Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 20:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ace0212831762c23ed684d2961dd285b91fac770936f6bd19e4658c17cf0677a.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
ace0212831762c23ed684d2961dd285b91fac770936f6bd19e4658c17cf0677a.exe
-
Size
454KB
-
MD5
a542f4bebd6f590532273f252d8dbcd6
-
SHA1
3d2aa1647ee8f3e6fe5073aeb623000dd1628d04
-
SHA256
ace0212831762c23ed684d2961dd285b91fac770936f6bd19e4658c17cf0677a
-
SHA512
625383b1658179bcad58afe5c6ff4a215c7ba0143e24042b15c31feb39cd9cd3cb418b76824c9996b1a3a4270998f00bf670b8a1153567b2d59f7e2f22535e3a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe4:q7Tc2NYHUrAwfMp3CD4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/1900-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/740-26-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/740-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-37-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/832-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1384-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-163-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1724-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-300-0x00000000771C0000-0x00000000772DF000-memory.dmp family_blackmoon behavioral1/memory/872-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1384-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/424-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/968-390-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1636-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-405-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/524-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-453-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2436-456-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2436-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-466-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2228-494-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/924-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/924-525-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1992-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-563-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2352-571-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2928-679-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1560-867-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2736 txhbpd.exe 740 jhrfrb.exe 832 pvthr.exe 3012 fxrjr.exe 2996 jvjtv.exe 2964 vbjlhl.exe 1384 fxxxr.exe 2892 tjvrtbx.exe 2600 dtxdx.exe 1212 fhlrvd.exe 776 hffrbx.exe 1612 bxdrttd.exe 2040 dbtprv.exe 2540 lthdr.exe 2252 vthtdbr.exe 2140 rtxrrh.exe 1724 dfftthj.exe 1132 jtxxt.exe 572 pprjfp.exe 2216 nfhrpd.exe 2416 rvrxn.exe 1128 ljffftb.exe 1008 jvphl.exe 2144 nlnfhtn.exe 2452 rbhdrv.exe 1124 tljhbj.exe 1688 bjbvr.exe 1016 pdrnjfl.exe 1276 bdtlxb.exe 2036 ljnpt.exe 1216 dpjnh.exe 876 dltxb.exe 872 hhxvbb.exe 816 tpfxrlj.exe 1628 fdjxv.exe 2472 tfttlv.exe 3016 fppnpxn.exe 3020 xtxlxp.exe 2956 tpldhj.exe 3064 bprbb.exe 3032 rjpjhln.exe 1384 jdvvp.exe 424 nbnbppb.exe 3052 htxrlr.exe 968 bbjlj.exe 1636 nhlhpbx.exe 1212 prbvpj.exe 3036 htnvh.exe 2764 pblrvd.exe 524 npfvd.exe 2540 hhfpjh.exe 2120 hvdprhf.exe 1996 jpdrt.exe 112 ldlvf.exe 2436 nxrld.exe 2208 txjvd.exe 2228 nhvrb.exe 2008 dhrllnh.exe 2396 xldhl.exe 2740 ljrfdbx.exe 924 nprlvrt.exe 2004 nrtbxlr.exe 2516 bpdxf.exe 1500 djrvlfb.exe -
resource yara_rule behavioral1/memory/1900-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/740-26-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/740-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/424-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/524-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/740-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-789-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxptjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhdjllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfjfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxppb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnxfhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjbpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvrbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxbdtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbnnjxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lptxhpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbprfld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrdfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hftdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfbdxfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjtblb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfhxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjhjlxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trhjfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljntpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdxjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbxbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrvfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tptljh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bprbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbhhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvhtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bddtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlrdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thvdrbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdlhdrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxrhtpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnxbdnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvvrhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjpjhln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnbppb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhrhrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbjvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjblx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtbrd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1900 wrote to memory of 2736 1900 ace0212831762c23ed684d2961dd285b91fac770936f6bd19e4658c17cf0677a.exe 30 PID 1900 wrote to memory of 2736 1900 ace0212831762c23ed684d2961dd285b91fac770936f6bd19e4658c17cf0677a.exe 30 PID 1900 wrote to memory of 2736 1900 ace0212831762c23ed684d2961dd285b91fac770936f6bd19e4658c17cf0677a.exe 30 PID 1900 wrote to memory of 2736 1900 ace0212831762c23ed684d2961dd285b91fac770936f6bd19e4658c17cf0677a.exe 30 PID 2736 wrote to memory of 740 2736 txhbpd.exe 31 PID 2736 wrote to memory of 740 2736 txhbpd.exe 31 PID 2736 wrote to memory of 740 2736 txhbpd.exe 31 PID 2736 wrote to memory of 740 2736 txhbpd.exe 31 PID 740 wrote to memory of 832 740 jhrfrb.exe 32 PID 740 wrote to memory of 832 740 jhrfrb.exe 32 PID 740 wrote to memory of 832 740 jhrfrb.exe 32 PID 740 wrote to memory of 832 740 jhrfrb.exe 32 PID 832 wrote to memory of 3012 832 pvthr.exe 33 PID 832 wrote to memory of 3012 832 pvthr.exe 33 PID 832 wrote to memory of 3012 832 pvthr.exe 33 PID 832 wrote to memory of 3012 832 pvthr.exe 33 PID 3012 wrote to memory of 2996 3012 fxrjr.exe 34 PID 3012 wrote to memory of 2996 3012 fxrjr.exe 34 PID 3012 wrote to memory of 2996 3012 fxrjr.exe 34 PID 3012 wrote to memory of 2996 3012 fxrjr.exe 34 PID 2996 wrote to memory of 2964 2996 jvjtv.exe 35 PID 2996 wrote to memory of 2964 2996 jvjtv.exe 35 PID 2996 wrote to memory of 2964 2996 jvjtv.exe 35 PID 2996 wrote to memory of 2964 2996 jvjtv.exe 35 PID 2964 wrote to memory of 1384 2964 vbjlhl.exe 36 PID 2964 wrote to memory of 1384 2964 vbjlhl.exe 36 PID 2964 wrote to memory of 1384 2964 vbjlhl.exe 36 PID 2964 wrote to memory of 1384 2964 vbjlhl.exe 36 PID 1384 wrote to memory of 2892 1384 fxxxr.exe 37 PID 1384 wrote to memory of 2892 1384 fxxxr.exe 37 PID 1384 wrote to memory of 2892 1384 fxxxr.exe 37 PID 1384 wrote to memory of 2892 1384 fxxxr.exe 37 PID 2892 wrote to memory of 2600 2892 tjvrtbx.exe 38 PID 2892 wrote to memory of 2600 2892 tjvrtbx.exe 38 PID 2892 wrote to memory of 2600 2892 tjvrtbx.exe 38 PID 2892 wrote to memory of 2600 2892 tjvrtbx.exe 38 PID 2600 wrote to memory of 1212 2600 dtxdx.exe 39 PID 2600 wrote to memory of 1212 2600 dtxdx.exe 39 PID 2600 wrote to memory of 1212 2600 dtxdx.exe 39 PID 2600 wrote to memory of 1212 2600 dtxdx.exe 39 PID 1212 wrote to memory of 776 1212 fhlrvd.exe 40 PID 1212 wrote to memory of 776 1212 fhlrvd.exe 40 PID 1212 wrote to memory of 776 1212 fhlrvd.exe 40 PID 1212 wrote to memory of 776 1212 fhlrvd.exe 40 PID 776 wrote to memory of 1612 776 hffrbx.exe 41 PID 776 wrote to memory of 1612 776 hffrbx.exe 41 PID 776 wrote to memory of 1612 776 hffrbx.exe 41 PID 776 wrote to memory of 1612 776 hffrbx.exe 41 PID 1612 wrote to memory of 2040 1612 bxdrttd.exe 42 PID 1612 wrote to memory of 2040 1612 bxdrttd.exe 42 PID 1612 wrote to memory of 2040 1612 bxdrttd.exe 42 PID 1612 wrote to memory of 2040 1612 bxdrttd.exe 42 PID 2040 wrote to memory of 2540 2040 dbtprv.exe 43 PID 2040 wrote to memory of 2540 2040 dbtprv.exe 43 PID 2040 wrote to memory of 2540 2040 dbtprv.exe 43 PID 2040 wrote to memory of 2540 2040 dbtprv.exe 43 PID 2540 wrote to memory of 2252 2540 lthdr.exe 44 PID 2540 wrote to memory of 2252 2540 lthdr.exe 44 PID 2540 wrote to memory of 2252 2540 lthdr.exe 44 PID 2540 wrote to memory of 2252 2540 lthdr.exe 44 PID 2252 wrote to memory of 2140 2252 vthtdbr.exe 45 PID 2252 wrote to memory of 2140 2252 vthtdbr.exe 45 PID 2252 wrote to memory of 2140 2252 vthtdbr.exe 45 PID 2252 wrote to memory of 2140 2252 vthtdbr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ace0212831762c23ed684d2961dd285b91fac770936f6bd19e4658c17cf0677a.exe"C:\Users\Admin\AppData\Local\Temp\ace0212831762c23ed684d2961dd285b91fac770936f6bd19e4658c17cf0677a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\txhbpd.exec:\txhbpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\jhrfrb.exec:\jhrfrb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\pvthr.exec:\pvthr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\fxrjr.exec:\fxrjr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\jvjtv.exec:\jvjtv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\vbjlhl.exec:\vbjlhl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\fxxxr.exec:\fxxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\tjvrtbx.exec:\tjvrtbx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\dtxdx.exec:\dtxdx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\fhlrvd.exec:\fhlrvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\hffrbx.exec:\hffrbx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\bxdrttd.exec:\bxdrttd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\dbtprv.exec:\dbtprv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\lthdr.exec:\lthdr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\vthtdbr.exec:\vthtdbr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\rtxrrh.exec:\rtxrrh.exe17⤵
- Executes dropped EXE
PID:2140 -
\??\c:\dfftthj.exec:\dfftthj.exe18⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jtxxt.exec:\jtxxt.exe19⤵
- Executes dropped EXE
PID:1132 -
\??\c:\pprjfp.exec:\pprjfp.exe20⤵
- Executes dropped EXE
PID:572 -
\??\c:\nfhrpd.exec:\nfhrpd.exe21⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rvrxn.exec:\rvrxn.exe22⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ljffftb.exec:\ljffftb.exe23⤵
- Executes dropped EXE
PID:1128 -
\??\c:\jvphl.exec:\jvphl.exe24⤵
- Executes dropped EXE
PID:1008 -
\??\c:\nlnfhtn.exec:\nlnfhtn.exe25⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rbhdrv.exec:\rbhdrv.exe26⤵
- Executes dropped EXE
PID:2452 -
\??\c:\tljhbj.exec:\tljhbj.exe27⤵
- Executes dropped EXE
PID:1124 -
\??\c:\bjbvr.exec:\bjbvr.exe28⤵
- Executes dropped EXE
PID:1688 -
\??\c:\pdrnjfl.exec:\pdrnjfl.exe29⤵
- Executes dropped EXE
PID:1016 -
\??\c:\bdtlxb.exec:\bdtlxb.exe30⤵
- Executes dropped EXE
PID:1276 -
\??\c:\ljnpt.exec:\ljnpt.exe31⤵
- Executes dropped EXE
PID:2036 -
\??\c:\dpjnh.exec:\dpjnh.exe32⤵
- Executes dropped EXE
PID:1216 -
\??\c:\dltxb.exec:\dltxb.exe33⤵
- Executes dropped EXE
PID:876 -
\??\c:\hhxvbb.exec:\hhxvbb.exe34⤵
- Executes dropped EXE
PID:872 -
\??\c:\rfbxp.exec:\rfbxp.exe35⤵PID:1556
-
\??\c:\tpfxrlj.exec:\tpfxrlj.exe36⤵
- Executes dropped EXE
PID:816 -
\??\c:\fdjxv.exec:\fdjxv.exe37⤵
- Executes dropped EXE
PID:1628 -
\??\c:\tfttlv.exec:\tfttlv.exe38⤵
- Executes dropped EXE
PID:2472 -
\??\c:\fppnpxn.exec:\fppnpxn.exe39⤵
- Executes dropped EXE
PID:3016 -
\??\c:\xtxlxp.exec:\xtxlxp.exe40⤵
- Executes dropped EXE
PID:3020 -
\??\c:\tpldhj.exec:\tpldhj.exe41⤵
- Executes dropped EXE
PID:2956 -
\??\c:\bprbb.exec:\bprbb.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3064 -
\??\c:\rjpjhln.exec:\rjpjhln.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3032 -
\??\c:\jdvvp.exec:\jdvvp.exe44⤵
- Executes dropped EXE
PID:1384 -
\??\c:\nbnbppb.exec:\nbnbppb.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:424 -
\??\c:\htxrlr.exec:\htxrlr.exe46⤵
- Executes dropped EXE
PID:3052 -
\??\c:\bbjlj.exec:\bbjlj.exe47⤵
- Executes dropped EXE
PID:968 -
\??\c:\nhlhpbx.exec:\nhlhpbx.exe48⤵
- Executes dropped EXE
PID:1636 -
\??\c:\prbvpj.exec:\prbvpj.exe49⤵
- Executes dropped EXE
PID:1212 -
\??\c:\htnvh.exec:\htnvh.exe50⤵
- Executes dropped EXE
PID:3036 -
\??\c:\pblrvd.exec:\pblrvd.exe51⤵
- Executes dropped EXE
PID:2764 -
\??\c:\npfvd.exec:\npfvd.exe52⤵
- Executes dropped EXE
PID:524 -
\??\c:\hhfpjh.exec:\hhfpjh.exe53⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hvdprhf.exec:\hvdprhf.exe54⤵
- Executes dropped EXE
PID:2120 -
\??\c:\jpdrt.exec:\jpdrt.exe55⤵
- Executes dropped EXE
PID:1996 -
\??\c:\ldlvf.exec:\ldlvf.exe56⤵
- Executes dropped EXE
PID:112 -
\??\c:\nxrld.exec:\nxrld.exe57⤵
- Executes dropped EXE
PID:2436 -
\??\c:\txjvd.exec:\txjvd.exe58⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nhvrb.exec:\nhvrb.exe59⤵
- Executes dropped EXE
PID:2228 -
\??\c:\dhrllnh.exec:\dhrllnh.exe60⤵
- Executes dropped EXE
PID:2008 -
\??\c:\xldhl.exec:\xldhl.exe61⤵
- Executes dropped EXE
PID:2396 -
\??\c:\ljrfdbx.exec:\ljrfdbx.exe62⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nprlvrt.exec:\nprlvrt.exe63⤵
- Executes dropped EXE
PID:924 -
\??\c:\nrtbxlr.exec:\nrtbxlr.exe64⤵
- Executes dropped EXE
PID:2004 -
\??\c:\bpdxf.exec:\bpdxf.exe65⤵
- Executes dropped EXE
PID:2516 -
\??\c:\djrvlfb.exec:\djrvlfb.exe66⤵
- Executes dropped EXE
PID:1500 -
\??\c:\jjnlr.exec:\jjnlr.exe67⤵PID:1992
-
\??\c:\bpxfbh.exec:\bpxfbh.exe68⤵PID:2068
-
\??\c:\dhbbl.exec:\dhbbl.exe69⤵PID:1004
-
\??\c:\hvljll.exec:\hvljll.exe70⤵PID:1608
-
\??\c:\fnhtr.exec:\fnhtr.exe71⤵PID:1604
-
\??\c:\rnbtltp.exec:\rnbtltp.exe72⤵PID:2244
-
\??\c:\bftpj.exec:\bftpj.exe73⤵PID:2352
-
\??\c:\lpppvlj.exec:\lpppvlj.exe74⤵PID:1072
-
\??\c:\nvdbnbj.exec:\nvdbnbj.exe75⤵PID:1936
-
\??\c:\hpltffr.exec:\hpltffr.exe76⤵PID:872
-
\??\c:\hbdlh.exec:\hbdlh.exe77⤵PID:2564
-
\??\c:\vhlnnj.exec:\vhlnnj.exe78⤵PID:1644
-
\??\c:\txnvt.exec:\txnvt.exe79⤵PID:2656
-
\??\c:\thvdrbp.exec:\thvdrbp.exe80⤵
- System Location Discovery: System Language Discovery
PID:740 -
\??\c:\nrjljft.exec:\nrjljft.exe81⤵PID:2280
-
\??\c:\hfphdx.exec:\hfphdx.exe82⤵PID:3020
-
\??\c:\rtdhp.exec:\rtdhp.exe83⤵PID:2904
-
\??\c:\hthjpd.exec:\hthjpd.exe84⤵PID:3064
-
\??\c:\hdhjhp.exec:\hdhjhp.exe85⤵PID:2780
-
\??\c:\djvjdbx.exec:\djvjdbx.exe86⤵PID:2840
-
\??\c:\htbrv.exec:\htbrv.exe87⤵PID:2820
-
\??\c:\xtpjf.exec:\xtpjf.exe88⤵PID:1488
-
\??\c:\vtnxb.exec:\vtnxb.exe89⤵PID:1988
-
\??\c:\nlnxfpd.exec:\nlnxfpd.exe90⤵PID:2928
-
\??\c:\ltxld.exec:\ltxld.exe91⤵PID:2100
-
\??\c:\rtxdft.exec:\rtxdft.exe92⤵PID:1612
-
\??\c:\jvjjx.exec:\jvjjx.exe93⤵PID:584
-
\??\c:\tvxvvb.exec:\tvxvvb.exe94⤵PID:3044
-
\??\c:\rppbrn.exec:\rppbrn.exe95⤵PID:2292
-
\??\c:\dxjpfl.exec:\dxjpfl.exe96⤵PID:2248
-
\??\c:\njdtb.exec:\njdtb.exe97⤵PID:1264
-
\??\c:\fvjbnhr.exec:\fvjbnhr.exe98⤵PID:1764
-
\??\c:\jdhltl.exec:\jdhltl.exe99⤵PID:112
-
\??\c:\vrtpffv.exec:\vrtpffv.exe100⤵PID:2400
-
\??\c:\jrjhpj.exec:\jrjhpj.exe101⤵PID:2376
-
\??\c:\pbhvbjf.exec:\pbhvbjf.exe102⤵PID:1232
-
\??\c:\nhpldtx.exec:\nhpldtx.exe103⤵PID:2216
-
\??\c:\jxnpl.exec:\jxnpl.exe104⤵PID:2416
-
\??\c:\xlhxdf.exec:\xlhxdf.exe105⤵PID:2028
-
\??\c:\tvnnvll.exec:\tvnnvll.exe106⤵PID:2664
-
\??\c:\dpnfbrb.exec:\dpnfbrb.exe107⤵PID:2496
-
\??\c:\ttfnl.exec:\ttfnl.exe108⤵PID:1980
-
\??\c:\hfpfhl.exec:\hfpfhl.exe109⤵PID:2328
-
\??\c:\hbpdpj.exec:\hbpdpj.exe110⤵PID:2848
-
\??\c:\pvjvv.exec:\pvjvv.exe111⤵PID:1116
-
\??\c:\vvjlthb.exec:\vvjlthb.exe112⤵PID:1812
-
\??\c:\blddn.exec:\blddn.exe113⤵PID:2728
-
\??\c:\jxnndrx.exec:\jxnndrx.exe114⤵PID:1616
-
\??\c:\brhpjth.exec:\brhpjth.exe115⤵PID:2036
-
\??\c:\jnhnrxt.exec:\jnhnrxt.exe116⤵PID:1288
-
\??\c:\rbnrj.exec:\rbnrj.exe117⤵PID:2352
-
\??\c:\dplrtvh.exec:\dplrtvh.exe118⤵PID:1072
-
\??\c:\lpnnlr.exec:\lpnnlr.exe119⤵PID:1560
-
\??\c:\ntdfjvf.exec:\ntdfjvf.exe120⤵PID:2652
-
\??\c:\lbhhr.exec:\lbhhr.exe121⤵
- System Location Discovery: System Language Discovery
PID:816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-