Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 23:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
64870b7daea9873cdb8281a650af11fff44adcde6a9864ec0f505b03e7f39baf.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
64870b7daea9873cdb8281a650af11fff44adcde6a9864ec0f505b03e7f39baf.exe
-
Size
456KB
-
MD5
99d046cbd785d917471eb8f6f1f4e18c
-
SHA1
22e2d8872ce3d5192ac673567a5f891a8f96ea2c
-
SHA256
64870b7daea9873cdb8281a650af11fff44adcde6a9864ec0f505b03e7f39baf
-
SHA512
ef83ba875ff938845990d996ea98960d7d403231c81a3b465040489af5ed47836c1e71f7edfb376b09ad05cd6641c03094a5f659f549e062112bcd1e1bb7268b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRy:q7Tc2NYHUrAwfMp3CDRy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2404-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-115-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1524-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-62-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2708-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-230-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1316-296-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2772-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-336-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2748-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/856-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/856-528-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2028-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-581-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2848-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-628-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2752-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-663-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2608-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-685-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-692-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-753-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1700-779-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/936-799-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2840 lvdxr.exe 2736 fpvjlhh.exe 2808 dllvdh.exe 2868 jjhxllb.exe 2708 tbblbpn.exe 2184 tflpjjb.exe 1036 nfdvtln.exe 2324 rpfbv.exe 1524 lfhpfv.exe 1728 xhxdt.exe 3024 ddjfhxj.exe 980 bprplhx.exe 2704 ljpjb.exe 3036 dxjfrx.exe 2404 pxnjntx.exe 2136 trrhn.exe 520 jxdxr.exe 2084 ndftrrn.exe 1924 rhhbx.exe 2348 prblnv.exe 2500 jxxhb.exe 956 jdhfnx.exe 2076 bpxdfjd.exe 1908 vhvxln.exe 856 rjnhjhp.exe 1292 fthrbb.exe 1764 vhdrtnt.exe 328 vfrdr.exe 2312 ffpbxll.exe 2300 jtxtx.exe 1996 jxvrprx.exe 1316 fvbjjl.exe 740 jdfdhvp.exe 2772 vndpvp.exe 1688 rppbjtl.exe 2180 vtjtvlj.exe 2840 hjntjn.exe 2748 tlbrntv.exe 2904 htpjhjl.exe 2648 nnflnnd.exe 2760 hxnxnvj.exe 2712 hfdxhp.exe 2620 fhbldb.exe 2184 tlbhxhd.exe 2176 dbnrbn.exe 2224 xrrfp.exe 2324 nptbxbl.exe 2380 tpjnh.exe 3008 rnvxp.exe 1572 bdhjdn.exe 1272 tdhhl.exe 980 rrnxr.exe 2964 fjvfp.exe 1948 lhfbvt.exe 1940 nrrnrd.exe 1668 fhndjf.exe 2136 tdjtp.exe 764 hxrrbv.exe 2512 hrpvrhn.exe 2072 dthrf.exe 1692 rfhvt.exe 1960 ljrhf.exe 388 vptdbb.exe 1544 vtrhrvn.exe -
resource yara_rule behavioral1/memory/2404-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-225-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2772-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-753-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/936-799-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpplr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnxxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jblfxfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjhxllb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjxfdfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhrdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdhnfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tppht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhprnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhfhvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnxhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtjnjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djlxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrjfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrrdrfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvltbpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdxfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjjxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjfrdtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvxlvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnrjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnjtbrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjlnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfhhpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpvtlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phntfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fprvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pptfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnhfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxfhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltbblpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpvdlxn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2492 wrote to memory of 2840 2492 64870b7daea9873cdb8281a650af11fff44adcde6a9864ec0f505b03e7f39baf.exe 30 PID 2492 wrote to memory of 2840 2492 64870b7daea9873cdb8281a650af11fff44adcde6a9864ec0f505b03e7f39baf.exe 30 PID 2492 wrote to memory of 2840 2492 64870b7daea9873cdb8281a650af11fff44adcde6a9864ec0f505b03e7f39baf.exe 30 PID 2492 wrote to memory of 2840 2492 64870b7daea9873cdb8281a650af11fff44adcde6a9864ec0f505b03e7f39baf.exe 30 PID 2840 wrote to memory of 2736 2840 lvdxr.exe 31 PID 2840 wrote to memory of 2736 2840 lvdxr.exe 31 PID 2840 wrote to memory of 2736 2840 lvdxr.exe 31 PID 2840 wrote to memory of 2736 2840 lvdxr.exe 31 PID 2736 wrote to memory of 2808 2736 fpvjlhh.exe 32 PID 2736 wrote to memory of 2808 2736 fpvjlhh.exe 32 PID 2736 wrote to memory of 2808 2736 fpvjlhh.exe 32 PID 2736 wrote to memory of 2808 2736 fpvjlhh.exe 32 PID 2808 wrote to memory of 2868 2808 dllvdh.exe 33 PID 2808 wrote to memory of 2868 2808 dllvdh.exe 33 PID 2808 wrote to memory of 2868 2808 dllvdh.exe 33 PID 2808 wrote to memory of 2868 2808 dllvdh.exe 33 PID 2868 wrote to memory of 2708 2868 jjhxllb.exe 34 PID 2868 wrote to memory of 2708 2868 jjhxllb.exe 34 PID 2868 wrote to memory of 2708 2868 jjhxllb.exe 34 PID 2868 wrote to memory of 2708 2868 jjhxllb.exe 34 PID 2708 wrote to memory of 2184 2708 tbblbpn.exe 35 PID 2708 wrote to memory of 2184 2708 tbblbpn.exe 35 PID 2708 wrote to memory of 2184 2708 tbblbpn.exe 35 PID 2708 wrote to memory of 2184 2708 tbblbpn.exe 35 PID 2184 wrote to memory of 1036 2184 tflpjjb.exe 36 PID 2184 wrote to memory of 1036 2184 tflpjjb.exe 36 PID 2184 wrote to memory of 1036 2184 tflpjjb.exe 36 PID 2184 wrote to memory of 1036 2184 tflpjjb.exe 36 PID 1036 wrote to memory of 2324 1036 nfdvtln.exe 37 PID 1036 wrote to memory of 2324 1036 nfdvtln.exe 37 PID 1036 wrote to memory of 2324 1036 nfdvtln.exe 37 PID 1036 wrote to memory of 2324 1036 nfdvtln.exe 37 PID 2324 wrote to memory of 1524 2324 rpfbv.exe 38 PID 2324 wrote to memory of 1524 2324 rpfbv.exe 38 PID 2324 wrote to memory of 1524 2324 rpfbv.exe 38 PID 2324 wrote to memory of 1524 2324 rpfbv.exe 38 PID 1524 wrote to memory of 1728 1524 lfhpfv.exe 39 PID 1524 wrote to memory of 1728 1524 lfhpfv.exe 39 PID 1524 wrote to memory of 1728 1524 lfhpfv.exe 39 PID 1524 wrote to memory of 1728 1524 lfhpfv.exe 39 PID 1728 wrote to memory of 3024 1728 xhxdt.exe 40 PID 1728 wrote to memory of 3024 1728 xhxdt.exe 40 PID 1728 wrote to memory of 3024 1728 xhxdt.exe 40 PID 1728 wrote to memory of 3024 1728 xhxdt.exe 40 PID 3024 wrote to memory of 980 3024 ddjfhxj.exe 41 PID 3024 wrote to memory of 980 3024 ddjfhxj.exe 41 PID 3024 wrote to memory of 980 3024 ddjfhxj.exe 41 PID 3024 wrote to memory of 980 3024 ddjfhxj.exe 41 PID 980 wrote to memory of 2704 980 bprplhx.exe 42 PID 980 wrote to memory of 2704 980 bprplhx.exe 42 PID 980 wrote to memory of 2704 980 bprplhx.exe 42 PID 980 wrote to memory of 2704 980 bprplhx.exe 42 PID 2704 wrote to memory of 3036 2704 ljpjb.exe 43 PID 2704 wrote to memory of 3036 2704 ljpjb.exe 43 PID 2704 wrote to memory of 3036 2704 ljpjb.exe 43 PID 2704 wrote to memory of 3036 2704 ljpjb.exe 43 PID 3036 wrote to memory of 2404 3036 dxjfrx.exe 44 PID 3036 wrote to memory of 2404 3036 dxjfrx.exe 44 PID 3036 wrote to memory of 2404 3036 dxjfrx.exe 44 PID 3036 wrote to memory of 2404 3036 dxjfrx.exe 44 PID 2404 wrote to memory of 2136 2404 pxnjntx.exe 45 PID 2404 wrote to memory of 2136 2404 pxnjntx.exe 45 PID 2404 wrote to memory of 2136 2404 pxnjntx.exe 45 PID 2404 wrote to memory of 2136 2404 pxnjntx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\64870b7daea9873cdb8281a650af11fff44adcde6a9864ec0f505b03e7f39baf.exe"C:\Users\Admin\AppData\Local\Temp\64870b7daea9873cdb8281a650af11fff44adcde6a9864ec0f505b03e7f39baf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\lvdxr.exec:\lvdxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\fpvjlhh.exec:\fpvjlhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\dllvdh.exec:\dllvdh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\jjhxllb.exec:\jjhxllb.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\tbblbpn.exec:\tbblbpn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\tflpjjb.exec:\tflpjjb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\nfdvtln.exec:\nfdvtln.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\rpfbv.exec:\rpfbv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\lfhpfv.exec:\lfhpfv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\xhxdt.exec:\xhxdt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\ddjfhxj.exec:\ddjfhxj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\bprplhx.exec:\bprplhx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\ljpjb.exec:\ljpjb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\dxjfrx.exec:\dxjfrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\pxnjntx.exec:\pxnjntx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\trrhn.exec:\trrhn.exe17⤵
- Executes dropped EXE
PID:2136 -
\??\c:\jxdxr.exec:\jxdxr.exe18⤵
- Executes dropped EXE
PID:520 -
\??\c:\ndftrrn.exec:\ndftrrn.exe19⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rhhbx.exec:\rhhbx.exe20⤵
- Executes dropped EXE
PID:1924 -
\??\c:\prblnv.exec:\prblnv.exe21⤵
- Executes dropped EXE
PID:2348 -
\??\c:\jxxhb.exec:\jxxhb.exe22⤵
- Executes dropped EXE
PID:2500 -
\??\c:\jdhfnx.exec:\jdhfnx.exe23⤵
- Executes dropped EXE
PID:956 -
\??\c:\bpxdfjd.exec:\bpxdfjd.exe24⤵
- Executes dropped EXE
PID:2076 -
\??\c:\vhvxln.exec:\vhvxln.exe25⤵
- Executes dropped EXE
PID:1908 -
\??\c:\rjnhjhp.exec:\rjnhjhp.exe26⤵
- Executes dropped EXE
PID:856 -
\??\c:\fthrbb.exec:\fthrbb.exe27⤵
- Executes dropped EXE
PID:1292 -
\??\c:\vhdrtnt.exec:\vhdrtnt.exe28⤵
- Executes dropped EXE
PID:1764 -
\??\c:\vfrdr.exec:\vfrdr.exe29⤵
- Executes dropped EXE
PID:328 -
\??\c:\ffpbxll.exec:\ffpbxll.exe30⤵
- Executes dropped EXE
PID:2312 -
\??\c:\jtxtx.exec:\jtxtx.exe31⤵
- Executes dropped EXE
PID:2300 -
\??\c:\jxvrprx.exec:\jxvrprx.exe32⤵
- Executes dropped EXE
PID:1996 -
\??\c:\fvbjjl.exec:\fvbjjl.exe33⤵
- Executes dropped EXE
PID:1316 -
\??\c:\jdfdhvp.exec:\jdfdhvp.exe34⤵
- Executes dropped EXE
PID:740 -
\??\c:\vndpvp.exec:\vndpvp.exe35⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rppbjtl.exec:\rppbjtl.exe36⤵
- Executes dropped EXE
PID:1688 -
\??\c:\vtjtvlj.exec:\vtjtvlj.exe37⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hjntjn.exec:\hjntjn.exe38⤵
- Executes dropped EXE
PID:2840 -
\??\c:\tlbrntv.exec:\tlbrntv.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\htpjhjl.exec:\htpjhjl.exe40⤵
- Executes dropped EXE
PID:2904 -
\??\c:\nnflnnd.exec:\nnflnnd.exe41⤵
- Executes dropped EXE
PID:2648 -
\??\c:\hxnxnvj.exec:\hxnxnvj.exe42⤵
- Executes dropped EXE
PID:2760 -
\??\c:\hfdxhp.exec:\hfdxhp.exe43⤵
- Executes dropped EXE
PID:2712 -
\??\c:\fhbldb.exec:\fhbldb.exe44⤵
- Executes dropped EXE
PID:2620 -
\??\c:\tlbhxhd.exec:\tlbhxhd.exe45⤵
- Executes dropped EXE
PID:2184 -
\??\c:\dbnrbn.exec:\dbnrbn.exe46⤵
- Executes dropped EXE
PID:2176 -
\??\c:\xrrfp.exec:\xrrfp.exe47⤵
- Executes dropped EXE
PID:2224 -
\??\c:\nptbxbl.exec:\nptbxbl.exe48⤵
- Executes dropped EXE
PID:2324 -
\??\c:\tpjnh.exec:\tpjnh.exe49⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rnvxp.exec:\rnvxp.exe50⤵
- Executes dropped EXE
PID:3008 -
\??\c:\bdhjdn.exec:\bdhjdn.exe51⤵
- Executes dropped EXE
PID:1572 -
\??\c:\tdhhl.exec:\tdhhl.exe52⤵
- Executes dropped EXE
PID:1272 -
\??\c:\rrnxr.exec:\rrnxr.exe53⤵
- Executes dropped EXE
PID:980 -
\??\c:\fjvfp.exec:\fjvfp.exe54⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lhfbvt.exec:\lhfbvt.exe55⤵
- Executes dropped EXE
PID:1948 -
\??\c:\nrrnrd.exec:\nrrnrd.exe56⤵
- Executes dropped EXE
PID:1940 -
\??\c:\fhndjf.exec:\fhndjf.exe57⤵
- Executes dropped EXE
PID:1668 -
\??\c:\tdjtp.exec:\tdjtp.exe58⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hxrrbv.exec:\hxrrbv.exe59⤵
- Executes dropped EXE
PID:764 -
\??\c:\hrpvrhn.exec:\hrpvrhn.exe60⤵
- Executes dropped EXE
PID:2512 -
\??\c:\dthrf.exec:\dthrf.exe61⤵
- Executes dropped EXE
PID:2072 -
\??\c:\rfhvt.exec:\rfhvt.exe62⤵
- Executes dropped EXE
PID:1692 -
\??\c:\ljrhf.exec:\ljrhf.exe63⤵
- Executes dropped EXE
PID:1960 -
\??\c:\vptdbb.exec:\vptdbb.exe64⤵
- Executes dropped EXE
PID:388 -
\??\c:\vtrhrvn.exec:\vtrhrvn.exe65⤵
- Executes dropped EXE
PID:1544 -
\??\c:\rjbvdpf.exec:\rjbvdpf.exe66⤵PID:952
-
\??\c:\vxrbn.exec:\vxrbn.exe67⤵PID:1724
-
\??\c:\ljvbb.exec:\ljvbb.exe68⤵PID:856
-
\??\c:\rhtjrt.exec:\rhtjrt.exe69⤵PID:2028
-
\??\c:\rdjftx.exec:\rdjftx.exe70⤵PID:1040
-
\??\c:\htdvjbr.exec:\htdvjbr.exe71⤵PID:2320
-
\??\c:\hjrlhp.exec:\hjrlhp.exe72⤵PID:1704
-
\??\c:\hjrrnh.exec:\hjrrnh.exe73⤵PID:2312
-
\??\c:\frrbrpf.exec:\frrbrpf.exe74⤵PID:2032
-
\??\c:\jdnfj.exec:\jdnfj.exe75⤵PID:1256
-
\??\c:\bvfdp.exec:\bvfdp.exe76⤵PID:1032
-
\??\c:\fxlbnr.exec:\fxlbnr.exe77⤵PID:924
-
\??\c:\hhnlr.exec:\hhnlr.exe78⤵PID:2492
-
\??\c:\jvjvfd.exec:\jvjvfd.exe79⤵PID:1688
-
\??\c:\jjrptjl.exec:\jjrptjl.exe80⤵PID:2848
-
\??\c:\tpjnbh.exec:\tpjnbh.exe81⤵PID:2764
-
\??\c:\hxtxbfp.exec:\hxtxbfp.exe82⤵PID:2672
-
\??\c:\prxrfd.exec:\prxrfd.exe83⤵PID:3044
-
\??\c:\tvltbpr.exec:\tvltbpr.exe84⤵
- System Location Discovery: System Language Discovery
PID:2752 -
\??\c:\dfhljt.exec:\dfhljt.exe85⤵PID:2688
-
\??\c:\nrhjfhv.exec:\nrhjfhv.exe86⤵PID:2712
-
\??\c:\brrbvb.exec:\brrbvb.exe87⤵PID:336
-
\??\c:\bxftp.exec:\bxftp.exe88⤵PID:1036
-
\??\c:\xhjxvnx.exec:\xhjxvnx.exe89⤵PID:2608
-
\??\c:\pjplp.exec:\pjplp.exe90⤵PID:2224
-
\??\c:\ddxvj.exec:\ddxvj.exe91⤵PID:760
-
\??\c:\vpbrv.exec:\vpbrv.exe92⤵PID:1476
-
\??\c:\rjfvhv.exec:\rjfvhv.exe93⤵PID:1492
-
\??\c:\fbbhll.exec:\fbbhll.exe94⤵PID:1260
-
\??\c:\jtvrtv.exec:\jtvrtv.exe95⤵PID:2880
-
\??\c:\hvrvjjx.exec:\hvrvjjx.exe96⤵PID:1460
-
\??\c:\lhvpnfb.exec:\lhvpnfb.exe97⤵PID:2052
-
\??\c:\nttvl.exec:\nttvl.exe98⤵PID:2000
-
\??\c:\ttxdthl.exec:\ttxdthl.exe99⤵PID:364
-
\??\c:\xntxnb.exec:\xntxnb.exe100⤵PID:2432
-
\??\c:\lbbpv.exec:\lbbpv.exe101⤵PID:2152
-
\??\c:\jxdhf.exec:\jxdhf.exe102⤵PID:2372
-
\??\c:\rhfhnnt.exec:\rhfhnnt.exe103⤵PID:2392
-
\??\c:\jrjpvjr.exec:\jrjpvjr.exe104⤵PID:1700
-
\??\c:\jvphvrl.exec:\jvphvrl.exe105⤵PID:676
-
\??\c:\lrxjf.exec:\lrxjf.exe106⤵PID:932
-
\??\c:\xpdlb.exec:\xpdlb.exe107⤵PID:880
-
\??\c:\vjpnjpn.exec:\vjpnjpn.exe108⤵PID:936
-
\??\c:\rjfjv.exec:\rjfjv.exe109⤵PID:580
-
\??\c:\hbvhpph.exec:\hbvhpph.exe110⤵PID:1336
-
\??\c:\rvlxp.exec:\rvlxp.exe111⤵PID:1812
-
\??\c:\dxlhjf.exec:\dxlhjf.exe112⤵PID:788
-
\??\c:\bpthbnl.exec:\bpthbnl.exe113⤵PID:928
-
\??\c:\npbffrn.exec:\npbffrn.exe114⤵PID:1784
-
\??\c:\dppdbr.exec:\dppdbr.exe115⤵PID:684
-
\??\c:\vdvdrp.exec:\vdvdrp.exe116⤵PID:2312
-
\??\c:\bxjtbl.exec:\bxjtbl.exe117⤵PID:1504
-
\??\c:\ndlxjhx.exec:\ndlxjhx.exe118⤵PID:2728
-
\??\c:\dptlhxp.exec:\dptlhxp.exe119⤵PID:992
-
\??\c:\jttlj.exec:\jttlj.exe120⤵PID:2776
-
\??\c:\lbbfpv.exec:\lbbfpv.exe121⤵PID:1684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-