Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 19:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c23d69935b7a5ae99c2fa15b91498535b61df5085f3df1346a2142d3dec3794c.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
c23d69935b7a5ae99c2fa15b91498535b61df5085f3df1346a2142d3dec3794c.exe
-
Size
456KB
-
MD5
fc5935424aaef52eea079a9bad859b6b
-
SHA1
6613b8a5ee772874a828764c14cd2b4677cbc2f8
-
SHA256
c23d69935b7a5ae99c2fa15b91498535b61df5085f3df1346a2142d3dec3794c
-
SHA512
0a915d8fde35eb9f3ecbdc94d8b76583988a760db8a214977d63c7d00a91421064a6ce558e075134aa3e47704f997c7fe818e927fd3e27feedabd0b0bc2f8fae
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR0:q7Tc2NYHUrAwfMp3CDR0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2448-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-66-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2636-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-112-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2796-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-131-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/864-141-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2188-140-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/852-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-161-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2108-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-201-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2992-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-301-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2448-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-345-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2416-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-604-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2780-617-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2776-625-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1936-664-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2796-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/852-731-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-776-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-810-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2768 phfflhb.exe 2724 dldvf.exe 2436 vptbhtd.exe 2900 rlbplbb.exe 2852 tnpdnd.exe 2636 nltvdhp.exe 932 xhlrpfn.exe 1240 vfxpj.exe 3028 xxfvf.exe 2432 dtvvdtj.exe 2188 fjjvjrp.exe 2964 nlvblj.exe 2796 tdxtl.exe 864 hdxjtth.exe 852 flnjvdl.exe 1572 xlnlnh.exe 2108 pdddjlp.exe 2444 dfdprrf.exe 2332 blnjx.exe 2456 tvrlxjl.exe 976 rjdbfxx.exe 1012 dpbhhl.exe 2992 djdhppx.exe 2460 rplnj.exe 1464 jfdhlnb.exe 1588 rlxrbht.exe 3012 rrjllld.exe 1496 xtljvpp.exe 3052 xbvlvjd.exe 3048 ljjxxvb.exe 2388 jdjvtt.exe 1860 fnbntp.exe 2448 xffvnbx.exe 1792 dxdxlp.exe 2848 fdxxt.exe 2884 vhlrtt.exe 2860 dhnlxft.exe 2812 rnfhxfd.exe 2876 lxhjdxp.exe 2792 tfbltr.exe 2416 lhtrttb.exe 2688 ndjltj.exe 1672 rhrxr.exe 3032 jjdxdrb.exe 2300 bnfvlj.exe 2004 nlbxhtn.exe 2316 jrnxtr.exe 2956 fvjdbr.exe 2716 drblbt.exe 1964 ffrhbtf.exe 2100 tfdfj.exe 1160 xvxfjd.exe 1152 vhnvldl.exe 1600 brrvpxb.exe 620 drffpj.exe 1796 jjjbntn.exe 2112 nrrhtn.exe 2272 dftxnvv.exe 2396 fxnlxb.exe 2464 dbvjlt.exe 2156 ltfdn.exe 1844 jrhhpf.exe 2056 ptxntp.exe 1336 ldlfjrn.exe -
resource yara_rule behavioral1/memory/2448-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-112-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2796-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-489-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1332-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-617-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2344-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-757-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-776-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jndbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffnjdvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tltdbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdtdxrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfdprrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfjvfft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrvpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbxljv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdxvpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlvhpvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfvdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xftttd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npvhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhfjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpbvxpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fplbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnhtld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfppbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvbhvxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxxjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phlfjpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dttdxpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppblbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrpvdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnpdnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtlrvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxxxtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhptj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flffhnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftrppdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntddf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvlpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bffvdh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2448 wrote to memory of 2768 2448 c23d69935b7a5ae99c2fa15b91498535b61df5085f3df1346a2142d3dec3794c.exe 30 PID 2448 wrote to memory of 2768 2448 c23d69935b7a5ae99c2fa15b91498535b61df5085f3df1346a2142d3dec3794c.exe 30 PID 2448 wrote to memory of 2768 2448 c23d69935b7a5ae99c2fa15b91498535b61df5085f3df1346a2142d3dec3794c.exe 30 PID 2448 wrote to memory of 2768 2448 c23d69935b7a5ae99c2fa15b91498535b61df5085f3df1346a2142d3dec3794c.exe 30 PID 2768 wrote to memory of 2724 2768 phfflhb.exe 31 PID 2768 wrote to memory of 2724 2768 phfflhb.exe 31 PID 2768 wrote to memory of 2724 2768 phfflhb.exe 31 PID 2768 wrote to memory of 2724 2768 phfflhb.exe 31 PID 2724 wrote to memory of 2436 2724 dldvf.exe 32 PID 2724 wrote to memory of 2436 2724 dldvf.exe 32 PID 2724 wrote to memory of 2436 2724 dldvf.exe 32 PID 2724 wrote to memory of 2436 2724 dldvf.exe 32 PID 2436 wrote to memory of 2900 2436 vptbhtd.exe 33 PID 2436 wrote to memory of 2900 2436 vptbhtd.exe 33 PID 2436 wrote to memory of 2900 2436 vptbhtd.exe 33 PID 2436 wrote to memory of 2900 2436 vptbhtd.exe 33 PID 2900 wrote to memory of 2852 2900 rlbplbb.exe 34 PID 2900 wrote to memory of 2852 2900 rlbplbb.exe 34 PID 2900 wrote to memory of 2852 2900 rlbplbb.exe 34 PID 2900 wrote to memory of 2852 2900 rlbplbb.exe 34 PID 2852 wrote to memory of 2636 2852 tnpdnd.exe 35 PID 2852 wrote to memory of 2636 2852 tnpdnd.exe 35 PID 2852 wrote to memory of 2636 2852 tnpdnd.exe 35 PID 2852 wrote to memory of 2636 2852 tnpdnd.exe 35 PID 2636 wrote to memory of 932 2636 nltvdhp.exe 36 PID 2636 wrote to memory of 932 2636 nltvdhp.exe 36 PID 2636 wrote to memory of 932 2636 nltvdhp.exe 36 PID 2636 wrote to memory of 932 2636 nltvdhp.exe 36 PID 932 wrote to memory of 1240 932 xhlrpfn.exe 37 PID 932 wrote to memory of 1240 932 xhlrpfn.exe 37 PID 932 wrote to memory of 1240 932 xhlrpfn.exe 37 PID 932 wrote to memory of 1240 932 xhlrpfn.exe 37 PID 1240 wrote to memory of 3028 1240 vfxpj.exe 38 PID 1240 wrote to memory of 3028 1240 vfxpj.exe 38 PID 1240 wrote to memory of 3028 1240 vfxpj.exe 38 PID 1240 wrote to memory of 3028 1240 vfxpj.exe 38 PID 3028 wrote to memory of 2432 3028 xxfvf.exe 39 PID 3028 wrote to memory of 2432 3028 xxfvf.exe 39 PID 3028 wrote to memory of 2432 3028 xxfvf.exe 39 PID 3028 wrote to memory of 2432 3028 xxfvf.exe 39 PID 2432 wrote to memory of 2188 2432 dtvvdtj.exe 40 PID 2432 wrote to memory of 2188 2432 dtvvdtj.exe 40 PID 2432 wrote to memory of 2188 2432 dtvvdtj.exe 40 PID 2432 wrote to memory of 2188 2432 dtvvdtj.exe 40 PID 2188 wrote to memory of 2964 2188 fjjvjrp.exe 41 PID 2188 wrote to memory of 2964 2188 fjjvjrp.exe 41 PID 2188 wrote to memory of 2964 2188 fjjvjrp.exe 41 PID 2188 wrote to memory of 2964 2188 fjjvjrp.exe 41 PID 2964 wrote to memory of 2796 2964 nlvblj.exe 42 PID 2964 wrote to memory of 2796 2964 nlvblj.exe 42 PID 2964 wrote to memory of 2796 2964 nlvblj.exe 42 PID 2964 wrote to memory of 2796 2964 nlvblj.exe 42 PID 2796 wrote to memory of 864 2796 tdxtl.exe 43 PID 2796 wrote to memory of 864 2796 tdxtl.exe 43 PID 2796 wrote to memory of 864 2796 tdxtl.exe 43 PID 2796 wrote to memory of 864 2796 tdxtl.exe 43 PID 864 wrote to memory of 852 864 hdxjtth.exe 44 PID 864 wrote to memory of 852 864 hdxjtth.exe 44 PID 864 wrote to memory of 852 864 hdxjtth.exe 44 PID 864 wrote to memory of 852 864 hdxjtth.exe 44 PID 852 wrote to memory of 1572 852 flnjvdl.exe 45 PID 852 wrote to memory of 1572 852 flnjvdl.exe 45 PID 852 wrote to memory of 1572 852 flnjvdl.exe 45 PID 852 wrote to memory of 1572 852 flnjvdl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c23d69935b7a5ae99c2fa15b91498535b61df5085f3df1346a2142d3dec3794c.exe"C:\Users\Admin\AppData\Local\Temp\c23d69935b7a5ae99c2fa15b91498535b61df5085f3df1346a2142d3dec3794c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\phfflhb.exec:\phfflhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\dldvf.exec:\dldvf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\vptbhtd.exec:\vptbhtd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\rlbplbb.exec:\rlbplbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\tnpdnd.exec:\tnpdnd.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\nltvdhp.exec:\nltvdhp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\xhlrpfn.exec:\xhlrpfn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\vfxpj.exec:\vfxpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\xxfvf.exec:\xxfvf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\dtvvdtj.exec:\dtvvdtj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\fjjvjrp.exec:\fjjvjrp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\nlvblj.exec:\nlvblj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\tdxtl.exec:\tdxtl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\hdxjtth.exec:\hdxjtth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\flnjvdl.exec:\flnjvdl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\xlnlnh.exec:\xlnlnh.exe17⤵
- Executes dropped EXE
PID:1572 -
\??\c:\pdddjlp.exec:\pdddjlp.exe18⤵
- Executes dropped EXE
PID:2108 -
\??\c:\dfdprrf.exec:\dfdprrf.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2444 -
\??\c:\blnjx.exec:\blnjx.exe20⤵
- Executes dropped EXE
PID:2332 -
\??\c:\tvrlxjl.exec:\tvrlxjl.exe21⤵
- Executes dropped EXE
PID:2456 -
\??\c:\rjdbfxx.exec:\rjdbfxx.exe22⤵
- Executes dropped EXE
PID:976 -
\??\c:\dpbhhl.exec:\dpbhhl.exe23⤵
- Executes dropped EXE
PID:1012 -
\??\c:\djdhppx.exec:\djdhppx.exe24⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rplnj.exec:\rplnj.exe25⤵
- Executes dropped EXE
PID:2460 -
\??\c:\jfdhlnb.exec:\jfdhlnb.exe26⤵
- Executes dropped EXE
PID:1464 -
\??\c:\rlxrbht.exec:\rlxrbht.exe27⤵
- Executes dropped EXE
PID:1588 -
\??\c:\rrjllld.exec:\rrjllld.exe28⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xtljvpp.exec:\xtljvpp.exe29⤵
- Executes dropped EXE
PID:1496 -
\??\c:\xbvlvjd.exec:\xbvlvjd.exe30⤵
- Executes dropped EXE
PID:3052 -
\??\c:\ljjxxvb.exec:\ljjxxvb.exe31⤵
- Executes dropped EXE
PID:3048 -
\??\c:\jdjvtt.exec:\jdjvtt.exe32⤵
- Executes dropped EXE
PID:2388 -
\??\c:\fnbntp.exec:\fnbntp.exe33⤵
- Executes dropped EXE
PID:1860 -
\??\c:\xffvnbx.exec:\xffvnbx.exe34⤵
- Executes dropped EXE
PID:2448 -
\??\c:\dxdxlp.exec:\dxdxlp.exe35⤵
- Executes dropped EXE
PID:1792 -
\??\c:\fdxxt.exec:\fdxxt.exe36⤵
- Executes dropped EXE
PID:2848 -
\??\c:\vhlrtt.exec:\vhlrtt.exe37⤵
- Executes dropped EXE
PID:2884 -
\??\c:\dhnlxft.exec:\dhnlxft.exe38⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rnfhxfd.exec:\rnfhxfd.exe39⤵
- Executes dropped EXE
PID:2812 -
\??\c:\lxhjdxp.exec:\lxhjdxp.exe40⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tfbltr.exec:\tfbltr.exe41⤵
- Executes dropped EXE
PID:2792 -
\??\c:\lhtrttb.exec:\lhtrttb.exe42⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ndjltj.exec:\ndjltj.exe43⤵
- Executes dropped EXE
PID:2688 -
\??\c:\rhrxr.exec:\rhrxr.exe44⤵
- Executes dropped EXE
PID:1672 -
\??\c:\jjdxdrb.exec:\jjdxdrb.exe45⤵
- Executes dropped EXE
PID:3032 -
\??\c:\bnfvlj.exec:\bnfvlj.exe46⤵
- Executes dropped EXE
PID:2300 -
\??\c:\nlbxhtn.exec:\nlbxhtn.exe47⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jrnxtr.exec:\jrnxtr.exe48⤵
- Executes dropped EXE
PID:2316 -
\??\c:\fvjdbr.exec:\fvjdbr.exe49⤵
- Executes dropped EXE
PID:2956 -
\??\c:\drblbt.exec:\drblbt.exe50⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ffrhbtf.exec:\ffrhbtf.exe51⤵
- Executes dropped EXE
PID:1964 -
\??\c:\tfdfj.exec:\tfdfj.exe52⤵
- Executes dropped EXE
PID:2100 -
\??\c:\xvxfjd.exec:\xvxfjd.exe53⤵
- Executes dropped EXE
PID:1160 -
\??\c:\vhnvldl.exec:\vhnvldl.exe54⤵
- Executes dropped EXE
PID:1152 -
\??\c:\brrvpxb.exec:\brrvpxb.exe55⤵
- Executes dropped EXE
PID:1600 -
\??\c:\drffpj.exec:\drffpj.exe56⤵
- Executes dropped EXE
PID:620 -
\??\c:\jjjbntn.exec:\jjjbntn.exe57⤵
- Executes dropped EXE
PID:1796 -
\??\c:\nrrhtn.exec:\nrrhtn.exe58⤵
- Executes dropped EXE
PID:2112 -
\??\c:\dftxnvv.exec:\dftxnvv.exe59⤵
- Executes dropped EXE
PID:2272 -
\??\c:\fxnlxb.exec:\fxnlxb.exe60⤵
- Executes dropped EXE
PID:2396 -
\??\c:\dbvjlt.exec:\dbvjlt.exe61⤵
- Executes dropped EXE
PID:2464 -
\??\c:\ltfdn.exec:\ltfdn.exe62⤵
- Executes dropped EXE
PID:2156 -
\??\c:\jrhhpf.exec:\jrhhpf.exe63⤵
- Executes dropped EXE
PID:1844 -
\??\c:\ptxntp.exec:\ptxntp.exe64⤵
- Executes dropped EXE
PID:2056 -
\??\c:\ldlfjrn.exec:\ldlfjrn.exe65⤵
- Executes dropped EXE
PID:1336 -
\??\c:\pxdjfr.exec:\pxdjfr.exe66⤵PID:1332
-
\??\c:\hplnd.exec:\hplnd.exe67⤵PID:1736
-
\??\c:\ntpxtrn.exec:\ntpxtrn.exe68⤵PID:748
-
\??\c:\dnnfpxp.exec:\dnnfpxp.exe69⤵PID:2228
-
\??\c:\nlxhf.exec:\nlxhf.exe70⤵PID:2536
-
\??\c:\vndjb.exec:\vndjb.exe71⤵PID:1320
-
\??\c:\dlrpjv.exec:\dlrpjv.exe72⤵PID:2076
-
\??\c:\xlpxb.exec:\xlpxb.exe73⤵PID:1032
-
\??\c:\tjvjd.exec:\tjvjd.exe74⤵PID:1044
-
\??\c:\ndnjj.exec:\ndnjj.exe75⤵PID:2280
-
\??\c:\pfjvfft.exec:\pfjvfft.exe76⤵
- System Location Discovery: System Language Discovery
PID:2248 -
\??\c:\nrvpf.exec:\nrvpf.exe77⤵
- System Location Discovery: System Language Discovery
PID:2844 -
\??\c:\hnhbjx.exec:\hnhbjx.exe78⤵PID:2776
-
\??\c:\vpjvh.exec:\vpjvh.exe79⤵PID:2752
-
\??\c:\xpxrh.exec:\xpxrh.exe80⤵PID:2780
-
\??\c:\ljhptf.exec:\ljhptf.exe81⤵PID:2884
-
\??\c:\xjdjttt.exec:\xjdjttt.exe82⤵PID:2436
-
\??\c:\lvllpht.exec:\lvllpht.exe83⤵PID:2676
-
\??\c:\lfnhtj.exec:\lfnhtj.exe84⤵PID:1936
-
\??\c:\bltnp.exec:\bltnp.exe85⤵PID:1564
-
\??\c:\xxxvd.exec:\xxxvd.exe86⤵PID:2344
-
\??\c:\vpjfb.exec:\vpjfb.exe87⤵PID:2688
-
\??\c:\jjpfx.exec:\jjpfx.exe88⤵PID:1672
-
\??\c:\xfdtv.exec:\xfdtv.exe89⤵PID:3036
-
\??\c:\frvbhv.exec:\frvbhv.exe90⤵PID:1776
-
\??\c:\fdblp.exec:\fdblp.exe91⤵PID:520
-
\??\c:\jxprf.exec:\jxprf.exe92⤵PID:2680
-
\??\c:\httlhxp.exec:\httlhxp.exe93⤵PID:2936
-
\??\c:\ltbjr.exec:\ltbjr.exe94⤵PID:2796
-
\??\c:\hlrvdd.exec:\hlrvdd.exe95⤵PID:1868
-
\??\c:\fhjvj.exec:\fhjvj.exe96⤵PID:2100
-
\??\c:\ffjtnp.exec:\ffjtnp.exe97⤵PID:852
-
\??\c:\trppb.exec:\trppb.exe98⤵PID:684
-
\??\c:\drrdxp.exec:\drrdxp.exe99⤵PID:2412
-
\??\c:\bdjtpb.exec:\bdjtpb.exe100⤵PID:620
-
\??\c:\llbnrhl.exec:\llbnrhl.exe101⤵PID:1796
-
\??\c:\nxhjjr.exec:\nxhjjr.exe102⤵PID:2256
-
\??\c:\jtvpj.exec:\jtvpj.exe103⤵PID:768
-
\??\c:\jthxrf.exec:\jthxrf.exe104⤵PID:2396
-
\??\c:\rrhdhjh.exec:\rrhdhjh.exe105⤵PID:2456
-
\??\c:\vnhtld.exec:\vnhtld.exe106⤵
- System Location Discovery: System Language Discovery
PID:1576 -
\??\c:\lpdjj.exec:\lpdjj.exe107⤵PID:984
-
\??\c:\pxbndlr.exec:\pxbndlr.exe108⤵PID:1728
-
\??\c:\fbjjndl.exec:\fbjjndl.exe109⤵PID:1476
-
\??\c:\dbbxnxn.exec:\dbbxnxn.exe110⤵PID:2016
-
\??\c:\jrtfpb.exec:\jrtfpb.exe111⤵PID:1684
-
\??\c:\vpfxtl.exec:\vpfxtl.exe112⤵PID:360
-
\??\c:\pjnvlhh.exec:\pjnvlhh.exe113⤵PID:1224
-
\??\c:\lpvrxnv.exec:\lpvrxnv.exe114⤵PID:2592
-
\??\c:\tvlpb.exec:\tvlpb.exe115⤵
- System Location Discovery: System Language Discovery
PID:1108 -
\??\c:\blphn.exec:\blphn.exe116⤵PID:1976
-
\??\c:\jjrhlb.exec:\jjrhlb.exe117⤵PID:1040
-
\??\c:\rdlhr.exec:\rdlhr.exe118⤵PID:1808
-
\??\c:\fdjtdx.exec:\fdjtdx.exe119⤵PID:2824
-
\??\c:\ddvdhjp.exec:\ddvdhjp.exe120⤵PID:2448
-
\??\c:\nvlnp.exec:\nvlnp.exe121⤵PID:1792
-
\??\c:\dtprbrj.exec:\dtprbrj.exe122⤵PID:2864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-