Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 00:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6e162def265c17f9dfbfd6019348f9d2bbe2988e381587ed9dad9ba93024d4a3.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
6e162def265c17f9dfbfd6019348f9d2bbe2988e381587ed9dad9ba93024d4a3.exe
-
Size
455KB
-
MD5
ae016cd7ed0eb29dd2dee0007dcd551c
-
SHA1
500e770f3d170c7edec729fd027fe2bbfed310ca
-
SHA256
6e162def265c17f9dfbfd6019348f9d2bbe2988e381587ed9dad9ba93024d4a3
-
SHA512
3a2cebb30c1ef57840b1af9f9edd3672374e07bab5c28af65eb82ac142473dd8a57f27170ae1ffd2a485f03a27e54316c4c30884ffc911faf400a5f8ca411bd2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeP:q7Tc2NYHUrAwfMp3CDP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/576-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1172-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/364-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1404-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-223-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2360-247-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2360-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1196-266-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2004-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/548-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-508-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1740-533-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/812-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/948-555-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2416-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-618-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2768-635-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/960-773-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1616-837-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2988 xfrhlh.exe 1172 dnfpftv.exe 2976 hxhddx.exe 2952 rdxnf.exe 2856 ljxpnt.exe 2828 rpblhl.exe 2924 fjbldv.exe 2812 pjfjbj.exe 2596 bbxbb.exe 2384 lpdnfl.exe 1976 btntnbf.exe 2840 rfbdt.exe 1892 nbxvdrh.exe 2800 dtdjht.exe 2916 tvtnhx.exe 2656 ffhbnt.exe 364 nvpvdpr.exe 2308 xnvnx.exe 1160 bhlxpf.exe 1404 vjlnrjj.exe 2436 ndtpjd.exe 2064 vdblpj.exe 2116 bppxl.exe 1040 ldjvxt.exe 1196 bppvl.exe 2360 dbntv.exe 2204 bhtfj.exe 108 ntpnj.exe 1716 dfpfb.exe 2004 btxrdb.exe 2128 fhvjfn.exe 2664 jbpljj.exe 2348 prrfxh.exe 2140 vthvdp.exe 2884 dfjfjl.exe 2460 npjrhf.exe 2844 hftvbd.exe 2940 rjfbbdp.exe 2776 hphdjj.exe 2900 ddlvlnx.exe 2744 dpthph.exe 2912 fltjd.exe 2620 bdjrjl.exe 2452 dbtvfr.exe 876 lpjxt.exe 1756 dtvvblx.exe 2380 bxfjpb.exe 1976 jxhpjfj.exe 3004 tplvv.exe 1744 npbbr.exe 1872 xrdpjvp.exe 2600 txdttn.exe 2284 prjrf.exe 1708 pjxlhh.exe 2288 flrhj.exe 2060 rpnbnhd.exe 2084 pxxfj.exe 2712 bbxbdv.exe 1956 frnrj.exe 2164 prblv.exe 548 dpdjd.exe 2012 xxxpx.exe 1660 rvltvfx.exe 1804 vfptj.exe -
resource yara_rule behavioral1/memory/576-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/364-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1404-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-306-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2140-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-485-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/548-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-735-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdvlbpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjhtnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhpvfdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfdnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnnvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flhvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtdxpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtrlbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljprr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhpvxvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frbvbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlvpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pthvvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrrjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhdrrlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldnvbtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hftvbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxxfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbpbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdrlnlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjfvpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlnfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plnnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbxttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxhfdtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxxtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldtdbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrtpbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdvpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtlbbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhtlrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhdxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpnrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dprllt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bppxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltnxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvhjnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjlxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjvxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfdlpn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 576 wrote to memory of 2988 576 6e162def265c17f9dfbfd6019348f9d2bbe2988e381587ed9dad9ba93024d4a3.exe 30 PID 576 wrote to memory of 2988 576 6e162def265c17f9dfbfd6019348f9d2bbe2988e381587ed9dad9ba93024d4a3.exe 30 PID 576 wrote to memory of 2988 576 6e162def265c17f9dfbfd6019348f9d2bbe2988e381587ed9dad9ba93024d4a3.exe 30 PID 576 wrote to memory of 2988 576 6e162def265c17f9dfbfd6019348f9d2bbe2988e381587ed9dad9ba93024d4a3.exe 30 PID 2988 wrote to memory of 1172 2988 xfrhlh.exe 31 PID 2988 wrote to memory of 1172 2988 xfrhlh.exe 31 PID 2988 wrote to memory of 1172 2988 xfrhlh.exe 31 PID 2988 wrote to memory of 1172 2988 xfrhlh.exe 31 PID 1172 wrote to memory of 2976 1172 dnfpftv.exe 32 PID 1172 wrote to memory of 2976 1172 dnfpftv.exe 32 PID 1172 wrote to memory of 2976 1172 dnfpftv.exe 32 PID 1172 wrote to memory of 2976 1172 dnfpftv.exe 32 PID 2976 wrote to memory of 2952 2976 hxhddx.exe 33 PID 2976 wrote to memory of 2952 2976 hxhddx.exe 33 PID 2976 wrote to memory of 2952 2976 hxhddx.exe 33 PID 2976 wrote to memory of 2952 2976 hxhddx.exe 33 PID 2952 wrote to memory of 2856 2952 rdxnf.exe 34 PID 2952 wrote to memory of 2856 2952 rdxnf.exe 34 PID 2952 wrote to memory of 2856 2952 rdxnf.exe 34 PID 2952 wrote to memory of 2856 2952 rdxnf.exe 34 PID 2856 wrote to memory of 2828 2856 ljxpnt.exe 35 PID 2856 wrote to memory of 2828 2856 ljxpnt.exe 35 PID 2856 wrote to memory of 2828 2856 ljxpnt.exe 35 PID 2856 wrote to memory of 2828 2856 ljxpnt.exe 35 PID 2828 wrote to memory of 2924 2828 rpblhl.exe 36 PID 2828 wrote to memory of 2924 2828 rpblhl.exe 36 PID 2828 wrote to memory of 2924 2828 rpblhl.exe 36 PID 2828 wrote to memory of 2924 2828 rpblhl.exe 36 PID 2924 wrote to memory of 2812 2924 fjbldv.exe 37 PID 2924 wrote to memory of 2812 2924 fjbldv.exe 37 PID 2924 wrote to memory of 2812 2924 fjbldv.exe 37 PID 2924 wrote to memory of 2812 2924 fjbldv.exe 37 PID 2812 wrote to memory of 2596 2812 pjfjbj.exe 38 PID 2812 wrote to memory of 2596 2812 pjfjbj.exe 38 PID 2812 wrote to memory of 2596 2812 pjfjbj.exe 38 PID 2812 wrote to memory of 2596 2812 pjfjbj.exe 38 PID 2596 wrote to memory of 2384 2596 bbxbb.exe 39 PID 2596 wrote to memory of 2384 2596 bbxbb.exe 39 PID 2596 wrote to memory of 2384 2596 bbxbb.exe 39 PID 2596 wrote to memory of 2384 2596 bbxbb.exe 39 PID 2384 wrote to memory of 1976 2384 lpdnfl.exe 40 PID 2384 wrote to memory of 1976 2384 lpdnfl.exe 40 PID 2384 wrote to memory of 1976 2384 lpdnfl.exe 40 PID 2384 wrote to memory of 1976 2384 lpdnfl.exe 40 PID 1976 wrote to memory of 2840 1976 btntnbf.exe 41 PID 1976 wrote to memory of 2840 1976 btntnbf.exe 41 PID 1976 wrote to memory of 2840 1976 btntnbf.exe 41 PID 1976 wrote to memory of 2840 1976 btntnbf.exe 41 PID 2840 wrote to memory of 1892 2840 rfbdt.exe 42 PID 2840 wrote to memory of 1892 2840 rfbdt.exe 42 PID 2840 wrote to memory of 1892 2840 rfbdt.exe 42 PID 2840 wrote to memory of 1892 2840 rfbdt.exe 42 PID 1892 wrote to memory of 2800 1892 nbxvdrh.exe 43 PID 1892 wrote to memory of 2800 1892 nbxvdrh.exe 43 PID 1892 wrote to memory of 2800 1892 nbxvdrh.exe 43 PID 1892 wrote to memory of 2800 1892 nbxvdrh.exe 43 PID 2800 wrote to memory of 2916 2800 dtdjht.exe 44 PID 2800 wrote to memory of 2916 2800 dtdjht.exe 44 PID 2800 wrote to memory of 2916 2800 dtdjht.exe 44 PID 2800 wrote to memory of 2916 2800 dtdjht.exe 44 PID 2916 wrote to memory of 2656 2916 tvtnhx.exe 45 PID 2916 wrote to memory of 2656 2916 tvtnhx.exe 45 PID 2916 wrote to memory of 2656 2916 tvtnhx.exe 45 PID 2916 wrote to memory of 2656 2916 tvtnhx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e162def265c17f9dfbfd6019348f9d2bbe2988e381587ed9dad9ba93024d4a3.exe"C:\Users\Admin\AppData\Local\Temp\6e162def265c17f9dfbfd6019348f9d2bbe2988e381587ed9dad9ba93024d4a3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\xfrhlh.exec:\xfrhlh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\dnfpftv.exec:\dnfpftv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\hxhddx.exec:\hxhddx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\rdxnf.exec:\rdxnf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\ljxpnt.exec:\ljxpnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\rpblhl.exec:\rpblhl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\fjbldv.exec:\fjbldv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\pjfjbj.exec:\pjfjbj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\bbxbb.exec:\bbxbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\lpdnfl.exec:\lpdnfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\btntnbf.exec:\btntnbf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\rfbdt.exec:\rfbdt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\nbxvdrh.exec:\nbxvdrh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\dtdjht.exec:\dtdjht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\tvtnhx.exec:\tvtnhx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\ffhbnt.exec:\ffhbnt.exe17⤵
- Executes dropped EXE
PID:2656 -
\??\c:\nvpvdpr.exec:\nvpvdpr.exe18⤵
- Executes dropped EXE
PID:364 -
\??\c:\xnvnx.exec:\xnvnx.exe19⤵
- Executes dropped EXE
PID:2308 -
\??\c:\bhlxpf.exec:\bhlxpf.exe20⤵
- Executes dropped EXE
PID:1160 -
\??\c:\vjlnrjj.exec:\vjlnrjj.exe21⤵
- Executes dropped EXE
PID:1404 -
\??\c:\ndtpjd.exec:\ndtpjd.exe22⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vdblpj.exec:\vdblpj.exe23⤵
- Executes dropped EXE
PID:2064 -
\??\c:\bppxl.exec:\bppxl.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2116 -
\??\c:\ldjvxt.exec:\ldjvxt.exe25⤵
- Executes dropped EXE
PID:1040 -
\??\c:\bppvl.exec:\bppvl.exe26⤵
- Executes dropped EXE
PID:1196 -
\??\c:\dbntv.exec:\dbntv.exe27⤵
- Executes dropped EXE
PID:2360 -
\??\c:\bhtfj.exec:\bhtfj.exe28⤵
- Executes dropped EXE
PID:2204 -
\??\c:\ntpnj.exec:\ntpnj.exe29⤵
- Executes dropped EXE
PID:108 -
\??\c:\dfpfb.exec:\dfpfb.exe30⤵
- Executes dropped EXE
PID:1716 -
\??\c:\btxrdb.exec:\btxrdb.exe31⤵
- Executes dropped EXE
PID:2004 -
\??\c:\fhvjfn.exec:\fhvjfn.exe32⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jbpljj.exec:\jbpljj.exe33⤵
- Executes dropped EXE
PID:2664 -
\??\c:\prrfxh.exec:\prrfxh.exe34⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vthvdp.exec:\vthvdp.exe35⤵
- Executes dropped EXE
PID:2140 -
\??\c:\dfjfjl.exec:\dfjfjl.exe36⤵
- Executes dropped EXE
PID:2884 -
\??\c:\npjrhf.exec:\npjrhf.exe37⤵
- Executes dropped EXE
PID:2460 -
\??\c:\hftvbd.exec:\hftvbd.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2844 -
\??\c:\rjfbbdp.exec:\rjfbbdp.exe39⤵
- Executes dropped EXE
PID:2940 -
\??\c:\hphdjj.exec:\hphdjj.exe40⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ddlvlnx.exec:\ddlvlnx.exe41⤵
- Executes dropped EXE
PID:2900 -
\??\c:\dpthph.exec:\dpthph.exe42⤵
- Executes dropped EXE
PID:2744 -
\??\c:\fltjd.exec:\fltjd.exe43⤵
- Executes dropped EXE
PID:2912 -
\??\c:\bdjrjl.exec:\bdjrjl.exe44⤵
- Executes dropped EXE
PID:2620 -
\??\c:\dbtvfr.exec:\dbtvfr.exe45⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lpjxt.exec:\lpjxt.exe46⤵
- Executes dropped EXE
PID:876 -
\??\c:\dtvvblx.exec:\dtvvblx.exe47⤵
- Executes dropped EXE
PID:1756 -
\??\c:\bxfjpb.exec:\bxfjpb.exe48⤵
- Executes dropped EXE
PID:2380 -
\??\c:\jxhpjfj.exec:\jxhpjfj.exe49⤵
- Executes dropped EXE
PID:1976 -
\??\c:\tplvv.exec:\tplvv.exe50⤵
- Executes dropped EXE
PID:3004 -
\??\c:\npbbr.exec:\npbbr.exe51⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xrdpjvp.exec:\xrdpjvp.exe52⤵
- Executes dropped EXE
PID:1872 -
\??\c:\txdttn.exec:\txdttn.exe53⤵
- Executes dropped EXE
PID:2600 -
\??\c:\prjrf.exec:\prjrf.exe54⤵
- Executes dropped EXE
PID:2284 -
\??\c:\pjxlhh.exec:\pjxlhh.exe55⤵
- Executes dropped EXE
PID:1708 -
\??\c:\flrhj.exec:\flrhj.exe56⤵
- Executes dropped EXE
PID:2288 -
\??\c:\rpnbnhd.exec:\rpnbnhd.exe57⤵
- Executes dropped EXE
PID:2060 -
\??\c:\pxxfj.exec:\pxxfj.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2084 -
\??\c:\bbxbdv.exec:\bbxbdv.exe59⤵
- Executes dropped EXE
PID:2712 -
\??\c:\frnrj.exec:\frnrj.exe60⤵
- Executes dropped EXE
PID:1956 -
\??\c:\prblv.exec:\prblv.exe61⤵
- Executes dropped EXE
PID:2164 -
\??\c:\dpdjd.exec:\dpdjd.exe62⤵
- Executes dropped EXE
PID:548 -
\??\c:\xxxpx.exec:\xxxpx.exe63⤵
- Executes dropped EXE
PID:2012 -
\??\c:\rvltvfx.exec:\rvltvfx.exe64⤵
- Executes dropped EXE
PID:1660 -
\??\c:\vfptj.exec:\vfptj.exe65⤵
- Executes dropped EXE
PID:1804 -
\??\c:\prhtj.exec:\prhtj.exe66⤵PID:1156
-
\??\c:\vrvdnd.exec:\vrvdnd.exe67⤵PID:1740
-
\??\c:\jdbbdt.exec:\jdbbdt.exe68⤵PID:1896
-
\??\c:\vdjvxx.exec:\vdjvxx.exe69⤵PID:812
-
\??\c:\bhfhddp.exec:\bhfhddp.exe70⤵PID:948
-
\??\c:\rbxfb.exec:\rbxfb.exe71⤵PID:2644
-
\??\c:\tbbbxf.exec:\tbbbxf.exe72⤵PID:1564
-
\??\c:\bnhxd.exec:\bnhxd.exe73⤵PID:2416
-
\??\c:\pjntplp.exec:\pjntplp.exe74⤵PID:576
-
\??\c:\dfnllvv.exec:\dfnllvv.exe75⤵PID:1584
-
\??\c:\djrdrx.exec:\djrdrx.exe76⤵PID:3000
-
\??\c:\trbjrf.exec:\trbjrf.exe77⤵PID:2140
-
\??\c:\rjdndf.exec:\rjdndf.exe78⤵PID:2968
-
\??\c:\pvvpld.exec:\pvvpld.exe79⤵PID:2864
-
\??\c:\nfffxh.exec:\nfffxh.exe80⤵PID:2328
-
\??\c:\rvjlht.exec:\rvjlht.exe81⤵PID:2948
-
\??\c:\hjxnlbt.exec:\hjxnlbt.exe82⤵PID:2768
-
\??\c:\xdxvx.exec:\xdxvx.exe83⤵PID:2788
-
\??\c:\pvxplln.exec:\pvxplln.exe84⤵PID:2772
-
\??\c:\pftxnv.exec:\pftxnv.exe85⤵PID:2588
-
\??\c:\xttjp.exec:\xttjp.exe86⤵PID:2620
-
\??\c:\brdvp.exec:\brdvp.exe87⤵PID:2428
-
\??\c:\vthtf.exec:\vthtf.exe88⤵PID:876
-
\??\c:\dddljl.exec:\dddljl.exe89⤵PID:1348
-
\??\c:\rfxpv.exec:\rfxpv.exe90⤵PID:2508
-
\??\c:\jljjx.exec:\jljjx.exe91⤵PID:3008
-
\??\c:\hllvr.exec:\hllvr.exe92⤵PID:3004
-
\??\c:\ltnxr.exec:\ltnxr.exe93⤵
- System Location Discovery: System Language Discovery
PID:1900 -
\??\c:\rptxf.exec:\rptxf.exe94⤵PID:1332
-
\??\c:\pftnvtt.exec:\pftnvtt.exe95⤵PID:2484
-
\??\c:\vjvfn.exec:\vjvfn.exe96⤵PID:2296
-
\??\c:\lfbndtl.exec:\lfbndtl.exe97⤵PID:1124
-
\??\c:\vpndx.exec:\vpndx.exe98⤵PID:1708
-
\??\c:\lphdrx.exec:\lphdrx.exe99⤵PID:2288
-
\??\c:\lbpdlv.exec:\lbpdlv.exe100⤵PID:1964
-
\??\c:\hfrxppb.exec:\hfrxppb.exe101⤵PID:1644
-
\??\c:\lptrhdl.exec:\lptrhdl.exe102⤵PID:1136
-
\??\c:\pdrjb.exec:\pdrjb.exe103⤵PID:900
-
\??\c:\xlhfh.exec:\xlhfh.exe104⤵PID:960
-
\??\c:\rffvvj.exec:\rffvvj.exe105⤵PID:2640
-
\??\c:\jrdnrhb.exec:\jrdnrhb.exe106⤵PID:1912
-
\??\c:\hbxhnv.exec:\hbxhnv.exe107⤵PID:2636
-
\??\c:\ddfrv.exec:\ddfrv.exe108⤵PID:1224
-
\??\c:\llxrx.exec:\llxrx.exe109⤵PID:1196
-
\??\c:\rlnxdp.exec:\rlnxdp.exe110⤵PID:1156
-
\??\c:\rhxvj.exec:\rhxvj.exe111⤵PID:1616
-
\??\c:\pblvnhb.exec:\pblvnhb.exe112⤵PID:944
-
\??\c:\fnpnfp.exec:\fnpnfp.exe113⤵PID:2672
-
\??\c:\trjtfht.exec:\trjtfht.exe114⤵PID:2540
-
\??\c:\vrbjpxt.exec:\vrbjpxt.exe115⤵PID:1720
-
\??\c:\lbvttv.exec:\lbvttv.exe116⤵PID:1728
-
\??\c:\nxbjhrr.exec:\nxbjhrr.exe117⤵PID:2208
-
\??\c:\ffxjj.exec:\ffxjj.exe118⤵PID:1684
-
\??\c:\dtbdrfp.exec:\dtbdrfp.exe119⤵PID:1692
-
\??\c:\jvlfr.exec:\jvlfr.exe120⤵PID:2988
-
\??\c:\pthvvh.exec:\pthvvh.exe121⤵
- System Location Discovery: System Language Discovery
PID:2972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-