx.exe 35 PID 2792 wrote to memory of 2904 2792 ftpbtx.exe 35 PID 2904 wrote to memory of 2980 2904 xllxp.exe 36 PID 2904 wrote to memory of 2980 2904 xllxp.exe 36 PID 2904 wrote to memory of 2980 2904 xllxp.exe 36 PID 2904 wrote to memory of 2980 2904 xllxp.exe 36 PID 2980 wrote to memory of 2680 2980 dtbbxnn.exe 37 PID 2980 wrote to memory of 2680 2980 dtbbxnn.exe 37 PID 2980 wrote to memory of 2680 2980 dtbbxnn.exe 37 PID 2980 wrote to memory of 2680 2980 dtbbxnn.exe 37 PID 2680 wrote to memory of 2700 2680 trjlhv.exe 38 PID 2680 wrote to memory of 2700 2680 trjlhv.exe 38 PID 2680 wrote to memory of 2700 2680 trjlhv.exe 38 PID 2680 wrote to memory of 2700 2680 trjlhv.exe 38 PID 2700 wrote to memory of 1664 2700 pxhlv.exe 39 PID 2700 wrote to memory of 1664 2700 pxhlv.exe 39 PID 2700 wrote to memory of 1664 2700 pxhlv.exe 39 PID 2700 wrote to memory of 1664 2700 pxhlv.exe 39 PID 1664 wrote to memory of 1676 1664 pntdh.exe 40 PID 1664 wrote to memory of 1676 1664 pntdh.exe 40 PID 1664 wrote to memory of 1676 1664 pntdh.exe 40 PID 1664 wrote to memory of 1676 1664 pntdh.exe 40 PID 1676 wrote to memory of 2344 1676 dpvjpbn.exe 41 PID 1676 wrote to memory of 2344 1676 dpvjpbn.exe 41 PID 1676 wrote to memory of 2344 1676 dpvjpbn.exe 41 PID 1676 wrote to memory of 2344 1676 dpvjpbn.exe 41 PID 2344 wrote to memory of 1072 2344 hbfjfd.exe 42 PID 2344 wrote to memory of 1072 2344 hbfjfd.exe 42 PID 2344 wrote to memory of 1072 2344 hbfjfd.exe 42 PID 2344 wrote to memory of 1072 2344 hbfjfd.exe 42 PID 1072 wrote to memory of 1296 1072 vtrhp.exe 43 PID 1072 wrote to memory of 1296 1072 vtrhp.exe 43 PID 1072 wrote to memory of 1296 1072 vtrhp.exe 43 PID 1072 wrote to memory of 1296 1072 vtrhp.exe 43 PID 1296 wrote to memory of 2032 1296 jlttd.exe 44 PID 1296 wrote to memory of 2032 1296 jlttd.exe 44 PID 1296 wrote to memory of 2032 1296 jlttd.exe 44 PID 1296 wrote to memory of 2032 1296 jlttd.exe 44 PID 2032 wrote to memory of 1716 2032 pphlpn.exe 45 PID 2032 wrote to memory of 1716 2032 pphlpn.exe 45 PID 2032 wrote to memory of 1716 2032 pphlpn.exe 45 PID 2032 wrote to memory of 1716 2032 pphlpn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b2dca201b20107f2263ef202815d8f0d1a9091b1fcf28d8507965b08a131673.exe"C:\Users\Admin\AppData\Local\Temp\9b2dca201b20107f2263ef202815d8f0d1a9091b1fcf28d8507965b08a131673.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\tdlhf.exec:\tdlhf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\ldfdp.exec:\ldfdp.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\fdhjd.exec:\fdhjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\vvxbnx.exec:\vvxbnx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\ftpbtx.exec:\ftpbtx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\xllxp.exec:\xllxp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\dtbbxnn.exec:\dtbbxnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\trjlhv.exec:\trjlhv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\pxhlv.exec:\pxhlv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\pntdh.exec:\pntdh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\dpvjpbn.exec:\dpvjpbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\hbfjfd.exec:\hbfjfd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\vtrhp.exec:\vtrhp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\jlttd.exec:\jlttd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\pphlpn.exec:\pphlpn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\jnrfbh.exec:\jnrfbh.exe17⤵
- Executes dropped EXE
PID:1716 -
\??\c:\nxdxrl.exec:\nxdxrl.exe18⤵
- Executes dropped EXE
PID:1964 -
\??\c:\rfbft.exec:\rfbft.exe19⤵
- Executes dropped EXE
PID:1956 -
\??\c:\fhhrxjd.exec:\fhhrxjd.exe20⤵
- Executes dropped EXE
PID:2864 -
\??\c:\lpnpj.exec:\lpnpj.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2324 -
\??\c:\frvfffv.exec:\frvfffv.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2384 -
\??\c:\plfvnhl.exec:\plfvnhl.exe23⤵
- Executes dropped EXE
PID:916 -
\??\c:\xjdxv.exec:\xjdxv.exe24⤵
- Executes dropped EXE
PID:2200 -
\??\c:\hhjbf.exec:\hhjbf.exe25⤵
- Executes dropped EXE
PID:1124 -
\??\c:\plhtpx.exec:\plhtpx.exe26⤵
- Executes dropped EXE
PID:964 -
\??\c:\vpptfnd.exec:\vpptfnd.exe27⤵
- Executes dropped EXE
PID:2008 -
\??\c:\trjnflt.exec:\trjnflt.exe28⤵
- Executes dropped EXE
PID:1692 -
\??\c:\dbddxp.exec:\dbddxp.exe29⤵
- Executes dropped EXE
PID:1364 -
\??\c:\hbdlbhl.exec:\hbdlbhl.exe30⤵
- Executes dropped EXE
PID:760 -
\??\c:\plltn.exec:\plltn.exe31⤵
- Executes dropped EXE
PID:2300 -
\??\c:\hrdtdnd.exec:\hrdtdnd.exe32⤵
- Executes dropped EXE
PID:2252 -
\??\c:\dlxfr.exec:\dlxfr.exe33⤵
- Executes dropped EXE
PID:272 -
\??\c:\vfrxbb.exec:\vfrxbb.exe34⤵
- Executes dropped EXE
PID:2036 -
\??\c:\fnvhh.exec:\fnvhh.exe35⤵
- Executes dropped EXE
PID:2536 -
\??\c:\bndhbp.exec:\bndhbp.exe36⤵
- Executes dropped EXE
PID:1576 -
\??\c:\nfthvbd.exec:\nfthvbd.exe37⤵
- Executes dropped EXE
PID:1972 -
\??\c:\hjxxlxt.exec:\hjxxlxt.exe38⤵
- Executes dropped EXE
PID:1800 -
\??\c:\bvbjb.exec:\bvbjb.exe39⤵
- Executes dropped EXE
PID:2396 -
\??\c:\lnrvfv.exec:\lnrvfv.exe40⤵
- Executes dropped EXE
PID:2452 -
\??\c:\njvxhd.exec:\njvxhd.exe41⤵
- Executes dropped EXE
PID:2440 -
\??\c:\pxbnj.exec:\pxbnj.exe42⤵
- Executes dropped EXE
PID:2760 -
\??\c:\dxbxrlt.exec:\dxbxrlt.exe43⤵
- Executes dropped EXE
PID:2220 -
\??\c:\pbntjt.exec:\pbntjt.exe44⤵
- Executes dropped EXE
PID:2932 -
\??\c:\tplpfnv.exec:\tplpfnv.exe45⤵
- Executes dropped EXE
PID:2876 -
\??\c:\fjxpjl.exec:\fjxpjl.exe46⤵
- Executes dropped EXE
PID:2676 -
\??\c:\hrbxlv.exec:\hrbxlv.exe47⤵
- Executes dropped EXE
PID:2944 -
\??\c:\flxjvjd.exec:\flxjvjd.exe48⤵
- Executes dropped EXE
PID:2728 -
\??\c:\dfpln.exec:\dfpln.exe49⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jdpvrx.exec:\jdpvrx.exe50⤵
- Executes dropped EXE
PID:1032 -
\??\c:\ddbjflx.exec:\ddbjflx.exe51⤵
- Executes dropped EXE
PID:2344 -
\??\c:\fvvxttt.exec:\fvvxttt.exe52⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xpfpl.exec:\xpfpl.exe53⤵
- Executes dropped EXE
PID:1256 -
\??\c:\rrbthj.exec:\rrbthj.exe54⤵
- Executes dropped EXE
PID:1992 -
\??\c:\tbpnp.exec:\tbpnp.exe55⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nbhbpxf.exec:\nbhbpxf.exe56⤵
- Executes dropped EXE
PID:1484 -
\??\c:\xvbdvv.exec:\xvbdvv.exe57⤵
- Executes dropped EXE
PID:2000 -
\??\c:\bdxbp.exec:\bdxbp.exe58⤵
- Executes dropped EXE
PID:2868 -
\??\c:\pltjtn.exec:\pltjtn.exe59⤵
- Executes dropped EXE
PID:3020 -
\??\c:\dpbnrxv.exec:\dpbnrxv.exe60⤵
- Executes dropped EXE
PID:2420 -
\??\c:\tlhlp.exec:\tlhlp.exe61⤵
- Executes dropped EXE
PID:2332 -
\??\c:\tpftp.exec:\tpftp.exe62⤵
- Executes dropped EXE
PID:3040 -
\??\c:\nftrj.exec:\nftrj.exe63⤵
- Executes dropped EXE
PID:1696 -
\??\c:\vtxnnpj.exec:\vtxnnpj.exe64⤵
- Executes dropped EXE
PID:2132 -
\??\c:\xxtnfb.exec:\xxtnfb.exe65⤵
- Executes dropped EXE
PID:820 -
\??\c:\fbrnpr.exec:\fbrnpr.exe66⤵PID:2544
-
\??\c:\rxtfjlj.exec:\rxtfjlj.exe67⤵PID:1744
-
\??\c:\njfvl.exec:\njfvl.exe68⤵PID:1756
-
\??\c:\thtbxr.exec:\thtbxr.exe69⤵PID:1688
-
\??\c:\pljljl.exec:\pljljl.exe70⤵
- System Location Discovery: System Language Discovery
PID:1504 -
\??\c:\llhflh.exec:\llhflh.exe71⤵PID:864
-
\??\c:\dpdrlf.exec:\dpdrlf.exe72⤵PID:2400
-
\??\c:\hvjfjn.exec:\hvjfjn.exe73⤵PID:2300
-
\??\c:\xbnrhn.exec:\xbnrhn.exe74⤵PID:2272
-
\??\c:\nfxlld.exec:\nfxlld.exe75⤵PID:3068
-
\??\c:\httphft.exec:\httphft.exe76⤵PID:1636
-
\??\c:\nplxpn.exec:\nplxpn.exe77⤵PID:2584
-
\??\c:\dnnftf.exec:\dnnftf.exe78⤵PID:1796
-
\??\c:\hxfjn.exec:\hxfjn.exe79⤵
- System Location Discovery: System Language Discovery
PID:1328 -
\??\c:\hvtdffj.exec:\hvtdffj.exe80⤵PID:2136
-
\??\c:\jdhdvll.exec:\jdhdvll.exe81⤵PID:2164
-
\??\c:\nftptbn.exec:\nftptbn.exe82⤵PID:2520
-
\??\c:\rplbxr.exec:\rplbxr.exe83⤵PID:2916
-
\??\c:\lhrhn.exec:\lhrhn.exe84⤵PID:2808
-
\??\c:\vbrntfp.exec:\vbrntfp.exe85⤵PID:2940
-
\??\c:\njvprhf.exec:\njvprhf.exe86⤵PID:3056
-
\??\c:\dthjll.exec:\dthjll.exe87⤵PID:1276
-
\??\c:\rfnbx.exec:\rfnbx.exe88⤵PID:2764
-
\??\c:\jpvhndl.exec:\jpvhndl.exe89⤵PID:2676
-
\??\c:\ljhdbv.exec:\ljhdbv.exe90⤵PID:2700
-
\??\c:\blthpvr.exec:\blthpvr.exe91⤵PID:2412
-
\??\c:\pbfpx.exec:\pbfpx.exe92⤵PID:1388
-
\??\c:\fvbjt.exec:\fvbjt.exe93⤵PID:1352
-
\??\c:\ttpnrlr.exec:\ttpnrlr.exe94⤵PID:924
-
\??\c:\xdvtv.exec:\xdvtv.exe95⤵PID:2312
-
\??\c:\xvvbxbp.exec:\xvvbxbp.exe96⤵PID:2884
-
\??\c:\xjjddl.exec:\xjjddl.exe97⤵PID:2080
-
\??\c:\rnhtdl.exec:\rnhtdl.exe98⤵PID:660
-
\??\c:\bbjfdx.exec:\bbjfdx.exe99⤵PID:1016
-
\??\c:\jnthj.exec:\jnthj.exe100⤵PID:1484
-
\??\c:\fjtjfb.exec:\fjtjfb.exe101⤵PID:2012
-
\??\c:\ndvvh.exec:\ndvvh.exe102⤵PID:2856
-
\??\c:\dphbln.exec:\dphbln.exe103⤵PID:1028
-
\??\c:\dtvvl.exec:\dtvvl.exe104⤵PID:2324
-
\??\c:\rtvvrth.exec:\rtvvrth.exe105⤵PID:2332
-
\??\c:\prnjjd.exec:\prnjjd.exe106⤵PID:1864
-
\??\c:\tbpnf.exec:\tbpnf.exe107⤵
- System Location Discovery: System Language Discovery
PID:1708 -
\??\c:\jbvbbp.exec:\jbvbbp.exe108⤵PID:2088
-
\??\c:\ptxth.exec:\ptxth.exe109⤵PID:1392
-
\??\c:\hjffv.exec:\hjffv.exe110⤵PID:1048
-
\??\c:\thdhj.exec:\thdhj.exe111⤵PID:2008
-
\??\c:\dblnf.exec:\dblnf.exe112⤵PID:2872
-
\??\c:\bpnrnnf.exec:\bpnrnnf.exe113⤵PID:680
-
\??\c:\jrvxx.exec:\jrvxx.exe114⤵PID:264
-
\??\c:\rnhpvbx.exec:\rnhpvbx.exe115⤵PID:1324
-
\??\c:\jrhpp.exec:\jrhpp.exe116⤵PID:1824
-
\??\c:\ntdvj.exec:\ntdvj.exe117⤵PID:2328
-
\??\c:\fjxpfxp.exec:\fjxpfxp.exe118⤵PID:316
-
\??\c:\rfljrtf.exec:\rfljrtf.exe119⤵PID:1624
-
\??\c:\tnphdp.exec:\tnphdp.exe120⤵PID:2736
-
\??\c:\rdfnb.exec:\rdfnb.exe121⤵PID:2584
-
\??\c:\vbbjj.exec:\vbbjj.exe122⤵PID:2348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-