Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 09:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe
-
Size
454KB
-
MD5
028354d76bfca5b4d8452fd7dad45001
-
SHA1
7f5a15adf340040e323df9c4e43360861f3c5200
-
SHA256
b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d
-
SHA512
ce6edfa4d27a6dc8a054b093bb97afceb40da0b01913efff223e5305094cc920f4ec3f9b807eb1458c5c417b01965e7043385aaac8a3b827440dfd2314a2ffa1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2660-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-102-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2100-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-109-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2108-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/436-157-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/436-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1220-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/524-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-307-0x00000000773A0000-0x00000000774BF000-memory.dmp family_blackmoon behavioral1/memory/1184-318-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/800-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-684-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1752-861-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2280-864-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3008 bhxvlrv.exe 2816 hpttp.exe 2948 bthvxll.exe 2720 dblfdll.exe 3032 xbrpl.exe 2996 djxvfh.exe 2784 jdthbf.exe 2592 tflbrv.exe 2304 bbxxt.exe 2100 tfnjptp.exe 2108 lfhpt.exe 580 rflrjd.exe 2888 vbdtvvr.exe 2064 brlltlx.exe 2152 nbnbvbd.exe 436 fbtjp.exe 1996 tdvltxv.exe 1536 pxbpvnn.exe 1728 nhfvjr.exe 2480 xxrfp.exe 2428 vbfnjpf.exe 1220 fnldf.exe 2156 rbpvjj.exe 1644 tjfnpf.exe 2128 blvrp.exe 1056 xrnnb.exe 1456 ftjnt.exe 1724 fvhtvj.exe 1988 trfhrlr.exe 524 lbhrbjf.exe 1004 pfdfh.exe 2384 pfhbtfx.exe 1692 vnlphx.exe 1620 pdflxp.exe 1184 bprlhlr.exe 1600 bvfjxp.exe 2336 xhbrthr.exe 2456 fvxhxdr.exe 3004 vnbhhdr.exe 2848 fnxrln.exe 1720 fjllxjn.exe 2732 dfxdv.exe 2608 nrbjrjd.exe 2784 pvndbp.exe 1660 rndjdr.exe 2252 jphdn.exe 2092 nrlrrbh.exe 1844 hnfpnrx.exe 2108 xhtbjp.exe 580 jjjjlp.exe 2180 bfvxbn.exe 1144 xxpvpd.exe 1260 jjnbpd.exe 1200 vxrnpf.exe 800 xnvtff.exe 1744 lhxnn.exe 2488 dhfvpb.exe 2236 jrdbbx.exe 2272 dhtbnpf.exe 2480 xfvdnrr.exe 2140 lhnvb.exe 1968 jhlfrpd.exe 952 pnthhtj.exe 1076 rvnxhf.exe -
resource yara_rule behavioral1/memory/2660-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/436-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1220-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/524-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-307-0x00000000773A0000-0x00000000774BF000-memory.dmp upx behavioral1/memory/2784-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-495-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2444-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-864-0x00000000003C0000-0x00000000003EA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npjnrvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxbtlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjbrhdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlhnjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phrbpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjllxjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnlvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vllrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdhvdjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbrpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrldv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plbrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlflp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hprprd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbjfrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dblbtfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnnpfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfxvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nllhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrnvvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffpdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdtfxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btlnrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvbjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hphnxrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brnjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drtrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjfvvvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdhdft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnldf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlhvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drprjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlrrfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbdrlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxltj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2660 wrote to memory of 3008 2660 b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe 29 PID 2660 wrote to memory of 3008 2660 b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe 29 PID 2660 wrote to memory of 3008 2660 b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe 29 PID 2660 wrote to memory of 3008 2660 b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe 29 PID 3008 wrote to memory of 2816 3008 bhxvlrv.exe 30 PID 3008 wrote to memory of 2816 3008 bhxvlrv.exe 30 PID 3008 wrote to memory of 2816 3008 bhxvlrv.exe 30 PID 3008 wrote to memory of 2816 3008 bhxvlrv.exe 30 PID 2816 wrote to memory of 2948 2816 hpttp.exe 31 PID 2816 wrote to memory of 2948 2816 hpttp.exe 31 PID 2816 wrote to memory of 2948 2816 hpttp.exe 31 PID 2816 wrote to memory of 2948 2816 hpttp.exe 31 PID 2948 wrote to memory of 2720 2948 bthvxll.exe 32 PID 2948 wrote to memory of 2720 2948 bthvxll.exe 32 PID 2948 wrote to memory of 2720 2948 bthvxll.exe 32 PID 2948 wrote to memory of 2720 2948 bthvxll.exe 32 PID 2720 wrote to memory of 3032 2720 dblfdll.exe 33 PID 2720 wrote to memory of 3032 2720 dblfdll.exe 33 PID 2720 wrote to memory of 3032 2720 dblfdll.exe 33 PID 2720 wrote to memory of 3032 2720 dblfdll.exe 33 PID 3032 wrote to memory of 2996 3032 xbrpl.exe 34 PID 3032 wrote to memory of 2996 3032 xbrpl.exe 34 PID 3032 wrote to memory of 2996 3032 xbrpl.exe 34 PID 3032 wrote to memory of 2996 3032 xbrpl.exe 34 PID 2996 wrote to memory of 2784 2996 djxvfh.exe 35 PID 2996 wrote to memory of 2784 2996 djxvfh.exe 35 PID 2996 wrote to memory of 2784 2996 djxvfh.exe 35 PID 2996 wrote to memory of 2784 2996 djxvfh.exe 35 PID 2784 wrote to memory of 2592 2784 jdthbf.exe 36 PID 2784 wrote to memory of 2592 2784 jdthbf.exe 36 PID 2784 wrote to memory of 2592 2784 jdthbf.exe 36 PID 2784 wrote to memory of 2592 2784 jdthbf.exe 36 PID 2592 wrote to memory of 2304 2592 tflbrv.exe 37 PID 2592 wrote to memory of 2304 2592 tflbrv.exe 37 PID 2592 wrote to memory of 2304 2592 tflbrv.exe 37 PID 2592 wrote to memory of 2304 2592 tflbrv.exe 37 PID 2304 wrote to memory of 2100 2304 bbxxt.exe 38 PID 2304 wrote to memory of 2100 2304 bbxxt.exe 38 PID 2304 wrote to memory of 2100 2304 bbxxt.exe 38 PID 2304 wrote to memory of 2100 2304 bbxxt.exe 38 PID 2100 wrote to memory of 2108 2100 tfnjptp.exe 39 PID 2100 wrote to memory of 2108 2100 tfnjptp.exe 39 PID 2100 wrote to memory of 2108 2100 tfnjptp.exe 39 PID 2100 wrote to memory of 2108 2100 tfnjptp.exe 39 PID 2108 wrote to memory of 580 2108 lfhpt.exe 40 PID 2108 wrote to memory of 580 2108 lfhpt.exe 40 PID 2108 wrote to memory of 580 2108 lfhpt.exe 40 PID 2108 wrote to memory of 580 2108 lfhpt.exe 40 PID 580 wrote to memory of 2888 580 rflrjd.exe 41 PID 580 wrote to memory of 2888 580 rflrjd.exe 41 PID 580 wrote to memory of 2888 580 rflrjd.exe 41 PID 580 wrote to memory of 2888 580 rflrjd.exe 41 PID 2888 wrote to memory of 2064 2888 vbdtvvr.exe 42 PID 2888 wrote to memory of 2064 2888 vbdtvvr.exe 42 PID 2888 wrote to memory of 2064 2888 vbdtvvr.exe 42 PID 2888 wrote to memory of 2064 2888 vbdtvvr.exe 42 PID 2064 wrote to memory of 2152 2064 brlltlx.exe 43 PID 2064 wrote to memory of 2152 2064 brlltlx.exe 43 PID 2064 wrote to memory of 2152 2064 brlltlx.exe 43 PID 2064 wrote to memory of 2152 2064 brlltlx.exe 43 PID 2152 wrote to memory of 436 2152 nbnbvbd.exe 44 PID 2152 wrote to memory of 436 2152 nbnbvbd.exe 44 PID 2152 wrote to memory of 436 2152 nbnbvbd.exe 44 PID 2152 wrote to memory of 436 2152 nbnbvbd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe"C:\Users\Admin\AppData\Local\Temp\b6c193de6d8744bdc0769f5c8abe2fefefce742fa3be460b1619fa4a8f75b84d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\bhxvlrv.exec:\bhxvlrv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\hpttp.exec:\hpttp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\bthvxll.exec:\bthvxll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\dblfdll.exec:\dblfdll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\xbrpl.exec:\xbrpl.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\djxvfh.exec:\djxvfh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\jdthbf.exec:\jdthbf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\tflbrv.exec:\tflbrv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\bbxxt.exec:\bbxxt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\tfnjptp.exec:\tfnjptp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\lfhpt.exec:\lfhpt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\rflrjd.exec:\rflrjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\vbdtvvr.exec:\vbdtvvr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\brlltlx.exec:\brlltlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\nbnbvbd.exec:\nbnbvbd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\fbtjp.exec:\fbtjp.exe17⤵
- Executes dropped EXE
PID:436 -
\??\c:\tdvltxv.exec:\tdvltxv.exe18⤵
- Executes dropped EXE
PID:1996 -
\??\c:\pxbpvnn.exec:\pxbpvnn.exe19⤵
- Executes dropped EXE
PID:1536 -
\??\c:\nhfvjr.exec:\nhfvjr.exe20⤵
- Executes dropped EXE
PID:1728 -
\??\c:\xxrfp.exec:\xxrfp.exe21⤵
- Executes dropped EXE
PID:2480 -
\??\c:\vbfnjpf.exec:\vbfnjpf.exe22⤵
- Executes dropped EXE
PID:2428 -
\??\c:\fnldf.exec:\fnldf.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1220 -
\??\c:\rbpvjj.exec:\rbpvjj.exe24⤵
- Executes dropped EXE
PID:2156 -
\??\c:\tjfnpf.exec:\tjfnpf.exe25⤵
- Executes dropped EXE
PID:1644 -
\??\c:\blvrp.exec:\blvrp.exe26⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xrnnb.exec:\xrnnb.exe27⤵
- Executes dropped EXE
PID:1056 -
\??\c:\ftjnt.exec:\ftjnt.exe28⤵
- Executes dropped EXE
PID:1456 -
\??\c:\fvhtvj.exec:\fvhtvj.exe29⤵
- Executes dropped EXE
PID:1724 -
\??\c:\trfhrlr.exec:\trfhrlr.exe30⤵
- Executes dropped EXE
PID:1988 -
\??\c:\lbhrbjf.exec:\lbhrbjf.exe31⤵
- Executes dropped EXE
PID:524 -
\??\c:\pfdfh.exec:\pfdfh.exe32⤵
- Executes dropped EXE
PID:1004 -
\??\c:\pfhbtfx.exec:\pfhbtfx.exe33⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vnlphx.exec:\vnlphx.exe34⤵
- Executes dropped EXE
PID:1692 -
\??\c:\pdflxp.exec:\pdflxp.exe35⤵
- Executes dropped EXE
PID:1620 -
\??\c:\bhrfvpf.exec:\bhrfvpf.exe36⤵PID:3008
-
\??\c:\bprlhlr.exec:\bprlhlr.exe37⤵
- Executes dropped EXE
PID:1184 -
\??\c:\bvfjxp.exec:\bvfjxp.exe38⤵
- Executes dropped EXE
PID:1600 -
\??\c:\xhbrthr.exec:\xhbrthr.exe39⤵
- Executes dropped EXE
PID:2336 -
\??\c:\fvxhxdr.exec:\fvxhxdr.exe40⤵
- Executes dropped EXE
PID:2456 -
\??\c:\vnbhhdr.exec:\vnbhhdr.exe41⤵
- Executes dropped EXE
PID:3004 -
\??\c:\fnxrln.exec:\fnxrln.exe42⤵
- Executes dropped EXE
PID:2848 -
\??\c:\fjllxjn.exec:\fjllxjn.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1720 -
\??\c:\dfxdv.exec:\dfxdv.exe44⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nrbjrjd.exec:\nrbjrjd.exe45⤵
- Executes dropped EXE
PID:2608 -
\??\c:\pvndbp.exec:\pvndbp.exe46⤵
- Executes dropped EXE
PID:2784 -
\??\c:\rndjdr.exec:\rndjdr.exe47⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jphdn.exec:\jphdn.exe48⤵
- Executes dropped EXE
PID:2252 -
\??\c:\nrlrrbh.exec:\nrlrrbh.exe49⤵
- Executes dropped EXE
PID:2092 -
\??\c:\hnfpnrx.exec:\hnfpnrx.exe50⤵
- Executes dropped EXE
PID:1844 -
\??\c:\xhtbjp.exec:\xhtbjp.exe51⤵
- Executes dropped EXE
PID:2108 -
\??\c:\jjjjlp.exec:\jjjjlp.exe52⤵
- Executes dropped EXE
PID:580 -
\??\c:\bfvxbn.exec:\bfvxbn.exe53⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xxpvpd.exec:\xxpvpd.exe54⤵
- Executes dropped EXE
PID:1144 -
\??\c:\jjnbpd.exec:\jjnbpd.exe55⤵
- Executes dropped EXE
PID:1260 -
\??\c:\vxrnpf.exec:\vxrnpf.exe56⤵
- Executes dropped EXE
PID:1200 -
\??\c:\xnvtff.exec:\xnvtff.exe57⤵
- Executes dropped EXE
PID:800 -
\??\c:\lhxnn.exec:\lhxnn.exe58⤵
- Executes dropped EXE
PID:1744 -
\??\c:\dhfvpb.exec:\dhfvpb.exe59⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jrdbbx.exec:\jrdbbx.exe60⤵
- Executes dropped EXE
PID:2236 -
\??\c:\dhtbnpf.exec:\dhtbnpf.exe61⤵
- Executes dropped EXE
PID:2272 -
\??\c:\xfvdnrr.exec:\xfvdnrr.exe62⤵
- Executes dropped EXE
PID:2480 -
\??\c:\lhnvb.exec:\lhnvb.exe63⤵
- Executes dropped EXE
PID:2140 -
\??\c:\jhlfrpd.exec:\jhlfrpd.exe64⤵
- Executes dropped EXE
PID:1968 -
\??\c:\pnthhtj.exec:\pnthhtj.exe65⤵
- Executes dropped EXE
PID:952 -
\??\c:\rvnxhf.exec:\rvnxhf.exe66⤵
- Executes dropped EXE
PID:1076 -
\??\c:\nbnjfnr.exec:\nbnjfnr.exe67⤵PID:1712
-
\??\c:\ptjdrdv.exec:\ptjdrdv.exe68⤵PID:2444
-
\??\c:\fndhhdp.exec:\fndhhdp.exe69⤵PID:1488
-
\??\c:\tvtxb.exec:\tvtxb.exe70⤵PID:1056
-
\??\c:\lnbnv.exec:\lnbnv.exe71⤵PID:1556
-
\??\c:\dvvrbvp.exec:\dvvrbvp.exe72⤵PID:1724
-
\??\c:\pxhvlbd.exec:\pxhvlbd.exe73⤵PID:2060
-
\??\c:\xndtpb.exec:\xndtpb.exe74⤵PID:1632
-
\??\c:\ptbpvb.exec:\ptbpvb.exe75⤵PID:2132
-
\??\c:\ljnbh.exec:\ljnbh.exe76⤵PID:1004
-
\??\c:\lrbjb.exec:\lrbjb.exe77⤵PID:2256
-
\??\c:\rtdtt.exec:\rtdtt.exe78⤵PID:2388
-
\??\c:\htbpfhp.exec:\htbpfhp.exe79⤵PID:2804
-
\??\c:\xhtvjb.exec:\xhtvjb.exe80⤵PID:1708
-
\??\c:\jbnhhxj.exec:\jbnhhxj.exe81⤵PID:2852
-
\??\c:\ltfrr.exec:\ltfrr.exe82⤵PID:2836
-
\??\c:\rxhppv.exec:\rxhppv.exe83⤵PID:3000
-
\??\c:\pddlptp.exec:\pddlptp.exe84⤵PID:2940
-
\??\c:\jljpbj.exec:\jljpbj.exe85⤵PID:2712
-
\??\c:\tfxlrdv.exec:\tfxlrdv.exe86⤵PID:2716
-
\??\c:\jtxrtj.exec:\jtxrtj.exe87⤵PID:2832
-
\??\c:\lhvfn.exec:\lhvfn.exe88⤵PID:2440
-
\??\c:\xbxjf.exec:\xbxjf.exe89⤵PID:2592
-
\??\c:\vnvpjp.exec:\vnvpjp.exe90⤵PID:1676
-
\??\c:\xdvrbp.exec:\xdvrbp.exe91⤵PID:2508
-
\??\c:\vrrfnxr.exec:\vrrfnxr.exe92⤵PID:832
-
\??\c:\bnjndl.exec:\bnjndl.exe93⤵PID:1168
-
\??\c:\dfpfbp.exec:\dfpfbp.exe94⤵PID:1844
-
\??\c:\jlppppx.exec:\jlppppx.exe95⤵PID:3068
-
\??\c:\nbftl.exec:\nbftl.exe96⤵PID:3064
-
\??\c:\lprvr.exec:\lprvr.exe97⤵PID:2172
-
\??\c:\pjrfn.exec:\pjrfn.exe98⤵PID:2764
-
\??\c:\fjhffvh.exec:\fjhffvh.exe99⤵PID:2004
-
\??\c:\vbnfj.exec:\vbnfj.exe100⤵PID:436
-
\??\c:\pbprx.exec:\pbprx.exe101⤵PID:1612
-
\??\c:\nrlbnb.exec:\nrlbnb.exe102⤵PID:1768
-
\??\c:\vvbfn.exec:\vvbfn.exe103⤵PID:2232
-
\??\c:\fdnthr.exec:\fdnthr.exe104⤵PID:2096
-
\??\c:\btlnrl.exec:\btlnrl.exe105⤵
- System Location Discovery: System Language Discovery
PID:1728 -
\??\c:\hbrhvf.exec:\hbrhvf.exe106⤵PID:2080
-
\??\c:\rtxlb.exec:\rtxlb.exe107⤵PID:2432
-
\??\c:\jhjfpj.exec:\jhjfpj.exe108⤵PID:2652
-
\??\c:\jdxpjt.exec:\jdxpjt.exe109⤵PID:612
-
\??\c:\lltdlr.exec:\lltdlr.exe110⤵PID:2604
-
\??\c:\tnhrn.exec:\tnhrn.exe111⤵PID:696
-
\??\c:\bxlthr.exec:\bxlthr.exe112⤵PID:1244
-
\??\c:\ntjlfxp.exec:\ntjlfxp.exe113⤵PID:1816
-
\??\c:\ffdlxxh.exec:\ffdlxxh.exe114⤵PID:2164
-
\??\c:\rbltb.exec:\rbltb.exe115⤵PID:2020
-
\??\c:\nbdrlt.exec:\nbdrlt.exe116⤵
- System Location Discovery: System Language Discovery
PID:1556 -
\??\c:\rftxvhn.exec:\rftxvhn.exe117⤵PID:568
-
\??\c:\vllrd.exec:\vllrd.exe118⤵
- System Location Discovery: System Language Discovery
PID:1964 -
\??\c:\lxdfdt.exec:\lxdfdt.exe119⤵PID:1752
-
\??\c:\hjjrxjb.exec:\hjjrxjb.exe120⤵PID:2280
-
\??\c:\lnjtjj.exec:\lnjtjj.exe121⤵PID:2384
-
\??\c:\rvfvfd.exec:\rvfvfd.exe122⤵PID:884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-