Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 02:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b69cffe40f5266f9f9c7eee5dffe4b30e9367c9fe3d7ed3a19b2c71da3b1a978.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
b69cffe40f5266f9f9c7eee5dffe4b30e9367c9fe3d7ed3a19b2c71da3b1a978.exe
-
Size
454KB
-
MD5
2e5564f5267c2f9019004db22a3b1e1d
-
SHA1
b83f468e0f7c020e22b15747c9b3cf1cf866e30c
-
SHA256
b69cffe40f5266f9f9c7eee5dffe4b30e9367c9fe3d7ed3a19b2c71da3b1a978
-
SHA512
b7b458abfb69495496f2b249ef818e280663eeb1b40d7249cf56beae14da879a87eb0e42609e4633977d9b97abb2ca1999f0d292dd27d968adcd3dd838c9cbed
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeS:q7Tc2NYHUrAwfMp3CDS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2744-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-71-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3052-67-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/692-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-112-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/3020-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-141-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2468-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1168-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-351-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3060-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-398-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2428-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-445-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1532-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-623-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-630-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1340-695-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1756-822-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2744 rtftjd.exe 2540 fnbvdtf.exe 2932 xlvnpxx.exe 2120 fjjxxfp.exe 2960 hrtthhf.exe 3052 vbvljfd.exe 2728 xtvpjlt.exe 692 btbbjvj.exe 1808 tdvhd.exe 2448 nvrfvn.exe 1164 blvbt.exe 3020 xrdhvt.exe 2952 hhhhp.exe 2468 nbnhv.exe 2992 dxjnrb.exe 2444 nrfxf.exe 1212 ntxhbb.exe 2168 dpnvd.exe 2088 lfvrv.exe 2200 tjjrb.exe 2632 pxdvr.exe 1084 xhdnxp.exe 1368 tpvprvt.exe 2564 rvxvt.exe 864 jtpbrf.exe 1688 nhpld.exe 1748 jvbrxhj.exe 1868 jnfdl.exe 1736 xhbffpx.exe 1168 rxthfbp.exe 332 hvpppfr.exe 2608 bpxnh.exe 1996 ljrjxfd.exe 2756 vhjlbn.exe 1596 djdtnn.exe 2892 dhfnbhd.exe 2540 bvxtftf.exe 2864 lrldtd.exe 2848 tbvnhbt.exe 3060 rbnlft.exe 2664 hxbrrd.exe 2696 lfflvh.exe 1504 rlnxf.exe 2296 vnxtjvb.exe 1628 hjhjbnd.exe 2428 bhjxt.exe 2420 xvlfx.exe 3056 xhjdbfx.exe 1472 rlljlp.exe 3020 nxxppt.exe 2972 fvtpb.exe 3032 fthnvn.exe 2468 fxlfj.exe 2192 nnhfb.exe 2276 djvbn.exe 1988 jrjvlt.exe 1212 rtlpf.exe 2236 pfbnr.exe 2152 hvlttrt.exe 1872 hdpfrbt.exe 2548 brdftvn.exe 1532 rdtrht.exe 1796 xjxvj.exe 1056 tdptvff.exe -
resource yara_rule behavioral1/memory/2744-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-83-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/692-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1168-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-452-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1532-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-630-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2884-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-695-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1528-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-755-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1756-796-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrhxtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhhjdbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rthbrnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txjbnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fntnhjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfhhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpvnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpbbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phjfxfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlnjjtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jljlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdftp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldtfpdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvdlrxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrxdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxbfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpndxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvhfjbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvftlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfjtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxxppt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrdxtrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvhlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlvtrrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fndtnvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrthlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdnxpdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnbpbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvvblt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrbfbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlfbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnjrpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1996 wrote to memory of 2744 1996 b69cffe40f5266f9f9c7eee5dffe4b30e9367c9fe3d7ed3a19b2c71da3b1a978.exe 29 PID 1996 wrote to memory of 2744 1996 b69cffe40f5266f9f9c7eee5dffe4b30e9367c9fe3d7ed3a19b2c71da3b1a978.exe 29 PID 1996 wrote to memory of 2744 1996 b69cffe40f5266f9f9c7eee5dffe4b30e9367c9fe3d7ed3a19b2c71da3b1a978.exe 29 PID 1996 wrote to memory of 2744 1996 b69cffe40f5266f9f9c7eee5dffe4b30e9367c9fe3d7ed3a19b2c71da3b1a978.exe 29 PID 2744 wrote to memory of 2540 2744 rtftjd.exe 30 PID 2744 wrote to memory of 2540 2744 rtftjd.exe 30 PID 2744 wrote to memory of 2540 2744 rtftjd.exe 30 PID 2744 wrote to memory of 2540 2744 rtftjd.exe 30 PID 2540 wrote to memory of 2932 2540 fnbvdtf.exe 31 PID 2540 wrote to memory of 2932 2540 fnbvdtf.exe 31 PID 2540 wrote to memory of 2932 2540 fnbvdtf.exe 31 PID 2540 wrote to memory of 2932 2540 fnbvdtf.exe 31 PID 2932 wrote to memory of 2120 2932 xlvnpxx.exe 32 PID 2932 wrote to memory of 2120 2932 xlvnpxx.exe 32 PID 2932 wrote to memory of 2120 2932 xlvnpxx.exe 32 PID 2932 wrote to memory of 2120 2932 xlvnpxx.exe 32 PID 2120 wrote to memory of 2960 2120 fjjxxfp.exe 33 PID 2120 wrote to memory of 2960 2120 fjjxxfp.exe 33 PID 2120 wrote to memory of 2960 2120 fjjxxfp.exe 33 PID 2120 wrote to memory of 2960 2120 fjjxxfp.exe 33 PID 2960 wrote to memory of 3052 2960 hrtthhf.exe 34 PID 2960 wrote to memory of 3052 2960 hrtthhf.exe 34 PID 2960 wrote to memory of 3052 2960 hrtthhf.exe 34 PID 2960 wrote to memory of 3052 2960 hrtthhf.exe 34 PID 3052 wrote to memory of 2728 3052 vbvljfd.exe 35 PID 3052 wrote to memory of 2728 3052 vbvljfd.exe 35 PID 3052 wrote to memory of 2728 3052 vbvljfd.exe 35 PID 3052 wrote to memory of 2728 3052 vbvljfd.exe 35 PID 2728 wrote to memory of 692 2728 xtvpjlt.exe 36 PID 2728 wrote to memory of 692 2728 xtvpjlt.exe 36 PID 2728 wrote to memory of 692 2728 xtvpjlt.exe 36 PID 2728 wrote to memory of 692 2728 xtvpjlt.exe 36 PID 692 wrote to memory of 1808 692 btbbjvj.exe 37 PID 692 wrote to memory of 1808 692 btbbjvj.exe 37 PID 692 wrote to memory of 1808 692 btbbjvj.exe 37 PID 692 wrote to memory of 1808 692 btbbjvj.exe 37 PID 1808 wrote to memory of 2448 1808 tdvhd.exe 38 PID 1808 wrote to memory of 2448 1808 tdvhd.exe 38 PID 1808 wrote to memory of 2448 1808 tdvhd.exe 38 PID 1808 wrote to memory of 2448 1808 tdvhd.exe 38 PID 2448 wrote to memory of 1164 2448 nvrfvn.exe 39 PID 2448 wrote to memory of 1164 2448 nvrfvn.exe 39 PID 2448 wrote to memory of 1164 2448 nvrfvn.exe 39 PID 2448 wrote to memory of 1164 2448 nvrfvn.exe 39 PID 1164 wrote to memory of 3020 1164 blvbt.exe 40 PID 1164 wrote to memory of 3020 1164 blvbt.exe 40 PID 1164 wrote to memory of 3020 1164 blvbt.exe 40 PID 1164 wrote to memory of 3020 1164 blvbt.exe 40 PID 3020 wrote to memory of 2952 3020 xrdhvt.exe 41 PID 3020 wrote to memory of 2952 3020 xrdhvt.exe 41 PID 3020 wrote to memory of 2952 3020 xrdhvt.exe 41 PID 3020 wrote to memory of 2952 3020 xrdhvt.exe 41 PID 2952 wrote to memory of 2468 2952 hhhhp.exe 42 PID 2952 wrote to memory of 2468 2952 hhhhp.exe 42 PID 2952 wrote to memory of 2468 2952 hhhhp.exe 42 PID 2952 wrote to memory of 2468 2952 hhhhp.exe 42 PID 2468 wrote to memory of 2992 2468 nbnhv.exe 43 PID 2468 wrote to memory of 2992 2468 nbnhv.exe 43 PID 2468 wrote to memory of 2992 2468 nbnhv.exe 43 PID 2468 wrote to memory of 2992 2468 nbnhv.exe 43 PID 2992 wrote to memory of 2444 2992 dxjnrb.exe 44 PID 2992 wrote to memory of 2444 2992 dxjnrb.exe 44 PID 2992 wrote to memory of 2444 2992 dxjnrb.exe 44 PID 2992 wrote to memory of 2444 2992 dxjnrb.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\b69cffe40f5266f9f9c7eee5dffe4b30e9367c9fe3d7ed3a19b2c71da3b1a978.exe"C:\Users\Admin\AppData\Local\Temp\b69cffe40f5266f9f9c7eee5dffe4b30e9367c9fe3d7ed3a19b2c71da3b1a978.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\rtftjd.exec:\rtftjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\fnbvdtf.exec:\fnbvdtf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\xlvnpxx.exec:\xlvnpxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\fjjxxfp.exec:\fjjxxfp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\hrtthhf.exec:\hrtthhf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\vbvljfd.exec:\vbvljfd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\xtvpjlt.exec:\xtvpjlt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\btbbjvj.exec:\btbbjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\tdvhd.exec:\tdvhd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\nvrfvn.exec:\nvrfvn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\blvbt.exec:\blvbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\xrdhvt.exec:\xrdhvt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\hhhhp.exec:\hhhhp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\nbnhv.exec:\nbnhv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\dxjnrb.exec:\dxjnrb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\nrfxf.exec:\nrfxf.exe17⤵
- Executes dropped EXE
PID:2444 -
\??\c:\ntxhbb.exec:\ntxhbb.exe18⤵
- Executes dropped EXE
PID:1212 -
\??\c:\dpnvd.exec:\dpnvd.exe19⤵
- Executes dropped EXE
PID:2168 -
\??\c:\lfvrv.exec:\lfvrv.exe20⤵
- Executes dropped EXE
PID:2088 -
\??\c:\tjjrb.exec:\tjjrb.exe21⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pxdvr.exec:\pxdvr.exe22⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xhdnxp.exec:\xhdnxp.exe23⤵
- Executes dropped EXE
PID:1084 -
\??\c:\tpvprvt.exec:\tpvprvt.exe24⤵
- Executes dropped EXE
PID:1368 -
\??\c:\rvxvt.exec:\rvxvt.exe25⤵
- Executes dropped EXE
PID:2564 -
\??\c:\jtpbrf.exec:\jtpbrf.exe26⤵
- Executes dropped EXE
PID:864 -
\??\c:\nhpld.exec:\nhpld.exe27⤵
- Executes dropped EXE
PID:1688 -
\??\c:\jvbrxhj.exec:\jvbrxhj.exe28⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jnfdl.exec:\jnfdl.exe29⤵
- Executes dropped EXE
PID:1868 -
\??\c:\xhbffpx.exec:\xhbffpx.exe30⤵
- Executes dropped EXE
PID:1736 -
\??\c:\rxthfbp.exec:\rxthfbp.exe31⤵
- Executes dropped EXE
PID:1168 -
\??\c:\hvpppfr.exec:\hvpppfr.exe32⤵
- Executes dropped EXE
PID:332 -
\??\c:\bpxnh.exec:\bpxnh.exe33⤵
- Executes dropped EXE
PID:2608 -
\??\c:\ljrjxfd.exec:\ljrjxfd.exe34⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vhjlbn.exec:\vhjlbn.exe35⤵
- Executes dropped EXE
PID:2756 -
\??\c:\djdtnn.exec:\djdtnn.exe36⤵
- Executes dropped EXE
PID:1596 -
\??\c:\dhfnbhd.exec:\dhfnbhd.exe37⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bvxtftf.exec:\bvxtftf.exe38⤵
- Executes dropped EXE
PID:2540 -
\??\c:\lrldtd.exec:\lrldtd.exe39⤵
- Executes dropped EXE
PID:2864 -
\??\c:\tbvnhbt.exec:\tbvnhbt.exe40⤵
- Executes dropped EXE
PID:2848 -
\??\c:\rbnlft.exec:\rbnlft.exe41⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hxbrrd.exec:\hxbrrd.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\lfflvh.exec:\lfflvh.exe43⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rlnxf.exec:\rlnxf.exe44⤵
- Executes dropped EXE
PID:1504 -
\??\c:\vnxtjvb.exec:\vnxtjvb.exe45⤵
- Executes dropped EXE
PID:2296 -
\??\c:\hjhjbnd.exec:\hjhjbnd.exe46⤵
- Executes dropped EXE
PID:1628 -
\??\c:\bhjxt.exec:\bhjxt.exe47⤵
- Executes dropped EXE
PID:2428 -
\??\c:\xvlfx.exec:\xvlfx.exe48⤵
- Executes dropped EXE
PID:2420 -
\??\c:\xhjdbfx.exec:\xhjdbfx.exe49⤵
- Executes dropped EXE
PID:3056 -
\??\c:\rlljlp.exec:\rlljlp.exe50⤵
- Executes dropped EXE
PID:1472 -
\??\c:\nxxppt.exec:\nxxppt.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3020 -
\??\c:\fvtpb.exec:\fvtpb.exe52⤵
- Executes dropped EXE
PID:2972 -
\??\c:\fthnvn.exec:\fthnvn.exe53⤵
- Executes dropped EXE
PID:3032 -
\??\c:\fxlfj.exec:\fxlfj.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2468 -
\??\c:\nnhfb.exec:\nnhfb.exe55⤵
- Executes dropped EXE
PID:2192 -
\??\c:\djvbn.exec:\djvbn.exe56⤵
- Executes dropped EXE
PID:2276 -
\??\c:\jrjvlt.exec:\jrjvlt.exe57⤵
- Executes dropped EXE
PID:1988 -
\??\c:\rtlpf.exec:\rtlpf.exe58⤵
- Executes dropped EXE
PID:1212 -
\??\c:\pfbnr.exec:\pfbnr.exe59⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hvlttrt.exec:\hvlttrt.exe60⤵
- Executes dropped EXE
PID:2152 -
\??\c:\hdpfrbt.exec:\hdpfrbt.exe61⤵
- Executes dropped EXE
PID:1872 -
\??\c:\brdftvn.exec:\brdftvn.exe62⤵
- Executes dropped EXE
PID:2548 -
\??\c:\rdtrht.exec:\rdtrht.exe63⤵
- Executes dropped EXE
PID:1532 -
\??\c:\xjxvj.exec:\xjxvj.exe64⤵
- Executes dropped EXE
PID:1796 -
\??\c:\tdptvff.exec:\tdptvff.exe65⤵
- Executes dropped EXE
PID:1056 -
\??\c:\nvtbvt.exec:\nvtbvt.exe66⤵PID:700
-
\??\c:\dnbbvj.exec:\dnbbvj.exe67⤵PID:1492
-
\??\c:\fnfflb.exec:\fnfflb.exe68⤵PID:2564
-
\??\c:\fdbntp.exec:\fdbntp.exe69⤵PID:2636
-
\??\c:\vbjldtf.exec:\vbjldtf.exe70⤵PID:2916
-
\??\c:\vvfvv.exec:\vvfvv.exe71⤵PID:2000
-
\??\c:\nrthlxx.exec:\nrthlxx.exe72⤵
- System Location Discovery: System Language Discovery
PID:1540 -
\??\c:\pfbxr.exec:\pfbxr.exe73⤵PID:1868
-
\??\c:\hrrlrnt.exec:\hrrlrnt.exe74⤵PID:1652
-
\??\c:\fhnfn.exec:\fhnfn.exe75⤵PID:108
-
\??\c:\bpdrpnr.exec:\bpdrpnr.exe76⤵PID:2404
-
\??\c:\bjtvpdr.exec:\bjtvpdr.exe77⤵PID:696
-
\??\c:\jhbvtnx.exec:\jhbvtnx.exe78⤵PID:2300
-
\??\c:\hnfpbjt.exec:\hnfpbjt.exe79⤵PID:2792
-
\??\c:\bnnrj.exec:\bnnrj.exe80⤵PID:1608
-
\??\c:\vdnxpdl.exec:\vdnxpdl.exe81⤵
- System Location Discovery: System Language Discovery
PID:2808 -
\??\c:\jntpf.exec:\jntpf.exe82⤵PID:2904
-
\??\c:\ttrfr.exec:\ttrfr.exe83⤵PID:2464
-
\??\c:\nfnlj.exec:\nfnlj.exe84⤵PID:2884
-
\??\c:\vrdxtrv.exec:\vrdxtrv.exe85⤵
- System Location Discovery: System Language Discovery
PID:2060 -
\??\c:\pfhnb.exec:\pfhnb.exe86⤵PID:1576
-
\??\c:\xxhfb.exec:\xxhfb.exe87⤵PID:2716
-
\??\c:\ftfbhd.exec:\ftfbhd.exe88⤵PID:2492
-
\??\c:\tdnph.exec:\tdnph.exe89⤵PID:2644
-
\??\c:\pttdvnx.exec:\pttdvnx.exe90⤵PID:1708
-
\??\c:\jrnhvvp.exec:\jrnhvvp.exe91⤵PID:1196
-
\??\c:\txtrlhd.exec:\txtrlhd.exe92⤵PID:1340
-
\??\c:\dxvdbff.exec:\dxvdbff.exe93⤵PID:2448
-
\??\c:\vfjljj.exec:\vfjljj.exe94⤵PID:2248
-
\??\c:\vfffjb.exec:\vfffjb.exe95⤵PID:2032
-
\??\c:\ftdnxlp.exec:\ftdnxlp.exe96⤵PID:2764
-
\??\c:\ddhvnvn.exec:\ddhvnvn.exe97⤵PID:936
-
\??\c:\vbtfhd.exec:\vbtfhd.exe98⤵PID:2952
-
\??\c:\pvbhnnn.exec:\pvbhnnn.exe99⤵PID:2368
-
\??\c:\jhbxdt.exec:\jhbxdt.exe100⤵PID:2544
-
\??\c:\nppnp.exec:\nppnp.exe101⤵PID:1204
-
\??\c:\hhfbj.exec:\hhfbj.exe102⤵PID:1528
-
\??\c:\xxptxh.exec:\xxptxh.exe103⤵PID:2384
-
\??\c:\trxjnx.exec:\trxjnx.exe104⤵PID:2224
-
\??\c:\lnnvp.exec:\lnnvp.exe105⤵PID:676
-
\??\c:\jbrhnpn.exec:\jbrhnpn.exe106⤵PID:1872
-
\??\c:\xrfpb.exec:\xrfpb.exe107⤵PID:2504
-
\??\c:\tnljf.exec:\tnljf.exe108⤵PID:1756
-
\??\c:\fbndr.exec:\fbndr.exe109⤵PID:928
-
\??\c:\pdbnjp.exec:\pdbnjp.exe110⤵PID:1752
-
\??\c:\rthbrnn.exec:\rthbrnn.exe111⤵
- System Location Discovery: System Language Discovery
PID:2040 -
\??\c:\tvlxh.exec:\tvlxh.exe112⤵PID:2432
-
\??\c:\hbnlrp.exec:\hbnlrp.exe113⤵PID:1764
-
\??\c:\dptvp.exec:\dptvp.exe114⤵PID:2636
-
\??\c:\jljfvb.exec:\jljfvb.exe115⤵PID:2916
-
\??\c:\lnxrdh.exec:\lnxrdh.exe116⤵PID:1728
-
\??\c:\rrnnr.exec:\rrnnr.exe117⤵PID:2240
-
\??\c:\nfxvfrr.exec:\nfxvfrr.exe118⤵PID:2436
-
\??\c:\rhpnv.exec:\rhpnv.exe119⤵PID:1108
-
\??\c:\rljlbpn.exec:\rljlbpn.exe120⤵PID:2488
-
\??\c:\dnjxjj.exec:\dnjxjj.exe121⤵PID:2576
-
\??\c:\xbxljh.exec:\xbxljh.exe122⤵PID:696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-