Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 19:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
12e67291045029b5985c8fbe3fcf29d9c80340fa8ca5e6b5f970fbf633fcb3cb.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
12e67291045029b5985c8fbe3fcf29d9c80340fa8ca5e6b5f970fbf633fcb3cb.exe
-
Size
454KB
-
MD5
c63d14477da91588cb655e21d00964ab
-
SHA1
96a6d0ff1b443bd4b96327db5d90d8a8e8784b41
-
SHA256
12e67291045029b5985c8fbe3fcf29d9c80340fa8ca5e6b5f970fbf633fcb3cb
-
SHA512
229d63470b59c344586712c73da2fe1a28e8998e5f30d84beb920a9232e26efdcaccc769c5fe19e8ab99675e67f8fe5372c94098077d840bada7c00b0146ae63
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeP:q7Tc2NYHUrAwfMp3CDP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2380-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-16-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2352-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-38-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2156-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/924-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-143-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2340-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/660-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-201-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1696-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/748-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-308-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2760-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-415-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1940-460-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2888-469-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2284-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-556-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1796-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-770-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2064 lprnfr.exe 2352 nnxvhnd.exe 2836 bfhpjtb.exe 2124 brdhvbh.exe 2156 xlvlvjv.exe 2808 hljtxbr.exe 2980 rxxftxr.exe 2676 hjlldlb.exe 2764 hrdntj.exe 2704 nddddj.exe 1960 fjhjhl.exe 884 hpblxvd.exe 924 dvvbnvl.exe 1256 plplnbb.exe 2340 prlvfrb.exe 660 hxrxvhj.exe 1484 njjvxtv.exe 1764 tdbvt.exe 3052 rtnvxf.exe 2420 nbrpb.exe 2556 fjvff.exe 1696 xflvr.exe 2088 bjdxl.exe 1836 flftv.exe 1584 lnlvd.exe 1772 vdhnfbb.exe 1680 nlndvd.exe 748 bbbft.exe 2240 rdhlv.exe 1760 jvlrv.exe 676 bhfpvv.exe 1624 ttnhj.exe 2308 rxxnfp.exe 1268 rxpnx.exe 2984 xpbnrlh.exe 2352 drvvfrl.exe 2136 fvrvvjb.exe 2212 rlnrblj.exe 2760 nbdfp.exe 2780 ltnvxn.exe 2660 jxxpf.exe 2932 jpnpthv.exe 2168 lbhbdtl.exe 2944 jpvbpbh.exe 2656 fxprnxf.exe 2764 ntltn.exe 2296 lblvxt.exe 1604 hnlddhf.exe 2828 vbblvr.exe 932 plvxbl.exe 924 jtbtl.exe 2112 vxjvblf.exe 1780 jbrlx.exe 1196 nxvpjbx.exe 1940 vtntr.exe 2888 ptrhtf.exe 2868 nrnbjb.exe 2284 hxlbjfd.exe 2384 vvtdfd.exe 1476 vjvjn.exe 896 ljntn.exe 2200 pxttp.exe 1124 ppjthn.exe 1744 vdlpb.exe -
resource yara_rule behavioral1/memory/2380-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/660-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/748-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-670-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2832-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-770-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlpbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jffdhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfhnvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnrpxbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplhvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxvbbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrxrnnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfbpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntftp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrhtdxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbnvdhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbjptf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfjbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvdnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxnhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnftt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxlnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlxhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trdvhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvfllnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxdrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjfrvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdlvfxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lftdhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxpnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvxvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pprndt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2064 2380 12e67291045029b5985c8fbe3fcf29d9c80340fa8ca5e6b5f970fbf633fcb3cb.exe 30 PID 2380 wrote to memory of 2064 2380 12e67291045029b5985c8fbe3fcf29d9c80340fa8ca5e6b5f970fbf633fcb3cb.exe 30 PID 2380 wrote to memory of 2064 2380 12e67291045029b5985c8fbe3fcf29d9c80340fa8ca5e6b5f970fbf633fcb3cb.exe 30 PID 2380 wrote to memory of 2064 2380 12e67291045029b5985c8fbe3fcf29d9c80340fa8ca5e6b5f970fbf633fcb3cb.exe 30 PID 2064 wrote to memory of 2352 2064 lprnfr.exe 31 PID 2064 wrote to memory of 2352 2064 lprnfr.exe 31 PID 2064 wrote to memory of 2352 2064 lprnfr.exe 31 PID 2064 wrote to memory of 2352 2064 lprnfr.exe 31 PID 2352 wrote to memory of 2836 2352 nnxvhnd.exe 32 PID 2352 wrote to memory of 2836 2352 nnxvhnd.exe 32 PID 2352 wrote to memory of 2836 2352 nnxvhnd.exe 32 PID 2352 wrote to memory of 2836 2352 nnxvhnd.exe 32 PID 2836 wrote to memory of 2124 2836 bfhpjtb.exe 33 PID 2836 wrote to memory of 2124 2836 bfhpjtb.exe 33 PID 2836 wrote to memory of 2124 2836 bfhpjtb.exe 33 PID 2836 wrote to memory of 2124 2836 bfhpjtb.exe 33 PID 2124 wrote to memory of 2156 2124 brdhvbh.exe 34 PID 2124 wrote to memory of 2156 2124 brdhvbh.exe 34 PID 2124 wrote to memory of 2156 2124 brdhvbh.exe 34 PID 2124 wrote to memory of 2156 2124 brdhvbh.exe 34 PID 2156 wrote to memory of 2808 2156 xlvlvjv.exe 35 PID 2156 wrote to memory of 2808 2156 xlvlvjv.exe 35 PID 2156 wrote to memory of 2808 2156 xlvlvjv.exe 35 PID 2156 wrote to memory of 2808 2156 xlvlvjv.exe 35 PID 2808 wrote to memory of 2980 2808 hljtxbr.exe 36 PID 2808 wrote to memory of 2980 2808 hljtxbr.exe 36 PID 2808 wrote to memory of 2980 2808 hljtxbr.exe 36 PID 2808 wrote to memory of 2980 2808 hljtxbr.exe 36 PID 2980 wrote to memory of 2676 2980 rxxftxr.exe 37 PID 2980 wrote to memory of 2676 2980 rxxftxr.exe 37 PID 2980 wrote to memory of 2676 2980 rxxftxr.exe 37 PID 2980 wrote to memory of 2676 2980 rxxftxr.exe 37 PID 2676 wrote to memory of 2764 2676 hjlldlb.exe 38 PID 2676 wrote to memory of 2764 2676 hjlldlb.exe 38 PID 2676 wrote to memory of 2764 2676 hjlldlb.exe 38 PID 2676 wrote to memory of 2764 2676 hjlldlb.exe 38 PID 2764 wrote to memory of 2704 2764 hrdntj.exe 39 PID 2764 wrote to memory of 2704 2764 hrdntj.exe 39 PID 2764 wrote to memory of 2704 2764 hrdntj.exe 39 PID 2764 wrote to memory of 2704 2764 hrdntj.exe 39 PID 2704 wrote to memory of 1960 2704 nddddj.exe 40 PID 2704 wrote to memory of 1960 2704 nddddj.exe 40 PID 2704 wrote to memory of 1960 2704 nddddj.exe 40 PID 2704 wrote to memory of 1960 2704 nddddj.exe 40 PID 1960 wrote to memory of 884 1960 fjhjhl.exe 41 PID 1960 wrote to memory of 884 1960 fjhjhl.exe 41 PID 1960 wrote to memory of 884 1960 fjhjhl.exe 41 PID 1960 wrote to memory of 884 1960 fjhjhl.exe 41 PID 884 wrote to memory of 924 884 hpblxvd.exe 42 PID 884 wrote to memory of 924 884 hpblxvd.exe 42 PID 884 wrote to memory of 924 884 hpblxvd.exe 42 PID 884 wrote to memory of 924 884 hpblxvd.exe 42 PID 924 wrote to memory of 1256 924 dvvbnvl.exe 43 PID 924 wrote to memory of 1256 924 dvvbnvl.exe 43 PID 924 wrote to memory of 1256 924 dvvbnvl.exe 43 PID 924 wrote to memory of 1256 924 dvvbnvl.exe 43 PID 1256 wrote to memory of 2340 1256 plplnbb.exe 44 PID 1256 wrote to memory of 2340 1256 plplnbb.exe 44 PID 1256 wrote to memory of 2340 1256 plplnbb.exe 44 PID 1256 wrote to memory of 2340 1256 plplnbb.exe 44 PID 2340 wrote to memory of 660 2340 prlvfrb.exe 45 PID 2340 wrote to memory of 660 2340 prlvfrb.exe 45 PID 2340 wrote to memory of 660 2340 prlvfrb.exe 45 PID 2340 wrote to memory of 660 2340 prlvfrb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\12e67291045029b5985c8fbe3fcf29d9c80340fa8ca5e6b5f970fbf633fcb3cb.exe"C:\Users\Admin\AppData\Local\Temp\12e67291045029b5985c8fbe3fcf29d9c80340fa8ca5e6b5f970fbf633fcb3cb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\lprnfr.exec:\lprnfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\nnxvhnd.exec:\nnxvhnd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\bfhpjtb.exec:\bfhpjtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\brdhvbh.exec:\brdhvbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\xlvlvjv.exec:\xlvlvjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\hljtxbr.exec:\hljtxbr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\rxxftxr.exec:\rxxftxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\hjlldlb.exec:\hjlldlb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\hrdntj.exec:\hrdntj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\nddddj.exec:\nddddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\fjhjhl.exec:\fjhjhl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\hpblxvd.exec:\hpblxvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\dvvbnvl.exec:\dvvbnvl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\plplnbb.exec:\plplnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\prlvfrb.exec:\prlvfrb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\hxrxvhj.exec:\hxrxvhj.exe17⤵
- Executes dropped EXE
PID:660 -
\??\c:\njjvxtv.exec:\njjvxtv.exe18⤵
- Executes dropped EXE
PID:1484 -
\??\c:\tdbvt.exec:\tdbvt.exe19⤵
- Executes dropped EXE
PID:1764 -
\??\c:\rtnvxf.exec:\rtnvxf.exe20⤵
- Executes dropped EXE
PID:3052 -
\??\c:\nbrpb.exec:\nbrpb.exe21⤵
- Executes dropped EXE
PID:2420 -
\??\c:\fjvff.exec:\fjvff.exe22⤵
- Executes dropped EXE
PID:2556 -
\??\c:\xflvr.exec:\xflvr.exe23⤵
- Executes dropped EXE
PID:1696 -
\??\c:\bjdxl.exec:\bjdxl.exe24⤵
- Executes dropped EXE
PID:2088 -
\??\c:\flftv.exec:\flftv.exe25⤵
- Executes dropped EXE
PID:1836 -
\??\c:\lnlvd.exec:\lnlvd.exe26⤵
- Executes dropped EXE
PID:1584 -
\??\c:\vdhnfbb.exec:\vdhnfbb.exe27⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nlndvd.exec:\nlndvd.exe28⤵
- Executes dropped EXE
PID:1680 -
\??\c:\bbbft.exec:\bbbft.exe29⤵
- Executes dropped EXE
PID:748 -
\??\c:\rdhlv.exec:\rdhlv.exe30⤵
- Executes dropped EXE
PID:2240 -
\??\c:\jvlrv.exec:\jvlrv.exe31⤵
- Executes dropped EXE
PID:1760 -
\??\c:\bhfpvv.exec:\bhfpvv.exe32⤵
- Executes dropped EXE
PID:676 -
\??\c:\ttnhj.exec:\ttnhj.exe33⤵
- Executes dropped EXE
PID:1624 -
\??\c:\rxxnfp.exec:\rxxnfp.exe34⤵
- Executes dropped EXE
PID:2308 -
\??\c:\rxpnx.exec:\rxpnx.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1268 -
\??\c:\xpbnrlh.exec:\xpbnrlh.exe36⤵
- Executes dropped EXE
PID:2984 -
\??\c:\drvvfrl.exec:\drvvfrl.exe37⤵
- Executes dropped EXE
PID:2352 -
\??\c:\fvrvvjb.exec:\fvrvvjb.exe38⤵
- Executes dropped EXE
PID:2136 -
\??\c:\rlnrblj.exec:\rlnrblj.exe39⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nbdfp.exec:\nbdfp.exe40⤵
- Executes dropped EXE
PID:2760 -
\??\c:\ltnvxn.exec:\ltnvxn.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\jxxpf.exec:\jxxpf.exe42⤵
- Executes dropped EXE
PID:2660 -
\??\c:\jpnpthv.exec:\jpnpthv.exe43⤵
- Executes dropped EXE
PID:2932 -
\??\c:\lbhbdtl.exec:\lbhbdtl.exe44⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jpvbpbh.exec:\jpvbpbh.exe45⤵
- Executes dropped EXE
PID:2944 -
\??\c:\fxprnxf.exec:\fxprnxf.exe46⤵
- Executes dropped EXE
PID:2656 -
\??\c:\ntltn.exec:\ntltn.exe47⤵
- Executes dropped EXE
PID:2764 -
\??\c:\lblvxt.exec:\lblvxt.exe48⤵
- Executes dropped EXE
PID:2296 -
\??\c:\hnlddhf.exec:\hnlddhf.exe49⤵
- Executes dropped EXE
PID:1604 -
\??\c:\vbblvr.exec:\vbblvr.exe50⤵
- Executes dropped EXE
PID:2828 -
\??\c:\plvxbl.exec:\plvxbl.exe51⤵
- Executes dropped EXE
PID:932 -
\??\c:\jtbtl.exec:\jtbtl.exe52⤵
- Executes dropped EXE
PID:924 -
\??\c:\vxjvblf.exec:\vxjvblf.exe53⤵
- Executes dropped EXE
PID:2112 -
\??\c:\jbrlx.exec:\jbrlx.exe54⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nxvpjbx.exec:\nxvpjbx.exe55⤵
- Executes dropped EXE
PID:1196 -
\??\c:\vtntr.exec:\vtntr.exe56⤵
- Executes dropped EXE
PID:1940 -
\??\c:\ptrhtf.exec:\ptrhtf.exe57⤵
- Executes dropped EXE
PID:2888 -
\??\c:\nrnbjb.exec:\nrnbjb.exe58⤵
- Executes dropped EXE
PID:2868 -
\??\c:\hxlbjfd.exec:\hxlbjfd.exe59⤵
- Executes dropped EXE
PID:2284 -
\??\c:\vvtdfd.exec:\vvtdfd.exe60⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vjvjn.exec:\vjvjn.exe61⤵
- Executes dropped EXE
PID:1476 -
\??\c:\ljntn.exec:\ljntn.exe62⤵
- Executes dropped EXE
PID:896 -
\??\c:\pxttp.exec:\pxttp.exe63⤵
- Executes dropped EXE
PID:2200 -
\??\c:\ppjthn.exec:\ppjthn.exe64⤵
- Executes dropped EXE
PID:1124 -
\??\c:\vdlpb.exec:\vdlpb.exe65⤵
- Executes dropped EXE
PID:1744 -
\??\c:\hljxj.exec:\hljxj.exe66⤵PID:1004
-
\??\c:\hjtntlv.exec:\hjtntlv.exe67⤵PID:1756
-
\??\c:\fhvfxx.exec:\fhvfxx.exe68⤵PID:3000
-
\??\c:\fhnnfh.exec:\fhnnfh.exe69⤵PID:1364
-
\??\c:\vhvbj.exec:\vhvbj.exe70⤵PID:1672
-
\??\c:\vhppb.exec:\vhppb.exe71⤵PID:268
-
\??\c:\hhnlbrp.exec:\hhnlbrp.exe72⤵PID:1852
-
\??\c:\vpjjp.exec:\vpjjp.exe73⤵PID:1760
-
\??\c:\hfbpt.exec:\hfbpt.exe74⤵
- System Location Discovery: System Language Discovery
PID:1732 -
\??\c:\vdfnlv.exec:\vdfnlv.exe75⤵PID:3068
-
\??\c:\dtjpj.exec:\dtjpj.exe76⤵PID:1576
-
\??\c:\dnrftjt.exec:\dnrftjt.exe77⤵PID:2600
-
\??\c:\jrjpdrl.exec:\jrjpdrl.exe78⤵PID:1796
-
\??\c:\bldpxhl.exec:\bldpxhl.exe79⤵PID:2352
-
\??\c:\ljxfxv.exec:\ljxfxv.exe80⤵PID:2124
-
\??\c:\bttnth.exec:\bttnth.exe81⤵PID:2440
-
\??\c:\lrvfl.exec:\lrvfl.exe82⤵PID:2176
-
\??\c:\hhbvfd.exec:\hhbvfd.exe83⤵PID:2368
-
\??\c:\nlvlxx.exec:\nlvlxx.exe84⤵PID:2036
-
\??\c:\flnnjb.exec:\flnnjb.exe85⤵PID:2932
-
\??\c:\btdfx.exec:\btdfx.exe86⤵PID:2708
-
\??\c:\lrnvjtn.exec:\lrnvjtn.exe87⤵PID:2944
-
\??\c:\dtvlphr.exec:\dtvlphr.exe88⤵PID:2772
-
\??\c:\vpfrp.exec:\vpfrp.exe89⤵PID:2764
-
\??\c:\btdbfxh.exec:\btdbfxh.exe90⤵PID:2716
-
\??\c:\pldfh.exec:\pldfh.exe91⤵PID:2832
-
\??\c:\vjhlbbr.exec:\vjhlbbr.exe92⤵PID:884
-
\??\c:\vxbjxnr.exec:\vxbjxnr.exe93⤵PID:1008
-
\??\c:\jpjffvp.exec:\jpjffvp.exe94⤵PID:1600
-
\??\c:\nrhtdxj.exec:\nrhtdxj.exe95⤵
- System Location Discovery: System Language Discovery
PID:1784 -
\??\c:\fxpltjp.exec:\fxpltjp.exe96⤵PID:1656
-
\??\c:\ljplbj.exec:\ljplbj.exe97⤵PID:1148
-
\??\c:\lbhnd.exec:\lbhnd.exe98⤵PID:1484
-
\??\c:\tlppnj.exec:\tlppnj.exe99⤵PID:2996
-
\??\c:\nttffr.exec:\nttffr.exe100⤵PID:2516
-
\??\c:\fflrdvx.exec:\fflrdvx.exe101⤵PID:3052
-
\??\c:\flrjpnl.exec:\flrjpnl.exe102⤵PID:3024
-
\??\c:\rdnjvfp.exec:\rdnjvfp.exe103⤵PID:1816
-
\??\c:\vpxljdd.exec:\vpxljdd.exe104⤵PID:772
-
\??\c:\rltfjd.exec:\rltfjd.exe105⤵PID:2132
-
\??\c:\pjrhd.exec:\pjrhd.exe106⤵PID:964
-
\??\c:\nvdhb.exec:\nvdhb.exe107⤵PID:1744
-
\??\c:\dtljhh.exec:\dtljhh.exe108⤵PID:2484
-
\??\c:\jpfnbxn.exec:\jpfnbxn.exe109⤵PID:1888
-
\??\c:\bnxrtf.exec:\bnxrtf.exe110⤵PID:3000
-
\??\c:\lbdrn.exec:\lbdrn.exe111⤵PID:1688
-
\??\c:\nxdrn.exec:\nxdrn.exe112⤵
- System Location Discovery: System Language Discovery
PID:2288 -
\??\c:\fxtnh.exec:\fxtnh.exe113⤵PID:2260
-
\??\c:\prfvhbt.exec:\prfvhbt.exe114⤵PID:1824
-
\??\c:\bbphj.exec:\bbphj.exe115⤵PID:2272
-
\??\c:\hrptd.exec:\hrptd.exe116⤵PID:2588
-
\??\c:\jhrtld.exec:\jhrtld.exe117⤵PID:2128
-
\??\c:\lvbfj.exec:\lvbfj.exe118⤵PID:1684
-
\??\c:\rffbff.exec:\rffbff.exe119⤵PID:1320
-
\??\c:\tnvftd.exec:\tnvftd.exe120⤵PID:2976
-
\??\c:\llxhjr.exec:\llxhjr.exe121⤵PID:3060
-
\??\c:\nxltj.exec:\nxltj.exe122⤵PID:2744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-