Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
27/12/2024, 23:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe
-
Size
453KB
-
MD5
609243d0265cb44a1f60cd626c2e9a2a
-
SHA1
83540096107387538742e106c70cedfd56628020
-
SHA256
771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b
-
SHA512
aad8916dff5c098dc8dbaf6fcf3941289356e98bee407e77656091b3ec9c0230d78def59e049acd912d6564529bf6f812c4f196425345a3e7ff94d7b64d20671
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeGM3:q7Tc2NYHUrAwfMp3CDGM3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2880-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-97-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/1440-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/364-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-377-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2964-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1136-655-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2928-681-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-810-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1284-844-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-851-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-852-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1396-885-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2704-962-0x0000000000280000-0x00000000002AA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2892 lvvxbdh.exe 3020 djldf.exe 2796 ldxtpl.exe 2660 njrtdd.exe 2488 bjvhxnn.exe 2116 rvlvh.exe 2548 jhrfpr.exe 2472 rtjph.exe 1624 ppldt.exe 772 pxhbpjx.exe 700 bhdhbjx.exe 2920 vvbtnbb.exe 1440 lxvxh.exe 2036 njbjpl.exe 3000 hxvhd.exe 2396 htlpfph.exe 1092 bbvlxbx.exe 2216 rrpbt.exe 1080 htbxn.exe 2192 bhlrnrt.exe 3012 fjftl.exe 1504 hnvvpf.exe 364 dpbpd.exe 1028 htxrp.exe 1800 fbvjv.exe 1540 hflrvv.exe 1656 bhffp.exe 2052 lplpbj.exe 2580 jvdtjbd.exe 1284 vtvvdhv.exe 2424 jrrttx.exe 1396 ptjvnj.exe 892 xddltdr.exe 2276 trpbtf.exe 2856 hpvfl.exe 2728 pvtdjd.exe 2760 rjjxhbn.exe 2492 xtldtp.exe 3020 rbjrhv.exe 2804 vpbjntx.exe 2640 flhprlp.exe 1780 brlhp.exe 1156 ttnnvr.exe 2228 tdbjn.exe 2732 rnrldx.exe 1060 nlfltp.exe 3036 lbbbvhf.exe 2496 drtnhr.exe 2964 hllbxhn.exe 2260 tpxrbrx.exe 1616 hxrhjxj.exe 1440 htbjvx.exe 2224 vvtnxh.exe 3004 tnnpjn.exe 472 bvrph.exe 2184 hbrpln.exe 2188 rvnrb.exe 2104 vhlttn.exe 2172 xxxdth.exe 2128 fpdjfp.exe 632 jvxvj.exe 1188 dnplntb.exe 2352 nfbbvth.exe 1732 tvfvhx.exe -
resource yara_rule behavioral1/memory/2880-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-97-0x0000000001C50000-0x0000000001C7A000-memory.dmp upx behavioral1/memory/1440-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/364-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/364-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-783-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-810-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1284-844-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-851-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-908-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-922-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvhbpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvrbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lprlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldvhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prrnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpjhfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjbhhnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tndldjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxdxtpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfxhnrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrhvlnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxftb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nptbxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdrhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbrlfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhntj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrjttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fldfhbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtxlnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdvlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvvxbdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhrthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrhpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfpxltx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvbfvph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxfndxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtjhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljtxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nljtxjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvxdxhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnrpxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnxdrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlbld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxphlnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhvft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnnvpnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drjrtrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhbplf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2880 wrote to memory of 2892 2880 771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe 30 PID 2880 wrote to memory of 2892 2880 771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe 30 PID 2880 wrote to memory of 2892 2880 771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe 30 PID 2880 wrote to memory of 2892 2880 771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe 30 PID 2892 wrote to memory of 3020 2892 lvvxbdh.exe 31 PID 2892 wrote to memory of 3020 2892 lvvxbdh.exe 31 PID 2892 wrote to memory of 3020 2892 lvvxbdh.exe 31 PID 2892 wrote to memory of 3020 2892 lvvxbdh.exe 31 PID 3020 wrote to memory of 2796 3020 djldf.exe 32 PID 3020 wrote to memory of 2796 3020 djldf.exe 32 PID 3020 wrote to memory of 2796 3020 djldf.exe 32 PID 3020 wrote to memory of 2796 3020 djldf.exe 32 PID 2796 wrote to memory of 2660 2796 ldxtpl.exe 33 PID 2796 wrote to memory of 2660 2796 ldxtpl.exe 33 PID 2796 wrote to memory of 2660 2796 ldxtpl.exe 33 PID 2796 wrote to memory of 2660 2796 ldxtpl.exe 33 PID 2660 wrote to memory of 2488 2660 njrtdd.exe 34 PID 2660 wrote to memory of 2488 2660 njrtdd.exe 34 PID 2660 wrote to memory of 2488 2660 njrtdd.exe 34 PID 2660 wrote to memory of 2488 2660 njrtdd.exe 34 PID 2488 wrote to memory of 2116 2488 bjvhxnn.exe 35 PID 2488 wrote to memory of 2116 2488 bjvhxnn.exe 35 PID 2488 wrote to memory of 2116 2488 bjvhxnn.exe 35 PID 2488 wrote to memory of 2116 2488 bjvhxnn.exe 35 PID 2116 wrote to memory of 2548 2116 rvlvh.exe 36 PID 2116 wrote to memory of 2548 2116 rvlvh.exe 36 PID 2116 wrote to memory of 2548 2116 rvlvh.exe 36 PID 2116 wrote to memory of 2548 2116 rvlvh.exe 36 PID 2548 wrote to memory of 2472 2548 jhrfpr.exe 37 PID 2548 wrote to memory of 2472 2548 jhrfpr.exe 37 PID 2548 wrote to memory of 2472 2548 jhrfpr.exe 37 PID 2548 wrote to memory of 2472 2548 jhrfpr.exe 37 PID 2472 wrote to memory of 1624 2472 rtjph.exe 38 PID 2472 wrote to memory of 1624 2472 rtjph.exe 38 PID 2472 wrote to memory of 1624 2472 rtjph.exe 38 PID 2472 wrote to memory of 1624 2472 rtjph.exe 38 PID 1624 wrote to memory of 772 1624 ppldt.exe 39 PID 1624 wrote to memory of 772 1624 ppldt.exe 39 PID 1624 wrote to memory of 772 1624 ppldt.exe 39 PID 1624 wrote to memory of 772 1624 ppldt.exe 39 PID 772 wrote to memory of 700 772 pxhbpjx.exe 40 PID 772 wrote to memory of 700 772 pxhbpjx.exe 40 PID 772 wrote to memory of 700 772 pxhbpjx.exe 40 PID 772 wrote to memory of 700 772 pxhbpjx.exe 40 PID 700 wrote to memory of 2920 700 bhdhbjx.exe 41 PID 700 wrote to memory of 2920 700 bhdhbjx.exe 41 PID 700 wrote to memory of 2920 700 bhdhbjx.exe 41 PID 700 wrote to memory of 2920 700 bhdhbjx.exe 41 PID 2920 wrote to memory of 1440 2920 vvbtnbb.exe 42 PID 2920 wrote to memory of 1440 2920 vvbtnbb.exe 42 PID 2920 wrote to memory of 1440 2920 vvbtnbb.exe 42 PID 2920 wrote to memory of 1440 2920 vvbtnbb.exe 42 PID 1440 wrote to memory of 2036 1440 lxvxh.exe 43 PID 1440 wrote to memory of 2036 1440 lxvxh.exe 43 PID 1440 wrote to memory of 2036 1440 lxvxh.exe 43 PID 1440 wrote to memory of 2036 1440 lxvxh.exe 43 PID 2036 wrote to memory of 3000 2036 njbjpl.exe 44 PID 2036 wrote to memory of 3000 2036 njbjpl.exe 44 PID 2036 wrote to memory of 3000 2036 njbjpl.exe 44 PID 2036 wrote to memory of 3000 2036 njbjpl.exe 44 PID 3000 wrote to memory of 2396 3000 hxvhd.exe 45 PID 3000 wrote to memory of 2396 3000 hxvhd.exe 45 PID 3000 wrote to memory of 2396 3000 hxvhd.exe 45 PID 3000 wrote to memory of 2396 3000 hxvhd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe"C:\Users\Admin\AppData\Local\Temp\771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\lvvxbdh.exec:\lvvxbdh.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\djldf.exec:\djldf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\ldxtpl.exec:\ldxtpl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\njrtdd.exec:\njrtdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\bjvhxnn.exec:\bjvhxnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\rvlvh.exec:\rvlvh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\jhrfpr.exec:\jhrfpr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\rtjph.exec:\rtjph.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\ppldt.exec:\ppldt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\pxhbpjx.exec:\pxhbpjx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\bhdhbjx.exec:\bhdhbjx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\vvbtnbb.exec:\vvbtnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\lxvxh.exec:\lxvxh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\njbjpl.exec:\njbjpl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\hxvhd.exec:\hxvhd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\htlpfph.exec:\htlpfph.exe17⤵
- Executes dropped EXE
PID:2396 -
\??\c:\bbvlxbx.exec:\bbvlxbx.exe18⤵
- Executes dropped EXE
PID:1092 -
\??\c:\rrpbt.exec:\rrpbt.exe19⤵
- Executes dropped EXE
PID:2216 -
\??\c:\htbxn.exec:\htbxn.exe20⤵
- Executes dropped EXE
PID:1080 -
\??\c:\bhlrnrt.exec:\bhlrnrt.exe21⤵
- Executes dropped EXE
PID:2192 -
\??\c:\fjftl.exec:\fjftl.exe22⤵
- Executes dropped EXE
PID:3012 -
\??\c:\hnvvpf.exec:\hnvvpf.exe23⤵
- Executes dropped EXE
PID:1504 -
\??\c:\dpbpd.exec:\dpbpd.exe24⤵
- Executes dropped EXE
PID:364 -
\??\c:\htxrp.exec:\htxrp.exe25⤵
- Executes dropped EXE
PID:1028 -
\??\c:\fbvjv.exec:\fbvjv.exe26⤵
- Executes dropped EXE
PID:1800 -
\??\c:\hflrvv.exec:\hflrvv.exe27⤵
- Executes dropped EXE
PID:1540 -
\??\c:\bhffp.exec:\bhffp.exe28⤵
- Executes dropped EXE
PID:1656 -
\??\c:\lplpbj.exec:\lplpbj.exe29⤵
- Executes dropped EXE
PID:2052 -
\??\c:\jvdtjbd.exec:\jvdtjbd.exe30⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vtvvdhv.exec:\vtvvdhv.exe31⤵
- Executes dropped EXE
PID:1284 -
\??\c:\jrrttx.exec:\jrrttx.exe32⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ptjvnj.exec:\ptjvnj.exe33⤵
- Executes dropped EXE
PID:1396 -
\??\c:\xddltdr.exec:\xddltdr.exe34⤵
- Executes dropped EXE
PID:892 -
\??\c:\trpbtf.exec:\trpbtf.exe35⤵
- Executes dropped EXE
PID:2276 -
\??\c:\hpvfl.exec:\hpvfl.exe36⤵
- Executes dropped EXE
PID:2856 -
\??\c:\pvtdjd.exec:\pvtdjd.exe37⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rjjxhbn.exec:\rjjxhbn.exe38⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xtldtp.exec:\xtldtp.exe39⤵
- Executes dropped EXE
PID:2492 -
\??\c:\rbjrhv.exec:\rbjrhv.exe40⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vpbjntx.exec:\vpbjntx.exe41⤵
- Executes dropped EXE
PID:2804 -
\??\c:\flhprlp.exec:\flhprlp.exe42⤵
- Executes dropped EXE
PID:2640 -
\??\c:\brlhp.exec:\brlhp.exe43⤵
- Executes dropped EXE
PID:1780 -
\??\c:\ttnnvr.exec:\ttnnvr.exe44⤵
- Executes dropped EXE
PID:1156 -
\??\c:\tdbjn.exec:\tdbjn.exe45⤵
- Executes dropped EXE
PID:2228 -
\??\c:\rnrldx.exec:\rnrldx.exe46⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nlfltp.exec:\nlfltp.exe47⤵
- Executes dropped EXE
PID:1060 -
\??\c:\lbbbvhf.exec:\lbbbvhf.exe48⤵
- Executes dropped EXE
PID:3036 -
\??\c:\drtnhr.exec:\drtnhr.exe49⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hllbxhn.exec:\hllbxhn.exe50⤵
- Executes dropped EXE
PID:2964 -
\??\c:\tpxrbrx.exec:\tpxrbrx.exe51⤵
- Executes dropped EXE
PID:2260 -
\??\c:\hxrhjxj.exec:\hxrhjxj.exe52⤵
- Executes dropped EXE
PID:1616 -
\??\c:\htbjvx.exec:\htbjvx.exe53⤵
- Executes dropped EXE
PID:1440 -
\??\c:\vvtnxh.exec:\vvtnxh.exe54⤵
- Executes dropped EXE
PID:2224 -
\??\c:\tnnpjn.exec:\tnnpjn.exe55⤵
- Executes dropped EXE
PID:3004 -
\??\c:\bvrph.exec:\bvrph.exe56⤵
- Executes dropped EXE
PID:472 -
\??\c:\hbrpln.exec:\hbrpln.exe57⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rvnrb.exec:\rvnrb.exe58⤵
- Executes dropped EXE
PID:2188 -
\??\c:\vhlttn.exec:\vhlttn.exe59⤵
- Executes dropped EXE
PID:2104 -
\??\c:\xxxdth.exec:\xxxdth.exe60⤵
- Executes dropped EXE
PID:2172 -
\??\c:\fpdjfp.exec:\fpdjfp.exe61⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jvxvj.exec:\jvxvj.exe62⤵
- Executes dropped EXE
PID:632 -
\??\c:\dnplntb.exec:\dnplntb.exe63⤵
- Executes dropped EXE
PID:1188 -
\??\c:\nfbbvth.exec:\nfbbvth.exe64⤵
- Executes dropped EXE
PID:2352 -
\??\c:\tvfvhx.exec:\tvfvhx.exe65⤵
- Executes dropped EXE
PID:1732 -
\??\c:\dtxvjx.exec:\dtxvjx.exe66⤵PID:1992
-
\??\c:\jjrbjb.exec:\jjrbjb.exe67⤵PID:1700
-
\??\c:\fnpfbv.exec:\fnpfbv.exe68⤵PID:1800
-
\??\c:\nnvlb.exec:\nnvlb.exe69⤵PID:2016
-
\??\c:\xlnnp.exec:\xlnnp.exe70⤵PID:2432
-
\??\c:\ptrxr.exec:\ptrxr.exe71⤵PID:2100
-
\??\c:\dfrrhn.exec:\dfrrhn.exe72⤵PID:2272
-
\??\c:\rpbvdv.exec:\rpbvdv.exe73⤵PID:1920
-
\??\c:\plxxhb.exec:\plxxhb.exe74⤵PID:2280
-
\??\c:\hbbrb.exec:\hbbrb.exe75⤵PID:2888
-
\??\c:\xrfjvrp.exec:\xrfjvrp.exe76⤵PID:2720
-
\??\c:\bdtlffb.exec:\bdtlffb.exe77⤵PID:2156
-
\??\c:\bpvfjp.exec:\bpvfjp.exe78⤵PID:2320
-
\??\c:\jbhvd.exec:\jbhvd.exe79⤵PID:2276
-
\??\c:\pnvdjfv.exec:\pnvdjfv.exe80⤵PID:2776
-
\??\c:\ttbrvd.exec:\ttbrvd.exe81⤵PID:2896
-
\??\c:\txvjj.exec:\txvjj.exe82⤵PID:2068
-
\??\c:\ftjjvv.exec:\ftjjvv.exe83⤵PID:2844
-
\??\c:\nbjddx.exec:\nbjddx.exe84⤵PID:2572
-
\??\c:\rdxjndv.exec:\rdxjndv.exe85⤵PID:2636
-
\??\c:\jtjjxxj.exec:\jtjjxxj.exe86⤵PID:2196
-
\??\c:\vhdrd.exec:\vhdrd.exe87⤵PID:2012
-
\??\c:\vbhpdv.exec:\vbhpdv.exe88⤵PID:1928
-
\??\c:\pddnlvp.exec:\pddnlvp.exe89⤵PID:1136
-
\??\c:\lxbpt.exec:\lxbpt.exe90⤵PID:2472
-
\??\c:\lthfv.exec:\lthfv.exe91⤵PID:2508
-
\??\c:\npttrrr.exec:\npttrrr.exe92⤵PID:2356
-
\??\c:\jhnvrvd.exec:\jhnvrvd.exe93⤵PID:2928
-
\??\c:\lvpblx.exec:\lvpblx.exe94⤵PID:2696
-
\??\c:\dhjtbr.exec:\dhjtbr.exe95⤵PID:2988
-
\??\c:\pdpnxpb.exec:\pdpnxpb.exe96⤵PID:2972
-
\??\c:\thfdrvh.exec:\thfdrvh.exe97⤵PID:1492
-
\??\c:\ljtnjrv.exec:\ljtnjrv.exe98⤵PID:2984
-
\??\c:\rbbtlp.exec:\rbbtlp.exe99⤵PID:2992
-
\??\c:\btvjv.exec:\btvjv.exe100⤵PID:1748
-
\??\c:\blrfl.exec:\blrfl.exe101⤵PID:2464
-
\??\c:\rjjrvp.exec:\rjjrvp.exe102⤵PID:1560
-
\??\c:\xhdnnvv.exec:\xhdnnvv.exe103⤵PID:1912
-
\??\c:\btpbhb.exec:\btpbhb.exe104⤵PID:1080
-
\??\c:\rpxbfdr.exec:\rpxbfdr.exe105⤵PID:2124
-
\??\c:\pxlthbb.exec:\pxlthbb.exe106⤵PID:2108
-
\??\c:\vnnntx.exec:\vnnntx.exe107⤵PID:1792
-
\??\c:\tddhx.exec:\tddhx.exe108⤵PID:980
-
\??\c:\dlxlrl.exec:\dlxlrl.exe109⤵PID:836
-
\??\c:\tdpntht.exec:\tdpntht.exe110⤵PID:784
-
\??\c:\phplxfp.exec:\phplxfp.exe111⤵PID:1256
-
\??\c:\txddxl.exec:\txddxl.exe112⤵PID:2368
-
\??\c:\nvdvrt.exec:\nvdvrt.exe113⤵PID:1696
-
\??\c:\jfxflhr.exec:\jfxflhr.exe114⤵PID:2584
-
\??\c:\vvlfdj.exec:\vvlfdj.exe115⤵PID:3008
-
\??\c:\dvvtj.exec:\dvvtj.exe116⤵PID:1884
-
\??\c:\pxhnvff.exec:\pxhnvff.exe117⤵PID:1284
-
\??\c:\xxnfddd.exec:\xxnfddd.exe118⤵PID:580
-
\??\c:\pdjrrpp.exec:\pdjrrpp.exe119⤵PID:2724
-
\??\c:\xfrtl.exec:\xfrtl.exe120⤵PID:1396
-
\??\c:\rdxxpv.exec:\rdxxpv.exe121⤵PID:2880
-
\??\c:\pfhbr.exec:\pfhbr.exe122⤵PID:1580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-