Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 12:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
98e885c77bfdcbff6c3a471a8a8d63b5b80ecfb3d4aa7d11b484e927c45e98c7.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
98e885c77bfdcbff6c3a471a8a8d63b5b80ecfb3d4aa7d11b484e927c45e98c7.exe
-
Size
456KB
-
MD5
dd45be161226ddc9be6f300487e67102
-
SHA1
ea8d876b47b68a28e49eb2341b933c10305c95be
-
SHA256
98e885c77bfdcbff6c3a471a8a8d63b5b80ecfb3d4aa7d11b484e927c45e98c7
-
SHA512
7f1b9fe04e2d3009bef2b33f0b2cfe9100a29f06b4f8af880fb76a7bc85d646e064d59dabb09ab0641fd242a7494ab5c03523ed1a9403c1e54917b439a5794d9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRE:q7Tc2NYHUrAwfMp3CDRE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/1084-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-16-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2296-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/968-132-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2044-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-195-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2404-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/272-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-365-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2776-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-433-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/112-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-496-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2380-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2296 vrvnjhf.exe 2980 fldtvfr.exe 2924 fnpvx.exe 2884 tnjvd.exe 1892 xnptfn.exe 3032 brppjbd.exe 2892 hxhrxpr.exe 2836 rxfxlb.exe 2428 fdfhxp.exe 968 jttflbn.exe 2092 fxnbbf.exe 2100 hxbffd.exe 2044 bxfnx.exe 548 prnnfpx.exe 2252 vfdtjxt.exe 2372 lnbfxvx.exe 1080 dldhtf.exe 1748 jlpfpj.exe 2032 rrflp.exe 2220 xlndff.exe 2404 ptbtdjl.exe 2732 fdhdpnh.exe 924 jtdvrp.exe 1800 jptbxh.exe 272 vdnlvj.exe 2328 rjrdbdj.exe 2232 rhjtrr.exe 1756 rdlpv.exe 1604 jdjlvbl.exe 1616 thhxt.exe 2320 djfpfx.exe 876 btrtpn.exe 2264 rppvtrp.exe 2716 prrdpl.exe 2712 nvjxlh.exe 2472 dnpllt.exe 2656 jftlvn.exe 2888 vdhftl.exe 2912 pbvxlbd.exe 1684 ffjjnrh.exe 2164 rndjf.exe 580 hthrxp.exe 2776 jvnvhrj.exe 2900 jdffxn.exe 2204 prpnl.exe 1488 ppxfjb.exe 2200 hrlrp.exe 2188 nrvlv.exe 1136 hbdtn.exe 2100 pvhrbnv.exe 2180 jbbvxfh.exe 2540 btllh.exe 2104 rfftxh.exe 1208 fhjnvpf.exe 112 vjpfj.exe 2436 fbfrdx.exe 1748 dvffft.exe 1884 xlxnfj.exe 1512 blfhn.exe 2396 jldljbx.exe 1700 jxjfphv.exe 2380 tdhtr.exe 2664 jjxnd.exe 992 lldnvb.exe -
resource yara_rule behavioral1/memory/1084-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/968-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/272-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1136-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-531-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1084-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/968-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-753-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/324-780-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjxrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frjxrbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttfvpnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnvjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brtdddb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjhvpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlfdjff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtlbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txdrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvhtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnhpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dphhndf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlvfdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hffvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxfpvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntlpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbftd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvrnxdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbthhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnrjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdbnlhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxvjljf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rthpbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jllrft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpfpfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnhtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlldb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvnfhxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljtnhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvhtfrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdfnjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndnlvfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blblrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhjvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxblvbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjhnxxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrrxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjfnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhxxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jldjttj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvxvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptvlbrj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1084 wrote to memory of 2296 1084 98e885c77bfdcbff6c3a471a8a8d63b5b80ecfb3d4aa7d11b484e927c45e98c7.exe 30 PID 1084 wrote to memory of 2296 1084 98e885c77bfdcbff6c3a471a8a8d63b5b80ecfb3d4aa7d11b484e927c45e98c7.exe 30 PID 1084 wrote to memory of 2296 1084 98e885c77bfdcbff6c3a471a8a8d63b5b80ecfb3d4aa7d11b484e927c45e98c7.exe 30 PID 1084 wrote to memory of 2296 1084 98e885c77bfdcbff6c3a471a8a8d63b5b80ecfb3d4aa7d11b484e927c45e98c7.exe 30 PID 2296 wrote to memory of 2980 2296 vrvnjhf.exe 31 PID 2296 wrote to memory of 2980 2296 vrvnjhf.exe 31 PID 2296 wrote to memory of 2980 2296 vrvnjhf.exe 31 PID 2296 wrote to memory of 2980 2296 vrvnjhf.exe 31 PID 2980 wrote to memory of 2924 2980 fldtvfr.exe 32 PID 2980 wrote to memory of 2924 2980 fldtvfr.exe 32 PID 2980 wrote to memory of 2924 2980 fldtvfr.exe 32 PID 2980 wrote to memory of 2924 2980 fldtvfr.exe 32 PID 2924 wrote to memory of 2884 2924 fnpvx.exe 33 PID 2924 wrote to memory of 2884 2924 fnpvx.exe 33 PID 2924 wrote to memory of 2884 2924 fnpvx.exe 33 PID 2924 wrote to memory of 2884 2924 fnpvx.exe 33 PID 2884 wrote to memory of 1892 2884 tnjvd.exe 34 PID 2884 wrote to memory of 1892 2884 tnjvd.exe 34 PID 2884 wrote to memory of 1892 2884 tnjvd.exe 34 PID 2884 wrote to memory of 1892 2884 tnjvd.exe 34 PID 1892 wrote to memory of 3032 1892 xnptfn.exe 35 PID 1892 wrote to memory of 3032 1892 xnptfn.exe 35 PID 1892 wrote to memory of 3032 1892 xnptfn.exe 35 PID 1892 wrote to memory of 3032 1892 xnptfn.exe 35 PID 3032 wrote to memory of 2892 3032 brppjbd.exe 36 PID 3032 wrote to memory of 2892 3032 brppjbd.exe 36 PID 3032 wrote to memory of 2892 3032 brppjbd.exe 36 PID 3032 wrote to memory of 2892 3032 brppjbd.exe 36 PID 2892 wrote to memory of 2836 2892 hxhrxpr.exe 37 PID 2892 wrote to memory of 2836 2892 hxhrxpr.exe 37 PID 2892 wrote to memory of 2836 2892 hxhrxpr.exe 37 PID 2892 wrote to memory of 2836 2892 hxhrxpr.exe 37 PID 2836 wrote to memory of 2428 2836 rxfxlb.exe 38 PID 2836 wrote to memory of 2428 2836 rxfxlb.exe 38 PID 2836 wrote to memory of 2428 2836 rxfxlb.exe 38 PID 2836 wrote to memory of 2428 2836 rxfxlb.exe 38 PID 2428 wrote to memory of 968 2428 fdfhxp.exe 39 PID 2428 wrote to memory of 968 2428 fdfhxp.exe 39 PID 2428 wrote to memory of 968 2428 fdfhxp.exe 39 PID 2428 wrote to memory of 968 2428 fdfhxp.exe 39 PID 968 wrote to memory of 2092 968 jttflbn.exe 40 PID 968 wrote to memory of 2092 968 jttflbn.exe 40 PID 968 wrote to memory of 2092 968 jttflbn.exe 40 PID 968 wrote to memory of 2092 968 jttflbn.exe 40 PID 2092 wrote to memory of 2100 2092 fxnbbf.exe 41 PID 2092 wrote to memory of 2100 2092 fxnbbf.exe 41 PID 2092 wrote to memory of 2100 2092 fxnbbf.exe 41 PID 2092 wrote to memory of 2100 2092 fxnbbf.exe 41 PID 2100 wrote to memory of 2044 2100 hxbffd.exe 42 PID 2100 wrote to memory of 2044 2100 hxbffd.exe 42 PID 2100 wrote to memory of 2044 2100 hxbffd.exe 42 PID 2100 wrote to memory of 2044 2100 hxbffd.exe 42 PID 2044 wrote to memory of 548 2044 bxfnx.exe 43 PID 2044 wrote to memory of 548 2044 bxfnx.exe 43 PID 2044 wrote to memory of 548 2044 bxfnx.exe 43 PID 2044 wrote to memory of 548 2044 bxfnx.exe 43 PID 548 wrote to memory of 2252 548 prnnfpx.exe 44 PID 548 wrote to memory of 2252 548 prnnfpx.exe 44 PID 548 wrote to memory of 2252 548 prnnfpx.exe 44 PID 548 wrote to memory of 2252 548 prnnfpx.exe 44 PID 2252 wrote to memory of 2372 2252 vfdtjxt.exe 45 PID 2252 wrote to memory of 2372 2252 vfdtjxt.exe 45 PID 2252 wrote to memory of 2372 2252 vfdtjxt.exe 45 PID 2252 wrote to memory of 2372 2252 vfdtjxt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\98e885c77bfdcbff6c3a471a8a8d63b5b80ecfb3d4aa7d11b484e927c45e98c7.exe"C:\Users\Admin\AppData\Local\Temp\98e885c77bfdcbff6c3a471a8a8d63b5b80ecfb3d4aa7d11b484e927c45e98c7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\vrvnjhf.exec:\vrvnjhf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\fldtvfr.exec:\fldtvfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\fnpvx.exec:\fnpvx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\tnjvd.exec:\tnjvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\xnptfn.exec:\xnptfn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\brppjbd.exec:\brppjbd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\hxhrxpr.exec:\hxhrxpr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\rxfxlb.exec:\rxfxlb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\fdfhxp.exec:\fdfhxp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\jttflbn.exec:\jttflbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\fxnbbf.exec:\fxnbbf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\hxbffd.exec:\hxbffd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\bxfnx.exec:\bxfnx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\prnnfpx.exec:\prnnfpx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\vfdtjxt.exec:\vfdtjxt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\lnbfxvx.exec:\lnbfxvx.exe17⤵
- Executes dropped EXE
PID:2372 -
\??\c:\dldhtf.exec:\dldhtf.exe18⤵
- Executes dropped EXE
PID:1080 -
\??\c:\jlpfpj.exec:\jlpfpj.exe19⤵
- Executes dropped EXE
PID:1748 -
\??\c:\rrflp.exec:\rrflp.exe20⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xlndff.exec:\xlndff.exe21⤵
- Executes dropped EXE
PID:2220 -
\??\c:\ptbtdjl.exec:\ptbtdjl.exe22⤵
- Executes dropped EXE
PID:2404 -
\??\c:\fdhdpnh.exec:\fdhdpnh.exe23⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jtdvrp.exec:\jtdvrp.exe24⤵
- Executes dropped EXE
PID:924 -
\??\c:\jptbxh.exec:\jptbxh.exe25⤵
- Executes dropped EXE
PID:1800 -
\??\c:\vdnlvj.exec:\vdnlvj.exe26⤵
- Executes dropped EXE
PID:272 -
\??\c:\rjrdbdj.exec:\rjrdbdj.exe27⤵
- Executes dropped EXE
PID:2328 -
\??\c:\rhjtrr.exec:\rhjtrr.exe28⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rdlpv.exec:\rdlpv.exe29⤵
- Executes dropped EXE
PID:1756 -
\??\c:\jdjlvbl.exec:\jdjlvbl.exe30⤵
- Executes dropped EXE
PID:1604 -
\??\c:\thhxt.exec:\thhxt.exe31⤵
- Executes dropped EXE
PID:1616 -
\??\c:\djfpfx.exec:\djfpfx.exe32⤵
- Executes dropped EXE
PID:2320 -
\??\c:\btrtpn.exec:\btrtpn.exe33⤵
- Executes dropped EXE
PID:876 -
\??\c:\rppvtrp.exec:\rppvtrp.exe34⤵
- Executes dropped EXE
PID:2264 -
\??\c:\prrdpl.exec:\prrdpl.exe35⤵
- Executes dropped EXE
PID:2716 -
\??\c:\nvjxlh.exec:\nvjxlh.exe36⤵
- Executes dropped EXE
PID:2712 -
\??\c:\dnpllt.exec:\dnpllt.exe37⤵
- Executes dropped EXE
PID:2472 -
\??\c:\jftlvn.exec:\jftlvn.exe38⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vdhftl.exec:\vdhftl.exe39⤵
- Executes dropped EXE
PID:2888 -
\??\c:\pbvxlbd.exec:\pbvxlbd.exe40⤵
- Executes dropped EXE
PID:2912 -
\??\c:\ffjjnrh.exec:\ffjjnrh.exe41⤵
- Executes dropped EXE
PID:1684 -
\??\c:\rndjf.exec:\rndjf.exe42⤵
- Executes dropped EXE
PID:2164 -
\??\c:\hthrxp.exec:\hthrxp.exe43⤵
- Executes dropped EXE
PID:580 -
\??\c:\jvnvhrj.exec:\jvnvhrj.exe44⤵
- Executes dropped EXE
PID:2776 -
\??\c:\jdffxn.exec:\jdffxn.exe45⤵
- Executes dropped EXE
PID:2900 -
\??\c:\prpnl.exec:\prpnl.exe46⤵
- Executes dropped EXE
PID:2204 -
\??\c:\ppxfjb.exec:\ppxfjb.exe47⤵
- Executes dropped EXE
PID:1488 -
\??\c:\hrlrp.exec:\hrlrp.exe48⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nrvlv.exec:\nrvlv.exe49⤵
- Executes dropped EXE
PID:2188 -
\??\c:\hbdtn.exec:\hbdtn.exe50⤵
- Executes dropped EXE
PID:1136 -
\??\c:\pvhrbnv.exec:\pvhrbnv.exe51⤵
- Executes dropped EXE
PID:2100 -
\??\c:\jbbvxfh.exec:\jbbvxfh.exe52⤵
- Executes dropped EXE
PID:2180 -
\??\c:\btllh.exec:\btllh.exe53⤵
- Executes dropped EXE
PID:2540 -
\??\c:\rfftxh.exec:\rfftxh.exe54⤵
- Executes dropped EXE
PID:2104 -
\??\c:\fhjnvpf.exec:\fhjnvpf.exe55⤵
- Executes dropped EXE
PID:1208 -
\??\c:\vjpfj.exec:\vjpfj.exe56⤵
- Executes dropped EXE
PID:112 -
\??\c:\fbfrdx.exec:\fbfrdx.exe57⤵
- Executes dropped EXE
PID:2436 -
\??\c:\dvffft.exec:\dvffft.exe58⤵
- Executes dropped EXE
PID:1748 -
\??\c:\xlxnfj.exec:\xlxnfj.exe59⤵
- Executes dropped EXE
PID:1884 -
\??\c:\blfhn.exec:\blfhn.exe60⤵
- Executes dropped EXE
PID:1512 -
\??\c:\jldljbx.exec:\jldljbx.exe61⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jxjfphv.exec:\jxjfphv.exe62⤵
- Executes dropped EXE
PID:1700 -
\??\c:\tdhtr.exec:\tdhtr.exe63⤵
- Executes dropped EXE
PID:2380 -
\??\c:\jjxnd.exec:\jjxnd.exe64⤵
- Executes dropped EXE
PID:2664 -
\??\c:\lldnvb.exec:\lldnvb.exe65⤵
- Executes dropped EXE
PID:992 -
\??\c:\fffptdp.exec:\fffptdp.exe66⤵PID:1500
-
\??\c:\hlpntp.exec:\hlpntp.exe67⤵PID:272
-
\??\c:\hlvfdb.exec:\hlvfdb.exe68⤵
- System Location Discovery: System Language Discovery
PID:1632 -
\??\c:\vvntp.exec:\vvntp.exe69⤵PID:1580
-
\??\c:\xbdvvbn.exec:\xbdvvbn.exe70⤵PID:1004
-
\??\c:\fnxvnxp.exec:\fnxvnxp.exe71⤵PID:2124
-
\??\c:\fdfbhhr.exec:\fdfbhhr.exe72⤵PID:2136
-
\??\c:\hrvlhnv.exec:\hrvlhnv.exe73⤵PID:2036
-
\??\c:\ddlht.exec:\ddlht.exe74⤵PID:1712
-
\??\c:\rpvhxr.exec:\rpvhxr.exe75⤵PID:876
-
\??\c:\dvhtfrt.exec:\dvhtfrt.exe76⤵
- System Location Discovery: System Language Discovery
PID:1084 -
\??\c:\lhlvv.exec:\lhlvv.exe77⤵PID:1560
-
\??\c:\jpbbhx.exec:\jpbbhx.exe78⤵PID:2564
-
\??\c:\ptfjh.exec:\ptfjh.exe79⤵PID:2116
-
\??\c:\nvttp.exec:\nvttp.exe80⤵PID:3008
-
\??\c:\ttjlvp.exec:\ttjlvp.exe81⤵PID:2280
-
\??\c:\xdbnvpd.exec:\xdbnvpd.exe82⤵PID:2888
-
\??\c:\bnhpr.exec:\bnhpr.exe83⤵PID:2784
-
\??\c:\nfhpdfh.exec:\nfhpdfh.exe84⤵PID:2800
-
\??\c:\bndrfx.exec:\bndrfx.exe85⤵PID:2944
-
\??\c:\fnbhr.exec:\fnbhr.exe86⤵PID:2808
-
\??\c:\rlnvpx.exec:\rlnvpx.exe87⤵PID:2776
-
\??\c:\vlfhbbr.exec:\vlfhbbr.exe88⤵PID:2612
-
\??\c:\vppvv.exec:\vppvv.exe89⤵PID:2168
-
\??\c:\phtdvp.exec:\phtdvp.exe90⤵PID:968
-
\??\c:\rtdjrvh.exec:\rtdjrvh.exe91⤵PID:2412
-
\??\c:\xhdvv.exec:\xhdvv.exe92⤵PID:2608
-
\??\c:\ptxlpp.exec:\ptxlpp.exe93⤵PID:1612
-
\??\c:\plddp.exec:\plddp.exe94⤵PID:1232
-
\??\c:\xblvpn.exec:\xblvpn.exe95⤵PID:1180
-
\??\c:\dphhj.exec:\dphhj.exe96⤵PID:2692
-
\??\c:\ftxtv.exec:\ftxtv.exe97⤵PID:2248
-
\??\c:\dnhdntp.exec:\dnhdntp.exe98⤵PID:660
-
\??\c:\vjtbfv.exec:\vjtbfv.exe99⤵PID:1760
-
\??\c:\xrblppd.exec:\xrblppd.exe100⤵PID:1080
-
\??\c:\trvtj.exec:\trvtj.exe101⤵PID:456
-
\??\c:\rpbbh.exec:\rpbbh.exe102⤵PID:2432
-
\??\c:\jlnhp.exec:\jlnhp.exe103⤵PID:2220
-
\??\c:\rllllr.exec:\rllllr.exe104⤵PID:1960
-
\??\c:\xrvjlpn.exec:\xrvjlpn.exe105⤵PID:324
-
\??\c:\nfrrhv.exec:\nfrrhv.exe106⤵PID:1504
-
\??\c:\xnltll.exec:\xnltll.exe107⤵PID:1864
-
\??\c:\bptvxjl.exec:\bptvxjl.exe108⤵PID:2664
-
\??\c:\rrbnlh.exec:\rrbnlh.exe109⤵PID:2452
-
\??\c:\jtjdx.exec:\jtjdx.exe110⤵PID:756
-
\??\c:\lxtnjl.exec:\lxtnjl.exe111⤵PID:2336
-
\??\c:\dhftlfn.exec:\dhftlfn.exe112⤵PID:1688
-
\??\c:\njpbdjn.exec:\njpbdjn.exe113⤵PID:1812
-
\??\c:\jfnbdtb.exec:\jfnbdtb.exe114⤵PID:1004
-
\??\c:\hpnxr.exec:\hpnxr.exe115⤵PID:2384
-
\??\c:\pnvfhrv.exec:\pnvfhrv.exe116⤵PID:2364
-
\??\c:\nnhnhl.exec:\nnhnhl.exe117⤵PID:2348
-
\??\c:\fltlhvn.exec:\fltlhvn.exe118⤵PID:1908
-
\??\c:\xdlxd.exec:\xdlxd.exe119⤵PID:2700
-
\??\c:\djbftn.exec:\djbftn.exe120⤵PID:2716
-
\??\c:\npjxhl.exec:\npjxhl.exe121⤵PID:2712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-