Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 20:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
23342650f890cb44811530777913f749504f6c4007c1fcb4e8ea06d53ac1023d.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
23342650f890cb44811530777913f749504f6c4007c1fcb4e8ea06d53ac1023d.exe
-
Size
454KB
-
MD5
22d677bacb60344e879fb9042b9a1313
-
SHA1
07bec762950b9ca0804d7cf7d20f725f3923a436
-
SHA256
23342650f890cb44811530777913f749504f6c4007c1fcb4e8ea06d53ac1023d
-
SHA512
9b58f207c77287de40569fd9425dc0ada962bcf3c96b5327a1ad185c308f3772c2b73e949d10b5e78679555fc3934cb2718e32e6d6d57bd866f57dbfad931206
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2740-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-28-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2788-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-67-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2176-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/544-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1292-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/328-263-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2032-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-345-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2608-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-435-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1776-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-511-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/536-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-526-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/564-551-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1304-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-560-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1592-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-720-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-934-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2604-987-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2284-1032-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2004-1040-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-1047-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2832 btpxln.exe 2788 frrpl.exe 3064 bpffvl.exe 2660 ldvntvn.exe 2060 fdplrlt.exe 2680 dltjtd.exe 2232 trjfd.exe 2176 rdpbdr.exe 2140 fjfhpnd.exe 760 dbntnf.exe 3012 dlfdfpj.exe 1572 vplfhvn.exe 2988 vvhrdvr.exe 2880 tptnhlv.exe 1120 ppjrv.exe 1668 rdjft.exe 544 pjrljt.exe 2452 nrpbhhx.exe 1924 fphxp.exe 2348 hbhnldn.exe 2500 lbdrv.exe 1360 jbpnndd.exe 2064 lnnrt.exe 1908 jdhjh.exe 1868 jdjnft.exe 1292 brhbr.exe 1764 jnhdlhl.exe 328 hdbbxj.exe 2548 dvfhdh.exe 2032 fnvvrp.exe 2308 hrjjx.exe 868 xljpl.exe 744 jvfbr.exe 2844 ftblxr.exe 1684 vlnjdpt.exe 3068 pfbtjj.exe 2456 djlrf.exe 2200 vbrpjh.exe 2664 pdlhbx.exe 2660 hpvfdf.exe 2772 prppf.exe 2700 lpllp.exe 2588 brbhtpn.exe 548 hvtdhn.exe 2608 rtnxph.exe 2344 rfhbpv.exe 2140 bpxfh.exe 3024 pfrnjj.exe 1476 jdnfpd.exe 2696 hrxjlh.exe 2892 xbjdh.exe 2952 hnnbp.exe 2416 rpbblj.exe 1940 lfvlhtj.exe 1776 rnnxrn.exe 764 fvlhfv.exe 2432 rhbff.exe 2512 dhjlfv.exe 1184 tjvnp.exe 2388 prndj.exe 2192 xvvnlpp.exe 388 rllfxt.exe 880 vbrtrx.exe 1672 txjtnr.exe -
resource yara_rule behavioral1/memory/2740-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-852-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-883-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-1040-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtnxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drvhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtvpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nddlpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jflllvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvljttp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frvjnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldxfht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnltrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnbhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfjfbjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtnpfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fblbjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltflvtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thxnnrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfhrfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrpxhjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjtflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfhbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdnbbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbjvpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvxljd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldjppn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhvxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpjtjnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnjnxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlbjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxndt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdpfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbrtrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjlrlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdprv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjbbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjtdlfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lthntv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpjbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2740 wrote to memory of 2832 2740 23342650f890cb44811530777913f749504f6c4007c1fcb4e8ea06d53ac1023d.exe 30 PID 2740 wrote to memory of 2832 2740 23342650f890cb44811530777913f749504f6c4007c1fcb4e8ea06d53ac1023d.exe 30 PID 2740 wrote to memory of 2832 2740 23342650f890cb44811530777913f749504f6c4007c1fcb4e8ea06d53ac1023d.exe 30 PID 2740 wrote to memory of 2832 2740 23342650f890cb44811530777913f749504f6c4007c1fcb4e8ea06d53ac1023d.exe 30 PID 2832 wrote to memory of 2788 2832 btpxln.exe 31 PID 2832 wrote to memory of 2788 2832 btpxln.exe 31 PID 2832 wrote to memory of 2788 2832 btpxln.exe 31 PID 2832 wrote to memory of 2788 2832 btpxln.exe 31 PID 2788 wrote to memory of 3064 2788 frrpl.exe 32 PID 2788 wrote to memory of 3064 2788 frrpl.exe 32 PID 2788 wrote to memory of 3064 2788 frrpl.exe 32 PID 2788 wrote to memory of 3064 2788 frrpl.exe 32 PID 3064 wrote to memory of 2660 3064 bpffvl.exe 33 PID 3064 wrote to memory of 2660 3064 bpffvl.exe 33 PID 3064 wrote to memory of 2660 3064 bpffvl.exe 33 PID 3064 wrote to memory of 2660 3064 bpffvl.exe 33 PID 2660 wrote to memory of 2060 2660 ldvntvn.exe 34 PID 2660 wrote to memory of 2060 2660 ldvntvn.exe 34 PID 2660 wrote to memory of 2060 2660 ldvntvn.exe 34 PID 2660 wrote to memory of 2060 2660 ldvntvn.exe 34 PID 2060 wrote to memory of 2680 2060 fdplrlt.exe 35 PID 2060 wrote to memory of 2680 2060 fdplrlt.exe 35 PID 2060 wrote to memory of 2680 2060 fdplrlt.exe 35 PID 2060 wrote to memory of 2680 2060 fdplrlt.exe 35 PID 2680 wrote to memory of 2232 2680 dltjtd.exe 36 PID 2680 wrote to memory of 2232 2680 dltjtd.exe 36 PID 2680 wrote to memory of 2232 2680 dltjtd.exe 36 PID 2680 wrote to memory of 2232 2680 dltjtd.exe 36 PID 2232 wrote to memory of 2176 2232 trjfd.exe 37 PID 2232 wrote to memory of 2176 2232 trjfd.exe 37 PID 2232 wrote to memory of 2176 2232 trjfd.exe 37 PID 2232 wrote to memory of 2176 2232 trjfd.exe 37 PID 2176 wrote to memory of 2140 2176 rdpbdr.exe 38 PID 2176 wrote to memory of 2140 2176 rdpbdr.exe 38 PID 2176 wrote to memory of 2140 2176 rdpbdr.exe 38 PID 2176 wrote to memory of 2140 2176 rdpbdr.exe 38 PID 2140 wrote to memory of 760 2140 fjfhpnd.exe 39 PID 2140 wrote to memory of 760 2140 fjfhpnd.exe 39 PID 2140 wrote to memory of 760 2140 fjfhpnd.exe 39 PID 2140 wrote to memory of 760 2140 fjfhpnd.exe 39 PID 760 wrote to memory of 3012 760 dbntnf.exe 40 PID 760 wrote to memory of 3012 760 dbntnf.exe 40 PID 760 wrote to memory of 3012 760 dbntnf.exe 40 PID 760 wrote to memory of 3012 760 dbntnf.exe 40 PID 3012 wrote to memory of 1572 3012 dlfdfpj.exe 41 PID 3012 wrote to memory of 1572 3012 dlfdfpj.exe 41 PID 3012 wrote to memory of 1572 3012 dlfdfpj.exe 41 PID 3012 wrote to memory of 1572 3012 dlfdfpj.exe 41 PID 1572 wrote to memory of 2988 1572 vplfhvn.exe 42 PID 1572 wrote to memory of 2988 1572 vplfhvn.exe 42 PID 1572 wrote to memory of 2988 1572 vplfhvn.exe 42 PID 1572 wrote to memory of 2988 1572 vplfhvn.exe 42 PID 2988 wrote to memory of 2880 2988 vvhrdvr.exe 43 PID 2988 wrote to memory of 2880 2988 vvhrdvr.exe 43 PID 2988 wrote to memory of 2880 2988 vvhrdvr.exe 43 PID 2988 wrote to memory of 2880 2988 vvhrdvr.exe 43 PID 2880 wrote to memory of 1120 2880 tptnhlv.exe 44 PID 2880 wrote to memory of 1120 2880 tptnhlv.exe 44 PID 2880 wrote to memory of 1120 2880 tptnhlv.exe 44 PID 2880 wrote to memory of 1120 2880 tptnhlv.exe 44 PID 1120 wrote to memory of 1668 1120 ppjrv.exe 45 PID 1120 wrote to memory of 1668 1120 ppjrv.exe 45 PID 1120 wrote to memory of 1668 1120 ppjrv.exe 45 PID 1120 wrote to memory of 1668 1120 ppjrv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\23342650f890cb44811530777913f749504f6c4007c1fcb4e8ea06d53ac1023d.exe"C:\Users\Admin\AppData\Local\Temp\23342650f890cb44811530777913f749504f6c4007c1fcb4e8ea06d53ac1023d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\btpxln.exec:\btpxln.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\frrpl.exec:\frrpl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\bpffvl.exec:\bpffvl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\ldvntvn.exec:\ldvntvn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\fdplrlt.exec:\fdplrlt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\dltjtd.exec:\dltjtd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\trjfd.exec:\trjfd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\rdpbdr.exec:\rdpbdr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\fjfhpnd.exec:\fjfhpnd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\dbntnf.exec:\dbntnf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\dlfdfpj.exec:\dlfdfpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\vplfhvn.exec:\vplfhvn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\vvhrdvr.exec:\vvhrdvr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\tptnhlv.exec:\tptnhlv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\ppjrv.exec:\ppjrv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\rdjft.exec:\rdjft.exe17⤵
- Executes dropped EXE
PID:1668 -
\??\c:\pjrljt.exec:\pjrljt.exe18⤵
- Executes dropped EXE
PID:544 -
\??\c:\nrpbhhx.exec:\nrpbhhx.exe19⤵
- Executes dropped EXE
PID:2452 -
\??\c:\fphxp.exec:\fphxp.exe20⤵
- Executes dropped EXE
PID:1924 -
\??\c:\hbhnldn.exec:\hbhnldn.exe21⤵
- Executes dropped EXE
PID:2348 -
\??\c:\lbdrv.exec:\lbdrv.exe22⤵
- Executes dropped EXE
PID:2500 -
\??\c:\jbpnndd.exec:\jbpnndd.exe23⤵
- Executes dropped EXE
PID:1360 -
\??\c:\lnnrt.exec:\lnnrt.exe24⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jdhjh.exec:\jdhjh.exe25⤵
- Executes dropped EXE
PID:1908 -
\??\c:\jdjnft.exec:\jdjnft.exe26⤵
- Executes dropped EXE
PID:1868 -
\??\c:\brhbr.exec:\brhbr.exe27⤵
- Executes dropped EXE
PID:1292 -
\??\c:\jnhdlhl.exec:\jnhdlhl.exe28⤵
- Executes dropped EXE
PID:1764 -
\??\c:\hdbbxj.exec:\hdbbxj.exe29⤵
- Executes dropped EXE
PID:328 -
\??\c:\dvfhdh.exec:\dvfhdh.exe30⤵
- Executes dropped EXE
PID:2548 -
\??\c:\fnvvrp.exec:\fnvvrp.exe31⤵
- Executes dropped EXE
PID:2032 -
\??\c:\hrjjx.exec:\hrjjx.exe32⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xljpl.exec:\xljpl.exe33⤵
- Executes dropped EXE
PID:868 -
\??\c:\jvfbr.exec:\jvfbr.exe34⤵
- Executes dropped EXE
PID:744 -
\??\c:\ftblxr.exec:\ftblxr.exe35⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vlnjdpt.exec:\vlnjdpt.exe36⤵
- Executes dropped EXE
PID:1684 -
\??\c:\pfbtjj.exec:\pfbtjj.exe37⤵
- Executes dropped EXE
PID:3068 -
\??\c:\djlrf.exec:\djlrf.exe38⤵
- Executes dropped EXE
PID:2456 -
\??\c:\vbrpjh.exec:\vbrpjh.exe39⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pdlhbx.exec:\pdlhbx.exe40⤵
- Executes dropped EXE
PID:2664 -
\??\c:\hpvfdf.exec:\hpvfdf.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\prppf.exec:\prppf.exe42⤵
- Executes dropped EXE
PID:2772 -
\??\c:\lpllp.exec:\lpllp.exe43⤵
- Executes dropped EXE
PID:2700 -
\??\c:\brbhtpn.exec:\brbhtpn.exe44⤵
- Executes dropped EXE
PID:2588 -
\??\c:\hvtdhn.exec:\hvtdhn.exe45⤵
- Executes dropped EXE
PID:548 -
\??\c:\rtnxph.exec:\rtnxph.exe46⤵
- Executes dropped EXE
PID:2608 -
\??\c:\rfhbpv.exec:\rfhbpv.exe47⤵
- Executes dropped EXE
PID:2344 -
\??\c:\bpxfh.exec:\bpxfh.exe48⤵
- Executes dropped EXE
PID:2140 -
\??\c:\pfrnjj.exec:\pfrnjj.exe49⤵
- Executes dropped EXE
PID:3024 -
\??\c:\jdnfpd.exec:\jdnfpd.exe50⤵
- Executes dropped EXE
PID:1476 -
\??\c:\hrxjlh.exec:\hrxjlh.exe51⤵
- Executes dropped EXE
PID:2696 -
\??\c:\xbjdh.exec:\xbjdh.exe52⤵
- Executes dropped EXE
PID:2892 -
\??\c:\hnnbp.exec:\hnnbp.exe53⤵
- Executes dropped EXE
PID:2952 -
\??\c:\rpbblj.exec:\rpbblj.exe54⤵
- Executes dropped EXE
PID:2416 -
\??\c:\lfvlhtj.exec:\lfvlhtj.exe55⤵
- Executes dropped EXE
PID:1940 -
\??\c:\rnnxrn.exec:\rnnxrn.exe56⤵
- Executes dropped EXE
PID:1776 -
\??\c:\fvlhfv.exec:\fvlhfv.exe57⤵
- Executes dropped EXE
PID:764 -
\??\c:\rhbff.exec:\rhbff.exe58⤵
- Executes dropped EXE
PID:2432 -
\??\c:\dhjlfv.exec:\dhjlfv.exe59⤵
- Executes dropped EXE
PID:2512 -
\??\c:\tjvnp.exec:\tjvnp.exe60⤵
- Executes dropped EXE
PID:1184 -
\??\c:\prndj.exec:\prndj.exe61⤵
- Executes dropped EXE
PID:2388 -
\??\c:\xvvnlpp.exec:\xvvnlpp.exe62⤵
- Executes dropped EXE
PID:2192 -
\??\c:\rllfxt.exec:\rllfxt.exe63⤵
- Executes dropped EXE
PID:388 -
\??\c:\vbrtrx.exec:\vbrtrx.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:880 -
\??\c:\txjtnr.exec:\txjtnr.exe65⤵
- Executes dropped EXE
PID:1672 -
\??\c:\dhlbnnj.exec:\dhlbnnj.exe66⤵PID:536
-
\??\c:\pfpfdl.exec:\pfpfdl.exe67⤵PID:1952
-
\??\c:\fhrfj.exec:\fhrfj.exe68⤵PID:2716
-
\??\c:\pvvhh.exec:\pvvhh.exe69⤵PID:3004
-
\??\c:\hbdbbxx.exec:\hbdbbxx.exe70⤵PID:640
-
\??\c:\nttvdt.exec:\nttvdt.exe71⤵PID:564
-
\??\c:\bffrxtn.exec:\bffrxtn.exe72⤵PID:1304
-
\??\c:\brbnxj.exec:\brbnxj.exe73⤵PID:684
-
\??\c:\nbthf.exec:\nbthf.exe74⤵PID:2220
-
\??\c:\pnbxn.exec:\pnbxn.exe75⤵PID:2368
-
\??\c:\njdnd.exec:\njdnd.exe76⤵PID:2856
-
\??\c:\xftdnfj.exec:\xftdnfj.exe77⤵PID:868
-
\??\c:\rnjtv.exec:\rnjtv.exe78⤵PID:1592
-
\??\c:\tbfjp.exec:\tbfjp.exe79⤵PID:2844
-
\??\c:\xptbrh.exec:\xptbrh.exe80⤵PID:2756
-
\??\c:\hjlhpx.exec:\hjlhpx.exe81⤵PID:2808
-
\??\c:\jxlvf.exec:\jxlvf.exe82⤵PID:2456
-
\??\c:\thxnnrj.exec:\thxnnrj.exe83⤵
- System Location Discovery: System Language Discovery
PID:2768 -
\??\c:\hxhnlv.exec:\hxhnlv.exe84⤵PID:3032
-
\??\c:\ljxll.exec:\ljxll.exe85⤵PID:2636
-
\??\c:\nbrlp.exec:\nbrlp.exe86⤵PID:1520
-
\??\c:\jpbph.exec:\jpbph.exe87⤵PID:2256
-
\??\c:\nxpbrfr.exec:\nxpbrfr.exe88⤵PID:1072
-
\??\c:\blllhnt.exec:\blllhnt.exe89⤵PID:2024
-
\??\c:\tptrn.exec:\tptrn.exe90⤵PID:2324
-
\??\c:\rbrthtl.exec:\rbrthtl.exe91⤵PID:2112
-
\??\c:\pnhbb.exec:\pnhbb.exe92⤵PID:2380
-
\??\c:\jpxfld.exec:\jpxfld.exe93⤵PID:2088
-
\??\c:\rnvfr.exec:\rnvfr.exe94⤵PID:3000
-
\??\c:\jxjhjd.exec:\jxjhjd.exe95⤵PID:980
-
\??\c:\xfjxv.exec:\xfjxv.exe96⤵PID:2956
-
\??\c:\fptxhn.exec:\fptxhn.exe97⤵PID:2984
-
\??\c:\nxnlhd.exec:\nxnlhd.exe98⤵PID:2404
-
\??\c:\fbjbrnv.exec:\fbjbrnv.exe99⤵PID:1264
-
\??\c:\tvhpjt.exec:\tvhpjt.exe100⤵PID:2100
-
\??\c:\trvtl.exec:\trvtl.exe101⤵PID:1640
-
\??\c:\pdbvpb.exec:\pdbvpb.exe102⤵PID:1900
-
\??\c:\jhlbd.exec:\jhlbd.exe103⤵PID:2396
-
\??\c:\pfnhl.exec:\pfnhl.exe104⤵PID:2068
-
\??\c:\rxvfbvp.exec:\rxvfbvp.exe105⤵PID:2132
-
\??\c:\vtnhx.exec:\vtnhx.exe106⤵PID:1960
-
\??\c:\pltdxfh.exec:\pltdxfh.exe107⤵PID:2532
-
\??\c:\btjtpl.exec:\btjtpl.exe108⤵PID:1360
-
\??\c:\bbldp.exec:\bbldp.exe109⤵PID:952
-
\??\c:\drdvbnl.exec:\drdvbnl.exe110⤵PID:2460
-
\??\c:\hbtxxhf.exec:\hbtxxhf.exe111⤵PID:580
-
\??\c:\dtvpvpp.exec:\dtvpvpp.exe112⤵
- System Location Discovery: System Language Discovery
PID:1340 -
\??\c:\hjftbp.exec:\hjftbp.exe113⤵PID:2716
-
\??\c:\rxfjf.exec:\rxfjf.exe114⤵PID:3060
-
\??\c:\rjjdn.exec:\rjjdn.exe115⤵PID:928
-
\??\c:\hftbtt.exec:\hftbtt.exe116⤵PID:1800
-
\??\c:\ldffbnp.exec:\ldffbnp.exe117⤵PID:2300
-
\??\c:\bhlpjt.exec:\bhlpjt.exe118⤵PID:2228
-
\??\c:\vvrlfh.exec:\vvrlfh.exe119⤵PID:812
-
\??\c:\vpnfjpd.exec:\vpnfjpd.exe120⤵PID:1256
-
\??\c:\lvtfd.exec:\lvtfd.exe121⤵PID:1504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-