Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 15:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
820b4f579308df5d350ce9ccd4ffd11c5106a3599d63ee8aa623fce5d6ae7c63.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
820b4f579308df5d350ce9ccd4ffd11c5106a3599d63ee8aa623fce5d6ae7c63.exe
-
Size
453KB
-
MD5
97feb28f0e447340ec6bf8dd58ba249f
-
SHA1
179b749a42ce30fb49443f3a163dde6c1b541cb1
-
SHA256
820b4f579308df5d350ce9ccd4ffd11c5106a3599d63ee8aa623fce5d6ae7c63
-
SHA512
5e0266f3226adf2ea72e5c1b6379f6bd5751391f23e40a1b9e5a945f7234abd4a46fe11bc7bb306d2245585a209f0f6e7fbbc3c634bbd4c94adb9b778d3b141f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeN:q7Tc2NYHUrAwfMp3CDN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2880-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-74-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1928-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1400-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/544-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/436-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/940-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-268-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2520-279-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2520-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-313-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2860-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-323-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2060-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-336-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2700-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-409-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2260-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-618-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2840-617-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2704-691-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2896 vpnbj.exe 3020 btvvj.exe 2912 jnpxrfr.exe 2948 lhfnndt.exe 2632 bnnvpt.exe 2008 rjlph.exe 1928 rvbrb.exe 1456 tjfbxd.exe 2456 jxlrl.exe 1400 thtjr.exe 2736 pfbtr.exe 544 bhhppdd.exe 436 rdvhfjn.exe 2992 fjhjxp.exe 320 lttlfv.exe 1560 nxxxrbt.exe 2216 rfdtld.exe 1080 ndvfl.exe 2076 rllpv.exe 2120 rjbbr.exe 2352 htbnxtf.exe 364 vxprxr.exe 1952 dhddhn.exe 916 tpfrlp.exe 1516 hpjpndv.exe 2084 brhdfp.exe 940 rxvdp.exe 3024 llvll.exe 2520 xfnhfhx.exe 2420 vhdphdx.exe 2404 rnhbv.exe 2512 lxbbd.exe 2860 btpdv.exe 1668 ltphp.exe 2060 xrdjd.exe 2492 hhtlx.exe 2664 rbbnlh.exe 2948 rrxvf.exe 2700 xxttlv.exe 572 nxnbll.exe 2548 bbvvnv.exe 2676 ftvbtx.exe 2332 nrpftx.exe 2480 rvfbp.exe 3040 vvjtpf.exe 2508 rjdxrb.exe 2928 rhjff.exe 2260 rvhvdv.exe 2448 ptjvtbd.exe 1640 tdlrvd.exe 2224 hrjntjl.exe 2984 jlbbv.exe 576 nxlbh.exe 1924 hjnxhnb.exe 1560 xhllp.exe 1264 jnnfpln.exe 368 vhdpjp.exe 2208 dnbvdnx.exe 2124 dpjpbhv.exe 984 frttdb.exe 2352 brjrrb.exe 980 bxpxx.exe 1608 nlvjxtb.exe 1952 rlpnl.exe -
resource yara_rule behavioral1/memory/2880-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/436-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-313-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2860-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-706-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/436-720-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbxvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rttfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxfjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrvdtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhjvlhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxvprh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txttl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfllbrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvlbflh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldldh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvbpnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhpfnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djrrnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjtpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjlpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlffjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhxvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jblvlxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpflnrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvdnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrnnvhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfdthbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bddrdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlrvpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drdvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvfttlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhbxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prpbvdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvbdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxvhxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnxvtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvjvf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2880 wrote to memory of 2896 2880 820b4f579308df5d350ce9ccd4ffd11c5106a3599d63ee8aa623fce5d6ae7c63.exe 30 PID 2880 wrote to memory of 2896 2880 820b4f579308df5d350ce9ccd4ffd11c5106a3599d63ee8aa623fce5d6ae7c63.exe 30 PID 2880 wrote to memory of 2896 2880 820b4f579308df5d350ce9ccd4ffd11c5106a3599d63ee8aa623fce5d6ae7c63.exe 30 PID 2880 wrote to memory of 2896 2880 820b4f579308df5d350ce9ccd4ffd11c5106a3599d63ee8aa623fce5d6ae7c63.exe 30 PID 2896 wrote to memory of 3020 2896 vpnbj.exe 31 PID 2896 wrote to memory of 3020 2896 vpnbj.exe 31 PID 2896 wrote to memory of 3020 2896 vpnbj.exe 31 PID 2896 wrote to memory of 3020 2896 vpnbj.exe 31 PID 3020 wrote to memory of 2912 3020 btvvj.exe 32 PID 3020 wrote to memory of 2912 3020 btvvj.exe 32 PID 3020 wrote to memory of 2912 3020 btvvj.exe 32 PID 3020 wrote to memory of 2912 3020 btvvj.exe 32 PID 2912 wrote to memory of 2948 2912 jnpxrfr.exe 33 PID 2912 wrote to memory of 2948 2912 jnpxrfr.exe 33 PID 2912 wrote to memory of 2948 2912 jnpxrfr.exe 33 PID 2912 wrote to memory of 2948 2912 jnpxrfr.exe 33 PID 2948 wrote to memory of 2632 2948 lhfnndt.exe 34 PID 2948 wrote to memory of 2632 2948 lhfnndt.exe 34 PID 2948 wrote to memory of 2632 2948 lhfnndt.exe 34 PID 2948 wrote to memory of 2632 2948 lhfnndt.exe 34 PID 2632 wrote to memory of 2008 2632 bnnvpt.exe 35 PID 2632 wrote to memory of 2008 2632 bnnvpt.exe 35 PID 2632 wrote to memory of 2008 2632 bnnvpt.exe 35 PID 2632 wrote to memory of 2008 2632 bnnvpt.exe 35 PID 2008 wrote to memory of 1928 2008 rjlph.exe 36 PID 2008 wrote to memory of 1928 2008 rjlph.exe 36 PID 2008 wrote to memory of 1928 2008 rjlph.exe 36 PID 2008 wrote to memory of 1928 2008 rjlph.exe 36 PID 1928 wrote to memory of 1456 1928 rvbrb.exe 37 PID 1928 wrote to memory of 1456 1928 rvbrb.exe 37 PID 1928 wrote to memory of 1456 1928 rvbrb.exe 37 PID 1928 wrote to memory of 1456 1928 rvbrb.exe 37 PID 1456 wrote to memory of 2456 1456 tjfbxd.exe 38 PID 1456 wrote to memory of 2456 1456 tjfbxd.exe 38 PID 1456 wrote to memory of 2456 1456 tjfbxd.exe 38 PID 1456 wrote to memory of 2456 1456 tjfbxd.exe 38 PID 2456 wrote to memory of 1400 2456 jxlrl.exe 39 PID 2456 wrote to memory of 1400 2456 jxlrl.exe 39 PID 2456 wrote to memory of 1400 2456 jxlrl.exe 39 PID 2456 wrote to memory of 1400 2456 jxlrl.exe 39 PID 1400 wrote to memory of 2736 1400 thtjr.exe 40 PID 1400 wrote to memory of 2736 1400 thtjr.exe 40 PID 1400 wrote to memory of 2736 1400 thtjr.exe 40 PID 1400 wrote to memory of 2736 1400 thtjr.exe 40 PID 2736 wrote to memory of 544 2736 pfbtr.exe 41 PID 2736 wrote to memory of 544 2736 pfbtr.exe 41 PID 2736 wrote to memory of 544 2736 pfbtr.exe 41 PID 2736 wrote to memory of 544 2736 pfbtr.exe 41 PID 544 wrote to memory of 436 544 bhhppdd.exe 42 PID 544 wrote to memory of 436 544 bhhppdd.exe 42 PID 544 wrote to memory of 436 544 bhhppdd.exe 42 PID 544 wrote to memory of 436 544 bhhppdd.exe 42 PID 436 wrote to memory of 2992 436 rdvhfjn.exe 43 PID 436 wrote to memory of 2992 436 rdvhfjn.exe 43 PID 436 wrote to memory of 2992 436 rdvhfjn.exe 43 PID 436 wrote to memory of 2992 436 rdvhfjn.exe 43 PID 2992 wrote to memory of 320 2992 fjhjxp.exe 44 PID 2992 wrote to memory of 320 2992 fjhjxp.exe 44 PID 2992 wrote to memory of 320 2992 fjhjxp.exe 44 PID 2992 wrote to memory of 320 2992 fjhjxp.exe 44 PID 320 wrote to memory of 1560 320 lttlfv.exe 45 PID 320 wrote to memory of 1560 320 lttlfv.exe 45 PID 320 wrote to memory of 1560 320 lttlfv.exe 45 PID 320 wrote to memory of 1560 320 lttlfv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\820b4f579308df5d350ce9ccd4ffd11c5106a3599d63ee8aa623fce5d6ae7c63.exe"C:\Users\Admin\AppData\Local\Temp\820b4f579308df5d350ce9ccd4ffd11c5106a3599d63ee8aa623fce5d6ae7c63.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\vpnbj.exec:\vpnbj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\btvvj.exec:\btvvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\jnpxrfr.exec:\jnpxrfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\lhfnndt.exec:\lhfnndt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\bnnvpt.exec:\bnnvpt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\rjlph.exec:\rjlph.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\rvbrb.exec:\rvbrb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\tjfbxd.exec:\tjfbxd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\jxlrl.exec:\jxlrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\thtjr.exec:\thtjr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\pfbtr.exec:\pfbtr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\bhhppdd.exec:\bhhppdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\rdvhfjn.exec:\rdvhfjn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\fjhjxp.exec:\fjhjxp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\lttlfv.exec:\lttlfv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\nxxxrbt.exec:\nxxxrbt.exe17⤵
- Executes dropped EXE
PID:1560 -
\??\c:\rfdtld.exec:\rfdtld.exe18⤵
- Executes dropped EXE
PID:2216 -
\??\c:\ndvfl.exec:\ndvfl.exe19⤵
- Executes dropped EXE
PID:1080 -
\??\c:\rllpv.exec:\rllpv.exe20⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rjbbr.exec:\rjbbr.exe21⤵
- Executes dropped EXE
PID:2120 -
\??\c:\htbnxtf.exec:\htbnxtf.exe22⤵
- Executes dropped EXE
PID:2352 -
\??\c:\vxprxr.exec:\vxprxr.exe23⤵
- Executes dropped EXE
PID:364 -
\??\c:\dhddhn.exec:\dhddhn.exe24⤵
- Executes dropped EXE
PID:1952 -
\??\c:\tpfrlp.exec:\tpfrlp.exe25⤵
- Executes dropped EXE
PID:916 -
\??\c:\hpjpndv.exec:\hpjpndv.exe26⤵
- Executes dropped EXE
PID:1516 -
\??\c:\brhdfp.exec:\brhdfp.exe27⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rxvdp.exec:\rxvdp.exe28⤵
- Executes dropped EXE
PID:940 -
\??\c:\llvll.exec:\llvll.exe29⤵
- Executes dropped EXE
PID:3024 -
\??\c:\xfnhfhx.exec:\xfnhfhx.exe30⤵
- Executes dropped EXE
PID:2520 -
\??\c:\vhdphdx.exec:\vhdphdx.exe31⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rnhbv.exec:\rnhbv.exe32⤵
- Executes dropped EXE
PID:2404 -
\??\c:\lxbbd.exec:\lxbbd.exe33⤵
- Executes dropped EXE
PID:2512 -
\??\c:\btpdv.exec:\btpdv.exe34⤵
- Executes dropped EXE
PID:2860 -
\??\c:\ltphp.exec:\ltphp.exe35⤵
- Executes dropped EXE
PID:1668 -
\??\c:\xrdjd.exec:\xrdjd.exe36⤵
- Executes dropped EXE
PID:2060 -
\??\c:\hhtlx.exec:\hhtlx.exe37⤵
- Executes dropped EXE
PID:2492 -
\??\c:\rbbnlh.exec:\rbbnlh.exe38⤵
- Executes dropped EXE
PID:2664 -
\??\c:\rrxvf.exec:\rrxvf.exe39⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xxttlv.exec:\xxttlv.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\nxnbll.exec:\nxnbll.exe41⤵
- Executes dropped EXE
PID:572 -
\??\c:\bbvvnv.exec:\bbvvnv.exe42⤵
- Executes dropped EXE
PID:2548 -
\??\c:\ftvbtx.exec:\ftvbtx.exe43⤵
- Executes dropped EXE
PID:2676 -
\??\c:\nrpftx.exec:\nrpftx.exe44⤵
- Executes dropped EXE
PID:2332 -
\??\c:\rvfbp.exec:\rvfbp.exe45⤵
- Executes dropped EXE
PID:2480 -
\??\c:\vvjtpf.exec:\vvjtpf.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3040 -
\??\c:\rjdxrb.exec:\rjdxrb.exe47⤵
- Executes dropped EXE
PID:2508 -
\??\c:\rhjff.exec:\rhjff.exe48⤵
- Executes dropped EXE
PID:2928 -
\??\c:\rvhvdv.exec:\rvhvdv.exe49⤵
- Executes dropped EXE
PID:2260 -
\??\c:\ptjvtbd.exec:\ptjvtbd.exe50⤵
- Executes dropped EXE
PID:2448 -
\??\c:\tdlrvd.exec:\tdlrvd.exe51⤵
- Executes dropped EXE
PID:1640 -
\??\c:\hrjntjl.exec:\hrjntjl.exe52⤵
- Executes dropped EXE
PID:2224 -
\??\c:\jlbbv.exec:\jlbbv.exe53⤵
- Executes dropped EXE
PID:2984 -
\??\c:\nxlbh.exec:\nxlbh.exe54⤵
- Executes dropped EXE
PID:576 -
\??\c:\hjnxhnb.exec:\hjnxhnb.exe55⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xhllp.exec:\xhllp.exe56⤵
- Executes dropped EXE
PID:1560 -
\??\c:\jnnfpln.exec:\jnnfpln.exe57⤵
- Executes dropped EXE
PID:1264 -
\??\c:\vhdpjp.exec:\vhdpjp.exe58⤵
- Executes dropped EXE
PID:368 -
\??\c:\dnbvdnx.exec:\dnbvdnx.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\dpjpbhv.exec:\dpjpbhv.exe60⤵
- Executes dropped EXE
PID:2124 -
\??\c:\frttdb.exec:\frttdb.exe61⤵
- Executes dropped EXE
PID:984 -
\??\c:\brjrrb.exec:\brjrrb.exe62⤵
- Executes dropped EXE
PID:2352 -
\??\c:\bxpxx.exec:\bxpxx.exe63⤵
- Executes dropped EXE
PID:980 -
\??\c:\nlvjxtb.exec:\nlvjxtb.exe64⤵
- Executes dropped EXE
PID:1608 -
\??\c:\rlpnl.exec:\rlpnl.exe65⤵
- Executes dropped EXE
PID:1952 -
\??\c:\lltrbb.exec:\lltrbb.exe66⤵PID:916
-
\??\c:\hfhtj.exec:\hfhtj.exe67⤵PID:2368
-
\??\c:\rvxfrl.exec:\rvxfrl.exe68⤵PID:1760
-
\??\c:\jdlndv.exec:\jdlndv.exe69⤵PID:2360
-
\??\c:\nnnpltx.exec:\nnnpltx.exe70⤵PID:3048
-
\??\c:\fhbtrtn.exec:\fhbtrtn.exe71⤵PID:2560
-
\??\c:\dhtxjb.exec:\dhtxjb.exe72⤵PID:1756
-
\??\c:\dtvthrv.exec:\dtvthrv.exe73⤵PID:1876
-
\??\c:\vntrhh.exec:\vntrhh.exe74⤵PID:680
-
\??\c:\nhnfbxr.exec:\nhnfbxr.exe75⤵PID:2884
-
\??\c:\tnndhbr.exec:\tnndhbr.exe76⤵PID:2512
-
\??\c:\jjftn.exec:\jjftn.exe77⤵PID:1580
-
\??\c:\pplrxn.exec:\pplrxn.exe78⤵PID:2892
-
\??\c:\tjtpdv.exec:\tjtpdv.exe79⤵PID:2840
-
\??\c:\bvvdp.exec:\bvvdp.exe80⤵PID:3016
-
\??\c:\rvrxjn.exec:\rvrxjn.exe81⤵PID:2660
-
\??\c:\ltttt.exec:\ltttt.exe82⤵PID:2808
-
\??\c:\bffvrj.exec:\bffvrj.exe83⤵PID:2948
-
\??\c:\vjjjvbj.exec:\vjjjvbj.exe84⤵PID:2488
-
\??\c:\bddrdj.exec:\bddrdj.exe85⤵
- System Location Discovery: System Language Discovery
PID:572 -
\??\c:\bfxbt.exec:\bfxbt.exe86⤵PID:2548
-
\??\c:\nvjvvj.exec:\nvjvvj.exe87⤵PID:1600
-
\??\c:\fdtlf.exec:\fdtlf.exe88⤵PID:772
-
\??\c:\rtntnx.exec:\rtntnx.exe89⤵PID:2916
-
\??\c:\tdxvd.exec:\tdxvd.exe90⤵PID:2704
-
\??\c:\rnnxx.exec:\rnnxx.exe91⤵PID:2988
-
\??\c:\rlrjld.exec:\rlrjld.exe92⤵PID:2736
-
\??\c:\rfjvtd.exec:\rfjvtd.exe93⤵PID:544
-
\??\c:\hfjjjx.exec:\hfjjjx.exe94⤵PID:624
-
\??\c:\llbplr.exec:\llbplr.exe95⤵PID:436
-
\??\c:\dllbh.exec:\dllbh.exe96⤵PID:2396
-
\??\c:\tdvbhx.exec:\tdvbhx.exe97⤵PID:2348
-
\??\c:\fllblfx.exec:\fllblfx.exe98⤵PID:2248
-
\??\c:\ltlldhj.exec:\ltlldhj.exe99⤵PID:2388
-
\??\c:\bvndxl.exec:\bvndxl.exe100⤵PID:2392
-
\??\c:\jjfhpn.exec:\jjfhpn.exe101⤵PID:2160
-
\??\c:\pjppbn.exec:\pjppbn.exe102⤵
- System Location Discovery: System Language Discovery
PID:1964 -
\??\c:\rjtdfl.exec:\rjtdfl.exe103⤵PID:760
-
\??\c:\jrbdd.exec:\jrbdd.exe104⤵PID:556
-
\??\c:\fpflnrr.exec:\fpflnrr.exe105⤵
- System Location Discovery: System Language Discovery
PID:2532 -
\??\c:\btvhlnf.exec:\btvhlnf.exe106⤵PID:2352
-
\??\c:\nbbpl.exec:\nbbpl.exe107⤵PID:980
-
\??\c:\lddhn.exec:\lddhn.exe108⤵PID:1460
-
\??\c:\bfldxlf.exec:\bfldxlf.exe109⤵PID:2436
-
\??\c:\hnbthb.exec:\hnbthb.exe110⤵PID:916
-
\??\c:\dffvrbr.exec:\dffvrbr.exe111⤵PID:288
-
\??\c:\drvhf.exec:\drvhf.exe112⤵PID:1020
-
\??\c:\jlftxb.exec:\jlftxb.exe113⤵PID:1248
-
\??\c:\nvnxbbj.exec:\nvnxbbj.exe114⤵PID:2564
-
\??\c:\ptrntf.exec:\ptrntf.exe115⤵PID:1284
-
\??\c:\rfrvdtf.exec:\rfrvdtf.exe116⤵
- System Location Discovery: System Language Discovery
PID:1936 -
\??\c:\drxbj.exec:\drxbj.exe117⤵PID:1720
-
\??\c:\vnplvl.exec:\vnplvl.exe118⤵PID:1396
-
\??\c:\hhvvbdv.exec:\hhvvbdv.exe119⤵PID:2884
-
\??\c:\nlpdlbj.exec:\nlpdlbj.exe120⤵PID:1584
-
\??\c:\hvrdvh.exec:\hvrdvh.exe121⤵PID:1580
-
\??\c:\fdrxhdt.exec:\fdrxhdt.exe122⤵PID:2796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-