Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 00:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
668c75a60bbe84e03228c37e98dbba73127c7e40a50df978bed62662a95dcba3.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
668c75a60bbe84e03228c37e98dbba73127c7e40a50df978bed62662a95dcba3.exe
-
Size
455KB
-
MD5
ee251d06651761b1727687534da60ca0
-
SHA1
82424f687d4c5726e6c06fcd05e1c590ff6a0695
-
SHA256
668c75a60bbe84e03228c37e98dbba73127c7e40a50df978bed62662a95dcba3
-
SHA512
9fe4869e01f6dc2d99c6025572636818c46abd228c04c6c088fd35c8472c433c9684ef175abb77999a6d57f3012ffca02842991811b9b5daecb3784d5dacfc22
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeY:q7Tc2NYHUrAwfMp3CDY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/1236-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-54-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2944-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/960-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-299-0x0000000077090000-0x00000000771AF000-memory.dmp family_blackmoon behavioral1/memory/1692-300-0x0000000076F90000-0x000000007708A000-memory.dmp family_blackmoon behavioral1/memory/2204-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-648-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-781-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/764-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-795-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-809-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2688-829-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2204-906-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2560 rjphfhl.exe 1620 tflpp.exe 2912 bljnj.exe 2616 fltnv.exe 2944 rpttp.exe 2732 xpvrr.exe 2988 bxvplj.exe 2984 xfnhrj.exe 2332 flfjrln.exe 1344 vtjrnj.exe 1872 vtdpdhj.exe 1884 nrfjxjr.exe 3064 bjltr.exe 3016 phxvb.exe 324 rftntdt.exe 1964 plvth.exe 1592 ljprxh.exe 2372 vxhdtd.exe 2056 thntj.exe 2492 xbjxf.exe 1680 lvxldnl.exe 960 dxphp.exe 2628 vtpftr.exe 832 htxrpft.exe 1772 lvjndlv.exe 1428 bxtph.exe 944 fjnvb.exe 1164 xhtnj.exe 1608 rlxnt.exe 236 pfpxvhb.exe 1744 prvdtf.exe 2696 bjlnx.exe 1692 bfjrvx.exe 2204 bhrff.exe 1640 hvxrfpv.exe 1916 hrtxj.exe 668 ppnjfth.exe 2444 xnpdbb.exe 3000 fdjbx.exe 3004 ffrhtbt.exe 2884 lrjppjf.exe 3068 hvlttbb.exe 2988 ndfblv.exe 2956 xvnxptf.exe 1632 htprxj.exe 956 lbnvtfb.exe 2324 jjbnjjx.exe 3040 nrxpjl.exe 2968 dljvnd.exe 2452 bhrnjph.exe 1348 bnfdl.exe 1576 tddll.exe 2540 jxvvfnf.exe 2288 pvvlj.exe 1868 xxxbj.exe 1648 vvvtvhn.exe 2076 hxdlbfr.exe 1488 tfltr.exe 2056 jvrtnjh.exe 2516 jnnft.exe 2368 tbhnlf.exe 2028 jrpxlr.exe 764 ddtjnl.exe 2500 bpldd.exe -
resource yara_rule behavioral1/memory/1236-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-299-0x0000000077090000-0x00000000771AF000-memory.dmp upx behavioral1/memory/2204-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-768-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-795-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-830-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-856-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-953-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-972-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxlljvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hprpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjblnlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhnft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffldrhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndrxhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pptxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtbdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pljxtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdbxtjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjnjrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tflpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdlnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxvrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnrbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llnlfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhtxvlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffdpxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrvdrhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxdlbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhbhrlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttpnbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trjvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtnrjht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrjjbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfljbxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxhbxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpprntd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrftx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbfxjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxhrft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdjfjbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbfbjj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1236 wrote to memory of 2560 1236 668c75a60bbe84e03228c37e98dbba73127c7e40a50df978bed62662a95dcba3.exe 30 PID 1236 wrote to memory of 2560 1236 668c75a60bbe84e03228c37e98dbba73127c7e40a50df978bed62662a95dcba3.exe 30 PID 1236 wrote to memory of 2560 1236 668c75a60bbe84e03228c37e98dbba73127c7e40a50df978bed62662a95dcba3.exe 30 PID 1236 wrote to memory of 2560 1236 668c75a60bbe84e03228c37e98dbba73127c7e40a50df978bed62662a95dcba3.exe 30 PID 2560 wrote to memory of 1620 2560 rjphfhl.exe 31 PID 2560 wrote to memory of 1620 2560 rjphfhl.exe 31 PID 2560 wrote to memory of 1620 2560 rjphfhl.exe 31 PID 2560 wrote to memory of 1620 2560 rjphfhl.exe 31 PID 1620 wrote to memory of 2912 1620 tflpp.exe 32 PID 1620 wrote to memory of 2912 1620 tflpp.exe 32 PID 1620 wrote to memory of 2912 1620 tflpp.exe 32 PID 1620 wrote to memory of 2912 1620 tflpp.exe 32 PID 2912 wrote to memory of 2616 2912 bljnj.exe 33 PID 2912 wrote to memory of 2616 2912 bljnj.exe 33 PID 2912 wrote to memory of 2616 2912 bljnj.exe 33 PID 2912 wrote to memory of 2616 2912 bljnj.exe 33 PID 2616 wrote to memory of 2944 2616 fltnv.exe 34 PID 2616 wrote to memory of 2944 2616 fltnv.exe 34 PID 2616 wrote to memory of 2944 2616 fltnv.exe 34 PID 2616 wrote to memory of 2944 2616 fltnv.exe 34 PID 2944 wrote to memory of 2732 2944 rpttp.exe 35 PID 2944 wrote to memory of 2732 2944 rpttp.exe 35 PID 2944 wrote to memory of 2732 2944 rpttp.exe 35 PID 2944 wrote to memory of 2732 2944 rpttp.exe 35 PID 2732 wrote to memory of 2988 2732 xpvrr.exe 36 PID 2732 wrote to memory of 2988 2732 xpvrr.exe 36 PID 2732 wrote to memory of 2988 2732 xpvrr.exe 36 PID 2732 wrote to memory of 2988 2732 xpvrr.exe 36 PID 2988 wrote to memory of 2984 2988 bxvplj.exe 37 PID 2988 wrote to memory of 2984 2988 bxvplj.exe 37 PID 2988 wrote to memory of 2984 2988 bxvplj.exe 37 PID 2988 wrote to memory of 2984 2988 bxvplj.exe 37 PID 2984 wrote to memory of 2332 2984 xfnhrj.exe 38 PID 2984 wrote to memory of 2332 2984 xfnhrj.exe 38 PID 2984 wrote to memory of 2332 2984 xfnhrj.exe 38 PID 2984 wrote to memory of 2332 2984 xfnhrj.exe 38 PID 2332 wrote to memory of 1344 2332 flfjrln.exe 39 PID 2332 wrote to memory of 1344 2332 flfjrln.exe 39 PID 2332 wrote to memory of 1344 2332 flfjrln.exe 39 PID 2332 wrote to memory of 1344 2332 flfjrln.exe 39 PID 1344 wrote to memory of 1872 1344 vtjrnj.exe 40 PID 1344 wrote to memory of 1872 1344 vtjrnj.exe 40 PID 1344 wrote to memory of 1872 1344 vtjrnj.exe 40 PID 1344 wrote to memory of 1872 1344 vtjrnj.exe 40 PID 1872 wrote to memory of 1884 1872 vtdpdhj.exe 41 PID 1872 wrote to memory of 1884 1872 vtdpdhj.exe 41 PID 1872 wrote to memory of 1884 1872 vtdpdhj.exe 41 PID 1872 wrote to memory of 1884 1872 vtdpdhj.exe 41 PID 1884 wrote to memory of 3064 1884 nrfjxjr.exe 42 PID 1884 wrote to memory of 3064 1884 nrfjxjr.exe 42 PID 1884 wrote to memory of 3064 1884 nrfjxjr.exe 42 PID 1884 wrote to memory of 3064 1884 nrfjxjr.exe 42 PID 3064 wrote to memory of 3016 3064 bjltr.exe 43 PID 3064 wrote to memory of 3016 3064 bjltr.exe 43 PID 3064 wrote to memory of 3016 3064 bjltr.exe 43 PID 3064 wrote to memory of 3016 3064 bjltr.exe 43 PID 3016 wrote to memory of 324 3016 phxvb.exe 44 PID 3016 wrote to memory of 324 3016 phxvb.exe 44 PID 3016 wrote to memory of 324 3016 phxvb.exe 44 PID 3016 wrote to memory of 324 3016 phxvb.exe 44 PID 324 wrote to memory of 1964 324 rftntdt.exe 45 PID 324 wrote to memory of 1964 324 rftntdt.exe 45 PID 324 wrote to memory of 1964 324 rftntdt.exe 45 PID 324 wrote to memory of 1964 324 rftntdt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\668c75a60bbe84e03228c37e98dbba73127c7e40a50df978bed62662a95dcba3.exe"C:\Users\Admin\AppData\Local\Temp\668c75a60bbe84e03228c37e98dbba73127c7e40a50df978bed62662a95dcba3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\rjphfhl.exec:\rjphfhl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\tflpp.exec:\tflpp.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\bljnj.exec:\bljnj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\fltnv.exec:\fltnv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\rpttp.exec:\rpttp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\xpvrr.exec:\xpvrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\bxvplj.exec:\bxvplj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\xfnhrj.exec:\xfnhrj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\flfjrln.exec:\flfjrln.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\vtjrnj.exec:\vtjrnj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\vtdpdhj.exec:\vtdpdhj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\nrfjxjr.exec:\nrfjxjr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\bjltr.exec:\bjltr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\phxvb.exec:\phxvb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\rftntdt.exec:\rftntdt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\plvth.exec:\plvth.exe17⤵
- Executes dropped EXE
PID:1964 -
\??\c:\ljprxh.exec:\ljprxh.exe18⤵
- Executes dropped EXE
PID:1592 -
\??\c:\vxhdtd.exec:\vxhdtd.exe19⤵
- Executes dropped EXE
PID:2372 -
\??\c:\thntj.exec:\thntj.exe20⤵
- Executes dropped EXE
PID:2056 -
\??\c:\xbjxf.exec:\xbjxf.exe21⤵
- Executes dropped EXE
PID:2492 -
\??\c:\lvxldnl.exec:\lvxldnl.exe22⤵
- Executes dropped EXE
PID:1680 -
\??\c:\dxphp.exec:\dxphp.exe23⤵
- Executes dropped EXE
PID:960 -
\??\c:\vtpftr.exec:\vtpftr.exe24⤵
- Executes dropped EXE
PID:2628 -
\??\c:\htxrpft.exec:\htxrpft.exe25⤵
- Executes dropped EXE
PID:832 -
\??\c:\lvjndlv.exec:\lvjndlv.exe26⤵
- Executes dropped EXE
PID:1772 -
\??\c:\bxtph.exec:\bxtph.exe27⤵
- Executes dropped EXE
PID:1428 -
\??\c:\fjnvb.exec:\fjnvb.exe28⤵
- Executes dropped EXE
PID:944 -
\??\c:\xhtnj.exec:\xhtnj.exe29⤵
- Executes dropped EXE
PID:1164 -
\??\c:\rlxnt.exec:\rlxnt.exe30⤵
- Executes dropped EXE
PID:1608 -
\??\c:\pfpxvhb.exec:\pfpxvhb.exe31⤵
- Executes dropped EXE
PID:236 -
\??\c:\prvdtf.exec:\prvdtf.exe32⤵
- Executes dropped EXE
PID:1744 -
\??\c:\bjlnx.exec:\bjlnx.exe33⤵
- Executes dropped EXE
PID:2696 -
\??\c:\bfjrvx.exec:\bfjrvx.exe34⤵
- Executes dropped EXE
PID:1692 -
\??\c:\jnfjth.exec:\jnfjth.exe35⤵PID:2656
-
\??\c:\bhrff.exec:\bhrff.exe36⤵
- Executes dropped EXE
PID:2204 -
\??\c:\hvxrfpv.exec:\hvxrfpv.exe37⤵
- Executes dropped EXE
PID:1640 -
\??\c:\hrtxj.exec:\hrtxj.exe38⤵
- Executes dropped EXE
PID:1916 -
\??\c:\ppnjfth.exec:\ppnjfth.exe39⤵
- Executes dropped EXE
PID:668 -
\??\c:\xnpdbb.exec:\xnpdbb.exe40⤵
- Executes dropped EXE
PID:2444 -
\??\c:\fdjbx.exec:\fdjbx.exe41⤵
- Executes dropped EXE
PID:3000 -
\??\c:\ffrhtbt.exec:\ffrhtbt.exe42⤵
- Executes dropped EXE
PID:3004 -
\??\c:\lrjppjf.exec:\lrjppjf.exe43⤵
- Executes dropped EXE
PID:2884 -
\??\c:\hvlttbb.exec:\hvlttbb.exe44⤵
- Executes dropped EXE
PID:3068 -
\??\c:\ndfblv.exec:\ndfblv.exe45⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xvnxptf.exec:\xvnxptf.exe46⤵
- Executes dropped EXE
PID:2956 -
\??\c:\htprxj.exec:\htprxj.exe47⤵
- Executes dropped EXE
PID:1632 -
\??\c:\lbnvtfb.exec:\lbnvtfb.exe48⤵
- Executes dropped EXE
PID:956 -
\??\c:\jjbnjjx.exec:\jjbnjjx.exe49⤵
- Executes dropped EXE
PID:2324 -
\??\c:\nrxpjl.exec:\nrxpjl.exe50⤵
- Executes dropped EXE
PID:3040 -
\??\c:\dljvnd.exec:\dljvnd.exe51⤵
- Executes dropped EXE
PID:2968 -
\??\c:\bhrnjph.exec:\bhrnjph.exe52⤵
- Executes dropped EXE
PID:2452 -
\??\c:\bnfdl.exec:\bnfdl.exe53⤵
- Executes dropped EXE
PID:1348 -
\??\c:\tddll.exec:\tddll.exe54⤵
- Executes dropped EXE
PID:1576 -
\??\c:\jxvvfnf.exec:\jxvvfnf.exe55⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pvvlj.exec:\pvvlj.exe56⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xxxbj.exec:\xxxbj.exe57⤵
- Executes dropped EXE
PID:1868 -
\??\c:\vvvtvhn.exec:\vvvtvhn.exe58⤵
- Executes dropped EXE
PID:1648 -
\??\c:\hxdlbfr.exec:\hxdlbfr.exe59⤵
- Executes dropped EXE
PID:2076 -
\??\c:\tfltr.exec:\tfltr.exe60⤵
- Executes dropped EXE
PID:1488 -
\??\c:\jvrtnjh.exec:\jvrtnjh.exe61⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jnnft.exec:\jnnft.exe62⤵
- Executes dropped EXE
PID:2516 -
\??\c:\tbhnlf.exec:\tbhnlf.exe63⤵
- Executes dropped EXE
PID:2368 -
\??\c:\jrpxlr.exec:\jrpxlr.exe64⤵
- Executes dropped EXE
PID:2028 -
\??\c:\ddtjnl.exec:\ddtjnl.exe65⤵
- Executes dropped EXE
PID:764 -
\??\c:\bpldd.exec:\bpldd.exe66⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hllhp.exec:\hllhp.exe67⤵PID:2528
-
\??\c:\nbhtf.exec:\nbhtf.exe68⤵PID:832
-
\??\c:\tbvlf.exec:\tbvlf.exe69⤵PID:2592
-
\??\c:\xdxprht.exec:\xdxprht.exe70⤵PID:108
-
\??\c:\bbrdvll.exec:\bbrdvll.exe71⤵PID:1800
-
\??\c:\brfjhjj.exec:\brfjhjj.exe72⤵PID:2236
-
\??\c:\hblbrpf.exec:\hblbrpf.exe73⤵PID:1020
-
\??\c:\hvrnhjb.exec:\hvrnhjb.exe74⤵PID:2032
-
\??\c:\jxtxh.exec:\jxtxh.exe75⤵PID:2672
-
\??\c:\btpflpf.exec:\btpflpf.exe76⤵PID:1744
-
\??\c:\thvjx.exec:\thvjx.exe77⤵PID:2568
-
\??\c:\trtnrpj.exec:\trtnrpj.exe78⤵PID:1528
-
\??\c:\jrfvlh.exec:\jrfvlh.exe79⤵PID:2292
-
\??\c:\vrpth.exec:\vrpth.exe80⤵PID:2240
-
\??\c:\bbnrvvn.exec:\bbnrvvn.exe81⤵PID:1272
-
\??\c:\tdlrjt.exec:\tdlrjt.exe82⤵PID:2912
-
\??\c:\hxbhx.exec:\hxbhx.exe83⤵PID:2924
-
\??\c:\lppvth.exec:\lppvth.exe84⤵PID:2940
-
\??\c:\tjlxb.exec:\tjlxb.exe85⤵PID:2944
-
\??\c:\rhdjv.exec:\rhdjv.exe86⤵PID:2556
-
\??\c:\vvpjr.exec:\vvpjr.exe87⤵PID:2908
-
\??\c:\vjvtbfx.exec:\vjvtbfx.exe88⤵PID:2920
-
\??\c:\vjxtx.exec:\vjxtx.exe89⤵PID:2772
-
\??\c:\fbfbjj.exec:\fbfbjj.exe90⤵
- System Location Discovery: System Language Discovery
PID:2736 -
\??\c:\njbnbtn.exec:\njbnbtn.exe91⤵PID:1632
-
\??\c:\nxjxtrb.exec:\nxjxtrb.exe92⤵PID:956
-
\??\c:\rddpnjr.exec:\rddpnjr.exe93⤵PID:1872
-
\??\c:\dbvlnl.exec:\dbvlnl.exe94⤵PID:2976
-
\??\c:\hfvtnrv.exec:\hfvtnrv.exe95⤵PID:2964
-
\??\c:\jblxx.exec:\jblxx.exe96⤵PID:1876
-
\??\c:\ntrpr.exec:\ntrpr.exe97⤵PID:2764
-
\??\c:\dhppbnn.exec:\dhppbnn.exe98⤵PID:2340
-
\??\c:\tbnpv.exec:\tbnpv.exe99⤵PID:2540
-
\??\c:\pxbpht.exec:\pxbpht.exe100⤵PID:324
-
\??\c:\vdjpthn.exec:\vdjpthn.exe101⤵PID:848
-
\??\c:\ldbpf.exec:\ldbpf.exe102⤵PID:1648
-
\??\c:\rfpphn.exec:\rfpphn.exe103⤵PID:836
-
\??\c:\vrxbthr.exec:\vrxbthr.exe104⤵PID:2512
-
\??\c:\hjfpxn.exec:\hjfpxn.exe105⤵PID:2520
-
\??\c:\jrjln.exec:\jrjln.exe106⤵PID:2516
-
\??\c:\pfbvt.exec:\pfbvt.exe107⤵PID:1144
-
\??\c:\vxdhj.exec:\vxdhj.exe108⤵PID:1564
-
\??\c:\lrbdl.exec:\lrbdl.exe109⤵PID:764
-
\??\c:\hvxndpl.exec:\hvxndpl.exe110⤵PID:2412
-
\??\c:\pflpbf.exec:\pflpbf.exe111⤵PID:2328
-
\??\c:\vrhjnjf.exec:\vrhjnjf.exe112⤵PID:772
-
\??\c:\pbhnjj.exec:\pbhnjj.exe113⤵PID:2592
-
\??\c:\xlrrvhd.exec:\xlrrvhd.exe114⤵PID:2688
-
\??\c:\nttdpf.exec:\nttdpf.exe115⤵PID:1800
-
\??\c:\llvdr.exec:\llvdr.exe116⤵PID:1756
-
\??\c:\lrjndvj.exec:\lrjndvj.exe117⤵PID:236
-
\??\c:\ddrpvl.exec:\ddrpvl.exe118⤵PID:1032
-
\??\c:\lffdpxt.exec:\lffdpxt.exe119⤵
- System Location Discovery: System Language Discovery
PID:2184 -
\??\c:\hhlldh.exec:\hhlldh.exe120⤵PID:1532
-
\??\c:\rrndfn.exec:\rrndfn.exe121⤵PID:2284
-
\??\c:\lbjrhdf.exec:\lbjrhdf.exe122⤵PID:2396
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-