Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 12:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
43b11c1aed3239751598eb1d50118576067accec4b0197a338b3205449cb6a1f.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
43b11c1aed3239751598eb1d50118576067accec4b0197a338b3205449cb6a1f.exe
-
Size
456KB
-
MD5
064a819bed9a53bf2ee7eff80c79efa0
-
SHA1
77224ff128faa864bedb73de7561ed3c3e32ea4a
-
SHA256
43b11c1aed3239751598eb1d50118576067accec4b0197a338b3205449cb6a1f
-
SHA512
48f4c654f51396ad6d07eae2b92fa40e12d891eaebcff08616bd057adaf84a714ab3d7d5d3495d2e12ad0ddede7789f7141273cc6f649f3e42e5ed0cbc7551ac
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRo:q7Tc2NYHUrAwfMp3CDRo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/1832-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-389-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1604-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-429-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1016-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/852-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-592-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2028-612-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2660-637-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1944-730-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-764-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-765-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/960-795-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2564 xfpdv.exe 1936 rdhnxf.exe 2836 pjxtn.exe 2092 bfxnfvd.exe 2440 rprnxn.exe 2904 hpfpn.exe 2932 ndxnl.exe 2196 dltdtl.exe 2004 hxpvt.exe 1664 ltbvff.exe 1868 prffpnj.exe 2636 fffnlnh.exe 1648 dbbfnn.exe 1296 lndrxpl.exe 1992 pnxbjdl.exe 1608 hlbbfnp.exe 1808 xfpld.exe 1952 xrlpbtd.exe 2996 bfdrpl.exe 2324 ptftxp.exe 2748 dvjdbf.exe 1816 pbppb.exe 2200 vrjrn.exe 1748 ppptn.exe 964 dnvnhl.exe 1752 fltxl.exe 2140 ppttrvh.exe 1364 jrtph.exe 760 jjjjln.exe 1852 nhbllfp.exe 2456 lvjrdx.exe 1732 jjdhpb.exe 3068 pldxfr.exe 1564 vjfhr.exe 1300 jnvrdl.exe 2352 xrjxfp.exe 2600 rpxhv.exe 1800 fhfvj.exe 2744 vbnrr.exe 2756 dddthp.exe 2940 xnndb.exe 2804 fjbvnll.exe 2952 dbbdbnt.exe 2844 bxrrp.exe 2824 xrlhtbb.exe 2664 xjnhdvh.exe 1960 pdjtpb.exe 1804 vtvjl.exe 1604 pjldnv.exe 1040 ftxjlt.exe 1016 frpprjh.exe 1296 vrnjpt.exe 2640 rpfjt.exe 1704 tdjllpl.exe 1964 nlxtph.exe 1948 tfvtndj.exe 1148 lnndrx.exe 3052 rdvbxd.exe 2996 npjdtb.exe 852 phptld.exe 2332 lrfbtnj.exe 2256 hdrbr.exe 3016 hvbrd.exe 1104 jdbjvdt.exe -
resource yara_rule behavioral1/memory/2564-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-541-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/308-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-795-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2124-898-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhvbph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfrnxjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlrtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppfxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfvlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvfxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxfdftp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppttrvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnvbhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptbxtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlphnfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxtxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pljlpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbrfdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xldprx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxbpbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdhdllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxrxddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljxnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbjjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtphdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjptbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lndrbfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrvlhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxlfvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htxtdrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdddx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvlnbtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrhlfhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpdxfpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xldff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtdhrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lppbfjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rldffd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrftxt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1832 wrote to memory of 2564 1832 43b11c1aed3239751598eb1d50118576067accec4b0197a338b3205449cb6a1f.exe 30 PID 1832 wrote to memory of 2564 1832 43b11c1aed3239751598eb1d50118576067accec4b0197a338b3205449cb6a1f.exe 30 PID 1832 wrote to memory of 2564 1832 43b11c1aed3239751598eb1d50118576067accec4b0197a338b3205449cb6a1f.exe 30 PID 1832 wrote to memory of 2564 1832 43b11c1aed3239751598eb1d50118576067accec4b0197a338b3205449cb6a1f.exe 30 PID 2564 wrote to memory of 1936 2564 xfpdv.exe 31 PID 2564 wrote to memory of 1936 2564 xfpdv.exe 31 PID 2564 wrote to memory of 1936 2564 xfpdv.exe 31 PID 2564 wrote to memory of 1936 2564 xfpdv.exe 31 PID 1936 wrote to memory of 2836 1936 rdhnxf.exe 32 PID 1936 wrote to memory of 2836 1936 rdhnxf.exe 32 PID 1936 wrote to memory of 2836 1936 rdhnxf.exe 32 PID 1936 wrote to memory of 2836 1936 rdhnxf.exe 32 PID 2836 wrote to memory of 2092 2836 pjxtn.exe 33 PID 2836 wrote to memory of 2092 2836 pjxtn.exe 33 PID 2836 wrote to memory of 2092 2836 pjxtn.exe 33 PID 2836 wrote to memory of 2092 2836 pjxtn.exe 33 PID 2092 wrote to memory of 2440 2092 bfxnfvd.exe 34 PID 2092 wrote to memory of 2440 2092 bfxnfvd.exe 34 PID 2092 wrote to memory of 2440 2092 bfxnfvd.exe 34 PID 2092 wrote to memory of 2440 2092 bfxnfvd.exe 34 PID 2440 wrote to memory of 2904 2440 rprnxn.exe 35 PID 2440 wrote to memory of 2904 2440 rprnxn.exe 35 PID 2440 wrote to memory of 2904 2440 rprnxn.exe 35 PID 2440 wrote to memory of 2904 2440 rprnxn.exe 35 PID 2904 wrote to memory of 2932 2904 hpfpn.exe 36 PID 2904 wrote to memory of 2932 2904 hpfpn.exe 36 PID 2904 wrote to memory of 2932 2904 hpfpn.exe 36 PID 2904 wrote to memory of 2932 2904 hpfpn.exe 36 PID 2932 wrote to memory of 2196 2932 ndxnl.exe 37 PID 2932 wrote to memory of 2196 2932 ndxnl.exe 37 PID 2932 wrote to memory of 2196 2932 ndxnl.exe 37 PID 2932 wrote to memory of 2196 2932 ndxnl.exe 37 PID 2196 wrote to memory of 2004 2196 dltdtl.exe 38 PID 2196 wrote to memory of 2004 2196 dltdtl.exe 38 PID 2196 wrote to memory of 2004 2196 dltdtl.exe 38 PID 2196 wrote to memory of 2004 2196 dltdtl.exe 38 PID 2004 wrote to memory of 1664 2004 hxpvt.exe 39 PID 2004 wrote to memory of 1664 2004 hxpvt.exe 39 PID 2004 wrote to memory of 1664 2004 hxpvt.exe 39 PID 2004 wrote to memory of 1664 2004 hxpvt.exe 39 PID 1664 wrote to memory of 1868 1664 ltbvff.exe 40 PID 1664 wrote to memory of 1868 1664 ltbvff.exe 40 PID 1664 wrote to memory of 1868 1664 ltbvff.exe 40 PID 1664 wrote to memory of 1868 1664 ltbvff.exe 40 PID 1868 wrote to memory of 2636 1868 prffpnj.exe 41 PID 1868 wrote to memory of 2636 1868 prffpnj.exe 41 PID 1868 wrote to memory of 2636 1868 prffpnj.exe 41 PID 1868 wrote to memory of 2636 1868 prffpnj.exe 41 PID 2636 wrote to memory of 1648 2636 fffnlnh.exe 42 PID 2636 wrote to memory of 1648 2636 fffnlnh.exe 42 PID 2636 wrote to memory of 1648 2636 fffnlnh.exe 42 PID 2636 wrote to memory of 1648 2636 fffnlnh.exe 42 PID 1648 wrote to memory of 1296 1648 dbbfnn.exe 43 PID 1648 wrote to memory of 1296 1648 dbbfnn.exe 43 PID 1648 wrote to memory of 1296 1648 dbbfnn.exe 43 PID 1648 wrote to memory of 1296 1648 dbbfnn.exe 43 PID 1296 wrote to memory of 1992 1296 lndrxpl.exe 44 PID 1296 wrote to memory of 1992 1296 lndrxpl.exe 44 PID 1296 wrote to memory of 1992 1296 lndrxpl.exe 44 PID 1296 wrote to memory of 1992 1296 lndrxpl.exe 44 PID 1992 wrote to memory of 1608 1992 pnxbjdl.exe 45 PID 1992 wrote to memory of 1608 1992 pnxbjdl.exe 45 PID 1992 wrote to memory of 1608 1992 pnxbjdl.exe 45 PID 1992 wrote to memory of 1608 1992 pnxbjdl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\43b11c1aed3239751598eb1d50118576067accec4b0197a338b3205449cb6a1f.exe"C:\Users\Admin\AppData\Local\Temp\43b11c1aed3239751598eb1d50118576067accec4b0197a338b3205449cb6a1f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\xfpdv.exec:\xfpdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\rdhnxf.exec:\rdhnxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\pjxtn.exec:\pjxtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\bfxnfvd.exec:\bfxnfvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\rprnxn.exec:\rprnxn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\hpfpn.exec:\hpfpn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\ndxnl.exec:\ndxnl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\dltdtl.exec:\dltdtl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\hxpvt.exec:\hxpvt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\ltbvff.exec:\ltbvff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\prffpnj.exec:\prffpnj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\fffnlnh.exec:\fffnlnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\dbbfnn.exec:\dbbfnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\lndrxpl.exec:\lndrxpl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\pnxbjdl.exec:\pnxbjdl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\hlbbfnp.exec:\hlbbfnp.exe17⤵
- Executes dropped EXE
PID:1608 -
\??\c:\xfpld.exec:\xfpld.exe18⤵
- Executes dropped EXE
PID:1808 -
\??\c:\xrlpbtd.exec:\xrlpbtd.exe19⤵
- Executes dropped EXE
PID:1952 -
\??\c:\bfdrpl.exec:\bfdrpl.exe20⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ptftxp.exec:\ptftxp.exe21⤵
- Executes dropped EXE
PID:2324 -
\??\c:\dvjdbf.exec:\dvjdbf.exe22⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pbppb.exec:\pbppb.exe23⤵
- Executes dropped EXE
PID:1816 -
\??\c:\vrjrn.exec:\vrjrn.exe24⤵
- Executes dropped EXE
PID:2200 -
\??\c:\ppptn.exec:\ppptn.exe25⤵
- Executes dropped EXE
PID:1748 -
\??\c:\dnvnhl.exec:\dnvnhl.exe26⤵
- Executes dropped EXE
PID:964 -
\??\c:\fltxl.exec:\fltxl.exe27⤵
- Executes dropped EXE
PID:1752 -
\??\c:\ppttrvh.exec:\ppttrvh.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2140 -
\??\c:\jrtph.exec:\jrtph.exe29⤵
- Executes dropped EXE
PID:1364 -
\??\c:\jjjjln.exec:\jjjjln.exe30⤵
- Executes dropped EXE
PID:760 -
\??\c:\nhbllfp.exec:\nhbllfp.exe31⤵
- Executes dropped EXE
PID:1852 -
\??\c:\lvjrdx.exec:\lvjrdx.exe32⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jjdhpb.exec:\jjdhpb.exe33⤵
- Executes dropped EXE
PID:1732 -
\??\c:\pldxfr.exec:\pldxfr.exe34⤵
- Executes dropped EXE
PID:3068 -
\??\c:\vjfhr.exec:\vjfhr.exe35⤵
- Executes dropped EXE
PID:1564 -
\??\c:\jnvrdl.exec:\jnvrdl.exe36⤵
- Executes dropped EXE
PID:1300 -
\??\c:\xrjxfp.exec:\xrjxfp.exe37⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rpxhv.exec:\rpxhv.exe38⤵
- Executes dropped EXE
PID:2600 -
\??\c:\fhfvj.exec:\fhfvj.exe39⤵
- Executes dropped EXE
PID:1800 -
\??\c:\vbnrr.exec:\vbnrr.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\dddthp.exec:\dddthp.exe41⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xnndb.exec:\xnndb.exe42⤵
- Executes dropped EXE
PID:2940 -
\??\c:\fjbvnll.exec:\fjbvnll.exe43⤵
- Executes dropped EXE
PID:2804 -
\??\c:\dbbdbnt.exec:\dbbdbnt.exe44⤵
- Executes dropped EXE
PID:2952 -
\??\c:\bxrrp.exec:\bxrrp.exe45⤵
- Executes dropped EXE
PID:2844 -
\??\c:\xrlhtbb.exec:\xrlhtbb.exe46⤵
- Executes dropped EXE
PID:2824 -
\??\c:\xjnhdvh.exec:\xjnhdvh.exe47⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pdjtpb.exec:\pdjtpb.exe48⤵
- Executes dropped EXE
PID:1960 -
\??\c:\vtvjl.exec:\vtvjl.exe49⤵
- Executes dropped EXE
PID:1804 -
\??\c:\pjldnv.exec:\pjldnv.exe50⤵
- Executes dropped EXE
PID:1604 -
\??\c:\ftxjlt.exec:\ftxjlt.exe51⤵
- Executes dropped EXE
PID:1040 -
\??\c:\frpprjh.exec:\frpprjh.exe52⤵
- Executes dropped EXE
PID:1016 -
\??\c:\vrnjpt.exec:\vrnjpt.exe53⤵
- Executes dropped EXE
PID:1296 -
\??\c:\rpfjt.exec:\rpfjt.exe54⤵
- Executes dropped EXE
PID:2640 -
\??\c:\tdjllpl.exec:\tdjllpl.exe55⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nlxtph.exec:\nlxtph.exe56⤵
- Executes dropped EXE
PID:1964 -
\??\c:\tfvtndj.exec:\tfvtndj.exe57⤵
- Executes dropped EXE
PID:1948 -
\??\c:\lnndrx.exec:\lnndrx.exe58⤵
- Executes dropped EXE
PID:1148 -
\??\c:\rdvbxd.exec:\rdvbxd.exe59⤵
- Executes dropped EXE
PID:3052 -
\??\c:\npjdtb.exec:\npjdtb.exe60⤵
- Executes dropped EXE
PID:2996 -
\??\c:\phptld.exec:\phptld.exe61⤵
- Executes dropped EXE
PID:852 -
\??\c:\lrfbtnj.exec:\lrfbtnj.exe62⤵
- Executes dropped EXE
PID:2332 -
\??\c:\hdrbr.exec:\hdrbr.exe63⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hvbrd.exec:\hvbrd.exe64⤵
- Executes dropped EXE
PID:3016 -
\??\c:\jdbjvdt.exec:\jdbjvdt.exe65⤵
- Executes dropped EXE
PID:1104 -
\??\c:\ptrxhp.exec:\ptrxhp.exe66⤵PID:684
-
\??\c:\rldffd.exec:\rldffd.exe67⤵
- System Location Discovery: System Language Discovery
PID:1736 -
\??\c:\tdnrphf.exec:\tdnrphf.exe68⤵PID:3000
-
\??\c:\hvjvrdj.exec:\hvjvrdj.exe69⤵PID:1528
-
\??\c:\nxvvftv.exec:\nxvvftv.exe70⤵PID:1968
-
\??\c:\bttdj.exec:\bttdj.exe71⤵PID:2276
-
\??\c:\bbxtxrd.exec:\bbxtxrd.exe72⤵PID:1640
-
\??\c:\jhvxlbf.exec:\jhvxlbf.exe73⤵PID:1712
-
\??\c:\njnvl.exec:\njnvl.exe74⤵PID:308
-
\??\c:\pppjxdn.exec:\pppjxdn.exe75⤵PID:2280
-
\??\c:\hrvfrtd.exec:\hrvfrtd.exe76⤵PID:2128
-
\??\c:\vfnrlp.exec:\vfnrlp.exe77⤵PID:1268
-
\??\c:\hhnltbl.exec:\hhnltbl.exe78⤵PID:1972
-
\??\c:\vlptxfp.exec:\vlptxfp.exe79⤵PID:2500
-
\??\c:\pdlbdft.exec:\pdlbdft.exe80⤵PID:2028
-
\??\c:\bjhlxd.exec:\bjhlxd.exe81⤵PID:2424
-
\??\c:\dphntb.exec:\dphntb.exe82⤵PID:2156
-
\??\c:\xpbfljd.exec:\xpbfljd.exe83⤵PID:2568
-
\??\c:\vvxdhhb.exec:\vvxdhhb.exe84⤵PID:2660
-
\??\c:\hhbbvh.exec:\hhbbvh.exe85⤵PID:676
-
\??\c:\ldtttpb.exec:\ldtttpb.exe86⤵PID:2680
-
\??\c:\ndvvxfj.exec:\ndvvxfj.exe87⤵PID:2952
-
\??\c:\xxntxd.exec:\xxntxd.exe88⤵PID:2968
-
\??\c:\xfjnn.exec:\xfjnn.exe89⤵PID:2824
-
\??\c:\hptlfjn.exec:\hptlfjn.exe90⤵PID:2616
-
\??\c:\vffxx.exec:\vffxx.exe91⤵PID:1960
-
\??\c:\xjfvv.exec:\xjfvv.exe92⤵PID:2096
-
\??\c:\tvhvl.exec:\tvhvl.exe93⤵PID:1604
-
\??\c:\rnltpn.exec:\rnltpn.exe94⤵PID:1648
-
\??\c:\vbvdjl.exec:\vbvdjl.exe95⤵PID:1784
-
\??\c:\jdvbtfb.exec:\jdvbtfb.exe96⤵PID:1008
-
\??\c:\lxflrf.exec:\lxflrf.exe97⤵PID:2640
-
\??\c:\thppbpd.exec:\thppbpd.exe98⤵PID:1944
-
\??\c:\bbthxhn.exec:\bbthxhn.exe99⤵PID:3004
-
\??\c:\brnrnj.exec:\brnrnj.exe100⤵PID:2960
-
\??\c:\tfthj.exec:\tfthj.exe101⤵PID:2516
-
\??\c:\bjbjbfl.exec:\bjbjbfl.exe102⤵PID:2432
-
\??\c:\vnbprp.exec:\vnbprp.exe103⤵PID:3028
-
\??\c:\nhllfp.exec:\nhllfp.exe104⤵PID:2404
-
\??\c:\jlnpt.exec:\jlnpt.exe105⤵PID:2132
-
\??\c:\ppthpp.exec:\ppthpp.exe106⤵PID:616
-
\??\c:\brxfh.exec:\brxfh.exe107⤵PID:2548
-
\??\c:\dhhpndj.exec:\dhhpndj.exe108⤵PID:960
-
\??\c:\ldxvrdb.exec:\ldxvrdb.exe109⤵PID:1756
-
\??\c:\tdfvbdv.exec:\tdfvbdv.exe110⤵PID:1044
-
\??\c:\tvnhd.exec:\tvnhd.exe111⤵PID:268
-
\??\c:\dplbv.exec:\dplbv.exe112⤵PID:1580
-
\??\c:\rjtnld.exec:\rjtnld.exe113⤵PID:1620
-
\??\c:\fdddx.exec:\fdddx.exe114⤵
- System Location Discovery: System Language Discovery
PID:1760 -
\??\c:\trrvl.exec:\trrvl.exe115⤵PID:2252
-
\??\c:\ppxtp.exec:\ppxtp.exe116⤵PID:2264
-
\??\c:\jvxlf.exec:\jvxlf.exe117⤵PID:1732
-
\??\c:\rpldfdx.exec:\rpldfdx.exe118⤵PID:1660
-
\??\c:\tvldjx.exec:\tvldjx.exe119⤵PID:1540
-
\??\c:\pdnlvxn.exec:\pdnlvxn.exe120⤵PID:1320
-
\??\c:\ttfvvp.exec:\ttfvvp.exe121⤵PID:1328
-
\??\c:\nhhfxj.exec:\nhhfxj.exe122⤵PID:2396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-