Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cbd7e4dc9fce8ead7ef06577369f7dc8312eb0b4be5e5ee8c5f31d1a40f34851N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
cbd7e4dc9fce8ead7ef06577369f7dc8312eb0b4be5e5ee8c5f31d1a40f34851N.exe
-
Size
454KB
-
MD5
c8350c48b19812dc7c994dce49753b00
-
SHA1
e479572e2670a909868e281214cccce689355ace
-
SHA256
cbd7e4dc9fce8ead7ef06577369f7dc8312eb0b4be5e5ee8c5f31d1a40f34851
-
SHA512
ae2f2d3cb4f7398c6f1999722d12c873c0817b7a3231a54387a44e19e67f14a95c0705e0b27b5023c8f2f297dcd18a71bf801b492d7d4e5de7236c4813de0961
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeO:q7Tc2NYHUrAwfMp3CDO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2380-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-78-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2788-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-108-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2320-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1372-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-288-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1512-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-358-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2936-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1100-404-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2224-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-481-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/612-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/612-521-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1820-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-537-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1640-542-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/920-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-621-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2036-720-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-814-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1988-841-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1516 nvjvxdf.exe 1044 pdjprp.exe 2980 pflbl.exe 2720 vdnbtdp.exe 2748 pdlvv.exe 2976 txhbftx.exe 1048 bpfhd.exe 2788 drvppbr.exe 2356 lndlt.exe 2100 frddjhp.exe 1584 rrnvp.exe 2320 xbtfpnv.exe 3036 vvnlrrv.exe 2764 bpttnpn.exe 1296 rrbxrd.exe 2248 fxnlphr.exe 1148 drvvx.exe 2232 tjrprx.exe 1524 ddnvtl.exe 2088 tlbhbtj.exe 2080 lblxt.exe 2216 hpbpl.exe 660 bjjrpt.exe 2580 pxbppn.exe 1932 phljx.exe 2284 drljp.exe 2164 xhnxtjf.exe 1372 llvtlbh.exe 964 llxnlt.exe 2656 vfjlrjl.exe 1072 ljjxlj.exe 1512 nttfl.exe 1132 fxfvhlh.exe 1596 nhljj.exe 1184 tnddv.exe 2856 tllpr.exe 2932 dldtr.exe 2984 txptx.exe 2844 rxjnl.exe 3024 pnrrvxj.exe 2936 vrnfvbj.exe 2716 rbnddxf.exe 2824 xtdhf.exe 2596 lljbrnf.exe 2788 tnlfnn.exe 2304 dvdllpf.exe 2028 trtdhh.exe 1100 hxvhnhh.exe 2224 hfrdhpf.exe 2320 tfrnjp.exe 1144 rlhrr.exe 1984 pvdntd.exe 1260 xvldb.exe 1296 nljnj.exe 2900 dxtttn.exe 1272 xphffd.exe 2188 fvldl.exe 2452 ftdlxd.exe 1524 pfdvnpn.exe 2192 flrhnjf.exe 2576 ndttrlf.exe 612 rbprht.exe 1712 dffbnd.exe 1832 fvjfxb.exe -
resource yara_rule behavioral1/memory/2380-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-621-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2892-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-807-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-841-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-842-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnbfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdntd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdlddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lptrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbtrbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nltrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrhnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdxhlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhdjtrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtfljf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvplltv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhbxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddrxvvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvfxnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljxpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljdhfbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbdntf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjdvnpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlbnnvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlrhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfjtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpjllv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvfhph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhjpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpnpdpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plxtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrvdrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvbnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drhvlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbjvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhlvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlfbbph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxhtnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbrvvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjpxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 1516 2380 cbd7e4dc9fce8ead7ef06577369f7dc8312eb0b4be5e5ee8c5f31d1a40f34851N.exe 29 PID 2380 wrote to memory of 1516 2380 cbd7e4dc9fce8ead7ef06577369f7dc8312eb0b4be5e5ee8c5f31d1a40f34851N.exe 29 PID 2380 wrote to memory of 1516 2380 cbd7e4dc9fce8ead7ef06577369f7dc8312eb0b4be5e5ee8c5f31d1a40f34851N.exe 29 PID 2380 wrote to memory of 1516 2380 cbd7e4dc9fce8ead7ef06577369f7dc8312eb0b4be5e5ee8c5f31d1a40f34851N.exe 29 PID 1516 wrote to memory of 1044 1516 nvjvxdf.exe 30 PID 1516 wrote to memory of 1044 1516 nvjvxdf.exe 30 PID 1516 wrote to memory of 1044 1516 nvjvxdf.exe 30 PID 1516 wrote to memory of 1044 1516 nvjvxdf.exe 30 PID 1044 wrote to memory of 2980 1044 pdjprp.exe 31 PID 1044 wrote to memory of 2980 1044 pdjprp.exe 31 PID 1044 wrote to memory of 2980 1044 pdjprp.exe 31 PID 1044 wrote to memory of 2980 1044 pdjprp.exe 31 PID 2980 wrote to memory of 2720 2980 pflbl.exe 32 PID 2980 wrote to memory of 2720 2980 pflbl.exe 32 PID 2980 wrote to memory of 2720 2980 pflbl.exe 32 PID 2980 wrote to memory of 2720 2980 pflbl.exe 32 PID 2720 wrote to memory of 2748 2720 vdnbtdp.exe 33 PID 2720 wrote to memory of 2748 2720 vdnbtdp.exe 33 PID 2720 wrote to memory of 2748 2720 vdnbtdp.exe 33 PID 2720 wrote to memory of 2748 2720 vdnbtdp.exe 33 PID 2748 wrote to memory of 2976 2748 pdlvv.exe 34 PID 2748 wrote to memory of 2976 2748 pdlvv.exe 34 PID 2748 wrote to memory of 2976 2748 pdlvv.exe 34 PID 2748 wrote to memory of 2976 2748 pdlvv.exe 34 PID 2976 wrote to memory of 1048 2976 txhbftx.exe 35 PID 2976 wrote to memory of 1048 2976 txhbftx.exe 35 PID 2976 wrote to memory of 1048 2976 txhbftx.exe 35 PID 2976 wrote to memory of 1048 2976 txhbftx.exe 35 PID 1048 wrote to memory of 2788 1048 bpfhd.exe 36 PID 1048 wrote to memory of 2788 1048 bpfhd.exe 36 PID 1048 wrote to memory of 2788 1048 bpfhd.exe 36 PID 1048 wrote to memory of 2788 1048 bpfhd.exe 36 PID 2788 wrote to memory of 2356 2788 drvppbr.exe 37 PID 2788 wrote to memory of 2356 2788 drvppbr.exe 37 PID 2788 wrote to memory of 2356 2788 drvppbr.exe 37 PID 2788 wrote to memory of 2356 2788 drvppbr.exe 37 PID 2356 wrote to memory of 2100 2356 lndlt.exe 38 PID 2356 wrote to memory of 2100 2356 lndlt.exe 38 PID 2356 wrote to memory of 2100 2356 lndlt.exe 38 PID 2356 wrote to memory of 2100 2356 lndlt.exe 38 PID 2100 wrote to memory of 1584 2100 frddjhp.exe 39 PID 2100 wrote to memory of 1584 2100 frddjhp.exe 39 PID 2100 wrote to memory of 1584 2100 frddjhp.exe 39 PID 2100 wrote to memory of 1584 2100 frddjhp.exe 39 PID 1584 wrote to memory of 2320 1584 rrnvp.exe 40 PID 1584 wrote to memory of 2320 1584 rrnvp.exe 40 PID 1584 wrote to memory of 2320 1584 rrnvp.exe 40 PID 1584 wrote to memory of 2320 1584 rrnvp.exe 40 PID 2320 wrote to memory of 3036 2320 xbtfpnv.exe 41 PID 2320 wrote to memory of 3036 2320 xbtfpnv.exe 41 PID 2320 wrote to memory of 3036 2320 xbtfpnv.exe 41 PID 2320 wrote to memory of 3036 2320 xbtfpnv.exe 41 PID 3036 wrote to memory of 2764 3036 vvnlrrv.exe 42 PID 3036 wrote to memory of 2764 3036 vvnlrrv.exe 42 PID 3036 wrote to memory of 2764 3036 vvnlrrv.exe 42 PID 3036 wrote to memory of 2764 3036 vvnlrrv.exe 42 PID 2764 wrote to memory of 1296 2764 bpttnpn.exe 43 PID 2764 wrote to memory of 1296 2764 bpttnpn.exe 43 PID 2764 wrote to memory of 1296 2764 bpttnpn.exe 43 PID 2764 wrote to memory of 1296 2764 bpttnpn.exe 43 PID 1296 wrote to memory of 2248 1296 rrbxrd.exe 44 PID 1296 wrote to memory of 2248 1296 rrbxrd.exe 44 PID 1296 wrote to memory of 2248 1296 rrbxrd.exe 44 PID 1296 wrote to memory of 2248 1296 rrbxrd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbd7e4dc9fce8ead7ef06577369f7dc8312eb0b4be5e5ee8c5f31d1a40f34851N.exe"C:\Users\Admin\AppData\Local\Temp\cbd7e4dc9fce8ead7ef06577369f7dc8312eb0b4be5e5ee8c5f31d1a40f34851N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\nvjvxdf.exec:\nvjvxdf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\pdjprp.exec:\pdjprp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\pflbl.exec:\pflbl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\vdnbtdp.exec:\vdnbtdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\pdlvv.exec:\pdlvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\txhbftx.exec:\txhbftx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\bpfhd.exec:\bpfhd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\drvppbr.exec:\drvppbr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\lndlt.exec:\lndlt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\frddjhp.exec:\frddjhp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\rrnvp.exec:\rrnvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\xbtfpnv.exec:\xbtfpnv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\vvnlrrv.exec:\vvnlrrv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\bpttnpn.exec:\bpttnpn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\rrbxrd.exec:\rrbxrd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\fxnlphr.exec:\fxnlphr.exe17⤵
- Executes dropped EXE
PID:2248 -
\??\c:\drvvx.exec:\drvvx.exe18⤵
- Executes dropped EXE
PID:1148 -
\??\c:\tjrprx.exec:\tjrprx.exe19⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ddnvtl.exec:\ddnvtl.exe20⤵
- Executes dropped EXE
PID:1524 -
\??\c:\tlbhbtj.exec:\tlbhbtj.exe21⤵
- Executes dropped EXE
PID:2088 -
\??\c:\lblxt.exec:\lblxt.exe22⤵
- Executes dropped EXE
PID:2080 -
\??\c:\hpbpl.exec:\hpbpl.exe23⤵
- Executes dropped EXE
PID:2216 -
\??\c:\bjjrpt.exec:\bjjrpt.exe24⤵
- Executes dropped EXE
PID:660 -
\??\c:\pxbppn.exec:\pxbppn.exe25⤵
- Executes dropped EXE
PID:2580 -
\??\c:\phljx.exec:\phljx.exe26⤵
- Executes dropped EXE
PID:1932 -
\??\c:\drljp.exec:\drljp.exe27⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xhnxtjf.exec:\xhnxtjf.exe28⤵
- Executes dropped EXE
PID:2164 -
\??\c:\llvtlbh.exec:\llvtlbh.exe29⤵
- Executes dropped EXE
PID:1372 -
\??\c:\llxnlt.exec:\llxnlt.exe30⤵
- Executes dropped EXE
PID:964 -
\??\c:\vfjlrjl.exec:\vfjlrjl.exe31⤵
- Executes dropped EXE
PID:2656 -
\??\c:\ljjxlj.exec:\ljjxlj.exe32⤵
- Executes dropped EXE
PID:1072 -
\??\c:\nttfl.exec:\nttfl.exe33⤵
- Executes dropped EXE
PID:1512 -
\??\c:\fxfvhlh.exec:\fxfvhlh.exe34⤵
- Executes dropped EXE
PID:1132 -
\??\c:\nhljj.exec:\nhljj.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\tnddv.exec:\tnddv.exe36⤵
- Executes dropped EXE
PID:1184 -
\??\c:\tllpr.exec:\tllpr.exe37⤵
- Executes dropped EXE
PID:2856 -
\??\c:\dldtr.exec:\dldtr.exe38⤵
- Executes dropped EXE
PID:2932 -
\??\c:\txptx.exec:\txptx.exe39⤵
- Executes dropped EXE
PID:2984 -
\??\c:\rxjnl.exec:\rxjnl.exe40⤵
- Executes dropped EXE
PID:2844 -
\??\c:\pnrrvxj.exec:\pnrrvxj.exe41⤵
- Executes dropped EXE
PID:3024 -
\??\c:\vrnfvbj.exec:\vrnfvbj.exe42⤵
- Executes dropped EXE
PID:2936 -
\??\c:\rbnddxf.exec:\rbnddxf.exe43⤵
- Executes dropped EXE
PID:2716 -
\??\c:\xtdhf.exec:\xtdhf.exe44⤵
- Executes dropped EXE
PID:2824 -
\??\c:\lljbrnf.exec:\lljbrnf.exe45⤵
- Executes dropped EXE
PID:2596 -
\??\c:\tnlfnn.exec:\tnlfnn.exe46⤵
- Executes dropped EXE
PID:2788 -
\??\c:\dvdllpf.exec:\dvdllpf.exe47⤵
- Executes dropped EXE
PID:2304 -
\??\c:\trtdhh.exec:\trtdhh.exe48⤵
- Executes dropped EXE
PID:2028 -
\??\c:\hxvhnhh.exec:\hxvhnhh.exe49⤵
- Executes dropped EXE
PID:1100 -
\??\c:\hfrdhpf.exec:\hfrdhpf.exe50⤵
- Executes dropped EXE
PID:2224 -
\??\c:\tfrnjp.exec:\tfrnjp.exe51⤵
- Executes dropped EXE
PID:2320 -
\??\c:\rlhrr.exec:\rlhrr.exe52⤵
- Executes dropped EXE
PID:1144 -
\??\c:\pvdntd.exec:\pvdntd.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1984 -
\??\c:\xvldb.exec:\xvldb.exe54⤵
- Executes dropped EXE
PID:1260 -
\??\c:\nljnj.exec:\nljnj.exe55⤵
- Executes dropped EXE
PID:1296 -
\??\c:\dxtttn.exec:\dxtttn.exe56⤵
- Executes dropped EXE
PID:2900 -
\??\c:\xphffd.exec:\xphffd.exe57⤵
- Executes dropped EXE
PID:1272 -
\??\c:\fvldl.exec:\fvldl.exe58⤵
- Executes dropped EXE
PID:2188 -
\??\c:\ftdlxd.exec:\ftdlxd.exe59⤵
- Executes dropped EXE
PID:2452 -
\??\c:\pfdvnpn.exec:\pfdvnpn.exe60⤵
- Executes dropped EXE
PID:1524 -
\??\c:\flrhnjf.exec:\flrhnjf.exe61⤵
- Executes dropped EXE
PID:2192 -
\??\c:\ndttrlf.exec:\ndttrlf.exe62⤵
- Executes dropped EXE
PID:2576 -
\??\c:\rbprht.exec:\rbprht.exe63⤵
- Executes dropped EXE
PID:612 -
\??\c:\dffbnd.exec:\dffbnd.exe64⤵
- Executes dropped EXE
PID:1712 -
\??\c:\fvjfxb.exec:\fvjfxb.exe65⤵
- Executes dropped EXE
PID:1832 -
\??\c:\pdltntn.exec:\pdltntn.exe66⤵PID:2032
-
\??\c:\rdxhnht.exec:\rdxhnht.exe67⤵PID:2564
-
\??\c:\blfhr.exec:\blfhr.exe68⤵PID:1820
-
\??\c:\btxhdx.exec:\btxhdx.exe69⤵PID:1640
-
\??\c:\jpbvh.exec:\jpbvh.exe70⤵PID:1724
-
\??\c:\vdjxjlh.exec:\vdjxjlh.exe71⤵PID:920
-
\??\c:\ptrtn.exec:\ptrtn.exe72⤵PID:2392
-
\??\c:\bphpp.exec:\bphpp.exe73⤵PID:2308
-
\??\c:\dxbjx.exec:\dxbjx.exe74⤵PID:2360
-
\??\c:\nvndj.exec:\nvndj.exe75⤵PID:876
-
\??\c:\vjpdvrx.exec:\vjpdvrx.exe76⤵PID:2388
-
\??\c:\jrhtjp.exec:\jrhtjp.exe77⤵PID:1600
-
\??\c:\btltlr.exec:\btltlr.exe78⤵PID:2468
-
\??\c:\txxhb.exec:\txxhb.exe79⤵PID:2868
-
\??\c:\hrbnjh.exec:\hrbnjh.exe80⤵PID:2336
-
\??\c:\xnpbdv.exec:\xnpbdv.exe81⤵PID:2456
-
\??\c:\nrbbxpr.exec:\nrbbxpr.exe82⤵PID:2836
-
\??\c:\pttnb.exec:\pttnb.exe83⤵PID:2844
-
\??\c:\hvrbf.exec:\hvrbf.exe84⤵PID:2752
-
\??\c:\pxxhd.exec:\pxxhd.exe85⤵PID:2936
-
\??\c:\jlrpvnt.exec:\jlrpvnt.exe86⤵PID:2708
-
\??\c:\vpxpvj.exec:\vpxpvj.exe87⤵PID:2768
-
\??\c:\nlpnlxt.exec:\nlpnlxt.exe88⤵PID:2892
-
\??\c:\jlbxx.exec:\jlbxx.exe89⤵PID:2616
-
\??\c:\hhxtpp.exec:\hhxtpp.exe90⤵PID:2600
-
\??\c:\nddjntf.exec:\nddjntf.exe91⤵PID:2028
-
\??\c:\dvtjjhj.exec:\dvtjjhj.exe92⤵PID:2960
-
\??\c:\xbxxnd.exec:\xbxxnd.exe93⤵PID:3040
-
\??\c:\dhhrvn.exec:\dhhrvn.exe94⤵PID:3044
-
\??\c:\lnxljhv.exec:\lnxljhv.exe95⤵PID:2004
-
\??\c:\pppvnbj.exec:\pppvnbj.exe96⤵PID:2036
-
\??\c:\vfrvnx.exec:\vfrvnx.exe97⤵PID:1448
-
\??\c:\nvpxjv.exec:\nvpxjv.exe98⤵PID:1296
-
\??\c:\rhvpdjr.exec:\rhvpdjr.exe99⤵PID:2900
-
\??\c:\dndbnf.exec:\dndbnf.exe100⤵PID:2232
-
\??\c:\bfllv.exec:\bfllv.exe101⤵PID:1728
-
\??\c:\pbrffr.exec:\pbrffr.exe102⤵PID:1652
-
\??\c:\hxdjpd.exec:\hxdjpd.exe103⤵PID:2088
-
\??\c:\jnhxvx.exec:\jnhxvx.exe104⤵PID:1968
-
\??\c:\blnbfp.exec:\blnbfp.exe105⤵PID:1552
-
\??\c:\vtljrb.exec:\vtljrb.exe106⤵PID:1644
-
\??\c:\btrddx.exec:\btrddx.exe107⤵PID:2548
-
\??\c:\djlbxv.exec:\djlbxv.exe108⤵PID:2580
-
\??\c:\thtfrv.exec:\thtfrv.exe109⤵PID:1052
-
\??\c:\rjjvjn.exec:\rjjvjn.exe110⤵PID:112
-
\??\c:\pvphxp.exec:\pvphxp.exe111⤵PID:1668
-
\??\c:\lrvdjv.exec:\lrvdjv.exe112⤵PID:1736
-
\??\c:\bfhbb.exec:\bfhbb.exe113⤵PID:2140
-
\??\c:\nlxdj.exec:\nlxdj.exe114⤵PID:1988
-
\??\c:\lbhjxfh.exec:\lbhjxfh.exe115⤵PID:1780
-
\??\c:\vflhtdl.exec:\vflhtdl.exe116⤵PID:572
-
\??\c:\xxprv.exec:\xxprv.exe117⤵PID:2132
-
\??\c:\dlrfnf.exec:\dlrfnf.exe118⤵PID:1512
-
\??\c:\jvbhtrx.exec:\jvbhtrx.exe119⤵PID:2296
-
\??\c:\rhrtn.exec:\rhrtn.exe120⤵PID:1388
-
\??\c:\rvplvv.exec:\rvplvv.exe121⤵PID:2288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-