Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe
-
Size
453KB
-
MD5
aa50a9422ef3c3e770fc6df958f6d5f6
-
SHA1
5727000564274a33e402b2132deb06520c89ea8c
-
SHA256
a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300
-
SHA512
b72a49e4e4d46fae0d981487ef985f924e7d07d79476fc0e4a74be34caf9756f52e935cd2f095e832fad9ea9fae3c5fd8a8643e8996f8c00ddd82b3106e563a4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetD:q7Tc2NYHUrAwfMp3CDtD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2336-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1180-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1180-146-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1324-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-212-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1948-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/700-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-238-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/616-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1180-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-466-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/272-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/704-637-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2164-718-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-726-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-780-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-788-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2604 nxndnt.exe 2932 prbvfl.exe 2476 nvhln.exe 2992 dttnlhr.exe 332 lnxjvxn.exe 2580 jrxfpl.exe 1092 trxxxn.exe 2816 nhlrhj.exe 2588 npdlljh.exe 2812 tdlbblt.exe 3036 fvvbb.exe 1500 fljnpn.exe 3064 pxjdr.exe 1924 vjlnd.exe 1180 njpvbtx.exe 2172 rdlhflx.exe 1140 tnhxx.exe 984 pbbvvh.exe 1324 fdxhb.exe 2452 dhhpvph.exe 2092 brbhlnx.exe 1968 frjjbr.exe 1948 tnljh.exe 700 hpvblxx.exe 1712 dxvnt.exe 1328 hrjrtvx.exe 1700 phfxtld.exe 616 tpvrnd.exe 776 jbxrnv.exe 1220 pbnjt.exe 2072 fntpvdl.exe 2004 xrdnh.exe 1156 frpfvvj.exe 2384 lpplv.exe 1716 hjbdpj.exe 2604 hjljtvv.exe 2888 rdvlrx.exe 2956 xfttx.exe 2884 lbrprjr.exe 2340 htpxj.exe 2224 nhhxhl.exe 2780 hhbfv.exe 2856 lpprt.exe 2740 pfvdjv.exe 2408 dfjnh.exe 2012 rjlxvj.exe 1232 vvdvrt.exe 3044 fldxrp.exe 580 brxtft.exe 2832 pxfln.exe 2436 rtxbl.exe 2316 rnlhx.exe 2448 pfddtbd.exe 1180 rtfjn.exe 1364 pxrrt.exe 2044 vjtnfh.exe 2400 xjnnfh.exe 2296 bxhfrxb.exe 2920 ttrjvjr.exe 2692 bbfjjp.exe 1784 vdvfptp.exe 272 xhvrhl.exe 612 rvfjf.exe 1672 tfpnxf.exe -
resource yara_rule behavioral1/memory/2336-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/616-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1220-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1220-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-466-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2692-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/272-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/272-521-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1556-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-780-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-788-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfjpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvtllp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvpfjtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpphd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfdbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhfhrhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbdpvfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdtrpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xltnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpxpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjvnbnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbjvfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dttnlhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjlnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddxnlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbnvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjhdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njxhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frpfvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdvdpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxxjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvfptp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flpjxhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llvlxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjltlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrhnrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldjhrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fthtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtbrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2604 2336 a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe 29 PID 2336 wrote to memory of 2604 2336 a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe 29 PID 2336 wrote to memory of 2604 2336 a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe 29 PID 2336 wrote to memory of 2604 2336 a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe 29 PID 2604 wrote to memory of 2932 2604 nxndnt.exe 30 PID 2604 wrote to memory of 2932 2604 nxndnt.exe 30 PID 2604 wrote to memory of 2932 2604 nxndnt.exe 30 PID 2604 wrote to memory of 2932 2604 nxndnt.exe 30 PID 2932 wrote to memory of 2476 2932 prbvfl.exe 31 PID 2932 wrote to memory of 2476 2932 prbvfl.exe 31 PID 2932 wrote to memory of 2476 2932 prbvfl.exe 31 PID 2932 wrote to memory of 2476 2932 prbvfl.exe 31 PID 2476 wrote to memory of 2992 2476 nvhln.exe 32 PID 2476 wrote to memory of 2992 2476 nvhln.exe 32 PID 2476 wrote to memory of 2992 2476 nvhln.exe 32 PID 2476 wrote to memory of 2992 2476 nvhln.exe 32 PID 2992 wrote to memory of 332 2992 dttnlhr.exe 33 PID 2992 wrote to memory of 332 2992 dttnlhr.exe 33 PID 2992 wrote to memory of 332 2992 dttnlhr.exe 33 PID 2992 wrote to memory of 332 2992 dttnlhr.exe 33 PID 332 wrote to memory of 2580 332 lnxjvxn.exe 34 PID 332 wrote to memory of 2580 332 lnxjvxn.exe 34 PID 332 wrote to memory of 2580 332 lnxjvxn.exe 34 PID 332 wrote to memory of 2580 332 lnxjvxn.exe 34 PID 2580 wrote to memory of 1092 2580 jrxfpl.exe 35 PID 2580 wrote to memory of 1092 2580 jrxfpl.exe 35 PID 2580 wrote to memory of 1092 2580 jrxfpl.exe 35 PID 2580 wrote to memory of 1092 2580 jrxfpl.exe 35 PID 1092 wrote to memory of 2816 1092 trxxxn.exe 36 PID 1092 wrote to memory of 2816 1092 trxxxn.exe 36 PID 1092 wrote to memory of 2816 1092 trxxxn.exe 36 PID 1092 wrote to memory of 2816 1092 trxxxn.exe 36 PID 2816 wrote to memory of 2588 2816 nhlrhj.exe 37 PID 2816 wrote to memory of 2588 2816 nhlrhj.exe 37 PID 2816 wrote to memory of 2588 2816 nhlrhj.exe 37 PID 2816 wrote to memory of 2588 2816 nhlrhj.exe 37 PID 2588 wrote to memory of 2812 2588 npdlljh.exe 38 PID 2588 wrote to memory of 2812 2588 npdlljh.exe 38 PID 2588 wrote to memory of 2812 2588 npdlljh.exe 38 PID 2588 wrote to memory of 2812 2588 npdlljh.exe 38 PID 2812 wrote to memory of 3036 2812 tdlbblt.exe 39 PID 2812 wrote to memory of 3036 2812 tdlbblt.exe 39 PID 2812 wrote to memory of 3036 2812 tdlbblt.exe 39 PID 2812 wrote to memory of 3036 2812 tdlbblt.exe 39 PID 3036 wrote to memory of 1500 3036 fvvbb.exe 40 PID 3036 wrote to memory of 1500 3036 fvvbb.exe 40 PID 3036 wrote to memory of 1500 3036 fvvbb.exe 40 PID 3036 wrote to memory of 1500 3036 fvvbb.exe 40 PID 1500 wrote to memory of 3064 1500 fljnpn.exe 41 PID 1500 wrote to memory of 3064 1500 fljnpn.exe 41 PID 1500 wrote to memory of 3064 1500 fljnpn.exe 41 PID 1500 wrote to memory of 3064 1500 fljnpn.exe 41 PID 3064 wrote to memory of 1924 3064 pxjdr.exe 42 PID 3064 wrote to memory of 1924 3064 pxjdr.exe 42 PID 3064 wrote to memory of 1924 3064 pxjdr.exe 42 PID 3064 wrote to memory of 1924 3064 pxjdr.exe 42 PID 1924 wrote to memory of 1180 1924 vjlnd.exe 43 PID 1924 wrote to memory of 1180 1924 vjlnd.exe 43 PID 1924 wrote to memory of 1180 1924 vjlnd.exe 43 PID 1924 wrote to memory of 1180 1924 vjlnd.exe 43 PID 1180 wrote to memory of 2172 1180 njpvbtx.exe 44 PID 1180 wrote to memory of 2172 1180 njpvbtx.exe 44 PID 1180 wrote to memory of 2172 1180 njpvbtx.exe 44 PID 1180 wrote to memory of 2172 1180 njpvbtx.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe"C:\Users\Admin\AppData\Local\Temp\a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\nxndnt.exec:\nxndnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\prbvfl.exec:\prbvfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\nvhln.exec:\nvhln.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\dttnlhr.exec:\dttnlhr.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\lnxjvxn.exec:\lnxjvxn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\jrxfpl.exec:\jrxfpl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\trxxxn.exec:\trxxxn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\nhlrhj.exec:\nhlrhj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\npdlljh.exec:\npdlljh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\tdlbblt.exec:\tdlbblt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\fvvbb.exec:\fvvbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\fljnpn.exec:\fljnpn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\pxjdr.exec:\pxjdr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\vjlnd.exec:\vjlnd.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\njpvbtx.exec:\njpvbtx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\rdlhflx.exec:\rdlhflx.exe17⤵
- Executes dropped EXE
PID:2172 -
\??\c:\tnhxx.exec:\tnhxx.exe18⤵
- Executes dropped EXE
PID:1140 -
\??\c:\pbbvvh.exec:\pbbvvh.exe19⤵
- Executes dropped EXE
PID:984 -
\??\c:\fdxhb.exec:\fdxhb.exe20⤵
- Executes dropped EXE
PID:1324 -
\??\c:\dhhpvph.exec:\dhhpvph.exe21⤵
- Executes dropped EXE
PID:2452 -
\??\c:\brbhlnx.exec:\brbhlnx.exe22⤵
- Executes dropped EXE
PID:2092 -
\??\c:\frjjbr.exec:\frjjbr.exe23⤵
- Executes dropped EXE
PID:1968 -
\??\c:\tnljh.exec:\tnljh.exe24⤵
- Executes dropped EXE
PID:1948 -
\??\c:\hpvblxx.exec:\hpvblxx.exe25⤵
- Executes dropped EXE
PID:700 -
\??\c:\dxvnt.exec:\dxvnt.exe26⤵
- Executes dropped EXE
PID:1712 -
\??\c:\hrjrtvx.exec:\hrjrtvx.exe27⤵
- Executes dropped EXE
PID:1328 -
\??\c:\phfxtld.exec:\phfxtld.exe28⤵
- Executes dropped EXE
PID:1700 -
\??\c:\tpvrnd.exec:\tpvrnd.exe29⤵
- Executes dropped EXE
PID:616 -
\??\c:\jbxrnv.exec:\jbxrnv.exe30⤵
- Executes dropped EXE
PID:776 -
\??\c:\pbnjt.exec:\pbnjt.exe31⤵
- Executes dropped EXE
PID:1220 -
\??\c:\fntpvdl.exec:\fntpvdl.exe32⤵
- Executes dropped EXE
PID:2072 -
\??\c:\xrdnh.exec:\xrdnh.exe33⤵
- Executes dropped EXE
PID:2004 -
\??\c:\frpfvvj.exec:\frpfvvj.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1156 -
\??\c:\lpplv.exec:\lpplv.exe35⤵
- Executes dropped EXE
PID:2384 -
\??\c:\hjbdpj.exec:\hjbdpj.exe36⤵
- Executes dropped EXE
PID:1716 -
\??\c:\hjljtvv.exec:\hjljtvv.exe37⤵
- Executes dropped EXE
PID:2604 -
\??\c:\rdvlrx.exec:\rdvlrx.exe38⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xfttx.exec:\xfttx.exe39⤵
- Executes dropped EXE
PID:2956 -
\??\c:\lbrprjr.exec:\lbrprjr.exe40⤵
- Executes dropped EXE
PID:2884 -
\??\c:\htpxj.exec:\htpxj.exe41⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nhhxhl.exec:\nhhxhl.exe42⤵
- Executes dropped EXE
PID:2224 -
\??\c:\hhbfv.exec:\hhbfv.exe43⤵
- Executes dropped EXE
PID:2780 -
\??\c:\lpprt.exec:\lpprt.exe44⤵
- Executes dropped EXE
PID:2856 -
\??\c:\pfvdjv.exec:\pfvdjv.exe45⤵
- Executes dropped EXE
PID:2740 -
\??\c:\dfjnh.exec:\dfjnh.exe46⤵
- Executes dropped EXE
PID:2408 -
\??\c:\rjlxvj.exec:\rjlxvj.exe47⤵
- Executes dropped EXE
PID:2012 -
\??\c:\vvdvrt.exec:\vvdvrt.exe48⤵
- Executes dropped EXE
PID:1232 -
\??\c:\fldxrp.exec:\fldxrp.exe49⤵
- Executes dropped EXE
PID:3044 -
\??\c:\brxtft.exec:\brxtft.exe50⤵
- Executes dropped EXE
PID:580 -
\??\c:\pxfln.exec:\pxfln.exe51⤵
- Executes dropped EXE
PID:2832 -
\??\c:\rtxbl.exec:\rtxbl.exe52⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rnlhx.exec:\rnlhx.exe53⤵
- Executes dropped EXE
PID:2316 -
\??\c:\pfddtbd.exec:\pfddtbd.exe54⤵
- Executes dropped EXE
PID:2448 -
\??\c:\rtfjn.exec:\rtfjn.exe55⤵
- Executes dropped EXE
PID:1180 -
\??\c:\pxrrt.exec:\pxrrt.exe56⤵
- Executes dropped EXE
PID:1364 -
\??\c:\vjtnfh.exec:\vjtnfh.exe57⤵
- Executes dropped EXE
PID:2044 -
\??\c:\xjnnfh.exec:\xjnnfh.exe58⤵
- Executes dropped EXE
PID:2400 -
\??\c:\bxhfrxb.exec:\bxhfrxb.exe59⤵
- Executes dropped EXE
PID:2296 -
\??\c:\ttrjvjr.exec:\ttrjvjr.exe60⤵
- Executes dropped EXE
PID:2920 -
\??\c:\bbfjjp.exec:\bbfjjp.exe61⤵
- Executes dropped EXE
PID:2692 -
\??\c:\vdvfptp.exec:\vdvfptp.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1784 -
\??\c:\xhvrhl.exec:\xhvrhl.exe63⤵
- Executes dropped EXE
PID:272 -
\??\c:\rvfjf.exec:\rvfjf.exe64⤵
- Executes dropped EXE
PID:612 -
\??\c:\tfpnxf.exec:\tfpnxf.exe65⤵
- Executes dropped EXE
PID:1672 -
\??\c:\plbhp.exec:\plbhp.exe66⤵PID:2544
-
\??\c:\xrxjx.exec:\xrxjx.exe67⤵PID:1880
-
\??\c:\xjttnl.exec:\xjttnl.exe68⤵PID:1556
-
\??\c:\nxxjp.exec:\nxxjp.exe69⤵PID:1240
-
\??\c:\jrrvfr.exec:\jrrvfr.exe70⤵PID:1060
-
\??\c:\ndnddfd.exec:\ndnddfd.exe71⤵PID:832
-
\??\c:\jtfnf.exec:\jtfnf.exe72⤵PID:304
-
\??\c:\thfnx.exec:\thfnx.exe73⤵PID:776
-
\??\c:\rrxtt.exec:\rrxtt.exe74⤵PID:1220
-
\??\c:\xtpbr.exec:\xtpbr.exe75⤵PID:1288
-
\??\c:\jxtrhx.exec:\jxtrhx.exe76⤵PID:2276
-
\??\c:\vfnthbr.exec:\vfnthbr.exe77⤵PID:1492
-
\??\c:\dfhhlh.exec:\dfhhlh.exe78⤵PID:2244
-
\??\c:\bxhjx.exec:\bxhjx.exe79⤵PID:1704
-
\??\c:\xdfth.exec:\xdfth.exe80⤵PID:2824
-
\??\c:\vbnhbx.exec:\vbnhbx.exe81⤵PID:3032
-
\??\c:\xhbbnr.exec:\xhbbnr.exe82⤵PID:2892
-
\??\c:\jxvbfl.exec:\jxvbfl.exe83⤵PID:704
-
\??\c:\hnndx.exec:\hnndx.exe84⤵PID:2904
-
\??\c:\lvdljjb.exec:\lvdljjb.exe85⤵PID:472
-
\??\c:\fjfpnrp.exec:\fjfpnrp.exe86⤵PID:2880
-
\??\c:\hxrpnj.exec:\hxrpnj.exe87⤵PID:2736
-
\??\c:\xphtdd.exec:\xphtdd.exe88⤵PID:2808
-
\??\c:\jhxnhj.exec:\jhxnhj.exe89⤵PID:2820
-
\??\c:\llfxbv.exec:\llfxbv.exe90⤵PID:2720
-
\??\c:\prtpxt.exec:\prtpxt.exe91⤵PID:960
-
\??\c:\brpvj.exec:\brpvj.exe92⤵PID:2812
-
\??\c:\hbhtdpv.exec:\hbhtdpv.exe93⤵PID:2360
-
\??\c:\jbplp.exec:\jbplp.exe94⤵PID:1500
-
\??\c:\rtvhlb.exec:\rtvhlb.exe95⤵PID:2164
-
\??\c:\pxbbh.exec:\pxbbh.exe96⤵PID:2556
-
\??\c:\flnfdp.exec:\flnfdp.exe97⤵PID:2312
-
\??\c:\prpnrn.exec:\prpnrn.exe98⤵PID:1788
-
\??\c:\dhhbrj.exec:\dhhbrj.exe99⤵PID:2288
-
\??\c:\ffjpv.exec:\ffjpv.exe100⤵PID:1320
-
\??\c:\xvplb.exec:\xvplb.exe101⤵PID:2120
-
\??\c:\tnjtt.exec:\tnjtt.exe102⤵PID:1184
-
\??\c:\rjnlx.exec:\rjnlx.exe103⤵PID:2372
-
\??\c:\tbhhr.exec:\tbhhr.exe104⤵PID:2136
-
\??\c:\nxnlrj.exec:\nxnlrj.exe105⤵PID:2176
-
\??\c:\phdlrx.exec:\phdlrx.exe106⤵PID:964
-
\??\c:\pdvrt.exec:\pdvrt.exe107⤵PID:1420
-
\??\c:\lttpxb.exec:\lttpxb.exe108⤵PID:1948
-
\??\c:\tbrfhb.exec:\tbrfhb.exe109⤵PID:1672
-
\??\c:\bhbdt.exec:\bhbdt.exe110⤵
- System Location Discovery: System Language Discovery
PID:1340 -
\??\c:\xfplbxl.exec:\xfplbxl.exe111⤵PID:1880
-
\??\c:\dxhjfjx.exec:\dxhjfjx.exe112⤵PID:2612
-
\??\c:\pfdvtp.exec:\pfdvtp.exe113⤵PID:916
-
\??\c:\xljnjj.exec:\xljnjj.exe114⤵PID:1684
-
\??\c:\hvfpjv.exec:\hvfpjv.exe115⤵PID:2432
-
\??\c:\nvtlbx.exec:\nvtlbx.exe116⤵PID:1724
-
\??\c:\hrvxv.exec:\hrvxv.exe117⤵PID:932
-
\??\c:\jbrdbht.exec:\jbrdbht.exe118⤵PID:2324
-
\??\c:\ftttf.exec:\ftttf.exe119⤵PID:2292
-
\??\c:\dbnxj.exec:\dbnxj.exe120⤵PID:2072
-
\??\c:\htxtv.exec:\htxtv.exe121⤵PID:2828
-
\??\c:\nbrvhrb.exec:\nbrvhrb.exe122⤵PID:1720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-