Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 20:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
190940fe80dcc97ffe5946c53b05076bd65a7b0147c486dafa9c41fdc8418ea4.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
190940fe80dcc97ffe5946c53b05076bd65a7b0147c486dafa9c41fdc8418ea4.exe
-
Size
454KB
-
MD5
70ccb33990fa2fda85a75d8f41218dc2
-
SHA1
bc6d10eb1608050c069311dc1e3b3fb0594b2a1a
-
SHA256
190940fe80dcc97ffe5946c53b05076bd65a7b0147c486dafa9c41fdc8418ea4
-
SHA512
9e30e1c61ef6f92d12b486ad444dc78834a32037ea9b7aa8c673de3b94ab4b9e2dc345862a762d7bae7baf09a30940bcb0e0ff5ae88e882c1ac695580f2d2a27
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2052-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-57-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2900-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-72-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2708-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-200-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2496-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/920-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-301-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1592-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-314-0x00000000773A0000-0x00000000774BF000-memory.dmp family_blackmoon behavioral1/memory/1704-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-331-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1720-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-351-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2876-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/960-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-586-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2756-621-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2884-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-668-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2440-685-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1704 rjllndr.exe 2228 jrplh.exe 2900 tfxxflr.exe 2768 vlvnl.exe 1660 lxtpd.exe 2688 rjrljd.exe 2708 bbbbxn.exe 2156 tddhvv.exe 2944 tvhpfl.exe 2452 dxfxb.exe 924 rtrvbrl.exe 2032 hhxpdrv.exe 2996 tjxvdv.exe 1976 nbdnvnv.exe 1664 jxhxv.exe 2444 jtplhd.exe 1212 jtxhv.exe 1820 vdhnpd.exe 1328 ttdlv.exe 2184 jjpfpx.exe 2520 dprtxfv.exe 2068 lhlbbpp.exe 1796 vdnld.exe 2496 rddhhn.exe 2624 rvflrnr.exe 1784 bdxjlf.exe 1764 btbdrd.exe 920 nhdhptx.exe 2008 xtnrtj.exe 1152 bvxll.exe 1816 hxfhl.exe 1592 nvhfllv.exe 696 ftvhtrb.exe 2380 ttrxtf.exe 2792 rthdb.exe 1720 vtlhhx.exe 2104 ldvfn.exe 2876 nvthll.exe 2132 pnrrdl.exe 2856 hfnlpx.exe 2728 bfrrp.exe 2136 njvdv.exe 692 fljdb.exe 1624 pbffbh.exe 1188 xfttjpb.exe 1928 ddljhdb.exe 2760 ntlld.exe 3056 nddvfbt.exe 3020 pnlnjj.exe 2948 hrjtp.exe 1216 phnpj.exe 2964 lbrlx.exe 1976 vrdvlr.exe 2232 ntlxpt.exe 2084 trtrb.exe 1372 trhnl.exe 824 prlltt.exe 1872 jnvnd.exe 1328 vrjrr.exe 2372 vllvjp.exe 2632 nbdvtnd.exe 1804 ptbvp.exe 948 phdlpbp.exe 1796 htlxxxf.exe -
resource yara_rule behavioral1/memory/2052-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-643-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpjrnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjxvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntlxpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdjfjbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdlplpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvvjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhxnlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tptbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllvnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlldb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrdvlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbnljf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtdrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blhfdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvxtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnrpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfvjjbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvplrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxblxxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llltl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frjdbhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 190940fe80dcc97ffe5946c53b05076bd65a7b0147c486dafa9c41fdc8418ea4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfttjpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbvljhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2052 wrote to memory of 1704 2052 190940fe80dcc97ffe5946c53b05076bd65a7b0147c486dafa9c41fdc8418ea4.exe 29 PID 2052 wrote to memory of 1704 2052 190940fe80dcc97ffe5946c53b05076bd65a7b0147c486dafa9c41fdc8418ea4.exe 29 PID 2052 wrote to memory of 1704 2052 190940fe80dcc97ffe5946c53b05076bd65a7b0147c486dafa9c41fdc8418ea4.exe 29 PID 2052 wrote to memory of 1704 2052 190940fe80dcc97ffe5946c53b05076bd65a7b0147c486dafa9c41fdc8418ea4.exe 29 PID 1704 wrote to memory of 2228 1704 rjllndr.exe 30 PID 1704 wrote to memory of 2228 1704 rjllndr.exe 30 PID 1704 wrote to memory of 2228 1704 rjllndr.exe 30 PID 1704 wrote to memory of 2228 1704 rjllndr.exe 30 PID 2228 wrote to memory of 2900 2228 jrplh.exe 31 PID 2228 wrote to memory of 2900 2228 jrplh.exe 31 PID 2228 wrote to memory of 2900 2228 jrplh.exe 31 PID 2228 wrote to memory of 2900 2228 jrplh.exe 31 PID 2900 wrote to memory of 2768 2900 tfxxflr.exe 32 PID 2900 wrote to memory of 2768 2900 tfxxflr.exe 32 PID 2900 wrote to memory of 2768 2900 tfxxflr.exe 32 PID 2900 wrote to memory of 2768 2900 tfxxflr.exe 32 PID 2768 wrote to memory of 1660 2768 vlvnl.exe 33 PID 2768 wrote to memory of 1660 2768 vlvnl.exe 33 PID 2768 wrote to memory of 1660 2768 vlvnl.exe 33 PID 2768 wrote to memory of 1660 2768 vlvnl.exe 33 PID 1660 wrote to memory of 2688 1660 lxtpd.exe 34 PID 1660 wrote to memory of 2688 1660 lxtpd.exe 34 PID 1660 wrote to memory of 2688 1660 lxtpd.exe 34 PID 1660 wrote to memory of 2688 1660 lxtpd.exe 34 PID 2688 wrote to memory of 2708 2688 rjrljd.exe 35 PID 2688 wrote to memory of 2708 2688 rjrljd.exe 35 PID 2688 wrote to memory of 2708 2688 rjrljd.exe 35 PID 2688 wrote to memory of 2708 2688 rjrljd.exe 35 PID 2708 wrote to memory of 2156 2708 bbbbxn.exe 36 PID 2708 wrote to memory of 2156 2708 bbbbxn.exe 36 PID 2708 wrote to memory of 2156 2708 bbbbxn.exe 36 PID 2708 wrote to memory of 2156 2708 bbbbxn.exe 36 PID 2156 wrote to memory of 2944 2156 tddhvv.exe 37 PID 2156 wrote to memory of 2944 2156 tddhvv.exe 37 PID 2156 wrote to memory of 2944 2156 tddhvv.exe 37 PID 2156 wrote to memory of 2944 2156 tddhvv.exe 37 PID 2944 wrote to memory of 2452 2944 tvhpfl.exe 38 PID 2944 wrote to memory of 2452 2944 tvhpfl.exe 38 PID 2944 wrote to memory of 2452 2944 tvhpfl.exe 38 PID 2944 wrote to memory of 2452 2944 tvhpfl.exe 38 PID 2452 wrote to memory of 924 2452 dxfxb.exe 39 PID 2452 wrote to memory of 924 2452 dxfxb.exe 39 PID 2452 wrote to memory of 924 2452 dxfxb.exe 39 PID 2452 wrote to memory of 924 2452 dxfxb.exe 39 PID 924 wrote to memory of 2032 924 rtrvbrl.exe 40 PID 924 wrote to memory of 2032 924 rtrvbrl.exe 40 PID 924 wrote to memory of 2032 924 rtrvbrl.exe 40 PID 924 wrote to memory of 2032 924 rtrvbrl.exe 40 PID 2032 wrote to memory of 2996 2032 hhxpdrv.exe 41 PID 2032 wrote to memory of 2996 2032 hhxpdrv.exe 41 PID 2032 wrote to memory of 2996 2032 hhxpdrv.exe 41 PID 2032 wrote to memory of 2996 2032 hhxpdrv.exe 41 PID 2996 wrote to memory of 1976 2996 tjxvdv.exe 42 PID 2996 wrote to memory of 1976 2996 tjxvdv.exe 42 PID 2996 wrote to memory of 1976 2996 tjxvdv.exe 42 PID 2996 wrote to memory of 1976 2996 tjxvdv.exe 42 PID 1976 wrote to memory of 1664 1976 nbdnvnv.exe 43 PID 1976 wrote to memory of 1664 1976 nbdnvnv.exe 43 PID 1976 wrote to memory of 1664 1976 nbdnvnv.exe 43 PID 1976 wrote to memory of 1664 1976 nbdnvnv.exe 43 PID 1664 wrote to memory of 2444 1664 jxhxv.exe 44 PID 1664 wrote to memory of 2444 1664 jxhxv.exe 44 PID 1664 wrote to memory of 2444 1664 jxhxv.exe 44 PID 1664 wrote to memory of 2444 1664 jxhxv.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\190940fe80dcc97ffe5946c53b05076bd65a7b0147c486dafa9c41fdc8418ea4.exe"C:\Users\Admin\AppData\Local\Temp\190940fe80dcc97ffe5946c53b05076bd65a7b0147c486dafa9c41fdc8418ea4.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\rjllndr.exec:\rjllndr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\jrplh.exec:\jrplh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\tfxxflr.exec:\tfxxflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\vlvnl.exec:\vlvnl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\lxtpd.exec:\lxtpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\rjrljd.exec:\rjrljd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\bbbbxn.exec:\bbbbxn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\tddhvv.exec:\tddhvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\tvhpfl.exec:\tvhpfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\dxfxb.exec:\dxfxb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\rtrvbrl.exec:\rtrvbrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\hhxpdrv.exec:\hhxpdrv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\tjxvdv.exec:\tjxvdv.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\nbdnvnv.exec:\nbdnvnv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\jxhxv.exec:\jxhxv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\jtplhd.exec:\jtplhd.exe17⤵
- Executes dropped EXE
PID:2444 -
\??\c:\jtxhv.exec:\jtxhv.exe18⤵
- Executes dropped EXE
PID:1212 -
\??\c:\vdhnpd.exec:\vdhnpd.exe19⤵
- Executes dropped EXE
PID:1820 -
\??\c:\ttdlv.exec:\ttdlv.exe20⤵
- Executes dropped EXE
PID:1328 -
\??\c:\jjpfpx.exec:\jjpfpx.exe21⤵
- Executes dropped EXE
PID:2184 -
\??\c:\dprtxfv.exec:\dprtxfv.exe22⤵
- Executes dropped EXE
PID:2520 -
\??\c:\lhlbbpp.exec:\lhlbbpp.exe23⤵
- Executes dropped EXE
PID:2068 -
\??\c:\vdnld.exec:\vdnld.exe24⤵
- Executes dropped EXE
PID:1796 -
\??\c:\rddhhn.exec:\rddhhn.exe25⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rvflrnr.exec:\rvflrnr.exe26⤵
- Executes dropped EXE
PID:2624 -
\??\c:\bdxjlf.exec:\bdxjlf.exe27⤵
- Executes dropped EXE
PID:1784 -
\??\c:\btbdrd.exec:\btbdrd.exe28⤵
- Executes dropped EXE
PID:1764 -
\??\c:\nhdhptx.exec:\nhdhptx.exe29⤵
- Executes dropped EXE
PID:920 -
\??\c:\xtnrtj.exec:\xtnrtj.exe30⤵
- Executes dropped EXE
PID:2008 -
\??\c:\bvxll.exec:\bvxll.exe31⤵
- Executes dropped EXE
PID:1152 -
\??\c:\hxfhl.exec:\hxfhl.exe32⤵
- Executes dropped EXE
PID:1816 -
\??\c:\nvhfllv.exec:\nvhfllv.exe33⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ftvhtrb.exec:\ftvhtrb.exe34⤵
- Executes dropped EXE
PID:696 -
\??\c:\rlnrpv.exec:\rlnrpv.exe35⤵PID:1704
-
\??\c:\ttrxtf.exec:\ttrxtf.exe36⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rthdb.exec:\rthdb.exe37⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vtlhhx.exec:\vtlhhx.exe38⤵
- Executes dropped EXE
PID:1720 -
\??\c:\ldvfn.exec:\ldvfn.exe39⤵
- Executes dropped EXE
PID:2104 -
\??\c:\nvthll.exec:\nvthll.exe40⤵
- Executes dropped EXE
PID:2876 -
\??\c:\pnrrdl.exec:\pnrrdl.exe41⤵
- Executes dropped EXE
PID:2132 -
\??\c:\hfnlpx.exec:\hfnlpx.exe42⤵
- Executes dropped EXE
PID:2856 -
\??\c:\bfrrp.exec:\bfrrp.exe43⤵
- Executes dropped EXE
PID:2728 -
\??\c:\njvdv.exec:\njvdv.exe44⤵
- Executes dropped EXE
PID:2136 -
\??\c:\fljdb.exec:\fljdb.exe45⤵
- Executes dropped EXE
PID:692 -
\??\c:\pbffbh.exec:\pbffbh.exe46⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xfttjpb.exec:\xfttjpb.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1188 -
\??\c:\ddljhdb.exec:\ddljhdb.exe48⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ntlld.exec:\ntlld.exe49⤵
- Executes dropped EXE
PID:2760 -
\??\c:\nddvfbt.exec:\nddvfbt.exe50⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pnlnjj.exec:\pnlnjj.exe51⤵
- Executes dropped EXE
PID:3020 -
\??\c:\hrjtp.exec:\hrjtp.exe52⤵
- Executes dropped EXE
PID:2948 -
\??\c:\phnpj.exec:\phnpj.exe53⤵
- Executes dropped EXE
PID:1216 -
\??\c:\lbrlx.exec:\lbrlx.exe54⤵
- Executes dropped EXE
PID:2964 -
\??\c:\vrdvlr.exec:\vrdvlr.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1976 -
\??\c:\ntlxpt.exec:\ntlxpt.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2232 -
\??\c:\trtrb.exec:\trtrb.exe57⤵
- Executes dropped EXE
PID:2084 -
\??\c:\trhnl.exec:\trhnl.exe58⤵
- Executes dropped EXE
PID:1372 -
\??\c:\prlltt.exec:\prlltt.exe59⤵
- Executes dropped EXE
PID:824 -
\??\c:\jnvnd.exec:\jnvnd.exe60⤵
- Executes dropped EXE
PID:1872 -
\??\c:\vrjrr.exec:\vrjrr.exe61⤵
- Executes dropped EXE
PID:1328 -
\??\c:\vllvjp.exec:\vllvjp.exe62⤵
- Executes dropped EXE
PID:2372 -
\??\c:\nbdvtnd.exec:\nbdvtnd.exe63⤵
- Executes dropped EXE
PID:2632 -
\??\c:\ptbvp.exec:\ptbvp.exe64⤵
- Executes dropped EXE
PID:1804 -
\??\c:\phdlpbp.exec:\phdlpbp.exe65⤵
- Executes dropped EXE
PID:948 -
\??\c:\htlxxxf.exec:\htlxxxf.exe66⤵
- Executes dropped EXE
PID:1796 -
\??\c:\pjblhl.exec:\pjblhl.exe67⤵PID:1752
-
\??\c:\ftjrt.exec:\ftjrt.exe68⤵PID:864
-
\??\c:\bpdbx.exec:\bpdbx.exe69⤵PID:1484
-
\??\c:\xdtfrn.exec:\xdtfrn.exe70⤵PID:1812
-
\??\c:\rfjnd.exec:\rfjnd.exe71⤵PID:960
-
\??\c:\ttrlvp.exec:\ttrlvp.exe72⤵PID:2016
-
\??\c:\jrnvpnj.exec:\jrnvpnj.exe73⤵PID:2280
-
\??\c:\ntnnn.exec:\ntnnn.exe74⤵PID:1300
-
\??\c:\fbbhb.exec:\fbbhb.exe75⤵PID:2144
-
\??\c:\hlvfdn.exec:\hlvfdn.exe76⤵PID:1588
-
\??\c:\pbnflt.exec:\pbnflt.exe77⤵PID:1108
-
\??\c:\tlltbht.exec:\tlltbht.exe78⤵PID:1996
-
\??\c:\rvnhjtj.exec:\rvnhjtj.exe79⤵PID:696
-
\??\c:\fvbhttn.exec:\fvbhttn.exe80⤵PID:2540
-
\??\c:\vvldx.exec:\vvldx.exe81⤵PID:2756
-
\??\c:\rtnrnhd.exec:\rtnrnhd.exe82⤵PID:1608
-
\??\c:\xrrdpvp.exec:\xrrdpvp.exe83⤵PID:2908
-
\??\c:\hllhn.exec:\hllhn.exe84⤵PID:2884
-
\??\c:\txlpr.exec:\txlpr.exe85⤵PID:1660
-
\??\c:\hvjfft.exec:\hvjfft.exe86⤵PID:2824
-
\??\c:\bfvtxrv.exec:\bfvtxrv.exe87⤵PID:2672
-
\??\c:\bbvljhr.exec:\bbvljhr.exe88⤵
- System Location Discovery: System Language Discovery
PID:2832 -
\??\c:\tvjpjtl.exec:\tvjpjtl.exe89⤵PID:2708
-
\??\c:\jjlrlf.exec:\jjlrlf.exe90⤵PID:2644
-
\??\c:\tltvfb.exec:\tltvfb.exe91⤵PID:2440
-
\??\c:\rhprd.exec:\rhprd.exe92⤵PID:1048
-
\??\c:\ltlhhtn.exec:\ltlhhtn.exe93⤵PID:1732
-
\??\c:\jrppl.exec:\jrppl.exe94⤵PID:3028
-
\??\c:\tjtlddt.exec:\tjtlddt.exe95⤵PID:1164
-
\??\c:\hvdjnx.exec:\hvdjnx.exe96⤵PID:3032
-
\??\c:\xfhnhv.exec:\xfhnhv.exe97⤵PID:848
-
\??\c:\llhpt.exec:\llhpt.exe98⤵PID:2472
-
\??\c:\dftltx.exec:\dftltx.exe99⤵PID:2020
-
\??\c:\ndhxrt.exec:\ndhxrt.exe100⤵PID:1076
-
\??\c:\nthhb.exec:\nthhb.exe101⤵PID:1976
-
\??\c:\ndtdj.exec:\ndtdj.exe102⤵PID:1644
-
\??\c:\dlnxv.exec:\dlnxv.exe103⤵PID:2400
-
\??\c:\dfrbfx.exec:\dfrbfx.exe104⤵PID:2168
-
\??\c:\rfbblx.exec:\rfbblx.exe105⤵PID:2224
-
\??\c:\tlljn.exec:\tlljn.exe106⤵PID:2364
-
\??\c:\nnvpfj.exec:\nnvpfj.exe107⤵PID:2184
-
\??\c:\pbdbfdd.exec:\pbdbfdd.exe108⤵PID:2520
-
\??\c:\jlnlt.exec:\jlnlt.exe109⤵PID:2460
-
\??\c:\hxfftbv.exec:\hxfftbv.exe110⤵PID:1520
-
\??\c:\lpbrjvh.exec:\lpbrjvh.exe111⤵PID:2564
-
\??\c:\phbjd.exec:\phbjd.exe112⤵PID:2496
-
\??\c:\llrhh.exec:\llrhh.exe113⤵PID:560
-
\??\c:\xbbxv.exec:\xbbxv.exe114⤵PID:1724
-
\??\c:\txdpf.exec:\txdpf.exe115⤵PID:1712
-
\??\c:\hnrtxrf.exec:\hnrtxrf.exe116⤵PID:1868
-
\??\c:\bbnnbtp.exec:\bbnnbtp.exe117⤵PID:2516
-
\??\c:\tnhthdb.exec:\tnhthdb.exe118⤵PID:1736
-
\??\c:\jrrbtdd.exec:\jrrbtdd.exe119⤵PID:2436
-
\??\c:\tbfllhn.exec:\tbfllhn.exe120⤵PID:2404
-
\??\c:\nvvlt.exec:\nvvlt.exe121⤵PID:2188
-
\??\c:\txffrfn.exec:\txffrfn.exe122⤵PID:1980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-