Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 05:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a217160b8daff8c1cc5b04ed9a915c516b4fed853535a86162c88d105738b177.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a217160b8daff8c1cc5b04ed9a915c516b4fed853535a86162c88d105738b177.exe
-
Size
453KB
-
MD5
cb390e21885a25dc8d43d7e42848491f
-
SHA1
170dd046d2fade01929acab663c59f03b09683c5
-
SHA256
a217160b8daff8c1cc5b04ed9a915c516b4fed853535a86162c88d105738b177
-
SHA512
4d6835f61e6eb5d08a4bee62e588949f1905233994e3ce82e9beb4fc465790cb3f144b6d0f16d6ea088dc0c598374629fafd17035c0134ed2f17dfb10eb12551
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2244-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-63-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2868-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-164-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/692-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-210-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1668-227-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1668-226-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1192-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-289-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3000-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-308-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2472-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-357-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1744-378-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2320-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-431-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1468-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-519-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2676-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-609-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3012-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-658-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2700-711-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-724-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-763-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2448 ljnfbr.exe 2960 fdblfx.exe 2904 tvxptlb.exe 2880 hvdlbvt.exe 2996 fhjvb.exe 1376 vnxbf.exe 2868 rbrxpj.exe 1936 rnbbrlt.exe 1672 dhbnx.exe 1708 jffbjlt.exe 1624 lnbtp.exe 2816 hrnrdv.exe 2340 npvhp.exe 1968 rvfnj.exe 2736 nfbbl.exe 2704 pdbljf.exe 692 pvbdb.exe 2308 fdbbv.exe 2200 xllnx.exe 2524 xtnfhf.exe 2520 xfhbtt.exe 1592 hpjjn.exe 2532 xtlrr.exe 1668 vlfftdl.exe 2056 flpdl.exe 1504 brlnjf.exe 1192 brptx.exe 112 hnpxh.exe 2316 xbdfn.exe 1664 hffdbfp.exe 1240 brddhl.exe 1804 trvnxbf.exe 3000 hnphpl.exe 2472 lfrpp.exe 2448 lvffjb.exe 2960 fflnftr.exe 2876 ftnvh.exe 2904 ndntbjj.exe 2912 hpvrbrh.exe 2588 xdbrf.exe 2804 tvjljt.exe 2604 ljpdvxb.exe 1744 pnvppfh.exe 944 xvnllf.exe 2320 bnfvdh.exe 1684 hhlpvr.exe 1140 bftbhph.exe 316 rnvlln.exe 2092 hvdttff.exe 940 xpllvt.exe 2788 ftntbrt.exe 1444 rpjxd.exe 2008 tltrvf.exe 1468 jdtrbn.exe 324 fvdxpx.exe 840 lrpxnh.exe 2460 plppj.exe 2228 dxpbvrp.exe 2300 nphlx.exe 2564 vrlftfn.exe 2144 lxdrt.exe 980 rnppvj.exe 1096 brfrhx.exe 2532 rbxpdv.exe -
resource yara_rule behavioral1/memory/2244-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-308-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2472-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-519-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1752-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-711-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-724-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-763-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-834-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrtrlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnpfnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvrtvrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvhvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpprjdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnptddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfbnjnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txxfvbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnxrhxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvlbjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxljrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrnrtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftnvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxpftxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrhrhnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvtdfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpndrtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxbtrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxpbvrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prnhvvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvtpvtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtlld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnnbjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phpld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbvlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvbffnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xljppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdnpth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nddhbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfrhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpjtvtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nphlrhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fprrnfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djhfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvjrvvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlfbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpjndxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvbdlb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2448 2244 a217160b8daff8c1cc5b04ed9a915c516b4fed853535a86162c88d105738b177.exe 30 PID 2244 wrote to memory of 2448 2244 a217160b8daff8c1cc5b04ed9a915c516b4fed853535a86162c88d105738b177.exe 30 PID 2244 wrote to memory of 2448 2244 a217160b8daff8c1cc5b04ed9a915c516b4fed853535a86162c88d105738b177.exe 30 PID 2244 wrote to memory of 2448 2244 a217160b8daff8c1cc5b04ed9a915c516b4fed853535a86162c88d105738b177.exe 30 PID 2448 wrote to memory of 2960 2448 ljnfbr.exe 31 PID 2448 wrote to memory of 2960 2448 ljnfbr.exe 31 PID 2448 wrote to memory of 2960 2448 ljnfbr.exe 31 PID 2448 wrote to memory of 2960 2448 ljnfbr.exe 31 PID 2960 wrote to memory of 2904 2960 fdblfx.exe 32 PID 2960 wrote to memory of 2904 2960 fdblfx.exe 32 PID 2960 wrote to memory of 2904 2960 fdblfx.exe 32 PID 2960 wrote to memory of 2904 2960 fdblfx.exe 32 PID 2904 wrote to memory of 2880 2904 tvxptlb.exe 33 PID 2904 wrote to memory of 2880 2904 tvxptlb.exe 33 PID 2904 wrote to memory of 2880 2904 tvxptlb.exe 33 PID 2904 wrote to memory of 2880 2904 tvxptlb.exe 33 PID 2880 wrote to memory of 2996 2880 hvdlbvt.exe 34 PID 2880 wrote to memory of 2996 2880 hvdlbvt.exe 34 PID 2880 wrote to memory of 2996 2880 hvdlbvt.exe 34 PID 2880 wrote to memory of 2996 2880 hvdlbvt.exe 34 PID 2996 wrote to memory of 1376 2996 fhjvb.exe 35 PID 2996 wrote to memory of 1376 2996 fhjvb.exe 35 PID 2996 wrote to memory of 1376 2996 fhjvb.exe 35 PID 2996 wrote to memory of 1376 2996 fhjvb.exe 35 PID 1376 wrote to memory of 2868 1376 vnxbf.exe 36 PID 1376 wrote to memory of 2868 1376 vnxbf.exe 36 PID 1376 wrote to memory of 2868 1376 vnxbf.exe 36 PID 1376 wrote to memory of 2868 1376 vnxbf.exe 36 PID 2868 wrote to memory of 1936 2868 rbrxpj.exe 37 PID 2868 wrote to memory of 1936 2868 rbrxpj.exe 37 PID 2868 wrote to memory of 1936 2868 rbrxpj.exe 37 PID 2868 wrote to memory of 1936 2868 rbrxpj.exe 37 PID 1936 wrote to memory of 1672 1936 rnbbrlt.exe 38 PID 1936 wrote to memory of 1672 1936 rnbbrlt.exe 38 PID 1936 wrote to memory of 1672 1936 rnbbrlt.exe 38 PID 1936 wrote to memory of 1672 1936 rnbbrlt.exe 38 PID 1672 wrote to memory of 1708 1672 dhbnx.exe 39 PID 1672 wrote to memory of 1708 1672 dhbnx.exe 39 PID 1672 wrote to memory of 1708 1672 dhbnx.exe 39 PID 1672 wrote to memory of 1708 1672 dhbnx.exe 39 PID 1708 wrote to memory of 1624 1708 jffbjlt.exe 40 PID 1708 wrote to memory of 1624 1708 jffbjlt.exe 40 PID 1708 wrote to memory of 1624 1708 jffbjlt.exe 40 PID 1708 wrote to memory of 1624 1708 jffbjlt.exe 40 PID 1624 wrote to memory of 2816 1624 lnbtp.exe 41 PID 1624 wrote to memory of 2816 1624 lnbtp.exe 41 PID 1624 wrote to memory of 2816 1624 lnbtp.exe 41 PID 1624 wrote to memory of 2816 1624 lnbtp.exe 41 PID 2816 wrote to memory of 2340 2816 hrnrdv.exe 42 PID 2816 wrote to memory of 2340 2816 hrnrdv.exe 42 PID 2816 wrote to memory of 2340 2816 hrnrdv.exe 42 PID 2816 wrote to memory of 2340 2816 hrnrdv.exe 42 PID 2340 wrote to memory of 1968 2340 npvhp.exe 43 PID 2340 wrote to memory of 1968 2340 npvhp.exe 43 PID 2340 wrote to memory of 1968 2340 npvhp.exe 43 PID 2340 wrote to memory of 1968 2340 npvhp.exe 43 PID 1968 wrote to memory of 2736 1968 rvfnj.exe 44 PID 1968 wrote to memory of 2736 1968 rvfnj.exe 44 PID 1968 wrote to memory of 2736 1968 rvfnj.exe 44 PID 1968 wrote to memory of 2736 1968 rvfnj.exe 44 PID 2736 wrote to memory of 2704 2736 nfbbl.exe 45 PID 2736 wrote to memory of 2704 2736 nfbbl.exe 45 PID 2736 wrote to memory of 2704 2736 nfbbl.exe 45 PID 2736 wrote to memory of 2704 2736 nfbbl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a217160b8daff8c1cc5b04ed9a915c516b4fed853535a86162c88d105738b177.exe"C:\Users\Admin\AppData\Local\Temp\a217160b8daff8c1cc5b04ed9a915c516b4fed853535a86162c88d105738b177.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\ljnfbr.exec:\ljnfbr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\fdblfx.exec:\fdblfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\tvxptlb.exec:\tvxptlb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\hvdlbvt.exec:\hvdlbvt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\fhjvb.exec:\fhjvb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\vnxbf.exec:\vnxbf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\rbrxpj.exec:\rbrxpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\rnbbrlt.exec:\rnbbrlt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\dhbnx.exec:\dhbnx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\jffbjlt.exec:\jffbjlt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\lnbtp.exec:\lnbtp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\hrnrdv.exec:\hrnrdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\npvhp.exec:\npvhp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\rvfnj.exec:\rvfnj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\nfbbl.exec:\nfbbl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\pdbljf.exec:\pdbljf.exe17⤵
- Executes dropped EXE
PID:2704 -
\??\c:\pvbdb.exec:\pvbdb.exe18⤵
- Executes dropped EXE
PID:692 -
\??\c:\fdbbv.exec:\fdbbv.exe19⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xllnx.exec:\xllnx.exe20⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xtnfhf.exec:\xtnfhf.exe21⤵
- Executes dropped EXE
PID:2524 -
\??\c:\xfhbtt.exec:\xfhbtt.exe22⤵
- Executes dropped EXE
PID:2520 -
\??\c:\hpjjn.exec:\hpjjn.exe23⤵
- Executes dropped EXE
PID:1592 -
\??\c:\xtlrr.exec:\xtlrr.exe24⤵
- Executes dropped EXE
PID:2532 -
\??\c:\vlfftdl.exec:\vlfftdl.exe25⤵
- Executes dropped EXE
PID:1668 -
\??\c:\flpdl.exec:\flpdl.exe26⤵
- Executes dropped EXE
PID:2056 -
\??\c:\brlnjf.exec:\brlnjf.exe27⤵
- Executes dropped EXE
PID:1504 -
\??\c:\brptx.exec:\brptx.exe28⤵
- Executes dropped EXE
PID:1192 -
\??\c:\hnpxh.exec:\hnpxh.exe29⤵
- Executes dropped EXE
PID:112 -
\??\c:\xbdfn.exec:\xbdfn.exe30⤵
- Executes dropped EXE
PID:2316 -
\??\c:\hffdbfp.exec:\hffdbfp.exe31⤵
- Executes dropped EXE
PID:1664 -
\??\c:\brddhl.exec:\brddhl.exe32⤵
- Executes dropped EXE
PID:1240 -
\??\c:\trvnxbf.exec:\trvnxbf.exe33⤵
- Executes dropped EXE
PID:1804 -
\??\c:\hnphpl.exec:\hnphpl.exe34⤵
- Executes dropped EXE
PID:3000 -
\??\c:\lfrpp.exec:\lfrpp.exe35⤵
- Executes dropped EXE
PID:2472 -
\??\c:\lvffjb.exec:\lvffjb.exe36⤵
- Executes dropped EXE
PID:2448 -
\??\c:\fflnftr.exec:\fflnftr.exe37⤵
- Executes dropped EXE
PID:2960 -
\??\c:\ftnvh.exec:\ftnvh.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2876 -
\??\c:\ndntbjj.exec:\ndntbjj.exe39⤵
- Executes dropped EXE
PID:2904 -
\??\c:\hpvrbrh.exec:\hpvrbrh.exe40⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xdbrf.exec:\xdbrf.exe41⤵
- Executes dropped EXE
PID:2588 -
\??\c:\tvjljt.exec:\tvjljt.exe42⤵
- Executes dropped EXE
PID:2804 -
\??\c:\ljpdvxb.exec:\ljpdvxb.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\pnvppfh.exec:\pnvppfh.exe44⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xvnllf.exec:\xvnllf.exe45⤵
- Executes dropped EXE
PID:944 -
\??\c:\bnfvdh.exec:\bnfvdh.exe46⤵
- Executes dropped EXE
PID:2320 -
\??\c:\hhlpvr.exec:\hhlpvr.exe47⤵
- Executes dropped EXE
PID:1684 -
\??\c:\bftbhph.exec:\bftbhph.exe48⤵
- Executes dropped EXE
PID:1140 -
\??\c:\rnvlln.exec:\rnvlln.exe49⤵
- Executes dropped EXE
PID:316 -
\??\c:\hvdttff.exec:\hvdttff.exe50⤵
- Executes dropped EXE
PID:2092 -
\??\c:\xpllvt.exec:\xpllvt.exe51⤵
- Executes dropped EXE
PID:940 -
\??\c:\ftntbrt.exec:\ftntbrt.exe52⤵
- Executes dropped EXE
PID:2788 -
\??\c:\rpjxd.exec:\rpjxd.exe53⤵
- Executes dropped EXE
PID:1444 -
\??\c:\tltrvf.exec:\tltrvf.exe54⤵
- Executes dropped EXE
PID:2008 -
\??\c:\jdtrbn.exec:\jdtrbn.exe55⤵
- Executes dropped EXE
PID:1468 -
\??\c:\fvdxpx.exec:\fvdxpx.exe56⤵
- Executes dropped EXE
PID:324 -
\??\c:\lrpxnh.exec:\lrpxnh.exe57⤵
- Executes dropped EXE
PID:840 -
\??\c:\plppj.exec:\plppj.exe58⤵
- Executes dropped EXE
PID:2460 -
\??\c:\dxpbvrp.exec:\dxpbvrp.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2228 -
\??\c:\nphlx.exec:\nphlx.exe60⤵
- Executes dropped EXE
PID:2300 -
\??\c:\vrlftfn.exec:\vrlftfn.exe61⤵
- Executes dropped EXE
PID:2564 -
\??\c:\lxdrt.exec:\lxdrt.exe62⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rnppvj.exec:\rnppvj.exe63⤵
- Executes dropped EXE
PID:980 -
\??\c:\brfrhx.exec:\brfrhx.exe64⤵
- Executes dropped EXE
PID:1096 -
\??\c:\rbxpdv.exec:\rbxpdv.exe65⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lbnrp.exec:\lbnrp.exe66⤵PID:1184
-
\??\c:\lfdbrdb.exec:\lfdbrdb.exe67⤵PID:1752
-
\??\c:\drrnjl.exec:\drrnjl.exe68⤵PID:1552
-
\??\c:\fdbtxt.exec:\fdbtxt.exe69⤵PID:1084
-
\??\c:\ftxlpj.exec:\ftxlpj.exe70⤵PID:1192
-
\??\c:\tfphpdx.exec:\tfphpdx.exe71⤵PID:596
-
\??\c:\dtdnr.exec:\dtdnr.exe72⤵PID:2676
-
\??\c:\ddjhnj.exec:\ddjhnj.exe73⤵PID:1060
-
\??\c:\hlfhjv.exec:\hlfhjv.exe74⤵PID:1200
-
\??\c:\lxbjjxx.exec:\lxbjjxx.exe75⤵PID:2580
-
\??\c:\ptnjp.exec:\ptnjp.exe76⤵PID:1104
-
\??\c:\dnjvhh.exec:\dnjvhh.exe77⤵PID:664
-
\??\c:\vbnvhdl.exec:\vbnvhdl.exe78⤵PID:2892
-
\??\c:\xvpbj.exec:\xvpbj.exe79⤵PID:2988
-
\??\c:\phlnpdx.exec:\phlnpdx.exe80⤵PID:2204
-
\??\c:\tvvldvl.exec:\tvvldvl.exe81⤵PID:2960
-
\??\c:\lxvbxfx.exec:\lxvbxfx.exe82⤵PID:2948
-
\??\c:\hppxtb.exec:\hppxtb.exe83⤵PID:3012
-
\??\c:\trlpnh.exec:\trlpnh.exe84⤵PID:2912
-
\??\c:\lpnrln.exec:\lpnrln.exe85⤵PID:2800
-
\??\c:\vfbxp.exec:\vfbxp.exe86⤵PID:2804
-
\??\c:\jjfpjnd.exec:\jjfpjnd.exe87⤵PID:2604
-
\??\c:\pltlvb.exec:\pltlvb.exe88⤵PID:1744
-
\??\c:\bxfjx.exec:\bxfjx.exe89⤵PID:2380
-
\??\c:\nvdnr.exec:\nvdnr.exe90⤵PID:2320
-
\??\c:\ppbhjb.exec:\ppbhjb.exe91⤵PID:1684
-
\??\c:\pldhd.exec:\pldhd.exe92⤵PID:1624
-
\??\c:\btlphx.exec:\btlphx.exe93⤵PID:432
-
\??\c:\vjtnfjl.exec:\vjtnfjl.exe94⤵PID:2508
-
\??\c:\dnvph.exec:\dnvph.exe95⤵PID:2700
-
\??\c:\ndnbpdd.exec:\ndnbpdd.exe96⤵PID:2844
-
\??\c:\jpnnxb.exec:\jpnnxb.exe97⤵PID:2696
-
\??\c:\fhnbfj.exec:\fhnbfj.exe98⤵PID:2516
-
\??\c:\xtbvr.exec:\xtbvr.exe99⤵PID:1468
-
\??\c:\vjdfn.exec:\vjdfn.exe100⤵PID:2116
-
\??\c:\bbrvtl.exec:\bbrvtl.exe101⤵PID:840
-
\??\c:\vtpjx.exec:\vtpjx.exe102⤵PID:2252
-
\??\c:\dbfbj.exec:\dbfbj.exe103⤵PID:2200
-
\??\c:\drnpb.exec:\drnpb.exe104⤵PID:2300
-
\??\c:\jdxtfvr.exec:\jdxtfvr.exe105⤵PID:1960
-
\??\c:\fjdtbb.exec:\fjdtbb.exe106⤵PID:1020
-
\??\c:\ldjbrl.exec:\ldjbrl.exe107⤵PID:2428
-
\??\c:\xrxvdtt.exec:\xrxvdtt.exe108⤵PID:1096
-
\??\c:\dprjtl.exec:\dprjtl.exe109⤵PID:900
-
\??\c:\trjtjnd.exec:\trjtjnd.exe110⤵PID:236
-
\??\c:\jhvtjh.exec:\jhvtjh.exe111⤵PID:1504
-
\??\c:\hxlbx.exec:\hxlbx.exe112⤵PID:1216
-
\??\c:\nlxdnl.exec:\nlxdnl.exe113⤵PID:1944
-
\??\c:\frdtr.exec:\frdtr.exe114⤵PID:1652
-
\??\c:\hrpnv.exec:\hrpnv.exe115⤵PID:1384
-
\??\c:\xlrjhbj.exec:\xlrjhbj.exe116⤵PID:2572
-
\??\c:\tnhxvr.exec:\tnhxvr.exe117⤵PID:332
-
\??\c:\prnhvvx.exec:\prnhvvx.exe118⤵
- System Location Discovery: System Language Discovery
PID:364 -
\??\c:\tjrhhbj.exec:\tjrhhbj.exe119⤵PID:892
-
\??\c:\vlbnndr.exec:\vlbnndr.exe120⤵PID:2244
-
\??\c:\ffxhvrf.exec:\ffxhvrf.exe121⤵PID:1604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-