Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 19:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
540603761e43c90c1329fc9e689d2cfd2fd6fa012ee07c342ddd54db9ac61080.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
540603761e43c90c1329fc9e689d2cfd2fd6fa012ee07c342ddd54db9ac61080.exe
-
Size
454KB
-
MD5
7bda01d16c5ab3e3b5591247fc77f984
-
SHA1
1e917cd2df494541d9faa2a2c45890aed8aa6941
-
SHA256
540603761e43c90c1329fc9e689d2cfd2fd6fa012ee07c342ddd54db9ac61080
-
SHA512
e2b84ae9ca724a71017c2dbb9eb13eb3f7eff7f82ee66266475cea6db8dfbb6670b4db8aa9d6760ddec60553eaf63351f1dd9b535a3691d9c163eb94d7859da9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeD:q7Tc2NYHUrAwfMp3CDD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/1128-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-119-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2136-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-185-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2452-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-306-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/760-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-504-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1972-555-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1708-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-595-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1816-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-625-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/872-895-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2828-940-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-978-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1128 jhjht.exe 2184 xthpfj.exe 584 hdvvr.exe 2952 xnvff.exe 2968 xbjxdtv.exe 2836 rlrtjdv.exe 2016 pjjxvf.exe 2884 xhxrlb.exe 2272 bhhxnvt.exe 2988 hprnlhp.exe 944 nnrlv.exe 1784 jttpdpv.exe 2136 hhnpxff.exe 2860 tfxfp.exe 3036 dfbxnx.exe 2032 nptff.exe 904 hlnbjhn.exe 1304 nnrjtdf.exe 2308 rxhxn.exe 864 xxhvr.exe 2452 hxtljbl.exe 2064 xrrvf.exe 2672 nhnftx.exe 1800 hdxhbxt.exe 1572 vnpjlrn.exe 2400 xnnvvxn.exe 2204 frhrfj.exe 1708 xjjvf.exe 2628 lxbnpf.exe 2636 vbvxbfd.exe 536 rrjhddr.exe 1816 xbbpr.exe 2236 pnvvjd.exe 760 vhxjpvf.exe 1984 ljbtf.exe 1620 hpxdflv.exe 2128 tlxflfb.exe 2020 rfdtr.exe 3064 pphphlp.exe 2844 hdbptdt.exe 2152 bjnxxhv.exe 2944 ntvvf.exe 2824 xxfvvj.exe 2516 jxhvt.exe 2884 rptrx.exe 2484 vxprdr.exe 1692 dnrpxr.exe 2984 ljpfprx.exe 1248 xvfnr.exe 3028 bhbffnh.exe 668 fjptvxb.exe 1660 rpvlf.exe 2860 xtdxn.exe 2088 prpvlhp.exe 2120 hphxbf.exe 2352 tthnddj.exe 2292 jnlvxt.exe 2504 fvjnvvl.exe 2232 tnljftb.exe 2412 hfjlll.exe 1960 pdfdvfr.exe 2452 hbtbnhp.exe 2408 djdrjn.exe 2064 rrlrn.exe -
resource yara_rule behavioral1/memory/1128-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-921-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-940-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-978-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tddrhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttlxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jprvbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxhtlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhdrhph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drnbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpntdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptnnnhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnbfbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bflxvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbrhfdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njdndv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfjft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brlfjnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnpvflt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fplvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xftxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlbdnvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvhxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jptbnxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bppxnrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llhpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbvlvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtxjtdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvprdld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbhpld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhtjrpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prfdrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjntdnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdxjhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnthrdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxtxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvbdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpdbvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrnjtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxvpljt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1688 wrote to memory of 1128 1688 540603761e43c90c1329fc9e689d2cfd2fd6fa012ee07c342ddd54db9ac61080.exe 30 PID 1688 wrote to memory of 1128 1688 540603761e43c90c1329fc9e689d2cfd2fd6fa012ee07c342ddd54db9ac61080.exe 30 PID 1688 wrote to memory of 1128 1688 540603761e43c90c1329fc9e689d2cfd2fd6fa012ee07c342ddd54db9ac61080.exe 30 PID 1688 wrote to memory of 1128 1688 540603761e43c90c1329fc9e689d2cfd2fd6fa012ee07c342ddd54db9ac61080.exe 30 PID 1128 wrote to memory of 2184 1128 jhjht.exe 31 PID 1128 wrote to memory of 2184 1128 jhjht.exe 31 PID 1128 wrote to memory of 2184 1128 jhjht.exe 31 PID 1128 wrote to memory of 2184 1128 jhjht.exe 31 PID 2184 wrote to memory of 584 2184 xthpfj.exe 32 PID 2184 wrote to memory of 584 2184 xthpfj.exe 32 PID 2184 wrote to memory of 584 2184 xthpfj.exe 32 PID 2184 wrote to memory of 584 2184 xthpfj.exe 32 PID 584 wrote to memory of 2952 584 hdvvr.exe 33 PID 584 wrote to memory of 2952 584 hdvvr.exe 33 PID 584 wrote to memory of 2952 584 hdvvr.exe 33 PID 584 wrote to memory of 2952 584 hdvvr.exe 33 PID 2952 wrote to memory of 2968 2952 xnvff.exe 34 PID 2952 wrote to memory of 2968 2952 xnvff.exe 34 PID 2952 wrote to memory of 2968 2952 xnvff.exe 34 PID 2952 wrote to memory of 2968 2952 xnvff.exe 34 PID 2968 wrote to memory of 2836 2968 xbjxdtv.exe 35 PID 2968 wrote to memory of 2836 2968 xbjxdtv.exe 35 PID 2968 wrote to memory of 2836 2968 xbjxdtv.exe 35 PID 2968 wrote to memory of 2836 2968 xbjxdtv.exe 35 PID 2836 wrote to memory of 2016 2836 rlrtjdv.exe 36 PID 2836 wrote to memory of 2016 2836 rlrtjdv.exe 36 PID 2836 wrote to memory of 2016 2836 rlrtjdv.exe 36 PID 2836 wrote to memory of 2016 2836 rlrtjdv.exe 36 PID 2016 wrote to memory of 2884 2016 pjjxvf.exe 37 PID 2016 wrote to memory of 2884 2016 pjjxvf.exe 37 PID 2016 wrote to memory of 2884 2016 pjjxvf.exe 37 PID 2016 wrote to memory of 2884 2016 pjjxvf.exe 37 PID 2884 wrote to memory of 2272 2884 xhxrlb.exe 38 PID 2884 wrote to memory of 2272 2884 xhxrlb.exe 38 PID 2884 wrote to memory of 2272 2884 xhxrlb.exe 38 PID 2884 wrote to memory of 2272 2884 xhxrlb.exe 38 PID 2272 wrote to memory of 2988 2272 bhhxnvt.exe 39 PID 2272 wrote to memory of 2988 2272 bhhxnvt.exe 39 PID 2272 wrote to memory of 2988 2272 bhhxnvt.exe 39 PID 2272 wrote to memory of 2988 2272 bhhxnvt.exe 39 PID 2988 wrote to memory of 944 2988 hprnlhp.exe 40 PID 2988 wrote to memory of 944 2988 hprnlhp.exe 40 PID 2988 wrote to memory of 944 2988 hprnlhp.exe 40 PID 2988 wrote to memory of 944 2988 hprnlhp.exe 40 PID 944 wrote to memory of 1784 944 nnrlv.exe 41 PID 944 wrote to memory of 1784 944 nnrlv.exe 41 PID 944 wrote to memory of 1784 944 nnrlv.exe 41 PID 944 wrote to memory of 1784 944 nnrlv.exe 41 PID 1784 wrote to memory of 2136 1784 jttpdpv.exe 42 PID 1784 wrote to memory of 2136 1784 jttpdpv.exe 42 PID 1784 wrote to memory of 2136 1784 jttpdpv.exe 42 PID 1784 wrote to memory of 2136 1784 jttpdpv.exe 42 PID 2136 wrote to memory of 2860 2136 hhnpxff.exe 43 PID 2136 wrote to memory of 2860 2136 hhnpxff.exe 43 PID 2136 wrote to memory of 2860 2136 hhnpxff.exe 43 PID 2136 wrote to memory of 2860 2136 hhnpxff.exe 43 PID 2860 wrote to memory of 3036 2860 tfxfp.exe 44 PID 2860 wrote to memory of 3036 2860 tfxfp.exe 44 PID 2860 wrote to memory of 3036 2860 tfxfp.exe 44 PID 2860 wrote to memory of 3036 2860 tfxfp.exe 44 PID 3036 wrote to memory of 2032 3036 dfbxnx.exe 45 PID 3036 wrote to memory of 2032 3036 dfbxnx.exe 45 PID 3036 wrote to memory of 2032 3036 dfbxnx.exe 45 PID 3036 wrote to memory of 2032 3036 dfbxnx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\540603761e43c90c1329fc9e689d2cfd2fd6fa012ee07c342ddd54db9ac61080.exe"C:\Users\Admin\AppData\Local\Temp\540603761e43c90c1329fc9e689d2cfd2fd6fa012ee07c342ddd54db9ac61080.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\jhjht.exec:\jhjht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\xthpfj.exec:\xthpfj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\hdvvr.exec:\hdvvr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:584 -
\??\c:\xnvff.exec:\xnvff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\xbjxdtv.exec:\xbjxdtv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\rlrtjdv.exec:\rlrtjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\pjjxvf.exec:\pjjxvf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\xhxrlb.exec:\xhxrlb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\bhhxnvt.exec:\bhhxnvt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\hprnlhp.exec:\hprnlhp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\nnrlv.exec:\nnrlv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\jttpdpv.exec:\jttpdpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\hhnpxff.exec:\hhnpxff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\tfxfp.exec:\tfxfp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\dfbxnx.exec:\dfbxnx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\nptff.exec:\nptff.exe17⤵
- Executes dropped EXE
PID:2032 -
\??\c:\hlnbjhn.exec:\hlnbjhn.exe18⤵
- Executes dropped EXE
PID:904 -
\??\c:\nnrjtdf.exec:\nnrjtdf.exe19⤵
- Executes dropped EXE
PID:1304 -
\??\c:\rxhxn.exec:\rxhxn.exe20⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xxhvr.exec:\xxhvr.exe21⤵
- Executes dropped EXE
PID:864 -
\??\c:\hxtljbl.exec:\hxtljbl.exe22⤵
- Executes dropped EXE
PID:2452 -
\??\c:\xrrvf.exec:\xrrvf.exe23⤵
- Executes dropped EXE
PID:2064 -
\??\c:\nhnftx.exec:\nhnftx.exe24⤵
- Executes dropped EXE
PID:2672 -
\??\c:\hdxhbxt.exec:\hdxhbxt.exe25⤵
- Executes dropped EXE
PID:1800 -
\??\c:\vnpjlrn.exec:\vnpjlrn.exe26⤵
- Executes dropped EXE
PID:1572 -
\??\c:\xnnvvxn.exec:\xnnvvxn.exe27⤵
- Executes dropped EXE
PID:2400 -
\??\c:\frhrfj.exec:\frhrfj.exe28⤵
- Executes dropped EXE
PID:2204 -
\??\c:\xjjvf.exec:\xjjvf.exe29⤵
- Executes dropped EXE
PID:1708 -
\??\c:\lxbnpf.exec:\lxbnpf.exe30⤵
- Executes dropped EXE
PID:2628 -
\??\c:\vbvxbfd.exec:\vbvxbfd.exe31⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rrjhddr.exec:\rrjhddr.exe32⤵
- Executes dropped EXE
PID:536 -
\??\c:\xbbpr.exec:\xbbpr.exe33⤵
- Executes dropped EXE
PID:1816 -
\??\c:\pnvvjd.exec:\pnvvjd.exe34⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vhxjpvf.exec:\vhxjpvf.exe35⤵
- Executes dropped EXE
PID:760 -
\??\c:\ljbtf.exec:\ljbtf.exe36⤵
- Executes dropped EXE
PID:1984 -
\??\c:\hpxdflv.exec:\hpxdflv.exe37⤵
- Executes dropped EXE
PID:1620 -
\??\c:\tlxflfb.exec:\tlxflfb.exe38⤵
- Executes dropped EXE
PID:2128 -
\??\c:\rfdtr.exec:\rfdtr.exe39⤵
- Executes dropped EXE
PID:2020 -
\??\c:\pphphlp.exec:\pphphlp.exe40⤵
- Executes dropped EXE
PID:3064 -
\??\c:\hdbptdt.exec:\hdbptdt.exe41⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bjnxxhv.exec:\bjnxxhv.exe42⤵
- Executes dropped EXE
PID:2152 -
\??\c:\ntvvf.exec:\ntvvf.exe43⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xxfvvj.exec:\xxfvvj.exe44⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jxhvt.exec:\jxhvt.exe45⤵
- Executes dropped EXE
PID:2516 -
\??\c:\rptrx.exec:\rptrx.exe46⤵
- Executes dropped EXE
PID:2884 -
\??\c:\vxprdr.exec:\vxprdr.exe47⤵
- Executes dropped EXE
PID:2484 -
\??\c:\dnrpxr.exec:\dnrpxr.exe48⤵
- Executes dropped EXE
PID:1692 -
\??\c:\ljpfprx.exec:\ljpfprx.exe49⤵
- Executes dropped EXE
PID:2984 -
\??\c:\xvfnr.exec:\xvfnr.exe50⤵
- Executes dropped EXE
PID:1248 -
\??\c:\bhbffnh.exec:\bhbffnh.exe51⤵
- Executes dropped EXE
PID:3028 -
\??\c:\fjptvxb.exec:\fjptvxb.exe52⤵
- Executes dropped EXE
PID:668 -
\??\c:\rpvlf.exec:\rpvlf.exe53⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xtdxn.exec:\xtdxn.exe54⤵
- Executes dropped EXE
PID:2860 -
\??\c:\prpvlhp.exec:\prpvlhp.exe55⤵
- Executes dropped EXE
PID:2088 -
\??\c:\hphxbf.exec:\hphxbf.exe56⤵
- Executes dropped EXE
PID:2120 -
\??\c:\tthnddj.exec:\tthnddj.exe57⤵
- Executes dropped EXE
PID:2352 -
\??\c:\jnlvxt.exec:\jnlvxt.exe58⤵
- Executes dropped EXE
PID:2292 -
\??\c:\fvjnvvl.exec:\fvjnvvl.exe59⤵
- Executes dropped EXE
PID:2504 -
\??\c:\tnljftb.exec:\tnljftb.exe60⤵
- Executes dropped EXE
PID:2232 -
\??\c:\hfjlll.exec:\hfjlll.exe61⤵
- Executes dropped EXE
PID:2412 -
\??\c:\pdfdvfr.exec:\pdfdvfr.exe62⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hbtbnhp.exec:\hbtbnhp.exe63⤵
- Executes dropped EXE
PID:2452 -
\??\c:\djdrjn.exec:\djdrjn.exe64⤵
- Executes dropped EXE
PID:2408 -
\??\c:\rrlrn.exec:\rrlrn.exe65⤵
- Executes dropped EXE
PID:2064 -
\??\c:\dxxpt.exec:\dxxpt.exe66⤵PID:612
-
\??\c:\hlrdn.exec:\hlrdn.exe67⤵PID:960
-
\??\c:\bjljxpp.exec:\bjljxpp.exe68⤵PID:1972
-
\??\c:\nttjf.exec:\nttjf.exe69⤵PID:1572
-
\??\c:\ltppdv.exec:\ltppdv.exe70⤵PID:2400
-
\??\c:\hrrpjjr.exec:\hrrpjjr.exe71⤵PID:112
-
\??\c:\dlhhfpj.exec:\dlhhfpj.exe72⤵PID:1708
-
\??\c:\bbpjr.exec:\bbpjr.exe73⤵PID:1820
-
\??\c:\vrddpr.exec:\vrddpr.exe74⤵PID:2588
-
\??\c:\ttlxd.exec:\ttlxd.exe75⤵
- System Location Discovery: System Language Discovery
PID:2608 -
\??\c:\tnxrh.exec:\tnxrh.exe76⤵PID:1288
-
\??\c:\xnlfv.exec:\xnlfv.exe77⤵PID:1816
-
\??\c:\rbbfbr.exec:\rbbfbr.exe78⤵PID:1456
-
\??\c:\dhbptp.exec:\dhbptp.exe79⤵PID:760
-
\??\c:\hbbtbld.exec:\hbbtbld.exe80⤵PID:2916
-
\??\c:\frpvtf.exec:\frpvtf.exe81⤵PID:1620
-
\??\c:\lrjhnd.exec:\lrjhnd.exe82⤵PID:2960
-
\??\c:\hbrfpl.exec:\hbrfpl.exe83⤵PID:3012
-
\??\c:\fdlvj.exec:\fdlvj.exe84⤵PID:2940
-
\??\c:\jnxnjb.exec:\jnxnjb.exe85⤵PID:2980
-
\??\c:\bftdpp.exec:\bftdpp.exe86⤵PID:1804
-
\??\c:\nfrnjl.exec:\nfrnjl.exe87⤵PID:2944
-
\??\c:\pprftr.exec:\pprftr.exe88⤵PID:2524
-
\??\c:\rbbpvld.exec:\rbbpvld.exe89⤵PID:1968
-
\??\c:\xhrhd.exec:\xhrhd.exe90⤵PID:2784
-
\??\c:\vnthrdl.exec:\vnthrdl.exe91⤵
- System Location Discovery: System Language Discovery
PID:2272 -
\??\c:\jptbnxt.exec:\jptbnxt.exe92⤵
- System Location Discovery: System Language Discovery
PID:2260 -
\??\c:\plfxjx.exec:\plfxjx.exe93⤵PID:2868
-
\??\c:\prlpvhd.exec:\prlpvhd.exe94⤵PID:1460
-
\??\c:\xjptfrv.exec:\xjptfrv.exe95⤵PID:2664
-
\??\c:\dltvf.exec:\dltvf.exe96⤵PID:2340
-
\??\c:\fhfnx.exec:\fhfnx.exe97⤵PID:2460
-
\??\c:\ndptb.exec:\ndptb.exe98⤵PID:2356
-
\??\c:\trdjb.exec:\trdjb.exe99⤵PID:2348
-
\??\c:\jptvhj.exec:\jptvhj.exe100⤵PID:2032
-
\??\c:\lhvpj.exec:\lhvpj.exe101⤵PID:764
-
\??\c:\bppxnrx.exec:\bppxnrx.exe102⤵
- System Location Discovery: System Language Discovery
PID:564 -
\??\c:\pldlnh.exec:\pldlnh.exe103⤵PID:1532
-
\??\c:\vfthnb.exec:\vfthnb.exe104⤵PID:2656
-
\??\c:\fbbdvh.exec:\fbbdvh.exe105⤵PID:2404
-
\??\c:\pnxffn.exec:\pnxffn.exe106⤵PID:972
-
\??\c:\hrtlnfp.exec:\hrtlnfp.exe107⤵PID:1992
-
\??\c:\lrrdl.exec:\lrrdl.exe108⤵PID:912
-
\??\c:\dhbbdx.exec:\dhbbdx.exe109⤵PID:2148
-
\??\c:\fpnhjjb.exec:\fpnhjjb.exe110⤵PID:1420
-
\??\c:\rptbnnj.exec:\rptbnnj.exe111⤵PID:1812
-
\??\c:\bxvpljt.exec:\bxvpljt.exe112⤵
- System Location Discovery: System Language Discovery
PID:1564 -
\??\c:\vrxrrb.exec:\vrxrrb.exe113⤵PID:2300
-
\??\c:\tjlxxbj.exec:\tjlxxbj.exe114⤵PID:1572
-
\??\c:\pjbxxp.exec:\pjbxxp.exe115⤵PID:1764
-
\??\c:\xppxpfh.exec:\xppxpfh.exe116⤵PID:632
-
\??\c:\pxxjd.exec:\pxxjd.exe117⤵PID:1708
-
\??\c:\jdvpv.exec:\jdvpv.exe118⤵PID:2752
-
\??\c:\lfrnbd.exec:\lfrnbd.exe119⤵PID:2632
-
\??\c:\dhfrflf.exec:\dhfrflf.exe120⤵PID:1752
-
\??\c:\xtbrjv.exec:\xtbrjv.exe121⤵PID:1688
-
\??\c:\fpbjn.exec:\fpbjn.exe122⤵PID:2432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-