Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 04:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe
-
Size
454KB
-
MD5
92f17e71b40b4d85ea4357514506b3d8
-
SHA1
699da613e097a661464b5c7dbc097537baae99f9
-
SHA256
c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b
-
SHA512
0060cc946c8b2e9c230a1b7913a5fc56598af747160ef6f38ee9ce11ef8e779f6b14b54e04bb999981d7fa29302b14e82809176b3c4f804dfb4dc70e8ea7ed4e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeI:q7Tc2NYHUrAwfMp3CDI
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2884-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-43-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2868-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/520-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/748-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-196-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2576-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-214-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2620-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-298-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1468-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1440-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-539-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2244-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-821-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2100-846-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-892-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1988 rtfrl.exe 2896 bdtlr.exe 1984 pxxvdh.exe 2868 jjhjbfd.exe 2788 rrbbl.exe 1644 xdppbrh.exe 2588 fhdpx.exe 2116 tvtfjv.exe 1800 jvlhld.exe 2164 bhpvjp.exe 2132 bbfrxjj.exe 2356 nndlp.exe 1940 bfvrtpr.exe 2860 rxnxdj.exe 2584 pvxbtnj.exe 2220 jpnhvtl.exe 520 fphftv.exe 1512 jpxvbnh.exe 748 rjbxf.exe 2576 pjhlvn.exe 1784 vnjxfr.exe 1848 prvtb.exe 1680 brrjhvx.exe 2620 tjbpthb.exe 1776 rhxdv.exe 1740 jrfdj.exe 1596 jdvlh.exe 800 tvrnrdx.exe 2364 rrnrnv.exe 584 hlxnt.exe 1040 rjrfn.exe 1468 nxfvlhn.exe 1280 jrrtlr.exe 2088 nvlvnbj.exe 2852 xrxbd.exe 2900 tnrxf.exe 2500 vldrr.exe 2172 lpjfrl.exe 2724 bpbplbb.exe 2788 vntpjhr.exe 2208 nrfbbjr.exe 1324 rxhtb.exe 1524 bvfdvfh.exe 2116 jvtjbx.exe 1844 hhvfphl.exe 600 vtbbtvb.exe 1304 hflvjt.exe 2288 flnjh.exe 2228 xlnlp.exe 2972 pjvhtfb.exe 1940 tjpbht.exe 1544 xvvfv.exe 1392 hhltl.exe 3032 frjjb.exe 944 dpjjjl.exe 2372 fbtdx.exe 1512 jnvjhb.exe 1440 bhdxx.exe 1436 vdtxt.exe 1624 bdrnj.exe 1096 pfftx.exe 856 hjxdd.exe 1088 ldnfhv.exe 1772 rtbjx.exe -
resource yara_rule behavioral1/memory/2884-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/520-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/748-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-846-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-892-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfhbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhxdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hflvjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnvfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtrdhbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdvlnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhvlhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjnnhfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpbvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhjjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvldh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbnnll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllbjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtfhdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjdtdvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpjvdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btxjrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhdrptn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpfjprv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtdjdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxddjdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldhdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxnxdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxfhltx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjfrpdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnpvdxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtntfht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rttxjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffjhdln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbxjrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldxbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvntr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbfphl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhpnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tffpjbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnjhblx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrjnbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2884 wrote to memory of 1988 2884 c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe 30 PID 2884 wrote to memory of 1988 2884 c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe 30 PID 2884 wrote to memory of 1988 2884 c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe 30 PID 2884 wrote to memory of 1988 2884 c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe 30 PID 1988 wrote to memory of 2896 1988 rtfrl.exe 31 PID 1988 wrote to memory of 2896 1988 rtfrl.exe 31 PID 1988 wrote to memory of 2896 1988 rtfrl.exe 31 PID 1988 wrote to memory of 2896 1988 rtfrl.exe 31 PID 2896 wrote to memory of 1984 2896 bdtlr.exe 32 PID 2896 wrote to memory of 1984 2896 bdtlr.exe 32 PID 2896 wrote to memory of 1984 2896 bdtlr.exe 32 PID 2896 wrote to memory of 1984 2896 bdtlr.exe 32 PID 1984 wrote to memory of 2868 1984 pxxvdh.exe 33 PID 1984 wrote to memory of 2868 1984 pxxvdh.exe 33 PID 1984 wrote to memory of 2868 1984 pxxvdh.exe 33 PID 1984 wrote to memory of 2868 1984 pxxvdh.exe 33 PID 2868 wrote to memory of 2788 2868 jjhjbfd.exe 34 PID 2868 wrote to memory of 2788 2868 jjhjbfd.exe 34 PID 2868 wrote to memory of 2788 2868 jjhjbfd.exe 34 PID 2868 wrote to memory of 2788 2868 jjhjbfd.exe 34 PID 2788 wrote to memory of 1644 2788 rrbbl.exe 35 PID 2788 wrote to memory of 1644 2788 rrbbl.exe 35 PID 2788 wrote to memory of 1644 2788 rrbbl.exe 35 PID 2788 wrote to memory of 1644 2788 rrbbl.exe 35 PID 1644 wrote to memory of 2588 1644 xdppbrh.exe 36 PID 1644 wrote to memory of 2588 1644 xdppbrh.exe 36 PID 1644 wrote to memory of 2588 1644 xdppbrh.exe 36 PID 1644 wrote to memory of 2588 1644 xdppbrh.exe 36 PID 2588 wrote to memory of 2116 2588 fhdpx.exe 37 PID 2588 wrote to memory of 2116 2588 fhdpx.exe 37 PID 2588 wrote to memory of 2116 2588 fhdpx.exe 37 PID 2588 wrote to memory of 2116 2588 fhdpx.exe 37 PID 2116 wrote to memory of 1800 2116 tvtfjv.exe 38 PID 2116 wrote to memory of 1800 2116 tvtfjv.exe 38 PID 2116 wrote to memory of 1800 2116 tvtfjv.exe 38 PID 2116 wrote to memory of 1800 2116 tvtfjv.exe 38 PID 1800 wrote to memory of 2164 1800 jvlhld.exe 39 PID 1800 wrote to memory of 2164 1800 jvlhld.exe 39 PID 1800 wrote to memory of 2164 1800 jvlhld.exe 39 PID 1800 wrote to memory of 2164 1800 jvlhld.exe 39 PID 2164 wrote to memory of 2132 2164 bhpvjp.exe 40 PID 2164 wrote to memory of 2132 2164 bhpvjp.exe 40 PID 2164 wrote to memory of 2132 2164 bhpvjp.exe 40 PID 2164 wrote to memory of 2132 2164 bhpvjp.exe 40 PID 2132 wrote to memory of 2356 2132 bbfrxjj.exe 41 PID 2132 wrote to memory of 2356 2132 bbfrxjj.exe 41 PID 2132 wrote to memory of 2356 2132 bbfrxjj.exe 41 PID 2132 wrote to memory of 2356 2132 bbfrxjj.exe 41 PID 2356 wrote to memory of 1940 2356 nndlp.exe 42 PID 2356 wrote to memory of 1940 2356 nndlp.exe 42 PID 2356 wrote to memory of 1940 2356 nndlp.exe 42 PID 2356 wrote to memory of 1940 2356 nndlp.exe 42 PID 1940 wrote to memory of 2860 1940 bfvrtpr.exe 43 PID 1940 wrote to memory of 2860 1940 bfvrtpr.exe 43 PID 1940 wrote to memory of 2860 1940 bfvrtpr.exe 43 PID 1940 wrote to memory of 2860 1940 bfvrtpr.exe 43 PID 2860 wrote to memory of 2584 2860 rxnxdj.exe 44 PID 2860 wrote to memory of 2584 2860 rxnxdj.exe 44 PID 2860 wrote to memory of 2584 2860 rxnxdj.exe 44 PID 2860 wrote to memory of 2584 2860 rxnxdj.exe 44 PID 2584 wrote to memory of 2220 2584 pvxbtnj.exe 45 PID 2584 wrote to memory of 2220 2584 pvxbtnj.exe 45 PID 2584 wrote to memory of 2220 2584 pvxbtnj.exe 45 PID 2584 wrote to memory of 2220 2584 pvxbtnj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe"C:\Users\Admin\AppData\Local\Temp\c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\rtfrl.exec:\rtfrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\bdtlr.exec:\bdtlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\pxxvdh.exec:\pxxvdh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\jjhjbfd.exec:\jjhjbfd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\rrbbl.exec:\rrbbl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\xdppbrh.exec:\xdppbrh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\fhdpx.exec:\fhdpx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\tvtfjv.exec:\tvtfjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\jvlhld.exec:\jvlhld.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\bhpvjp.exec:\bhpvjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\bbfrxjj.exec:\bbfrxjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\nndlp.exec:\nndlp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\bfvrtpr.exec:\bfvrtpr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\rxnxdj.exec:\rxnxdj.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\pvxbtnj.exec:\pvxbtnj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\jpnhvtl.exec:\jpnhvtl.exe17⤵
- Executes dropped EXE
PID:2220 -
\??\c:\fphftv.exec:\fphftv.exe18⤵
- Executes dropped EXE
PID:520 -
\??\c:\jpxvbnh.exec:\jpxvbnh.exe19⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rjbxf.exec:\rjbxf.exe20⤵
- Executes dropped EXE
PID:748 -
\??\c:\pjhlvn.exec:\pjhlvn.exe21⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vnjxfr.exec:\vnjxfr.exe22⤵
- Executes dropped EXE
PID:1784 -
\??\c:\prvtb.exec:\prvtb.exe23⤵
- Executes dropped EXE
PID:1848 -
\??\c:\brrjhvx.exec:\brrjhvx.exe24⤵
- Executes dropped EXE
PID:1680 -
\??\c:\tjbpthb.exec:\tjbpthb.exe25⤵
- Executes dropped EXE
PID:2620 -
\??\c:\rhxdv.exec:\rhxdv.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1776 -
\??\c:\jrfdj.exec:\jrfdj.exe27⤵
- Executes dropped EXE
PID:1740 -
\??\c:\jdvlh.exec:\jdvlh.exe28⤵
- Executes dropped EXE
PID:1596 -
\??\c:\tvrnrdx.exec:\tvrnrdx.exe29⤵
- Executes dropped EXE
PID:800 -
\??\c:\rrnrnv.exec:\rrnrnv.exe30⤵
- Executes dropped EXE
PID:2364 -
\??\c:\hlxnt.exec:\hlxnt.exe31⤵
- Executes dropped EXE
PID:584 -
\??\c:\rjrfn.exec:\rjrfn.exe32⤵
- Executes dropped EXE
PID:1040 -
\??\c:\nxfvlhn.exec:\nxfvlhn.exe33⤵
- Executes dropped EXE
PID:1468 -
\??\c:\jrrtlr.exec:\jrrtlr.exe34⤵
- Executes dropped EXE
PID:1280 -
\??\c:\nvlvnbj.exec:\nvlvnbj.exe35⤵
- Executes dropped EXE
PID:2088 -
\??\c:\xrxbd.exec:\xrxbd.exe36⤵
- Executes dropped EXE
PID:2852 -
\??\c:\tnrxf.exec:\tnrxf.exe37⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vldrr.exec:\vldrr.exe38⤵
- Executes dropped EXE
PID:2500 -
\??\c:\lpjfrl.exec:\lpjfrl.exe39⤵
- Executes dropped EXE
PID:2172 -
\??\c:\bpbplbb.exec:\bpbplbb.exe40⤵
- Executes dropped EXE
PID:2724 -
\??\c:\vntpjhr.exec:\vntpjhr.exe41⤵
- Executes dropped EXE
PID:2788 -
\??\c:\nrfbbjr.exec:\nrfbbjr.exe42⤵
- Executes dropped EXE
PID:2208 -
\??\c:\rxhtb.exec:\rxhtb.exe43⤵
- Executes dropped EXE
PID:1324 -
\??\c:\bvfdvfh.exec:\bvfdvfh.exe44⤵
- Executes dropped EXE
PID:1524 -
\??\c:\jvtjbx.exec:\jvtjbx.exe45⤵
- Executes dropped EXE
PID:2116 -
\??\c:\hhvfphl.exec:\hhvfphl.exe46⤵
- Executes dropped EXE
PID:1844 -
\??\c:\vtbbtvb.exec:\vtbbtvb.exe47⤵
- Executes dropped EXE
PID:600 -
\??\c:\hflvjt.exec:\hflvjt.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1304 -
\??\c:\flnjh.exec:\flnjh.exe49⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xlnlp.exec:\xlnlp.exe50⤵
- Executes dropped EXE
PID:2228 -
\??\c:\pjvhtfb.exec:\pjvhtfb.exe51⤵
- Executes dropped EXE
PID:2972 -
\??\c:\tjpbht.exec:\tjpbht.exe52⤵
- Executes dropped EXE
PID:1940 -
\??\c:\xvvfv.exec:\xvvfv.exe53⤵
- Executes dropped EXE
PID:1544 -
\??\c:\hhltl.exec:\hhltl.exe54⤵
- Executes dropped EXE
PID:1392 -
\??\c:\frjjb.exec:\frjjb.exe55⤵
- Executes dropped EXE
PID:3032 -
\??\c:\dpjjjl.exec:\dpjjjl.exe56⤵
- Executes dropped EXE
PID:944 -
\??\c:\fbtdx.exec:\fbtdx.exe57⤵
- Executes dropped EXE
PID:2372 -
\??\c:\jnvjhb.exec:\jnvjhb.exe58⤵
- Executes dropped EXE
PID:1512 -
\??\c:\bhdxx.exec:\bhdxx.exe59⤵
- Executes dropped EXE
PID:1440 -
\??\c:\vdtxt.exec:\vdtxt.exe60⤵
- Executes dropped EXE
PID:1436 -
\??\c:\bdrnj.exec:\bdrnj.exe61⤵
- Executes dropped EXE
PID:1624 -
\??\c:\pfftx.exec:\pfftx.exe62⤵
- Executes dropped EXE
PID:1096 -
\??\c:\hjxdd.exec:\hjxdd.exe63⤵
- Executes dropped EXE
PID:856 -
\??\c:\ldnfhv.exec:\ldnfhv.exe64⤵
- Executes dropped EXE
PID:1088 -
\??\c:\rtbjx.exec:\rtbjx.exe65⤵
- Executes dropped EXE
PID:1772 -
\??\c:\xjrfxj.exec:\xjrfxj.exe66⤵PID:1156
-
\??\c:\hhfxbfl.exec:\hhfxbfl.exe67⤵PID:1860
-
\??\c:\thpjhv.exec:\thpjhv.exe68⤵PID:2036
-
\??\c:\rrxhhfr.exec:\rrxhhfr.exe69⤵PID:2244
-
\??\c:\lvdxdv.exec:\lvdxdv.exe70⤵PID:1260
-
\??\c:\prhrph.exec:\prhrph.exe71⤵PID:2100
-
\??\c:\dxltxf.exec:\dxltxf.exe72⤵PID:1764
-
\??\c:\rtrhdht.exec:\rtrhdht.exe73⤵PID:2540
-
\??\c:\dvnbfp.exec:\dvnbfp.exe74⤵PID:1564
-
\??\c:\llrrnnp.exec:\llrrnnp.exe75⤵PID:2748
-
\??\c:\tblhn.exec:\tblhn.exe76⤵PID:1712
-
\??\c:\rlrjdxr.exec:\rlrjdxr.exe77⤵PID:2824
-
\??\c:\tvrxhvj.exec:\tvrxhvj.exe78⤵PID:2792
-
\??\c:\ffxhfp.exec:\ffxhfp.exe79⤵PID:2784
-
\??\c:\hjfrplv.exec:\hjfrplv.exe80⤵PID:2852
-
\??\c:\lxjbdj.exec:\lxjbdj.exe81⤵PID:2900
-
\??\c:\dpjrnx.exec:\dpjrnx.exe82⤵PID:2684
-
\??\c:\dvlhl.exec:\dvlhl.exe83⤵PID:580
-
\??\c:\pxbrplf.exec:\pxbrplf.exe84⤵PID:876
-
\??\c:\lnvfb.exec:\lnvfb.exe85⤵
- System Location Discovery: System Language Discovery
PID:2408 -
\??\c:\xhxtrf.exec:\xhxtrf.exe86⤵PID:2024
-
\??\c:\pdfjfvh.exec:\pdfjfvh.exe87⤵PID:1132
-
\??\c:\rrxrp.exec:\rrxrp.exe88⤵PID:952
-
\??\c:\vhxdt.exec:\vhxdt.exe89⤵PID:2528
-
\??\c:\prfpvtp.exec:\prfpvtp.exe90⤵PID:2480
-
\??\c:\lflnnlp.exec:\lflnnlp.exe91⤵PID:2572
-
\??\c:\dbppnb.exec:\dbppnb.exe92⤵PID:2488
-
\??\c:\vddtp.exec:\vddtp.exe93⤵PID:2704
-
\??\c:\ftrpfj.exec:\ftrpfj.exe94⤵PID:2324
-
\??\c:\vfrrjx.exec:\vfrrjx.exe95⤵PID:2996
-
\??\c:\xvdjlf.exec:\xvdjlf.exe96⤵PID:2296
-
\??\c:\bxbvjb.exec:\bxbvjb.exe97⤵PID:1544
-
\??\c:\vlvjftd.exec:\vlvjftd.exe98⤵PID:1392
-
\??\c:\jxhrnpl.exec:\jxhrnpl.exe99⤵PID:3032
-
\??\c:\hnltt.exec:\hnltt.exe100⤵PID:2416
-
\??\c:\vjdvt.exec:\vjdvt.exe101⤵PID:2548
-
\??\c:\rjrprf.exec:\rjrprf.exe102⤵PID:748
-
\??\c:\fpjpt.exec:\fpjpt.exe103⤵PID:1408
-
\??\c:\hldvn.exec:\hldvn.exe104⤵PID:980
-
\??\c:\fbrjl.exec:\fbrjl.exe105⤵PID:2628
-
\??\c:\rxjpvv.exec:\rxjpvv.exe106⤵PID:956
-
\??\c:\nnhxb.exec:\nnhxb.exe107⤵PID:3012
-
\??\c:\xjlrxd.exec:\xjlrxd.exe108⤵PID:1568
-
\??\c:\lvndbr.exec:\lvndbr.exe109⤵PID:1352
-
\??\c:\ltxtl.exec:\ltxtl.exe110⤵PID:1820
-
\??\c:\vjvnxdn.exec:\vjvnxdn.exe111⤵PID:2332
-
\??\c:\vpjvnl.exec:\vpjvnl.exe112⤵PID:1740
-
\??\c:\htltt.exec:\htltt.exe113⤵PID:1812
-
\??\c:\hllrp.exec:\hllrp.exe114⤵PID:1704
-
\??\c:\hbbnvn.exec:\hbbnvn.exe115⤵PID:2272
-
\??\c:\jrpvtr.exec:\jrpvtr.exe116⤵PID:2100
-
\??\c:\bdthxjb.exec:\bdthxjb.exe117⤵PID:2364
-
\??\c:\pbfxpfh.exec:\pbfxpfh.exe118⤵PID:2540
-
\??\c:\rllnv.exec:\rllnv.exe119⤵PID:1828
-
\??\c:\dtvptft.exec:\dtvptft.exe120⤵PID:2892
-
\??\c:\tvndjn.exec:\tvndjn.exe121⤵PID:1576
-
\??\c:\hdrndj.exec:\hdrndj.exe122⤵PID:1988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-