Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 19:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
066654143a6cfce0b064d32e47a9f731384c15eb562c581b5db4c07d26907fd9.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
066654143a6cfce0b064d32e47a9f731384c15eb562c581b5db4c07d26907fd9.exe
-
Size
454KB
-
MD5
f2e6db9fc4283e9353312ec59723ffe6
-
SHA1
0289e9674d8981ed4e983bf1e266d1a4d6023a62
-
SHA256
066654143a6cfce0b064d32e47a9f731384c15eb562c581b5db4c07d26907fd9
-
SHA512
1778e4b0286edd2f38129bf8b7d0849b544c152b38ee8418f1dd1811580c711fc831e59f38db48a46ad6c87cdafa438612be8218043f1846e734f78e30fa0e78
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeI:q7Tc2NYHUrAwfMp3CDI
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2124-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1472-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/296-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-299-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1588-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-329-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2832-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1068-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-441-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1124-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-465-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2524-480-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2488-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-585-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2412-675-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2516-683-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1084-815-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/800-836-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2932 jdlhnb.exe 2276 xvvvrvv.exe 2992 brvxlp.exe 2940 lvjhl.exe 2900 jtxlt.exe 864 vhhpr.exe 2356 nnfjtl.exe 2504 fddvxnv.exe 2720 brtpfr.exe 1624 lrfvpxf.exe 1756 xnxhfr.exe 3060 xlnvvd.exe 1472 tptnj.exe 3004 jfrfj.exe 1900 dnrhvrv.exe 1332 dnfhph.exe 296 xhnnl.exe 1828 fxvpnd.exe 2292 lhddbf.exe 2200 pdrjh.exe 2500 rbjrxb.exe 2192 fhfld.exe 960 jjlpvnh.exe 2640 fxxlv.exe 692 tdxtj.exe 1804 dhvhrjv.exe 392 hrnhrbl.exe 236 hrthd.exe 1680 jxxbp.exe 2824 rtdfpt.exe 2392 frflp.exe 2128 pjhpxbt.exe 2132 xtxjhvd.exe 1684 bbjfvr.exe 1588 ntdtlnj.exe 2868 ntpxbj.exe 2996 nhxjvv.exe 2832 xfrtb.exe 2940 rvbjnjr.exe 2776 thbjphv.exe 864 fvbvx.exe 2620 htbllbf.exe 2224 xnlbb.exe 2788 xdjtd.exe 1576 bjdvjhn.exe 776 thvvxp.exe 1640 jxnjrjr.exe 1312 dfddl.exe 3008 xjvtpn.exe 1892 bprpxv.exe 1068 bldtrnj.exe 1968 fprnp.exe 2076 tvbbxvd.exe 2092 pffbfp.exe 1124 dlfpln.exe 2280 rxlvbvd.exe 832 bjhnj.exe 2524 txxtdl.exe 2200 xbvrlj.exe 2488 njlfn.exe 1956 rfbphtl.exe 1936 htnhndf.exe 2632 fxhtnh.exe 1452 jdrjnlj.exe -
resource yara_rule behavioral1/memory/2124-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/296-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-299-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1588-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-329-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2832-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1124-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-836-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtrxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrhrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxlbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pffbfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rphnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlvfdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbbhdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhdxbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjhfhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnnljr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbldtfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdnhtvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvbxnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brbfvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thdbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjtrhll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhfdnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blvbjtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlxrpjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnlbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjfdxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvrjbfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnrhvrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppltr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbrltlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbxrfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhdhxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htvlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrddx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdrxld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnfjtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bldtrnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppnjll.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2932 2124 066654143a6cfce0b064d32e47a9f731384c15eb562c581b5db4c07d26907fd9.exe 30 PID 2124 wrote to memory of 2932 2124 066654143a6cfce0b064d32e47a9f731384c15eb562c581b5db4c07d26907fd9.exe 30 PID 2124 wrote to memory of 2932 2124 066654143a6cfce0b064d32e47a9f731384c15eb562c581b5db4c07d26907fd9.exe 30 PID 2124 wrote to memory of 2932 2124 066654143a6cfce0b064d32e47a9f731384c15eb562c581b5db4c07d26907fd9.exe 30 PID 2932 wrote to memory of 2276 2932 jdlhnb.exe 31 PID 2932 wrote to memory of 2276 2932 jdlhnb.exe 31 PID 2932 wrote to memory of 2276 2932 jdlhnb.exe 31 PID 2932 wrote to memory of 2276 2932 jdlhnb.exe 31 PID 2276 wrote to memory of 2992 2276 xvvvrvv.exe 32 PID 2276 wrote to memory of 2992 2276 xvvvrvv.exe 32 PID 2276 wrote to memory of 2992 2276 xvvvrvv.exe 32 PID 2276 wrote to memory of 2992 2276 xvvvrvv.exe 32 PID 2992 wrote to memory of 2940 2992 brvxlp.exe 33 PID 2992 wrote to memory of 2940 2992 brvxlp.exe 33 PID 2992 wrote to memory of 2940 2992 brvxlp.exe 33 PID 2992 wrote to memory of 2940 2992 brvxlp.exe 33 PID 2940 wrote to memory of 2900 2940 lvjhl.exe 34 PID 2940 wrote to memory of 2900 2940 lvjhl.exe 34 PID 2940 wrote to memory of 2900 2940 lvjhl.exe 34 PID 2940 wrote to memory of 2900 2940 lvjhl.exe 34 PID 2900 wrote to memory of 864 2900 jtxlt.exe 35 PID 2900 wrote to memory of 864 2900 jtxlt.exe 35 PID 2900 wrote to memory of 864 2900 jtxlt.exe 35 PID 2900 wrote to memory of 864 2900 jtxlt.exe 35 PID 864 wrote to memory of 2356 864 vhhpr.exe 36 PID 864 wrote to memory of 2356 864 vhhpr.exe 36 PID 864 wrote to memory of 2356 864 vhhpr.exe 36 PID 864 wrote to memory of 2356 864 vhhpr.exe 36 PID 2356 wrote to memory of 2504 2356 nnfjtl.exe 37 PID 2356 wrote to memory of 2504 2356 nnfjtl.exe 37 PID 2356 wrote to memory of 2504 2356 nnfjtl.exe 37 PID 2356 wrote to memory of 2504 2356 nnfjtl.exe 37 PID 2504 wrote to memory of 2720 2504 fddvxnv.exe 38 PID 2504 wrote to memory of 2720 2504 fddvxnv.exe 38 PID 2504 wrote to memory of 2720 2504 fddvxnv.exe 38 PID 2504 wrote to memory of 2720 2504 fddvxnv.exe 38 PID 2720 wrote to memory of 1624 2720 brtpfr.exe 39 PID 2720 wrote to memory of 1624 2720 brtpfr.exe 39 PID 2720 wrote to memory of 1624 2720 brtpfr.exe 39 PID 2720 wrote to memory of 1624 2720 brtpfr.exe 39 PID 1624 wrote to memory of 1756 1624 lrfvpxf.exe 40 PID 1624 wrote to memory of 1756 1624 lrfvpxf.exe 40 PID 1624 wrote to memory of 1756 1624 lrfvpxf.exe 40 PID 1624 wrote to memory of 1756 1624 lrfvpxf.exe 40 PID 1756 wrote to memory of 3060 1756 xnxhfr.exe 41 PID 1756 wrote to memory of 3060 1756 xnxhfr.exe 41 PID 1756 wrote to memory of 3060 1756 xnxhfr.exe 41 PID 1756 wrote to memory of 3060 1756 xnxhfr.exe 41 PID 3060 wrote to memory of 1472 3060 xlnvvd.exe 42 PID 3060 wrote to memory of 1472 3060 xlnvvd.exe 42 PID 3060 wrote to memory of 1472 3060 xlnvvd.exe 42 PID 3060 wrote to memory of 1472 3060 xlnvvd.exe 42 PID 1472 wrote to memory of 3004 1472 tptnj.exe 43 PID 1472 wrote to memory of 3004 1472 tptnj.exe 43 PID 1472 wrote to memory of 3004 1472 tptnj.exe 43 PID 1472 wrote to memory of 3004 1472 tptnj.exe 43 PID 3004 wrote to memory of 1900 3004 jfrfj.exe 44 PID 3004 wrote to memory of 1900 3004 jfrfj.exe 44 PID 3004 wrote to memory of 1900 3004 jfrfj.exe 44 PID 3004 wrote to memory of 1900 3004 jfrfj.exe 44 PID 1900 wrote to memory of 1332 1900 dnrhvrv.exe 45 PID 1900 wrote to memory of 1332 1900 dnrhvrv.exe 45 PID 1900 wrote to memory of 1332 1900 dnrhvrv.exe 45 PID 1900 wrote to memory of 1332 1900 dnrhvrv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\066654143a6cfce0b064d32e47a9f731384c15eb562c581b5db4c07d26907fd9.exe"C:\Users\Admin\AppData\Local\Temp\066654143a6cfce0b064d32e47a9f731384c15eb562c581b5db4c07d26907fd9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\jdlhnb.exec:\jdlhnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\xvvvrvv.exec:\xvvvrvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\brvxlp.exec:\brvxlp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\lvjhl.exec:\lvjhl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\jtxlt.exec:\jtxlt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\vhhpr.exec:\vhhpr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\nnfjtl.exec:\nnfjtl.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\fddvxnv.exec:\fddvxnv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\brtpfr.exec:\brtpfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\lrfvpxf.exec:\lrfvpxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\xnxhfr.exec:\xnxhfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\xlnvvd.exec:\xlnvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\tptnj.exec:\tptnj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\jfrfj.exec:\jfrfj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\dnrhvrv.exec:\dnrhvrv.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\dnfhph.exec:\dnfhph.exe17⤵
- Executes dropped EXE
PID:1332 -
\??\c:\xhnnl.exec:\xhnnl.exe18⤵
- Executes dropped EXE
PID:296 -
\??\c:\fxvpnd.exec:\fxvpnd.exe19⤵
- Executes dropped EXE
PID:1828 -
\??\c:\lhddbf.exec:\lhddbf.exe20⤵
- Executes dropped EXE
PID:2292 -
\??\c:\pdrjh.exec:\pdrjh.exe21⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rbjrxb.exec:\rbjrxb.exe22⤵
- Executes dropped EXE
PID:2500 -
\??\c:\fhfld.exec:\fhfld.exe23⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jjlpvnh.exec:\jjlpvnh.exe24⤵
- Executes dropped EXE
PID:960 -
\??\c:\fxxlv.exec:\fxxlv.exe25⤵
- Executes dropped EXE
PID:2640 -
\??\c:\tdxtj.exec:\tdxtj.exe26⤵
- Executes dropped EXE
PID:692 -
\??\c:\dhvhrjv.exec:\dhvhrjv.exe27⤵
- Executes dropped EXE
PID:1804 -
\??\c:\hrnhrbl.exec:\hrnhrbl.exe28⤵
- Executes dropped EXE
PID:392 -
\??\c:\hrthd.exec:\hrthd.exe29⤵
- Executes dropped EXE
PID:236 -
\??\c:\jxxbp.exec:\jxxbp.exe30⤵
- Executes dropped EXE
PID:1680 -
\??\c:\rtdfpt.exec:\rtdfpt.exe31⤵
- Executes dropped EXE
PID:2824 -
\??\c:\frflp.exec:\frflp.exe32⤵
- Executes dropped EXE
PID:2392 -
\??\c:\pjhpxbt.exec:\pjhpxbt.exe33⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xtxjhvd.exec:\xtxjhvd.exe34⤵
- Executes dropped EXE
PID:2132 -
\??\c:\bbjfvr.exec:\bbjfvr.exe35⤵
- Executes dropped EXE
PID:1684 -
\??\c:\ntdtlnj.exec:\ntdtlnj.exe36⤵
- Executes dropped EXE
PID:1588 -
\??\c:\ntpxbj.exec:\ntpxbj.exe37⤵
- Executes dropped EXE
PID:2868 -
\??\c:\nhxjvv.exec:\nhxjvv.exe38⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xfrtb.exec:\xfrtb.exe39⤵
- Executes dropped EXE
PID:2832 -
\??\c:\rvbjnjr.exec:\rvbjnjr.exe40⤵
- Executes dropped EXE
PID:2940 -
\??\c:\thbjphv.exec:\thbjphv.exe41⤵
- Executes dropped EXE
PID:2776 -
\??\c:\fvbvx.exec:\fvbvx.exe42⤵
- Executes dropped EXE
PID:864 -
\??\c:\htbllbf.exec:\htbllbf.exe43⤵
- Executes dropped EXE
PID:2620 -
\??\c:\xnlbb.exec:\xnlbb.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2224 -
\??\c:\xdjtd.exec:\xdjtd.exe45⤵
- Executes dropped EXE
PID:2788 -
\??\c:\bjdvjhn.exec:\bjdvjhn.exe46⤵
- Executes dropped EXE
PID:1576 -
\??\c:\thvvxp.exec:\thvvxp.exe47⤵
- Executes dropped EXE
PID:776 -
\??\c:\jxnjrjr.exec:\jxnjrjr.exe48⤵
- Executes dropped EXE
PID:1640 -
\??\c:\dfddl.exec:\dfddl.exe49⤵
- Executes dropped EXE
PID:1312 -
\??\c:\xjvtpn.exec:\xjvtpn.exe50⤵
- Executes dropped EXE
PID:3008 -
\??\c:\bprpxv.exec:\bprpxv.exe51⤵
- Executes dropped EXE
PID:1892 -
\??\c:\bldtrnj.exec:\bldtrnj.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1068 -
\??\c:\fprnp.exec:\fprnp.exe53⤵
- Executes dropped EXE
PID:1968 -
\??\c:\tvbbxvd.exec:\tvbbxvd.exe54⤵
- Executes dropped EXE
PID:2076 -
\??\c:\pffbfp.exec:\pffbfp.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2092 -
\??\c:\dlfpln.exec:\dlfpln.exe56⤵
- Executes dropped EXE
PID:1124 -
\??\c:\rxlvbvd.exec:\rxlvbvd.exe57⤵
- Executes dropped EXE
PID:2280 -
\??\c:\bjhnj.exec:\bjhnj.exe58⤵
- Executes dropped EXE
PID:832 -
\??\c:\txxtdl.exec:\txxtdl.exe59⤵
- Executes dropped EXE
PID:2524 -
\??\c:\xbvrlj.exec:\xbvrlj.exe60⤵
- Executes dropped EXE
PID:2200 -
\??\c:\njlfn.exec:\njlfn.exe61⤵
- Executes dropped EXE
PID:2488 -
\??\c:\rfbphtl.exec:\rfbphtl.exe62⤵
- Executes dropped EXE
PID:1956 -
\??\c:\htnhndf.exec:\htnhndf.exe63⤵
- Executes dropped EXE
PID:1936 -
\??\c:\fxhtnh.exec:\fxhtnh.exe64⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jdrjnlj.exec:\jdrjnlj.exe65⤵
- Executes dropped EXE
PID:1452 -
\??\c:\ffhhnvh.exec:\ffhhnvh.exe66⤵PID:1656
-
\??\c:\btjbjj.exec:\btjbjj.exe67⤵PID:2104
-
\??\c:\ppltr.exec:\ppltr.exe68⤵
- System Location Discovery: System Language Discovery
PID:2388 -
\??\c:\vxvfthx.exec:\vxvfthx.exe69⤵PID:1596
-
\??\c:\nnhpp.exec:\nnhpp.exe70⤵PID:1620
-
\??\c:\xfjpfd.exec:\xfjpfd.exe71⤵PID:952
-
\??\c:\xvflp.exec:\xvflp.exe72⤵PID:948
-
\??\c:\lvflxf.exec:\lvflxf.exe73⤵PID:1564
-
\??\c:\xpldxxl.exec:\xpldxxl.exe74⤵PID:1748
-
\??\c:\fhvtdbx.exec:\fhvtdbx.exe75⤵PID:1728
-
\??\c:\njxht.exec:\njxht.exe76⤵PID:2132
-
\??\c:\rvnnljl.exec:\rvnnljl.exe77⤵PID:2124
-
\??\c:\rvjhph.exec:\rvjhph.exe78⤵PID:2348
-
\??\c:\pbdfhrn.exec:\pbdfhrn.exe79⤵PID:2972
-
\??\c:\djjlh.exec:\djjlh.exe80⤵PID:2896
-
\??\c:\rvvjnfn.exec:\rvvjnfn.exe81⤵PID:2920
-
\??\c:\xbblvh.exec:\xbblvh.exe82⤵PID:3020
-
\??\c:\xxnnnxp.exec:\xxnnnxp.exe83⤵PID:2828
-
\??\c:\rnnvxxx.exec:\rnnvxxx.exe84⤵PID:1648
-
\??\c:\pbrvfvx.exec:\pbrvfvx.exe85⤵PID:2588
-
\??\c:\tjvnh.exec:\tjvnh.exe86⤵PID:640
-
\??\c:\dtvjlr.exec:\dtvjlr.exe87⤵PID:2624
-
\??\c:\dbnrfvf.exec:\dbnrfvf.exe88⤵PID:2504
-
\??\c:\fjjfbl.exec:\fjjfbl.exe89⤵PID:2256
-
\??\c:\tvbxb.exec:\tvbxb.exe90⤵PID:2412
-
\??\c:\jhdxbx.exec:\jhdxbx.exe91⤵
- System Location Discovery: System Language Discovery
PID:2516 -
\??\c:\dppnjll.exec:\dppnjll.exe92⤵
- System Location Discovery: System Language Discovery
PID:3012 -
\??\c:\rnlrlbr.exec:\rnlrlbr.exe93⤵PID:3044
-
\??\c:\pdrtjx.exec:\pdrtjx.exe94⤵PID:2148
-
\??\c:\lfjjv.exec:\lfjjv.exe95⤵PID:2028
-
\??\c:\rhfdnv.exec:\rhfdnv.exe96⤵
- System Location Discovery: System Language Discovery
PID:2096 -
\??\c:\tjhrxhh.exec:\tjhrxhh.exe97⤵PID:2264
-
\??\c:\njbbpvr.exec:\njbbpvr.exe98⤵PID:2432
-
\??\c:\vfvftff.exec:\vfvftff.exe99⤵PID:2656
-
\??\c:\llbdvf.exec:\llbdvf.exe100⤵PID:2308
-
\??\c:\phhvpj.exec:\phhvpj.exe101⤵PID:2288
-
\??\c:\jpbrx.exec:\jpbrx.exe102⤵PID:1200
-
\??\c:\vxbxhbd.exec:\vxbxhbd.exe103⤵PID:2088
-
\??\c:\jfjnl.exec:\jfjnl.exe104⤵PID:1136
-
\??\c:\xjvdbj.exec:\xjvdbj.exe105⤵PID:2456
-
\??\c:\xbftx.exec:\xbftx.exe106⤵PID:584
-
\??\c:\txplh.exec:\txplh.exe107⤵PID:2228
-
\??\c:\pnjrlh.exec:\pnjrlh.exe108⤵PID:1040
-
\??\c:\lvtvlxp.exec:\lvtvlxp.exe109⤵PID:1952
-
\??\c:\xfjnff.exec:\xfjnff.exe110⤵PID:2144
-
\??\c:\pbblxp.exec:\pbblxp.exe111⤵PID:1084
-
\??\c:\fvhpfrl.exec:\fvhpfrl.exe112⤵PID:2204
-
\??\c:\lrrbtt.exec:\lrrbtt.exe113⤵PID:936
-
\??\c:\nhhnrx.exec:\nhhnrx.exe114⤵PID:800
-
\??\c:\frjppr.exec:\frjppr.exe115⤵PID:2672
-
\??\c:\djnfhp.exec:\djnfhp.exe116⤵PID:2824
-
\??\c:\jpxnj.exec:\jpxnj.exe117⤵PID:2332
-
\??\c:\tfrrjh.exec:\tfrrjh.exe118⤵PID:1020
-
\??\c:\lphnjd.exec:\lphnjd.exe119⤵PID:2416
-
\??\c:\dxxrvd.exec:\dxxrvd.exe120⤵PID:3000
-
\??\c:\jdlxfld.exec:\jdlxfld.exe121⤵PID:1584
-
\??\c:\nrtntf.exec:\nrtntf.exe122⤵PID:1588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-