Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe
-
Size
453KB
-
MD5
4a50aec50881291c33b2e9731d648a20
-
SHA1
e0688793f7a506ebb688210a17e3aad747667a87
-
SHA256
b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f
-
SHA512
2379134392b5000224f477c5fe48f7d0d1fd43d81b9c9f851278aca6947f96737114c46c7b8f93b37409b1eef538931459439cde477d4be0b827b5e6c4cc562a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2368-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-115-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2340-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-171-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3032-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-366-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1356-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-396-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1072-422-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2832-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-439-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1932-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-489-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/3032-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-507-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3000-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-539-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2712-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-620-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3056-676-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2636-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1300 lrrrhvf.exe 2600 tvxvxff.exe 1800 pdljnv.exe 2164 vlpfv.exe 2792 nlnxb.exe 2248 bbxdxn.exe 2932 xhlld.exe 2168 rdvfx.exe 2700 rbjxf.exe 2684 npxpl.exe 1960 bpxhdh.exe 1604 vlvpxnv.exe 924 lfnjrdn.exe 1256 rtpbp.exe 2340 ljflddn.exe 660 nbdlj.exe 1484 rvlvt.exe 1764 rtpjpj.exe 3032 dlbjnx.exe 2860 jlldhr.exe 3040 lnxvx.exe 1864 hhnlnnh.exe 3016 xhndvtx.exe 1744 drlrj.exe 1752 ttffhr.exe 2140 nfjddl.exe 1368 vjdtfpl.exe 1144 lxhjh.exe 1248 bfdjlp.exe 2276 xltbbxh.exe 2228 hfddr.exe 2068 lnhtb.exe 2536 jvvxd.exe 1576 jlrdnh.exe 2984 bpxnx.exe 832 nvtrvdr.exe 1328 nfhbrld.exe 1192 jfnfdj.exe 2756 hnjjrrn.exe 2924 tfhnft.exe 2776 tvbht.exe 1356 xtjjhx.exe 2740 llnbtt.exe 2968 rrfbvtr.exe 2944 njhrr.exe 2716 xxphtx.exe 1616 njpvrfb.exe 1984 lrvft.exe 1072 hxbnxfj.exe 2832 jrndrx.exe 1992 nfdfnnx.exe 2112 dhtphxr.exe 1264 blrbrfv.exe 1932 rxrpdb.exe 1940 ldrbthh.exe 2964 vphbrbr.exe 2872 xxxbvdb.exe 2420 trnhx.exe 3032 xhfnl.exe 1816 drrnp.exe 772 xbpnr.exe 1748 nrjpdhv.exe 1496 hhbxr.exe 1340 pfrrn.exe -
resource yara_rule behavioral1/memory/2368-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-27-0x0000000001C70000-0x0000000001C9A000-memory.dmp upx behavioral1/memory/1800-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/660-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-741-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtnjbnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdhtbxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdpbrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxnplh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnpdfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvbrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxhjxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvptpbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rldxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhpdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blplt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhnlpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blrbrfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhfbfbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbbnftj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlxxdbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdrxhpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhndvtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drlrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpxndv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhvpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhffbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtbvhxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbxfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbdpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frtfpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jffvjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frtrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dltjpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxnbhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvljb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrjftbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhpjnhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvxft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnrxbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpphd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpdpv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1300 2368 b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe 30 PID 2368 wrote to memory of 1300 2368 b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe 30 PID 2368 wrote to memory of 1300 2368 b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe 30 PID 2368 wrote to memory of 1300 2368 b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe 30 PID 1300 wrote to memory of 2600 1300 lrrrhvf.exe 31 PID 1300 wrote to memory of 2600 1300 lrrrhvf.exe 31 PID 1300 wrote to memory of 2600 1300 lrrrhvf.exe 31 PID 1300 wrote to memory of 2600 1300 lrrrhvf.exe 31 PID 2600 wrote to memory of 1800 2600 tvxvxff.exe 32 PID 2600 wrote to memory of 1800 2600 tvxvxff.exe 32 PID 2600 wrote to memory of 1800 2600 tvxvxff.exe 32 PID 2600 wrote to memory of 1800 2600 tvxvxff.exe 32 PID 1800 wrote to memory of 2164 1800 pdljnv.exe 33 PID 1800 wrote to memory of 2164 1800 pdljnv.exe 33 PID 1800 wrote to memory of 2164 1800 pdljnv.exe 33 PID 1800 wrote to memory of 2164 1800 pdljnv.exe 33 PID 2164 wrote to memory of 2792 2164 vlpfv.exe 34 PID 2164 wrote to memory of 2792 2164 vlpfv.exe 34 PID 2164 wrote to memory of 2792 2164 vlpfv.exe 34 PID 2164 wrote to memory of 2792 2164 vlpfv.exe 34 PID 2792 wrote to memory of 2248 2792 nlnxb.exe 35 PID 2792 wrote to memory of 2248 2792 nlnxb.exe 35 PID 2792 wrote to memory of 2248 2792 nlnxb.exe 35 PID 2792 wrote to memory of 2248 2792 nlnxb.exe 35 PID 2248 wrote to memory of 2932 2248 bbxdxn.exe 36 PID 2248 wrote to memory of 2932 2248 bbxdxn.exe 36 PID 2248 wrote to memory of 2932 2248 bbxdxn.exe 36 PID 2248 wrote to memory of 2932 2248 bbxdxn.exe 36 PID 2932 wrote to memory of 2168 2932 xhlld.exe 37 PID 2932 wrote to memory of 2168 2932 xhlld.exe 37 PID 2932 wrote to memory of 2168 2932 xhlld.exe 37 PID 2932 wrote to memory of 2168 2932 xhlld.exe 37 PID 2168 wrote to memory of 2700 2168 rdvfx.exe 38 PID 2168 wrote to memory of 2700 2168 rdvfx.exe 38 PID 2168 wrote to memory of 2700 2168 rdvfx.exe 38 PID 2168 wrote to memory of 2700 2168 rdvfx.exe 38 PID 2700 wrote to memory of 2684 2700 rbjxf.exe 39 PID 2700 wrote to memory of 2684 2700 rbjxf.exe 39 PID 2700 wrote to memory of 2684 2700 rbjxf.exe 39 PID 2700 wrote to memory of 2684 2700 rbjxf.exe 39 PID 2684 wrote to memory of 1960 2684 npxpl.exe 40 PID 2684 wrote to memory of 1960 2684 npxpl.exe 40 PID 2684 wrote to memory of 1960 2684 npxpl.exe 40 PID 2684 wrote to memory of 1960 2684 npxpl.exe 40 PID 1960 wrote to memory of 1604 1960 bpxhdh.exe 41 PID 1960 wrote to memory of 1604 1960 bpxhdh.exe 41 PID 1960 wrote to memory of 1604 1960 bpxhdh.exe 41 PID 1960 wrote to memory of 1604 1960 bpxhdh.exe 41 PID 1604 wrote to memory of 924 1604 vlvpxnv.exe 42 PID 1604 wrote to memory of 924 1604 vlvpxnv.exe 42 PID 1604 wrote to memory of 924 1604 vlvpxnv.exe 42 PID 1604 wrote to memory of 924 1604 vlvpxnv.exe 42 PID 924 wrote to memory of 1256 924 lfnjrdn.exe 43 PID 924 wrote to memory of 1256 924 lfnjrdn.exe 43 PID 924 wrote to memory of 1256 924 lfnjrdn.exe 43 PID 924 wrote to memory of 1256 924 lfnjrdn.exe 43 PID 1256 wrote to memory of 2340 1256 rtpbp.exe 44 PID 1256 wrote to memory of 2340 1256 rtpbp.exe 44 PID 1256 wrote to memory of 2340 1256 rtpbp.exe 44 PID 1256 wrote to memory of 2340 1256 rtpbp.exe 44 PID 2340 wrote to memory of 660 2340 ljflddn.exe 45 PID 2340 wrote to memory of 660 2340 ljflddn.exe 45 PID 2340 wrote to memory of 660 2340 ljflddn.exe 45 PID 2340 wrote to memory of 660 2340 ljflddn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe"C:\Users\Admin\AppData\Local\Temp\b5377ceca72ec3792eab6a8bb9f6d035cd46baa2ab4ad0dbeee106c32a2ecf9f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\lrrrhvf.exec:\lrrrhvf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\tvxvxff.exec:\tvxvxff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\pdljnv.exec:\pdljnv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\vlpfv.exec:\vlpfv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\nlnxb.exec:\nlnxb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\bbxdxn.exec:\bbxdxn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\xhlld.exec:\xhlld.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\rdvfx.exec:\rdvfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\rbjxf.exec:\rbjxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\npxpl.exec:\npxpl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\bpxhdh.exec:\bpxhdh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\vlvpxnv.exec:\vlvpxnv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\lfnjrdn.exec:\lfnjrdn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\rtpbp.exec:\rtpbp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\ljflddn.exec:\ljflddn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\nbdlj.exec:\nbdlj.exe17⤵
- Executes dropped EXE
PID:660 -
\??\c:\rvlvt.exec:\rvlvt.exe18⤵
- Executes dropped EXE
PID:1484 -
\??\c:\rtpjpj.exec:\rtpjpj.exe19⤵
- Executes dropped EXE
PID:1764 -
\??\c:\dlbjnx.exec:\dlbjnx.exe20⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jlldhr.exec:\jlldhr.exe21⤵
- Executes dropped EXE
PID:2860 -
\??\c:\lnxvx.exec:\lnxvx.exe22⤵
- Executes dropped EXE
PID:3040 -
\??\c:\hhnlnnh.exec:\hhnlnnh.exe23⤵
- Executes dropped EXE
PID:1864 -
\??\c:\xhndvtx.exec:\xhndvtx.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3016 -
\??\c:\drlrj.exec:\drlrj.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1744 -
\??\c:\ttffhr.exec:\ttffhr.exe26⤵
- Executes dropped EXE
PID:1752 -
\??\c:\nfjddl.exec:\nfjddl.exe27⤵
- Executes dropped EXE
PID:2140 -
\??\c:\vjdtfpl.exec:\vjdtfpl.exe28⤵
- Executes dropped EXE
PID:1368 -
\??\c:\lxhjh.exec:\lxhjh.exe29⤵
- Executes dropped EXE
PID:1144 -
\??\c:\bfdjlp.exec:\bfdjlp.exe30⤵
- Executes dropped EXE
PID:1248 -
\??\c:\xltbbxh.exec:\xltbbxh.exe31⤵
- Executes dropped EXE
PID:2276 -
\??\c:\hfddr.exec:\hfddr.exe32⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lnhtb.exec:\lnhtb.exe33⤵
- Executes dropped EXE
PID:2068 -
\??\c:\jvvxd.exec:\jvvxd.exe34⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jlrdnh.exec:\jlrdnh.exe35⤵
- Executes dropped EXE
PID:1576 -
\??\c:\bpxnx.exec:\bpxnx.exe36⤵
- Executes dropped EXE
PID:2984 -
\??\c:\nvtrvdr.exec:\nvtrvdr.exe37⤵
- Executes dropped EXE
PID:832 -
\??\c:\nfhbrld.exec:\nfhbrld.exe38⤵
- Executes dropped EXE
PID:1328 -
\??\c:\jfnfdj.exec:\jfnfdj.exe39⤵
- Executes dropped EXE
PID:1192 -
\??\c:\hnjjrrn.exec:\hnjjrrn.exe40⤵
- Executes dropped EXE
PID:2756 -
\??\c:\tfhnft.exec:\tfhnft.exe41⤵
- Executes dropped EXE
PID:2924 -
\??\c:\tvbht.exec:\tvbht.exe42⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xtjjhx.exec:\xtjjhx.exe43⤵
- Executes dropped EXE
PID:1356 -
\??\c:\llnbtt.exec:\llnbtt.exe44⤵
- Executes dropped EXE
PID:2740 -
\??\c:\rrfbvtr.exec:\rrfbvtr.exe45⤵
- Executes dropped EXE
PID:2968 -
\??\c:\njhrr.exec:\njhrr.exe46⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xxphtx.exec:\xxphtx.exe47⤵
- Executes dropped EXE
PID:2716 -
\??\c:\njpvrfb.exec:\njpvrfb.exe48⤵
- Executes dropped EXE
PID:1616 -
\??\c:\lrvft.exec:\lrvft.exe49⤵
- Executes dropped EXE
PID:1984 -
\??\c:\hxbnxfj.exec:\hxbnxfj.exe50⤵
- Executes dropped EXE
PID:1072 -
\??\c:\jrndrx.exec:\jrndrx.exe51⤵
- Executes dropped EXE
PID:2832 -
\??\c:\nfdfnnx.exec:\nfdfnnx.exe52⤵
- Executes dropped EXE
PID:1992 -
\??\c:\dhtphxr.exec:\dhtphxr.exe53⤵
- Executes dropped EXE
PID:2112 -
\??\c:\blrbrfv.exec:\blrbrfv.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1264 -
\??\c:\rxrpdb.exec:\rxrpdb.exe55⤵
- Executes dropped EXE
PID:1932 -
\??\c:\ldrbthh.exec:\ldrbthh.exe56⤵
- Executes dropped EXE
PID:1940 -
\??\c:\vphbrbr.exec:\vphbrbr.exe57⤵
- Executes dropped EXE
PID:2964 -
\??\c:\xxxbvdb.exec:\xxxbvdb.exe58⤵
- Executes dropped EXE
PID:2872 -
\??\c:\trnhx.exec:\trnhx.exe59⤵
- Executes dropped EXE
PID:2420 -
\??\c:\xhfnl.exec:\xhfnl.exe60⤵
- Executes dropped EXE
PID:3032 -
\??\c:\drrnp.exec:\drrnp.exe61⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xbpnr.exec:\xbpnr.exe62⤵
- Executes dropped EXE
PID:772 -
\??\c:\nrjpdhv.exec:\nrjpdhv.exe63⤵
- Executes dropped EXE
PID:1748 -
\??\c:\hhbxr.exec:\hhbxr.exe64⤵
- Executes dropped EXE
PID:1496 -
\??\c:\pfrrn.exec:\pfrrn.exe65⤵
- Executes dropped EXE
PID:1340 -
\??\c:\jnxfxdh.exec:\jnxfxdh.exe66⤵PID:2624
-
\??\c:\tlxjbdd.exec:\tlxjbdd.exe67⤵PID:3000
-
\??\c:\rxpjxhr.exec:\rxpjxhr.exe68⤵PID:1680
-
\??\c:\ffhjdl.exec:\ffhjdl.exe69⤵PID:1672
-
\??\c:\xvndfxt.exec:\xvndfxt.exe70⤵PID:264
-
\??\c:\jfndvrv.exec:\jfndvrv.exe71⤵PID:1640
-
\??\c:\ttxjx.exec:\ttxjx.exe72⤵PID:2712
-
\??\c:\vttrdn.exec:\vttrdn.exe73⤵PID:1852
-
\??\c:\vxxpn.exec:\vxxpn.exe74⤵PID:2044
-
\??\c:\bhxrj.exec:\bhxrj.exe75⤵PID:1636
-
\??\c:\thnnfh.exec:\thnnfh.exe76⤵PID:1568
-
\??\c:\xrplx.exec:\xrplx.exe77⤵PID:2448
-
\??\c:\fllxxl.exec:\fllxxl.exe78⤵PID:2136
-
\??\c:\jdljb.exec:\jdljb.exe79⤵PID:2156
-
\??\c:\xntrrb.exec:\xntrrb.exe80⤵PID:2920
-
\??\c:\htnxndt.exec:\htnxndt.exe81⤵PID:2928
-
\??\c:\jjflr.exec:\jjflr.exe82⤵PID:2912
-
\??\c:\dlfjdd.exec:\dlfjdd.exe83⤵PID:2688
-
\??\c:\bnvhbdd.exec:\bnvhbdd.exe84⤵PID:3056
-
\??\c:\ffrtb.exec:\ffrtb.exe85⤵PID:2800
-
\??\c:\bnhvrpf.exec:\bnhvrpf.exe86⤵PID:2664
-
\??\c:\fpphd.exec:\fpphd.exe87⤵
- System Location Discovery: System Language Discovery
PID:2708 -
\??\c:\frxbrh.exec:\frxbrh.exe88⤵PID:1032
-
\??\c:\fjvdjhr.exec:\fjvdjhr.exe89⤵PID:2636
-
\??\c:\tftdlj.exec:\tftdlj.exe90⤵PID:1700
-
\??\c:\fxllxf.exec:\fxllxf.exe91⤵PID:1984
-
\??\c:\vvthrrj.exec:\vvthrrj.exe92⤵PID:1296
-
\??\c:\pdbnnjt.exec:\pdbnnjt.exe93⤵PID:924
-
\??\c:\dlxxpl.exec:\dlxxpl.exe94⤵PID:2560
-
\??\c:\nfxhtbn.exec:\nfxhtbn.exe95⤵PID:1784
-
\??\c:\pvntn.exec:\pvntn.exe96⤵PID:1488
-
\??\c:\rpnlp.exec:\rpnlp.exe97⤵PID:1148
-
\??\c:\fttbjj.exec:\fttbjj.exe98⤵PID:2880
-
\??\c:\lnntblh.exec:\lnntblh.exe99⤵PID:2996
-
\??\c:\tbjjbff.exec:\tbjjbff.exe100⤵PID:1764
-
\??\c:\xjfxpvn.exec:\xjfxpvn.exe101⤵PID:2332
-
\??\c:\ppxxbnv.exec:\ppxxbnv.exe102⤵PID:2360
-
\??\c:\fhtvp.exec:\fhtvp.exe103⤵PID:3036
-
\??\c:\hjnprdp.exec:\hjnprdp.exe104⤵PID:1816
-
\??\c:\lddlddx.exec:\lddlddx.exe105⤵PID:2184
-
\??\c:\pdxbj.exec:\pdxbj.exe106⤵PID:1836
-
\??\c:\lvnnd.exec:\lvnnd.exe107⤵PID:960
-
\??\c:\rxjdvr.exec:\rxjdvr.exe108⤵PID:1772
-
\??\c:\dtxjdlj.exec:\dtxjdlj.exe109⤵PID:1752
-
\??\c:\jrnnnn.exec:\jrnnnn.exe110⤵
- System Location Discovery: System Language Discovery
PID:680 -
\??\c:\hhtdt.exec:\hhtdt.exe111⤵PID:1680
-
\??\c:\nbrrh.exec:\nbrrh.exe112⤵PID:1580
-
\??\c:\xptffb.exec:\xptffb.exe113⤵PID:264
-
\??\c:\tpbjbxf.exec:\tpbjbxf.exe114⤵PID:1640
-
\??\c:\pffhxjh.exec:\pffhxjh.exe115⤵PID:676
-
\??\c:\nnrxrdr.exec:\nnrxrdr.exe116⤵PID:2128
-
\??\c:\nptrrdh.exec:\nptrrdh.exe117⤵PID:1564
-
\??\c:\pvvdprj.exec:\pvvdprj.exe118⤵PID:1300
-
\??\c:\tfnnl.exec:\tfnnl.exe119⤵PID:2352
-
\??\c:\nhpvtnp.exec:\nhpvtnp.exe120⤵PID:2620
-
\??\c:\hpbtdnv.exec:\hpbtdnv.exe121⤵PID:2452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-