Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 02:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
808f91658173c613b6f61664a018f1c64dbf206350e775922f7ac74290f65700.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
808f91658173c613b6f61664a018f1c64dbf206350e775922f7ac74290f65700.exe
-
Size
453KB
-
MD5
f179f37b553998161af1c2ce6dc4f906
-
SHA1
b1dae539d1ecb918e4d674dafbf40771937507d2
-
SHA256
808f91658173c613b6f61664a018f1c64dbf206350e775922f7ac74290f65700
-
SHA512
a44108ad09ecb3803abaa077b93cd3cca95a1de32d9b2192a37677dd68bb08dbae0b214a71b76b123645b78aa41168abb6cc59e2b4a7ac0bd1d5bf92d883f58f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbes:q7Tc2NYHUrAwfMp3CDs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2492-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/432-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-102-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2112-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/672-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1384-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-231-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1848-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-308-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2876-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-329-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2960-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-358-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2024-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-398-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2380-400-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/844-453-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/672-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/672-467-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2392-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/812-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-631-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/592-702-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-744-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/676-792-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2840 hdxdnlt.exe 2780 vbjbb.exe 2456 fxhtpfp.exe 2904 jtdnfn.exe 2824 pflxdxb.exe 1712 hprrpt.exe 2616 jvhftfn.exe 432 brxvv.exe 2224 jpxthvt.exe 2112 vjdvvtf.exe 1236 dhlhr.exe 1572 tvbld.exe 2988 fnxvp.exe 2956 xrpbv.exe 1948 fjlfpf.exe 1088 rhxxb.exe 672 tbpvjj.exe 1900 vvrfxl.exe 2512 thbnnp.exe 2068 tnxdtj.exe 2500 djnvnn.exe 1384 frlrj.exe 1544 xxlpr.exe 2116 fbhbjnx.exe 1812 hfhht.exe 2092 xdjvdl.exe 1780 hrlnnnr.exe 2264 vdvtlb.exe 1304 pddrd.exe 1996 fpbrx.exe 1848 nbtxxb.exe 1252 btfdtv.exe 2304 bxhhjp.exe 2876 xbllrrv.exe 1600 dxdxlxl.exe 2788 rjdnntn.exe 3064 xnhprhd.exe 2456 lvbfvn.exe 2960 bldpdl.exe 2684 jtxjtl.exe 2680 vxlhfph.exe 1712 phbdjh.exe 1072 prjxlx.exe 2608 hpvlx.exe 2024 bpbfl.exe 2380 xnjvp.exe 2440 dvxffl.exe 2096 fnplx.exe 1484 fvfnl.exe 2884 fjxnh.exe 2952 jnjvn.exe 2992 xvtxhn.exe 1992 vjfdtdl.exe 844 thxfvff.exe 1088 fdpjhfb.exe 672 llbhhl.exe 2152 dpldp.exe 2392 njdxlb.exe 2572 vpnnrfl.exe 1700 xhhrtnh.exe 528 lvbfrrv.exe 848 dpjppl.exe 952 pvndhv.exe 2428 nhdln.exe -
resource yara_rule behavioral1/memory/2840-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/432-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-771-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-792-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftlhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfpbllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blhpnvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpvrdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbxvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrjrnlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dptttp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpnjxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvrhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdhld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phxfnxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhfntx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdbxtvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtrvhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tplvvxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhfvll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhxdtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnpffrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvfndtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdfrdrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrlnllt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfhbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbjxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxxxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrtxxbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxfhfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlrjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjnjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flndh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njtpdft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tphhpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpbfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trjlbvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjpbdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thpjpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfndj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxlhfph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpxnlnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlrbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltnxnbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdhdntv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdttvjn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2492 wrote to memory of 2840 2492 808f91658173c613b6f61664a018f1c64dbf206350e775922f7ac74290f65700.exe 30 PID 2492 wrote to memory of 2840 2492 808f91658173c613b6f61664a018f1c64dbf206350e775922f7ac74290f65700.exe 30 PID 2492 wrote to memory of 2840 2492 808f91658173c613b6f61664a018f1c64dbf206350e775922f7ac74290f65700.exe 30 PID 2492 wrote to memory of 2840 2492 808f91658173c613b6f61664a018f1c64dbf206350e775922f7ac74290f65700.exe 30 PID 2840 wrote to memory of 2780 2840 hdxdnlt.exe 31 PID 2840 wrote to memory of 2780 2840 hdxdnlt.exe 31 PID 2840 wrote to memory of 2780 2840 hdxdnlt.exe 31 PID 2840 wrote to memory of 2780 2840 hdxdnlt.exe 31 PID 2780 wrote to memory of 2456 2780 vbjbb.exe 32 PID 2780 wrote to memory of 2456 2780 vbjbb.exe 32 PID 2780 wrote to memory of 2456 2780 vbjbb.exe 32 PID 2780 wrote to memory of 2456 2780 vbjbb.exe 32 PID 2456 wrote to memory of 2904 2456 fxhtpfp.exe 33 PID 2456 wrote to memory of 2904 2456 fxhtpfp.exe 33 PID 2456 wrote to memory of 2904 2456 fxhtpfp.exe 33 PID 2456 wrote to memory of 2904 2456 fxhtpfp.exe 33 PID 2904 wrote to memory of 2824 2904 jtdnfn.exe 34 PID 2904 wrote to memory of 2824 2904 jtdnfn.exe 34 PID 2904 wrote to memory of 2824 2904 jtdnfn.exe 34 PID 2904 wrote to memory of 2824 2904 jtdnfn.exe 34 PID 2824 wrote to memory of 1712 2824 pflxdxb.exe 35 PID 2824 wrote to memory of 1712 2824 pflxdxb.exe 35 PID 2824 wrote to memory of 1712 2824 pflxdxb.exe 35 PID 2824 wrote to memory of 1712 2824 pflxdxb.exe 35 PID 1712 wrote to memory of 2616 1712 hprrpt.exe 36 PID 1712 wrote to memory of 2616 1712 hprrpt.exe 36 PID 1712 wrote to memory of 2616 1712 hprrpt.exe 36 PID 1712 wrote to memory of 2616 1712 hprrpt.exe 36 PID 2616 wrote to memory of 432 2616 jvhftfn.exe 37 PID 2616 wrote to memory of 432 2616 jvhftfn.exe 37 PID 2616 wrote to memory of 432 2616 jvhftfn.exe 37 PID 2616 wrote to memory of 432 2616 jvhftfn.exe 37 PID 432 wrote to memory of 2224 432 brxvv.exe 38 PID 432 wrote to memory of 2224 432 brxvv.exe 38 PID 432 wrote to memory of 2224 432 brxvv.exe 38 PID 432 wrote to memory of 2224 432 brxvv.exe 38 PID 2224 wrote to memory of 2112 2224 jpxthvt.exe 39 PID 2224 wrote to memory of 2112 2224 jpxthvt.exe 39 PID 2224 wrote to memory of 2112 2224 jpxthvt.exe 39 PID 2224 wrote to memory of 2112 2224 jpxthvt.exe 39 PID 2112 wrote to memory of 1236 2112 vjdvvtf.exe 40 PID 2112 wrote to memory of 1236 2112 vjdvvtf.exe 40 PID 2112 wrote to memory of 1236 2112 vjdvvtf.exe 40 PID 2112 wrote to memory of 1236 2112 vjdvvtf.exe 40 PID 1236 wrote to memory of 1572 1236 dhlhr.exe 41 PID 1236 wrote to memory of 1572 1236 dhlhr.exe 41 PID 1236 wrote to memory of 1572 1236 dhlhr.exe 41 PID 1236 wrote to memory of 1572 1236 dhlhr.exe 41 PID 1572 wrote to memory of 2988 1572 tvbld.exe 42 PID 1572 wrote to memory of 2988 1572 tvbld.exe 42 PID 1572 wrote to memory of 2988 1572 tvbld.exe 42 PID 1572 wrote to memory of 2988 1572 tvbld.exe 42 PID 2988 wrote to memory of 2956 2988 fnxvp.exe 43 PID 2988 wrote to memory of 2956 2988 fnxvp.exe 43 PID 2988 wrote to memory of 2956 2988 fnxvp.exe 43 PID 2988 wrote to memory of 2956 2988 fnxvp.exe 43 PID 2956 wrote to memory of 1948 2956 xrpbv.exe 44 PID 2956 wrote to memory of 1948 2956 xrpbv.exe 44 PID 2956 wrote to memory of 1948 2956 xrpbv.exe 44 PID 2956 wrote to memory of 1948 2956 xrpbv.exe 44 PID 1948 wrote to memory of 1088 1948 fjlfpf.exe 45 PID 1948 wrote to memory of 1088 1948 fjlfpf.exe 45 PID 1948 wrote to memory of 1088 1948 fjlfpf.exe 45 PID 1948 wrote to memory of 1088 1948 fjlfpf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\808f91658173c613b6f61664a018f1c64dbf206350e775922f7ac74290f65700.exe"C:\Users\Admin\AppData\Local\Temp\808f91658173c613b6f61664a018f1c64dbf206350e775922f7ac74290f65700.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\hdxdnlt.exec:\hdxdnlt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\vbjbb.exec:\vbjbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\fxhtpfp.exec:\fxhtpfp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\jtdnfn.exec:\jtdnfn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\pflxdxb.exec:\pflxdxb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\hprrpt.exec:\hprrpt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\jvhftfn.exec:\jvhftfn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\brxvv.exec:\brxvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\jpxthvt.exec:\jpxthvt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\vjdvvtf.exec:\vjdvvtf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\dhlhr.exec:\dhlhr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\tvbld.exec:\tvbld.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\fnxvp.exec:\fnxvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\xrpbv.exec:\xrpbv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\fjlfpf.exec:\fjlfpf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\rhxxb.exec:\rhxxb.exe17⤵
- Executes dropped EXE
PID:1088 -
\??\c:\tbpvjj.exec:\tbpvjj.exe18⤵
- Executes dropped EXE
PID:672 -
\??\c:\vvrfxl.exec:\vvrfxl.exe19⤵
- Executes dropped EXE
PID:1900 -
\??\c:\thbnnp.exec:\thbnnp.exe20⤵
- Executes dropped EXE
PID:2512 -
\??\c:\tnxdtj.exec:\tnxdtj.exe21⤵
- Executes dropped EXE
PID:2068 -
\??\c:\djnvnn.exec:\djnvnn.exe22⤵
- Executes dropped EXE
PID:2500 -
\??\c:\frlrj.exec:\frlrj.exe23⤵
- Executes dropped EXE
PID:1384 -
\??\c:\xxlpr.exec:\xxlpr.exe24⤵
- Executes dropped EXE
PID:1544 -
\??\c:\fbhbjnx.exec:\fbhbjnx.exe25⤵
- Executes dropped EXE
PID:2116 -
\??\c:\hfhht.exec:\hfhht.exe26⤵
- Executes dropped EXE
PID:1812 -
\??\c:\xdjvdl.exec:\xdjvdl.exe27⤵
- Executes dropped EXE
PID:2092 -
\??\c:\hrlnnnr.exec:\hrlnnnr.exe28⤵
- Executes dropped EXE
PID:1780 -
\??\c:\vdvtlb.exec:\vdvtlb.exe29⤵
- Executes dropped EXE
PID:2264 -
\??\c:\pddrd.exec:\pddrd.exe30⤵
- Executes dropped EXE
PID:1304 -
\??\c:\fpbrx.exec:\fpbrx.exe31⤵
- Executes dropped EXE
PID:1996 -
\??\c:\nbtxxb.exec:\nbtxxb.exe32⤵
- Executes dropped EXE
PID:1848 -
\??\c:\btfdtv.exec:\btfdtv.exe33⤵
- Executes dropped EXE
PID:1252 -
\??\c:\bxhhjp.exec:\bxhhjp.exe34⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xbllrrv.exec:\xbllrrv.exe35⤵
- Executes dropped EXE
PID:2876 -
\??\c:\dxdxlxl.exec:\dxdxlxl.exe36⤵
- Executes dropped EXE
PID:1600 -
\??\c:\rjdnntn.exec:\rjdnntn.exe37⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xnhprhd.exec:\xnhprhd.exe38⤵
- Executes dropped EXE
PID:3064 -
\??\c:\lvbfvn.exec:\lvbfvn.exe39⤵
- Executes dropped EXE
PID:2456 -
\??\c:\bldpdl.exec:\bldpdl.exe40⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jtxjtl.exec:\jtxjtl.exe41⤵
- Executes dropped EXE
PID:2684 -
\??\c:\vxlhfph.exec:\vxlhfph.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2680 -
\??\c:\phbdjh.exec:\phbdjh.exe43⤵
- Executes dropped EXE
PID:1712 -
\??\c:\prjxlx.exec:\prjxlx.exe44⤵
- Executes dropped EXE
PID:1072 -
\??\c:\hpvlx.exec:\hpvlx.exe45⤵
- Executes dropped EXE
PID:2608 -
\??\c:\bpbfl.exec:\bpbfl.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2024 -
\??\c:\xnjvp.exec:\xnjvp.exe47⤵
- Executes dropped EXE
PID:2380 -
\??\c:\dvxffl.exec:\dvxffl.exe48⤵
- Executes dropped EXE
PID:2440 -
\??\c:\fnplx.exec:\fnplx.exe49⤵
- Executes dropped EXE
PID:2096 -
\??\c:\fvfnl.exec:\fvfnl.exe50⤵
- Executes dropped EXE
PID:1484 -
\??\c:\fjxnh.exec:\fjxnh.exe51⤵
- Executes dropped EXE
PID:2884 -
\??\c:\jnjvn.exec:\jnjvn.exe52⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xvtxhn.exec:\xvtxhn.exe53⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vjfdtdl.exec:\vjfdtdl.exe54⤵
- Executes dropped EXE
PID:1992 -
\??\c:\thxfvff.exec:\thxfvff.exe55⤵
- Executes dropped EXE
PID:844 -
\??\c:\fdpjhfb.exec:\fdpjhfb.exe56⤵
- Executes dropped EXE
PID:1088 -
\??\c:\llbhhl.exec:\llbhhl.exe57⤵
- Executes dropped EXE
PID:672 -
\??\c:\dpldp.exec:\dpldp.exe58⤵
- Executes dropped EXE
PID:2152 -
\??\c:\njdxlb.exec:\njdxlb.exe59⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vpnnrfl.exec:\vpnnrfl.exe60⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xhhrtnh.exec:\xhhrtnh.exe61⤵
- Executes dropped EXE
PID:1700 -
\??\c:\lvbfrrv.exec:\lvbfrrv.exe62⤵
- Executes dropped EXE
PID:528 -
\??\c:\dpjppl.exec:\dpjppl.exe63⤵
- Executes dropped EXE
PID:848 -
\??\c:\pvndhv.exec:\pvndhv.exe64⤵
- Executes dropped EXE
PID:952 -
\??\c:\nhdln.exec:\nhdln.exe65⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rddxn.exec:\rddxn.exe66⤵PID:1868
-
\??\c:\prlpnf.exec:\prlpnf.exe67⤵PID:1536
-
\??\c:\llvfb.exec:\llvfb.exe68⤵PID:3060
-
\??\c:\dbtdhjp.exec:\dbtdhjp.exe69⤵PID:640
-
\??\c:\pptbtt.exec:\pptbtt.exe70⤵PID:908
-
\??\c:\vxtph.exec:\vxtph.exe71⤵PID:1676
-
\??\c:\dxtrxr.exec:\dxtrxr.exe72⤵PID:2228
-
\??\c:\hxpbtjl.exec:\hxpbtjl.exe73⤵PID:812
-
\??\c:\vplbj.exec:\vplbj.exe74⤵PID:2300
-
\??\c:\pbxnrx.exec:\pbxnrx.exe75⤵PID:2244
-
\??\c:\lvlhlv.exec:\lvlhlv.exe76⤵PID:1504
-
\??\c:\lvbtflv.exec:\lvbtflv.exe77⤵PID:2844
-
\??\c:\fdxpr.exec:\fdxpr.exe78⤵PID:3056
-
\??\c:\rhltvv.exec:\rhltvv.exe79⤵PID:2848
-
\??\c:\pnvpfb.exec:\pnvpfb.exe80⤵PID:2896
-
\??\c:\hnlfl.exec:\hnlfl.exe81⤵PID:2808
-
\??\c:\ndtrxxt.exec:\ndtrxxt.exe82⤵PID:3064
-
\??\c:\tflflbv.exec:\tflflbv.exe83⤵PID:2692
-
\??\c:\tdvnnj.exec:\tdvnnj.exe84⤵PID:2632
-
\??\c:\nfvbx.exec:\nfvbx.exe85⤵PID:2708
-
\??\c:\btxnvb.exec:\btxnvb.exe86⤵PID:2680
-
\??\c:\xbjdpd.exec:\xbjdpd.exe87⤵PID:2424
-
\??\c:\xppxf.exec:\xppxf.exe88⤵PID:1072
-
\??\c:\xpvjn.exec:\xpvjn.exe89⤵PID:2128
-
\??\c:\hhjhhtn.exec:\hhjhhtn.exe90⤵PID:1148
-
\??\c:\rxrxfd.exec:\rxrxfd.exe91⤵PID:2604
-
\??\c:\trpvx.exec:\trpvx.exe92⤵PID:2996
-
\??\c:\pfvxbfj.exec:\pfvxbfj.exe93⤵PID:592
-
\??\c:\pnlhjd.exec:\pnlhjd.exe94⤵PID:980
-
\??\c:\rjhlbr.exec:\rjhlbr.exe95⤵PID:2988
-
\??\c:\nbtvn.exec:\nbtvn.exe96⤵PID:2964
-
\??\c:\dhbtjdx.exec:\dhbtjdx.exe97⤵PID:1264
-
\??\c:\lhxlv.exec:\lhxlv.exe98⤵PID:1948
-
\??\c:\thfvdh.exec:\thfvdh.exe99⤵PID:264
-
\??\c:\vnlrnht.exec:\vnlrnht.exe100⤵PID:2148
-
\??\c:\prpnnnx.exec:\prpnnnx.exe101⤵PID:1640
-
\??\c:\hpdtvpt.exec:\hpdtvpt.exe102⤵PID:2388
-
\??\c:\jxxdf.exec:\jxxdf.exe103⤵PID:1692
-
\??\c:\xvpjfr.exec:\xvpjfr.exe104⤵PID:2504
-
\??\c:\fpjlvdf.exec:\fpjlvdf.exe105⤵PID:1360
-
\??\c:\nxxbll.exec:\nxxbll.exe106⤵PID:676
-
\??\c:\bfjxpp.exec:\bfjxpp.exe107⤵PID:612
-
\??\c:\nnvxtf.exec:\nnvxtf.exe108⤵PID:936
-
\??\c:\pvfdxp.exec:\pvfdxp.exe109⤵PID:2028
-
\??\c:\bdfdpff.exec:\bdfdpff.exe110⤵PID:1336
-
\??\c:\xlbhj.exec:\xlbhj.exe111⤵PID:2320
-
\??\c:\ntdlpp.exec:\ntdlpp.exe112⤵PID:2092
-
\??\c:\vtndtp.exec:\vtndtp.exe113⤵PID:1516
-
\??\c:\xrpxj.exec:\xrpxj.exe114⤵PID:916
-
\??\c:\nfplx.exec:\nfplx.exe115⤵PID:1676
-
\??\c:\xhljbxj.exec:\xhljbxj.exe116⤵PID:2220
-
\??\c:\hbtttl.exec:\hbtttl.exe117⤵PID:1316
-
\??\c:\ptttd.exec:\ptttd.exe118⤵PID:2300
-
\??\c:\npppnbj.exec:\npppnbj.exe119⤵PID:2760
-
\??\c:\npxxp.exec:\npxxp.exe120⤵PID:1592
-
\??\c:\xppdvtr.exec:\xppdvtr.exe121⤵PID:2876
-
\??\c:\bfbjfxj.exec:\bfbjfxj.exe122⤵PID:1600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-