Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 14:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5451285e1b1c8200dd0e172ef2a4c3f752b949ff724c60865067ff7c84b54d99.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
5451285e1b1c8200dd0e172ef2a4c3f752b949ff724c60865067ff7c84b54d99.exe
-
Size
456KB
-
MD5
21d91a165fd73477d96156e970f81c99
-
SHA1
56b1c7b662e31a5172176fd1dd437c1724e80da2
-
SHA256
5451285e1b1c8200dd0e172ef2a4c3f752b949ff724c60865067ff7c84b54d99
-
SHA512
e6206520f8daa58b67a1f2d3128befd74af1f3a5aab006bd065822f61a1c6964c22b299c706c9a175790588097a832fe6719ea9194d30c41f26280761802b0ed
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbely:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2776-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-44-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2692-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/108-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-101-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1672-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-176-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2388-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/732-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-277-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/664-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-305-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1588-300-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2892-308-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2924-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-328-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-414-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1784-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1460-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-460-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1392-520-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1392-518-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1232-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-599-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2708-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1196-657-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-664-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1704-857-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-870-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2792-889-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-926-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1860-927-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2876 nnvlnh.exe 2676 vvljhjb.exe 2900 rhfjp.exe 2692 tvlvh.exe 2724 jprnx.exe 1668 nlftdx.exe 2104 hjfbp.exe 916 pthtbbn.exe 108 blnphdl.exe 2212 vbhbd.exe 1924 vndrvt.exe 1672 bnffllf.exe 3008 bvltx.exe 908 tjxjb.exe 1944 nfnrjn.exe 760 vnllr.exe 2136 dfhdt.exe 2388 jldnph.exe 2192 jrjtfbd.exe 2516 rlprxj.exe 2244 hvtfr.exe 1616 bftfbv.exe 732 dtjtn.exe 2560 lldfjvb.exe 1512 bldjt.exe 736 lxnvb.exe 1736 tpvpbv.exe 1588 nnxxn.exe 1752 nhhprxv.exe 664 rlxltp.exe 2480 jdrrpb.exe 2296 jffvxnv.exe 2892 tfbjv.exe 2924 vtbdnd.exe 2828 xxfrv.exe 2228 xjvvrt.exe 2804 pxhnxv.exe 2884 rlrxblf.exe 2700 drdfh.exe 2724 vdjhlv.exe 1668 rtntnt.exe 2172 txhnd.exe 2004 xjtldd.exe 912 tjhhhjp.exe 1872 tdnbv.exe 2260 jbpdpdt.exe 1372 nrfbb.exe 1924 drnhvxb.exe 1672 flvbf.exe 2132 njpfnl.exe 1784 htlfpx.exe 1460 rnrnh.exe 2024 nhjhl.exe 2368 tjdfdvn.exe 2180 tjdrfdn.exe 1124 vlthjd.exe 2608 dnhjfbx.exe 2192 blhnnf.exe 956 pxnxltf.exe 828 blxvr.exe 2444 xfdjpj.exe 1616 lbrlvb.exe 1720 rfdfdbh.exe 1392 jhflnnn.exe -
resource yara_rule behavioral1/memory/2776-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-44-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2692-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/732-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/732-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-277-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/664-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-414-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1784-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-815-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-857-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-889-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbjtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxrrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blhfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxvrbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhnlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltdpdxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfbjxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfnndl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlxbntf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blttfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldldxbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxltp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrdnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvrhrhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrrxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jffvxnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrhnvtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxbnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtnxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljjfbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntvnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnhrnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnvnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnxbpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbrbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfjxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdbxph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlrxxxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhrpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlftdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtjtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxfth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxvxnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpftdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxfxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbdtxtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppvnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrpph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxrdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjlxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnvvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bljvpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrnpnrf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2776 wrote to memory of 2876 2776 5451285e1b1c8200dd0e172ef2a4c3f752b949ff724c60865067ff7c84b54d99.exe 30 PID 2776 wrote to memory of 2876 2776 5451285e1b1c8200dd0e172ef2a4c3f752b949ff724c60865067ff7c84b54d99.exe 30 PID 2776 wrote to memory of 2876 2776 5451285e1b1c8200dd0e172ef2a4c3f752b949ff724c60865067ff7c84b54d99.exe 30 PID 2776 wrote to memory of 2876 2776 5451285e1b1c8200dd0e172ef2a4c3f752b949ff724c60865067ff7c84b54d99.exe 30 PID 2876 wrote to memory of 2676 2876 nnvlnh.exe 31 PID 2876 wrote to memory of 2676 2876 nnvlnh.exe 31 PID 2876 wrote to memory of 2676 2876 nnvlnh.exe 31 PID 2876 wrote to memory of 2676 2876 nnvlnh.exe 31 PID 2676 wrote to memory of 2900 2676 vvljhjb.exe 32 PID 2676 wrote to memory of 2900 2676 vvljhjb.exe 32 PID 2676 wrote to memory of 2900 2676 vvljhjb.exe 32 PID 2676 wrote to memory of 2900 2676 vvljhjb.exe 32 PID 2900 wrote to memory of 2692 2900 rhfjp.exe 33 PID 2900 wrote to memory of 2692 2900 rhfjp.exe 33 PID 2900 wrote to memory of 2692 2900 rhfjp.exe 33 PID 2900 wrote to memory of 2692 2900 rhfjp.exe 33 PID 2692 wrote to memory of 2724 2692 tvlvh.exe 34 PID 2692 wrote to memory of 2724 2692 tvlvh.exe 34 PID 2692 wrote to memory of 2724 2692 tvlvh.exe 34 PID 2692 wrote to memory of 2724 2692 tvlvh.exe 34 PID 2724 wrote to memory of 1668 2724 jprnx.exe 35 PID 2724 wrote to memory of 1668 2724 jprnx.exe 35 PID 2724 wrote to memory of 1668 2724 jprnx.exe 35 PID 2724 wrote to memory of 1668 2724 jprnx.exe 35 PID 1668 wrote to memory of 2104 1668 nlftdx.exe 36 PID 1668 wrote to memory of 2104 1668 nlftdx.exe 36 PID 1668 wrote to memory of 2104 1668 nlftdx.exe 36 PID 1668 wrote to memory of 2104 1668 nlftdx.exe 36 PID 2104 wrote to memory of 916 2104 hjfbp.exe 37 PID 2104 wrote to memory of 916 2104 hjfbp.exe 37 PID 2104 wrote to memory of 916 2104 hjfbp.exe 37 PID 2104 wrote to memory of 916 2104 hjfbp.exe 37 PID 916 wrote to memory of 108 916 pthtbbn.exe 38 PID 916 wrote to memory of 108 916 pthtbbn.exe 38 PID 916 wrote to memory of 108 916 pthtbbn.exe 38 PID 916 wrote to memory of 108 916 pthtbbn.exe 38 PID 108 wrote to memory of 2212 108 blnphdl.exe 39 PID 108 wrote to memory of 2212 108 blnphdl.exe 39 PID 108 wrote to memory of 2212 108 blnphdl.exe 39 PID 108 wrote to memory of 2212 108 blnphdl.exe 39 PID 2212 wrote to memory of 1924 2212 vbhbd.exe 40 PID 2212 wrote to memory of 1924 2212 vbhbd.exe 40 PID 2212 wrote to memory of 1924 2212 vbhbd.exe 40 PID 2212 wrote to memory of 1924 2212 vbhbd.exe 40 PID 1924 wrote to memory of 1672 1924 vndrvt.exe 41 PID 1924 wrote to memory of 1672 1924 vndrvt.exe 41 PID 1924 wrote to memory of 1672 1924 vndrvt.exe 41 PID 1924 wrote to memory of 1672 1924 vndrvt.exe 41 PID 1672 wrote to memory of 3008 1672 bnffllf.exe 42 PID 1672 wrote to memory of 3008 1672 bnffllf.exe 42 PID 1672 wrote to memory of 3008 1672 bnffllf.exe 42 PID 1672 wrote to memory of 3008 1672 bnffllf.exe 42 PID 3008 wrote to memory of 908 3008 bvltx.exe 43 PID 3008 wrote to memory of 908 3008 bvltx.exe 43 PID 3008 wrote to memory of 908 3008 bvltx.exe 43 PID 3008 wrote to memory of 908 3008 bvltx.exe 43 PID 908 wrote to memory of 1944 908 tjxjb.exe 44 PID 908 wrote to memory of 1944 908 tjxjb.exe 44 PID 908 wrote to memory of 1944 908 tjxjb.exe 44 PID 908 wrote to memory of 1944 908 tjxjb.exe 44 PID 1944 wrote to memory of 760 1944 nfnrjn.exe 45 PID 1944 wrote to memory of 760 1944 nfnrjn.exe 45 PID 1944 wrote to memory of 760 1944 nfnrjn.exe 45 PID 1944 wrote to memory of 760 1944 nfnrjn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5451285e1b1c8200dd0e172ef2a4c3f752b949ff724c60865067ff7c84b54d99.exe"C:\Users\Admin\AppData\Local\Temp\5451285e1b1c8200dd0e172ef2a4c3f752b949ff724c60865067ff7c84b54d99.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\nnvlnh.exec:\nnvlnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\vvljhjb.exec:\vvljhjb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\rhfjp.exec:\rhfjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\tvlvh.exec:\tvlvh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\jprnx.exec:\jprnx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\nlftdx.exec:\nlftdx.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\hjfbp.exec:\hjfbp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\pthtbbn.exec:\pthtbbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\blnphdl.exec:\blnphdl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
\??\c:\vbhbd.exec:\vbhbd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\vndrvt.exec:\vndrvt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\bnffllf.exec:\bnffllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\bvltx.exec:\bvltx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\tjxjb.exec:\tjxjb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\nfnrjn.exec:\nfnrjn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\vnllr.exec:\vnllr.exe17⤵
- Executes dropped EXE
PID:760 -
\??\c:\dfhdt.exec:\dfhdt.exe18⤵
- Executes dropped EXE
PID:2136 -
\??\c:\jldnph.exec:\jldnph.exe19⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jrjtfbd.exec:\jrjtfbd.exe20⤵
- Executes dropped EXE
PID:2192 -
\??\c:\rlprxj.exec:\rlprxj.exe21⤵
- Executes dropped EXE
PID:2516 -
\??\c:\hvtfr.exec:\hvtfr.exe22⤵
- Executes dropped EXE
PID:2244 -
\??\c:\bftfbv.exec:\bftfbv.exe23⤵
- Executes dropped EXE
PID:1616 -
\??\c:\dtjtn.exec:\dtjtn.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:732 -
\??\c:\lldfjvb.exec:\lldfjvb.exe25⤵
- Executes dropped EXE
PID:2560 -
\??\c:\bldjt.exec:\bldjt.exe26⤵
- Executes dropped EXE
PID:1512 -
\??\c:\lxnvb.exec:\lxnvb.exe27⤵
- Executes dropped EXE
PID:736 -
\??\c:\tpvpbv.exec:\tpvpbv.exe28⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nnxxn.exec:\nnxxn.exe29⤵
- Executes dropped EXE
PID:1588 -
\??\c:\nhhprxv.exec:\nhhprxv.exe30⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rlxltp.exec:\rlxltp.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:664 -
\??\c:\jdrrpb.exec:\jdrrpb.exe32⤵
- Executes dropped EXE
PID:2480 -
\??\c:\jffvxnv.exec:\jffvxnv.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2296 -
\??\c:\tfbjv.exec:\tfbjv.exe34⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vtbdnd.exec:\vtbdnd.exe35⤵
- Executes dropped EXE
PID:2924 -
\??\c:\xxfrv.exec:\xxfrv.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2828 -
\??\c:\xjvvrt.exec:\xjvvrt.exe37⤵
- Executes dropped EXE
PID:2228 -
\??\c:\pxhnxv.exec:\pxhnxv.exe38⤵
- Executes dropped EXE
PID:2804 -
\??\c:\rlrxblf.exec:\rlrxblf.exe39⤵
- Executes dropped EXE
PID:2884 -
\??\c:\drdfh.exec:\drdfh.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vdjhlv.exec:\vdjhlv.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rtntnt.exec:\rtntnt.exe42⤵
- Executes dropped EXE
PID:1668 -
\??\c:\txhnd.exec:\txhnd.exe43⤵
- Executes dropped EXE
PID:2172 -
\??\c:\xjtldd.exec:\xjtldd.exe44⤵
- Executes dropped EXE
PID:2004 -
\??\c:\tjhhhjp.exec:\tjhhhjp.exe45⤵
- Executes dropped EXE
PID:912 -
\??\c:\tdnbv.exec:\tdnbv.exe46⤵
- Executes dropped EXE
PID:1872 -
\??\c:\jbpdpdt.exec:\jbpdpdt.exe47⤵
- Executes dropped EXE
PID:2260 -
\??\c:\nrfbb.exec:\nrfbb.exe48⤵
- Executes dropped EXE
PID:1372 -
\??\c:\drnhvxb.exec:\drnhvxb.exe49⤵
- Executes dropped EXE
PID:1924 -
\??\c:\flvbf.exec:\flvbf.exe50⤵
- Executes dropped EXE
PID:1672 -
\??\c:\njpfnl.exec:\njpfnl.exe51⤵
- Executes dropped EXE
PID:2132 -
\??\c:\htlfpx.exec:\htlfpx.exe52⤵
- Executes dropped EXE
PID:1784 -
\??\c:\rnrnh.exec:\rnrnh.exe53⤵
- Executes dropped EXE
PID:1460 -
\??\c:\nhjhl.exec:\nhjhl.exe54⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tjdfdvn.exec:\tjdfdvn.exe55⤵
- Executes dropped EXE
PID:2368 -
\??\c:\tjdrfdn.exec:\tjdrfdn.exe56⤵
- Executes dropped EXE
PID:2180 -
\??\c:\vlthjd.exec:\vlthjd.exe57⤵
- Executes dropped EXE
PID:1124 -
\??\c:\dnhjfbx.exec:\dnhjfbx.exe58⤵
- Executes dropped EXE
PID:2608 -
\??\c:\blhnnf.exec:\blhnnf.exe59⤵
- Executes dropped EXE
PID:2192 -
\??\c:\pxnxltf.exec:\pxnxltf.exe60⤵
- Executes dropped EXE
PID:956 -
\??\c:\blxvr.exec:\blxvr.exe61⤵
- Executes dropped EXE
PID:828 -
\??\c:\xfdjpj.exec:\xfdjpj.exe62⤵
- Executes dropped EXE
PID:2444 -
\??\c:\lbrlvb.exec:\lbrlvb.exe63⤵
- Executes dropped EXE
PID:1616 -
\??\c:\rfdfdbh.exec:\rfdfdbh.exe64⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jhflnnn.exec:\jhflnnn.exe65⤵
- Executes dropped EXE
PID:1392 -
\??\c:\fbvbn.exec:\fbvbn.exe66⤵PID:568
-
\??\c:\xlbvtj.exec:\xlbvtj.exe67⤵PID:740
-
\??\c:\rprbj.exec:\rprbj.exe68⤵PID:2940
-
\??\c:\xtdvn.exec:\xtdvn.exe69⤵PID:588
-
\??\c:\vhhnn.exec:\vhhnn.exe70⤵
- System Location Discovery: System Language Discovery
PID:1232 -
\??\c:\jlhhj.exec:\jlhhj.exe71⤵PID:2304
-
\??\c:\txntx.exec:\txntx.exe72⤵PID:924
-
\??\c:\jrjxld.exec:\jrjxld.exe73⤵PID:2328
-
\??\c:\fljxv.exec:\fljxv.exe74⤵PID:2508
-
\??\c:\dxvxnl.exec:\dxvxnl.exe75⤵
- System Location Discovery: System Language Discovery
PID:2592 -
\??\c:\dpdft.exec:\dpdft.exe76⤵PID:2296
-
\??\c:\hjvfhfx.exec:\hjvfhfx.exe77⤵PID:2920
-
\??\c:\tlhpr.exec:\tlhpr.exe78⤵PID:2876
-
\??\c:\hbjdf.exec:\hbjdf.exe79⤵PID:2916
-
\??\c:\hhrpn.exec:\hhrpn.exe80⤵PID:3012
-
\??\c:\hrffj.exec:\hrffj.exe81⤵PID:2896
-
\??\c:\lnnjj.exec:\lnnjj.exe82⤵PID:2708
-
\??\c:\lhdjb.exec:\lhdjb.exe83⤵PID:2112
-
\??\c:\tnthrx.exec:\tnthrx.exe84⤵PID:2288
-
\??\c:\hltjbjl.exec:\hltjbjl.exe85⤵PID:2644
-
\??\c:\bjvjdvl.exec:\bjvjdvl.exe86⤵PID:1196
-
\??\c:\hhhdxj.exec:\hhhdxj.exe87⤵PID:1932
-
\??\c:\rttnv.exec:\rttnv.exe88⤵PID:2544
-
\??\c:\dvrnl.exec:\dvrnl.exe89⤵PID:2652
-
\??\c:\ljtxrdr.exec:\ljtxrdr.exe90⤵PID:1644
-
\??\c:\pjnlp.exec:\pjnlp.exe91⤵PID:2996
-
\??\c:\pbvfxdv.exec:\pbvfxdv.exe92⤵PID:2968
-
\??\c:\ldjxnjv.exec:\ldjxnjv.exe93⤵PID:2844
-
\??\c:\tpvtp.exec:\tpvtp.exe94⤵PID:1484
-
\??\c:\xxvtjd.exec:\xxvtjd.exe95⤵PID:2084
-
\??\c:\rtjdt.exec:\rtjdt.exe96⤵PID:700
-
\??\c:\blhfn.exec:\blhfn.exe97⤵
- System Location Discovery: System Language Discovery
PID:264 -
\??\c:\pflll.exec:\pflll.exe98⤵
- System Location Discovery: System Language Discovery
PID:2144 -
\??\c:\xhffpvh.exec:\xhffpvh.exe99⤵PID:2368
-
\??\c:\tbpvv.exec:\tbpvv.exe100⤵PID:2064
-
\??\c:\rvhnvv.exec:\rvhnvv.exe101⤵PID:2528
-
\??\c:\vtbvp.exec:\vtbvp.exe102⤵PID:1144
-
\??\c:\dhnxfjj.exec:\dhnxfjj.exe103⤵PID:520
-
\??\c:\nrbbpr.exec:\nrbbpr.exe104⤵PID:1576
-
\??\c:\vppvrxj.exec:\vppvrxj.exe105⤵PID:1280
-
\??\c:\tpddhn.exec:\tpddhn.exe106⤵PID:1680
-
\??\c:\rvdpxb.exec:\rvdpxb.exe107⤵PID:2124
-
\??\c:\dlrxxxb.exec:\dlrxxxb.exe108⤵
- System Location Discovery: System Language Discovery
PID:1916 -
\??\c:\ttbpllr.exec:\ttbpllr.exe109⤵PID:2560
-
\??\c:\pjvrft.exec:\pjvrft.exe110⤵PID:2536
-
\??\c:\rfldxbv.exec:\rfldxbv.exe111⤵PID:1548
-
\??\c:\nhfjt.exec:\nhfjt.exe112⤵PID:1816
-
\??\c:\pxdhhj.exec:\pxdhhj.exe113⤵PID:1736
-
\??\c:\bxftdpp.exec:\bxftdpp.exe114⤵PID:1588
-
\??\c:\pxffbj.exec:\pxffbj.exe115⤵PID:2624
-
\??\c:\rttdx.exec:\rttdx.exe116⤵PID:1064
-
\??\c:\ddptd.exec:\ddptd.exe117⤵PID:1704
-
\??\c:\htjffpj.exec:\htjffpj.exe118⤵PID:2480
-
\??\c:\hldft.exec:\hldft.exe119⤵PID:2864
-
\??\c:\vvthnnl.exec:\vvthnnl.exe120⤵PID:1580
-
\??\c:\jpdtjj.exec:\jpdtjj.exe121⤵PID:2892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-