Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 21:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2ad39224ce558f5943897b8f24faa88006edfd5c118e6a0792d501f23c1e7b39.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
2ad39224ce558f5943897b8f24faa88006edfd5c118e6a0792d501f23c1e7b39.exe
-
Size
454KB
-
MD5
be7921a406d588b299bd44790020616f
-
SHA1
be50e71289be2158afe8e30795722c0e7b43a477
-
SHA256
2ad39224ce558f5943897b8f24faa88006edfd5c118e6a0792d501f23c1e7b39
-
SHA512
4afabc0c7ec2102b9eb67401f326adc2394d341a102bedaa4304da208983b4719dfb48394a70372bf78c676584a6266a51323c6698ce66b1f7c99f628eecc248
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeVV:q7Tc2NYHUrAwfMp3CDVV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2116-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/756-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/644-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/108-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-339-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1912-237-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1772-235-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1964-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1224-412-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1868-476-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1372-524-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2688-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-552-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1544-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-624-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2980-660-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-807-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1664-836-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2556-856-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1472-869-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/1916-885-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2580 ftbpl.exe 756 pdjfxv.exe 3008 xfxjlpl.exe 2444 rbtdv.exe 2932 hnjxlb.exe 644 phjtndd.exe 2680 pnvxbt.exe 1656 xjbfj.exe 2956 nxbdfht.exe 1956 lppbfbn.exe 2352 hvrhhb.exe 1752 btppdb.exe 2548 ljdpl.exe 3016 xjfvxdl.exe 324 dnlvxv.exe 1964 hjtfb.exe 1592 ttfxdd.exe 2148 thfdlrn.exe 2056 bffrtdj.exe 2492 lnrrflt.exe 904 rfplbf.exe 1912 txbtx.exe 2628 pxdxt.exe 456 hfpjpv.exe 1772 phtfxdf.exe 1428 pprtnpt.exe 108 nbpxxx.exe 1312 dtrpxp.exe 1684 tdlnvdj.exe 1928 rpjvpj.exe 1032 jthdxpx.exe 1736 drrnlp.exe 1236 fvvpvxd.exe 1628 bljnrnv.exe 1916 hpfhd.exe 1892 xfdhrnb.exe 3008 djpjhtt.exe 2924 nrfnbn.exe 2816 vpfdpn.exe 584 vdxxbb.exe 3000 hhhvlx.exe 2760 jhxhjf.exe 2624 htfrbl.exe 2740 jjlrb.exe 2376 djftb.exe 928 dhprbn.exe 1956 hndbhj.exe 1872 bxjrtfx.exe 1224 fxtdrxj.exe 2364 hrltj.exe 2820 trhvlf.exe 2900 pfnpth.exe 396 vndpldn.exe 1952 xbtdfj.exe 320 lbblj.exe 640 tvpdpt.exe 1552 frnxfln.exe 2144 hllvt.exe 1868 djrnj.exe 904 xjnrn.exe 2248 dddtr.exe 1440 lhfjlb.exe 1972 vlvdvdd.exe 2432 xdltrv.exe -
resource yara_rule behavioral1/memory/2116-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/644-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-458-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2248-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-624-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2980-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-815-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-871-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbddbdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltvnbhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jthdxpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbppjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbldfdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptlrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhldlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdtvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbpfvtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnrjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djltxjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdtvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dffpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnfhjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrrnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdhddrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpfpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vflnrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpffhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpbhfxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbvhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrrph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjtrtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxpfln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrfnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbrlrnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlpvtlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdrth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbddnr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2580 2116 2ad39224ce558f5943897b8f24faa88006edfd5c118e6a0792d501f23c1e7b39.exe 30 PID 2116 wrote to memory of 2580 2116 2ad39224ce558f5943897b8f24faa88006edfd5c118e6a0792d501f23c1e7b39.exe 30 PID 2116 wrote to memory of 2580 2116 2ad39224ce558f5943897b8f24faa88006edfd5c118e6a0792d501f23c1e7b39.exe 30 PID 2116 wrote to memory of 2580 2116 2ad39224ce558f5943897b8f24faa88006edfd5c118e6a0792d501f23c1e7b39.exe 30 PID 2580 wrote to memory of 756 2580 ftbpl.exe 31 PID 2580 wrote to memory of 756 2580 ftbpl.exe 31 PID 2580 wrote to memory of 756 2580 ftbpl.exe 31 PID 2580 wrote to memory of 756 2580 ftbpl.exe 31 PID 756 wrote to memory of 3008 756 pdjfxv.exe 66 PID 756 wrote to memory of 3008 756 pdjfxv.exe 66 PID 756 wrote to memory of 3008 756 pdjfxv.exe 66 PID 756 wrote to memory of 3008 756 pdjfxv.exe 66 PID 3008 wrote to memory of 2444 3008 xfxjlpl.exe 33 PID 3008 wrote to memory of 2444 3008 xfxjlpl.exe 33 PID 3008 wrote to memory of 2444 3008 xfxjlpl.exe 33 PID 3008 wrote to memory of 2444 3008 xfxjlpl.exe 33 PID 2444 wrote to memory of 2932 2444 rbtdv.exe 34 PID 2444 wrote to memory of 2932 2444 rbtdv.exe 34 PID 2444 wrote to memory of 2932 2444 rbtdv.exe 34 PID 2444 wrote to memory of 2932 2444 rbtdv.exe 34 PID 2932 wrote to memory of 644 2932 hnjxlb.exe 35 PID 2932 wrote to memory of 644 2932 hnjxlb.exe 35 PID 2932 wrote to memory of 644 2932 hnjxlb.exe 35 PID 2932 wrote to memory of 644 2932 hnjxlb.exe 35 PID 644 wrote to memory of 2680 644 phjtndd.exe 36 PID 644 wrote to memory of 2680 644 phjtndd.exe 36 PID 644 wrote to memory of 2680 644 phjtndd.exe 36 PID 644 wrote to memory of 2680 644 phjtndd.exe 36 PID 2680 wrote to memory of 1656 2680 pnvxbt.exe 37 PID 2680 wrote to memory of 1656 2680 pnvxbt.exe 37 PID 2680 wrote to memory of 1656 2680 pnvxbt.exe 37 PID 2680 wrote to memory of 1656 2680 pnvxbt.exe 37 PID 1656 wrote to memory of 2956 1656 xjbfj.exe 38 PID 1656 wrote to memory of 2956 1656 xjbfj.exe 38 PID 1656 wrote to memory of 2956 1656 xjbfj.exe 38 PID 1656 wrote to memory of 2956 1656 xjbfj.exe 38 PID 2956 wrote to memory of 1956 2956 nxbdfht.exe 39 PID 2956 wrote to memory of 1956 2956 nxbdfht.exe 39 PID 2956 wrote to memory of 1956 2956 nxbdfht.exe 39 PID 2956 wrote to memory of 1956 2956 nxbdfht.exe 39 PID 1956 wrote to memory of 2352 1956 lppbfbn.exe 40 PID 1956 wrote to memory of 2352 1956 lppbfbn.exe 40 PID 1956 wrote to memory of 2352 1956 lppbfbn.exe 40 PID 1956 wrote to memory of 2352 1956 lppbfbn.exe 40 PID 2352 wrote to memory of 1752 2352 hvrhhb.exe 41 PID 2352 wrote to memory of 1752 2352 hvrhhb.exe 41 PID 2352 wrote to memory of 1752 2352 hvrhhb.exe 41 PID 2352 wrote to memory of 1752 2352 hvrhhb.exe 41 PID 1752 wrote to memory of 2548 1752 btppdb.exe 42 PID 1752 wrote to memory of 2548 1752 btppdb.exe 42 PID 1752 wrote to memory of 2548 1752 btppdb.exe 42 PID 1752 wrote to memory of 2548 1752 btppdb.exe 42 PID 2548 wrote to memory of 3016 2548 ljdpl.exe 43 PID 2548 wrote to memory of 3016 2548 ljdpl.exe 43 PID 2548 wrote to memory of 3016 2548 ljdpl.exe 43 PID 2548 wrote to memory of 3016 2548 ljdpl.exe 43 PID 3016 wrote to memory of 324 3016 xjfvxdl.exe 44 PID 3016 wrote to memory of 324 3016 xjfvxdl.exe 44 PID 3016 wrote to memory of 324 3016 xjfvxdl.exe 44 PID 3016 wrote to memory of 324 3016 xjfvxdl.exe 44 PID 324 wrote to memory of 1964 324 dnlvxv.exe 45 PID 324 wrote to memory of 1964 324 dnlvxv.exe 45 PID 324 wrote to memory of 1964 324 dnlvxv.exe 45 PID 324 wrote to memory of 1964 324 dnlvxv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ad39224ce558f5943897b8f24faa88006edfd5c118e6a0792d501f23c1e7b39.exe"C:\Users\Admin\AppData\Local\Temp\2ad39224ce558f5943897b8f24faa88006edfd5c118e6a0792d501f23c1e7b39.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\ftbpl.exec:\ftbpl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\pdjfxv.exec:\pdjfxv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\xfxjlpl.exec:\xfxjlpl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\rbtdv.exec:\rbtdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\hnjxlb.exec:\hnjxlb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\phjtndd.exec:\phjtndd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\pnvxbt.exec:\pnvxbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\xjbfj.exec:\xjbfj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\nxbdfht.exec:\nxbdfht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\lppbfbn.exec:\lppbfbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\hvrhhb.exec:\hvrhhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\btppdb.exec:\btppdb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\ljdpl.exec:\ljdpl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\xjfvxdl.exec:\xjfvxdl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\dnlvxv.exec:\dnlvxv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\hjtfb.exec:\hjtfb.exe17⤵
- Executes dropped EXE
PID:1964 -
\??\c:\ttfxdd.exec:\ttfxdd.exe18⤵
- Executes dropped EXE
PID:1592 -
\??\c:\thfdlrn.exec:\thfdlrn.exe19⤵
- Executes dropped EXE
PID:2148 -
\??\c:\bffrtdj.exec:\bffrtdj.exe20⤵
- Executes dropped EXE
PID:2056 -
\??\c:\lnrrflt.exec:\lnrrflt.exe21⤵
- Executes dropped EXE
PID:2492 -
\??\c:\rfplbf.exec:\rfplbf.exe22⤵
- Executes dropped EXE
PID:904 -
\??\c:\txbtx.exec:\txbtx.exe23⤵
- Executes dropped EXE
PID:1912 -
\??\c:\pxdxt.exec:\pxdxt.exe24⤵
- Executes dropped EXE
PID:2628 -
\??\c:\hfpjpv.exec:\hfpjpv.exe25⤵
- Executes dropped EXE
PID:456 -
\??\c:\phtfxdf.exec:\phtfxdf.exe26⤵
- Executes dropped EXE
PID:1772 -
\??\c:\pprtnpt.exec:\pprtnpt.exe27⤵
- Executes dropped EXE
PID:1428 -
\??\c:\nbpxxx.exec:\nbpxxx.exe28⤵
- Executes dropped EXE
PID:108 -
\??\c:\dtrpxp.exec:\dtrpxp.exe29⤵
- Executes dropped EXE
PID:1312 -
\??\c:\tdlnvdj.exec:\tdlnvdj.exe30⤵
- Executes dropped EXE
PID:1684 -
\??\c:\rpjvpj.exec:\rpjvpj.exe31⤵
- Executes dropped EXE
PID:1928 -
\??\c:\jthdxpx.exec:\jthdxpx.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1032 -
\??\c:\drrnlp.exec:\drrnlp.exe33⤵
- Executes dropped EXE
PID:1736 -
\??\c:\fvvpvxd.exec:\fvvpvxd.exe34⤵
- Executes dropped EXE
PID:1236 -
\??\c:\bljnrnv.exec:\bljnrnv.exe35⤵
- Executes dropped EXE
PID:1628 -
\??\c:\hpfhd.exec:\hpfhd.exe36⤵
- Executes dropped EXE
PID:1916 -
\??\c:\xfdhrnb.exec:\xfdhrnb.exe37⤵
- Executes dropped EXE
PID:1892 -
\??\c:\djpjhtt.exec:\djpjhtt.exe38⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nrfnbn.exec:\nrfnbn.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2924 -
\??\c:\vpfdpn.exec:\vpfdpn.exe40⤵
- Executes dropped EXE
PID:2816 -
\??\c:\vdxxbb.exec:\vdxxbb.exe41⤵
- Executes dropped EXE
PID:584 -
\??\c:\hhhvlx.exec:\hhhvlx.exe42⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jhxhjf.exec:\jhxhjf.exe43⤵
- Executes dropped EXE
PID:2760 -
\??\c:\htfrbl.exec:\htfrbl.exe44⤵
- Executes dropped EXE
PID:2624 -
\??\c:\jjlrb.exec:\jjlrb.exe45⤵
- Executes dropped EXE
PID:2740 -
\??\c:\djftb.exec:\djftb.exe46⤵
- Executes dropped EXE
PID:2376 -
\??\c:\dhprbn.exec:\dhprbn.exe47⤵
- Executes dropped EXE
PID:928 -
\??\c:\hndbhj.exec:\hndbhj.exe48⤵
- Executes dropped EXE
PID:1956 -
\??\c:\bxjrtfx.exec:\bxjrtfx.exe49⤵
- Executes dropped EXE
PID:1872 -
\??\c:\fxtdrxj.exec:\fxtdrxj.exe50⤵
- Executes dropped EXE
PID:1224 -
\??\c:\hrltj.exec:\hrltj.exe51⤵
- Executes dropped EXE
PID:2364 -
\??\c:\trhvlf.exec:\trhvlf.exe52⤵
- Executes dropped EXE
PID:2820 -
\??\c:\pfnpth.exec:\pfnpth.exe53⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vndpldn.exec:\vndpldn.exe54⤵
- Executes dropped EXE
PID:396 -
\??\c:\xbtdfj.exec:\xbtdfj.exe55⤵
- Executes dropped EXE
PID:1952 -
\??\c:\lbblj.exec:\lbblj.exe56⤵
- Executes dropped EXE
PID:320 -
\??\c:\tvpdpt.exec:\tvpdpt.exe57⤵
- Executes dropped EXE
PID:640 -
\??\c:\frnxfln.exec:\frnxfln.exe58⤵
- Executes dropped EXE
PID:1552 -
\??\c:\hllvt.exec:\hllvt.exe59⤵
- Executes dropped EXE
PID:2144 -
\??\c:\djrnj.exec:\djrnj.exe60⤵
- Executes dropped EXE
PID:1868 -
\??\c:\xjnrn.exec:\xjnrn.exe61⤵
- Executes dropped EXE
PID:904 -
\??\c:\dddtr.exec:\dddtr.exe62⤵
- Executes dropped EXE
PID:2248 -
\??\c:\lhfjlb.exec:\lhfjlb.exe63⤵
- Executes dropped EXE
PID:1440 -
\??\c:\vlvdvdd.exec:\vlvdvdd.exe64⤵
- Executes dropped EXE
PID:1972 -
\??\c:\xdltrv.exec:\xdltrv.exe65⤵
- Executes dropped EXE
PID:2432 -
\??\c:\pttrl.exec:\pttrl.exe66⤵PID:1448
-
\??\c:\rptvbbv.exec:\rptvbbv.exe67⤵PID:1372
-
\??\c:\jdhxfpp.exec:\jdhxfpp.exe68⤵PID:2688
-
\??\c:\bvbdnv.exec:\bvbdnv.exe69⤵PID:108
-
\??\c:\txdjr.exec:\txdjr.exe70⤵PID:700
-
\??\c:\tltvbh.exec:\tltvbh.exe71⤵PID:236
-
\??\c:\fxddjf.exec:\fxddjf.exe72⤵PID:1924
-
\??\c:\dbvnpx.exec:\dbvnpx.exe73⤵PID:1504
-
\??\c:\vtnphh.exec:\vtnphh.exe74⤵PID:1544
-
\??\c:\dbnjfr.exec:\dbnjfr.exe75⤵PID:1524
-
\??\c:\bhjvtrb.exec:\bhjvtrb.exe76⤵PID:1532
-
\??\c:\vvxxvlf.exec:\vvxxvlf.exe77⤵PID:1272
-
\??\c:\jljfrjl.exec:\jljfrjl.exe78⤵PID:1536
-
\??\c:\bnftnp.exec:\bnftnp.exe79⤵PID:2068
-
\??\c:\xpjdfx.exec:\xpjdfx.exe80⤵PID:1892
-
\??\c:\bthdhbr.exec:\bthdhbr.exe81⤵PID:2444
-
\??\c:\bbbtl.exec:\bbbtl.exe82⤵PID:2936
-
\??\c:\flxpvlp.exec:\flxpvlp.exe83⤵PID:2992
-
\??\c:\xnflfd.exec:\xnflfd.exe84⤵PID:2616
-
\??\c:\lxpndv.exec:\lxpndv.exe85⤵PID:2860
-
\??\c:\bpbdbn.exec:\bpbdbn.exe86⤵PID:2876
-
\??\c:\rlxhhp.exec:\rlxhhp.exe87⤵PID:2980
-
\??\c:\tlnhn.exec:\tlnhn.exe88⤵PID:2752
-
\??\c:\fptjdtx.exec:\fptjdtx.exe89⤵PID:2836
-
\??\c:\tnnxnh.exec:\tnnxnh.exe90⤵PID:928
-
\??\c:\hbxjhfn.exec:\hbxjhfn.exe91⤵PID:1956
-
\??\c:\rnvxhhh.exec:\rnvxhhh.exe92⤵PID:3064
-
\??\c:\tvtvftf.exec:\tvtvftf.exe93⤵PID:2756
-
\??\c:\nhnnhxh.exec:\nhnnhxh.exe94⤵PID:2364
-
\??\c:\fjjpb.exec:\fjjpb.exe95⤵PID:2272
-
\??\c:\rvxnvjr.exec:\rvxnvjr.exe96⤵PID:3016
-
\??\c:\phjbp.exec:\phjbp.exe97⤵PID:1748
-
\??\c:\lhlvx.exec:\lhlvx.exe98⤵PID:2260
-
\??\c:\ppldxf.exec:\ppldxf.exe99⤵PID:2764
-
\??\c:\rhpttlh.exec:\rhpttlh.exe100⤵PID:1052
-
\??\c:\rrnfpv.exec:\rrnfpv.exe101⤵PID:2512
-
\??\c:\ntjxdp.exec:\ntjxdp.exe102⤵PID:1276
-
\??\c:\jxfjdf.exec:\jxfjdf.exe103⤵PID:1720
-
\??\c:\hlhtjf.exec:\hlhtjf.exe104⤵PID:1044
-
\??\c:\ffftflx.exec:\ffftflx.exe105⤵PID:2028
-
\??\c:\xdlhxdn.exec:\xdlhxdn.exe106⤵PID:848
-
\??\c:\lpfjd.exec:\lpfjd.exe107⤵PID:2280
-
\??\c:\lppfvjh.exec:\lppfvjh.exe108⤵PID:2600
-
\??\c:\xddnbnf.exec:\xddnbnf.exe109⤵PID:1432
-
\??\c:\nbrlrnd.exec:\nbrlrnd.exe110⤵
- System Location Discovery: System Language Discovery
PID:772 -
\??\c:\nnfvjhb.exec:\nnfvjhb.exe111⤵PID:2264
-
\??\c:\thtlphr.exec:\thtlphr.exe112⤵PID:2208
-
\??\c:\tdxvpr.exec:\tdxvpr.exe113⤵PID:532
-
\??\c:\xlxrntl.exec:\xlxrntl.exe114⤵PID:1664
-
\??\c:\xxxrpnn.exec:\xxxrpnn.exe115⤵PID:1020
-
\??\c:\dbvhf.exec:\dbvhf.exe116⤵
- System Location Discovery: System Language Discovery
PID:892 -
\??\c:\rdrth.exec:\rdrth.exe117⤵
- System Location Discovery: System Language Discovery
PID:2556 -
\??\c:\xjndb.exec:\xjndb.exe118⤵PID:896
-
\??\c:\prxrth.exec:\prxrth.exe119⤵PID:1472
-
\??\c:\hpjlhh.exec:\hpjlhh.exe120⤵PID:1628
-
\??\c:\vlvbppf.exec:\vlvbppf.exe121⤵PID:1916
-
\??\c:\rpfvxlb.exec:\rpfvxlb.exe122⤵PID:2196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-