Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 19:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0c152f8d8bdf63289fd4a83880cfeb13af2269dc639331cb0b7a022433a3b5be.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
0c152f8d8bdf63289fd4a83880cfeb13af2269dc639331cb0b7a022433a3b5be.exe
-
Size
454KB
-
MD5
d4cbdf719a21dc89101c869fd0d3a7c1
-
SHA1
560d041cd3626c46440368467f088999963c4c38
-
SHA256
0c152f8d8bdf63289fd4a83880cfeb13af2269dc639331cb0b7a022433a3b5be
-
SHA512
f4cf55fe804c205a8ccd2ce403ee5f75f2e32817a4aae4d7c6c6d9286314d910e3911f17542d14ebfab5819b652d48aebb76ddfc1f05992805c258a34edb7eac
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeO:q7Tc2NYHUrAwfMp3CDO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2380-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-73-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2768-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-512-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2184-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-526-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2836-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-629-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-637-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2792-644-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2792-663-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2564 nxfvp.exe 2352 nvvrx.exe 2500 rprdv.exe 2092 xhfhh.exe 2496 rfflrl.exe 2784 lxdphv.exe 2928 bxprxh.exe 2768 nvrxpln.exe 2168 fnrxl.exe 2728 nrlvjx.exe 1388 pnfxthp.exe 2840 fdfvlbx.exe 1920 vrvlbxb.exe 2884 llxjl.exe 2112 nxrrjjv.exe 1656 jpxhnj.exe 1148 tpvfj.exe 3044 jjfpxj.exe 3020 ltphpbt.exe 2860 jbfvvr.exe 3036 pbbrv.exe 772 ljbnjbd.exe 2184 lbjldt.exe 1252 fprhx.exe 1004 pfrtfhf.exe 1888 vpphr.exe 1672 hplnhft.exe 268 hhljtxl.exe 1580 hffrrpn.exe 2300 fvtxhbt.exe 2316 rppddp.exe 1740 vhpvpnv.exe 2380 xnhvptx.exe 1572 htbxn.exe 832 frrdbtx.exe 1320 jdxdl.exe 1980 xxpxrv.exe 2396 pbdrvrj.exe 2092 flflx.exe 2756 ftxvd.exe 2792 xfltt.exe 2788 pxxbhjx.exe 2928 bnhlxjx.exe 2196 vdtrln.exe 3056 llntpx.exe 1868 fhvntnr.exe 2636 jdblb.exe 1604 tpvrxx.exe 2832 xfflvbn.exe 1040 tdnhf.exe 1992 pxxhf.exe 2340 rdtvj.exe 1780 thttfdn.exe 2112 pxtxllt.exe 1656 dxlxhd.exe 1764 fjdvlt.exe 2864 jvbtpjv.exe 2144 dbdfphb.exe 2852 vhtljl.exe 2072 tlxhtbf.exe 1696 jpbfdvt.exe 2200 fxtln.exe 820 xlpvp.exe 2184 hjdvxx.exe -
resource yara_rule behavioral1/memory/2380-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-819-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-856-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-869-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-876-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-903-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxnhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fplphn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thxtdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndbltbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbrxnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlhxrbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jljdxnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nflnpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hljbrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhrvvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbrvnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drbxjrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxpdnvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrbdtvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdtxnbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlfvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppbhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnvdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxpdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpfvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhhthtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvddjxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntvfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxrlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fljbnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnvpjhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdxrtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfjhfhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrvtfpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdfpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlldp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnrdlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjhlpl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2564 2380 0c152f8d8bdf63289fd4a83880cfeb13af2269dc639331cb0b7a022433a3b5be.exe 30 PID 2380 wrote to memory of 2564 2380 0c152f8d8bdf63289fd4a83880cfeb13af2269dc639331cb0b7a022433a3b5be.exe 30 PID 2380 wrote to memory of 2564 2380 0c152f8d8bdf63289fd4a83880cfeb13af2269dc639331cb0b7a022433a3b5be.exe 30 PID 2380 wrote to memory of 2564 2380 0c152f8d8bdf63289fd4a83880cfeb13af2269dc639331cb0b7a022433a3b5be.exe 30 PID 2564 wrote to memory of 2352 2564 nxfvp.exe 31 PID 2564 wrote to memory of 2352 2564 nxfvp.exe 31 PID 2564 wrote to memory of 2352 2564 nxfvp.exe 31 PID 2564 wrote to memory of 2352 2564 nxfvp.exe 31 PID 2352 wrote to memory of 2500 2352 nvvrx.exe 32 PID 2352 wrote to memory of 2500 2352 nvvrx.exe 32 PID 2352 wrote to memory of 2500 2352 nvvrx.exe 32 PID 2352 wrote to memory of 2500 2352 nvvrx.exe 32 PID 2500 wrote to memory of 2092 2500 rprdv.exe 33 PID 2500 wrote to memory of 2092 2500 rprdv.exe 33 PID 2500 wrote to memory of 2092 2500 rprdv.exe 33 PID 2500 wrote to memory of 2092 2500 rprdv.exe 33 PID 2092 wrote to memory of 2496 2092 xhfhh.exe 34 PID 2092 wrote to memory of 2496 2092 xhfhh.exe 34 PID 2092 wrote to memory of 2496 2092 xhfhh.exe 34 PID 2092 wrote to memory of 2496 2092 xhfhh.exe 34 PID 2496 wrote to memory of 2784 2496 rfflrl.exe 35 PID 2496 wrote to memory of 2784 2496 rfflrl.exe 35 PID 2496 wrote to memory of 2784 2496 rfflrl.exe 35 PID 2496 wrote to memory of 2784 2496 rfflrl.exe 35 PID 2784 wrote to memory of 2928 2784 lxdphv.exe 36 PID 2784 wrote to memory of 2928 2784 lxdphv.exe 36 PID 2784 wrote to memory of 2928 2784 lxdphv.exe 36 PID 2784 wrote to memory of 2928 2784 lxdphv.exe 36 PID 2928 wrote to memory of 2768 2928 bxprxh.exe 37 PID 2928 wrote to memory of 2768 2928 bxprxh.exe 37 PID 2928 wrote to memory of 2768 2928 bxprxh.exe 37 PID 2928 wrote to memory of 2768 2928 bxprxh.exe 37 PID 2768 wrote to memory of 2168 2768 nvrxpln.exe 38 PID 2768 wrote to memory of 2168 2768 nvrxpln.exe 38 PID 2768 wrote to memory of 2168 2768 nvrxpln.exe 38 PID 2768 wrote to memory of 2168 2768 nvrxpln.exe 38 PID 2168 wrote to memory of 2728 2168 fnrxl.exe 39 PID 2168 wrote to memory of 2728 2168 fnrxl.exe 39 PID 2168 wrote to memory of 2728 2168 fnrxl.exe 39 PID 2168 wrote to memory of 2728 2168 fnrxl.exe 39 PID 2728 wrote to memory of 1388 2728 nrlvjx.exe 40 PID 2728 wrote to memory of 1388 2728 nrlvjx.exe 40 PID 2728 wrote to memory of 1388 2728 nrlvjx.exe 40 PID 2728 wrote to memory of 1388 2728 nrlvjx.exe 40 PID 1388 wrote to memory of 2840 1388 pnfxthp.exe 41 PID 1388 wrote to memory of 2840 1388 pnfxthp.exe 41 PID 1388 wrote to memory of 2840 1388 pnfxthp.exe 41 PID 1388 wrote to memory of 2840 1388 pnfxthp.exe 41 PID 2840 wrote to memory of 1920 2840 fdfvlbx.exe 42 PID 2840 wrote to memory of 1920 2840 fdfvlbx.exe 42 PID 2840 wrote to memory of 1920 2840 fdfvlbx.exe 42 PID 2840 wrote to memory of 1920 2840 fdfvlbx.exe 42 PID 1920 wrote to memory of 2884 1920 vrvlbxb.exe 43 PID 1920 wrote to memory of 2884 1920 vrvlbxb.exe 43 PID 1920 wrote to memory of 2884 1920 vrvlbxb.exe 43 PID 1920 wrote to memory of 2884 1920 vrvlbxb.exe 43 PID 2884 wrote to memory of 2112 2884 llxjl.exe 44 PID 2884 wrote to memory of 2112 2884 llxjl.exe 44 PID 2884 wrote to memory of 2112 2884 llxjl.exe 44 PID 2884 wrote to memory of 2112 2884 llxjl.exe 44 PID 2112 wrote to memory of 1656 2112 nxrrjjv.exe 45 PID 2112 wrote to memory of 1656 2112 nxrrjjv.exe 45 PID 2112 wrote to memory of 1656 2112 nxrrjjv.exe 45 PID 2112 wrote to memory of 1656 2112 nxrrjjv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c152f8d8bdf63289fd4a83880cfeb13af2269dc639331cb0b7a022433a3b5be.exe"C:\Users\Admin\AppData\Local\Temp\0c152f8d8bdf63289fd4a83880cfeb13af2269dc639331cb0b7a022433a3b5be.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\nxfvp.exec:\nxfvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\nvvrx.exec:\nvvrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\rprdv.exec:\rprdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\xhfhh.exec:\xhfhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\rfflrl.exec:\rfflrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\lxdphv.exec:\lxdphv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\bxprxh.exec:\bxprxh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\nvrxpln.exec:\nvrxpln.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\fnrxl.exec:\fnrxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\nrlvjx.exec:\nrlvjx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\pnfxthp.exec:\pnfxthp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\fdfvlbx.exec:\fdfvlbx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\vrvlbxb.exec:\vrvlbxb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\llxjl.exec:\llxjl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\nxrrjjv.exec:\nxrrjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\jpxhnj.exec:\jpxhnj.exe17⤵
- Executes dropped EXE
PID:1656 -
\??\c:\tpvfj.exec:\tpvfj.exe18⤵
- Executes dropped EXE
PID:1148 -
\??\c:\jjfpxj.exec:\jjfpxj.exe19⤵
- Executes dropped EXE
PID:3044 -
\??\c:\ltphpbt.exec:\ltphpbt.exe20⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jbfvvr.exec:\jbfvvr.exe21⤵
- Executes dropped EXE
PID:2860 -
\??\c:\pbbrv.exec:\pbbrv.exe22⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ljbnjbd.exec:\ljbnjbd.exe23⤵
- Executes dropped EXE
PID:772 -
\??\c:\lbjldt.exec:\lbjldt.exe24⤵
- Executes dropped EXE
PID:2184 -
\??\c:\fprhx.exec:\fprhx.exe25⤵
- Executes dropped EXE
PID:1252 -
\??\c:\pfrtfhf.exec:\pfrtfhf.exe26⤵
- Executes dropped EXE
PID:1004 -
\??\c:\vpphr.exec:\vpphr.exe27⤵
- Executes dropped EXE
PID:1888 -
\??\c:\hplnhft.exec:\hplnhft.exe28⤵
- Executes dropped EXE
PID:1672 -
\??\c:\hhljtxl.exec:\hhljtxl.exe29⤵
- Executes dropped EXE
PID:268 -
\??\c:\hffrrpn.exec:\hffrrpn.exe30⤵
- Executes dropped EXE
PID:1580 -
\??\c:\fvtxhbt.exec:\fvtxhbt.exe31⤵
- Executes dropped EXE
PID:2300 -
\??\c:\rppddp.exec:\rppddp.exe32⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vhpvpnv.exec:\vhpvpnv.exe33⤵
- Executes dropped EXE
PID:1740 -
\??\c:\xnhvptx.exec:\xnhvptx.exe34⤵
- Executes dropped EXE
PID:2380 -
\??\c:\htbxn.exec:\htbxn.exe35⤵
- Executes dropped EXE
PID:1572 -
\??\c:\frrdbtx.exec:\frrdbtx.exe36⤵
- Executes dropped EXE
PID:832 -
\??\c:\jdxdl.exec:\jdxdl.exe37⤵
- Executes dropped EXE
PID:1320 -
\??\c:\xxpxrv.exec:\xxpxrv.exe38⤵
- Executes dropped EXE
PID:1980 -
\??\c:\pbdrvrj.exec:\pbdrvrj.exe39⤵
- Executes dropped EXE
PID:2396 -
\??\c:\flflx.exec:\flflx.exe40⤵
- Executes dropped EXE
PID:2092 -
\??\c:\ftxvd.exec:\ftxvd.exe41⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xfltt.exec:\xfltt.exe42⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pxxbhjx.exec:\pxxbhjx.exe43⤵
- Executes dropped EXE
PID:2788 -
\??\c:\bnhlxjx.exec:\bnhlxjx.exe44⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vdtrln.exec:\vdtrln.exe45⤵
- Executes dropped EXE
PID:2196 -
\??\c:\llntpx.exec:\llntpx.exe46⤵
- Executes dropped EXE
PID:3056 -
\??\c:\fhvntnr.exec:\fhvntnr.exe47⤵
- Executes dropped EXE
PID:1868 -
\??\c:\jdblb.exec:\jdblb.exe48⤵
- Executes dropped EXE
PID:2636 -
\??\c:\tpvrxx.exec:\tpvrxx.exe49⤵
- Executes dropped EXE
PID:1604 -
\??\c:\xfflvbn.exec:\xfflvbn.exe50⤵
- Executes dropped EXE
PID:2832 -
\??\c:\tdnhf.exec:\tdnhf.exe51⤵
- Executes dropped EXE
PID:1040 -
\??\c:\pxxhf.exec:\pxxhf.exe52⤵
- Executes dropped EXE
PID:1992 -
\??\c:\rdtvj.exec:\rdtvj.exe53⤵
- Executes dropped EXE
PID:2340 -
\??\c:\thttfdn.exec:\thttfdn.exe54⤵
- Executes dropped EXE
PID:1780 -
\??\c:\pxtxllt.exec:\pxtxllt.exe55⤵
- Executes dropped EXE
PID:2112 -
\??\c:\dxlxhd.exec:\dxlxhd.exe56⤵
- Executes dropped EXE
PID:1656 -
\??\c:\fjdvlt.exec:\fjdvlt.exe57⤵
- Executes dropped EXE
PID:1764 -
\??\c:\jvbtpjv.exec:\jvbtpjv.exe58⤵
- Executes dropped EXE
PID:2864 -
\??\c:\dbdfphb.exec:\dbdfphb.exe59⤵
- Executes dropped EXE
PID:2144 -
\??\c:\vhtljl.exec:\vhtljl.exe60⤵
- Executes dropped EXE
PID:2852 -
\??\c:\tlxhtbf.exec:\tlxhtbf.exe61⤵
- Executes dropped EXE
PID:2072 -
\??\c:\jpbfdvt.exec:\jpbfdvt.exe62⤵
- Executes dropped EXE
PID:1696 -
\??\c:\fxtln.exec:\fxtln.exe63⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xlpvp.exec:\xlpvp.exe64⤵
- Executes dropped EXE
PID:820 -
\??\c:\hjdvxx.exec:\hjdvxx.exe65⤵
- Executes dropped EXE
PID:2184 -
\??\c:\njtnj.exec:\njtnj.exe66⤵PID:960
-
\??\c:\jjphpl.exec:\jjphpl.exe67⤵PID:1756
-
\??\c:\rfldp.exec:\rfldp.exe68⤵PID:2140
-
\??\c:\lxvfrpx.exec:\lxvfrpx.exe69⤵PID:1556
-
\??\c:\vfvlpjx.exec:\vfvlpjx.exe70⤵PID:1672
-
\??\c:\bnbrvnn.exec:\bnbrvnn.exe71⤵
- System Location Discovery: System Language Discovery
PID:1968 -
\??\c:\dpnfb.exec:\dpnfb.exe72⤵PID:272
-
\??\c:\lpbff.exec:\lpbff.exe73⤵PID:2628
-
\??\c:\nfldjpx.exec:\nfldjpx.exe74⤵PID:2316
-
\??\c:\rppbpd.exec:\rppbpd.exe75⤵PID:2268
-
\??\c:\ltblh.exec:\ltblh.exe76⤵PID:2064
-
\??\c:\hhxjpd.exec:\hhxjpd.exe77⤵PID:1576
-
\??\c:\pvrjx.exec:\pvrjx.exe78⤵PID:1300
-
\??\c:\fdbbjfx.exec:\fdbbjfx.exe79⤵PID:2836
-
\??\c:\tvptl.exec:\tvptl.exe80⤵PID:2424
-
\??\c:\xffhj.exec:\xffhj.exe81⤵PID:1192
-
\??\c:\dtvhlhj.exec:\dtvhlhj.exe82⤵PID:2796
-
\??\c:\tpbfbd.exec:\tpbfbd.exe83⤵PID:2920
-
\??\c:\lndxvdd.exec:\lndxvdd.exe84⤵PID:2792
-
\??\c:\xlvphpx.exec:\xlvphpx.exe85⤵PID:2076
-
\??\c:\rrhrvx.exec:\rrhrvx.exe86⤵PID:1276
-
\??\c:\llfpx.exec:\llfpx.exe87⤵PID:2816
-
\??\c:\jjdbjl.exec:\jjdbjl.exe88⤵PID:2616
-
\??\c:\hvhjn.exec:\hvhjn.exe89⤵PID:1868
-
\??\c:\prhhrj.exec:\prhhrj.exe90⤵PID:2344
-
\??\c:\hjphn.exec:\hjphn.exe91⤵PID:884
-
\??\c:\xdtjbnt.exec:\xdtjbnt.exe92⤵PID:1548
-
\??\c:\rpbrvp.exec:\rpbrvp.exe93⤵PID:1920
-
\??\c:\hlpxblr.exec:\hlpxblr.exe94⤵PID:624
-
\??\c:\xbhlhf.exec:\xbhlhf.exe95⤵PID:1716
-
\??\c:\phdxtx.exec:\phdxtx.exe96⤵PID:2640
-
\??\c:\ppftl.exec:\ppftl.exe97⤵PID:1484
-
\??\c:\nnhhjxr.exec:\nnhhjxr.exe98⤵PID:1956
-
\??\c:\pbrlhp.exec:\pbrlhp.exe99⤵PID:1764
-
\??\c:\dnfjv.exec:\dnfjv.exe100⤵PID:852
-
\??\c:\xrbxl.exec:\xrbxl.exe101⤵PID:2432
-
\??\c:\pxxbjbn.exec:\pxxbjbn.exe102⤵PID:3040
-
\??\c:\vdfpr.exec:\vdfpr.exe103⤵
- System Location Discovery: System Language Discovery
PID:1864 -
\??\c:\fljdxjb.exec:\fljdxjb.exe104⤵PID:2132
-
\??\c:\rhfjp.exec:\rhfjp.exe105⤵PID:2544
-
\??\c:\dbxrb.exec:\dbxrb.exe106⤵PID:800
-
\??\c:\fbjbb.exec:\fbjbb.exe107⤵PID:2484
-
\??\c:\rjvfdnx.exec:\rjvfdnx.exe108⤵PID:3012
-
\??\c:\dfjfpfd.exec:\dfjfpfd.exe109⤵PID:580
-
\??\c:\xhxxn.exec:\xhxxn.exe110⤵PID:1504
-
\??\c:\vlfptt.exec:\vlfptt.exe111⤵PID:1144
-
\??\c:\xvbdv.exec:\xvbdv.exe112⤵PID:2240
-
\??\c:\hbnjp.exec:\hbnjp.exe113⤵PID:1620
-
\??\c:\jpxxl.exec:\jpxxl.exe114⤵PID:2300
-
\??\c:\vbpnrt.exec:\vbpnrt.exe115⤵PID:2568
-
\??\c:\pxhnrf.exec:\pxhnrf.exe116⤵PID:3068
-
\??\c:\vtjdnd.exec:\vtjdnd.exe117⤵PID:1564
-
\??\c:\vvtvtj.exec:\vvtvtj.exe118⤵PID:768
-
\??\c:\hvnhptn.exec:\hvnhptn.exe119⤵PID:2600
-
\??\c:\ltxfhnn.exec:\ltxfhnn.exe120⤵PID:2976
-
\??\c:\jlprnd.exec:\jlprnd.exe121⤵PID:1300
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-