Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 09:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8323446802499be1ea4363f8612c6462ef6f4077fc2d61067b0b1ba7373d9f43.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
8323446802499be1ea4363f8612c6462ef6f4077fc2d61067b0b1ba7373d9f43.exe
-
Size
454KB
-
MD5
73fd9cebc58cef28121ef5a9fcf2cb57
-
SHA1
258cf8a41c4d3be549207e17df6d8d166a7581d7
-
SHA256
8323446802499be1ea4363f8612c6462ef6f4077fc2d61067b0b1ba7373d9f43
-
SHA512
75da5e21d3fd6381842e8da705c3113f06928c7593be72534c78582d0b610239f4da7bed573f86c00e35bf40d740a3b24bf8e614497a15ccb2591acdb5081e82
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbes:q7Tc2NYHUrAwfMp3CDs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/1268-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-104-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1560-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-204-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2620-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-310-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/668-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-367-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2712-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/556-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/556-602-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3008-609-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/668-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-709-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/436-779-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1464-834-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2288 vtndnj.exe 2256 rxnljlp.exe 2496 xllbxhx.exe 2880 rtplrn.exe 2844 ddvtldd.exe 2908 dbvnfbh.exe 2864 djllfrp.exe 2732 jtnnhv.exe 2184 nvdhrpp.exe 1800 tnjhtvj.exe 2452 vtnbt.exe 1560 vxpbx.exe 1332 dfrdb.exe 1852 thfrjh.exe 1684 rvbvvbv.exe 2040 hhjnp.exe 2116 hdldthr.exe 1724 lbjfnr.exe 764 pfbtpx.exe 3048 jftttnp.exe 2244 phlrvn.exe 2264 njtjn.exe 2088 bpbtn.exe 2620 jnpnpv.exe 2424 phnbxp.exe 1536 hhvpp.exe 1744 nrtdvxf.exe 776 lbphptd.exe 1456 ttjxhj.exe 1972 frtnxr.exe 3008 rrdnbp.exe 2340 xjlhp.exe 1648 plhvfdh.exe 2640 ntfpll.exe 2144 jxflrvp.exe 2156 pttllnf.exe 2188 jnxrp.exe 668 xlbflv.exe 2896 vxtrnlj.exe 2824 frflb.exe 2768 ndvld.exe 2844 rdftfn.exe 2720 dndphhn.exe 2724 njxtr.exe 2712 nllbrbr.exe 1168 pbvxtj.exe 308 hxddld.exe 2212 brdxhf.exe 2348 xlhxh.exe 980 tfjhj.exe 2568 lvvnx.exe 956 bbhbvnl.exe 2996 rdjrhbt.exe 316 lbtxbht.exe 1228 tfbnnn.exe 2372 hljtt.exe 2388 tvrxlr.exe 1792 rvtbl.exe 2200 bbpttl.exe 3028 xhfdhtv.exe 2364 lbplddp.exe 2492 dptptxj.exe 1432 hnrnr.exe 2088 tbxdbhd.exe -
resource yara_rule behavioral1/memory/1268-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1168-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-767-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-847-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-873-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhnrnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blrnphf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frddl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhjdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxbtxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbnvph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhnxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvppf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrdnbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddfbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prvtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrfbdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plhvfdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflldbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blbhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpfdldl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvvtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bflltnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrtxvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnxnhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhxhlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbdxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffbnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfjpphj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lntjjnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhfdhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhlnvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hldpbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdbtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbnrth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnndx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thfhfrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prxpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrldv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbflhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttxlftn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhlntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrdhdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phnbxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrtdvxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1268 wrote to memory of 2288 1268 8323446802499be1ea4363f8612c6462ef6f4077fc2d61067b0b1ba7373d9f43.exe 29 PID 1268 wrote to memory of 2288 1268 8323446802499be1ea4363f8612c6462ef6f4077fc2d61067b0b1ba7373d9f43.exe 29 PID 1268 wrote to memory of 2288 1268 8323446802499be1ea4363f8612c6462ef6f4077fc2d61067b0b1ba7373d9f43.exe 29 PID 1268 wrote to memory of 2288 1268 8323446802499be1ea4363f8612c6462ef6f4077fc2d61067b0b1ba7373d9f43.exe 29 PID 2288 wrote to memory of 2256 2288 vtndnj.exe 30 PID 2288 wrote to memory of 2256 2288 vtndnj.exe 30 PID 2288 wrote to memory of 2256 2288 vtndnj.exe 30 PID 2288 wrote to memory of 2256 2288 vtndnj.exe 30 PID 2256 wrote to memory of 2496 2256 rxnljlp.exe 31 PID 2256 wrote to memory of 2496 2256 rxnljlp.exe 31 PID 2256 wrote to memory of 2496 2256 rxnljlp.exe 31 PID 2256 wrote to memory of 2496 2256 rxnljlp.exe 31 PID 2496 wrote to memory of 2880 2496 xllbxhx.exe 32 PID 2496 wrote to memory of 2880 2496 xllbxhx.exe 32 PID 2496 wrote to memory of 2880 2496 xllbxhx.exe 32 PID 2496 wrote to memory of 2880 2496 xllbxhx.exe 32 PID 2880 wrote to memory of 2844 2880 rtplrn.exe 33 PID 2880 wrote to memory of 2844 2880 rtplrn.exe 33 PID 2880 wrote to memory of 2844 2880 rtplrn.exe 33 PID 2880 wrote to memory of 2844 2880 rtplrn.exe 33 PID 2844 wrote to memory of 2908 2844 ddvtldd.exe 34 PID 2844 wrote to memory of 2908 2844 ddvtldd.exe 34 PID 2844 wrote to memory of 2908 2844 ddvtldd.exe 34 PID 2844 wrote to memory of 2908 2844 ddvtldd.exe 34 PID 2908 wrote to memory of 2864 2908 dbvnfbh.exe 35 PID 2908 wrote to memory of 2864 2908 dbvnfbh.exe 35 PID 2908 wrote to memory of 2864 2908 dbvnfbh.exe 35 PID 2908 wrote to memory of 2864 2908 dbvnfbh.exe 35 PID 2864 wrote to memory of 2732 2864 djllfrp.exe 36 PID 2864 wrote to memory of 2732 2864 djllfrp.exe 36 PID 2864 wrote to memory of 2732 2864 djllfrp.exe 36 PID 2864 wrote to memory of 2732 2864 djllfrp.exe 36 PID 2732 wrote to memory of 2184 2732 jtnnhv.exe 37 PID 2732 wrote to memory of 2184 2732 jtnnhv.exe 37 PID 2732 wrote to memory of 2184 2732 jtnnhv.exe 37 PID 2732 wrote to memory of 2184 2732 jtnnhv.exe 37 PID 2184 wrote to memory of 1800 2184 nvdhrpp.exe 38 PID 2184 wrote to memory of 1800 2184 nvdhrpp.exe 38 PID 2184 wrote to memory of 1800 2184 nvdhrpp.exe 38 PID 2184 wrote to memory of 1800 2184 nvdhrpp.exe 38 PID 1800 wrote to memory of 2452 1800 tnjhtvj.exe 39 PID 1800 wrote to memory of 2452 1800 tnjhtvj.exe 39 PID 1800 wrote to memory of 2452 1800 tnjhtvj.exe 39 PID 1800 wrote to memory of 2452 1800 tnjhtvj.exe 39 PID 2452 wrote to memory of 1560 2452 vtnbt.exe 40 PID 2452 wrote to memory of 1560 2452 vtnbt.exe 40 PID 2452 wrote to memory of 1560 2452 vtnbt.exe 40 PID 2452 wrote to memory of 1560 2452 vtnbt.exe 40 PID 1560 wrote to memory of 1332 1560 vxpbx.exe 41 PID 1560 wrote to memory of 1332 1560 vxpbx.exe 41 PID 1560 wrote to memory of 1332 1560 vxpbx.exe 41 PID 1560 wrote to memory of 1332 1560 vxpbx.exe 41 PID 1332 wrote to memory of 1852 1332 dfrdb.exe 42 PID 1332 wrote to memory of 1852 1332 dfrdb.exe 42 PID 1332 wrote to memory of 1852 1332 dfrdb.exe 42 PID 1332 wrote to memory of 1852 1332 dfrdb.exe 42 PID 1852 wrote to memory of 1684 1852 thfrjh.exe 43 PID 1852 wrote to memory of 1684 1852 thfrjh.exe 43 PID 1852 wrote to memory of 1684 1852 thfrjh.exe 43 PID 1852 wrote to memory of 1684 1852 thfrjh.exe 43 PID 1684 wrote to memory of 2040 1684 rvbvvbv.exe 44 PID 1684 wrote to memory of 2040 1684 rvbvvbv.exe 44 PID 1684 wrote to memory of 2040 1684 rvbvvbv.exe 44 PID 1684 wrote to memory of 2040 1684 rvbvvbv.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\8323446802499be1ea4363f8612c6462ef6f4077fc2d61067b0b1ba7373d9f43.exe"C:\Users\Admin\AppData\Local\Temp\8323446802499be1ea4363f8612c6462ef6f4077fc2d61067b0b1ba7373d9f43.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\vtndnj.exec:\vtndnj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\rxnljlp.exec:\rxnljlp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\xllbxhx.exec:\xllbxhx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\rtplrn.exec:\rtplrn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\ddvtldd.exec:\ddvtldd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\dbvnfbh.exec:\dbvnfbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\djllfrp.exec:\djllfrp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\jtnnhv.exec:\jtnnhv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\nvdhrpp.exec:\nvdhrpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\tnjhtvj.exec:\tnjhtvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\vtnbt.exec:\vtnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\vxpbx.exec:\vxpbx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\dfrdb.exec:\dfrdb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\thfrjh.exec:\thfrjh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\rvbvvbv.exec:\rvbvvbv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\hhjnp.exec:\hhjnp.exe17⤵
- Executes dropped EXE
PID:2040 -
\??\c:\hdldthr.exec:\hdldthr.exe18⤵
- Executes dropped EXE
PID:2116 -
\??\c:\lbjfnr.exec:\lbjfnr.exe19⤵
- Executes dropped EXE
PID:1724 -
\??\c:\pfbtpx.exec:\pfbtpx.exe20⤵
- Executes dropped EXE
PID:764 -
\??\c:\jftttnp.exec:\jftttnp.exe21⤵
- Executes dropped EXE
PID:3048 -
\??\c:\phlrvn.exec:\phlrvn.exe22⤵
- Executes dropped EXE
PID:2244 -
\??\c:\njtjn.exec:\njtjn.exe23⤵
- Executes dropped EXE
PID:2264 -
\??\c:\bpbtn.exec:\bpbtn.exe24⤵
- Executes dropped EXE
PID:2088 -
\??\c:\jnpnpv.exec:\jnpnpv.exe25⤵
- Executes dropped EXE
PID:2620 -
\??\c:\phnbxp.exec:\phnbxp.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2424 -
\??\c:\hhvpp.exec:\hhvpp.exe27⤵
- Executes dropped EXE
PID:1536 -
\??\c:\nrtdvxf.exec:\nrtdvxf.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1744 -
\??\c:\lbphptd.exec:\lbphptd.exe29⤵
- Executes dropped EXE
PID:776 -
\??\c:\ttjxhj.exec:\ttjxhj.exe30⤵
- Executes dropped EXE
PID:1456 -
\??\c:\frtnxr.exec:\frtnxr.exe31⤵
- Executes dropped EXE
PID:1972 -
\??\c:\rrdnbp.exec:\rrdnbp.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3008 -
\??\c:\xjlhp.exec:\xjlhp.exe33⤵
- Executes dropped EXE
PID:2340 -
\??\c:\plhvfdh.exec:\plhvfdh.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1648 -
\??\c:\ntfpll.exec:\ntfpll.exe35⤵
- Executes dropped EXE
PID:2640 -
\??\c:\jxflrvp.exec:\jxflrvp.exe36⤵
- Executes dropped EXE
PID:2144 -
\??\c:\pttllnf.exec:\pttllnf.exe37⤵
- Executes dropped EXE
PID:2156 -
\??\c:\jnxrp.exec:\jnxrp.exe38⤵
- Executes dropped EXE
PID:2188 -
\??\c:\xlbflv.exec:\xlbflv.exe39⤵
- Executes dropped EXE
PID:668 -
\??\c:\vxtrnlj.exec:\vxtrnlj.exe40⤵
- Executes dropped EXE
PID:2896 -
\??\c:\frflb.exec:\frflb.exe41⤵
- Executes dropped EXE
PID:2824 -
\??\c:\ndvld.exec:\ndvld.exe42⤵
- Executes dropped EXE
PID:2768 -
\??\c:\rdftfn.exec:\rdftfn.exe43⤵
- Executes dropped EXE
PID:2844 -
\??\c:\dndphhn.exec:\dndphhn.exe44⤵
- Executes dropped EXE
PID:2720 -
\??\c:\njxtr.exec:\njxtr.exe45⤵
- Executes dropped EXE
PID:2724 -
\??\c:\nllbrbr.exec:\nllbrbr.exe46⤵
- Executes dropped EXE
PID:2712 -
\??\c:\pbvxtj.exec:\pbvxtj.exe47⤵
- Executes dropped EXE
PID:1168 -
\??\c:\hxddld.exec:\hxddld.exe48⤵
- Executes dropped EXE
PID:308 -
\??\c:\brdxhf.exec:\brdxhf.exe49⤵
- Executes dropped EXE
PID:2212 -
\??\c:\xlhxh.exec:\xlhxh.exe50⤵
- Executes dropped EXE
PID:2348 -
\??\c:\tfjhj.exec:\tfjhj.exe51⤵
- Executes dropped EXE
PID:980 -
\??\c:\lvvnx.exec:\lvvnx.exe52⤵
- Executes dropped EXE
PID:2568 -
\??\c:\bbhbvnl.exec:\bbhbvnl.exe53⤵
- Executes dropped EXE
PID:956 -
\??\c:\rdjrhbt.exec:\rdjrhbt.exe54⤵
- Executes dropped EXE
PID:2996 -
\??\c:\lbtxbht.exec:\lbtxbht.exe55⤵
- Executes dropped EXE
PID:316 -
\??\c:\tfbnnn.exec:\tfbnnn.exe56⤵
- Executes dropped EXE
PID:1228 -
\??\c:\hljtt.exec:\hljtt.exe57⤵
- Executes dropped EXE
PID:2372 -
\??\c:\tvrxlr.exec:\tvrxlr.exe58⤵
- Executes dropped EXE
PID:2388 -
\??\c:\rvtbl.exec:\rvtbl.exe59⤵
- Executes dropped EXE
PID:1792 -
\??\c:\bbpttl.exec:\bbpttl.exe60⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xhfdhtv.exec:\xhfdhtv.exe61⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lbplddp.exec:\lbplddp.exe62⤵
- Executes dropped EXE
PID:2364 -
\??\c:\dptptxj.exec:\dptptxj.exe63⤵
- Executes dropped EXE
PID:2492 -
\??\c:\hnrnr.exec:\hnrnr.exe64⤵
- Executes dropped EXE
PID:1432 -
\??\c:\tbxdbhd.exec:\tbxdbhd.exe65⤵
- Executes dropped EXE
PID:2088 -
\??\c:\tbnxp.exec:\tbnxp.exe66⤵PID:2416
-
\??\c:\pbhhdp.exec:\pbhhdp.exe67⤵PID:2252
-
\??\c:\ddxhrl.exec:\ddxhrl.exe68⤵PID:1424
-
\??\c:\txdhh.exec:\txdhh.exe69⤵PID:2468
-
\??\c:\ddlfhb.exec:\ddlfhb.exe70⤵PID:2776
-
\??\c:\vvhjhp.exec:\vvhjhp.exe71⤵PID:1608
-
\??\c:\frpvltl.exec:\frpvltl.exe72⤵PID:964
-
\??\c:\fltdf.exec:\fltdf.exe73⤵PID:3024
-
\??\c:\vlnnln.exec:\vlnnln.exe74⤵PID:1572
-
\??\c:\txblr.exec:\txblr.exe75⤵PID:556
-
\??\c:\tjjbv.exec:\tjjbv.exe76⤵PID:3008
-
\??\c:\djblvh.exec:\djblvh.exe77⤵PID:2340
-
\??\c:\njpxlft.exec:\njpxlft.exe78⤵PID:1648
-
\??\c:\ftnrnvf.exec:\ftnrnvf.exe79⤵PID:2640
-
\??\c:\bbbxnx.exec:\bbbxnx.exe80⤵PID:2056
-
\??\c:\ppxxhph.exec:\ppxxhph.exe81⤵PID:2052
-
\??\c:\tddtt.exec:\tddtt.exe82⤵PID:2188
-
\??\c:\rxdllhd.exec:\rxdllhd.exe83⤵PID:668
-
\??\c:\ltvtrbj.exec:\ltvtrbj.exe84⤵PID:2524
-
\??\c:\rrtxvp.exec:\rrtxvp.exe85⤵
- System Location Discovery: System Language Discovery
PID:2816 -
\??\c:\ptxxnt.exec:\ptxxnt.exe86⤵PID:2940
-
\??\c:\lnfphb.exec:\lnfphb.exe87⤵PID:2780
-
\??\c:\pttlrdt.exec:\pttlrdt.exe88⤵PID:2680
-
\??\c:\jdjrnhx.exec:\jdjrnhx.exe89⤵PID:1968
-
\??\c:\ljdfft.exec:\ljdfft.exe90⤵PID:2208
-
\??\c:\hbndfh.exec:\hbndfh.exe91⤵PID:2004
-
\??\c:\rprhtx.exec:\rprhtx.exe92⤵PID:2616
-
\??\c:\jpxnjv.exec:\jpxnjv.exe93⤵PID:1692
-
\??\c:\xdltr.exec:\xdltr.exe94⤵PID:2668
-
\??\c:\xptxth.exec:\xptxth.exe95⤵PID:2084
-
\??\c:\fddpt.exec:\fddpt.exe96⤵PID:2560
-
\??\c:\jhxpl.exec:\jhxpl.exe97⤵PID:1728
-
\??\c:\pxxjf.exec:\pxxjf.exe98⤵PID:1116
-
\??\c:\vxrpn.exec:\vxrpn.exe99⤵PID:2472
-
\??\c:\xvltrf.exec:\xvltrf.exe100⤵PID:2040
-
\??\c:\jrxhnx.exec:\jrxhnx.exe101⤵PID:1636
-
\??\c:\pdvrxxn.exec:\pdvrxxn.exe102⤵PID:276
-
\??\c:\jnphrj.exec:\jnphrj.exe103⤵PID:2140
-
\??\c:\xpdxv.exec:\xpdxv.exe104⤵PID:3040
-
\??\c:\bjnjj.exec:\bjnjj.exe105⤵PID:436
-
\??\c:\thlvfrx.exec:\thlvfrx.exe106⤵PID:2968
-
\??\c:\rdptbh.exec:\rdptbh.exe107⤵PID:2556
-
\??\c:\hnhjdl.exec:\hnhjdl.exe108⤵
- System Location Discovery: System Language Discovery
PID:2316 -
\??\c:\blbhj.exec:\blbhj.exe109⤵
- System Location Discovery: System Language Discovery
PID:2304 -
\??\c:\rhjjp.exec:\rhjjp.exe110⤵PID:2408
-
\??\c:\rphffl.exec:\rphffl.exe111⤵PID:2424
-
\??\c:\pdlbp.exec:\pdlbp.exe112⤵PID:1860
-
\??\c:\pttfhd.exec:\pttfhd.exe113⤵PID:1464
-
\??\c:\ndlxl.exec:\ndlxl.exe114⤵PID:1744
-
\??\c:\rtppr.exec:\rtppr.exe115⤵PID:1052
-
\??\c:\btpjxrx.exec:\btpjxrx.exe116⤵PID:1456
-
\??\c:\hvbxnlx.exec:\hvbxnlx.exe117⤵PID:2308
-
\??\c:\nfdfp.exec:\nfdfp.exe118⤵PID:844
-
\??\c:\hjjph.exec:\hjjph.exe119⤵PID:2168
-
\??\c:\fjnhrp.exec:\fjnhrp.exe120⤵PID:1932
-
\??\c:\tbndf.exec:\tbndf.exe121⤵PID:876
-
\??\c:\ftjpxdr.exec:\ftjpxdr.exe122⤵PID:2148
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-