Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 21:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3210c3918d8a2e5314503f462ae9452330b2b7eb91c70f7ffab4e5a0d00f9569.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
3210c3918d8a2e5314503f462ae9452330b2b7eb91c70f7ffab4e5a0d00f9569.exe
-
Size
454KB
-
MD5
03db74dc8c7e7bdbe52708f3c26456dd
-
SHA1
4a93d11b06893b905e96550d5371e7d2e4e39c2e
-
SHA256
3210c3918d8a2e5314503f462ae9452330b2b7eb91c70f7ffab4e5a0d00f9569
-
SHA512
51c1e8fae242707ed0ff46a97b1de176e10cf4e61b104e5af6dde84c3ab96f412d60ade0980bdf924f0b4147bf26eca8cc5b86ec22443e441f33a2479bf3da80
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbebs:q7Tc2NYHUrAwfMp3CDbs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2236-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1384-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1020-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-217-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1536-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-327-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2568-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-393-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2948-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-444-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1116-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1452-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1116-499-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2368-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-518-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2120-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-868-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-909-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2384 vjbhl.exe 2716 jjphvpp.exe 3012 rbrjpb.exe 2776 rhnjr.exe 2740 vdfhfb.exe 2916 lbpnr.exe 3008 dxpnrt.exe 2696 lbhbt.exe 2704 xtljnrv.exe 2336 tbvvht.exe 1712 llhrrdd.exe 2720 hddxvf.exe 2984 rrlfhj.exe 564 tphnpdp.exe 1384 jfdlpb.exe 1644 pvntvp.exe 1020 xxtnjv.exe 1444 lbhbh.exe 872 dbnvfp.exe 2192 pxtdtfp.exe 1628 nnbfh.exe 3040 txldtx.exe 2144 vplff.exe 1536 fvrvdl.exe 2196 jxnhxr.exe 288 rdfbvhh.exe 1768 nvhrpht.exe 2484 fxdnvrj.exe 2348 ftbld.exe 2016 prbxlvp.exe 1744 hxpvxn.exe 2532 xjjnvbl.exe 1812 lxntxf.exe 2304 fvdjvp.exe 1740 xnfvnfj.exe 1604 xlvfxj.exe 2568 njbrnl.exe 2712 pfvnhl.exe 2508 tlrpbvv.exe 2860 vldbpn.exe 2840 tljftnn.exe 2828 bjdjh.exe 2540 djplnbt.exe 2768 hlprljh.exe 2656 jtjvxlt.exe 2696 pxdhfdj.exe 2676 bddhdnv.exe 2600 dnlnlp.exe 1696 njfjhl.exe 2948 hphjhxr.exe 2944 xhrtndp.exe 2980 bvrfrpx.exe 2984 ffvttdx.exe 1732 lbfpt.exe 1748 pbhpvpj.exe 1156 jhbxrnh.exe 1644 hxfdpbp.exe 1116 fbvbbd.exe 1452 hnlnln.exe 1968 rxdhnd.exe 1808 hfrjrdr.exe 2368 nlnhtjh.exe 2340 xrtjnhr.exe 2096 dtthh.exe -
resource yara_rule behavioral1/memory/2236-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-792-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-843-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-868-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-929-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2852-930-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-951-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfldhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffhhpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxllphl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjvfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvhpfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvhxpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htvhdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfthtnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrhvfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxtbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hljftnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnrpdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjvlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hphjhxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjjrhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvjxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjnfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbvvht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdlhxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxhbfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfrlnpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nddlfbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xthbhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbftlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdrvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxvvxtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trlffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnntx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnblthx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddlprtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdjtnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bplnpjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njbrnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxbpnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvnltdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndxnpfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrndd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnfntdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhlvdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdhfnf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2384 2236 3210c3918d8a2e5314503f462ae9452330b2b7eb91c70f7ffab4e5a0d00f9569.exe 29 PID 2236 wrote to memory of 2384 2236 3210c3918d8a2e5314503f462ae9452330b2b7eb91c70f7ffab4e5a0d00f9569.exe 29 PID 2236 wrote to memory of 2384 2236 3210c3918d8a2e5314503f462ae9452330b2b7eb91c70f7ffab4e5a0d00f9569.exe 29 PID 2236 wrote to memory of 2384 2236 3210c3918d8a2e5314503f462ae9452330b2b7eb91c70f7ffab4e5a0d00f9569.exe 29 PID 2384 wrote to memory of 2716 2384 vjbhl.exe 30 PID 2384 wrote to memory of 2716 2384 vjbhl.exe 30 PID 2384 wrote to memory of 2716 2384 vjbhl.exe 30 PID 2384 wrote to memory of 2716 2384 vjbhl.exe 30 PID 2716 wrote to memory of 3012 2716 jjphvpp.exe 31 PID 2716 wrote to memory of 3012 2716 jjphvpp.exe 31 PID 2716 wrote to memory of 3012 2716 jjphvpp.exe 31 PID 2716 wrote to memory of 3012 2716 jjphvpp.exe 31 PID 3012 wrote to memory of 2776 3012 rbrjpb.exe 32 PID 3012 wrote to memory of 2776 3012 rbrjpb.exe 32 PID 3012 wrote to memory of 2776 3012 rbrjpb.exe 32 PID 3012 wrote to memory of 2776 3012 rbrjpb.exe 32 PID 2776 wrote to memory of 2740 2776 rhnjr.exe 33 PID 2776 wrote to memory of 2740 2776 rhnjr.exe 33 PID 2776 wrote to memory of 2740 2776 rhnjr.exe 33 PID 2776 wrote to memory of 2740 2776 rhnjr.exe 33 PID 2740 wrote to memory of 2916 2740 vdfhfb.exe 34 PID 2740 wrote to memory of 2916 2740 vdfhfb.exe 34 PID 2740 wrote to memory of 2916 2740 vdfhfb.exe 34 PID 2740 wrote to memory of 2916 2740 vdfhfb.exe 34 PID 2916 wrote to memory of 3008 2916 lbpnr.exe 35 PID 2916 wrote to memory of 3008 2916 lbpnr.exe 35 PID 2916 wrote to memory of 3008 2916 lbpnr.exe 35 PID 2916 wrote to memory of 3008 2916 lbpnr.exe 35 PID 3008 wrote to memory of 2696 3008 dxpnrt.exe 36 PID 3008 wrote to memory of 2696 3008 dxpnrt.exe 36 PID 3008 wrote to memory of 2696 3008 dxpnrt.exe 36 PID 3008 wrote to memory of 2696 3008 dxpnrt.exe 36 PID 2696 wrote to memory of 2704 2696 lbhbt.exe 37 PID 2696 wrote to memory of 2704 2696 lbhbt.exe 37 PID 2696 wrote to memory of 2704 2696 lbhbt.exe 37 PID 2696 wrote to memory of 2704 2696 lbhbt.exe 37 PID 2704 wrote to memory of 2336 2704 xtljnrv.exe 38 PID 2704 wrote to memory of 2336 2704 xtljnrv.exe 38 PID 2704 wrote to memory of 2336 2704 xtljnrv.exe 38 PID 2704 wrote to memory of 2336 2704 xtljnrv.exe 38 PID 2336 wrote to memory of 1712 2336 tbvvht.exe 39 PID 2336 wrote to memory of 1712 2336 tbvvht.exe 39 PID 2336 wrote to memory of 1712 2336 tbvvht.exe 39 PID 2336 wrote to memory of 1712 2336 tbvvht.exe 39 PID 1712 wrote to memory of 2720 1712 llhrrdd.exe 40 PID 1712 wrote to memory of 2720 1712 llhrrdd.exe 40 PID 1712 wrote to memory of 2720 1712 llhrrdd.exe 40 PID 1712 wrote to memory of 2720 1712 llhrrdd.exe 40 PID 2720 wrote to memory of 2984 2720 hddxvf.exe 41 PID 2720 wrote to memory of 2984 2720 hddxvf.exe 41 PID 2720 wrote to memory of 2984 2720 hddxvf.exe 41 PID 2720 wrote to memory of 2984 2720 hddxvf.exe 41 PID 2984 wrote to memory of 564 2984 rrlfhj.exe 42 PID 2984 wrote to memory of 564 2984 rrlfhj.exe 42 PID 2984 wrote to memory of 564 2984 rrlfhj.exe 42 PID 2984 wrote to memory of 564 2984 rrlfhj.exe 42 PID 564 wrote to memory of 1384 564 tphnpdp.exe 43 PID 564 wrote to memory of 1384 564 tphnpdp.exe 43 PID 564 wrote to memory of 1384 564 tphnpdp.exe 43 PID 564 wrote to memory of 1384 564 tphnpdp.exe 43 PID 1384 wrote to memory of 1644 1384 jfdlpb.exe 44 PID 1384 wrote to memory of 1644 1384 jfdlpb.exe 44 PID 1384 wrote to memory of 1644 1384 jfdlpb.exe 44 PID 1384 wrote to memory of 1644 1384 jfdlpb.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\3210c3918d8a2e5314503f462ae9452330b2b7eb91c70f7ffab4e5a0d00f9569.exe"C:\Users\Admin\AppData\Local\Temp\3210c3918d8a2e5314503f462ae9452330b2b7eb91c70f7ffab4e5a0d00f9569.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\vjbhl.exec:\vjbhl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\jjphvpp.exec:\jjphvpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\rbrjpb.exec:\rbrjpb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\rhnjr.exec:\rhnjr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\vdfhfb.exec:\vdfhfb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\lbpnr.exec:\lbpnr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\dxpnrt.exec:\dxpnrt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\lbhbt.exec:\lbhbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\xtljnrv.exec:\xtljnrv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\tbvvht.exec:\tbvvht.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\llhrrdd.exec:\llhrrdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\hddxvf.exec:\hddxvf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\rrlfhj.exec:\rrlfhj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\tphnpdp.exec:\tphnpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\jfdlpb.exec:\jfdlpb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\pvntvp.exec:\pvntvp.exe17⤵
- Executes dropped EXE
PID:1644 -
\??\c:\xxtnjv.exec:\xxtnjv.exe18⤵
- Executes dropped EXE
PID:1020 -
\??\c:\lbhbh.exec:\lbhbh.exe19⤵
- Executes dropped EXE
PID:1444 -
\??\c:\dbnvfp.exec:\dbnvfp.exe20⤵
- Executes dropped EXE
PID:872 -
\??\c:\pxtdtfp.exec:\pxtdtfp.exe21⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nnbfh.exec:\nnbfh.exe22⤵
- Executes dropped EXE
PID:1628 -
\??\c:\txldtx.exec:\txldtx.exe23⤵
- Executes dropped EXE
PID:3040 -
\??\c:\vplff.exec:\vplff.exe24⤵
- Executes dropped EXE
PID:2144 -
\??\c:\fvrvdl.exec:\fvrvdl.exe25⤵
- Executes dropped EXE
PID:1536 -
\??\c:\jxnhxr.exec:\jxnhxr.exe26⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rdfbvhh.exec:\rdfbvhh.exe27⤵
- Executes dropped EXE
PID:288 -
\??\c:\nvhrpht.exec:\nvhrpht.exe28⤵
- Executes dropped EXE
PID:1768 -
\??\c:\fxdnvrj.exec:\fxdnvrj.exe29⤵
- Executes dropped EXE
PID:2484 -
\??\c:\ftbld.exec:\ftbld.exe30⤵
- Executes dropped EXE
PID:2348 -
\??\c:\prbxlvp.exec:\prbxlvp.exe31⤵
- Executes dropped EXE
PID:2016 -
\??\c:\hxpvxn.exec:\hxpvxn.exe32⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xjjnvbl.exec:\xjjnvbl.exe33⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lxntxf.exec:\lxntxf.exe34⤵
- Executes dropped EXE
PID:1812 -
\??\c:\fvdjvp.exec:\fvdjvp.exe35⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xnfvnfj.exec:\xnfvnfj.exe36⤵
- Executes dropped EXE
PID:1740 -
\??\c:\xlvfxj.exec:\xlvfxj.exe37⤵
- Executes dropped EXE
PID:1604 -
\??\c:\njbrnl.exec:\njbrnl.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2568 -
\??\c:\pfvnhl.exec:\pfvnhl.exe39⤵
- Executes dropped EXE
PID:2712 -
\??\c:\tlrpbvv.exec:\tlrpbvv.exe40⤵
- Executes dropped EXE
PID:2508 -
\??\c:\vldbpn.exec:\vldbpn.exe41⤵
- Executes dropped EXE
PID:2860 -
\??\c:\tljftnn.exec:\tljftnn.exe42⤵
- Executes dropped EXE
PID:2840 -
\??\c:\bjdjh.exec:\bjdjh.exe43⤵
- Executes dropped EXE
PID:2828 -
\??\c:\djplnbt.exec:\djplnbt.exe44⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hlprljh.exec:\hlprljh.exe45⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jtjvxlt.exec:\jtjvxlt.exe46⤵
- Executes dropped EXE
PID:2656 -
\??\c:\pxdhfdj.exec:\pxdhfdj.exe47⤵
- Executes dropped EXE
PID:2696 -
\??\c:\bddhdnv.exec:\bddhdnv.exe48⤵
- Executes dropped EXE
PID:2676 -
\??\c:\dnlnlp.exec:\dnlnlp.exe49⤵
- Executes dropped EXE
PID:2600 -
\??\c:\njfjhl.exec:\njfjhl.exe50⤵
- Executes dropped EXE
PID:1696 -
\??\c:\hphjhxr.exec:\hphjhxr.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2948 -
\??\c:\xhrtndp.exec:\xhrtndp.exe52⤵
- Executes dropped EXE
PID:2944 -
\??\c:\bvrfrpx.exec:\bvrfrpx.exe53⤵
- Executes dropped EXE
PID:2980 -
\??\c:\ffvttdx.exec:\ffvttdx.exe54⤵
- Executes dropped EXE
PID:2984 -
\??\c:\lbfpt.exec:\lbfpt.exe55⤵
- Executes dropped EXE
PID:1732 -
\??\c:\pbhpvpj.exec:\pbhpvpj.exe56⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jhbxrnh.exec:\jhbxrnh.exe57⤵
- Executes dropped EXE
PID:1156 -
\??\c:\hxfdpbp.exec:\hxfdpbp.exe58⤵
- Executes dropped EXE
PID:1644 -
\??\c:\fbvbbd.exec:\fbvbbd.exe59⤵
- Executes dropped EXE
PID:1116 -
\??\c:\hnlnln.exec:\hnlnln.exe60⤵
- Executes dropped EXE
PID:1452 -
\??\c:\rxdhnd.exec:\rxdhnd.exe61⤵
- Executes dropped EXE
PID:1968 -
\??\c:\hfrjrdr.exec:\hfrjrdr.exe62⤵
- Executes dropped EXE
PID:1808 -
\??\c:\nlnhtjh.exec:\nlnhtjh.exe63⤵
- Executes dropped EXE
PID:2368 -
\??\c:\xrtjnhr.exec:\xrtjnhr.exe64⤵
- Executes dropped EXE
PID:2340 -
\??\c:\dtthh.exec:\dtthh.exe65⤵
- Executes dropped EXE
PID:2096 -
\??\c:\hvjlb.exec:\hvjlb.exe66⤵PID:900
-
\??\c:\nnhrlh.exec:\nnhrlh.exe67⤵PID:3048
-
\??\c:\bnrxhd.exec:\bnrxhd.exe68⤵PID:2528
-
\??\c:\fhthp.exec:\fhthp.exe69⤵PID:1860
-
\??\c:\jtnjb.exec:\jtnjb.exe70⤵PID:2120
-
\??\c:\nfvntl.exec:\nfvntl.exe71⤵PID:2184
-
\??\c:\hffdfd.exec:\hffdfd.exe72⤵PID:2200
-
\??\c:\ldtjnp.exec:\ldtjnp.exe73⤵PID:860
-
\??\c:\xhfxbfr.exec:\xhfxbfr.exe74⤵PID:2348
-
\??\c:\vnpjx.exec:\vnpjx.exe75⤵PID:1752
-
\??\c:\nthtljv.exec:\nthtljv.exe76⤵PID:1744
-
\??\c:\ppxrvj.exec:\ppxrvj.exe77⤵PID:888
-
\??\c:\nxxbn.exec:\nxxbn.exe78⤵PID:2392
-
\??\c:\npdfj.exec:\npdfj.exe79⤵PID:928
-
\??\c:\htlphbf.exec:\htlphbf.exe80⤵PID:1600
-
\??\c:\nlrpfd.exec:\nlrpfd.exe81⤵PID:2924
-
\??\c:\hjnvx.exec:\hjnvx.exe82⤵PID:276
-
\??\c:\blbtnv.exec:\blbtnv.exe83⤵PID:1664
-
\??\c:\dtvjd.exec:\dtvjd.exe84⤵PID:2852
-
\??\c:\nxtvvb.exec:\nxtvvb.exe85⤵PID:2788
-
\??\c:\tpfdhtv.exec:\tpfdhtv.exe86⤵PID:2640
-
\??\c:\tndxvd.exec:\tndxvd.exe87⤵PID:2848
-
\??\c:\ltvxdt.exec:\ltvxdt.exe88⤵PID:2976
-
\??\c:\jnfjxn.exec:\jnfjxn.exe89⤵PID:2744
-
\??\c:\tvbtpd.exec:\tvbtpd.exe90⤵PID:2692
-
\??\c:\vrxbbv.exec:\vrxbbv.exe91⤵PID:2688
-
\??\c:\vlrfb.exec:\vlrfb.exe92⤵PID:2216
-
\??\c:\ddhvpf.exec:\ddhvpf.exe93⤵PID:988
-
\??\c:\pbrhx.exec:\pbrhx.exe94⤵PID:2936
-
\??\c:\tnprt.exec:\tnprt.exe95⤵PID:2964
-
\??\c:\lvdbj.exec:\lvdbj.exe96⤵PID:2932
-
\??\c:\xhhtl.exec:\xhhtl.exe97⤵PID:1268
-
\??\c:\dphnp.exec:\dphnp.exe98⤵PID:3004
-
\??\c:\vxbpnr.exec:\vxbpnr.exe99⤵
- System Location Discovery: System Language Discovery
PID:1728 -
\??\c:\dlfpt.exec:\dlfpt.exe100⤵PID:1280
-
\??\c:\bdfpjnd.exec:\bdfpjnd.exe101⤵PID:520
-
\??\c:\ttdtd.exec:\ttdtd.exe102⤵PID:1988
-
\??\c:\lffhhpd.exec:\lffhhpd.exe103⤵
- System Location Discovery: System Language Discovery
PID:2844 -
\??\c:\pnpbvv.exec:\pnpbvv.exe104⤵PID:336
-
\??\c:\ptflff.exec:\ptflff.exe105⤵PID:1964
-
\??\c:\ptlrf.exec:\ptlrf.exe106⤵PID:2500
-
\??\c:\pbvvln.exec:\pbvvln.exe107⤵PID:1624
-
\??\c:\bfdpl.exec:\bfdpl.exe108⤵PID:1916
-
\??\c:\xxnpn.exec:\xxnpn.exe109⤵PID:2352
-
\??\c:\lpjvh.exec:\lpjvh.exe110⤵PID:2456
-
\??\c:\xfphxtn.exec:\xfphxtn.exe111⤵PID:972
-
\??\c:\hdlhxv.exec:\hdlhxv.exe112⤵
- System Location Discovery: System Language Discovery
PID:668 -
\??\c:\hrlhdlr.exec:\hrlhdlr.exe113⤵PID:1292
-
\??\c:\jffjhj.exec:\jffjhj.exe114⤵PID:2196
-
\??\c:\trlffl.exec:\trlffl.exe115⤵
- System Location Discovery: System Language Discovery
PID:288 -
\??\c:\dfdxb.exec:\dfdxb.exe116⤵PID:2120
-
\??\c:\hlxrfv.exec:\hlxrfv.exe117⤵PID:1892
-
\??\c:\tdjft.exec:\tdjft.exe118⤵PID:1840
-
\??\c:\fvllfh.exec:\fvllfh.exe119⤵PID:392
-
\??\c:\hdxbbvr.exec:\hdxbbvr.exe120⤵PID:1704
-
\??\c:\xbjtpf.exec:\xbjtpf.exe121⤵PID:2584
-
\??\c:\jbbvl.exec:\jbbvl.exe122⤵PID:2296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-