Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 15:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
95ab65738cf93b1e6fc48032c8909e463551101b0e91bf135bce2ff5270b7dcb.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
95ab65738cf93b1e6fc48032c8909e463551101b0e91bf135bce2ff5270b7dcb.exe
-
Size
453KB
-
MD5
ce63ad30c4fc21683f52c105f311b457
-
SHA1
0e2ba74fcb74ef12a42dacf42cf3f648542414d9
-
SHA256
95ab65738cf93b1e6fc48032c8909e463551101b0e91bf135bce2ff5270b7dcb
-
SHA512
2fc35c04f97e41cf7fa421ce9f1003daf74dd465318da4d8339268ffdbdfce3fcc0373d892977374f320307eba8f4d7c408a9ae698dceedf1447ac1800bd3d37
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbev:q7Tc2NYHUrAwfMp3CDv
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/1996-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1472-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-221-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/948-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-264-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1108-299-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2608-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-341-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2772-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1196-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-429-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2468-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-561-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/996-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-709-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/280-816-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/2500-879-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2768-938-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2744 jtvff.exe 2476 ffprrh.exe 2912 rfbtd.exe 2868 xfhlr.exe 3048 vvvtvxt.exe 2828 jfbhdnr.exe 2660 bdhhj.exe 1504 hppdb.exe 1580 jllndf.exe 1432 xfbvb.exe 1260 rhvxn.exe 1732 dhrvj.exe 1472 pvjll.exe 2996 tlltd.exe 1976 phvrnft.exe 1664 bllpxth.exe 2232 jvnxbt.exe 1644 ftdxb.exe 1768 xtrpd.exe 2088 tvvxr.exe 2200 dbhvvn.exe 2412 tlxxrpl.exe 1308 bvnpl.exe 948 hrfdp.exe 2172 vnjthd.exe 864 rbtrj.exe 1484 dpltffj.exe 1748 prbttl.exe 1868 nvdrdb.exe 2320 nptxfbn.exe 2436 fvdvft.exe 1108 rhhht.exe 2608 tfnljtt.exe 1996 tfdbf.exe 3036 rvpdbb.exe 1584 nvfpl.exe 2900 dhtxjj.exe 2772 pvbdbrb.exe 2960 vdftr.exe 2132 dtvrrbp.exe 2832 rtxdj.exe 2680 rfvhl.exe 2728 ljnhn.exe 2156 hhlrhb.exe 2648 nrvnt.exe 1196 tvjtln.exe 2452 bttfnp.exe 2588 dhfdvx.exe 2956 lpnpxx.exe 1732 rntrpdj.exe 3032 tnrvrh.exe 2468 jdfpxn.exe 3012 pltntxn.exe 540 ltrrl.exe 2444 nbjxtx.exe 976 rvjnvr.exe 316 htpnpl.exe 2128 blhll.exe 2400 jdttrp.exe 1684 fntlj.exe 2504 hfbjbhr.exe 1532 njjpvnp.exe 1804 nrrln.exe 1368 rthpvtj.exe -
resource yara_rule behavioral1/memory/1996-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-299-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2608-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-561-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/996-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-905-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-925-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfnndxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnnpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnrjpvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prxnnvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlfhjbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nffhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnhdfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prvfxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbnlrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pljhnjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jffdjtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfvdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brffxfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxjpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rthpvtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxvvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lptjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbplhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttfnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhrtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxnlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdnxnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfdblf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxdxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxjdlnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brblj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrtnrdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvrntxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxvprrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfhhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddthjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxjbpbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpfrnvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dblljrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxvjdvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blnjph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njjpvnp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1996 wrote to memory of 2744 1996 95ab65738cf93b1e6fc48032c8909e463551101b0e91bf135bce2ff5270b7dcb.exe 29 PID 1996 wrote to memory of 2744 1996 95ab65738cf93b1e6fc48032c8909e463551101b0e91bf135bce2ff5270b7dcb.exe 29 PID 1996 wrote to memory of 2744 1996 95ab65738cf93b1e6fc48032c8909e463551101b0e91bf135bce2ff5270b7dcb.exe 29 PID 1996 wrote to memory of 2744 1996 95ab65738cf93b1e6fc48032c8909e463551101b0e91bf135bce2ff5270b7dcb.exe 29 PID 2744 wrote to memory of 2476 2744 jtvff.exe 30 PID 2744 wrote to memory of 2476 2744 jtvff.exe 30 PID 2744 wrote to memory of 2476 2744 jtvff.exe 30 PID 2744 wrote to memory of 2476 2744 jtvff.exe 30 PID 2476 wrote to memory of 2912 2476 ffprrh.exe 31 PID 2476 wrote to memory of 2912 2476 ffprrh.exe 31 PID 2476 wrote to memory of 2912 2476 ffprrh.exe 31 PID 2476 wrote to memory of 2912 2476 ffprrh.exe 31 PID 2912 wrote to memory of 2868 2912 rfbtd.exe 32 PID 2912 wrote to memory of 2868 2912 rfbtd.exe 32 PID 2912 wrote to memory of 2868 2912 rfbtd.exe 32 PID 2912 wrote to memory of 2868 2912 rfbtd.exe 32 PID 2868 wrote to memory of 3048 2868 xfhlr.exe 33 PID 2868 wrote to memory of 3048 2868 xfhlr.exe 33 PID 2868 wrote to memory of 3048 2868 xfhlr.exe 33 PID 2868 wrote to memory of 3048 2868 xfhlr.exe 33 PID 3048 wrote to memory of 2828 3048 vvvtvxt.exe 34 PID 3048 wrote to memory of 2828 3048 vvvtvxt.exe 34 PID 3048 wrote to memory of 2828 3048 vvvtvxt.exe 34 PID 3048 wrote to memory of 2828 3048 vvvtvxt.exe 34 PID 2828 wrote to memory of 2660 2828 jfbhdnr.exe 35 PID 2828 wrote to memory of 2660 2828 jfbhdnr.exe 35 PID 2828 wrote to memory of 2660 2828 jfbhdnr.exe 35 PID 2828 wrote to memory of 2660 2828 jfbhdnr.exe 35 PID 2660 wrote to memory of 1504 2660 bdhhj.exe 36 PID 2660 wrote to memory of 1504 2660 bdhhj.exe 36 PID 2660 wrote to memory of 1504 2660 bdhhj.exe 36 PID 2660 wrote to memory of 1504 2660 bdhhj.exe 36 PID 1504 wrote to memory of 1580 1504 hppdb.exe 37 PID 1504 wrote to memory of 1580 1504 hppdb.exe 37 PID 1504 wrote to memory of 1580 1504 hppdb.exe 37 PID 1504 wrote to memory of 1580 1504 hppdb.exe 37 PID 1580 wrote to memory of 1432 1580 jllndf.exe 38 PID 1580 wrote to memory of 1432 1580 jllndf.exe 38 PID 1580 wrote to memory of 1432 1580 jllndf.exe 38 PID 1580 wrote to memory of 1432 1580 jllndf.exe 38 PID 1432 wrote to memory of 1260 1432 xfbvb.exe 39 PID 1432 wrote to memory of 1260 1432 xfbvb.exe 39 PID 1432 wrote to memory of 1260 1432 xfbvb.exe 39 PID 1432 wrote to memory of 1260 1432 xfbvb.exe 39 PID 1260 wrote to memory of 1732 1260 rhvxn.exe 40 PID 1260 wrote to memory of 1732 1260 rhvxn.exe 40 PID 1260 wrote to memory of 1732 1260 rhvxn.exe 40 PID 1260 wrote to memory of 1732 1260 rhvxn.exe 40 PID 1732 wrote to memory of 1472 1732 dhrvj.exe 41 PID 1732 wrote to memory of 1472 1732 dhrvj.exe 41 PID 1732 wrote to memory of 1472 1732 dhrvj.exe 41 PID 1732 wrote to memory of 1472 1732 dhrvj.exe 41 PID 1472 wrote to memory of 2996 1472 pvjll.exe 42 PID 1472 wrote to memory of 2996 1472 pvjll.exe 42 PID 1472 wrote to memory of 2996 1472 pvjll.exe 42 PID 1472 wrote to memory of 2996 1472 pvjll.exe 42 PID 2996 wrote to memory of 1976 2996 tlltd.exe 43 PID 2996 wrote to memory of 1976 2996 tlltd.exe 43 PID 2996 wrote to memory of 1976 2996 tlltd.exe 43 PID 2996 wrote to memory of 1976 2996 tlltd.exe 43 PID 1976 wrote to memory of 1664 1976 phvrnft.exe 44 PID 1976 wrote to memory of 1664 1976 phvrnft.exe 44 PID 1976 wrote to memory of 1664 1976 phvrnft.exe 44 PID 1976 wrote to memory of 1664 1976 phvrnft.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\95ab65738cf93b1e6fc48032c8909e463551101b0e91bf135bce2ff5270b7dcb.exe"C:\Users\Admin\AppData\Local\Temp\95ab65738cf93b1e6fc48032c8909e463551101b0e91bf135bce2ff5270b7dcb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\jtvff.exec:\jtvff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\ffprrh.exec:\ffprrh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\rfbtd.exec:\rfbtd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\xfhlr.exec:\xfhlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\vvvtvxt.exec:\vvvtvxt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\jfbhdnr.exec:\jfbhdnr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\bdhhj.exec:\bdhhj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\hppdb.exec:\hppdb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\jllndf.exec:\jllndf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\xfbvb.exec:\xfbvb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\rhvxn.exec:\rhvxn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\dhrvj.exec:\dhrvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\pvjll.exec:\pvjll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\tlltd.exec:\tlltd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\phvrnft.exec:\phvrnft.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\bllpxth.exec:\bllpxth.exe17⤵
- Executes dropped EXE
PID:1664 -
\??\c:\jvnxbt.exec:\jvnxbt.exe18⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ftdxb.exec:\ftdxb.exe19⤵
- Executes dropped EXE
PID:1644 -
\??\c:\xtrpd.exec:\xtrpd.exe20⤵
- Executes dropped EXE
PID:1768 -
\??\c:\tvvxr.exec:\tvvxr.exe21⤵
- Executes dropped EXE
PID:2088 -
\??\c:\dbhvvn.exec:\dbhvvn.exe22⤵
- Executes dropped EXE
PID:2200 -
\??\c:\tlxxrpl.exec:\tlxxrpl.exe23⤵
- Executes dropped EXE
PID:2412 -
\??\c:\bvnpl.exec:\bvnpl.exe24⤵
- Executes dropped EXE
PID:1308 -
\??\c:\hrfdp.exec:\hrfdp.exe25⤵
- Executes dropped EXE
PID:948 -
\??\c:\vnjthd.exec:\vnjthd.exe26⤵
- Executes dropped EXE
PID:2172 -
\??\c:\rbtrj.exec:\rbtrj.exe27⤵
- Executes dropped EXE
PID:864 -
\??\c:\dpltffj.exec:\dpltffj.exe28⤵
- Executes dropped EXE
PID:1484 -
\??\c:\prbttl.exec:\prbttl.exe29⤵
- Executes dropped EXE
PID:1748 -
\??\c:\nvdrdb.exec:\nvdrdb.exe30⤵
- Executes dropped EXE
PID:1868 -
\??\c:\nptxfbn.exec:\nptxfbn.exe31⤵
- Executes dropped EXE
PID:2320 -
\??\c:\fvdvft.exec:\fvdvft.exe32⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rhhht.exec:\rhhht.exe33⤵
- Executes dropped EXE
PID:1108 -
\??\c:\tfnljtt.exec:\tfnljtt.exe34⤵
- Executes dropped EXE
PID:2608 -
\??\c:\tfdbf.exec:\tfdbf.exe35⤵
- Executes dropped EXE
PID:1996 -
\??\c:\rvpdbb.exec:\rvpdbb.exe36⤵
- Executes dropped EXE
PID:3036 -
\??\c:\nvfpl.exec:\nvfpl.exe37⤵
- Executes dropped EXE
PID:1584 -
\??\c:\dhtxjj.exec:\dhtxjj.exe38⤵
- Executes dropped EXE
PID:2900 -
\??\c:\pvbdbrb.exec:\pvbdbrb.exe39⤵
- Executes dropped EXE
PID:2772 -
\??\c:\vdftr.exec:\vdftr.exe40⤵
- Executes dropped EXE
PID:2960 -
\??\c:\dtvrrbp.exec:\dtvrrbp.exe41⤵
- Executes dropped EXE
PID:2132 -
\??\c:\rtxdj.exec:\rtxdj.exe42⤵
- Executes dropped EXE
PID:2832 -
\??\c:\rfvhl.exec:\rfvhl.exe43⤵
- Executes dropped EXE
PID:2680 -
\??\c:\ljnhn.exec:\ljnhn.exe44⤵
- Executes dropped EXE
PID:2728 -
\??\c:\hhlrhb.exec:\hhlrhb.exe45⤵
- Executes dropped EXE
PID:2156 -
\??\c:\nrvnt.exec:\nrvnt.exe46⤵
- Executes dropped EXE
PID:2648 -
\??\c:\tvjtln.exec:\tvjtln.exe47⤵
- Executes dropped EXE
PID:1196 -
\??\c:\bttfnp.exec:\bttfnp.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2452 -
\??\c:\dhfdvx.exec:\dhfdvx.exe49⤵
- Executes dropped EXE
PID:2588 -
\??\c:\lpnpxx.exec:\lpnpxx.exe50⤵
- Executes dropped EXE
PID:2956 -
\??\c:\rntrpdj.exec:\rntrpdj.exe51⤵
- Executes dropped EXE
PID:1732 -
\??\c:\tnrvrh.exec:\tnrvrh.exe52⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jdfpxn.exec:\jdfpxn.exe53⤵
- Executes dropped EXE
PID:2468 -
\??\c:\pltntxn.exec:\pltntxn.exe54⤵
- Executes dropped EXE
PID:3012 -
\??\c:\ltrrl.exec:\ltrrl.exe55⤵
- Executes dropped EXE
PID:540 -
\??\c:\nbjxtx.exec:\nbjxtx.exe56⤵
- Executes dropped EXE
PID:2444 -
\??\c:\rvjnvr.exec:\rvjnvr.exe57⤵
- Executes dropped EXE
PID:976 -
\??\c:\htpnpl.exec:\htpnpl.exe58⤵
- Executes dropped EXE
PID:316 -
\??\c:\blhll.exec:\blhll.exe59⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jdttrp.exec:\jdttrp.exe60⤵
- Executes dropped EXE
PID:2400 -
\??\c:\fntlj.exec:\fntlj.exe61⤵
- Executes dropped EXE
PID:1684 -
\??\c:\hfbjbhr.exec:\hfbjbhr.exe62⤵
- Executes dropped EXE
PID:2504 -
\??\c:\njjpvnp.exec:\njjpvnp.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1532 -
\??\c:\nrrln.exec:\nrrln.exe64⤵
- Executes dropped EXE
PID:1804 -
\??\c:\rthpvtj.exec:\rthpvtj.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1368 -
\??\c:\hhjrn.exec:\hhjrn.exe66⤵PID:700
-
\??\c:\rpxvx.exec:\rpxvx.exe67⤵PID:1008
-
\??\c:\flfnbhf.exec:\flfnbhf.exe68⤵PID:2564
-
\??\c:\fbhhxv.exec:\fbhhxv.exe69⤵PID:1688
-
\??\c:\jjfjj.exec:\jjfjj.exe70⤵PID:440
-
\??\c:\xhnltvb.exec:\xhnltvb.exe71⤵PID:916
-
\??\c:\hfxjpl.exec:\hfxjpl.exe72⤵PID:1540
-
\??\c:\tjhdr.exec:\tjhdr.exe73⤵PID:1468
-
\??\c:\pjbbjfx.exec:\pjbbjfx.exe74⤵PID:2416
-
\??\c:\vjddfnx.exec:\vjddfnx.exe75⤵PID:996
-
\??\c:\dlhnnnh.exec:\dlhnnnh.exe76⤵PID:2404
-
\??\c:\fhrtv.exec:\fhrtv.exe77⤵
- System Location Discovery: System Language Discovery
PID:2536 -
\??\c:\lfxjfx.exec:\lfxjfx.exe78⤵PID:2608
-
\??\c:\pjfrrnn.exec:\pjfrrnn.exe79⤵PID:1636
-
\??\c:\bvnnd.exec:\bvnnd.exe80⤵PID:2808
-
\??\c:\dbntdj.exec:\dbntdj.exe81⤵PID:764
-
\??\c:\vbjxtt.exec:\vbjxtt.exe82⤵PID:2812
-
\??\c:\htnhvb.exec:\htnhvb.exe83⤵PID:2672
-
\??\c:\lxxdj.exec:\lxxdj.exe84⤵PID:3044
-
\??\c:\trtbnn.exec:\trtbnn.exe85⤵PID:2876
-
\??\c:\jdbrtpd.exec:\jdbrtpd.exe86⤵PID:2776
-
\??\c:\nbljb.exec:\nbljb.exe87⤵PID:2860
-
\??\c:\ntvxhxr.exec:\ntvxhxr.exe88⤵PID:2680
-
\??\c:\xtlxh.exec:\xtlxh.exe89⤵PID:2784
-
\??\c:\nlxtpp.exec:\nlxtpp.exe90⤵PID:1188
-
\??\c:\hpvxn.exec:\hpvxn.exe91⤵PID:2944
-
\??\c:\bpdfh.exec:\bpdfh.exe92⤵PID:1708
-
\??\c:\dpthd.exec:\dpthd.exe93⤵PID:2760
-
\??\c:\ftdrnp.exec:\ftdrnp.exe94⤵PID:1356
-
\??\c:\rxppn.exec:\rxppn.exe95⤵PID:2612
-
\??\c:\fxtblfr.exec:\fxtblfr.exe96⤵PID:2952
-
\??\c:\tffxhtl.exec:\tffxhtl.exe97⤵PID:3024
-
\??\c:\xdxvvn.exec:\xdxvvn.exe98⤵PID:2996
-
\??\c:\xdnxnvt.exec:\xdnxnvt.exe99⤵PID:2980
-
\??\c:\pbfvrnt.exec:\pbfvrnt.exe100⤵PID:2368
-
\??\c:\xbhdpt.exec:\xbhdpt.exe101⤵PID:2056
-
\??\c:\lblxrtx.exec:\lblxrtx.exe102⤵PID:1372
-
\??\c:\tfddr.exec:\tfddr.exe103⤵PID:1820
-
\??\c:\phxndrv.exec:\phxndrv.exe104⤵PID:2236
-
\??\c:\jfpbn.exec:\jfpbn.exe105⤵PID:2152
-
\??\c:\jllpj.exec:\jllpj.exe106⤵PID:2372
-
\??\c:\xfpflrr.exec:\xfpflrr.exe107⤵PID:2204
-
\??\c:\xprhjd.exec:\xprhjd.exe108⤵PID:1280
-
\??\c:\jvhjdt.exec:\jvhjdt.exe109⤵PID:1952
-
\??\c:\nrvtj.exec:\nrvtj.exe110⤵PID:1804
-
\??\c:\plhffv.exec:\plhffv.exe111⤵PID:280
-
\??\c:\rxxjrd.exec:\rxxjrd.exe112⤵PID:3064
-
\??\c:\rnrdnd.exec:\rnrdnd.exe113⤵PID:2624
-
\??\c:\rrbrjl.exec:\rrbrjl.exe114⤵PID:1764
-
\??\c:\pvpdrt.exec:\pvpdrt.exe115⤵PID:1740
-
\??\c:\hjtllbx.exec:\hjtllbx.exe116⤵PID:612
-
\??\c:\rnthvl.exec:\rnthvl.exe117⤵PID:2028
-
\??\c:\bbtnfn.exec:\bbtnfn.exe118⤵PID:1736
-
\??\c:\jttjbhb.exec:\jttjbhb.exe119⤵PID:1468
-
\??\c:\vrdlbj.exec:\vrdlbj.exe120⤵PID:1168
-
\??\c:\dftdtt.exec:\dftdtt.exe121⤵PID:2500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-