Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 05:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe
-
Size
453KB
-
MD5
4fdd10b459c02e3e888e9a53edb64d72
-
SHA1
691f618d57a8f9e4b037d95b6e902ae19b1a46c1
-
SHA256
5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244
-
SHA512
86f3d01e99750799753c8240fb9f635f70447d13609766eaedb192cc203dcd730517d7beef2b6d849d3d4e8e88a54e7e2a9b8bbceb86d67ac6dbfa9e79073825
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet1:q7Tc2NYHUrAwfMp3CDt1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2260-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-37-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2768-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-46-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2996-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1464-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1100-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-221-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1804-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/328-231-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1724-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/544-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-437-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1624-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1064-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1016-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-544-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/3064-549-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2704-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-571-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2336-595-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2336-617-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2884-624-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1712-709-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2572-736-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-815-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2304 flnbjnr.exe 1708 hxphvl.exe 2448 rvbhnt.exe 2768 prblp.exe 2772 ntpttl.exe 2996 dlltjbv.exe 2052 dpfhdn.exe 2620 xbtrh.exe 2740 vvpxh.exe 2576 jdbnjd.exe 2688 xdbjrb.exe 2952 xlfpvhd.exe 832 hfhhd.exe 2840 flrxx.exe 560 txntvlt.exe 1464 xnhllh.exe 1896 xlbdt.exe 2660 pbtltvn.exe 940 hfldv.exe 1504 ppndnx.exe 1100 xnpvnn.exe 1052 pxjjtrd.exe 1480 bxtht.exe 1804 fjtthn.exe 328 thtpp.exe 1724 pfttvtl.exe 1788 xtxpfbt.exe 1512 jtvdpvd.exe 2700 xnnpdp.exe 2180 tlfdplj.exe 544 bjrrnrp.exe 1672 dbhtdlv.exe 2280 nlhpp.exe 1592 tdnnrhr.exe 2548 tdxxfv.exe 2552 hjptvj.exe 2728 jtxfpxt.exe 2432 hvtjlp.exe 2904 lphlp.exe 2780 fnbvdl.exe 2824 rbfpnp.exe 2896 xppddd.exe 2668 fdfbxjh.exe 772 ntvhjt.exe 2464 jlhvx.exe 2600 flhlh.exe 1692 jlrlrf.exe 3000 fbxplfv.exe 2952 hhpxbhp.exe 384 xthtjrx.exe 740 hlrxv.exe 1176 bnbpnfp.exe 2300 vbpvjdd.exe 924 bvtnhd.exe 1624 bjfnxbx.exe 1628 blvdn.exe 2988 jxxnlt.exe 1908 nhvtxf.exe 2252 jhlxf.exe 1064 vtrxj.exe 3052 jjljdv.exe 1164 nxdtdt.exe 972 jrbpx.exe 1016 fbfdnb.exe -
resource yara_rule behavioral1/memory/2260-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-37-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2768-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-437-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1624-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-544-0x00000000001C0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/2704-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-638-0x00000000001C0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/340-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-736-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-815-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2748-896-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2432-897-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xppddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtxpfbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvrtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phtdnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnhvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pttltrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdbjrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvfddt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtbpxhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjhfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdhnjpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdttnjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjrpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnhllh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjndt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvrrvxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nltlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbdlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpbnrnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjvhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxjldx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnjhjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbpxdnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjbdhvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thpbxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frbjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vprxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvnxjlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2260 wrote to memory of 2304 2260 5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe 31 PID 2260 wrote to memory of 2304 2260 5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe 31 PID 2260 wrote to memory of 2304 2260 5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe 31 PID 2260 wrote to memory of 2304 2260 5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe 31 PID 2304 wrote to memory of 1708 2304 flnbjnr.exe 32 PID 2304 wrote to memory of 1708 2304 flnbjnr.exe 32 PID 2304 wrote to memory of 1708 2304 flnbjnr.exe 32 PID 2304 wrote to memory of 1708 2304 flnbjnr.exe 32 PID 1708 wrote to memory of 2448 1708 hxphvl.exe 33 PID 1708 wrote to memory of 2448 1708 hxphvl.exe 33 PID 1708 wrote to memory of 2448 1708 hxphvl.exe 33 PID 1708 wrote to memory of 2448 1708 hxphvl.exe 33 PID 2448 wrote to memory of 2768 2448 rvbhnt.exe 34 PID 2448 wrote to memory of 2768 2448 rvbhnt.exe 34 PID 2448 wrote to memory of 2768 2448 rvbhnt.exe 34 PID 2448 wrote to memory of 2768 2448 rvbhnt.exe 34 PID 2768 wrote to memory of 2772 2768 prblp.exe 35 PID 2768 wrote to memory of 2772 2768 prblp.exe 35 PID 2768 wrote to memory of 2772 2768 prblp.exe 35 PID 2768 wrote to memory of 2772 2768 prblp.exe 35 PID 2772 wrote to memory of 2996 2772 ntpttl.exe 36 PID 2772 wrote to memory of 2996 2772 ntpttl.exe 36 PID 2772 wrote to memory of 2996 2772 ntpttl.exe 36 PID 2772 wrote to memory of 2996 2772 ntpttl.exe 36 PID 2996 wrote to memory of 2052 2996 dlltjbv.exe 37 PID 2996 wrote to memory of 2052 2996 dlltjbv.exe 37 PID 2996 wrote to memory of 2052 2996 dlltjbv.exe 37 PID 2996 wrote to memory of 2052 2996 dlltjbv.exe 37 PID 2052 wrote to memory of 2620 2052 dpfhdn.exe 38 PID 2052 wrote to memory of 2620 2052 dpfhdn.exe 38 PID 2052 wrote to memory of 2620 2052 dpfhdn.exe 38 PID 2052 wrote to memory of 2620 2052 dpfhdn.exe 38 PID 2620 wrote to memory of 2740 2620 xbtrh.exe 39 PID 2620 wrote to memory of 2740 2620 xbtrh.exe 39 PID 2620 wrote to memory of 2740 2620 xbtrh.exe 39 PID 2620 wrote to memory of 2740 2620 xbtrh.exe 39 PID 2740 wrote to memory of 2576 2740 vvpxh.exe 40 PID 2740 wrote to memory of 2576 2740 vvpxh.exe 40 PID 2740 wrote to memory of 2576 2740 vvpxh.exe 40 PID 2740 wrote to memory of 2576 2740 vvpxh.exe 40 PID 2576 wrote to memory of 2688 2576 jdbnjd.exe 41 PID 2576 wrote to memory of 2688 2576 jdbnjd.exe 41 PID 2576 wrote to memory of 2688 2576 jdbnjd.exe 41 PID 2576 wrote to memory of 2688 2576 jdbnjd.exe 41 PID 2688 wrote to memory of 2952 2688 xdbjrb.exe 42 PID 2688 wrote to memory of 2952 2688 xdbjrb.exe 42 PID 2688 wrote to memory of 2952 2688 xdbjrb.exe 42 PID 2688 wrote to memory of 2952 2688 xdbjrb.exe 42 PID 2952 wrote to memory of 832 2952 xlfpvhd.exe 43 PID 2952 wrote to memory of 832 2952 xlfpvhd.exe 43 PID 2952 wrote to memory of 832 2952 xlfpvhd.exe 43 PID 2952 wrote to memory of 832 2952 xlfpvhd.exe 43 PID 832 wrote to memory of 2840 832 hfhhd.exe 44 PID 832 wrote to memory of 2840 832 hfhhd.exe 44 PID 832 wrote to memory of 2840 832 hfhhd.exe 44 PID 832 wrote to memory of 2840 832 hfhhd.exe 44 PID 2840 wrote to memory of 560 2840 flrxx.exe 45 PID 2840 wrote to memory of 560 2840 flrxx.exe 45 PID 2840 wrote to memory of 560 2840 flrxx.exe 45 PID 2840 wrote to memory of 560 2840 flrxx.exe 45 PID 560 wrote to memory of 1464 560 txntvlt.exe 46 PID 560 wrote to memory of 1464 560 txntvlt.exe 46 PID 560 wrote to memory of 1464 560 txntvlt.exe 46 PID 560 wrote to memory of 1464 560 txntvlt.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe"C:\Users\Admin\AppData\Local\Temp\5466800ebaa2eca1d67bb17c6dba2f17afef84ea64b81134a6450b6e2b4ad244.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\flnbjnr.exec:\flnbjnr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\hxphvl.exec:\hxphvl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\rvbhnt.exec:\rvbhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\prblp.exec:\prblp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\ntpttl.exec:\ntpttl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\dlltjbv.exec:\dlltjbv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\dpfhdn.exec:\dpfhdn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\xbtrh.exec:\xbtrh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\vvpxh.exec:\vvpxh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\jdbnjd.exec:\jdbnjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\xdbjrb.exec:\xdbjrb.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\xlfpvhd.exec:\xlfpvhd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\hfhhd.exec:\hfhhd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\flrxx.exec:\flrxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\txntvlt.exec:\txntvlt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\xnhllh.exec:\xnhllh.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1464 -
\??\c:\xlbdt.exec:\xlbdt.exe18⤵
- Executes dropped EXE
PID:1896 -
\??\c:\pbtltvn.exec:\pbtltvn.exe19⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hfldv.exec:\hfldv.exe20⤵
- Executes dropped EXE
PID:940 -
\??\c:\ppndnx.exec:\ppndnx.exe21⤵
- Executes dropped EXE
PID:1504 -
\??\c:\xnpvnn.exec:\xnpvnn.exe22⤵
- Executes dropped EXE
PID:1100 -
\??\c:\pxjjtrd.exec:\pxjjtrd.exe23⤵
- Executes dropped EXE
PID:1052 -
\??\c:\bxtht.exec:\bxtht.exe24⤵
- Executes dropped EXE
PID:1480 -
\??\c:\fjtthn.exec:\fjtthn.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1804 -
\??\c:\thtpp.exec:\thtpp.exe26⤵
- Executes dropped EXE
PID:328 -
\??\c:\pfttvtl.exec:\pfttvtl.exe27⤵
- Executes dropped EXE
PID:1724 -
\??\c:\xtxpfbt.exec:\xtxpfbt.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1788 -
\??\c:\jtvdpvd.exec:\jtvdpvd.exe29⤵
- Executes dropped EXE
PID:1512 -
\??\c:\xnnpdp.exec:\xnnpdp.exe30⤵
- Executes dropped EXE
PID:2700 -
\??\c:\tlfdplj.exec:\tlfdplj.exe31⤵
- Executes dropped EXE
PID:2180 -
\??\c:\bjrrnrp.exec:\bjrrnrp.exe32⤵
- Executes dropped EXE
PID:544 -
\??\c:\dbhtdlv.exec:\dbhtdlv.exe33⤵
- Executes dropped EXE
PID:1672 -
\??\c:\nlhpp.exec:\nlhpp.exe34⤵
- Executes dropped EXE
PID:2280 -
\??\c:\tdnnrhr.exec:\tdnnrhr.exe35⤵
- Executes dropped EXE
PID:1592 -
\??\c:\tdxxfv.exec:\tdxxfv.exe36⤵
- Executes dropped EXE
PID:2548 -
\??\c:\hjptvj.exec:\hjptvj.exe37⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jtxfpxt.exec:\jtxfpxt.exe38⤵
- Executes dropped EXE
PID:2728 -
\??\c:\hvtjlp.exec:\hvtjlp.exe39⤵
- Executes dropped EXE
PID:2432 -
\??\c:\lphlp.exec:\lphlp.exe40⤵
- Executes dropped EXE
PID:2904 -
\??\c:\fnbvdl.exec:\fnbvdl.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\rbfpnp.exec:\rbfpnp.exe42⤵
- Executes dropped EXE
PID:2824 -
\??\c:\xppddd.exec:\xppddd.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2896 -
\??\c:\fdfbxjh.exec:\fdfbxjh.exe44⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ntvhjt.exec:\ntvhjt.exe45⤵
- Executes dropped EXE
PID:772 -
\??\c:\jlhvx.exec:\jlhvx.exe46⤵
- Executes dropped EXE
PID:2464 -
\??\c:\flhlh.exec:\flhlh.exe47⤵
- Executes dropped EXE
PID:2600 -
\??\c:\jlrlrf.exec:\jlrlrf.exe48⤵
- Executes dropped EXE
PID:1692 -
\??\c:\fbxplfv.exec:\fbxplfv.exe49⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hhpxbhp.exec:\hhpxbhp.exe50⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xthtjrx.exec:\xthtjrx.exe51⤵
- Executes dropped EXE
PID:384 -
\??\c:\hlrxv.exec:\hlrxv.exe52⤵
- Executes dropped EXE
PID:740 -
\??\c:\bnbpnfp.exec:\bnbpnfp.exe53⤵
- Executes dropped EXE
PID:1176 -
\??\c:\vbpvjdd.exec:\vbpvjdd.exe54⤵
- Executes dropped EXE
PID:2300 -
\??\c:\bvtnhd.exec:\bvtnhd.exe55⤵
- Executes dropped EXE
PID:924 -
\??\c:\bjfnxbx.exec:\bjfnxbx.exe56⤵
- Executes dropped EXE
PID:1624 -
\??\c:\blvdn.exec:\blvdn.exe57⤵
- Executes dropped EXE
PID:1628 -
\??\c:\jxxnlt.exec:\jxxnlt.exe58⤵
- Executes dropped EXE
PID:2988 -
\??\c:\nhvtxf.exec:\nhvtxf.exe59⤵
- Executes dropped EXE
PID:1908 -
\??\c:\jhlxf.exec:\jhlxf.exe60⤵
- Executes dropped EXE
PID:2252 -
\??\c:\vtrxj.exec:\vtrxj.exe61⤵
- Executes dropped EXE
PID:1064 -
\??\c:\jjljdv.exec:\jjljdv.exe62⤵
- Executes dropped EXE
PID:3052 -
\??\c:\nxdtdt.exec:\nxdtdt.exe63⤵
- Executes dropped EXE
PID:1164 -
\??\c:\jrbpx.exec:\jrbpx.exe64⤵
- Executes dropped EXE
PID:972 -
\??\c:\fbfdnb.exec:\fbfdnb.exe65⤵
- Executes dropped EXE
PID:1016 -
\??\c:\vjdvtdx.exec:\vjdvtdx.exe66⤵PID:1780
-
\??\c:\nxxlftr.exec:\nxxlftr.exe67⤵PID:824
-
\??\c:\hllrh.exec:\hllrh.exe68⤵PID:1688
-
\??\c:\njjxlv.exec:\njjxlv.exe69⤵PID:1588
-
\??\c:\nthnp.exec:\nthnp.exe70⤵PID:3064
-
\??\c:\bldfjd.exec:\bldfjd.exe71⤵PID:2704
-
\??\c:\xltln.exec:\xltln.exe72⤵PID:1820
-
\??\c:\hlrnnn.exec:\hlrnnn.exe73⤵PID:864
-
\??\c:\nnnxhlx.exec:\nnnxhlx.exe74⤵PID:2072
-
\??\c:\vhdxp.exec:\vhdxp.exe75⤵PID:2260
-
\??\c:\tbdlxl.exec:\tbdlxl.exe76⤵
- System Location Discovery: System Language Discovery
PID:2532 -
\??\c:\jfrpbr.exec:\jfrpbr.exe77⤵PID:2336
-
\??\c:\hllvbhf.exec:\hllvbhf.exe78⤵PID:2208
-
\??\c:\lxlfvd.exec:\lxlfvd.exe79⤵PID:2036
-
\??\c:\vjrjd.exec:\vjrjd.exe80⤵PID:2812
-
\??\c:\hjhjhpp.exec:\hjhjhpp.exe81⤵PID:2884
-
\??\c:\hpvhbtr.exec:\hpvhbtr.exe82⤵PID:2192
-
\??\c:\btfnbd.exec:\btfnbd.exe83⤵PID:2772
-
\??\c:\ntxblh.exec:\ntxblh.exe84⤵PID:2996
-
\??\c:\ndtrf.exec:\ndtrf.exe85⤵PID:2732
-
\??\c:\hbvnf.exec:\hbvnf.exe86⤵PID:2652
-
\??\c:\tvtrpr.exec:\tvtrpr.exe87⤵PID:1580
-
\??\c:\hlrpt.exec:\hlrpt.exe88⤵PID:2376
-
\??\c:\xtjtjl.exec:\xtjtjl.exe89⤵PID:2464
-
\??\c:\rhdnpj.exec:\rhdnpj.exe90⤵PID:1872
-
\??\c:\vbdljf.exec:\vbdljf.exe91⤵PID:2976
-
\??\c:\rrhff.exec:\rrhff.exe92⤵PID:2608
-
\??\c:\lbjvvvd.exec:\lbjvvvd.exe93⤵PID:340
-
\??\c:\prndx.exec:\prndx.exe94⤵PID:1712
-
\??\c:\ndjfxb.exec:\ndjfxb.exe95⤵PID:2980
-
\??\c:\jbhfdp.exec:\jbhfdp.exe96⤵PID:1884
-
\??\c:\hxplrlv.exec:\hxplrlv.exe97⤵PID:1888
-
\??\c:\lrrnxdh.exec:\lrrnxdh.exe98⤵PID:2572
-
\??\c:\jlnhn.exec:\jlnhn.exe99⤵PID:2404
-
\??\c:\bnvnp.exec:\bnvnp.exe100⤵PID:2344
-
\??\c:\dphhdxj.exec:\dphhdxj.exe101⤵PID:2988
-
\??\c:\dbffxf.exec:\dbffxf.exe102⤵PID:1180
-
\??\c:\ffpbjxh.exec:\ffpbjxh.exe103⤵PID:1076
-
\??\c:\xpbnrnt.exec:\xpbnrnt.exe104⤵
- System Location Discovery: System Language Discovery
PID:1064 -
\??\c:\lflhvj.exec:\lflhvj.exe105⤵PID:3060
-
\??\c:\dnrdn.exec:\dnrdn.exe106⤵PID:620
-
\??\c:\drtntj.exec:\drtntj.exe107⤵PID:2120
-
\??\c:\rfnlp.exec:\rfnlp.exe108⤵PID:1744
-
\??\c:\hlnnpn.exec:\hlnnpn.exe109⤵PID:1780
-
\??\c:\jvxlxf.exec:\jvxlxf.exe110⤵PID:1472
-
\??\c:\tjfbf.exec:\tjfbf.exe111⤵PID:1688
-
\??\c:\hdnhp.exec:\hdnhp.exe112⤵PID:1588
-
\??\c:\jpdtdb.exec:\jpdtdb.exe113⤵PID:1412
-
\??\c:\ndtvfnn.exec:\ndtvfnn.exe114⤵PID:2116
-
\??\c:\jvrfp.exec:\jvrfp.exe115⤵PID:2264
-
\??\c:\tbnjdjh.exec:\tbnjdjh.exe116⤵PID:864
-
\??\c:\tvhjt.exec:\tvhjt.exe117⤵PID:788
-
\??\c:\tppfnvt.exec:\tppfnvt.exe118⤵PID:1408
-
\??\c:\lnltnh.exec:\lnltnh.exe119⤵PID:1596
-
\??\c:\fplvjtv.exec:\fplvjtv.exe120⤵PID:1988
-
\??\c:\bthhj.exec:\bthhj.exe121⤵PID:2456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-