Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 18:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a0fef7a397030d7e3bad73986411a9ddb7747ebbd997e7f1fd1906dd8615863N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
5a0fef7a397030d7e3bad73986411a9ddb7747ebbd997e7f1fd1906dd8615863N.exe
-
Size
456KB
-
MD5
2f0ee2b2a5b0ca29bb6ae2a724fb9090
-
SHA1
11dddd685d5bc3f6d767d4a5905b35b04223a8e0
-
SHA256
5a0fef7a397030d7e3bad73986411a9ddb7747ebbd997e7f1fd1906dd8615863
-
SHA512
749753d32a7d755ca5a1f32645416fb47c56c100f07528664f2e68c89cb91688c478fce74cf96289daaa2eb0734e69440d1dbfe87cc019492068f27ffe3555c2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRr:q7Tc2NYHUrAwfMp3CDRr
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2488-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1472-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-141-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2112-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1016-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/668-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-304-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2616-302-0x00000000777F0000-0x000000007790F000-memory.dmp family_blackmoon behavioral1/memory/2920-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-357-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2884-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-506-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2060-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-549-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1676-552-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2244-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-610-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2368-729-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2168-770-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2052-784-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2004-788-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/904-799-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1512-800-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/816-833-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2568 jtfhhpd.exe 2912 xlxxh.exe 3012 blnfd.exe 2996 nlrhhtd.exe 3060 ldjvjp.exe 2824 hvtdxjr.exe 2056 ttpdh.exe 2744 bpfvtlf.exe 2476 tphnxdj.exe 1472 bdbbr.exe 2700 xxbrl.exe 2136 fxlhh.exe 944 jvjvvlx.exe 2112 brvpl.exe 2328 lhtrnn.exe 1016 lvfvn.exe 2036 vnfnpl.exe 2412 xrpjdh.exe 2176 pbxhft.exe 2232 xpnlj.exe 2068 hhttx.exe 1716 rhlnxjn.exe 2584 pjfxlp.exe 1384 bhxpjp.exe 1496 hlvfb.exe 1052 rtdfv.exe 1648 pdvplh.exe 668 ldhthr.exe 2296 bvfvr.exe 2596 txnvtpr.exe 1036 hxfpx.exe 1568 dlhhdf.exe 2616 fbhxdnn.exe 1620 xnlnhb.exe 2920 rtdlnhj.exe 2916 pflhdd.exe 2032 llbrv.exe 3040 xbddp.exe 3016 rxbfh.exe 2884 pbrfbv.exe 2908 ndxrf.exe 2224 rpjddjx.exe 836 trfxl.exe 1996 rnxjd.exe 2316 nhjtv.exe 2628 fhfxbr.exe 2948 rljfd.exe 436 ptbbxfj.exe 1984 rxtdrpd.exe 1120 rdlfvp.exe 2480 hnrbx.exe 1148 bjtnfrl.exe 2300 lphdd.exe 2080 rrvbvbr.exe 2420 flnbbfl.exe 2180 xndnpxd.exe 2432 xnxxpj.exe 2260 brfndjt.exe 2256 jtplx.exe 1876 xlxrnvl.exe 2188 dpppflx.exe 1716 jbpjlp.exe 720 tprhvt.exe 2460 jlpbxjj.exe -
resource yara_rule behavioral1/memory/2488-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-302-0x00000000777F0000-0x000000007790F000-memory.dmp upx behavioral1/memory/2920-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-452-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2260-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-549-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/2244-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-610-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2164-737-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-785-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-800-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-807-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/816-833-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-853-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdflhvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thvrfdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptjptx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fddfbhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljvljd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxdtrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htdnpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfnfllv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptjrfhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfldfbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drnhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blvnjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpjjxlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnntdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xldft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrrjlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpxdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbpjjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbljvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbjlxrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdxrndh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpnptf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pffbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdhhnvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pphjrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpjddjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbrtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtfxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jndxbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vthvrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbjvht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnhbtbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frnfhhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llbrft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfvbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhjfrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnhbdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxndd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbhtrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhntjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnfnpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtdlnhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rljfd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2568 2488 5a0fef7a397030d7e3bad73986411a9ddb7747ebbd997e7f1fd1906dd8615863N.exe 30 PID 2488 wrote to memory of 2568 2488 5a0fef7a397030d7e3bad73986411a9ddb7747ebbd997e7f1fd1906dd8615863N.exe 30 PID 2488 wrote to memory of 2568 2488 5a0fef7a397030d7e3bad73986411a9ddb7747ebbd997e7f1fd1906dd8615863N.exe 30 PID 2488 wrote to memory of 2568 2488 5a0fef7a397030d7e3bad73986411a9ddb7747ebbd997e7f1fd1906dd8615863N.exe 30 PID 2568 wrote to memory of 2912 2568 jtfhhpd.exe 31 PID 2568 wrote to memory of 2912 2568 jtfhhpd.exe 31 PID 2568 wrote to memory of 2912 2568 jtfhhpd.exe 31 PID 2568 wrote to memory of 2912 2568 jtfhhpd.exe 31 PID 2912 wrote to memory of 3012 2912 xlxxh.exe 32 PID 2912 wrote to memory of 3012 2912 xlxxh.exe 32 PID 2912 wrote to memory of 3012 2912 xlxxh.exe 32 PID 2912 wrote to memory of 3012 2912 xlxxh.exe 32 PID 3012 wrote to memory of 2996 3012 blnfd.exe 33 PID 3012 wrote to memory of 2996 3012 blnfd.exe 33 PID 3012 wrote to memory of 2996 3012 blnfd.exe 33 PID 3012 wrote to memory of 2996 3012 blnfd.exe 33 PID 2996 wrote to memory of 3060 2996 nlrhhtd.exe 34 PID 2996 wrote to memory of 3060 2996 nlrhhtd.exe 34 PID 2996 wrote to memory of 3060 2996 nlrhhtd.exe 34 PID 2996 wrote to memory of 3060 2996 nlrhhtd.exe 34 PID 3060 wrote to memory of 2824 3060 ldjvjp.exe 35 PID 3060 wrote to memory of 2824 3060 ldjvjp.exe 35 PID 3060 wrote to memory of 2824 3060 ldjvjp.exe 35 PID 3060 wrote to memory of 2824 3060 ldjvjp.exe 35 PID 2824 wrote to memory of 2056 2824 hvtdxjr.exe 36 PID 2824 wrote to memory of 2056 2824 hvtdxjr.exe 36 PID 2824 wrote to memory of 2056 2824 hvtdxjr.exe 36 PID 2824 wrote to memory of 2056 2824 hvtdxjr.exe 36 PID 2056 wrote to memory of 2744 2056 ttpdh.exe 37 PID 2056 wrote to memory of 2744 2056 ttpdh.exe 37 PID 2056 wrote to memory of 2744 2056 ttpdh.exe 37 PID 2056 wrote to memory of 2744 2056 ttpdh.exe 37 PID 2744 wrote to memory of 2476 2744 bpfvtlf.exe 38 PID 2744 wrote to memory of 2476 2744 bpfvtlf.exe 38 PID 2744 wrote to memory of 2476 2744 bpfvtlf.exe 38 PID 2744 wrote to memory of 2476 2744 bpfvtlf.exe 38 PID 2476 wrote to memory of 1472 2476 tphnxdj.exe 39 PID 2476 wrote to memory of 1472 2476 tphnxdj.exe 39 PID 2476 wrote to memory of 1472 2476 tphnxdj.exe 39 PID 2476 wrote to memory of 1472 2476 tphnxdj.exe 39 PID 1472 wrote to memory of 2700 1472 bdbbr.exe 40 PID 1472 wrote to memory of 2700 1472 bdbbr.exe 40 PID 1472 wrote to memory of 2700 1472 bdbbr.exe 40 PID 1472 wrote to memory of 2700 1472 bdbbr.exe 40 PID 2700 wrote to memory of 2136 2700 xxbrl.exe 41 PID 2700 wrote to memory of 2136 2700 xxbrl.exe 41 PID 2700 wrote to memory of 2136 2700 xxbrl.exe 41 PID 2700 wrote to memory of 2136 2700 xxbrl.exe 41 PID 2136 wrote to memory of 944 2136 fxlhh.exe 42 PID 2136 wrote to memory of 944 2136 fxlhh.exe 42 PID 2136 wrote to memory of 944 2136 fxlhh.exe 42 PID 2136 wrote to memory of 944 2136 fxlhh.exe 42 PID 944 wrote to memory of 2112 944 jvjvvlx.exe 43 PID 944 wrote to memory of 2112 944 jvjvvlx.exe 43 PID 944 wrote to memory of 2112 944 jvjvvlx.exe 43 PID 944 wrote to memory of 2112 944 jvjvvlx.exe 43 PID 2112 wrote to memory of 2328 2112 brvpl.exe 44 PID 2112 wrote to memory of 2328 2112 brvpl.exe 44 PID 2112 wrote to memory of 2328 2112 brvpl.exe 44 PID 2112 wrote to memory of 2328 2112 brvpl.exe 44 PID 2328 wrote to memory of 1016 2328 lhtrnn.exe 45 PID 2328 wrote to memory of 1016 2328 lhtrnn.exe 45 PID 2328 wrote to memory of 1016 2328 lhtrnn.exe 45 PID 2328 wrote to memory of 1016 2328 lhtrnn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a0fef7a397030d7e3bad73986411a9ddb7747ebbd997e7f1fd1906dd8615863N.exe"C:\Users\Admin\AppData\Local\Temp\5a0fef7a397030d7e3bad73986411a9ddb7747ebbd997e7f1fd1906dd8615863N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\jtfhhpd.exec:\jtfhhpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\xlxxh.exec:\xlxxh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\blnfd.exec:\blnfd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\nlrhhtd.exec:\nlrhhtd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\ldjvjp.exec:\ldjvjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\hvtdxjr.exec:\hvtdxjr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\ttpdh.exec:\ttpdh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\bpfvtlf.exec:\bpfvtlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\tphnxdj.exec:\tphnxdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\bdbbr.exec:\bdbbr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\xxbrl.exec:\xxbrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\fxlhh.exec:\fxlhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\jvjvvlx.exec:\jvjvvlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\brvpl.exec:\brvpl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\lhtrnn.exec:\lhtrnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\lvfvn.exec:\lvfvn.exe17⤵
- Executes dropped EXE
PID:1016 -
\??\c:\vnfnpl.exec:\vnfnpl.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2036 -
\??\c:\xrpjdh.exec:\xrpjdh.exe19⤵
- Executes dropped EXE
PID:2412 -
\??\c:\pbxhft.exec:\pbxhft.exe20⤵
- Executes dropped EXE
PID:2176 -
\??\c:\xpnlj.exec:\xpnlj.exe21⤵
- Executes dropped EXE
PID:2232 -
\??\c:\hhttx.exec:\hhttx.exe22⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rhlnxjn.exec:\rhlnxjn.exe23⤵
- Executes dropped EXE
PID:1716 -
\??\c:\pjfxlp.exec:\pjfxlp.exe24⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bhxpjp.exec:\bhxpjp.exe25⤵
- Executes dropped EXE
PID:1384 -
\??\c:\hlvfb.exec:\hlvfb.exe26⤵
- Executes dropped EXE
PID:1496 -
\??\c:\rtdfv.exec:\rtdfv.exe27⤵
- Executes dropped EXE
PID:1052 -
\??\c:\pdvplh.exec:\pdvplh.exe28⤵
- Executes dropped EXE
PID:1648 -
\??\c:\ldhthr.exec:\ldhthr.exe29⤵
- Executes dropped EXE
PID:668 -
\??\c:\bvfvr.exec:\bvfvr.exe30⤵
- Executes dropped EXE
PID:2296 -
\??\c:\txnvtpr.exec:\txnvtpr.exe31⤵
- Executes dropped EXE
PID:2596 -
\??\c:\hxfpx.exec:\hxfpx.exe32⤵
- Executes dropped EXE
PID:1036 -
\??\c:\dlhhdf.exec:\dlhhdf.exe33⤵
- Executes dropped EXE
PID:1568 -
\??\c:\fbhxdnn.exec:\fbhxdnn.exe34⤵
- Executes dropped EXE
PID:2616 -
\??\c:\djtrpb.exec:\djtrpb.exe35⤵PID:1692
-
\??\c:\xnlnhb.exec:\xnlnhb.exe36⤵
- Executes dropped EXE
PID:1620 -
\??\c:\rtdlnhj.exec:\rtdlnhj.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2920 -
\??\c:\pflhdd.exec:\pflhdd.exe38⤵
- Executes dropped EXE
PID:2916 -
\??\c:\llbrv.exec:\llbrv.exe39⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xbddp.exec:\xbddp.exe40⤵
- Executes dropped EXE
PID:3040 -
\??\c:\rxbfh.exec:\rxbfh.exe41⤵
- Executes dropped EXE
PID:3016 -
\??\c:\pbrfbv.exec:\pbrfbv.exe42⤵
- Executes dropped EXE
PID:2884 -
\??\c:\ndxrf.exec:\ndxrf.exe43⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rpjddjx.exec:\rpjddjx.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2224 -
\??\c:\trfxl.exec:\trfxl.exe45⤵
- Executes dropped EXE
PID:836 -
\??\c:\rnxjd.exec:\rnxjd.exe46⤵
- Executes dropped EXE
PID:1996 -
\??\c:\nhjtv.exec:\nhjtv.exe47⤵
- Executes dropped EXE
PID:2316 -
\??\c:\fhfxbr.exec:\fhfxbr.exe48⤵
- Executes dropped EXE
PID:2628 -
\??\c:\rljfd.exec:\rljfd.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2948 -
\??\c:\ptbbxfj.exec:\ptbbxfj.exe50⤵
- Executes dropped EXE
PID:436 -
\??\c:\rxtdrpd.exec:\rxtdrpd.exe51⤵
- Executes dropped EXE
PID:1984 -
\??\c:\rdlfvp.exec:\rdlfvp.exe52⤵
- Executes dropped EXE
PID:1120 -
\??\c:\hnrbx.exec:\hnrbx.exe53⤵
- Executes dropped EXE
PID:2480 -
\??\c:\bjtnfrl.exec:\bjtnfrl.exe54⤵
- Executes dropped EXE
PID:1148 -
\??\c:\lphdd.exec:\lphdd.exe55⤵
- Executes dropped EXE
PID:2300 -
\??\c:\rrvbvbr.exec:\rrvbvbr.exe56⤵
- Executes dropped EXE
PID:2080 -
\??\c:\flnbbfl.exec:\flnbbfl.exe57⤵
- Executes dropped EXE
PID:2420 -
\??\c:\xndnpxd.exec:\xndnpxd.exe58⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xnxxpj.exec:\xnxxpj.exe59⤵
- Executes dropped EXE
PID:2432 -
\??\c:\brfndjt.exec:\brfndjt.exe60⤵
- Executes dropped EXE
PID:2260 -
\??\c:\jtplx.exec:\jtplx.exe61⤵
- Executes dropped EXE
PID:2256 -
\??\c:\xlxrnvl.exec:\xlxrnvl.exe62⤵
- Executes dropped EXE
PID:1876 -
\??\c:\dpppflx.exec:\dpppflx.exe63⤵
- Executes dropped EXE
PID:2188 -
\??\c:\jbpjlp.exec:\jbpjlp.exe64⤵
- Executes dropped EXE
PID:1716 -
\??\c:\tprhvt.exec:\tprhvt.exe65⤵
- Executes dropped EXE
PID:720 -
\??\c:\jlpbxjj.exec:\jlpbxjj.exe66⤵
- Executes dropped EXE
PID:2460 -
\??\c:\pfhtx.exec:\pfhtx.exe67⤵PID:1100
-
\??\c:\prtltln.exec:\prtltln.exe68⤵PID:1496
-
\??\c:\bpxpth.exec:\bpxpth.exe69⤵PID:2060
-
\??\c:\tbltdf.exec:\tbltdf.exe70⤵PID:1544
-
\??\c:\bbhtnl.exec:\bbhtnl.exe71⤵PID:1676
-
\??\c:\xdlrfh.exec:\xdlrfh.exe72⤵PID:1736
-
\??\c:\fntpp.exec:\fntpp.exe73⤵PID:772
-
\??\c:\htdnpp.exec:\htdnpp.exe74⤵
- System Location Discovery: System Language Discovery
PID:1960 -
\??\c:\hhtbhnd.exec:\hhtbhnd.exe75⤵PID:1036
-
\??\c:\dxpfph.exec:\dxpfph.exe76⤵PID:2560
-
\??\c:\jnbtr.exec:\jnbtr.exe77⤵PID:2864
-
\??\c:\flpxxnv.exec:\flpxxnv.exe78⤵PID:2244
-
\??\c:\xptrt.exec:\xptrt.exe79⤵PID:2900
-
\??\c:\nfbvdhf.exec:\nfbvdhf.exe80⤵PID:3008
-
\??\c:\lnrrt.exec:\lnrrt.exe81⤵PID:2924
-
\??\c:\bbrxdtb.exec:\bbrxdtb.exe82⤵PID:3000
-
\??\c:\rpvllb.exec:\rpvllb.exe83⤵PID:3064
-
\??\c:\njrpj.exec:\njrpj.exe84⤵PID:3060
-
\??\c:\dlhtxvh.exec:\dlhtxvh.exe85⤵PID:2772
-
\??\c:\lrxhln.exec:\lrxhln.exe86⤵PID:2788
-
\??\c:\rprtd.exec:\rprtd.exe87⤵PID:2820
-
\??\c:\btpnt.exec:\btpnt.exe88⤵PID:1336
-
\??\c:\jnlhppx.exec:\jnlhppx.exe89⤵PID:2456
-
\??\c:\dbrffl.exec:\dbrffl.exe90⤵PID:1996
-
\??\c:\jblnx.exec:\jblnx.exe91⤵PID:2316
-
\??\c:\tvtfj.exec:\tvtfj.exe92⤵PID:1856
-
\??\c:\hjpbl.exec:\hjpbl.exe93⤵PID:2948
-
\??\c:\xfbhlx.exec:\xfbhlx.exe94⤵PID:1656
-
\??\c:\vhdtj.exec:\vhdtj.exe95⤵PID:2136
-
\??\c:\hnltt.exec:\hnltt.exe96⤵PID:2368
-
\??\c:\lfbjlvp.exec:\lfbjlvp.exe97⤵PID:3024
-
\??\c:\dnxrn.exec:\dnxrn.exe98⤵PID:272
-
\??\c:\jvrrdbv.exec:\jvrrdbv.exe99⤵PID:1540
-
\??\c:\pvpjb.exec:\pvpjb.exe100⤵PID:1768
-
\??\c:\jbtltdv.exec:\jbtltdv.exe101⤵PID:2164
-
\??\c:\bvnfxv.exec:\bvnfxv.exe102⤵PID:588
-
\??\c:\rbrvnf.exec:\rbrvnf.exe103⤵PID:2376
-
\??\c:\frfhdxp.exec:\frfhdxp.exe104⤵PID:2052
-
\??\c:\rbbpdt.exec:\rbbpdt.exe105⤵PID:2168
-
\??\c:\bldvr.exec:\bldvr.exe106⤵PID:904
-
\??\c:\fpxprft.exec:\fpxprft.exe107⤵PID:2692
-
\??\c:\hhdbd.exec:\hhdbd.exe108⤵PID:2004
-
\??\c:\vbljvx.exec:\vbljvx.exe109⤵PID:1788
-
\??\c:\frrdf.exec:\frrdf.exe110⤵PID:1512
-
\??\c:\bvfldb.exec:\bvfldb.exe111⤵PID:2484
-
\??\c:\tphpxln.exec:\tphpxln.exe112⤵PID:1936
-
\??\c:\npjnbt.exec:\npjnbt.exe113⤵PID:108
-
\??\c:\jnjvxnl.exec:\jnjvxnl.exe114⤵PID:816
-
\??\c:\vnbrbt.exec:\vnbrbt.exe115⤵PID:1532
-
\??\c:\tfrlr.exec:\tfrlr.exe116⤵PID:1332
-
\??\c:\fthpp.exec:\fthpp.exe117⤵PID:2296
-
\??\c:\lndjhhf.exec:\lndjhhf.exe118⤵PID:1960
-
\??\c:\xlfbf.exec:\xlfbf.exe119⤵PID:1580
-
\??\c:\dxrnd.exec:\dxrnd.exe120⤵PID:2560
-
\??\c:\nrjdblj.exec:\nrjdblj.exe121⤵PID:1476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-