Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 12:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
42b265fe652a9630774b55859cc2fce40916bc813a969e242941ecc0195f6022.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
42b265fe652a9630774b55859cc2fce40916bc813a969e242941ecc0195f6022.exe
-
Size
456KB
-
MD5
b67a6b8c5b78cac9621d1645f2cb99ae
-
SHA1
107d4292f50d6a9ed35b34a6fde28fdcf17613da
-
SHA256
42b265fe652a9630774b55859cc2fce40916bc813a969e242941ecc0195f6022
-
SHA512
e6a4135839b9387e60f73aa1abde72eebbf486a2141a922dfac637b7770e886cffcbc584f302e8b16ada8067063ea59ecabd3eaaa6407dfb041d2dbd2cb3759e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRM:q7Tc2NYHUrAwfMp3CDRM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2304-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-46-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2896-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-193-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1392-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/932-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-317-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2992-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-387-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2312-400-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3040-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-449-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1824-455-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1824-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/268-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-626-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2564-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-756-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2796-861-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2848-908-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2848-928-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2696-954-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2236 dxrrlp.exe 2980 pflrv.exe 2844 bhjrbr.exe 2876 lljtbh.exe 2896 dplbxtt.exe 2792 rnpdxjf.exe 2268 vlpbf.exe 2928 xlxnrrj.exe 2100 rjhjfv.exe 2500 ftrvt.exe 2532 nlxtllf.exe 2960 dnxjb.exe 3056 phfhr.exe 2292 xhpfv.exe 2092 vnrbb.exe 1028 fhxdnj.exe 1920 dhnvxpf.exe 2480 vxnhl.exe 2412 txpvvxr.exe 2328 xnrhbx.exe 2200 lfpdhhn.exe 1392 xhpjjrr.exe 1620 pdpjrlb.exe 2168 vbhnvv.exe 932 tbrlh.exe 1712 pdndh.exe 552 dhdptp.exe 1656 nhbprh.exe 1288 vfjpvh.exe 1384 xxxtlxh.exe 1876 hhxdj.exe 1276 djbhvf.exe 1716 hlfrlfd.exe 1752 lvhhvf.exe 1564 hvfvpb.exe 2860 fnbjn.exe 2864 jnhxbpd.exe 2992 lbnfpf.exe 2840 vjfbxj.exe 2264 bbdffnj.exe 2764 fvvljf.exe 2788 tdtvlfr.exe 2560 jthnnl.exe 1188 tfbfnf.exe 568 xbhnf.exe 2928 bfnjdn.exe 2312 fhrntfx.exe 2568 fbnjdxr.exe 2776 tblvjn.exe 2956 bnvdjxp.exe 3040 lhljbh.exe 856 hdnvvh.exe 2320 ljxvv.exe 2292 vhjrphr.exe 1248 vnlfpjp.exe 1824 pldnjdx.exe 1920 vnphjnf.exe 2192 xfjjjph.exe 2144 ddthhhr.exe 2076 bvvdpbd.exe 900 hxlxd.exe 2244 trlvbv.exe 268 jrhtbp.exe 604 dhfrj.exe -
resource yara_rule behavioral1/memory/2236-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-294-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1752-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-943-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-979-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrljjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrhpnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptlnvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvbpbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhnvxpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvnvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbnpnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blvtnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brjlbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbdfhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbhfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phldbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffljl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtttvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxrdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlnpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjplpvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrfdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxxhnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrnlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpbldb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxhpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htdph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxnrrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbvrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndtnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjbjxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpttlrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtbrlbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nphrhfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvfdfpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxfhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blvldvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxlrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njxfbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpfnvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxvtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrtvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvbrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppnrjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbdxhhj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2236 2304 42b265fe652a9630774b55859cc2fce40916bc813a969e242941ecc0195f6022.exe 29 PID 2304 wrote to memory of 2236 2304 42b265fe652a9630774b55859cc2fce40916bc813a969e242941ecc0195f6022.exe 29 PID 2304 wrote to memory of 2236 2304 42b265fe652a9630774b55859cc2fce40916bc813a969e242941ecc0195f6022.exe 29 PID 2304 wrote to memory of 2236 2304 42b265fe652a9630774b55859cc2fce40916bc813a969e242941ecc0195f6022.exe 29 PID 2236 wrote to memory of 2980 2236 dxrrlp.exe 30 PID 2236 wrote to memory of 2980 2236 dxrrlp.exe 30 PID 2236 wrote to memory of 2980 2236 dxrrlp.exe 30 PID 2236 wrote to memory of 2980 2236 dxrrlp.exe 30 PID 2980 wrote to memory of 2844 2980 pflrv.exe 31 PID 2980 wrote to memory of 2844 2980 pflrv.exe 31 PID 2980 wrote to memory of 2844 2980 pflrv.exe 31 PID 2980 wrote to memory of 2844 2980 pflrv.exe 31 PID 2844 wrote to memory of 2876 2844 bhjrbr.exe 32 PID 2844 wrote to memory of 2876 2844 bhjrbr.exe 32 PID 2844 wrote to memory of 2876 2844 bhjrbr.exe 32 PID 2844 wrote to memory of 2876 2844 bhjrbr.exe 32 PID 2876 wrote to memory of 2896 2876 lljtbh.exe 33 PID 2876 wrote to memory of 2896 2876 lljtbh.exe 33 PID 2876 wrote to memory of 2896 2876 lljtbh.exe 33 PID 2876 wrote to memory of 2896 2876 lljtbh.exe 33 PID 2896 wrote to memory of 2792 2896 dplbxtt.exe 34 PID 2896 wrote to memory of 2792 2896 dplbxtt.exe 34 PID 2896 wrote to memory of 2792 2896 dplbxtt.exe 34 PID 2896 wrote to memory of 2792 2896 dplbxtt.exe 34 PID 2792 wrote to memory of 2268 2792 rnpdxjf.exe 35 PID 2792 wrote to memory of 2268 2792 rnpdxjf.exe 35 PID 2792 wrote to memory of 2268 2792 rnpdxjf.exe 35 PID 2792 wrote to memory of 2268 2792 rnpdxjf.exe 35 PID 2268 wrote to memory of 2928 2268 vlpbf.exe 36 PID 2268 wrote to memory of 2928 2268 vlpbf.exe 36 PID 2268 wrote to memory of 2928 2268 vlpbf.exe 36 PID 2268 wrote to memory of 2928 2268 vlpbf.exe 36 PID 2928 wrote to memory of 2100 2928 xlxnrrj.exe 37 PID 2928 wrote to memory of 2100 2928 xlxnrrj.exe 37 PID 2928 wrote to memory of 2100 2928 xlxnrrj.exe 37 PID 2928 wrote to memory of 2100 2928 xlxnrrj.exe 37 PID 2100 wrote to memory of 2500 2100 rjhjfv.exe 38 PID 2100 wrote to memory of 2500 2100 rjhjfv.exe 38 PID 2100 wrote to memory of 2500 2100 rjhjfv.exe 38 PID 2100 wrote to memory of 2500 2100 rjhjfv.exe 38 PID 2500 wrote to memory of 2532 2500 ftrvt.exe 39 PID 2500 wrote to memory of 2532 2500 ftrvt.exe 39 PID 2500 wrote to memory of 2532 2500 ftrvt.exe 39 PID 2500 wrote to memory of 2532 2500 ftrvt.exe 39 PID 2532 wrote to memory of 2960 2532 nlxtllf.exe 40 PID 2532 wrote to memory of 2960 2532 nlxtllf.exe 40 PID 2532 wrote to memory of 2960 2532 nlxtllf.exe 40 PID 2532 wrote to memory of 2960 2532 nlxtllf.exe 40 PID 2960 wrote to memory of 3056 2960 dnxjb.exe 41 PID 2960 wrote to memory of 3056 2960 dnxjb.exe 41 PID 2960 wrote to memory of 3056 2960 dnxjb.exe 41 PID 2960 wrote to memory of 3056 2960 dnxjb.exe 41 PID 3056 wrote to memory of 2292 3056 phfhr.exe 42 PID 3056 wrote to memory of 2292 3056 phfhr.exe 42 PID 3056 wrote to memory of 2292 3056 phfhr.exe 42 PID 3056 wrote to memory of 2292 3056 phfhr.exe 42 PID 2292 wrote to memory of 2092 2292 xhpfv.exe 43 PID 2292 wrote to memory of 2092 2292 xhpfv.exe 43 PID 2292 wrote to memory of 2092 2292 xhpfv.exe 43 PID 2292 wrote to memory of 2092 2292 xhpfv.exe 43 PID 2092 wrote to memory of 1028 2092 vnrbb.exe 44 PID 2092 wrote to memory of 1028 2092 vnrbb.exe 44 PID 2092 wrote to memory of 1028 2092 vnrbb.exe 44 PID 2092 wrote to memory of 1028 2092 vnrbb.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\42b265fe652a9630774b55859cc2fce40916bc813a969e242941ecc0195f6022.exe"C:\Users\Admin\AppData\Local\Temp\42b265fe652a9630774b55859cc2fce40916bc813a969e242941ecc0195f6022.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\dxrrlp.exec:\dxrrlp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\pflrv.exec:\pflrv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\bhjrbr.exec:\bhjrbr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\lljtbh.exec:\lljtbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\dplbxtt.exec:\dplbxtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\rnpdxjf.exec:\rnpdxjf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\vlpbf.exec:\vlpbf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\xlxnrrj.exec:\xlxnrrj.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\rjhjfv.exec:\rjhjfv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\ftrvt.exec:\ftrvt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\nlxtllf.exec:\nlxtllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\dnxjb.exec:\dnxjb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\phfhr.exec:\phfhr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\xhpfv.exec:\xhpfv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\vnrbb.exec:\vnrbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\fhxdnj.exec:\fhxdnj.exe17⤵
- Executes dropped EXE
PID:1028 -
\??\c:\dhnvxpf.exec:\dhnvxpf.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1920 -
\??\c:\vxnhl.exec:\vxnhl.exe19⤵
- Executes dropped EXE
PID:2480 -
\??\c:\txpvvxr.exec:\txpvvxr.exe20⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xnrhbx.exec:\xnrhbx.exe21⤵
- Executes dropped EXE
PID:2328 -
\??\c:\lfpdhhn.exec:\lfpdhhn.exe22⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xhpjjrr.exec:\xhpjjrr.exe23⤵
- Executes dropped EXE
PID:1392 -
\??\c:\pdpjrlb.exec:\pdpjrlb.exe24⤵
- Executes dropped EXE
PID:1620 -
\??\c:\vbhnvv.exec:\vbhnvv.exe25⤵
- Executes dropped EXE
PID:2168 -
\??\c:\tbrlh.exec:\tbrlh.exe26⤵
- Executes dropped EXE
PID:932 -
\??\c:\pdndh.exec:\pdndh.exe27⤵
- Executes dropped EXE
PID:1712 -
\??\c:\dhdptp.exec:\dhdptp.exe28⤵
- Executes dropped EXE
PID:552 -
\??\c:\nhbprh.exec:\nhbprh.exe29⤵
- Executes dropped EXE
PID:1656 -
\??\c:\vfjpvh.exec:\vfjpvh.exe30⤵
- Executes dropped EXE
PID:1288 -
\??\c:\xxxtlxh.exec:\xxxtlxh.exe31⤵
- Executes dropped EXE
PID:1384 -
\??\c:\hhxdj.exec:\hhxdj.exe32⤵
- Executes dropped EXE
PID:1876 -
\??\c:\djbhvf.exec:\djbhvf.exe33⤵
- Executes dropped EXE
PID:1276 -
\??\c:\hlfrlfd.exec:\hlfrlfd.exe34⤵
- Executes dropped EXE
PID:1716 -
\??\c:\lvhhvf.exec:\lvhhvf.exe35⤵
- Executes dropped EXE
PID:1752 -
\??\c:\hvfvpb.exec:\hvfvpb.exe36⤵
- Executes dropped EXE
PID:1564 -
\??\c:\fnbjn.exec:\fnbjn.exe37⤵
- Executes dropped EXE
PID:2860 -
\??\c:\jnhxbpd.exec:\jnhxbpd.exe38⤵
- Executes dropped EXE
PID:2864 -
\??\c:\lbnfpf.exec:\lbnfpf.exe39⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vjfbxj.exec:\vjfbxj.exe40⤵
- Executes dropped EXE
PID:2840 -
\??\c:\bbdffnj.exec:\bbdffnj.exe41⤵
- Executes dropped EXE
PID:2264 -
\??\c:\fvvljf.exec:\fvvljf.exe42⤵
- Executes dropped EXE
PID:2764 -
\??\c:\tdtvlfr.exec:\tdtvlfr.exe43⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jthnnl.exec:\jthnnl.exe44⤵
- Executes dropped EXE
PID:2560 -
\??\c:\tfbfnf.exec:\tfbfnf.exe45⤵
- Executes dropped EXE
PID:1188 -
\??\c:\xbhnf.exec:\xbhnf.exe46⤵
- Executes dropped EXE
PID:568 -
\??\c:\bfnjdn.exec:\bfnjdn.exe47⤵
- Executes dropped EXE
PID:2928 -
\??\c:\fhrntfx.exec:\fhrntfx.exe48⤵
- Executes dropped EXE
PID:2312 -
\??\c:\fbnjdxr.exec:\fbnjdxr.exe49⤵
- Executes dropped EXE
PID:2568 -
\??\c:\tblvjn.exec:\tblvjn.exe50⤵
- Executes dropped EXE
PID:2776 -
\??\c:\bnvdjxp.exec:\bnvdjxp.exe51⤵
- Executes dropped EXE
PID:2956 -
\??\c:\lhljbh.exec:\lhljbh.exe52⤵
- Executes dropped EXE
PID:3040 -
\??\c:\hdnvvh.exec:\hdnvvh.exe53⤵
- Executes dropped EXE
PID:856 -
\??\c:\ljxvv.exec:\ljxvv.exe54⤵
- Executes dropped EXE
PID:2320 -
\??\c:\vhjrphr.exec:\vhjrphr.exe55⤵
- Executes dropped EXE
PID:2292 -
\??\c:\vnlfpjp.exec:\vnlfpjp.exe56⤵
- Executes dropped EXE
PID:1248 -
\??\c:\pldnjdx.exec:\pldnjdx.exe57⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vnphjnf.exec:\vnphjnf.exe58⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xfjjjph.exec:\xfjjjph.exe59⤵
- Executes dropped EXE
PID:2192 -
\??\c:\ddthhhr.exec:\ddthhhr.exe60⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bvvdpbd.exec:\bvvdpbd.exe61⤵
- Executes dropped EXE
PID:2076 -
\??\c:\hxlxd.exec:\hxlxd.exe62⤵
- Executes dropped EXE
PID:900 -
\??\c:\trlvbv.exec:\trlvbv.exe63⤵
- Executes dropped EXE
PID:2244 -
\??\c:\jrhtbp.exec:\jrhtbp.exe64⤵
- Executes dropped EXE
PID:268 -
\??\c:\dhfrj.exec:\dhfrj.exe65⤵
- Executes dropped EXE
PID:604 -
\??\c:\xjbhtfd.exec:\xjbhtfd.exe66⤵PID:948
-
\??\c:\jhdvblp.exec:\jhdvblp.exe67⤵PID:2672
-
\??\c:\drbnbdj.exec:\drbnbdj.exe68⤵PID:1512
-
\??\c:\ndhtj.exec:\ndhtj.exe69⤵PID:964
-
\??\c:\vbxfv.exec:\vbxfv.exe70⤵PID:928
-
\??\c:\xdljpjb.exec:\xdljpjb.exe71⤵PID:540
-
\??\c:\jlnjd.exec:\jlnjd.exe72⤵PID:916
-
\??\c:\rprhn.exec:\rprhn.exe73⤵PID:1048
-
\??\c:\tjdplld.exec:\tjdplld.exe74⤵PID:1760
-
\??\c:\tlphxp.exec:\tlphxp.exe75⤵PID:2652
-
\??\c:\lpfnvvv.exec:\lpfnvvv.exe76⤵
- System Location Discovery: System Language Discovery
PID:520 -
\??\c:\dlpjlj.exec:\dlpjlj.exe77⤵PID:868
-
\??\c:\pthvxt.exec:\pthvxt.exe78⤵PID:2344
-
\??\c:\blvldvt.exec:\blvldvt.exe79⤵
- System Location Discovery: System Language Discovery
PID:2856 -
\??\c:\blvtnht.exec:\blvtnht.exe80⤵
- System Location Discovery: System Language Discovery
PID:2424 -
\??\c:\nvlbjj.exec:\nvlbjj.exe81⤵PID:2988
-
\??\c:\hbvjtdx.exec:\hbvjtdx.exe82⤵PID:2860
-
\??\c:\lhjvbdp.exec:\lhjvbdp.exe83⤵PID:2484
-
\??\c:\nndfpbn.exec:\nndfpbn.exe84⤵PID:2752
-
\??\c:\djbhv.exec:\djbhv.exe85⤵PID:2756
-
\??\c:\vthxt.exec:\vthxt.exe86⤵PID:3000
-
\??\c:\vlplfxn.exec:\vlplfxn.exe87⤵PID:2896
-
\??\c:\trfdxj.exec:\trfdxj.exe88⤵PID:2768
-
\??\c:\dttrvx.exec:\dttrvx.exe89⤵PID:2560
-
\??\c:\hlvllr.exec:\hlvllr.exe90⤵PID:2564
-
\??\c:\ffpbd.exec:\ffpbd.exe91⤵PID:1576
-
\??\c:\phldbt.exec:\phldbt.exe92⤵
- System Location Discovery: System Language Discovery
PID:1396 -
\??\c:\ddhnxr.exec:\ddhnxr.exe93⤵PID:1748
-
\??\c:\nrlxrdb.exec:\nrlxrdb.exe94⤵PID:2964
-
\??\c:\rndjxld.exec:\rndjxld.exe95⤵PID:2704
-
\??\c:\rlpxvf.exec:\rlpxvf.exe96⤵PID:2960
-
\??\c:\pffjlln.exec:\pffjlln.exe97⤵PID:972
-
\??\c:\vnnvt.exec:\vnnvt.exe98⤵PID:3056
-
\??\c:\xppbd.exec:\xppbd.exe99⤵PID:2488
-
\??\c:\jxjhhxf.exec:\jxjhhxf.exe100⤵PID:2292
-
\??\c:\bvdpnjn.exec:\bvdpnjn.exe101⤵PID:1812
-
\??\c:\fvvlhl.exec:\fvvlhl.exe102⤵PID:2140
-
\??\c:\hjfxr.exec:\hjfxr.exe103⤵PID:2464
-
\??\c:\rlnpx.exec:\rlnpx.exe104⤵
- System Location Discovery: System Language Discovery
PID:2128 -
\??\c:\vdlxh.exec:\vdlxh.exe105⤵PID:572
-
\??\c:\xnffp.exec:\xnffp.exe106⤵PID:1584
-
\??\c:\dhvtxp.exec:\dhvtxp.exe107⤵PID:2456
-
\??\c:\llvjfv.exec:\llvjfv.exe108⤵PID:2504
-
\??\c:\dvvhpj.exec:\dvvhpj.exe109⤵PID:944
-
\??\c:\hfvvdj.exec:\hfvvdj.exe110⤵PID:1620
-
\??\c:\hdbxjx.exec:\hdbxjx.exe111⤵PID:1272
-
\??\c:\dlpvl.exec:\dlpvl.exe112⤵PID:1784
-
\??\c:\bbpfddn.exec:\bbpfddn.exe113⤵PID:1516
-
\??\c:\nbjnldl.exec:\nbjnldl.exe114⤵PID:1664
-
\??\c:\htrxt.exec:\htrxt.exe115⤵PID:552
-
\??\c:\btbrb.exec:\btbrb.exe116⤵PID:1776
-
\??\c:\hvlprpt.exec:\hvlprpt.exe117⤵PID:1680
-
\??\c:\bfdfb.exec:\bfdfb.exe118⤵PID:2340
-
\??\c:\fvvpb.exec:\fvvpb.exe119⤵PID:2796
-
\??\c:\fxdfdt.exec:\fxdfdt.exe120⤵PID:1816
-
\??\c:\rrhblh.exec:\rrhblh.exe121⤵PID:520
-
\??\c:\nrlfvl.exec:\nrlfvl.exe122⤵PID:1716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-