Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 23:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
604a4c97837ddd2224abc077de72e18b0d61ddd3f9252631bed47deb1d97e317.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
604a4c97837ddd2224abc077de72e18b0d61ddd3f9252631bed47deb1d97e317.exe
-
Size
456KB
-
MD5
287160b4f673db6405eaa4d7d2f603cf
-
SHA1
61cc75af6563cc11f8285b300982eced3a4a7b20
-
SHA256
604a4c97837ddd2224abc077de72e18b0d61ddd3f9252631bed47deb1d97e317
-
SHA512
149800242c9e1f02dd5cb5504965194d6805b4004ea5ded782eddeccb4defa2a72e57aa129b968193a19109aeaad12b2b3d7c70a491088548db3b0de66891ef6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR7:q7Tc2NYHUrAwfMp3CDR7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/1728-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-66-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2876-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-79-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1928-97-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2944-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-99-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2912-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-118-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2924-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-145-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1908-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-175-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1608-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/628-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/268-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-262-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2456-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-413-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1280-437-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1624-433-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1280-441-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/516-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-470-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2520-484-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1904-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-664-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2796-883-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-1089-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1104 ljltx.exe 2300 jflrv.exe 1852 fbvpv.exe 2744 tjfbp.exe 2752 jvbjp.exe 2876 lrxxlrn.exe 2620 tdxpllb.exe 2656 vfbbth.exe 1928 xjnjbhp.exe 2944 nltxnx.exe 568 rbhpr.exe 2912 frxnxxh.exe 2924 lhpxhj.exe 772 njbfjx.exe 852 lpxfbxl.exe 1908 ptpvj.exe 2508 dpvfhd.exe 1608 bhvhnv.exe 2520 rnpbnr.exe 3048 vbnhhbf.exe 940 xhvlhxl.exe 776 xrrdf.exe 2440 nhlrjv.exe 628 hpjrnxn.exe 764 tdxtxh.exe 3032 htxdjvx.exe 1092 jhvvlhj.exe 268 lljbf.exe 2456 tnfvbtv.exe 1960 rlrjxxx.exe 2320 rdjbpvx.exe 876 prtbf.exe 1408 hldtpfp.exe 2268 jtjhfv.exe 2532 plnhvn.exe 2476 lhdrxn.exe 2812 hjnvv.exe 2136 hhnppd.exe 2844 dnrhbn.exe 3064 brbfhnv.exe 2616 tnbrh.exe 2648 vdlhxf.exe 1716 rprbj.exe 1536 vfnvbn.exe 2580 ppxhddj.exe 2956 rnnjxd.exe 2684 bhnpd.exe 1624 pnhdt.exe 2912 flrxfjb.exe 2948 hvfdjj.exe 952 tlpxj.exe 1280 xhpnnjh.exe 516 fhjtjdh.exe 2044 nxjblb.exe 2304 hnvrxp.exe 2092 lfbhv.exe 2204 jvxbrnv.exe 2520 vflpvd.exe 1308 dptpdvn.exe 808 fvjpr.exe 948 fdxfnx.exe 904 rphfhr.exe 1956 vlltd.exe 1904 jvjxbvv.exe -
resource yara_rule behavioral1/memory/1728-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-175-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1608-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/516-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/516-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-504-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1904-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-637-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2040-776-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-883-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-944-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-1013-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-1038-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-1045-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfxpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jntvxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fblvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbrjnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxnxxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drptx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnlrdxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrvpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxptlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljbbxpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtvvtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tppvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrfpnbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlltvbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxrfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhprhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htjnrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnlrhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfnjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbtpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxndt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppxhddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxnxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bprnrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpjvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plnrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvfhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvfrxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnndfbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1728 wrote to memory of 1104 1728 604a4c97837ddd2224abc077de72e18b0d61ddd3f9252631bed47deb1d97e317.exe 31 PID 1728 wrote to memory of 1104 1728 604a4c97837ddd2224abc077de72e18b0d61ddd3f9252631bed47deb1d97e317.exe 31 PID 1728 wrote to memory of 1104 1728 604a4c97837ddd2224abc077de72e18b0d61ddd3f9252631bed47deb1d97e317.exe 31 PID 1728 wrote to memory of 1104 1728 604a4c97837ddd2224abc077de72e18b0d61ddd3f9252631bed47deb1d97e317.exe 31 PID 1104 wrote to memory of 2300 1104 ljltx.exe 32 PID 1104 wrote to memory of 2300 1104 ljltx.exe 32 PID 1104 wrote to memory of 2300 1104 ljltx.exe 32 PID 1104 wrote to memory of 2300 1104 ljltx.exe 32 PID 2300 wrote to memory of 1852 2300 jflrv.exe 33 PID 2300 wrote to memory of 1852 2300 jflrv.exe 33 PID 2300 wrote to memory of 1852 2300 jflrv.exe 33 PID 2300 wrote to memory of 1852 2300 jflrv.exe 33 PID 1852 wrote to memory of 2744 1852 fbvpv.exe 34 PID 1852 wrote to memory of 2744 1852 fbvpv.exe 34 PID 1852 wrote to memory of 2744 1852 fbvpv.exe 34 PID 1852 wrote to memory of 2744 1852 fbvpv.exe 34 PID 2744 wrote to memory of 2752 2744 tjfbp.exe 35 PID 2744 wrote to memory of 2752 2744 tjfbp.exe 35 PID 2744 wrote to memory of 2752 2744 tjfbp.exe 35 PID 2744 wrote to memory of 2752 2744 tjfbp.exe 35 PID 2752 wrote to memory of 2876 2752 jvbjp.exe 36 PID 2752 wrote to memory of 2876 2752 jvbjp.exe 36 PID 2752 wrote to memory of 2876 2752 jvbjp.exe 36 PID 2752 wrote to memory of 2876 2752 jvbjp.exe 36 PID 2876 wrote to memory of 2620 2876 lrxxlrn.exe 37 PID 2876 wrote to memory of 2620 2876 lrxxlrn.exe 37 PID 2876 wrote to memory of 2620 2876 lrxxlrn.exe 37 PID 2876 wrote to memory of 2620 2876 lrxxlrn.exe 37 PID 2620 wrote to memory of 2656 2620 tdxpllb.exe 38 PID 2620 wrote to memory of 2656 2620 tdxpllb.exe 38 PID 2620 wrote to memory of 2656 2620 tdxpllb.exe 38 PID 2620 wrote to memory of 2656 2620 tdxpllb.exe 38 PID 2656 wrote to memory of 1928 2656 vfbbth.exe 39 PID 2656 wrote to memory of 1928 2656 vfbbth.exe 39 PID 2656 wrote to memory of 1928 2656 vfbbth.exe 39 PID 2656 wrote to memory of 1928 2656 vfbbth.exe 39 PID 1928 wrote to memory of 2944 1928 xjnjbhp.exe 40 PID 1928 wrote to memory of 2944 1928 xjnjbhp.exe 40 PID 1928 wrote to memory of 2944 1928 xjnjbhp.exe 40 PID 1928 wrote to memory of 2944 1928 xjnjbhp.exe 40 PID 2944 wrote to memory of 568 2944 nltxnx.exe 41 PID 2944 wrote to memory of 568 2944 nltxnx.exe 41 PID 2944 wrote to memory of 568 2944 nltxnx.exe 41 PID 2944 wrote to memory of 568 2944 nltxnx.exe 41 PID 568 wrote to memory of 2912 568 rbhpr.exe 42 PID 568 wrote to memory of 2912 568 rbhpr.exe 42 PID 568 wrote to memory of 2912 568 rbhpr.exe 42 PID 568 wrote to memory of 2912 568 rbhpr.exe 42 PID 2912 wrote to memory of 2924 2912 frxnxxh.exe 43 PID 2912 wrote to memory of 2924 2912 frxnxxh.exe 43 PID 2912 wrote to memory of 2924 2912 frxnxxh.exe 43 PID 2912 wrote to memory of 2924 2912 frxnxxh.exe 43 PID 2924 wrote to memory of 772 2924 lhpxhj.exe 44 PID 2924 wrote to memory of 772 2924 lhpxhj.exe 44 PID 2924 wrote to memory of 772 2924 lhpxhj.exe 44 PID 2924 wrote to memory of 772 2924 lhpxhj.exe 44 PID 772 wrote to memory of 852 772 njbfjx.exe 45 PID 772 wrote to memory of 852 772 njbfjx.exe 45 PID 772 wrote to memory of 852 772 njbfjx.exe 45 PID 772 wrote to memory of 852 772 njbfjx.exe 45 PID 852 wrote to memory of 1908 852 lpxfbxl.exe 46 PID 852 wrote to memory of 1908 852 lpxfbxl.exe 46 PID 852 wrote to memory of 1908 852 lpxfbxl.exe 46 PID 852 wrote to memory of 1908 852 lpxfbxl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\604a4c97837ddd2224abc077de72e18b0d61ddd3f9252631bed47deb1d97e317.exe"C:\Users\Admin\AppData\Local\Temp\604a4c97837ddd2224abc077de72e18b0d61ddd3f9252631bed47deb1d97e317.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\ljltx.exec:\ljltx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\jflrv.exec:\jflrv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\fbvpv.exec:\fbvpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\tjfbp.exec:\tjfbp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\jvbjp.exec:\jvbjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\lrxxlrn.exec:\lrxxlrn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\tdxpllb.exec:\tdxpllb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\vfbbth.exec:\vfbbth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\xjnjbhp.exec:\xjnjbhp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\nltxnx.exec:\nltxnx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\rbhpr.exec:\rbhpr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\frxnxxh.exec:\frxnxxh.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\lhpxhj.exec:\lhpxhj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\njbfjx.exec:\njbfjx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\lpxfbxl.exec:\lpxfbxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\ptpvj.exec:\ptpvj.exe17⤵
- Executes dropped EXE
PID:1908 -
\??\c:\dpvfhd.exec:\dpvfhd.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2508 -
\??\c:\bhvhnv.exec:\bhvhnv.exe19⤵
- Executes dropped EXE
PID:1608 -
\??\c:\rnpbnr.exec:\rnpbnr.exe20⤵
- Executes dropped EXE
PID:2520 -
\??\c:\vbnhhbf.exec:\vbnhhbf.exe21⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xhvlhxl.exec:\xhvlhxl.exe22⤵
- Executes dropped EXE
PID:940 -
\??\c:\xrrdf.exec:\xrrdf.exe23⤵
- Executes dropped EXE
PID:776 -
\??\c:\nhlrjv.exec:\nhlrjv.exe24⤵
- Executes dropped EXE
PID:2440 -
\??\c:\hpjrnxn.exec:\hpjrnxn.exe25⤵
- Executes dropped EXE
PID:628 -
\??\c:\tdxtxh.exec:\tdxtxh.exe26⤵
- Executes dropped EXE
PID:764 -
\??\c:\htxdjvx.exec:\htxdjvx.exe27⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jhvvlhj.exec:\jhvvlhj.exe28⤵
- Executes dropped EXE
PID:1092 -
\??\c:\lljbf.exec:\lljbf.exe29⤵
- Executes dropped EXE
PID:268 -
\??\c:\tnfvbtv.exec:\tnfvbtv.exe30⤵
- Executes dropped EXE
PID:2456 -
\??\c:\rlrjxxx.exec:\rlrjxxx.exe31⤵
- Executes dropped EXE
PID:1960 -
\??\c:\rdjbpvx.exec:\rdjbpvx.exe32⤵
- Executes dropped EXE
PID:2320 -
\??\c:\prtbf.exec:\prtbf.exe33⤵
- Executes dropped EXE
PID:876 -
\??\c:\hldtpfp.exec:\hldtpfp.exe34⤵
- Executes dropped EXE
PID:1408 -
\??\c:\jtjhfv.exec:\jtjhfv.exe35⤵
- Executes dropped EXE
PID:2268 -
\??\c:\plnhvn.exec:\plnhvn.exe36⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lhdrxn.exec:\lhdrxn.exe37⤵
- Executes dropped EXE
PID:2476 -
\??\c:\hjnvv.exec:\hjnvv.exe38⤵
- Executes dropped EXE
PID:2812 -
\??\c:\hhnppd.exec:\hhnppd.exe39⤵
- Executes dropped EXE
PID:2136 -
\??\c:\dnrhbn.exec:\dnrhbn.exe40⤵
- Executes dropped EXE
PID:2844 -
\??\c:\brbfhnv.exec:\brbfhnv.exe41⤵
- Executes dropped EXE
PID:3064 -
\??\c:\tnbrh.exec:\tnbrh.exe42⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vdlhxf.exec:\vdlhxf.exe43⤵
- Executes dropped EXE
PID:2648 -
\??\c:\rprbj.exec:\rprbj.exe44⤵
- Executes dropped EXE
PID:1716 -
\??\c:\vfnvbn.exec:\vfnvbn.exe45⤵
- Executes dropped EXE
PID:1536 -
\??\c:\ppxhddj.exec:\ppxhddj.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2580 -
\??\c:\rnnjxd.exec:\rnnjxd.exe47⤵
- Executes dropped EXE
PID:2956 -
\??\c:\bhnpd.exec:\bhnpd.exe48⤵
- Executes dropped EXE
PID:2684 -
\??\c:\pnhdt.exec:\pnhdt.exe49⤵
- Executes dropped EXE
PID:1624 -
\??\c:\flrxfjb.exec:\flrxfjb.exe50⤵
- Executes dropped EXE
PID:2912 -
\??\c:\hvfdjj.exec:\hvfdjj.exe51⤵
- Executes dropped EXE
PID:2948 -
\??\c:\tlpxj.exec:\tlpxj.exe52⤵
- Executes dropped EXE
PID:952 -
\??\c:\xhpnnjh.exec:\xhpnnjh.exe53⤵
- Executes dropped EXE
PID:1280 -
\??\c:\fhjtjdh.exec:\fhjtjdh.exe54⤵
- Executes dropped EXE
PID:516 -
\??\c:\nxjblb.exec:\nxjblb.exe55⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hnvrxp.exec:\hnvrxp.exe56⤵
- Executes dropped EXE
PID:2304 -
\??\c:\lfbhv.exec:\lfbhv.exe57⤵
- Executes dropped EXE
PID:2092 -
\??\c:\jvxbrnv.exec:\jvxbrnv.exe58⤵
- Executes dropped EXE
PID:2204 -
\??\c:\vflpvd.exec:\vflpvd.exe59⤵
- Executes dropped EXE
PID:2520 -
\??\c:\dptpdvn.exec:\dptpdvn.exe60⤵
- Executes dropped EXE
PID:1308 -
\??\c:\fvjpr.exec:\fvjpr.exe61⤵
- Executes dropped EXE
PID:808 -
\??\c:\fdxfnx.exec:\fdxfnx.exe62⤵
- Executes dropped EXE
PID:948 -
\??\c:\rphfhr.exec:\rphfhr.exe63⤵
- Executes dropped EXE
PID:904 -
\??\c:\vlltd.exec:\vlltd.exe64⤵
- Executes dropped EXE
PID:1956 -
\??\c:\jvjxbvv.exec:\jvjxbvv.exe65⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jbndhd.exec:\jbndhd.exe66⤵PID:1548
-
\??\c:\hrrfhpv.exec:\hrrfhpv.exe67⤵PID:3060
-
\??\c:\bndrxj.exec:\bndrxj.exe68⤵PID:1324
-
\??\c:\rlxnvdp.exec:\rlxnvdp.exe69⤵PID:1092
-
\??\c:\hhbrjhr.exec:\hhbrjhr.exe70⤵PID:1464
-
\??\c:\ltlrl.exec:\ltlrl.exe71⤵PID:2420
-
\??\c:\vhjndd.exec:\vhjndd.exe72⤵PID:2412
-
\??\c:\bbhth.exec:\bbhth.exe73⤵PID:1972
-
\??\c:\dhvrvp.exec:\dhvrvp.exe74⤵PID:1636
-
\??\c:\ttfrvb.exec:\ttfrvb.exe75⤵PID:2496
-
\??\c:\njnnvnd.exec:\njnnvnd.exe76⤵PID:1596
-
\??\c:\xrfvt.exec:\xrfvt.exe77⤵PID:1408
-
\??\c:\fjrlnbj.exec:\fjrlnbj.exe78⤵PID:2268
-
\??\c:\pnpxx.exec:\pnpxx.exe79⤵PID:2740
-
\??\c:\pljxndh.exec:\pljxndh.exe80⤵PID:2476
-
\??\c:\vhjnh.exec:\vhjnh.exe81⤵PID:2748
-
\??\c:\xrfrl.exec:\xrfrl.exe82⤵PID:2828
-
\??\c:\fpdjdpv.exec:\fpdjdpv.exe83⤵PID:2752
-
\??\c:\txrdjbp.exec:\txrdjbp.exe84⤵PID:2876
-
\??\c:\bvrlrxb.exec:\bvrlrxb.exe85⤵PID:2332
-
\??\c:\ldhvv.exec:\ldhvv.exe86⤵PID:2764
-
\??\c:\bvdfn.exec:\bvdfn.exe87⤵PID:2656
-
\??\c:\rndtjtx.exec:\rndtjtx.exe88⤵PID:2256
-
\??\c:\frxxb.exec:\frxxb.exe89⤵PID:1928
-
\??\c:\btbnn.exec:\btbnn.exe90⤵PID:2580
-
\??\c:\vbdxh.exec:\vbdxh.exe91⤵PID:3000
-
\??\c:\bpvxnrl.exec:\bpvxnrl.exe92⤵PID:2992
-
\??\c:\drhbpx.exec:\drhbpx.exe93⤵PID:568
-
\??\c:\dxdlb.exec:\dxdlb.exe94⤵PID:2940
-
\??\c:\lhntxtf.exec:\lhntxtf.exe95⤵PID:2976
-
\??\c:\dfrfpdh.exec:\dfrfpdh.exe96⤵PID:1124
-
\??\c:\pvdlfx.exec:\pvdlfx.exe97⤵PID:828
-
\??\c:\bfhbrnv.exec:\bfhbrnv.exe98⤵PID:2280
-
\??\c:\bbjfp.exec:\bbjfp.exe99⤵PID:2224
-
\??\c:\nrjtxhb.exec:\nrjtxhb.exe100⤵PID:2200
-
\??\c:\vhxfrb.exec:\vhxfrb.exe101⤵PID:2304
-
\??\c:\dfhbj.exec:\dfhbj.exe102⤵PID:3056
-
\??\c:\rvbbx.exec:\rvbbx.exe103⤵PID:1248
-
\??\c:\hldnvn.exec:\hldnvn.exe104⤵PID:1796
-
\??\c:\lxnjbrp.exec:\lxnjbrp.exe105⤵PID:1168
-
\??\c:\hxtnp.exec:\hxtnp.exe106⤵PID:776
-
\??\c:\btxrnhx.exec:\btxrnhx.exe107⤵PID:2040
-
\??\c:\xplnt.exec:\xplnt.exe108⤵PID:452
-
\??\c:\phjdnjv.exec:\phjdnjv.exe109⤵PID:2004
-
\??\c:\tvpvnr.exec:\tvpvnr.exe110⤵PID:1904
-
\??\c:\lrrhhb.exec:\lrrhhb.exe111⤵PID:1548
-
\??\c:\hrnpx.exec:\hrnpx.exe112⤵PID:2480
-
\??\c:\tvhxtbh.exec:\tvhxtbh.exe113⤵PID:1324
-
\??\c:\pldvhn.exec:\pldvhn.exe114⤵PID:572
-
\??\c:\fprrbv.exec:\fprrbv.exe115⤵PID:2148
-
\??\c:\bxnprhf.exec:\bxnprhf.exe116⤵PID:1740
-
\??\c:\nfpxff.exec:\nfpxff.exe117⤵PID:2412
-
\??\c:\vdhnn.exec:\vdhnn.exe118⤵PID:2524
-
\??\c:\tjhjlf.exec:\tjhjlf.exe119⤵PID:876
-
\??\c:\thlxbjv.exec:\thlxbjv.exe120⤵PID:1104
-
\??\c:\nndrjhn.exec:\nndrjhn.exe121⤵PID:1560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-