Analysis
-
max time kernel
121s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 20:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c6408b075d5af18244b4b11377ac374ea11a709fdb805f8aafe3fc7c4b1400b9.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c6408b075d5af18244b4b11377ac374ea11a709fdb805f8aafe3fc7c4b1400b9.exe
-
Size
453KB
-
MD5
08bbfa66ab0545db85dff79225017bd8
-
SHA1
1b619042832d5cafb387a40102ed9e4b63f2b173
-
SHA256
c6408b075d5af18244b4b11377ac374ea11a709fdb805f8aafe3fc7c4b1400b9
-
SHA512
ed32f7c29e485b5cc9deee16cfed9864531ff344d20b00bfe592ca5d383a614a4ca4519b11983de347c248ab980c8990708c1fa53cb56bf2f5cce554a9b8f6b6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2936-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-68-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1744-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1176-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-169-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2232-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/932-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-306-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1780-309-0x00000000770D0000-0x00000000771EF000-memory.dmp family_blackmoon behavioral1/memory/1780-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/388-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-551-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1768-550-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1768-572-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2492-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-654-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2800-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-696-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2364-867-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2236-901-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2612-945-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2216 bfvdhfb.exe 2964 bptpjxv.exe 2852 htxdtnt.exe 2096 nrdtf.exe 2916 vdpfhpd.exe 2792 nxphnhx.exe 2764 jxbbr.exe 1744 vvlnxrf.exe 1660 btffxb.exe 2716 rdrfrv.exe 2012 fplpvd.exe 3044 xdftfd.exe 3052 fphdr.exe 2108 fndhrh.exe 1444 pppndj.exe 2528 rldpr.exe 1176 vrbrftt.exe 1536 lltlxvx.exe 2264 dlnvpb.exe 2452 lblxxxx.exe 2232 vvhlv.exe 1076 bvjfb.exe 1900 brlbrpd.exe 2160 tbjpp.exe 1828 nbphtfd.exe 1284 tjfpf.exe 1812 bbvbht.exe 676 pvtbrb.exe 1464 hprpbbb.exe 932 fvbhbd.exe 596 djvbrbh.exe 2028 xvrrvvx.exe 1716 brpfb.exe 2828 rpphb.exe 1780 xvvhr.exe 2980 ldvhvnx.exe 2984 ddpxt.exe 2888 blnpbp.exe 2852 lfxbh.exe 1476 xbbnf.exe 2924 bxnvx.exe 2372 lxblx.exe 2812 lljnflp.exe 2604 lhjnf.exe 2728 prfbjhv.exe 388 hhfvx.exe 1660 nvrrhjx.exe 1708 bjxpr.exe 2196 dvftdp.exe 316 fjpnv.exe 2192 xbvjvpl.exe 3052 hhlvh.exe 2848 vnblvxb.exe 2504 xhtlx.exe 1640 jbtfbr.exe 1976 lndph.exe 1176 nlxhl.exe 2220 ntfvxt.exe 2500 tlfjdtv.exe 2564 tnxdpjf.exe 2060 xhvvvfl.exe 2232 xvxhldn.exe 1076 tdfnnjj.exe 2428 rvfhxv.exe -
resource yara_rule behavioral1/memory/2216-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/388-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-867-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2336-876-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-940-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rthdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbrrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbvtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdhpjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xddpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbldd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trdhvfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhfvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nljrjhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbpjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjljrdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dthtvhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npxxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blxfllb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppnxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnxdpjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlpjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldbhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxpnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbfltt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtvvnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnxjvnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhhlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvtfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjffj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxpxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trjllhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fndhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjnhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhtlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntfvxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdndvhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrrjddt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frhdbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjrbfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2216 2936 c6408b075d5af18244b4b11377ac374ea11a709fdb805f8aafe3fc7c4b1400b9.exe 29 PID 2936 wrote to memory of 2216 2936 c6408b075d5af18244b4b11377ac374ea11a709fdb805f8aafe3fc7c4b1400b9.exe 29 PID 2936 wrote to memory of 2216 2936 c6408b075d5af18244b4b11377ac374ea11a709fdb805f8aafe3fc7c4b1400b9.exe 29 PID 2936 wrote to memory of 2216 2936 c6408b075d5af18244b4b11377ac374ea11a709fdb805f8aafe3fc7c4b1400b9.exe 29 PID 2216 wrote to memory of 2964 2216 bfvdhfb.exe 30 PID 2216 wrote to memory of 2964 2216 bfvdhfb.exe 30 PID 2216 wrote to memory of 2964 2216 bfvdhfb.exe 30 PID 2216 wrote to memory of 2964 2216 bfvdhfb.exe 30 PID 2964 wrote to memory of 2852 2964 bptpjxv.exe 31 PID 2964 wrote to memory of 2852 2964 bptpjxv.exe 31 PID 2964 wrote to memory of 2852 2964 bptpjxv.exe 31 PID 2964 wrote to memory of 2852 2964 bptpjxv.exe 31 PID 2852 wrote to memory of 2096 2852 htxdtnt.exe 32 PID 2852 wrote to memory of 2096 2852 htxdtnt.exe 32 PID 2852 wrote to memory of 2096 2852 htxdtnt.exe 32 PID 2852 wrote to memory of 2096 2852 htxdtnt.exe 32 PID 2096 wrote to memory of 2916 2096 nrdtf.exe 33 PID 2096 wrote to memory of 2916 2096 nrdtf.exe 33 PID 2096 wrote to memory of 2916 2096 nrdtf.exe 33 PID 2096 wrote to memory of 2916 2096 nrdtf.exe 33 PID 2916 wrote to memory of 2792 2916 vdpfhpd.exe 34 PID 2916 wrote to memory of 2792 2916 vdpfhpd.exe 34 PID 2916 wrote to memory of 2792 2916 vdpfhpd.exe 34 PID 2916 wrote to memory of 2792 2916 vdpfhpd.exe 34 PID 2792 wrote to memory of 2764 2792 nxphnhx.exe 35 PID 2792 wrote to memory of 2764 2792 nxphnhx.exe 35 PID 2792 wrote to memory of 2764 2792 nxphnhx.exe 35 PID 2792 wrote to memory of 2764 2792 nxphnhx.exe 35 PID 2764 wrote to memory of 1744 2764 jxbbr.exe 36 PID 2764 wrote to memory of 1744 2764 jxbbr.exe 36 PID 2764 wrote to memory of 1744 2764 jxbbr.exe 36 PID 2764 wrote to memory of 1744 2764 jxbbr.exe 36 PID 1744 wrote to memory of 1660 1744 vvlnxrf.exe 37 PID 1744 wrote to memory of 1660 1744 vvlnxrf.exe 37 PID 1744 wrote to memory of 1660 1744 vvlnxrf.exe 37 PID 1744 wrote to memory of 1660 1744 vvlnxrf.exe 37 PID 1660 wrote to memory of 2716 1660 btffxb.exe 38 PID 1660 wrote to memory of 2716 1660 btffxb.exe 38 PID 1660 wrote to memory of 2716 1660 btffxb.exe 38 PID 1660 wrote to memory of 2716 1660 btffxb.exe 38 PID 2716 wrote to memory of 2012 2716 rdrfrv.exe 39 PID 2716 wrote to memory of 2012 2716 rdrfrv.exe 39 PID 2716 wrote to memory of 2012 2716 rdrfrv.exe 39 PID 2716 wrote to memory of 2012 2716 rdrfrv.exe 39 PID 2012 wrote to memory of 3044 2012 fplpvd.exe 40 PID 2012 wrote to memory of 3044 2012 fplpvd.exe 40 PID 2012 wrote to memory of 3044 2012 fplpvd.exe 40 PID 2012 wrote to memory of 3044 2012 fplpvd.exe 40 PID 3044 wrote to memory of 3052 3044 xdftfd.exe 41 PID 3044 wrote to memory of 3052 3044 xdftfd.exe 41 PID 3044 wrote to memory of 3052 3044 xdftfd.exe 41 PID 3044 wrote to memory of 3052 3044 xdftfd.exe 41 PID 3052 wrote to memory of 2108 3052 fphdr.exe 42 PID 3052 wrote to memory of 2108 3052 fphdr.exe 42 PID 3052 wrote to memory of 2108 3052 fphdr.exe 42 PID 3052 wrote to memory of 2108 3052 fphdr.exe 42 PID 2108 wrote to memory of 1444 2108 fndhrh.exe 43 PID 2108 wrote to memory of 1444 2108 fndhrh.exe 43 PID 2108 wrote to memory of 1444 2108 fndhrh.exe 43 PID 2108 wrote to memory of 1444 2108 fndhrh.exe 43 PID 1444 wrote to memory of 2528 1444 pppndj.exe 44 PID 1444 wrote to memory of 2528 1444 pppndj.exe 44 PID 1444 wrote to memory of 2528 1444 pppndj.exe 44 PID 1444 wrote to memory of 2528 1444 pppndj.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6408b075d5af18244b4b11377ac374ea11a709fdb805f8aafe3fc7c4b1400b9.exe"C:\Users\Admin\AppData\Local\Temp\c6408b075d5af18244b4b11377ac374ea11a709fdb805f8aafe3fc7c4b1400b9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\bfvdhfb.exec:\bfvdhfb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\bptpjxv.exec:\bptpjxv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\htxdtnt.exec:\htxdtnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\nrdtf.exec:\nrdtf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\vdpfhpd.exec:\vdpfhpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\nxphnhx.exec:\nxphnhx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\jxbbr.exec:\jxbbr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\vvlnxrf.exec:\vvlnxrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\btffxb.exec:\btffxb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\rdrfrv.exec:\rdrfrv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\fplpvd.exec:\fplpvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\xdftfd.exec:\xdftfd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\fphdr.exec:\fphdr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\fndhrh.exec:\fndhrh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\pppndj.exec:\pppndj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\rldpr.exec:\rldpr.exe17⤵
- Executes dropped EXE
PID:2528 -
\??\c:\vrbrftt.exec:\vrbrftt.exe18⤵
- Executes dropped EXE
PID:1176 -
\??\c:\lltlxvx.exec:\lltlxvx.exe19⤵
- Executes dropped EXE
PID:1536 -
\??\c:\dlnvpb.exec:\dlnvpb.exe20⤵
- Executes dropped EXE
PID:2264 -
\??\c:\lblxxxx.exec:\lblxxxx.exe21⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vvhlv.exec:\vvhlv.exe22⤵
- Executes dropped EXE
PID:2232 -
\??\c:\bvjfb.exec:\bvjfb.exe23⤵
- Executes dropped EXE
PID:1076 -
\??\c:\brlbrpd.exec:\brlbrpd.exe24⤵
- Executes dropped EXE
PID:1900 -
\??\c:\tbjpp.exec:\tbjpp.exe25⤵
- Executes dropped EXE
PID:2160 -
\??\c:\nbphtfd.exec:\nbphtfd.exe26⤵
- Executes dropped EXE
PID:1828 -
\??\c:\tjfpf.exec:\tjfpf.exe27⤵
- Executes dropped EXE
PID:1284 -
\??\c:\bbvbht.exec:\bbvbht.exe28⤵
- Executes dropped EXE
PID:1812 -
\??\c:\pvtbrb.exec:\pvtbrb.exe29⤵
- Executes dropped EXE
PID:676 -
\??\c:\hprpbbb.exec:\hprpbbb.exe30⤵
- Executes dropped EXE
PID:1464 -
\??\c:\fvbhbd.exec:\fvbhbd.exe31⤵
- Executes dropped EXE
PID:932 -
\??\c:\djvbrbh.exec:\djvbrbh.exe32⤵
- Executes dropped EXE
PID:596 -
\??\c:\xvrrvvx.exec:\xvrrvvx.exe33⤵
- Executes dropped EXE
PID:2028 -
\??\c:\brpfb.exec:\brpfb.exe34⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rpphb.exec:\rpphb.exe35⤵
- Executes dropped EXE
PID:2828 -
\??\c:\xvvhr.exec:\xvvhr.exe36⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nvxdv.exec:\nvxdv.exe37⤵PID:1616
-
\??\c:\ldvhvnx.exec:\ldvhvnx.exe38⤵
- Executes dropped EXE
PID:2980 -
\??\c:\ddpxt.exec:\ddpxt.exe39⤵
- Executes dropped EXE
PID:2984 -
\??\c:\blnpbp.exec:\blnpbp.exe40⤵
- Executes dropped EXE
PID:2888 -
\??\c:\lfxbh.exec:\lfxbh.exe41⤵
- Executes dropped EXE
PID:2852 -
\??\c:\xbbnf.exec:\xbbnf.exe42⤵
- Executes dropped EXE
PID:1476 -
\??\c:\bxnvx.exec:\bxnvx.exe43⤵
- Executes dropped EXE
PID:2924 -
\??\c:\lxblx.exec:\lxblx.exe44⤵
- Executes dropped EXE
PID:2372 -
\??\c:\lljnflp.exec:\lljnflp.exe45⤵
- Executes dropped EXE
PID:2812 -
\??\c:\lhjnf.exec:\lhjnf.exe46⤵
- Executes dropped EXE
PID:2604 -
\??\c:\prfbjhv.exec:\prfbjhv.exe47⤵
- Executes dropped EXE
PID:2728 -
\??\c:\hhfvx.exec:\hhfvx.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:388 -
\??\c:\nvrrhjx.exec:\nvrrhjx.exe49⤵
- Executes dropped EXE
PID:1660 -
\??\c:\bjxpr.exec:\bjxpr.exe50⤵
- Executes dropped EXE
PID:1708 -
\??\c:\dvftdp.exec:\dvftdp.exe51⤵
- Executes dropped EXE
PID:2196 -
\??\c:\fjpnv.exec:\fjpnv.exe52⤵
- Executes dropped EXE
PID:316 -
\??\c:\xbvjvpl.exec:\xbvjvpl.exe53⤵
- Executes dropped EXE
PID:2192 -
\??\c:\hhlvh.exec:\hhlvh.exe54⤵
- Executes dropped EXE
PID:3052 -
\??\c:\vnblvxb.exec:\vnblvxb.exe55⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xhtlx.exec:\xhtlx.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2504 -
\??\c:\jbtfbr.exec:\jbtfbr.exe57⤵
- Executes dropped EXE
PID:1640 -
\??\c:\lndph.exec:\lndph.exe58⤵
- Executes dropped EXE
PID:1976 -
\??\c:\nlxhl.exec:\nlxhl.exe59⤵
- Executes dropped EXE
PID:1176 -
\??\c:\ntfvxt.exec:\ntfvxt.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2220 -
\??\c:\tlfjdtv.exec:\tlfjdtv.exe61⤵
- Executes dropped EXE
PID:2500 -
\??\c:\tnxdpjf.exec:\tnxdpjf.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2564 -
\??\c:\xhvvvfl.exec:\xhvvvfl.exe63⤵
- Executes dropped EXE
PID:2060 -
\??\c:\xvxhldn.exec:\xvxhldn.exe64⤵
- Executes dropped EXE
PID:2232 -
\??\c:\tdfnnjj.exec:\tdfnnjj.exe65⤵
- Executes dropped EXE
PID:1076 -
\??\c:\rvfhxv.exec:\rvfhxv.exe66⤵
- Executes dropped EXE
PID:2428 -
\??\c:\pdvhp.exec:\pdvhp.exe67⤵PID:900
-
\??\c:\ndrndhd.exec:\ndrndhd.exe68⤵PID:2644
-
\??\c:\hntjx.exec:\hntjx.exe69⤵PID:1752
-
\??\c:\dthtvhf.exec:\dthtvhf.exe70⤵
- System Location Discovery: System Language Discovery
PID:2388 -
\??\c:\ftfbjrp.exec:\ftfbjrp.exe71⤵PID:1768
-
\??\c:\jthvfv.exec:\jthvfv.exe72⤵PID:2600
-
\??\c:\hphjv.exec:\hphjv.exe73⤵PID:1152
-
\??\c:\vvfvbfd.exec:\vvfvbfd.exe74⤵PID:2660
-
\??\c:\blbpv.exec:\blbpv.exe75⤵PID:1756
-
\??\c:\ntbxtlh.exec:\ntbxtlh.exe76⤵PID:2492
-
\??\c:\xbldf.exec:\xbldf.exe77⤵PID:1104
-
\??\c:\hdphn.exec:\hdphn.exe78⤵PID:2148
-
\??\c:\ffjdv.exec:\ffjdv.exe79⤵PID:2936
-
\??\c:\jvbjpt.exec:\jvbjpt.exe80⤵PID:1704
-
\??\c:\prtlv.exec:\prtlv.exe81⤵PID:2400
-
\??\c:\ppbjh.exec:\ppbjh.exe82⤵PID:2980
-
\??\c:\llrjl.exec:\llrjl.exe83⤵PID:2984
-
\??\c:\tltnf.exec:\tltnf.exe84⤵PID:2968
-
\??\c:\ppxnnh.exec:\ppxnnh.exe85⤵PID:3068
-
\??\c:\hdbvj.exec:\hdbvj.exe86⤵PID:1476
-
\??\c:\pxtdp.exec:\pxtdp.exe87⤵PID:2924
-
\??\c:\txfjvf.exec:\txfjvf.exe88⤵PID:2616
-
\??\c:\xjxhtr.exec:\xjxhtr.exe89⤵PID:2812
-
\??\c:\tpfnxvv.exec:\tpfnxvv.exe90⤵PID:2800
-
\??\c:\vtdblr.exec:\vtdblr.exe91⤵PID:1744
-
\??\c:\llvjrv.exec:\llvjrv.exe92⤵PID:2024
-
\??\c:\ltxbp.exec:\ltxbp.exe93⤵PID:1660
-
\??\c:\vflvrxb.exec:\vflvrxb.exe94⤵PID:1624
-
\??\c:\jljhrjd.exec:\jljhrjd.exe95⤵PID:2136
-
\??\c:\vdjvbrx.exec:\vdjvbrx.exe96⤵PID:2444
-
\??\c:\tvdhf.exec:\tvdhf.exe97⤵PID:2192
-
\??\c:\dnnvxnh.exec:\dnnvxnh.exe98⤵PID:2108
-
\??\c:\bxxhvv.exec:\bxxhvv.exe99⤵PID:2008
-
\??\c:\nnjfjb.exec:\nnjfjb.exe100⤵PID:2656
-
\??\c:\hfrvlhr.exec:\hfrvlhr.exe101⤵PID:2152
-
\??\c:\ddrdn.exec:\ddrdn.exe102⤵PID:836
-
\??\c:\bflfv.exec:\bflfv.exe103⤵PID:2460
-
\??\c:\ldfdf.exec:\ldfdf.exe104⤵PID:1760
-
\??\c:\thbldfx.exec:\thbldfx.exe105⤵PID:1204
-
\??\c:\dxlbp.exec:\dxlbp.exe106⤵PID:2424
-
\??\c:\fhltv.exec:\fhltv.exe107⤵PID:2060
-
\??\c:\hnpxb.exec:\hnpxb.exe108⤵PID:1072
-
\??\c:\vbltf.exec:\vbltf.exe109⤵PID:980
-
\??\c:\phppnpr.exec:\phppnpr.exe110⤵PID:2208
-
\??\c:\tbdrpph.exec:\tbdrpph.exe111⤵PID:1184
-
\??\c:\xnnth.exec:\xnnth.exe112⤵PID:792
-
\??\c:\rvtbh.exec:\rvtbh.exe113⤵PID:1472
-
\??\c:\fhntn.exec:\fhntn.exe114⤵PID:1192
-
\??\c:\rpplvdn.exec:\rpplvdn.exe115⤵PID:1836
-
\??\c:\nxljnhn.exec:\nxljnhn.exe116⤵PID:1924
-
\??\c:\xftfvn.exec:\xftfvn.exe117⤵PID:972
-
\??\c:\nnphtjn.exec:\nnphtjn.exe118⤵PID:932
-
\??\c:\vjhxdh.exec:\vjhxdh.exe119⤵PID:2384
-
\??\c:\phxjfr.exec:\phxjfr.exe120⤵PID:2364
-
\??\c:\jndjj.exec:\jndjj.exe121⤵PID:1644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-