Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 08:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fc395f47aab22178de06a06c699b65dff797970b8d062a7bac191a4a808212c0.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
fc395f47aab22178de06a06c699b65dff797970b8d062a7bac191a4a808212c0.exe
-
Size
453KB
-
MD5
e4c1fa87cd6106e0871ee7aec5a53a56
-
SHA1
500ac3d042b8ff6f0a4f5ca95d2c5a5f60b1f4d5
-
SHA256
fc395f47aab22178de06a06c699b65dff797970b8d062a7bac191a4a808212c0
-
SHA512
37e79e8978aa9c7255d90e1024bd57fb75254bf28174bcc96276f62f3a1ef81f7eac3bedb8c63498441c79b07bfa1c4067dbe540e35d5b7596653c519e06a424
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/1492-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1068-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/612-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/796-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-411-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2364-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/852-532-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2072-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/976-595-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2572-609-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1736-616-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2948-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-654-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2616 jfjdv.exe 3032 vrxhx.exe 2444 jflrb.exe 3008 jrvjltj.exe 2972 bnbxx.exe 2580 bljxl.exe 2740 pvvnvjt.exe 2820 rbpdd.exe 2408 jfpbf.exe 1976 tblbld.exe 2168 drjvlp.exe 1068 xnxrhvd.exe 2308 fhbdphj.exe 568 rvbbr.exe 2396 rvbpt.exe 1040 fpblbnb.exe 1364 dnnxvdl.exe 560 vrpfxh.exe 2344 bfljxb.exe 2136 rxbldhf.exe 2416 jjffr.exe 1628 hfpnvt.exe 612 lfvhj.exe 2460 hhtff.exe 1576 vhdnntx.exe 1428 xlfndx.exe 1408 jpnlrdx.exe 812 jbbrrr.exe 776 dbnbxfp.exe 2260 ndhfbf.exe 1748 bvxnnjf.exe 796 jlprl.exe 2116 xbxxpb.exe 1492 dnrvbb.exe 2636 hflphl.exe 1620 jfrnn.exe 2892 fvbnd.exe 2888 ndtdblt.exe 472 hxpbfr.exe 2928 tbrxtnj.exe 3004 xvjjhh.exe 2796 vpxpn.exe 2772 ltrpfxb.exe 2584 flvhjt.exe 2820 vjvjn.exe 2644 xxxnrd.exe 1036 ljxlfvb.exe 2364 prvvj.exe 2168 vflrb.exe 2140 vbfrxxt.exe 1924 vxjbj.exe 2840 pnvjltr.exe 2560 hdhlpt.exe 2032 thjpr.exe 1656 djjptl.exe 1140 frbdjfr.exe 2068 lllpl.exe 2456 pjjjj.exe 2388 tlfjj.exe 2484 xdhdftd.exe 1968 jjxdrjt.exe 852 rnntbx.exe 700 fdlnv.exe 1712 trbvrlt.exe -
resource yara_rule behavioral1/memory/1492-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-54-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2580-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-654-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlxpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnxnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhhxjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtthbpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nljhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvprlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtpxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbnlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnrnnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hflpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdhdvdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnrvbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhdxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtxtdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrdbxhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnlhdrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txtrrbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbptd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhxrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhjtndx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfhdxvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlfjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdfdrlt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1492 wrote to memory of 2616 1492 fc395f47aab22178de06a06c699b65dff797970b8d062a7bac191a4a808212c0.exe 29 PID 1492 wrote to memory of 2616 1492 fc395f47aab22178de06a06c699b65dff797970b8d062a7bac191a4a808212c0.exe 29 PID 1492 wrote to memory of 2616 1492 fc395f47aab22178de06a06c699b65dff797970b8d062a7bac191a4a808212c0.exe 29 PID 1492 wrote to memory of 2616 1492 fc395f47aab22178de06a06c699b65dff797970b8d062a7bac191a4a808212c0.exe 29 PID 2616 wrote to memory of 3032 2616 jfjdv.exe 30 PID 2616 wrote to memory of 3032 2616 jfjdv.exe 30 PID 2616 wrote to memory of 3032 2616 jfjdv.exe 30 PID 2616 wrote to memory of 3032 2616 jfjdv.exe 30 PID 3032 wrote to memory of 2444 3032 vrxhx.exe 31 PID 3032 wrote to memory of 2444 3032 vrxhx.exe 31 PID 3032 wrote to memory of 2444 3032 vrxhx.exe 31 PID 3032 wrote to memory of 2444 3032 vrxhx.exe 31 PID 2444 wrote to memory of 3008 2444 jflrb.exe 32 PID 2444 wrote to memory of 3008 2444 jflrb.exe 32 PID 2444 wrote to memory of 3008 2444 jflrb.exe 32 PID 2444 wrote to memory of 3008 2444 jflrb.exe 32 PID 3008 wrote to memory of 2972 3008 jrvjltj.exe 33 PID 3008 wrote to memory of 2972 3008 jrvjltj.exe 33 PID 3008 wrote to memory of 2972 3008 jrvjltj.exe 33 PID 3008 wrote to memory of 2972 3008 jrvjltj.exe 33 PID 2972 wrote to memory of 2580 2972 bnbxx.exe 34 PID 2972 wrote to memory of 2580 2972 bnbxx.exe 34 PID 2972 wrote to memory of 2580 2972 bnbxx.exe 34 PID 2972 wrote to memory of 2580 2972 bnbxx.exe 34 PID 2580 wrote to memory of 2740 2580 bljxl.exe 35 PID 2580 wrote to memory of 2740 2580 bljxl.exe 35 PID 2580 wrote to memory of 2740 2580 bljxl.exe 35 PID 2580 wrote to memory of 2740 2580 bljxl.exe 35 PID 2740 wrote to memory of 2820 2740 pvvnvjt.exe 36 PID 2740 wrote to memory of 2820 2740 pvvnvjt.exe 36 PID 2740 wrote to memory of 2820 2740 pvvnvjt.exe 36 PID 2740 wrote to memory of 2820 2740 pvvnvjt.exe 36 PID 2820 wrote to memory of 2408 2820 rbpdd.exe 37 PID 2820 wrote to memory of 2408 2820 rbpdd.exe 37 PID 2820 wrote to memory of 2408 2820 rbpdd.exe 37 PID 2820 wrote to memory of 2408 2820 rbpdd.exe 37 PID 2408 wrote to memory of 1976 2408 jfpbf.exe 38 PID 2408 wrote to memory of 1976 2408 jfpbf.exe 38 PID 2408 wrote to memory of 1976 2408 jfpbf.exe 38 PID 2408 wrote to memory of 1976 2408 jfpbf.exe 38 PID 1976 wrote to memory of 2168 1976 tblbld.exe 39 PID 1976 wrote to memory of 2168 1976 tblbld.exe 39 PID 1976 wrote to memory of 2168 1976 tblbld.exe 39 PID 1976 wrote to memory of 2168 1976 tblbld.exe 39 PID 2168 wrote to memory of 1068 2168 drjvlp.exe 40 PID 2168 wrote to memory of 1068 2168 drjvlp.exe 40 PID 2168 wrote to memory of 1068 2168 drjvlp.exe 40 PID 2168 wrote to memory of 1068 2168 drjvlp.exe 40 PID 1068 wrote to memory of 2308 1068 xnxrhvd.exe 41 PID 1068 wrote to memory of 2308 1068 xnxrhvd.exe 41 PID 1068 wrote to memory of 2308 1068 xnxrhvd.exe 41 PID 1068 wrote to memory of 2308 1068 xnxrhvd.exe 41 PID 2308 wrote to memory of 568 2308 fhbdphj.exe 42 PID 2308 wrote to memory of 568 2308 fhbdphj.exe 42 PID 2308 wrote to memory of 568 2308 fhbdphj.exe 42 PID 2308 wrote to memory of 568 2308 fhbdphj.exe 42 PID 568 wrote to memory of 2396 568 rvbbr.exe 43 PID 568 wrote to memory of 2396 568 rvbbr.exe 43 PID 568 wrote to memory of 2396 568 rvbbr.exe 43 PID 568 wrote to memory of 2396 568 rvbbr.exe 43 PID 2396 wrote to memory of 1040 2396 rvbpt.exe 44 PID 2396 wrote to memory of 1040 2396 rvbpt.exe 44 PID 2396 wrote to memory of 1040 2396 rvbpt.exe 44 PID 2396 wrote to memory of 1040 2396 rvbpt.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc395f47aab22178de06a06c699b65dff797970b8d062a7bac191a4a808212c0.exe"C:\Users\Admin\AppData\Local\Temp\fc395f47aab22178de06a06c699b65dff797970b8d062a7bac191a4a808212c0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\jfjdv.exec:\jfjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\vrxhx.exec:\vrxhx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\jflrb.exec:\jflrb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\jrvjltj.exec:\jrvjltj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\bnbxx.exec:\bnbxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\bljxl.exec:\bljxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\pvvnvjt.exec:\pvvnvjt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\rbpdd.exec:\rbpdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\jfpbf.exec:\jfpbf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\tblbld.exec:\tblbld.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\drjvlp.exec:\drjvlp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\xnxrhvd.exec:\xnxrhvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\fhbdphj.exec:\fhbdphj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\rvbbr.exec:\rvbbr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\rvbpt.exec:\rvbpt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\fpblbnb.exec:\fpblbnb.exe17⤵
- Executes dropped EXE
PID:1040 -
\??\c:\dnnxvdl.exec:\dnnxvdl.exe18⤵
- Executes dropped EXE
PID:1364 -
\??\c:\vrpfxh.exec:\vrpfxh.exe19⤵
- Executes dropped EXE
PID:560 -
\??\c:\bfljxb.exec:\bfljxb.exe20⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rxbldhf.exec:\rxbldhf.exe21⤵
- Executes dropped EXE
PID:2136 -
\??\c:\jjffr.exec:\jjffr.exe22⤵
- Executes dropped EXE
PID:2416 -
\??\c:\hfpnvt.exec:\hfpnvt.exe23⤵
- Executes dropped EXE
PID:1628 -
\??\c:\lfvhj.exec:\lfvhj.exe24⤵
- Executes dropped EXE
PID:612 -
\??\c:\hhtff.exec:\hhtff.exe25⤵
- Executes dropped EXE
PID:2460 -
\??\c:\vhdnntx.exec:\vhdnntx.exe26⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xlfndx.exec:\xlfndx.exe27⤵
- Executes dropped EXE
PID:1428 -
\??\c:\jpnlrdx.exec:\jpnlrdx.exe28⤵
- Executes dropped EXE
PID:1408 -
\??\c:\jbbrrr.exec:\jbbrrr.exe29⤵
- Executes dropped EXE
PID:812 -
\??\c:\dbnbxfp.exec:\dbnbxfp.exe30⤵
- Executes dropped EXE
PID:776 -
\??\c:\ndhfbf.exec:\ndhfbf.exe31⤵
- Executes dropped EXE
PID:2260 -
\??\c:\bvxnnjf.exec:\bvxnnjf.exe32⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jlprl.exec:\jlprl.exe33⤵
- Executes dropped EXE
PID:796 -
\??\c:\xbxxpb.exec:\xbxxpb.exe34⤵
- Executes dropped EXE
PID:2116 -
\??\c:\dnrvbb.exec:\dnrvbb.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1492 -
\??\c:\hflphl.exec:\hflphl.exe36⤵
- Executes dropped EXE
PID:2636 -
\??\c:\jfrnn.exec:\jfrnn.exe37⤵
- Executes dropped EXE
PID:1620 -
\??\c:\fvbnd.exec:\fvbnd.exe38⤵
- Executes dropped EXE
PID:2892 -
\??\c:\ndtdblt.exec:\ndtdblt.exe39⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hxpbfr.exec:\hxpbfr.exe40⤵
- Executes dropped EXE
PID:472 -
\??\c:\tbrxtnj.exec:\tbrxtnj.exe41⤵
- Executes dropped EXE
PID:2928 -
\??\c:\xvjjhh.exec:\xvjjhh.exe42⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vpxpn.exec:\vpxpn.exe43⤵
- Executes dropped EXE
PID:2796 -
\??\c:\ltrpfxb.exec:\ltrpfxb.exe44⤵
- Executes dropped EXE
PID:2772 -
\??\c:\flvhjt.exec:\flvhjt.exe45⤵
- Executes dropped EXE
PID:2584 -
\??\c:\vjvjn.exec:\vjvjn.exe46⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xxxnrd.exec:\xxxnrd.exe47⤵
- Executes dropped EXE
PID:2644 -
\??\c:\ljxlfvb.exec:\ljxlfvb.exe48⤵
- Executes dropped EXE
PID:1036 -
\??\c:\prvvj.exec:\prvvj.exe49⤵
- Executes dropped EXE
PID:2364 -
\??\c:\vflrb.exec:\vflrb.exe50⤵
- Executes dropped EXE
PID:2168 -
\??\c:\vbfrxxt.exec:\vbfrxxt.exe51⤵
- Executes dropped EXE
PID:2140 -
\??\c:\vxjbj.exec:\vxjbj.exe52⤵
- Executes dropped EXE
PID:1924 -
\??\c:\pnvjltr.exec:\pnvjltr.exe53⤵
- Executes dropped EXE
PID:2840 -
\??\c:\hdhlpt.exec:\hdhlpt.exe54⤵
- Executes dropped EXE
PID:2560 -
\??\c:\thjpr.exec:\thjpr.exe55⤵
- Executes dropped EXE
PID:2032 -
\??\c:\djjptl.exec:\djjptl.exe56⤵
- Executes dropped EXE
PID:1656 -
\??\c:\frbdjfr.exec:\frbdjfr.exe57⤵
- Executes dropped EXE
PID:1140 -
\??\c:\lllpl.exec:\lllpl.exe58⤵
- Executes dropped EXE
PID:2068 -
\??\c:\pjjjj.exec:\pjjjj.exe59⤵
- Executes dropped EXE
PID:2456 -
\??\c:\tlfjj.exec:\tlfjj.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2388 -
\??\c:\xdhdftd.exec:\xdhdftd.exe61⤵
- Executes dropped EXE
PID:2484 -
\??\c:\jjxdrjt.exec:\jjxdrjt.exe62⤵
- Executes dropped EXE
PID:1968 -
\??\c:\rnntbx.exec:\rnntbx.exe63⤵
- Executes dropped EXE
PID:852 -
\??\c:\fdlnv.exec:\fdlnv.exe64⤵
- Executes dropped EXE
PID:700 -
\??\c:\trbvrlt.exec:\trbvrlt.exe65⤵
- Executes dropped EXE
PID:1712 -
\??\c:\lvtjjxj.exec:\lvtjjxj.exe66⤵PID:2248
-
\??\c:\pjjrb.exec:\pjjrb.exe67⤵PID:1796
-
\??\c:\fvxpf.exec:\fvxpf.exe68⤵PID:2304
-
\??\c:\vrdpt.exec:\vrdpt.exe69⤵PID:1408
-
\??\c:\jbbddj.exec:\jbbddj.exe70⤵PID:304
-
\??\c:\trvhnr.exec:\trvhnr.exe71⤵PID:840
-
\??\c:\rlnxnbp.exec:\rlnxnbp.exe72⤵PID:976
-
\??\c:\ptltpl.exec:\ptltpl.exe73⤵PID:2072
-
\??\c:\nttthr.exec:\nttthr.exe74⤵PID:2024
-
\??\c:\lprdrx.exec:\lprdrx.exe75⤵PID:796
-
\??\c:\prtfhbn.exec:\prtfhbn.exe76⤵PID:2828
-
\??\c:\jprrp.exec:\jprrp.exe77⤵PID:2572
-
\??\c:\vdxbrd.exec:\vdxbrd.exe78⤵PID:1736
-
\??\c:\fpnlvv.exec:\fpnlvv.exe79⤵PID:2476
-
\??\c:\vxvbphr.exec:\vxvbphr.exe80⤵PID:2948
-
\??\c:\dhhxxl.exec:\dhhxxl.exe81⤵PID:2848
-
\??\c:\njxdh.exec:\njxdh.exe82⤵PID:3016
-
\??\c:\jvrnpf.exec:\jvrnpf.exe83⤵PID:2972
-
\??\c:\dvnxn.exec:\dvnxn.exe84⤵PID:2788
-
\??\c:\trrvd.exec:\trrvd.exe85⤵PID:2976
-
\??\c:\hpbhf.exec:\hpbhf.exe86⤵PID:2576
-
\??\c:\tfhnfrb.exec:\tfhnfrb.exe87⤵PID:2564
-
\??\c:\vvntv.exec:\vvntv.exe88⤵PID:2792
-
\??\c:\jrfrx.exec:\jrfrx.exe89⤵PID:2644
-
\??\c:\hnlxt.exec:\hnlxt.exe90⤵PID:2228
-
\??\c:\rjbph.exec:\rjbph.exe91⤵PID:2924
-
\??\c:\nxthnj.exec:\nxthnj.exe92⤵PID:2832
-
\??\c:\drpfnh.exec:\drpfnh.exe93⤵PID:3056
-
\??\c:\dxflnh.exec:\dxflnh.exe94⤵PID:1192
-
\??\c:\hdbprp.exec:\hdbprp.exe95⤵PID:2548
-
\??\c:\vdfhr.exec:\vdfhr.exe96⤵PID:2560
-
\??\c:\lhdbb.exec:\lhdbb.exe97⤵PID:2032
-
\??\c:\vvpvhb.exec:\vvpvhb.exe98⤵PID:2400
-
\??\c:\hvrjh.exec:\hvrjh.exe99⤵PID:560
-
\??\c:\pbrxxp.exec:\pbrxxp.exe100⤵PID:2452
-
\??\c:\fdbnxl.exec:\fdbnxl.exe101⤵PID:2456
-
\??\c:\bbrdnxx.exec:\bbrdnxx.exe102⤵PID:2264
-
\??\c:\drdnxjv.exec:\drdnxjv.exe103⤵PID:320
-
\??\c:\ftjrlx.exec:\ftjrlx.exe104⤵PID:1628
-
\??\c:\hldhjd.exec:\hldhjd.exe105⤵PID:1064
-
\??\c:\nbjhb.exec:\nbjhb.exe106⤵PID:1672
-
\??\c:\rlnvrth.exec:\rlnvrth.exe107⤵PID:2508
-
\??\c:\ddfnr.exec:\ddfnr.exe108⤵PID:1328
-
\??\c:\flhtrhr.exec:\flhtrhr.exe109⤵PID:1600
-
\??\c:\frhxpdh.exec:\frhxpdh.exe110⤵PID:1796
-
\??\c:\nxthn.exec:\nxthn.exe111⤵PID:2304
-
\??\c:\bdpbxfb.exec:\bdpbxfb.exe112⤵PID:1388
-
\??\c:\jfbpvth.exec:\jfbpvth.exe113⤵PID:948
-
\??\c:\hbpjr.exec:\hbpjr.exe114⤵PID:972
-
\??\c:\ndvhdpb.exec:\ndvhdpb.exe115⤵PID:880
-
\??\c:\hrnvl.exec:\hrnvl.exe116⤵PID:1748
-
\??\c:\bfprv.exec:\bfprv.exe117⤵PID:1696
-
\??\c:\rldldr.exec:\rldldr.exe118⤵PID:2600
-
\??\c:\hhhjpdf.exec:\hhhjpdf.exe119⤵PID:2616
-
\??\c:\nhbptd.exec:\nhbptd.exe120⤵
- System Location Discovery: System Language Discovery
PID:1492 -
\??\c:\ppjjrdf.exec:\ppjjrdf.exe121⤵PID:1616
-
\??\c:\djjpv.exec:\djjpv.exe122⤵PID:2952
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-