Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 01:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe
-
Size
454KB
-
MD5
a21c7201e63648a542e5110edd865490
-
SHA1
dc859810c352237af5497761e93697a3b8045850
-
SHA256
900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2
-
SHA512
966d33234346a04d2169cff3db3bd47c9d16ee8040a1de1ff825da1111fed707a84a45201a59dda4050925164d4a23b4b0a20d77dec06b32321fb12427aebb4c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbec:q7Tc2NYHUrAwfMp3CDc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/1688-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-37-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1128-49-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2952-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-107-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1692-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-126-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3024-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-191-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/768-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-259-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1708-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-541-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2808-561-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2592-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-636-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2820-666-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2996-697-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-754-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/820-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-958-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/608-1009-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1128 pxtth.exe 1456 rhbpv.exe 2936 thvbb.exe 2952 rlpjf.exe 2968 vxvhd.exe 2832 rtxnlx.exe 2800 pbdxvpb.exe 2564 pxbrn.exe 2788 bprhrb.exe 1692 llbjv.exe 1248 djndpj.exe 3020 xhvtvxn.exe 3024 blbrbl.exe 1836 tbrbrl.exe 608 lbtbttt.exe 580 dhbjd.exe 1348 rxhljr.exe 2240 lrpnn.exe 2060 jrbhr.exe 2476 dxrdhrr.exe 2472 ddrxxt.exe 2064 fxnfhbr.exe 2672 jlxplr.exe 768 jbdfv.exe 1700 jjbjr.exe 2400 pdrdrrh.exe 2204 dhxrb.exe 1708 xfbxfh.exe 2892 pfnbtlt.exe 1544 rtdxbjj.exe 1948 pxjtndf.exe 2372 jjljl.exe 2116 frbdf.exe 1236 rrbnjv.exe 1224 trlnv.exe 1628 bljhb.exe 2956 tdtrv.exe 2020 pvfxt.exe 3064 ptxblb.exe 3044 djxvbb.exe 2512 pvjnnlj.exe 2876 bptfhxx.exe 2828 xdpfvnt.exe 2572 bvrjbf.exe 2540 npxbrv.exe 1316 txftn.exe 1492 dptjbbf.exe 1084 vndbv.exe 1248 ftlrjd.exe 2580 ltljp.exe 1952 vtfbdv.exe 3036 lxbhr.exe 452 dtnphht.exe 840 hfjdnjf.exe 1028 vrxprrn.exe 588 fjvvdh.exe 1304 jdlfd.exe 2508 hhprbl.exe 2240 dlftp.exe 1964 dtrxhb.exe 2436 ljrxh.exe 972 rjtfd.exe 1992 flddvx.exe 2228 ldhjr.exe -
resource yara_rule behavioral1/memory/1688-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-826-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-944-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-1009-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-1022-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-1039-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/680-1065-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxxjrfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpvxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxjxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxlbjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbhnnfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfdhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnrdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjxlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntjjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbhhvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxnbxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbtpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxxjvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trnfrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtnjhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjhffn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvxhtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbrjvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npjlrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfdtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltxlbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvnbphh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrjbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njxpxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltpjrjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbvbbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlrhrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxhpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pflptnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1688 wrote to memory of 1128 1688 900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe 30 PID 1688 wrote to memory of 1128 1688 900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe 30 PID 1688 wrote to memory of 1128 1688 900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe 30 PID 1688 wrote to memory of 1128 1688 900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe 30 PID 1128 wrote to memory of 1456 1128 pxtth.exe 31 PID 1128 wrote to memory of 1456 1128 pxtth.exe 31 PID 1128 wrote to memory of 1456 1128 pxtth.exe 31 PID 1128 wrote to memory of 1456 1128 pxtth.exe 31 PID 1456 wrote to memory of 2936 1456 rhbpv.exe 32 PID 1456 wrote to memory of 2936 1456 rhbpv.exe 32 PID 1456 wrote to memory of 2936 1456 rhbpv.exe 32 PID 1456 wrote to memory of 2936 1456 rhbpv.exe 32 PID 2936 wrote to memory of 2952 2936 thvbb.exe 33 PID 2936 wrote to memory of 2952 2936 thvbb.exe 33 PID 2936 wrote to memory of 2952 2936 thvbb.exe 33 PID 2936 wrote to memory of 2952 2936 thvbb.exe 33 PID 2952 wrote to memory of 2968 2952 rlpjf.exe 34 PID 2952 wrote to memory of 2968 2952 rlpjf.exe 34 PID 2952 wrote to memory of 2968 2952 rlpjf.exe 34 PID 2952 wrote to memory of 2968 2952 rlpjf.exe 34 PID 2968 wrote to memory of 2832 2968 vxvhd.exe 35 PID 2968 wrote to memory of 2832 2968 vxvhd.exe 35 PID 2968 wrote to memory of 2832 2968 vxvhd.exe 35 PID 2968 wrote to memory of 2832 2968 vxvhd.exe 35 PID 2832 wrote to memory of 2800 2832 rtxnlx.exe 36 PID 2832 wrote to memory of 2800 2832 rtxnlx.exe 36 PID 2832 wrote to memory of 2800 2832 rtxnlx.exe 36 PID 2832 wrote to memory of 2800 2832 rtxnlx.exe 36 PID 2800 wrote to memory of 2564 2800 pbdxvpb.exe 37 PID 2800 wrote to memory of 2564 2800 pbdxvpb.exe 37 PID 2800 wrote to memory of 2564 2800 pbdxvpb.exe 37 PID 2800 wrote to memory of 2564 2800 pbdxvpb.exe 37 PID 2564 wrote to memory of 2788 2564 pxbrn.exe 38 PID 2564 wrote to memory of 2788 2564 pxbrn.exe 38 PID 2564 wrote to memory of 2788 2564 pxbrn.exe 38 PID 2564 wrote to memory of 2788 2564 pxbrn.exe 38 PID 2788 wrote to memory of 1692 2788 bprhrb.exe 39 PID 2788 wrote to memory of 1692 2788 bprhrb.exe 39 PID 2788 wrote to memory of 1692 2788 bprhrb.exe 39 PID 2788 wrote to memory of 1692 2788 bprhrb.exe 39 PID 1692 wrote to memory of 1248 1692 llbjv.exe 40 PID 1692 wrote to memory of 1248 1692 llbjv.exe 40 PID 1692 wrote to memory of 1248 1692 llbjv.exe 40 PID 1692 wrote to memory of 1248 1692 llbjv.exe 40 PID 1248 wrote to memory of 3020 1248 djndpj.exe 41 PID 1248 wrote to memory of 3020 1248 djndpj.exe 41 PID 1248 wrote to memory of 3020 1248 djndpj.exe 41 PID 1248 wrote to memory of 3020 1248 djndpj.exe 41 PID 3020 wrote to memory of 3024 3020 xhvtvxn.exe 42 PID 3020 wrote to memory of 3024 3020 xhvtvxn.exe 42 PID 3020 wrote to memory of 3024 3020 xhvtvxn.exe 42 PID 3020 wrote to memory of 3024 3020 xhvtvxn.exe 42 PID 3024 wrote to memory of 1836 3024 blbrbl.exe 43 PID 3024 wrote to memory of 1836 3024 blbrbl.exe 43 PID 3024 wrote to memory of 1836 3024 blbrbl.exe 43 PID 3024 wrote to memory of 1836 3024 blbrbl.exe 43 PID 1836 wrote to memory of 608 1836 tbrbrl.exe 44 PID 1836 wrote to memory of 608 1836 tbrbrl.exe 44 PID 1836 wrote to memory of 608 1836 tbrbrl.exe 44 PID 1836 wrote to memory of 608 1836 tbrbrl.exe 44 PID 608 wrote to memory of 580 608 lbtbttt.exe 45 PID 608 wrote to memory of 580 608 lbtbttt.exe 45 PID 608 wrote to memory of 580 608 lbtbttt.exe 45 PID 608 wrote to memory of 580 608 lbtbttt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe"C:\Users\Admin\AppData\Local\Temp\900e396b9f477f19df46122fb862de83a6d31a23b0526687e4ccbcaabb98dbb2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\pxtth.exec:\pxtth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\rhbpv.exec:\rhbpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\thvbb.exec:\thvbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\rlpjf.exec:\rlpjf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\vxvhd.exec:\vxvhd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\rtxnlx.exec:\rtxnlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\pbdxvpb.exec:\pbdxvpb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\pxbrn.exec:\pxbrn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\bprhrb.exec:\bprhrb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\llbjv.exec:\llbjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\djndpj.exec:\djndpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\xhvtvxn.exec:\xhvtvxn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\blbrbl.exec:\blbrbl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\tbrbrl.exec:\tbrbrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\lbtbttt.exec:\lbtbttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:608 -
\??\c:\dhbjd.exec:\dhbjd.exe17⤵
- Executes dropped EXE
PID:580 -
\??\c:\rxhljr.exec:\rxhljr.exe18⤵
- Executes dropped EXE
PID:1348 -
\??\c:\lrpnn.exec:\lrpnn.exe19⤵
- Executes dropped EXE
PID:2240 -
\??\c:\jrbhr.exec:\jrbhr.exe20⤵
- Executes dropped EXE
PID:2060 -
\??\c:\dxrdhrr.exec:\dxrdhrr.exe21⤵
- Executes dropped EXE
PID:2476 -
\??\c:\ddrxxt.exec:\ddrxxt.exe22⤵
- Executes dropped EXE
PID:2472 -
\??\c:\fxnfhbr.exec:\fxnfhbr.exe23⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jlxplr.exec:\jlxplr.exe24⤵
- Executes dropped EXE
PID:2672 -
\??\c:\jbdfv.exec:\jbdfv.exe25⤵
- Executes dropped EXE
PID:768 -
\??\c:\jjbjr.exec:\jjbjr.exe26⤵
- Executes dropped EXE
PID:1700 -
\??\c:\pdrdrrh.exec:\pdrdrrh.exe27⤵
- Executes dropped EXE
PID:2400 -
\??\c:\dhxrb.exec:\dhxrb.exe28⤵
- Executes dropped EXE
PID:2204 -
\??\c:\xfbxfh.exec:\xfbxfh.exe29⤵
- Executes dropped EXE
PID:1708 -
\??\c:\pfnbtlt.exec:\pfnbtlt.exe30⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rtdxbjj.exec:\rtdxbjj.exe31⤵
- Executes dropped EXE
PID:1544 -
\??\c:\pxjtndf.exec:\pxjtndf.exe32⤵
- Executes dropped EXE
PID:1948 -
\??\c:\jjljl.exec:\jjljl.exe33⤵
- Executes dropped EXE
PID:2372 -
\??\c:\frbdf.exec:\frbdf.exe34⤵
- Executes dropped EXE
PID:2116 -
\??\c:\rrbnjv.exec:\rrbnjv.exe35⤵
- Executes dropped EXE
PID:1236 -
\??\c:\trlnv.exec:\trlnv.exe36⤵
- Executes dropped EXE
PID:1224 -
\??\c:\bljhb.exec:\bljhb.exe37⤵
- Executes dropped EXE
PID:1628 -
\??\c:\tdtrv.exec:\tdtrv.exe38⤵
- Executes dropped EXE
PID:2956 -
\??\c:\pvfxt.exec:\pvfxt.exe39⤵
- Executes dropped EXE
PID:2020 -
\??\c:\ptxblb.exec:\ptxblb.exe40⤵
- Executes dropped EXE
PID:3064 -
\??\c:\djxvbb.exec:\djxvbb.exe41⤵
- Executes dropped EXE
PID:3044 -
\??\c:\pvjnnlj.exec:\pvjnnlj.exe42⤵
- Executes dropped EXE
PID:2512 -
\??\c:\bptfhxx.exec:\bptfhxx.exe43⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xdpfvnt.exec:\xdpfvnt.exe44⤵
- Executes dropped EXE
PID:2828 -
\??\c:\bvrjbf.exec:\bvrjbf.exe45⤵
- Executes dropped EXE
PID:2572 -
\??\c:\npxbrv.exec:\npxbrv.exe46⤵
- Executes dropped EXE
PID:2540 -
\??\c:\txftn.exec:\txftn.exe47⤵
- Executes dropped EXE
PID:1316 -
\??\c:\dptjbbf.exec:\dptjbbf.exe48⤵
- Executes dropped EXE
PID:1492 -
\??\c:\vndbv.exec:\vndbv.exe49⤵
- Executes dropped EXE
PID:1084 -
\??\c:\ftlrjd.exec:\ftlrjd.exe50⤵
- Executes dropped EXE
PID:1248 -
\??\c:\ltljp.exec:\ltljp.exe51⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vtfbdv.exec:\vtfbdv.exe52⤵
- Executes dropped EXE
PID:1952 -
\??\c:\lxbhr.exec:\lxbhr.exe53⤵
- Executes dropped EXE
PID:3036 -
\??\c:\dtnphht.exec:\dtnphht.exe54⤵
- Executes dropped EXE
PID:452 -
\??\c:\hfjdnjf.exec:\hfjdnjf.exe55⤵
- Executes dropped EXE
PID:840 -
\??\c:\vrxprrn.exec:\vrxprrn.exe56⤵
- Executes dropped EXE
PID:1028 -
\??\c:\fjvvdh.exec:\fjvvdh.exe57⤵
- Executes dropped EXE
PID:588 -
\??\c:\jdlfd.exec:\jdlfd.exe58⤵
- Executes dropped EXE
PID:1304 -
\??\c:\hhprbl.exec:\hhprbl.exe59⤵
- Executes dropped EXE
PID:2508 -
\??\c:\dlftp.exec:\dlftp.exe60⤵
- Executes dropped EXE
PID:2240 -
\??\c:\dtrxhb.exec:\dtrxhb.exe61⤵
- Executes dropped EXE
PID:1964 -
\??\c:\ljrxh.exec:\ljrxh.exe62⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rjtfd.exec:\rjtfd.exe63⤵
- Executes dropped EXE
PID:972 -
\??\c:\flddvx.exec:\flddvx.exe64⤵
- Executes dropped EXE
PID:1992 -
\??\c:\ldhjr.exec:\ldhjr.exe65⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jhvpnld.exec:\jhvpnld.exe66⤵PID:2732
-
\??\c:\trltjb.exec:\trltjb.exe67⤵PID:1208
-
\??\c:\rxhdh.exec:\rxhdh.exe68⤵PID:1600
-
\??\c:\djxrn.exec:\djxrn.exe69⤵PID:1700
-
\??\c:\rvtrxl.exec:\rvtrxl.exe70⤵PID:1712
-
\??\c:\nbfjjfv.exec:\nbfjjfv.exe71⤵PID:1204
-
\??\c:\ntpvrvh.exec:\ntpvrvh.exe72⤵PID:2388
-
\??\c:\nxbvbpv.exec:\nxbvbpv.exe73⤵PID:2808
-
\??\c:\rvptp.exec:\rvptp.exe74⤵PID:2592
-
\??\c:\jfxrl.exec:\jfxrl.exe75⤵PID:1748
-
\??\c:\xttbb.exec:\xttbb.exe76⤵PID:1808
-
\??\c:\blnlf.exec:\blnlf.exe77⤵PID:892
-
\??\c:\tntjjf.exec:\tntjjf.exe78⤵
- System Location Discovery: System Language Discovery
PID:2424 -
\??\c:\hnjhbnl.exec:\hnjhbnl.exe79⤵PID:1984
-
\??\c:\jpxrbd.exec:\jpxrbd.exe80⤵PID:1704
-
\??\c:\frbpb.exec:\frbpb.exe81⤵PID:2040
-
\??\c:\rbjxd.exec:\rbjxd.exe82⤵PID:2004
-
\??\c:\xffxp.exec:\xffxp.exe83⤵PID:3060
-
\??\c:\lphnrt.exec:\lphnrt.exe84⤵PID:2924
-
\??\c:\pnnbjr.exec:\pnnbjr.exe85⤵PID:1740
-
\??\c:\xbfhxv.exec:\xbfhxv.exe86⤵PID:2968
-
\??\c:\xlflfxx.exec:\xlflfxx.exe87⤵PID:2920
-
\??\c:\rjxnf.exec:\rjxnf.exe88⤵PID:2444
-
\??\c:\bnrfr.exec:\bnrfr.exe89⤵PID:2820
-
\??\c:\ldtflp.exec:\ldtflp.exe90⤵PID:2856
-
\??\c:\vppndbj.exec:\vppndbj.exe91⤵PID:2784
-
\??\c:\ppttd.exec:\ppttd.exe92⤵PID:1040
-
\??\c:\hnfdn.exec:\hnfdn.exe93⤵PID:1444
-
\??\c:\nxlbjr.exec:\nxlbjr.exe94⤵
- System Location Discovery: System Language Discovery
PID:2996 -
\??\c:\njjpvdx.exec:\njjpvdx.exe95⤵PID:3028
-
\??\c:\htdbnhh.exec:\htdbnhh.exe96⤵PID:2340
-
\??\c:\lrjxvx.exec:\lrjxvx.exe97⤵PID:980
-
\??\c:\rnbbx.exec:\rnbbx.exe98⤵PID:1496
-
\??\c:\njlvbbv.exec:\njlvbbv.exe99⤵PID:696
-
\??\c:\hvrhjb.exec:\hvrhjb.exe100⤵PID:1340
-
\??\c:\tjlhl.exec:\tjlhl.exe101⤵PID:580
-
\??\c:\tfxxjtj.exec:\tfxxjtj.exe102⤵PID:1760
-
\??\c:\bfhbr.exec:\bfhbr.exe103⤵PID:2052
-
\??\c:\htvrh.exec:\htvrh.exe104⤵PID:2384
-
\??\c:\brnhbbf.exec:\brnhbbf.exe105⤵PID:2464
-
\??\c:\djhnfpp.exec:\djhnfpp.exe106⤵PID:1424
-
\??\c:\jhjtj.exec:\jhjtj.exe107⤵PID:2408
-
\??\c:\dhjjdth.exec:\dhjjdth.exe108⤵PID:1716
-
\??\c:\xjnxf.exec:\xjnxf.exe109⤵PID:820
-
\??\c:\rlpfbvv.exec:\rlpfbvv.exe110⤵PID:1812
-
\??\c:\njpfnvb.exec:\njpfnvb.exe111⤵PID:1996
-
\??\c:\vtnjhj.exec:\vtnjhj.exe112⤵
- System Location Discovery: System Language Discovery
PID:1572 -
\??\c:\hfxvn.exec:\hfxvn.exe113⤵PID:2764
-
\??\c:\lplbl.exec:\lplbl.exe114⤵PID:1744
-
\??\c:\dbnhx.exec:\dbnhx.exe115⤵PID:2780
-
\??\c:\xvfbbx.exec:\xvfbbx.exe116⤵PID:1708
-
\??\c:\ftvbhb.exec:\ftvbhb.exe117⤵PID:2892
-
\??\c:\lpnvvh.exec:\lpnvvh.exe118⤵PID:2752
-
\??\c:\tnrrprt.exec:\tnrrprt.exe119⤵PID:1816
-
\??\c:\xrrjtxj.exec:\xrrjtxj.exe120⤵PID:1736
-
\??\c:\nbjtplf.exec:\nbjtplf.exe121⤵PID:2620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-