Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 11:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
26b7115b9451daed5dd2e3cbfb6f9a14baed6698545be3af2ef42a7a067fb37eN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
26b7115b9451daed5dd2e3cbfb6f9a14baed6698545be3af2ef42a7a067fb37eN.exe
-
Size
453KB
-
MD5
1401a9b75c79f40df7d54ba8d44cc210
-
SHA1
abfa4f0218aee55d66b5eaf5916a034befeea20b
-
SHA256
26b7115b9451daed5dd2e3cbfb6f9a14baed6698545be3af2ef42a7a067fb37e
-
SHA512
5ee25e7d40a31446a7045bb54434c0271443ac10e7065cb111cccd3826ad9452bdd1d86a609f93fe5b49869d11c343eca3446eb12a03c0e8ee1358467cf131c6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAben:q7Tc2NYHUrAwfMp3CDn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2868-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/364-243-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1516-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/852-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/288-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-374-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3040-388-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1060-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-667-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1444-681-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-694-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2988-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3032 jfjpjfx.exe 2836 hjpdfj.exe 2672 ptrvxfl.exe 2804 tlfjjtr.exe 2708 vbrjlt.exe 2168 htpbjt.exe 1928 dbfxd.exe 2344 nvppdbd.exe 2508 fdbpt.exe 2268 fnxhd.exe 2964 hdvtp.exe 1208 dbdtrdj.exe 1596 vfhbld.exe 2140 fvxnxtj.exe 1744 pfdjr.exe 1924 rpdxvbd.exe 2464 bfdpx.exe 1264 trxllvr.exe 2208 nbxndpx.exe 1964 vvjltv.exe 2352 txbdjdv.exe 364 rfnntf.exe 1960 ffnfrjf.exe 2468 vdnhtd.exe 1516 htpnrnj.exe 852 rbvjbd.exe 288 ndnvh.exe 2272 jdhpr.exe 2564 xdvdtjr.exe 1948 rpjvhhr.exe 1836 rnnln.exe 2284 vfhrv.exe 2776 hnldpf.exe 2492 hntrv.exe 2060 jrbrt.exe 2956 ddtxh.exe 2068 fvllxn.exe 2648 dpdjt.exe 2144 dnxrxhd.exe 2680 llxvfxd.exe 2896 nndnb.exe 2176 vhnlh.exe 1456 tdrbb.exe 3040 pjtvvf.exe 1060 bplhffn.exe 1260 txjtn.exe 1448 lblbnt.exe 2696 xhddb.exe 1616 tjlfrx.exe 1180 vtdhp.exe 3000 bbhrxx.exe 2396 jnlrfbx.exe 332 fvxnlh.exe 2216 vfdfvdh.exe 2384 lnvpvvt.exe 2464 ljjhrjb.exe 3056 ntnvtdb.exe 2172 bvnrn.exe 2108 rtnbp.exe 1592 vrtbh.exe 1468 hvtnvv.exe 1028 fxthrvb.exe 1724 frxxnp.exe 1992 jnlvt.exe -
resource yara_rule behavioral1/memory/2868-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-620-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2168-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-717-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnjxlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjlbfbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxjhnfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fltnhdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xndnlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxvfxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpffpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbxlnxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftffv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfpbfhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdrhxht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjldd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdrvjfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vblpfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvlblx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxlxdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phhvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdrfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjlfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxtlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bllptvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phnrdbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnxrxhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvrvxbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bppvhrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbnxftt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrdtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvxhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phfxnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxnbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dprhbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppblh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxtlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjnxrjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjrfnvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnjrdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbpxxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvllxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbbltx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjlnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdnxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trxllvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvtrbff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2868 wrote to memory of 3032 2868 26b7115b9451daed5dd2e3cbfb6f9a14baed6698545be3af2ef42a7a067fb37eN.exe 30 PID 2868 wrote to memory of 3032 2868 26b7115b9451daed5dd2e3cbfb6f9a14baed6698545be3af2ef42a7a067fb37eN.exe 30 PID 2868 wrote to memory of 3032 2868 26b7115b9451daed5dd2e3cbfb6f9a14baed6698545be3af2ef42a7a067fb37eN.exe 30 PID 2868 wrote to memory of 3032 2868 26b7115b9451daed5dd2e3cbfb6f9a14baed6698545be3af2ef42a7a067fb37eN.exe 30 PID 3032 wrote to memory of 2836 3032 jfjpjfx.exe 31 PID 3032 wrote to memory of 2836 3032 jfjpjfx.exe 31 PID 3032 wrote to memory of 2836 3032 jfjpjfx.exe 31 PID 3032 wrote to memory of 2836 3032 jfjpjfx.exe 31 PID 2836 wrote to memory of 2672 2836 hjpdfj.exe 32 PID 2836 wrote to memory of 2672 2836 hjpdfj.exe 32 PID 2836 wrote to memory of 2672 2836 hjpdfj.exe 32 PID 2836 wrote to memory of 2672 2836 hjpdfj.exe 32 PID 2672 wrote to memory of 2804 2672 ptrvxfl.exe 33 PID 2672 wrote to memory of 2804 2672 ptrvxfl.exe 33 PID 2672 wrote to memory of 2804 2672 ptrvxfl.exe 33 PID 2672 wrote to memory of 2804 2672 ptrvxfl.exe 33 PID 2804 wrote to memory of 2708 2804 tlfjjtr.exe 34 PID 2804 wrote to memory of 2708 2804 tlfjjtr.exe 34 PID 2804 wrote to memory of 2708 2804 tlfjjtr.exe 34 PID 2804 wrote to memory of 2708 2804 tlfjjtr.exe 34 PID 2708 wrote to memory of 2168 2708 vbrjlt.exe 35 PID 2708 wrote to memory of 2168 2708 vbrjlt.exe 35 PID 2708 wrote to memory of 2168 2708 vbrjlt.exe 35 PID 2708 wrote to memory of 2168 2708 vbrjlt.exe 35 PID 2168 wrote to memory of 1928 2168 htpbjt.exe 36 PID 2168 wrote to memory of 1928 2168 htpbjt.exe 36 PID 2168 wrote to memory of 1928 2168 htpbjt.exe 36 PID 2168 wrote to memory of 1928 2168 htpbjt.exe 36 PID 1928 wrote to memory of 2344 1928 dbfxd.exe 37 PID 1928 wrote to memory of 2344 1928 dbfxd.exe 37 PID 1928 wrote to memory of 2344 1928 dbfxd.exe 37 PID 1928 wrote to memory of 2344 1928 dbfxd.exe 37 PID 2344 wrote to memory of 2508 2344 nvppdbd.exe 38 PID 2344 wrote to memory of 2508 2344 nvppdbd.exe 38 PID 2344 wrote to memory of 2508 2344 nvppdbd.exe 38 PID 2344 wrote to memory of 2508 2344 nvppdbd.exe 38 PID 2508 wrote to memory of 2268 2508 fdbpt.exe 39 PID 2508 wrote to memory of 2268 2508 fdbpt.exe 39 PID 2508 wrote to memory of 2268 2508 fdbpt.exe 39 PID 2508 wrote to memory of 2268 2508 fdbpt.exe 39 PID 2268 wrote to memory of 2964 2268 fnxhd.exe 40 PID 2268 wrote to memory of 2964 2268 fnxhd.exe 40 PID 2268 wrote to memory of 2964 2268 fnxhd.exe 40 PID 2268 wrote to memory of 2964 2268 fnxhd.exe 40 PID 2964 wrote to memory of 1208 2964 hdvtp.exe 41 PID 2964 wrote to memory of 1208 2964 hdvtp.exe 41 PID 2964 wrote to memory of 1208 2964 hdvtp.exe 41 PID 2964 wrote to memory of 1208 2964 hdvtp.exe 41 PID 1208 wrote to memory of 1596 1208 dbdtrdj.exe 42 PID 1208 wrote to memory of 1596 1208 dbdtrdj.exe 42 PID 1208 wrote to memory of 1596 1208 dbdtrdj.exe 42 PID 1208 wrote to memory of 1596 1208 dbdtrdj.exe 42 PID 1596 wrote to memory of 2140 1596 vfhbld.exe 43 PID 1596 wrote to memory of 2140 1596 vfhbld.exe 43 PID 1596 wrote to memory of 2140 1596 vfhbld.exe 43 PID 1596 wrote to memory of 2140 1596 vfhbld.exe 43 PID 2140 wrote to memory of 1744 2140 fvxnxtj.exe 44 PID 2140 wrote to memory of 1744 2140 fvxnxtj.exe 44 PID 2140 wrote to memory of 1744 2140 fvxnxtj.exe 44 PID 2140 wrote to memory of 1744 2140 fvxnxtj.exe 44 PID 1744 wrote to memory of 1924 1744 pfdjr.exe 45 PID 1744 wrote to memory of 1924 1744 pfdjr.exe 45 PID 1744 wrote to memory of 1924 1744 pfdjr.exe 45 PID 1744 wrote to memory of 1924 1744 pfdjr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\26b7115b9451daed5dd2e3cbfb6f9a14baed6698545be3af2ef42a7a067fb37eN.exe"C:\Users\Admin\AppData\Local\Temp\26b7115b9451daed5dd2e3cbfb6f9a14baed6698545be3af2ef42a7a067fb37eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\jfjpjfx.exec:\jfjpjfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\hjpdfj.exec:\hjpdfj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\ptrvxfl.exec:\ptrvxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\tlfjjtr.exec:\tlfjjtr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\vbrjlt.exec:\vbrjlt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\htpbjt.exec:\htpbjt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\dbfxd.exec:\dbfxd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\nvppdbd.exec:\nvppdbd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\fdbpt.exec:\fdbpt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\fnxhd.exec:\fnxhd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\hdvtp.exec:\hdvtp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\dbdtrdj.exec:\dbdtrdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\vfhbld.exec:\vfhbld.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\fvxnxtj.exec:\fvxnxtj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\pfdjr.exec:\pfdjr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\rpdxvbd.exec:\rpdxvbd.exe17⤵
- Executes dropped EXE
PID:1924 -
\??\c:\bfdpx.exec:\bfdpx.exe18⤵
- Executes dropped EXE
PID:2464 -
\??\c:\trxllvr.exec:\trxllvr.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1264 -
\??\c:\nbxndpx.exec:\nbxndpx.exe20⤵
- Executes dropped EXE
PID:2208 -
\??\c:\vvjltv.exec:\vvjltv.exe21⤵
- Executes dropped EXE
PID:1964 -
\??\c:\txbdjdv.exec:\txbdjdv.exe22⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rfnntf.exec:\rfnntf.exe23⤵
- Executes dropped EXE
PID:364 -
\??\c:\ffnfrjf.exec:\ffnfrjf.exe24⤵
- Executes dropped EXE
PID:1960 -
\??\c:\vdnhtd.exec:\vdnhtd.exe25⤵
- Executes dropped EXE
PID:2468 -
\??\c:\htpnrnj.exec:\htpnrnj.exe26⤵
- Executes dropped EXE
PID:1516 -
\??\c:\rbvjbd.exec:\rbvjbd.exe27⤵
- Executes dropped EXE
PID:852 -
\??\c:\ndnvh.exec:\ndnvh.exe28⤵
- Executes dropped EXE
PID:288 -
\??\c:\jdhpr.exec:\jdhpr.exe29⤵
- Executes dropped EXE
PID:2272 -
\??\c:\xdvdtjr.exec:\xdvdtjr.exe30⤵
- Executes dropped EXE
PID:2564 -
\??\c:\rpjvhhr.exec:\rpjvhhr.exe31⤵
- Executes dropped EXE
PID:1948 -
\??\c:\rnnln.exec:\rnnln.exe32⤵
- Executes dropped EXE
PID:1836 -
\??\c:\vfhrv.exec:\vfhrv.exe33⤵
- Executes dropped EXE
PID:2284 -
\??\c:\hnldpf.exec:\hnldpf.exe34⤵
- Executes dropped EXE
PID:2776 -
\??\c:\hntrv.exec:\hntrv.exe35⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jrbrt.exec:\jrbrt.exe36⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ddtxh.exec:\ddtxh.exe37⤵
- Executes dropped EXE
PID:2956 -
\??\c:\fvllxn.exec:\fvllxn.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2068 -
\??\c:\dpdjt.exec:\dpdjt.exe39⤵
- Executes dropped EXE
PID:2648 -
\??\c:\dnxrxhd.exec:\dnxrxhd.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2144 -
\??\c:\llxvfxd.exec:\llxvfxd.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2680 -
\??\c:\nndnb.exec:\nndnb.exe42⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vhnlh.exec:\vhnlh.exe43⤵
- Executes dropped EXE
PID:2176 -
\??\c:\tdrbb.exec:\tdrbb.exe44⤵
- Executes dropped EXE
PID:1456 -
\??\c:\pjtvvf.exec:\pjtvvf.exe45⤵
- Executes dropped EXE
PID:3040 -
\??\c:\bplhffn.exec:\bplhffn.exe46⤵
- Executes dropped EXE
PID:1060 -
\??\c:\txjtn.exec:\txjtn.exe47⤵
- Executes dropped EXE
PID:1260 -
\??\c:\lblbnt.exec:\lblbnt.exe48⤵
- Executes dropped EXE
PID:1448 -
\??\c:\xhddb.exec:\xhddb.exe49⤵
- Executes dropped EXE
PID:2696 -
\??\c:\tjlfrx.exec:\tjlfrx.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1616 -
\??\c:\vtdhp.exec:\vtdhp.exe51⤵
- Executes dropped EXE
PID:1180 -
\??\c:\bbhrxx.exec:\bbhrxx.exe52⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jnlrfbx.exec:\jnlrfbx.exe53⤵
- Executes dropped EXE
PID:2396 -
\??\c:\fvxnlh.exec:\fvxnlh.exe54⤵
- Executes dropped EXE
PID:332 -
\??\c:\vfdfvdh.exec:\vfdfvdh.exe55⤵
- Executes dropped EXE
PID:2216 -
\??\c:\lnvpvvt.exec:\lnvpvvt.exe56⤵
- Executes dropped EXE
PID:2384 -
\??\c:\ljjhrjb.exec:\ljjhrjb.exe57⤵
- Executes dropped EXE
PID:2464 -
\??\c:\ntnvtdb.exec:\ntnvtdb.exe58⤵
- Executes dropped EXE
PID:3056 -
\??\c:\bvnrn.exec:\bvnrn.exe59⤵
- Executes dropped EXE
PID:2172 -
\??\c:\rtnbp.exec:\rtnbp.exe60⤵
- Executes dropped EXE
PID:2108 -
\??\c:\vrtbh.exec:\vrtbh.exe61⤵
- Executes dropped EXE
PID:1592 -
\??\c:\hvtnvv.exec:\hvtnvv.exe62⤵
- Executes dropped EXE
PID:1468 -
\??\c:\fxthrvb.exec:\fxthrvb.exe63⤵
- Executes dropped EXE
PID:1028 -
\??\c:\frxxnp.exec:\frxxnp.exe64⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jnlvt.exec:\jnlvt.exe65⤵
- Executes dropped EXE
PID:1992 -
\??\c:\xfjdvfv.exec:\xfjdvfv.exe66⤵PID:2468
-
\??\c:\fvtnhjv.exec:\fvtnhjv.exe67⤵PID:2016
-
\??\c:\lvpfj.exec:\lvpfj.exe68⤵PID:2052
-
\??\c:\pjdplr.exec:\pjdplr.exe69⤵PID:2432
-
\??\c:\jndfbb.exec:\jndfbb.exe70⤵PID:884
-
\??\c:\tplvj.exec:\tplvj.exe71⤵PID:2576
-
\??\c:\jlnxbr.exec:\jlnxbr.exe72⤵PID:2424
-
\??\c:\bfnbj.exec:\bfnbj.exe73⤵PID:2720
-
\??\c:\ntvfn.exec:\ntvfn.exe74⤵PID:892
-
\??\c:\jjvnnfv.exec:\jjvnnfv.exe75⤵PID:2296
-
\??\c:\dvpjp.exec:\dvpjp.exe76⤵PID:2276
-
\??\c:\tprrf.exec:\tprrf.exe77⤵PID:2892
-
\??\c:\nphhhdv.exec:\nphhhdv.exe78⤵PID:2816
-
\??\c:\tljfjjp.exec:\tljfjjp.exe79⤵PID:2840
-
\??\c:\pxdtlfn.exec:\pxdtlfn.exe80⤵PID:2672
-
\??\c:\vbrjpd.exec:\vbrjpd.exe81⤵PID:2748
-
\??\c:\vjljb.exec:\vjljb.exe82⤵PID:2700
-
\??\c:\jvdtp.exec:\jvdtp.exe83⤵PID:1604
-
\??\c:\vvxfvr.exec:\vvxfvr.exe84⤵PID:2712
-
\??\c:\ftxxpd.exec:\ftxxpd.exe85⤵PID:2168
-
\??\c:\pvvpdt.exec:\pvvpdt.exe86⤵PID:2336
-
\??\c:\vxtnb.exec:\vxtnb.exe87⤵
- System Location Discovery: System Language Discovery
PID:3044 -
\??\c:\vxnljx.exec:\vxnljx.exe88⤵PID:1944
-
\??\c:\nfpjrnj.exec:\nfpjrnj.exe89⤵PID:1444
-
\??\c:\dpnnbvl.exec:\dpnnbvl.exe90⤵PID:2944
-
\??\c:\ttlvt.exec:\ttlvt.exe91⤵PID:2988
-
\??\c:\ffrhjv.exec:\ffrhjv.exe92⤵PID:2032
-
\??\c:\njhvbvh.exec:\njhvbvh.exe93⤵PID:1736
-
\??\c:\rxjrv.exec:\rxjrv.exe94⤵PID:2376
-
\??\c:\trvpvh.exec:\trvpvh.exe95⤵PID:576
-
\??\c:\vbhrfph.exec:\vbhrfph.exe96⤵PID:1092
-
\??\c:\hjtrb.exec:\hjtrb.exe97⤵PID:1924
-
\??\c:\ffbnh.exec:\ffbnh.exe98⤵PID:1556
-
\??\c:\vfnrbb.exec:\vfnrbb.exe99⤵PID:2452
-
\??\c:\rtjbnfv.exec:\rtjbnfv.exe100⤵PID:2464
-
\??\c:\xdnvxj.exec:\xdnvxj.exe101⤵PID:3056
-
\??\c:\fpftl.exec:\fpftl.exe102⤵PID:3012
-
\??\c:\tnjfv.exec:\tnjfv.exe103⤵PID:1792
-
\??\c:\xnpxh.exec:\xnpxh.exe104⤵PID:980
-
\??\c:\ldjrfx.exec:\ldjrfx.exe105⤵PID:2352
-
\??\c:\vpppxv.exec:\vpppxv.exe106⤵PID:1028
-
\??\c:\jrptv.exec:\jrptv.exe107⤵PID:1700
-
\??\c:\rvlblx.exec:\rvlblx.exe108⤵
- System Location Discovery: System Language Discovery
PID:780 -
\??\c:\phfbfh.exec:\phfbfh.exe109⤵PID:1540
-
\??\c:\djfvjtn.exec:\djfvjtn.exe110⤵PID:1940
-
\??\c:\vdpdrl.exec:\vdpdrl.exe111⤵PID:940
-
\??\c:\frrdtj.exec:\frrdtj.exe112⤵
- System Location Discovery: System Language Discovery
PID:288 -
\??\c:\tfplv.exec:\tfplv.exe113⤵PID:1920
-
\??\c:\nnpnxj.exec:\nnpnxj.exe114⤵PID:1884
-
\??\c:\bfjlrrx.exec:\bfjlrrx.exe115⤵PID:2280
-
\??\c:\rxtlb.exec:\rxtlb.exe116⤵
- System Location Discovery: System Language Discovery
PID:1948 -
\??\c:\fllhhxx.exec:\fllhhxx.exe117⤵PID:2784
-
\??\c:\tfrfjt.exec:\tfrfjt.exe118⤵PID:2760
-
\??\c:\jrxlbh.exec:\jrxlbh.exe119⤵PID:2768
-
\??\c:\vnvrfn.exec:\vnvrfn.exe120⤵PID:2776
-
\??\c:\xlpdj.exec:\xlpdj.exe121⤵PID:1668
-
\??\c:\dlffl.exec:\dlffl.exe122⤵PID:2828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-