Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 04:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8dda96d9d077081b72322a1bebd1d1fc1fd9cb46906d0839300ddb519e4cc5f1.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
8dda96d9d077081b72322a1bebd1d1fc1fd9cb46906d0839300ddb519e4cc5f1.exe
-
Size
456KB
-
MD5
9fa14e964c3b6a4992d5f4b80a178191
-
SHA1
aa93eac8e562c1e57182c69997f426b21f0e7f6a
-
SHA256
8dda96d9d077081b72322a1bebd1d1fc1fd9cb46906d0839300ddb519e4cc5f1
-
SHA512
6a6cea25820611121e83632fc43dc95db6b422feffc1ed2a92418aa0a9fc8c0f1c80d8da398445668f2982f842bc3b531ed021607bf7a5214464e20f15a20ded
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRn:q7Tc2NYHUrAwfMp3CDRn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2880-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-26-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2796-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-194-0x0000000000280000-0x00000000002AA000-memory.dmp family_blackmoon behavioral1/memory/1732-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1396-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-343-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2632-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-359-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1624-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/368-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-470-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2208-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-502-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1684-566-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2940-614-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2196-656-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-683-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2200-761-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-782-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2896 trtprf.exe 3020 dbnxjn.exe 2796 jjrpdh.exe 2948 tpxvd.exe 2636 tbttv.exe 2340 bxpnbrr.exe 2616 fbrpjp.exe 2732 xppjtxh.exe 2508 xrjbldj.exe 2268 rpxjt.exe 2964 rfbbbb.exe 1664 nxpjvf.exe 2972 nvbtxh.exe 2224 nxfbhvv.exe 1744 tpbtpt.exe 1092 hjtfh.exe 2188 nxnhnpb.exe 1124 nrjhl.exe 2200 lnvxrnj.exe 2120 dhhdb.exe 1504 xfbrr.exe 1628 tppbfxx.exe 1732 hjpfbff.exe 1992 vtdbbl.exe 1728 bttlr.exe 2084 pvjjvf.exe 2052 rlnxtfv.exe 812 nvnfxl.exe 1284 fvdrt.exe 2420 hlfnj.exe 1396 vvjrlj.exe 1716 xvvvj.exe 2284 ppbpn.exe 1576 nrrbh.exe 2740 fxrbxln.exe 2844 pxnbx.exe 2956 bfnphr.exe 2800 tjxrxl.exe 2632 vrvtft.exe 2636 nfhdr.exe 2340 hfdfhl.exe 2748 ndhhl.exe 1624 jnjfv.exe 2596 xhrdvrn.exe 3040 hlddh.exe 1400 tpttv.exe 2920 hxhxhth.exe 2936 thfxdhl.exe 1448 jhhtx.exe 1736 ftxbbrn.exe 2980 xxdbrt.exe 1148 ljbbb.exe 1748 rpjhtnp.exe 568 dlfpd.exe 2248 lrjxxx.exe 368 fvbbxd.exe 2172 rlnljp.exe 3012 pbflf.exe 632 bdnxdn.exe 2208 rbbfxdl.exe 900 htjnjvd.exe 784 ldrhp.exe 936 ppfnj.exe 1516 xrhdjbl.exe -
resource yara_rule behavioral1/memory/2880-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/368-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-614-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2196-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-769-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-789-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhdvrnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtnbrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbpvhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfllnxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnpvlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtdlvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfjtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxvxpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhvlbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxbpdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dllbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njlhnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhbtjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rplxvtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvptv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfvxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjbfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frnpthd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxbhpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdvlxxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvfbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvfjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlxpfnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbdvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnfppn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drphjhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dndrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnvxrnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxhxhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hprtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpvtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxdvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlpbpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljxjrnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnlbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbxjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prrrb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2880 wrote to memory of 2896 2880 8dda96d9d077081b72322a1bebd1d1fc1fd9cb46906d0839300ddb519e4cc5f1.exe 30 PID 2880 wrote to memory of 2896 2880 8dda96d9d077081b72322a1bebd1d1fc1fd9cb46906d0839300ddb519e4cc5f1.exe 30 PID 2880 wrote to memory of 2896 2880 8dda96d9d077081b72322a1bebd1d1fc1fd9cb46906d0839300ddb519e4cc5f1.exe 30 PID 2880 wrote to memory of 2896 2880 8dda96d9d077081b72322a1bebd1d1fc1fd9cb46906d0839300ddb519e4cc5f1.exe 30 PID 2896 wrote to memory of 3020 2896 trtprf.exe 31 PID 2896 wrote to memory of 3020 2896 trtprf.exe 31 PID 2896 wrote to memory of 3020 2896 trtprf.exe 31 PID 2896 wrote to memory of 3020 2896 trtprf.exe 31 PID 3020 wrote to memory of 2796 3020 dbnxjn.exe 32 PID 3020 wrote to memory of 2796 3020 dbnxjn.exe 32 PID 3020 wrote to memory of 2796 3020 dbnxjn.exe 32 PID 3020 wrote to memory of 2796 3020 dbnxjn.exe 32 PID 2796 wrote to memory of 2948 2796 jjrpdh.exe 33 PID 2796 wrote to memory of 2948 2796 jjrpdh.exe 33 PID 2796 wrote to memory of 2948 2796 jjrpdh.exe 33 PID 2796 wrote to memory of 2948 2796 jjrpdh.exe 33 PID 2948 wrote to memory of 2636 2948 tpxvd.exe 34 PID 2948 wrote to memory of 2636 2948 tpxvd.exe 34 PID 2948 wrote to memory of 2636 2948 tpxvd.exe 34 PID 2948 wrote to memory of 2636 2948 tpxvd.exe 34 PID 2636 wrote to memory of 2340 2636 tbttv.exe 35 PID 2636 wrote to memory of 2340 2636 tbttv.exe 35 PID 2636 wrote to memory of 2340 2636 tbttv.exe 35 PID 2636 wrote to memory of 2340 2636 tbttv.exe 35 PID 2340 wrote to memory of 2616 2340 bxpnbrr.exe 36 PID 2340 wrote to memory of 2616 2340 bxpnbrr.exe 36 PID 2340 wrote to memory of 2616 2340 bxpnbrr.exe 36 PID 2340 wrote to memory of 2616 2340 bxpnbrr.exe 36 PID 2616 wrote to memory of 2732 2616 fbrpjp.exe 37 PID 2616 wrote to memory of 2732 2616 fbrpjp.exe 37 PID 2616 wrote to memory of 2732 2616 fbrpjp.exe 37 PID 2616 wrote to memory of 2732 2616 fbrpjp.exe 37 PID 2732 wrote to memory of 2508 2732 xppjtxh.exe 38 PID 2732 wrote to memory of 2508 2732 xppjtxh.exe 38 PID 2732 wrote to memory of 2508 2732 xppjtxh.exe 38 PID 2732 wrote to memory of 2508 2732 xppjtxh.exe 38 PID 2508 wrote to memory of 2268 2508 xrjbldj.exe 39 PID 2508 wrote to memory of 2268 2508 xrjbldj.exe 39 PID 2508 wrote to memory of 2268 2508 xrjbldj.exe 39 PID 2508 wrote to memory of 2268 2508 xrjbldj.exe 39 PID 2268 wrote to memory of 2964 2268 rpxjt.exe 40 PID 2268 wrote to memory of 2964 2268 rpxjt.exe 40 PID 2268 wrote to memory of 2964 2268 rpxjt.exe 40 PID 2268 wrote to memory of 2964 2268 rpxjt.exe 40 PID 2964 wrote to memory of 1664 2964 rfbbbb.exe 41 PID 2964 wrote to memory of 1664 2964 rfbbbb.exe 41 PID 2964 wrote to memory of 1664 2964 rfbbbb.exe 41 PID 2964 wrote to memory of 1664 2964 rfbbbb.exe 41 PID 1664 wrote to memory of 2972 1664 nxpjvf.exe 42 PID 1664 wrote to memory of 2972 1664 nxpjvf.exe 42 PID 1664 wrote to memory of 2972 1664 nxpjvf.exe 42 PID 1664 wrote to memory of 2972 1664 nxpjvf.exe 42 PID 2972 wrote to memory of 2224 2972 nvbtxh.exe 43 PID 2972 wrote to memory of 2224 2972 nvbtxh.exe 43 PID 2972 wrote to memory of 2224 2972 nvbtxh.exe 43 PID 2972 wrote to memory of 2224 2972 nvbtxh.exe 43 PID 2224 wrote to memory of 1744 2224 nxfbhvv.exe 44 PID 2224 wrote to memory of 1744 2224 nxfbhvv.exe 44 PID 2224 wrote to memory of 1744 2224 nxfbhvv.exe 44 PID 2224 wrote to memory of 1744 2224 nxfbhvv.exe 44 PID 1744 wrote to memory of 1092 1744 tpbtpt.exe 45 PID 1744 wrote to memory of 1092 1744 tpbtpt.exe 45 PID 1744 wrote to memory of 1092 1744 tpbtpt.exe 45 PID 1744 wrote to memory of 1092 1744 tpbtpt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8dda96d9d077081b72322a1bebd1d1fc1fd9cb46906d0839300ddb519e4cc5f1.exe"C:\Users\Admin\AppData\Local\Temp\8dda96d9d077081b72322a1bebd1d1fc1fd9cb46906d0839300ddb519e4cc5f1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\trtprf.exec:\trtprf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\dbnxjn.exec:\dbnxjn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\jjrpdh.exec:\jjrpdh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\tpxvd.exec:\tpxvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\tbttv.exec:\tbttv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\bxpnbrr.exec:\bxpnbrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\fbrpjp.exec:\fbrpjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\xppjtxh.exec:\xppjtxh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\xrjbldj.exec:\xrjbldj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\rpxjt.exec:\rpxjt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\rfbbbb.exec:\rfbbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\nxpjvf.exec:\nxpjvf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\nvbtxh.exec:\nvbtxh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\nxfbhvv.exec:\nxfbhvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\tpbtpt.exec:\tpbtpt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\hjtfh.exec:\hjtfh.exe17⤵
- Executes dropped EXE
PID:1092 -
\??\c:\nxnhnpb.exec:\nxnhnpb.exe18⤵
- Executes dropped EXE
PID:2188 -
\??\c:\nrjhl.exec:\nrjhl.exe19⤵
- Executes dropped EXE
PID:1124 -
\??\c:\lnvxrnj.exec:\lnvxrnj.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2200 -
\??\c:\dhhdb.exec:\dhhdb.exe21⤵
- Executes dropped EXE
PID:2120 -
\??\c:\xfbrr.exec:\xfbrr.exe22⤵
- Executes dropped EXE
PID:1504 -
\??\c:\tppbfxx.exec:\tppbfxx.exe23⤵
- Executes dropped EXE
PID:1628 -
\??\c:\hjpfbff.exec:\hjpfbff.exe24⤵
- Executes dropped EXE
PID:1732 -
\??\c:\vtdbbl.exec:\vtdbbl.exe25⤵
- Executes dropped EXE
PID:1992 -
\??\c:\bttlr.exec:\bttlr.exe26⤵
- Executes dropped EXE
PID:1728 -
\??\c:\pvjjvf.exec:\pvjjvf.exe27⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rlnxtfv.exec:\rlnxtfv.exe28⤵
- Executes dropped EXE
PID:2052 -
\??\c:\nvnfxl.exec:\nvnfxl.exe29⤵
- Executes dropped EXE
PID:812 -
\??\c:\fvdrt.exec:\fvdrt.exe30⤵
- Executes dropped EXE
PID:1284 -
\??\c:\hlfnj.exec:\hlfnj.exe31⤵
- Executes dropped EXE
PID:2420 -
\??\c:\vvjrlj.exec:\vvjrlj.exe32⤵
- Executes dropped EXE
PID:1396 -
\??\c:\xvvvj.exec:\xvvvj.exe33⤵
- Executes dropped EXE
PID:1716 -
\??\c:\ppbpn.exec:\ppbpn.exe34⤵
- Executes dropped EXE
PID:2284 -
\??\c:\nrrbh.exec:\nrrbh.exe35⤵
- Executes dropped EXE
PID:1576 -
\??\c:\fxrbxln.exec:\fxrbxln.exe36⤵
- Executes dropped EXE
PID:2740 -
\??\c:\pxnbx.exec:\pxnbx.exe37⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bfnphr.exec:\bfnphr.exe38⤵
- Executes dropped EXE
PID:2956 -
\??\c:\tjxrxl.exec:\tjxrxl.exe39⤵
- Executes dropped EXE
PID:2800 -
\??\c:\vrvtft.exec:\vrvtft.exe40⤵
- Executes dropped EXE
PID:2632 -
\??\c:\nfhdr.exec:\nfhdr.exe41⤵
- Executes dropped EXE
PID:2636 -
\??\c:\hfdfhl.exec:\hfdfhl.exe42⤵
- Executes dropped EXE
PID:2340 -
\??\c:\ndhhl.exec:\ndhhl.exe43⤵
- Executes dropped EXE
PID:2748 -
\??\c:\jnjfv.exec:\jnjfv.exe44⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xhrdvrn.exec:\xhrdvrn.exe45⤵
- Executes dropped EXE
PID:2596 -
\??\c:\hlddh.exec:\hlddh.exe46⤵
- Executes dropped EXE
PID:3040 -
\??\c:\tpttv.exec:\tpttv.exe47⤵
- Executes dropped EXE
PID:1400 -
\??\c:\hxhxhth.exec:\hxhxhth.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2920 -
\??\c:\thfxdhl.exec:\thfxdhl.exe49⤵
- Executes dropped EXE
PID:2936 -
\??\c:\jhhtx.exec:\jhhtx.exe50⤵
- Executes dropped EXE
PID:1448 -
\??\c:\ftxbbrn.exec:\ftxbbrn.exe51⤵
- Executes dropped EXE
PID:1736 -
\??\c:\xxdbrt.exec:\xxdbrt.exe52⤵
- Executes dropped EXE
PID:2980 -
\??\c:\ljbbb.exec:\ljbbb.exe53⤵
- Executes dropped EXE
PID:1148 -
\??\c:\rpjhtnp.exec:\rpjhtnp.exe54⤵
- Executes dropped EXE
PID:1748 -
\??\c:\dlfpd.exec:\dlfpd.exe55⤵
- Executes dropped EXE
PID:568 -
\??\c:\lrjxxx.exec:\lrjxxx.exe56⤵
- Executes dropped EXE
PID:2248 -
\??\c:\fvbbxd.exec:\fvbbxd.exe57⤵
- Executes dropped EXE
PID:368 -
\??\c:\rlnljp.exec:\rlnljp.exe58⤵
- Executes dropped EXE
PID:2172 -
\??\c:\pbflf.exec:\pbflf.exe59⤵
- Executes dropped EXE
PID:3012 -
\??\c:\bdnxdn.exec:\bdnxdn.exe60⤵
- Executes dropped EXE
PID:632 -
\??\c:\rbbfxdl.exec:\rbbfxdl.exe61⤵
- Executes dropped EXE
PID:2208 -
\??\c:\htjnjvd.exec:\htjnjvd.exe62⤵
- Executes dropped EXE
PID:900 -
\??\c:\ldrhp.exec:\ldrhp.exe63⤵
- Executes dropped EXE
PID:784 -
\??\c:\ppfnj.exec:\ppfnj.exe64⤵
- Executes dropped EXE
PID:936 -
\??\c:\xrhdjbl.exec:\xrhdjbl.exe65⤵
- Executes dropped EXE
PID:1516 -
\??\c:\tljxxlx.exec:\tljxxlx.exe66⤵PID:1476
-
\??\c:\dbxbb.exec:\dbxbb.exe67⤵PID:1760
-
\??\c:\lprjrf.exec:\lprjrf.exe68⤵PID:1940
-
\??\c:\fxvnhx.exec:\fxvnhx.exe69⤵PID:288
-
\??\c:\njllhv.exec:\njllhv.exe70⤵PID:1900
-
\??\c:\vtpxf.exec:\vtpxf.exe71⤵PID:1684
-
\??\c:\lrdjpbn.exec:\lrdjpbn.exe72⤵PID:1948
-
\??\c:\rfxnp.exec:\rfxnp.exe73⤵PID:1712
-
\??\c:\tpprtt.exec:\tpprtt.exe74⤵PID:2884
-
\??\c:\rbtrvn.exec:\rbtrvn.exe75⤵PID:2028
-
\??\c:\bthhlh.exec:\bthhlh.exe76⤵PID:1580
-
\??\c:\hhbdpbl.exec:\hhbdpbl.exe77⤵PID:2832
-
\??\c:\vrjrndh.exec:\vrjrndh.exe78⤵PID:2768
-
\??\c:\xhjftb.exec:\xhjftb.exe79⤵PID:2940
-
\??\c:\xfpjl.exec:\xfpjl.exe80⤵PID:2796
-
\??\c:\fpjtb.exec:\fpjtb.exe81⤵PID:2952
-
\??\c:\rnpxr.exec:\rnpxr.exe82⤵PID:2652
-
\??\c:\hjhrxd.exec:\hjhrxd.exe83⤵PID:2112
-
\??\c:\xvrnj.exec:\xvrnj.exe84⤵PID:2548
-
\??\c:\jvnntj.exec:\jvnntj.exe85⤵PID:2196
-
\??\c:\phlrn.exec:\phlrn.exe86⤵PID:2848
-
\??\c:\nfdtflv.exec:\nfdtflv.exe87⤵PID:3044
-
\??\c:\ldvrjxl.exec:\ldvrjxl.exe88⤵PID:1068
-
\??\c:\hjltxl.exec:\hjltxl.exe89⤵PID:3040
-
\??\c:\bnrrpp.exec:\bnrrpp.exe90⤵PID:1400
-
\??\c:\jbhjv.exec:\jbhjv.exe91⤵PID:2032
-
\??\c:\dfvxv.exec:\dfvxv.exe92⤵
- System Location Discovery: System Language Discovery
PID:1120 -
\??\c:\hrptj.exec:\hrptj.exe93⤵PID:2260
-
\??\c:\vxxjtfx.exec:\vxxjtfx.exe94⤵PID:320
-
\??\c:\vnnrx.exec:\vnnrx.exe95⤵PID:2984
-
\??\c:\vbplnd.exec:\vbplnd.exe96⤵PID:2384
-
\??\c:\rhdtl.exec:\rhdtl.exe97⤵PID:472
-
\??\c:\fbtpp.exec:\fbtpp.exe98⤵PID:332
-
\??\c:\fpntlv.exec:\fpntlv.exe99⤵PID:1912
-
\??\c:\lrxdvl.exec:\lrxdvl.exe100⤵
- System Location Discovery: System Language Discovery
PID:2464 -
\??\c:\jlpnrb.exec:\jlpnrb.exe101⤵PID:2200
-
\??\c:\rfxtbx.exec:\rfxtbx.exe102⤵PID:2124
-
\??\c:\hfrhblv.exec:\hfrhblv.exe103⤵PID:836
-
\??\c:\tfvxjnt.exec:\tfvxjnt.exe104⤵PID:2208
-
\??\c:\lthbb.exec:\lthbb.exe105⤵PID:2152
-
\??\c:\btvbbb.exec:\btvbbb.exe106⤵PID:1472
-
\??\c:\vtdxvjd.exec:\vtdxvjd.exe107⤵PID:2468
-
\??\c:\lhdvrnb.exec:\lhdvrnb.exe108⤵
- System Location Discovery: System Language Discovery
PID:780 -
\??\c:\jthrr.exec:\jthrr.exe109⤵PID:2016
-
\??\c:\tjdhpv.exec:\tjdhpv.exe110⤵PID:1020
-
\??\c:\dnldp.exec:\dnldp.exe111⤵PID:2580
-
\??\c:\pnbxvvt.exec:\pnbxvvt.exe112⤵PID:1708
-
\??\c:\hfndj.exec:\hfndj.exe113⤵PID:2560
-
\??\c:\bdnlp.exec:\bdnlp.exe114⤵PID:1704
-
\??\c:\jrppnbr.exec:\jrppnbr.exe115⤵PID:2404
-
\??\c:\ptnhxnr.exec:\ptnhxnr.exe116⤵PID:580
-
\??\c:\ptddljp.exec:\ptddljp.exe117⤵PID:1712
-
\??\c:\hvpndd.exec:\hvpndd.exe118⤵PID:2884
-
\??\c:\fxbtj.exec:\fxbtj.exe119⤵PID:2028
-
\??\c:\blnpt.exec:\blnpt.exe120⤵PID:1580
-
\??\c:\xndpffj.exec:\xndpffj.exe121⤵PID:2832
-
\??\c:\bbfvntr.exec:\bbfvntr.exe122⤵PID:2776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-