Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 14:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c01a20f70c987c2415a0cd0c73a90a014b38ee26ff78c30ee455d19f22cb0f5.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
7c01a20f70c987c2415a0cd0c73a90a014b38ee26ff78c30ee455d19f22cb0f5.exe
-
Size
454KB
-
MD5
7b0c9c367910c90454a69fb8b17421f5
-
SHA1
e7e20e03f5d4772b4e1859a787805f3ae49d9f13
-
SHA256
7c01a20f70c987c2415a0cd0c73a90a014b38ee26ff78c30ee455d19f22cb0f5
-
SHA512
7927fafebf36e08ec19eff9c3d723b1f5bee78bc90c7ea4f9a876a134eada76f66311e91f8f14ac79d2443e610a8c4934899ca70cb9671997178169a1dd6e200
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe3:q7Tc2NYHUrAwfMp3CD3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/1492-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/940-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-131-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1788-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1100-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-238-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/948-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-274-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2292-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-473-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1316-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/964-506-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1676-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-734-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2616 dbvlp.exe 3032 xhnjt.exe 2888 rvndtfp.exe 3008 xlltf.exe 2968 dntvxj.exe 2904 bnvdvl.exe 2764 lnnfbpp.exe 2744 xjflbpv.exe 2284 hbjjnnf.exe 940 bvtdblh.exe 2364 jlndfp.exe 2924 bdffdj.exe 2436 vdhrvv.exe 1788 lvxfl.exe 2560 dbbllpj.exe 1100 jtjvf.exe 1760 bdxvnjl.exe 2368 nrbnp.exe 2256 vxbvpv.exe 2700 brrjvv.exe 1784 lttnvd.exe 600 jnndnlh.exe 2160 brrtv.exe 2376 fhvllnl.exe 2480 lvtxdvt.exe 1556 plldvbn.exe 2304 bjrfxf.exe 596 ljlvxxb.exe 948 bdvpb.exe 1724 lfxln.exe 2124 bdrdpl.exe 2292 vfjvnhr.exe 2684 fbhjp.exe 1492 xvtxnn.exe 1632 tdvbn.exe 1720 pxtvjf.exe 1736 fdjpxdn.exe 2204 htfvntb.exe 2896 ppvvpph.exe 472 nnvfphd.exe 2412 plxrrr.exe 3012 bdnjlnd.exe 3052 lxhhn.exe 2756 dxlnvl.exe 1384 jxrnhvr.exe 2592 jvhtfbj.exe 2284 jrxrnv.exe 3068 lbnblb.exe 3044 lbltrhn.exe 2216 vxpthx.exe 2844 htvtfhh.exe 1192 bhnhvdf.exe 2840 vjlnvp.exe 1832 fhdtpt.exe 2040 hnrbnht.exe 908 jjrbflb.exe 1656 nlxxbv.exe 2344 bxvdhl.exe 1316 nrvndx.exe 2388 bjnhbnp.exe 2392 xbjbfx.exe 964 rpthpj.exe 2708 tfltbl.exe 2160 nfnfnpd.exe -
resource yara_rule behavioral1/memory/1492-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-750-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-807-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-806-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-833-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-846-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrhbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbxpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpfrbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phdvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxdhfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxvhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvntl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtvdvjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fltdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxpthx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfpblf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blvhdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvhvtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrhllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbxrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdntd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnhxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndldxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvrtxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnfhhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdjpxdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvbtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trhxdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptdnjbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hblxjjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjjdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxhfjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhxlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxftb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drhnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndfndnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nflfvdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bblnvlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrtfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhfxpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxhvbpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxjrbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1492 wrote to memory of 2616 1492 7c01a20f70c987c2415a0cd0c73a90a014b38ee26ff78c30ee455d19f22cb0f5.exe 29 PID 1492 wrote to memory of 2616 1492 7c01a20f70c987c2415a0cd0c73a90a014b38ee26ff78c30ee455d19f22cb0f5.exe 29 PID 1492 wrote to memory of 2616 1492 7c01a20f70c987c2415a0cd0c73a90a014b38ee26ff78c30ee455d19f22cb0f5.exe 29 PID 1492 wrote to memory of 2616 1492 7c01a20f70c987c2415a0cd0c73a90a014b38ee26ff78c30ee455d19f22cb0f5.exe 29 PID 2616 wrote to memory of 3032 2616 dbvlp.exe 30 PID 2616 wrote to memory of 3032 2616 dbvlp.exe 30 PID 2616 wrote to memory of 3032 2616 dbvlp.exe 30 PID 2616 wrote to memory of 3032 2616 dbvlp.exe 30 PID 3032 wrote to memory of 2888 3032 xhnjt.exe 31 PID 3032 wrote to memory of 2888 3032 xhnjt.exe 31 PID 3032 wrote to memory of 2888 3032 xhnjt.exe 31 PID 3032 wrote to memory of 2888 3032 xhnjt.exe 31 PID 2888 wrote to memory of 3008 2888 rvndtfp.exe 32 PID 2888 wrote to memory of 3008 2888 rvndtfp.exe 32 PID 2888 wrote to memory of 3008 2888 rvndtfp.exe 32 PID 2888 wrote to memory of 3008 2888 rvndtfp.exe 32 PID 3008 wrote to memory of 2968 3008 xlltf.exe 33 PID 3008 wrote to memory of 2968 3008 xlltf.exe 33 PID 3008 wrote to memory of 2968 3008 xlltf.exe 33 PID 3008 wrote to memory of 2968 3008 xlltf.exe 33 PID 2968 wrote to memory of 2904 2968 dntvxj.exe 34 PID 2968 wrote to memory of 2904 2968 dntvxj.exe 34 PID 2968 wrote to memory of 2904 2968 dntvxj.exe 34 PID 2968 wrote to memory of 2904 2968 dntvxj.exe 34 PID 2904 wrote to memory of 2764 2904 bnvdvl.exe 35 PID 2904 wrote to memory of 2764 2904 bnvdvl.exe 35 PID 2904 wrote to memory of 2764 2904 bnvdvl.exe 35 PID 2904 wrote to memory of 2764 2904 bnvdvl.exe 35 PID 2764 wrote to memory of 2744 2764 lnnfbpp.exe 36 PID 2764 wrote to memory of 2744 2764 lnnfbpp.exe 36 PID 2764 wrote to memory of 2744 2764 lnnfbpp.exe 36 PID 2764 wrote to memory of 2744 2764 lnnfbpp.exe 36 PID 2744 wrote to memory of 2284 2744 xjflbpv.exe 37 PID 2744 wrote to memory of 2284 2744 xjflbpv.exe 37 PID 2744 wrote to memory of 2284 2744 xjflbpv.exe 37 PID 2744 wrote to memory of 2284 2744 xjflbpv.exe 37 PID 2284 wrote to memory of 940 2284 hbjjnnf.exe 38 PID 2284 wrote to memory of 940 2284 hbjjnnf.exe 38 PID 2284 wrote to memory of 940 2284 hbjjnnf.exe 38 PID 2284 wrote to memory of 940 2284 hbjjnnf.exe 38 PID 940 wrote to memory of 2364 940 bvtdblh.exe 39 PID 940 wrote to memory of 2364 940 bvtdblh.exe 39 PID 940 wrote to memory of 2364 940 bvtdblh.exe 39 PID 940 wrote to memory of 2364 940 bvtdblh.exe 39 PID 2364 wrote to memory of 2924 2364 jlndfp.exe 40 PID 2364 wrote to memory of 2924 2364 jlndfp.exe 40 PID 2364 wrote to memory of 2924 2364 jlndfp.exe 40 PID 2364 wrote to memory of 2924 2364 jlndfp.exe 40 PID 2924 wrote to memory of 2436 2924 bdffdj.exe 41 PID 2924 wrote to memory of 2436 2924 bdffdj.exe 41 PID 2924 wrote to memory of 2436 2924 bdffdj.exe 41 PID 2924 wrote to memory of 2436 2924 bdffdj.exe 41 PID 2436 wrote to memory of 1788 2436 vdhrvv.exe 42 PID 2436 wrote to memory of 1788 2436 vdhrvv.exe 42 PID 2436 wrote to memory of 1788 2436 vdhrvv.exe 42 PID 2436 wrote to memory of 1788 2436 vdhrvv.exe 42 PID 1788 wrote to memory of 2560 1788 lvxfl.exe 43 PID 1788 wrote to memory of 2560 1788 lvxfl.exe 43 PID 1788 wrote to memory of 2560 1788 lvxfl.exe 43 PID 1788 wrote to memory of 2560 1788 lvxfl.exe 43 PID 2560 wrote to memory of 1100 2560 dbbllpj.exe 44 PID 2560 wrote to memory of 1100 2560 dbbllpj.exe 44 PID 2560 wrote to memory of 1100 2560 dbbllpj.exe 44 PID 2560 wrote to memory of 1100 2560 dbbllpj.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c01a20f70c987c2415a0cd0c73a90a014b38ee26ff78c30ee455d19f22cb0f5.exe"C:\Users\Admin\AppData\Local\Temp\7c01a20f70c987c2415a0cd0c73a90a014b38ee26ff78c30ee455d19f22cb0f5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\dbvlp.exec:\dbvlp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\xhnjt.exec:\xhnjt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\rvndtfp.exec:\rvndtfp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\xlltf.exec:\xlltf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\dntvxj.exec:\dntvxj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\bnvdvl.exec:\bnvdvl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\lnnfbpp.exec:\lnnfbpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\xjflbpv.exec:\xjflbpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\hbjjnnf.exec:\hbjjnnf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\bvtdblh.exec:\bvtdblh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\jlndfp.exec:\jlndfp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\bdffdj.exec:\bdffdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\vdhrvv.exec:\vdhrvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\lvxfl.exec:\lvxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\dbbllpj.exec:\dbbllpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\jtjvf.exec:\jtjvf.exe17⤵
- Executes dropped EXE
PID:1100 -
\??\c:\bdxvnjl.exec:\bdxvnjl.exe18⤵
- Executes dropped EXE
PID:1760 -
\??\c:\nrbnp.exec:\nrbnp.exe19⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vxbvpv.exec:\vxbvpv.exe20⤵
- Executes dropped EXE
PID:2256 -
\??\c:\brrjvv.exec:\brrjvv.exe21⤵
- Executes dropped EXE
PID:2700 -
\??\c:\lttnvd.exec:\lttnvd.exe22⤵
- Executes dropped EXE
PID:1784 -
\??\c:\jnndnlh.exec:\jnndnlh.exe23⤵
- Executes dropped EXE
PID:600 -
\??\c:\brrtv.exec:\brrtv.exe24⤵
- Executes dropped EXE
PID:2160 -
\??\c:\fhvllnl.exec:\fhvllnl.exe25⤵
- Executes dropped EXE
PID:2376 -
\??\c:\lvtxdvt.exec:\lvtxdvt.exe26⤵
- Executes dropped EXE
PID:2480 -
\??\c:\plldvbn.exec:\plldvbn.exe27⤵
- Executes dropped EXE
PID:1556 -
\??\c:\bjrfxf.exec:\bjrfxf.exe28⤵
- Executes dropped EXE
PID:2304 -
\??\c:\ljlvxxb.exec:\ljlvxxb.exe29⤵
- Executes dropped EXE
PID:596 -
\??\c:\bdvpb.exec:\bdvpb.exe30⤵
- Executes dropped EXE
PID:948 -
\??\c:\lfxln.exec:\lfxln.exe31⤵
- Executes dropped EXE
PID:1724 -
\??\c:\bdrdpl.exec:\bdrdpl.exe32⤵
- Executes dropped EXE
PID:2124 -
\??\c:\vfjvnhr.exec:\vfjvnhr.exe33⤵
- Executes dropped EXE
PID:2292 -
\??\c:\fbhjp.exec:\fbhjp.exe34⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xvtxnn.exec:\xvtxnn.exe35⤵
- Executes dropped EXE
PID:1492 -
\??\c:\tdvbn.exec:\tdvbn.exe36⤵
- Executes dropped EXE
PID:1632 -
\??\c:\pxtvjf.exec:\pxtvjf.exe37⤵
- Executes dropped EXE
PID:1720 -
\??\c:\fdjpxdn.exec:\fdjpxdn.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1736 -
\??\c:\htfvntb.exec:\htfvntb.exe39⤵
- Executes dropped EXE
PID:2204 -
\??\c:\ppvvpph.exec:\ppvvpph.exe40⤵
- Executes dropped EXE
PID:2896 -
\??\c:\nnvfphd.exec:\nnvfphd.exe41⤵
- Executes dropped EXE
PID:472 -
\??\c:\plxrrr.exec:\plxrrr.exe42⤵
- Executes dropped EXE
PID:2412 -
\??\c:\bdnjlnd.exec:\bdnjlnd.exe43⤵
- Executes dropped EXE
PID:3012 -
\??\c:\lxhhn.exec:\lxhhn.exe44⤵
- Executes dropped EXE
PID:3052 -
\??\c:\dxlnvl.exec:\dxlnvl.exe45⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jxrnhvr.exec:\jxrnhvr.exe46⤵
- Executes dropped EXE
PID:1384 -
\??\c:\jvhtfbj.exec:\jvhtfbj.exe47⤵
- Executes dropped EXE
PID:2592 -
\??\c:\jrxrnv.exec:\jrxrnv.exe48⤵
- Executes dropped EXE
PID:2284 -
\??\c:\lbnblb.exec:\lbnblb.exe49⤵
- Executes dropped EXE
PID:3068 -
\??\c:\lbltrhn.exec:\lbltrhn.exe50⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vxpthx.exec:\vxpthx.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2216 -
\??\c:\htvtfhh.exec:\htvtfhh.exe52⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bhnhvdf.exec:\bhnhvdf.exe53⤵
- Executes dropped EXE
PID:1192 -
\??\c:\vjlnvp.exec:\vjlnvp.exe54⤵
- Executes dropped EXE
PID:2840 -
\??\c:\fhdtpt.exec:\fhdtpt.exe55⤵
- Executes dropped EXE
PID:1832 -
\??\c:\hnrbnht.exec:\hnrbnht.exe56⤵
- Executes dropped EXE
PID:2040 -
\??\c:\jjrbflb.exec:\jjrbflb.exe57⤵
- Executes dropped EXE
PID:908 -
\??\c:\nlxxbv.exec:\nlxxbv.exe58⤵
- Executes dropped EXE
PID:1656 -
\??\c:\bxvdhl.exec:\bxvdhl.exe59⤵
- Executes dropped EXE
PID:2344 -
\??\c:\nrvndx.exec:\nrvndx.exe60⤵
- Executes dropped EXE
PID:1316 -
\??\c:\bjnhbnp.exec:\bjnhbnp.exe61⤵
- Executes dropped EXE
PID:2388 -
\??\c:\xbjbfx.exec:\xbjbfx.exe62⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rpthpj.exec:\rpthpj.exe63⤵
- Executes dropped EXE
PID:964 -
\??\c:\tfltbl.exec:\tfltbl.exe64⤵
- Executes dropped EXE
PID:2708 -
\??\c:\nfnfnpd.exec:\nfnfnpd.exe65⤵
- Executes dropped EXE
PID:2160 -
\??\c:\djrxnpv.exec:\djrxnpv.exe66⤵PID:2612
-
\??\c:\vffntn.exec:\vffntn.exe67⤵PID:2512
-
\??\c:\ljpdbd.exec:\ljpdbd.exe68⤵PID:1328
-
\??\c:\hblxjjr.exec:\hblxjjr.exe69⤵
- System Location Discovery: System Language Discovery
PID:1700 -
\??\c:\jfnxdbv.exec:\jfnxdbv.exe70⤵PID:812
-
\??\c:\lvddj.exec:\lvddj.exe71⤵PID:1172
-
\??\c:\htdfbt.exec:\htdfbt.exe72⤵PID:1676
-
\??\c:\ldrff.exec:\ldrff.exe73⤵PID:944
-
\??\c:\jfjvjn.exec:\jfjvjn.exe74⤵PID:2076
-
\??\c:\hxxtxvh.exec:\hxxtxvh.exe75⤵PID:2056
-
\??\c:\pxtdxn.exec:\pxtdxn.exe76⤵PID:2632
-
\??\c:\xpfrbp.exec:\xpfrbp.exe77⤵
- System Location Discovery: System Language Discovery
PID:2604 -
\??\c:\pbrdpd.exec:\pbrdpd.exe78⤵PID:1704
-
\??\c:\bvphxhb.exec:\bvphxhb.exe79⤵PID:1492
-
\??\c:\rvhvtd.exec:\rvhvtd.exe80⤵
- System Location Discovery: System Language Discovery
PID:1632 -
\??\c:\fjnfll.exec:\fjnfll.exe81⤵PID:1720
-
\??\c:\nflpnnp.exec:\nflpnnp.exe82⤵PID:704
-
\??\c:\pdphdvd.exec:\pdphdvd.exe83⤵PID:2204
-
\??\c:\hbdxxv.exec:\hbdxxv.exe84⤵PID:3020
-
\??\c:\njjrvl.exec:\njjrvl.exe85⤵PID:2968
-
\??\c:\brbxxb.exec:\brbxxb.exe86⤵PID:2768
-
\??\c:\fnjrrtj.exec:\fnjrrtj.exe87⤵PID:2880
-
\??\c:\thlrrpp.exec:\thlrrpp.exe88⤵PID:2856
-
\??\c:\hjpdnfr.exec:\hjpdnfr.exe89⤵PID:676
-
\??\c:\dbnxlt.exec:\dbnxlt.exe90⤵PID:2724
-
\??\c:\vdtfbfp.exec:\vdtfbfp.exe91⤵PID:2704
-
\??\c:\xrrvhhb.exec:\xrrvhhb.exe92⤵PID:2284
-
\??\c:\brfdvpr.exec:\brfdvpr.exe93⤵PID:2360
-
\??\c:\ljpbdlj.exec:\ljpbdlj.exe94⤵PID:2164
-
\??\c:\lnjfvjl.exec:\lnjfvjl.exe95⤵PID:592
-
\??\c:\xxrdv.exec:\xxrdv.exe96⤵PID:2436
-
\??\c:\jpjrr.exec:\jpjrr.exe97⤵PID:1088
-
\??\c:\rhlfv.exec:\rhlfv.exe98⤵PID:2036
-
\??\c:\tnxhr.exec:\tnxhr.exe99⤵PID:1812
-
\??\c:\tbtjhx.exec:\tbtjhx.exe100⤵PID:1692
-
\??\c:\hdlrl.exec:\hdlrl.exe101⤵PID:1184
-
\??\c:\tnxhj.exec:\tnxhj.exe102⤵PID:2300
-
\??\c:\ltrxtlj.exec:\ltrxtlj.exe103⤵PID:2404
-
\??\c:\fljbjb.exec:\fljbjb.exe104⤵PID:2700
-
\??\c:\xxlfn.exec:\xxlfn.exe105⤵PID:2416
-
\??\c:\ppxpbbp.exec:\ppxpbbp.exe106⤵PID:320
-
\??\c:\tphrv.exec:\tphrv.exe107⤵PID:712
-
\??\c:\vxllvjn.exec:\vxllvjn.exe108⤵PID:1828
-
\??\c:\ntbfn.exec:\ntbfn.exe109⤵PID:1576
-
\??\c:\nttxdf.exec:\nttxdf.exe110⤵PID:2716
-
\??\c:\dpjhrh.exec:\dpjhrh.exe111⤵PID:1600
-
\??\c:\lvbtd.exec:\lvbtd.exe112⤵
- System Location Discovery: System Language Discovery
PID:1240 -
\??\c:\nbfbb.exec:\nbfbb.exe113⤵PID:952
-
\??\c:\lnfxvnj.exec:\lnfxvnj.exe114⤵PID:1504
-
\??\c:\trjfnd.exec:\trjfnd.exe115⤵PID:304
-
\??\c:\rdpvn.exec:\rdpvn.exe116⤵PID:2024
-
\??\c:\bvvfnx.exec:\bvvfnx.exe117⤵PID:928
-
\??\c:\lpllplx.exec:\lpllplx.exe118⤵PID:2324
-
\??\c:\tlptnjb.exec:\tlptnjb.exe119⤵PID:2260
-
\??\c:\nxrjb.exec:\nxrjb.exe120⤵PID:844
-
\??\c:\ftptr.exec:\ftptr.exe121⤵PID:2604
-
\??\c:\llfjxh.exec:\llfjxh.exe122⤵PID:2156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-