Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 06:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9e9ecdfa61274a25ae56e40793842b137771f10041115a202e37c691d603312d.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
9e9ecdfa61274a25ae56e40793842b137771f10041115a202e37c691d603312d.exe
-
Size
453KB
-
MD5
10f95a9f43eed76f708d4d64d0d60c1a
-
SHA1
848bcaf4e6f0c4c831b3ef4d59e3b9797fc9adc0
-
SHA256
9e9ecdfa61274a25ae56e40793842b137771f10041115a202e37c691d603312d
-
SHA512
5519c53a29f9d83bdf06ce3f8d47229cf57dea9b30c7d70d6d01ef48ce0d452b084e3137291d490d9d1194af76ab7f2e2ac78e5ec0fedfa27e7ebad88a772552
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet:q7Tc2NYHUrAwfMp3CDt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/860-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/516-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-44-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2476-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-86-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2804-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-164-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2184-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/372-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-296-0x0000000077870000-0x000000007798F000-memory.dmp family_blackmoon behavioral1/memory/2356-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/524-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-349-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2852-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-402-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/836-405-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2976-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-484-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2600-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-540-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3028-572-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2576-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-635-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1688-642-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2704-656-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2720-672-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1924-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-694-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1728-701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 860 xjxjr.exe 1668 ltxhrjh.exe 1628 ppdjv.exe 2932 nnxdh.exe 2476 tjfdr.exe 2904 lxlpp.exe 2764 pflnt.exe 2100 fttjb.exe 2804 jxfhndn.exe 2648 xbxnnhr.exe 1572 njvvrpd.exe 2980 xfljf.exe 1016 dlfnp.exe 2968 trxvnvl.exe 1556 xxfhjhj.exe 1880 tfxnf.exe 2184 nrprv.exe 2916 jxnht.exe 2220 ddfjdpf.exe 372 tvlrl.exe 2504 djxhbvf.exe 1736 xdrlhpx.exe 1680 nndrhdt.exe 1836 xdfvlxj.exe 1732 lxndrf.exe 2404 lltxt.exe 1468 vtnjbd.exe 1444 jtdvf.exe 1768 dhldjv.exe 2488 thlxfd.exe 2364 jjxrvnl.exe 1948 vrvrh.exe 2344 bxjxl.exe 2564 tbvlvxx.exe 588 dptxr.exe 524 dtpxpt.exe 2476 vvnlnrj.exe 2852 nvddxlx.exe 2908 njprjh.exe 2892 vffjl.exe 2720 xtnjx.exe 2744 tbvlr.exe 2804 hnfdlpj.exe 2612 xthbnj.exe 2536 txvxtf.exe 1572 fbdnd.exe 836 xnlxhnf.exe 2976 tfpjp.exe 1972 bjhxb.exe 2808 rxfjdjx.exe 1480 bddvj.exe 828 rthnpb.exe 2120 jfrjd.exe 2080 nhhrbp.exe 2224 tfpll.exe 2592 phjvpp.exe 436 nrrjt.exe 2672 hvnjx.exe 1320 tlxdd.exe 916 phvrlx.exe 2944 rhfvv.exe 1704 xvlpd.exe 2600 txhfnt.exe 1492 xvjfd.exe -
resource yara_rule behavioral1/memory/860-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/516-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/372-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-294-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1948-296-0x0000000077870000-0x000000007798F000-memory.dmp upx behavioral1/memory/2356-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/524-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-672-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1924-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-708-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fptvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxdxjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttntvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfxjhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpjdlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbrpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtnph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpvhdnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxpfhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txvprbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrhfldt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxtpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxfrlnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdxdnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxphtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tprfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njlvxvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfljf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btjtpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlxxnfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnlvlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptdnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhpdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjrbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdnbtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbnvjrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnlrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjxjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdjpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnflddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjxfrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdtrtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rppfndp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tphrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhrfvln.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 516 wrote to memory of 860 516 9e9ecdfa61274a25ae56e40793842b137771f10041115a202e37c691d603312d.exe 30 PID 516 wrote to memory of 860 516 9e9ecdfa61274a25ae56e40793842b137771f10041115a202e37c691d603312d.exe 30 PID 516 wrote to memory of 860 516 9e9ecdfa61274a25ae56e40793842b137771f10041115a202e37c691d603312d.exe 30 PID 516 wrote to memory of 860 516 9e9ecdfa61274a25ae56e40793842b137771f10041115a202e37c691d603312d.exe 30 PID 860 wrote to memory of 1668 860 xjxjr.exe 31 PID 860 wrote to memory of 1668 860 xjxjr.exe 31 PID 860 wrote to memory of 1668 860 xjxjr.exe 31 PID 860 wrote to memory of 1668 860 xjxjr.exe 31 PID 1668 wrote to memory of 1628 1668 ltxhrjh.exe 32 PID 1668 wrote to memory of 1628 1668 ltxhrjh.exe 32 PID 1668 wrote to memory of 1628 1668 ltxhrjh.exe 32 PID 1668 wrote to memory of 1628 1668 ltxhrjh.exe 32 PID 1628 wrote to memory of 2932 1628 ppdjv.exe 33 PID 1628 wrote to memory of 2932 1628 ppdjv.exe 33 PID 1628 wrote to memory of 2932 1628 ppdjv.exe 33 PID 1628 wrote to memory of 2932 1628 ppdjv.exe 33 PID 2932 wrote to memory of 2476 2932 nnxdh.exe 34 PID 2932 wrote to memory of 2476 2932 nnxdh.exe 34 PID 2932 wrote to memory of 2476 2932 nnxdh.exe 34 PID 2932 wrote to memory of 2476 2932 nnxdh.exe 34 PID 2476 wrote to memory of 2904 2476 tjfdr.exe 36 PID 2476 wrote to memory of 2904 2476 tjfdr.exe 36 PID 2476 wrote to memory of 2904 2476 tjfdr.exe 36 PID 2476 wrote to memory of 2904 2476 tjfdr.exe 36 PID 2904 wrote to memory of 2764 2904 lxlpp.exe 37 PID 2904 wrote to memory of 2764 2904 lxlpp.exe 37 PID 2904 wrote to memory of 2764 2904 lxlpp.exe 37 PID 2904 wrote to memory of 2764 2904 lxlpp.exe 37 PID 2764 wrote to memory of 2100 2764 pflnt.exe 38 PID 2764 wrote to memory of 2100 2764 pflnt.exe 38 PID 2764 wrote to memory of 2100 2764 pflnt.exe 38 PID 2764 wrote to memory of 2100 2764 pflnt.exe 38 PID 2100 wrote to memory of 2804 2100 fttjb.exe 39 PID 2100 wrote to memory of 2804 2100 fttjb.exe 39 PID 2100 wrote to memory of 2804 2100 fttjb.exe 39 PID 2100 wrote to memory of 2804 2100 fttjb.exe 39 PID 2804 wrote to memory of 2648 2804 jxfhndn.exe 40 PID 2804 wrote to memory of 2648 2804 jxfhndn.exe 40 PID 2804 wrote to memory of 2648 2804 jxfhndn.exe 40 PID 2804 wrote to memory of 2648 2804 jxfhndn.exe 40 PID 2648 wrote to memory of 1572 2648 xbxnnhr.exe 41 PID 2648 wrote to memory of 1572 2648 xbxnnhr.exe 41 PID 2648 wrote to memory of 1572 2648 xbxnnhr.exe 41 PID 2648 wrote to memory of 1572 2648 xbxnnhr.exe 41 PID 1572 wrote to memory of 2980 1572 njvvrpd.exe 42 PID 1572 wrote to memory of 2980 1572 njvvrpd.exe 42 PID 1572 wrote to memory of 2980 1572 njvvrpd.exe 42 PID 1572 wrote to memory of 2980 1572 njvvrpd.exe 42 PID 2980 wrote to memory of 1016 2980 xfljf.exe 43 PID 2980 wrote to memory of 1016 2980 xfljf.exe 43 PID 2980 wrote to memory of 1016 2980 xfljf.exe 43 PID 2980 wrote to memory of 1016 2980 xfljf.exe 43 PID 1016 wrote to memory of 2968 1016 dlfnp.exe 44 PID 1016 wrote to memory of 2968 1016 dlfnp.exe 44 PID 1016 wrote to memory of 2968 1016 dlfnp.exe 44 PID 1016 wrote to memory of 2968 1016 dlfnp.exe 44 PID 2968 wrote to memory of 1556 2968 trxvnvl.exe 45 PID 2968 wrote to memory of 1556 2968 trxvnvl.exe 45 PID 2968 wrote to memory of 1556 2968 trxvnvl.exe 45 PID 2968 wrote to memory of 1556 2968 trxvnvl.exe 45 PID 1556 wrote to memory of 1880 1556 xxfhjhj.exe 46 PID 1556 wrote to memory of 1880 1556 xxfhjhj.exe 46 PID 1556 wrote to memory of 1880 1556 xxfhjhj.exe 46 PID 1556 wrote to memory of 1880 1556 xxfhjhj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e9ecdfa61274a25ae56e40793842b137771f10041115a202e37c691d603312d.exe"C:\Users\Admin\AppData\Local\Temp\9e9ecdfa61274a25ae56e40793842b137771f10041115a202e37c691d603312d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\xjxjr.exec:\xjxjr.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\ltxhrjh.exec:\ltxhrjh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\ppdjv.exec:\ppdjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\nnxdh.exec:\nnxdh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\tjfdr.exec:\tjfdr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\lxlpp.exec:\lxlpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\pflnt.exec:\pflnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\fttjb.exec:\fttjb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\jxfhndn.exec:\jxfhndn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\xbxnnhr.exec:\xbxnnhr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\njvvrpd.exec:\njvvrpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\xfljf.exec:\xfljf.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\dlfnp.exec:\dlfnp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\trxvnvl.exec:\trxvnvl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\xxfhjhj.exec:\xxfhjhj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\tfxnf.exec:\tfxnf.exe17⤵
- Executes dropped EXE
PID:1880 -
\??\c:\nrprv.exec:\nrprv.exe18⤵
- Executes dropped EXE
PID:2184 -
\??\c:\jxnht.exec:\jxnht.exe19⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ddfjdpf.exec:\ddfjdpf.exe20⤵
- Executes dropped EXE
PID:2220 -
\??\c:\tvlrl.exec:\tvlrl.exe21⤵
- Executes dropped EXE
PID:372 -
\??\c:\djxhbvf.exec:\djxhbvf.exe22⤵
- Executes dropped EXE
PID:2504 -
\??\c:\xdrlhpx.exec:\xdrlhpx.exe23⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nndrhdt.exec:\nndrhdt.exe24⤵
- Executes dropped EXE
PID:1680 -
\??\c:\xdfvlxj.exec:\xdfvlxj.exe25⤵
- Executes dropped EXE
PID:1836 -
\??\c:\lxndrf.exec:\lxndrf.exe26⤵
- Executes dropped EXE
PID:1732 -
\??\c:\lltxt.exec:\lltxt.exe27⤵
- Executes dropped EXE
PID:2404 -
\??\c:\vtnjbd.exec:\vtnjbd.exe28⤵
- Executes dropped EXE
PID:1468 -
\??\c:\jtdvf.exec:\jtdvf.exe29⤵
- Executes dropped EXE
PID:1444 -
\??\c:\dhldjv.exec:\dhldjv.exe30⤵
- Executes dropped EXE
PID:1768 -
\??\c:\thlxfd.exec:\thlxfd.exe31⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jjxrvnl.exec:\jjxrvnl.exe32⤵
- Executes dropped EXE
PID:2364 -
\??\c:\vrvrh.exec:\vrvrh.exe33⤵
- Executes dropped EXE
PID:1948 -
\??\c:\hhprx.exec:\hhprx.exe34⤵PID:2356
-
\??\c:\bxjxl.exec:\bxjxl.exe35⤵
- Executes dropped EXE
PID:2344 -
\??\c:\tbvlvxx.exec:\tbvlvxx.exe36⤵
- Executes dropped EXE
PID:2564 -
\??\c:\dptxr.exec:\dptxr.exe37⤵
- Executes dropped EXE
PID:588 -
\??\c:\dtpxpt.exec:\dtpxpt.exe38⤵
- Executes dropped EXE
PID:524 -
\??\c:\vvnlnrj.exec:\vvnlnrj.exe39⤵
- Executes dropped EXE
PID:2476 -
\??\c:\nvddxlx.exec:\nvddxlx.exe40⤵
- Executes dropped EXE
PID:2852 -
\??\c:\njprjh.exec:\njprjh.exe41⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vffjl.exec:\vffjl.exe42⤵
- Executes dropped EXE
PID:2892 -
\??\c:\xtnjx.exec:\xtnjx.exe43⤵
- Executes dropped EXE
PID:2720 -
\??\c:\tbvlr.exec:\tbvlr.exe44⤵
- Executes dropped EXE
PID:2744 -
\??\c:\hnfdlpj.exec:\hnfdlpj.exe45⤵
- Executes dropped EXE
PID:2804 -
\??\c:\xthbnj.exec:\xthbnj.exe46⤵
- Executes dropped EXE
PID:2612 -
\??\c:\txvxtf.exec:\txvxtf.exe47⤵
- Executes dropped EXE
PID:2536 -
\??\c:\fbdnd.exec:\fbdnd.exe48⤵
- Executes dropped EXE
PID:1572 -
\??\c:\xnlxhnf.exec:\xnlxhnf.exe49⤵
- Executes dropped EXE
PID:836 -
\??\c:\tfpjp.exec:\tfpjp.exe50⤵
- Executes dropped EXE
PID:2976 -
\??\c:\bjhxb.exec:\bjhxb.exe51⤵
- Executes dropped EXE
PID:1972 -
\??\c:\rxfjdjx.exec:\rxfjdjx.exe52⤵
- Executes dropped EXE
PID:2808 -
\??\c:\bddvj.exec:\bddvj.exe53⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rthnpb.exec:\rthnpb.exe54⤵
- Executes dropped EXE
PID:828 -
\??\c:\jfrjd.exec:\jfrjd.exe55⤵
- Executes dropped EXE
PID:2120 -
\??\c:\nhhrbp.exec:\nhhrbp.exe56⤵
- Executes dropped EXE
PID:2080 -
\??\c:\tfpll.exec:\tfpll.exe57⤵
- Executes dropped EXE
PID:2224 -
\??\c:\phjvpp.exec:\phjvpp.exe58⤵
- Executes dropped EXE
PID:2592 -
\??\c:\nrrjt.exec:\nrrjt.exe59⤵
- Executes dropped EXE
PID:436 -
\??\c:\hvnjx.exec:\hvnjx.exe60⤵
- Executes dropped EXE
PID:2672 -
\??\c:\tlxdd.exec:\tlxdd.exe61⤵
- Executes dropped EXE
PID:1320 -
\??\c:\phvrlx.exec:\phvrlx.exe62⤵
- Executes dropped EXE
PID:916 -
\??\c:\rhfvv.exec:\rhfvv.exe63⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xvlpd.exec:\xvlpd.exe64⤵
- Executes dropped EXE
PID:1704 -
\??\c:\txhfnt.exec:\txhfnt.exe65⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xvjfd.exec:\xvjfd.exe66⤵
- Executes dropped EXE
PID:1492 -
\??\c:\rphbl.exec:\rphbl.exe67⤵PID:1328
-
\??\c:\dhhhjnb.exec:\dhhhjnb.exe68⤵PID:2520
-
\??\c:\vtlpphp.exec:\vtlpphp.exe69⤵PID:1444
-
\??\c:\fjppl.exec:\fjppl.exe70⤵PID:868
-
\??\c:\nfxjnv.exec:\nfxjnv.exe71⤵PID:2308
-
\??\c:\dbbnj.exec:\dbbnj.exe72⤵PID:1400
-
\??\c:\bfpxhr.exec:\bfpxhr.exe73⤵PID:3028
-
\??\c:\rfjdrdh.exec:\rfjdrdh.exe74⤵PID:2576
-
\??\c:\rxbxp.exec:\rxbxp.exe75⤵PID:2360
-
\??\c:\nrnrl.exec:\nrnrl.exe76⤵PID:2104
-
\??\c:\jjrbx.exec:\jjrbx.exe77⤵
- System Location Discovery: System Language Discovery
PID:1636 -
\??\c:\tjnnnjn.exec:\tjnnnjn.exe78⤵PID:2292
-
\??\c:\pdnbtf.exec:\pdnbtf.exe79⤵
- System Location Discovery: System Language Discovery
PID:2500 -
\??\c:\dvtbpfl.exec:\dvtbpfl.exe80⤵PID:2788
-
\??\c:\htpjlb.exec:\htpjlb.exe81⤵PID:2380
-
\??\c:\ftfdj.exec:\ftfdj.exe82⤵PID:2668
-
\??\c:\jddvnn.exec:\jddvnn.exe83⤵PID:1688
-
\??\c:\ldhhptl.exec:\ldhhptl.exe84⤵PID:2720
-
\??\c:\vxdnt.exec:\vxdnt.exe85⤵PID:2704
-
\??\c:\fthptx.exec:\fthptx.exe86⤵PID:940
-
\??\c:\vbdpjdj.exec:\vbdpjdj.exe87⤵PID:2956
-
\??\c:\hnnnr.exec:\hnnnr.exe88⤵PID:1908
-
\??\c:\tdhphr.exec:\tdhphr.exe89⤵PID:1924
-
\??\c:\nvfdl.exec:\nvfdl.exe90⤵PID:1904
-
\??\c:\hhbxh.exec:\hhbxh.exe91⤵PID:1364
-
\??\c:\jflfdb.exec:\jflfdb.exe92⤵PID:1728
-
\??\c:\pbnvjrb.exec:\pbnvjrb.exe93⤵
- System Location Discovery: System Language Discovery
PID:1756 -
\??\c:\lhvhnrp.exec:\lhvhnrp.exe94⤵PID:2984
-
\??\c:\pvfdt.exec:\pvfdt.exe95⤵PID:1112
-
\??\c:\plbhxd.exec:\plbhxd.exe96⤵PID:2296
-
\??\c:\tdtbt.exec:\tdtbt.exe97⤵PID:2248
-
\??\c:\bllvf.exec:\bllvf.exe98⤵PID:1932
-
\??\c:\vthvll.exec:\vthvll.exe99⤵PID:3064
-
\??\c:\plrtxnv.exec:\plrtxnv.exe100⤵PID:1780
-
\??\c:\drbdhn.exec:\drbdhn.exe101⤵PID:2672
-
\??\c:\fxddx.exec:\fxddx.exe102⤵PID:944
-
\??\c:\blxvxt.exec:\blxvxt.exe103⤵PID:972
-
\??\c:\btjtpp.exec:\btjtpp.exe104⤵
- System Location Discovery: System Language Discovery
PID:1684 -
\??\c:\nrnfbh.exec:\nrnfbh.exe105⤵PID:336
-
\??\c:\fvlnrld.exec:\fvlnrld.exe106⤵PID:1072
-
\??\c:\xtvbdt.exec:\xtvbdt.exe107⤵PID:1552
-
\??\c:\pjddd.exec:\pjddd.exe108⤵PID:560
-
\??\c:\tvfvjh.exec:\tvfvjh.exe109⤵PID:580
-
\??\c:\jrlftj.exec:\jrlftj.exe110⤵PID:1372
-
\??\c:\xhljpp.exec:\xhljpp.exe111⤵PID:1952
-
\??\c:\xxjtbdb.exec:\xxjtbdb.exe112⤵PID:2384
-
\??\c:\fxdxjjd.exec:\fxdxjjd.exe113⤵
- System Location Discovery: System Language Discovery
PID:2580 -
\??\c:\bfltprf.exec:\bfltprf.exe114⤵PID:860
-
\??\c:\trpdlf.exec:\trpdlf.exe115⤵PID:2544
-
\??\c:\dnlvlh.exec:\dnlvlh.exe116⤵
- System Location Discovery: System Language Discovery
PID:2568 -
\??\c:\hhnfnbx.exec:\hhnfnbx.exe117⤵PID:2360
-
\??\c:\rhbnb.exec:\rhbnb.exe118⤵PID:1628
-
\??\c:\jdjtv.exec:\jdjtv.exe119⤵PID:1668
-
\??\c:\rdvfv.exec:\rdvfv.exe120⤵PID:1376
-
\??\c:\xltpth.exec:\xltpth.exe121⤵PID:2844
-
\??\c:\fldjrv.exec:\fldjrv.exe122⤵PID:2872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-