Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 19:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
95c8e539630b8edf258114fb57c4241a9ae8a9e1d3c03bf2c3f8c1f5efaf32a2N.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
95c8e539630b8edf258114fb57c4241a9ae8a9e1d3c03bf2c3f8c1f5efaf32a2N.exe
-
Size
454KB
-
MD5
59859c3a14a2f2ce896f7a287b277c50
-
SHA1
f993b0eba18aafcf985843d285935f8c84682fe0
-
SHA256
95c8e539630b8edf258114fb57c4241a9ae8a9e1d3c03bf2c3f8c1f5efaf32a2
-
SHA512
6113c5ec2dde22e30dcfd9fbdd7d66ec7ea4f1e7753f809f3e6b6d076b2745f244b5cfe63d48e5f8ce46491c9d0f7befdb25e26e20c2c8bd98902e3ba55f68e1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT8:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2380-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-22-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1796-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-62-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2908-65-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2688-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-91-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2412-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-104-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1548-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-127-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1008-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-341-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2924-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-396-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1040-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-451-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1656-449-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3048-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/308-584-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2064 hbfvr.exe 1796 xdrvb.exe 2500 xtndr.exe 2124 vfdrpvd.exe 2452 llvffl.exe 2908 xnrll.exe 2788 tlvdvhx.exe 2688 rpxptbj.exe 1276 xtrdp.exe 2412 flbbh.exe 1984 jvrbxrx.exe 1548 rvvthxv.exe 1008 fnhxd.exe 1716 fnpvd.exe 1964 xfblfl.exe 2040 ljbbfn.exe 2872 vjfntt.exe 2420 tvrxf.exe 3048 lrtvj.exe 1696 xdjbx.exe 2132 hfdlvb.exe 1836 jbfvfll.exe 1004 jxlftd.exe 3000 hvrpf.exe 1672 pnrvnfx.exe 864 bnlvhp.exe 1580 njjpjl.exe 1620 jdpxd.exe 2304 xltlt.exe 3068 hnbjt.exe 2348 pvtlfvf.exe 1268 lpddp.exe 1800 tlhlhv.exe 2492 nndjffj.exe 2500 nrntlxj.exe 2164 nhrhnxx.exe 2780 pdlfpf.exe 2924 pxdljjl.exe 2916 dljxfp.exe 2948 ltvvldd.exe 3056 hxltpp.exe 2668 fvpdn.exe 2684 xxnjj.exe 2632 tbnnx.exe 2828 fpvvrn.exe 1040 drbpdhd.exe 2884 dbvbd.exe 2080 fdjlhxx.exe 1704 vdpbj.exe 1780 pbplt.exe 1656 rdlblt.exe 2012 bxdrnbh.exe 2960 lbvnttf.exe 2324 nxvfv.exe 852 bjbdf.exe 2404 bhvphd.exe 3048 jrnln.exe 2200 njthf.exe 2544 vjhvt.exe 1788 xlbdf.exe 2624 brhvxjv.exe 1756 xrnjxv.exe 2140 jntnp.exe 2428 jjbpb.exe -
resource yara_rule behavioral1/memory/2064-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-65-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2688-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-449-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2960-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-558-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2228-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-654-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvbrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbttpdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxdjjth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhntjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfffp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtndr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfvtxxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnflxhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbdnxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnltjrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prhhjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdxrpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjdfjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjjbbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvlxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxpph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vttbbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjdfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvhfxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfjvdtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnbvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njdfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xprndr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnrlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfpvldt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltvphln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbttlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfbvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpndnpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtnrvph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdlfpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbjrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjfdpdv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2064 2380 95c8e539630b8edf258114fb57c4241a9ae8a9e1d3c03bf2c3f8c1f5efaf32a2N.exe 30 PID 2380 wrote to memory of 2064 2380 95c8e539630b8edf258114fb57c4241a9ae8a9e1d3c03bf2c3f8c1f5efaf32a2N.exe 30 PID 2380 wrote to memory of 2064 2380 95c8e539630b8edf258114fb57c4241a9ae8a9e1d3c03bf2c3f8c1f5efaf32a2N.exe 30 PID 2380 wrote to memory of 2064 2380 95c8e539630b8edf258114fb57c4241a9ae8a9e1d3c03bf2c3f8c1f5efaf32a2N.exe 30 PID 2064 wrote to memory of 1796 2064 hbfvr.exe 31 PID 2064 wrote to memory of 1796 2064 hbfvr.exe 31 PID 2064 wrote to memory of 1796 2064 hbfvr.exe 31 PID 2064 wrote to memory of 1796 2064 hbfvr.exe 31 PID 1796 wrote to memory of 2500 1796 xdrvb.exe 32 PID 1796 wrote to memory of 2500 1796 xdrvb.exe 32 PID 1796 wrote to memory of 2500 1796 xdrvb.exe 32 PID 1796 wrote to memory of 2500 1796 xdrvb.exe 32 PID 2500 wrote to memory of 2124 2500 xtndr.exe 33 PID 2500 wrote to memory of 2124 2500 xtndr.exe 33 PID 2500 wrote to memory of 2124 2500 xtndr.exe 33 PID 2500 wrote to memory of 2124 2500 xtndr.exe 33 PID 2124 wrote to memory of 2452 2124 vfdrpvd.exe 34 PID 2124 wrote to memory of 2452 2124 vfdrpvd.exe 34 PID 2124 wrote to memory of 2452 2124 vfdrpvd.exe 34 PID 2124 wrote to memory of 2452 2124 vfdrpvd.exe 34 PID 2452 wrote to memory of 2908 2452 llvffl.exe 35 PID 2452 wrote to memory of 2908 2452 llvffl.exe 35 PID 2452 wrote to memory of 2908 2452 llvffl.exe 35 PID 2452 wrote to memory of 2908 2452 llvffl.exe 35 PID 2908 wrote to memory of 2788 2908 xnrll.exe 36 PID 2908 wrote to memory of 2788 2908 xnrll.exe 36 PID 2908 wrote to memory of 2788 2908 xnrll.exe 36 PID 2908 wrote to memory of 2788 2908 xnrll.exe 36 PID 2788 wrote to memory of 2688 2788 tlvdvhx.exe 37 PID 2788 wrote to memory of 2688 2788 tlvdvhx.exe 37 PID 2788 wrote to memory of 2688 2788 tlvdvhx.exe 37 PID 2788 wrote to memory of 2688 2788 tlvdvhx.exe 37 PID 2688 wrote to memory of 1276 2688 rpxptbj.exe 38 PID 2688 wrote to memory of 1276 2688 rpxptbj.exe 38 PID 2688 wrote to memory of 1276 2688 rpxptbj.exe 38 PID 2688 wrote to memory of 1276 2688 rpxptbj.exe 38 PID 1276 wrote to memory of 2412 1276 xtrdp.exe 39 PID 1276 wrote to memory of 2412 1276 xtrdp.exe 39 PID 1276 wrote to memory of 2412 1276 xtrdp.exe 39 PID 1276 wrote to memory of 2412 1276 xtrdp.exe 39 PID 2412 wrote to memory of 1984 2412 flbbh.exe 40 PID 2412 wrote to memory of 1984 2412 flbbh.exe 40 PID 2412 wrote to memory of 1984 2412 flbbh.exe 40 PID 2412 wrote to memory of 1984 2412 flbbh.exe 40 PID 1984 wrote to memory of 1548 1984 jvrbxrx.exe 41 PID 1984 wrote to memory of 1548 1984 jvrbxrx.exe 41 PID 1984 wrote to memory of 1548 1984 jvrbxrx.exe 41 PID 1984 wrote to memory of 1548 1984 jvrbxrx.exe 41 PID 1548 wrote to memory of 1008 1548 rvvthxv.exe 42 PID 1548 wrote to memory of 1008 1548 rvvthxv.exe 42 PID 1548 wrote to memory of 1008 1548 rvvthxv.exe 42 PID 1548 wrote to memory of 1008 1548 rvvthxv.exe 42 PID 1008 wrote to memory of 1716 1008 fnhxd.exe 43 PID 1008 wrote to memory of 1716 1008 fnhxd.exe 43 PID 1008 wrote to memory of 1716 1008 fnhxd.exe 43 PID 1008 wrote to memory of 1716 1008 fnhxd.exe 43 PID 1716 wrote to memory of 1964 1716 fnpvd.exe 44 PID 1716 wrote to memory of 1964 1716 fnpvd.exe 44 PID 1716 wrote to memory of 1964 1716 fnpvd.exe 44 PID 1716 wrote to memory of 1964 1716 fnpvd.exe 44 PID 1964 wrote to memory of 2040 1964 xfblfl.exe 45 PID 1964 wrote to memory of 2040 1964 xfblfl.exe 45 PID 1964 wrote to memory of 2040 1964 xfblfl.exe 45 PID 1964 wrote to memory of 2040 1964 xfblfl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\95c8e539630b8edf258114fb57c4241a9ae8a9e1d3c03bf2c3f8c1f5efaf32a2N.exe"C:\Users\Admin\AppData\Local\Temp\95c8e539630b8edf258114fb57c4241a9ae8a9e1d3c03bf2c3f8c1f5efaf32a2N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\hbfvr.exec:\hbfvr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\xdrvb.exec:\xdrvb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\xtndr.exec:\xtndr.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\vfdrpvd.exec:\vfdrpvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\llvffl.exec:\llvffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\xnrll.exec:\xnrll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\tlvdvhx.exec:\tlvdvhx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\rpxptbj.exec:\rpxptbj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\xtrdp.exec:\xtrdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\flbbh.exec:\flbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\jvrbxrx.exec:\jvrbxrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\rvvthxv.exec:\rvvthxv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\fnhxd.exec:\fnhxd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\fnpvd.exec:\fnpvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\xfblfl.exec:\xfblfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\ljbbfn.exec:\ljbbfn.exe17⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vjfntt.exec:\vjfntt.exe18⤵
- Executes dropped EXE
PID:2872 -
\??\c:\tvrxf.exec:\tvrxf.exe19⤵
- Executes dropped EXE
PID:2420 -
\??\c:\lrtvj.exec:\lrtvj.exe20⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xdjbx.exec:\xdjbx.exe21⤵
- Executes dropped EXE
PID:1696 -
\??\c:\hfdlvb.exec:\hfdlvb.exe22⤵
- Executes dropped EXE
PID:2132 -
\??\c:\jbfvfll.exec:\jbfvfll.exe23⤵
- Executes dropped EXE
PID:1836 -
\??\c:\jxlftd.exec:\jxlftd.exe24⤵
- Executes dropped EXE
PID:1004 -
\??\c:\hvrpf.exec:\hvrpf.exe25⤵
- Executes dropped EXE
PID:3000 -
\??\c:\pnrvnfx.exec:\pnrvnfx.exe26⤵
- Executes dropped EXE
PID:1672 -
\??\c:\bnlvhp.exec:\bnlvhp.exe27⤵
- Executes dropped EXE
PID:864 -
\??\c:\njjpjl.exec:\njjpjl.exe28⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jdpxd.exec:\jdpxd.exe29⤵
- Executes dropped EXE
PID:1620 -
\??\c:\xltlt.exec:\xltlt.exe30⤵
- Executes dropped EXE
PID:2304 -
\??\c:\hnbjt.exec:\hnbjt.exe31⤵
- Executes dropped EXE
PID:3068 -
\??\c:\pvtlfvf.exec:\pvtlfvf.exe32⤵
- Executes dropped EXE
PID:2348 -
\??\c:\lpddp.exec:\lpddp.exe33⤵
- Executes dropped EXE
PID:1268 -
\??\c:\tlhlhv.exec:\tlhlhv.exe34⤵
- Executes dropped EXE
PID:1800 -
\??\c:\nndjffj.exec:\nndjffj.exe35⤵
- Executes dropped EXE
PID:2492 -
\??\c:\nrntlxj.exec:\nrntlxj.exe36⤵
- Executes dropped EXE
PID:2500 -
\??\c:\nhrhnxx.exec:\nhrhnxx.exe37⤵
- Executes dropped EXE
PID:2164 -
\??\c:\pdlfpf.exec:\pdlfpf.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2780 -
\??\c:\pxdljjl.exec:\pxdljjl.exe39⤵
- Executes dropped EXE
PID:2924 -
\??\c:\dljxfp.exec:\dljxfp.exe40⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ltvvldd.exec:\ltvvldd.exe41⤵
- Executes dropped EXE
PID:2948 -
\??\c:\hxltpp.exec:\hxltpp.exe42⤵
- Executes dropped EXE
PID:3056 -
\??\c:\fvpdn.exec:\fvpdn.exe43⤵
- Executes dropped EXE
PID:2668 -
\??\c:\xxnjj.exec:\xxnjj.exe44⤵
- Executes dropped EXE
PID:2684 -
\??\c:\tbnnx.exec:\tbnnx.exe45⤵
- Executes dropped EXE
PID:2632 -
\??\c:\fpvvrn.exec:\fpvvrn.exe46⤵
- Executes dropped EXE
PID:2828 -
\??\c:\drbpdhd.exec:\drbpdhd.exe47⤵
- Executes dropped EXE
PID:1040 -
\??\c:\dbvbd.exec:\dbvbd.exe48⤵
- Executes dropped EXE
PID:2884 -
\??\c:\fdjlhxx.exec:\fdjlhxx.exe49⤵
- Executes dropped EXE
PID:2080 -
\??\c:\vdpbj.exec:\vdpbj.exe50⤵
- Executes dropped EXE
PID:1704 -
\??\c:\pbplt.exec:\pbplt.exe51⤵
- Executes dropped EXE
PID:1780 -
\??\c:\rdlblt.exec:\rdlblt.exe52⤵
- Executes dropped EXE
PID:1656 -
\??\c:\bxdrnbh.exec:\bxdrnbh.exe53⤵
- Executes dropped EXE
PID:2012 -
\??\c:\lbvnttf.exec:\lbvnttf.exe54⤵
- Executes dropped EXE
PID:2960 -
\??\c:\nxvfv.exec:\nxvfv.exe55⤵
- Executes dropped EXE
PID:2324 -
\??\c:\bjbdf.exec:\bjbdf.exe56⤵
- Executes dropped EXE
PID:852 -
\??\c:\bhvphd.exec:\bhvphd.exe57⤵
- Executes dropped EXE
PID:2404 -
\??\c:\jrnln.exec:\jrnln.exe58⤵
- Executes dropped EXE
PID:3048 -
\??\c:\njthf.exec:\njthf.exe59⤵
- Executes dropped EXE
PID:2200 -
\??\c:\vjhvt.exec:\vjhvt.exe60⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xlbdf.exec:\xlbdf.exe61⤵
- Executes dropped EXE
PID:1788 -
\??\c:\brhvxjv.exec:\brhvxjv.exe62⤵
- Executes dropped EXE
PID:2624 -
\??\c:\xrnjxv.exec:\xrnjxv.exe63⤵
- Executes dropped EXE
PID:1756 -
\??\c:\jntnp.exec:\jntnp.exe64⤵
- Executes dropped EXE
PID:2140 -
\??\c:\jjbpb.exec:\jjbpb.exe65⤵
- Executes dropped EXE
PID:2428 -
\??\c:\trdjx.exec:\trdjx.exe66⤵PID:748
-
\??\c:\xntdj.exec:\xntdj.exe67⤵PID:2240
-
\??\c:\dltrbjh.exec:\dltrbjh.exe68⤵PID:2276
-
\??\c:\bnjhdn.exec:\bnjhdn.exe69⤵PID:308
-
\??\c:\lddxdn.exec:\lddxdn.exe70⤵PID:2228
-
\??\c:\hhtvjvx.exec:\hhtvjvx.exe71⤵PID:2280
-
\??\c:\djdxrxl.exec:\djdxrxl.exe72⤵PID:1564
-
\??\c:\tnvvh.exec:\tnvvh.exe73⤵PID:1660
-
\??\c:\pvjfhf.exec:\pvjfhf.exe74⤵PID:2600
-
\??\c:\jbfrvtn.exec:\jbfrvtn.exe75⤵PID:1320
-
\??\c:\ttrdpht.exec:\ttrdpht.exe76⤵PID:1972
-
\??\c:\ldxxhh.exec:\ldxxhh.exe77⤵PID:2836
-
\??\c:\nnnhpvv.exec:\nnnhpvv.exe78⤵PID:2156
-
\??\c:\nrrvtxx.exec:\nrrvtxx.exe79⤵PID:2756
-
\??\c:\lrbth.exec:\lrbth.exe80⤵PID:2912
-
\??\c:\fbjxxhb.exec:\fbjxxhb.exe81⤵PID:2108
-
\??\c:\xphnd.exec:\xphnd.exe82⤵PID:2660
-
\??\c:\hrtxb.exec:\hrtxb.exe83⤵PID:2948
-
\??\c:\dhrdvj.exec:\dhrdvj.exe84⤵PID:2764
-
\??\c:\xbflh.exec:\xbflh.exe85⤵PID:1388
-
\??\c:\vrvxnht.exec:\vrvxnht.exe86⤵PID:2096
-
\??\c:\blxrvl.exec:\blxrvl.exe87⤵PID:1036
-
\??\c:\rlxjdpt.exec:\rlxjdpt.exe88⤵PID:1116
-
\??\c:\jvtxh.exec:\jvtxh.exe89⤵PID:1256
-
\??\c:\nxjdjrn.exec:\nxjdjrn.exe90⤵PID:1152
-
\??\c:\trpdt.exec:\trpdt.exe91⤵PID:1196
-
\??\c:\xfblxd.exec:\xfblxd.exe92⤵PID:1932
-
\??\c:\vrljfpx.exec:\vrljfpx.exe93⤵PID:1148
-
\??\c:\lxdnhj.exec:\lxdnhj.exe94⤵PID:3044
-
\??\c:\xvhfxn.exec:\xvhfxn.exe95⤵
- System Location Discovery: System Language Discovery
PID:3020 -
\??\c:\ldjdn.exec:\ldjdn.exe96⤵PID:2360
-
\??\c:\htbbt.exec:\htbbt.exe97⤵
- System Location Discovery: System Language Discovery
PID:1476 -
\??\c:\vfjtff.exec:\vfjtff.exe98⤵PID:3036
-
\??\c:\vbbxl.exec:\vbbxl.exe99⤵PID:2184
-
\??\c:\jppvpx.exec:\jppvpx.exe100⤵PID:3008
-
\??\c:\rhxft.exec:\rhxft.exe101⤵PID:2548
-
\??\c:\dflrhx.exec:\dflrhx.exe102⤵PID:2484
-
\??\c:\hlpln.exec:\hlpln.exe103⤵PID:1772
-
\??\c:\phxrrv.exec:\phxrrv.exe104⤵PID:1756
-
\??\c:\tdvdvvx.exec:\tdvdvvx.exe105⤵PID:580
-
\??\c:\bjtxvl.exec:\bjtxvl.exe106⤵PID:2428
-
\??\c:\fnrvpp.exec:\fnrvpp.exe107⤵PID:1500
-
\??\c:\pfvjpt.exec:\pfvjpt.exe108⤵PID:2260
-
\??\c:\lfhbvn.exec:\lfhbvn.exe109⤵PID:1824
-
\??\c:\vhvhjj.exec:\vhvhjj.exe110⤵PID:2272
-
\??\c:\nfxtd.exec:\nfxtd.exe111⤵PID:2264
-
\??\c:\xrfflnj.exec:\xrfflnj.exe112⤵PID:2536
-
\??\c:\jnlphh.exec:\jnlphh.exe113⤵PID:2584
-
\??\c:\fffpbl.exec:\fffpbl.exe114⤵PID:1660
-
\??\c:\vrjnbb.exec:\vrjnbb.exe115⤵PID:2564
-
\??\c:\rxfrxnt.exec:\rxfrxnt.exe116⤵PID:1936
-
\??\c:\dvrhrf.exec:\dvrhrf.exe117⤵PID:2016
-
\??\c:\dtdbjf.exec:\dtdbjf.exe118⤵PID:2136
-
\??\c:\htdjrf.exec:\htdjrf.exe119⤵PID:2176
-
\??\c:\fvbrj.exec:\fvbrj.exe120⤵
- System Location Discovery: System Language Discovery
PID:2780 -
\??\c:\hpxpnd.exec:\hpxpnd.exe121⤵PID:2776
-
\??\c:\xrrxrr.exec:\xrrxrr.exe122⤵PID:2740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-