Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 01:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c7df757953bd6ee8d38ffb390111c97f5b5ed685bdbfa082773a37ed2f2b453.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
7c7df757953bd6ee8d38ffb390111c97f5b5ed685bdbfa082773a37ed2f2b453.exe
-
Size
455KB
-
MD5
6b13ece23985bc38347e0bb7993024dd
-
SHA1
c0d50b1d5f9b3f988ee93932855eacdde942692b
-
SHA256
7c7df757953bd6ee8d38ffb390111c97f5b5ed685bdbfa082773a37ed2f2b453
-
SHA512
8855a75c2ec200aa68212ef6ce1d56081f9361249971cc128c930132a641df30b71fd7b1fe048f5d6e0fc939b334159f749f7c39ef0f21d4e3fe1e86b8443ed8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2524-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1472-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-165-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2164-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1472-426-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2336-466-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/892-517-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/1496-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-543-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2580-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-623-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-661-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2304-683-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2872-700-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-735-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1772-820-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2596-846-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2076 bdphtlv.exe 1476 vblrpv.exe 2980 nxpdpnf.exe 2776 vbvlvtv.exe 1048 ldhftj.exe 2796 hvjdjrj.exe 2564 btvnb.exe 832 vjvffbt.exe 2452 bnpdj.exe 1472 tptnphb.exe 2700 lrrtdb.exe 2136 brhpb.exe 2832 hlxnjpv.exe 2368 rpdpxp.exe 2300 djhrn.exe 272 hxrxhb.exe 1880 pphbvvn.exe 2164 tdxppl.exe 2432 vnnpxlj.exe 2256 nfblbl.exe 960 djbdlvp.exe 904 hlffb.exe 2584 llhbdfd.exe 2064 dlfvj.exe 1496 ptjfxr.exe 1932 rdhdxrl.exe 1772 xdhlp.exe 1436 bdbpxd.exe 1328 flrvn.exe 1960 ndlnh.exe 1040 dhdvvhj.exe 2020 tffvrlj.exe 1616 jxxlf.exe 1272 jjpndxf.exe 2916 jdtbh.exe 1476 jfphf.exe 2876 frntxp.exe 3056 httvp.exe 2808 ttftdtn.exe 2824 pnjnv.exe 2908 pnrrl.exe 644 ftrdjx.exe 2564 xbldj.exe 836 fvdtj.exe 2628 bndpd.exe 2268 dfffltx.exe 1472 rxlbv.exe 1276 lbndxp.exe 1928 rrdht.exe 1956 xjrjdj.exe 2112 vrjjrxj.exe 2480 hnpdt.exe 2336 bvptx.exe 284 dhthf.exe 2000 hbjjbbj.exe 588 btfrx.exe 2428 pdtnhv.exe 368 thpndv.exe 2052 pdnhdt.exe 2128 xjtdhxn.exe 892 flldl.exe 2188 lvxjf.exe 2140 tpljj.exe 2460 vxnnpbv.exe -
resource yara_rule behavioral1/memory/2524-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-517-0x0000000000340000-0x000000000036A000-memory.dmp upx behavioral1/memory/1496-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-683-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2872-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-708-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-813-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-853-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-866-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxbjrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrhfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnldnnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxvbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvjdjrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrbjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdhdhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txpvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blhppxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljxjrft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdjxhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbxnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfblx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhjrpll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrrrpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbbvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlblhpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftpjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlvxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxhjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnfhtbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrjhtxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfrprb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdfdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jldjnlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txpptl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntpltv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npvtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brvbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvbrdhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlvbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffhpjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2076 2524 7c7df757953bd6ee8d38ffb390111c97f5b5ed685bdbfa082773a37ed2f2b453.exe 30 PID 2524 wrote to memory of 2076 2524 7c7df757953bd6ee8d38ffb390111c97f5b5ed685bdbfa082773a37ed2f2b453.exe 30 PID 2524 wrote to memory of 2076 2524 7c7df757953bd6ee8d38ffb390111c97f5b5ed685bdbfa082773a37ed2f2b453.exe 30 PID 2524 wrote to memory of 2076 2524 7c7df757953bd6ee8d38ffb390111c97f5b5ed685bdbfa082773a37ed2f2b453.exe 30 PID 2076 wrote to memory of 1476 2076 bdphtlv.exe 31 PID 2076 wrote to memory of 1476 2076 bdphtlv.exe 31 PID 2076 wrote to memory of 1476 2076 bdphtlv.exe 31 PID 2076 wrote to memory of 1476 2076 bdphtlv.exe 31 PID 1476 wrote to memory of 2980 1476 vblrpv.exe 32 PID 1476 wrote to memory of 2980 1476 vblrpv.exe 32 PID 1476 wrote to memory of 2980 1476 vblrpv.exe 32 PID 1476 wrote to memory of 2980 1476 vblrpv.exe 32 PID 2980 wrote to memory of 2776 2980 nxpdpnf.exe 33 PID 2980 wrote to memory of 2776 2980 nxpdpnf.exe 33 PID 2980 wrote to memory of 2776 2980 nxpdpnf.exe 33 PID 2980 wrote to memory of 2776 2980 nxpdpnf.exe 33 PID 2776 wrote to memory of 1048 2776 vbvlvtv.exe 34 PID 2776 wrote to memory of 1048 2776 vbvlvtv.exe 34 PID 2776 wrote to memory of 1048 2776 vbvlvtv.exe 34 PID 2776 wrote to memory of 1048 2776 vbvlvtv.exe 34 PID 1048 wrote to memory of 2796 1048 ldhftj.exe 35 PID 1048 wrote to memory of 2796 1048 ldhftj.exe 35 PID 1048 wrote to memory of 2796 1048 ldhftj.exe 35 PID 1048 wrote to memory of 2796 1048 ldhftj.exe 35 PID 2796 wrote to memory of 2564 2796 hvjdjrj.exe 36 PID 2796 wrote to memory of 2564 2796 hvjdjrj.exe 36 PID 2796 wrote to memory of 2564 2796 hvjdjrj.exe 36 PID 2796 wrote to memory of 2564 2796 hvjdjrj.exe 36 PID 2564 wrote to memory of 832 2564 btvnb.exe 37 PID 2564 wrote to memory of 832 2564 btvnb.exe 37 PID 2564 wrote to memory of 832 2564 btvnb.exe 37 PID 2564 wrote to memory of 832 2564 btvnb.exe 37 PID 832 wrote to memory of 2452 832 vjvffbt.exe 38 PID 832 wrote to memory of 2452 832 vjvffbt.exe 38 PID 832 wrote to memory of 2452 832 vjvffbt.exe 38 PID 832 wrote to memory of 2452 832 vjvffbt.exe 38 PID 2452 wrote to memory of 1472 2452 bnpdj.exe 39 PID 2452 wrote to memory of 1472 2452 bnpdj.exe 39 PID 2452 wrote to memory of 1472 2452 bnpdj.exe 39 PID 2452 wrote to memory of 1472 2452 bnpdj.exe 39 PID 1472 wrote to memory of 2700 1472 tptnphb.exe 40 PID 1472 wrote to memory of 2700 1472 tptnphb.exe 40 PID 1472 wrote to memory of 2700 1472 tptnphb.exe 40 PID 1472 wrote to memory of 2700 1472 tptnphb.exe 40 PID 2700 wrote to memory of 2136 2700 lrrtdb.exe 41 PID 2700 wrote to memory of 2136 2700 lrrtdb.exe 41 PID 2700 wrote to memory of 2136 2700 lrrtdb.exe 41 PID 2700 wrote to memory of 2136 2700 lrrtdb.exe 41 PID 2136 wrote to memory of 2832 2136 brhpb.exe 42 PID 2136 wrote to memory of 2832 2136 brhpb.exe 42 PID 2136 wrote to memory of 2832 2136 brhpb.exe 42 PID 2136 wrote to memory of 2832 2136 brhpb.exe 42 PID 2832 wrote to memory of 2368 2832 hlxnjpv.exe 43 PID 2832 wrote to memory of 2368 2832 hlxnjpv.exe 43 PID 2832 wrote to memory of 2368 2832 hlxnjpv.exe 43 PID 2832 wrote to memory of 2368 2832 hlxnjpv.exe 43 PID 2368 wrote to memory of 2300 2368 rpdpxp.exe 44 PID 2368 wrote to memory of 2300 2368 rpdpxp.exe 44 PID 2368 wrote to memory of 2300 2368 rpdpxp.exe 44 PID 2368 wrote to memory of 2300 2368 rpdpxp.exe 44 PID 2300 wrote to memory of 272 2300 djhrn.exe 45 PID 2300 wrote to memory of 272 2300 djhrn.exe 45 PID 2300 wrote to memory of 272 2300 djhrn.exe 45 PID 2300 wrote to memory of 272 2300 djhrn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c7df757953bd6ee8d38ffb390111c97f5b5ed685bdbfa082773a37ed2f2b453.exe"C:\Users\Admin\AppData\Local\Temp\7c7df757953bd6ee8d38ffb390111c97f5b5ed685bdbfa082773a37ed2f2b453.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\bdphtlv.exec:\bdphtlv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\vblrpv.exec:\vblrpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\nxpdpnf.exec:\nxpdpnf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\vbvlvtv.exec:\vbvlvtv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\ldhftj.exec:\ldhftj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\hvjdjrj.exec:\hvjdjrj.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\btvnb.exec:\btvnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\vjvffbt.exec:\vjvffbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\bnpdj.exec:\bnpdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\tptnphb.exec:\tptnphb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\lrrtdb.exec:\lrrtdb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\brhpb.exec:\brhpb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\hlxnjpv.exec:\hlxnjpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\rpdpxp.exec:\rpdpxp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\djhrn.exec:\djhrn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\hxrxhb.exec:\hxrxhb.exe17⤵
- Executes dropped EXE
PID:272 -
\??\c:\pphbvvn.exec:\pphbvvn.exe18⤵
- Executes dropped EXE
PID:1880 -
\??\c:\tdxppl.exec:\tdxppl.exe19⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vnnpxlj.exec:\vnnpxlj.exe20⤵
- Executes dropped EXE
PID:2432 -
\??\c:\nfblbl.exec:\nfblbl.exe21⤵
- Executes dropped EXE
PID:2256 -
\??\c:\djbdlvp.exec:\djbdlvp.exe22⤵
- Executes dropped EXE
PID:960 -
\??\c:\hlffb.exec:\hlffb.exe23⤵
- Executes dropped EXE
PID:904 -
\??\c:\llhbdfd.exec:\llhbdfd.exe24⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dlfvj.exec:\dlfvj.exe25⤵
- Executes dropped EXE
PID:2064 -
\??\c:\ptjfxr.exec:\ptjfxr.exe26⤵
- Executes dropped EXE
PID:1496 -
\??\c:\rdhdxrl.exec:\rdhdxrl.exe27⤵
- Executes dropped EXE
PID:1932 -
\??\c:\xdhlp.exec:\xdhlp.exe28⤵
- Executes dropped EXE
PID:1772 -
\??\c:\bdbpxd.exec:\bdbpxd.exe29⤵
- Executes dropped EXE
PID:1436 -
\??\c:\flrvn.exec:\flrvn.exe30⤵
- Executes dropped EXE
PID:1328 -
\??\c:\ndlnh.exec:\ndlnh.exe31⤵
- Executes dropped EXE
PID:1960 -
\??\c:\dhdvvhj.exec:\dhdvvhj.exe32⤵
- Executes dropped EXE
PID:1040 -
\??\c:\tffvrlj.exec:\tffvrlj.exe33⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jxxlf.exec:\jxxlf.exe34⤵
- Executes dropped EXE
PID:1616 -
\??\c:\jjpndxf.exec:\jjpndxf.exe35⤵
- Executes dropped EXE
PID:1272 -
\??\c:\jdtbh.exec:\jdtbh.exe36⤵
- Executes dropped EXE
PID:2916 -
\??\c:\jfphf.exec:\jfphf.exe37⤵
- Executes dropped EXE
PID:1476 -
\??\c:\frntxp.exec:\frntxp.exe38⤵
- Executes dropped EXE
PID:2876 -
\??\c:\httvp.exec:\httvp.exe39⤵
- Executes dropped EXE
PID:3056 -
\??\c:\ttftdtn.exec:\ttftdtn.exe40⤵
- Executes dropped EXE
PID:2808 -
\??\c:\pnjnv.exec:\pnjnv.exe41⤵
- Executes dropped EXE
PID:2824 -
\??\c:\pnrrl.exec:\pnrrl.exe42⤵
- Executes dropped EXE
PID:2908 -
\??\c:\ftrdjx.exec:\ftrdjx.exe43⤵
- Executes dropped EXE
PID:644 -
\??\c:\xbldj.exec:\xbldj.exe44⤵
- Executes dropped EXE
PID:2564 -
\??\c:\fvdtj.exec:\fvdtj.exe45⤵
- Executes dropped EXE
PID:836 -
\??\c:\bndpd.exec:\bndpd.exe46⤵
- Executes dropped EXE
PID:2628 -
\??\c:\dfffltx.exec:\dfffltx.exe47⤵
- Executes dropped EXE
PID:2268 -
\??\c:\rxlbv.exec:\rxlbv.exe48⤵
- Executes dropped EXE
PID:1472 -
\??\c:\lbndxp.exec:\lbndxp.exe49⤵
- Executes dropped EXE
PID:1276 -
\??\c:\rrdht.exec:\rrdht.exe50⤵
- Executes dropped EXE
PID:1928 -
\??\c:\xjrjdj.exec:\xjrjdj.exe51⤵
- Executes dropped EXE
PID:1956 -
\??\c:\vrjjrxj.exec:\vrjjrxj.exe52⤵
- Executes dropped EXE
PID:2112 -
\??\c:\hnpdt.exec:\hnpdt.exe53⤵
- Executes dropped EXE
PID:2480 -
\??\c:\bvptx.exec:\bvptx.exe54⤵
- Executes dropped EXE
PID:2336 -
\??\c:\dhthf.exec:\dhthf.exe55⤵
- Executes dropped EXE
PID:284 -
\??\c:\hbjjbbj.exec:\hbjjbbj.exe56⤵
- Executes dropped EXE
PID:2000 -
\??\c:\btfrx.exec:\btfrx.exe57⤵
- Executes dropped EXE
PID:588 -
\??\c:\pdtnhv.exec:\pdtnhv.exe58⤵
- Executes dropped EXE
PID:2428 -
\??\c:\thpndv.exec:\thpndv.exe59⤵
- Executes dropped EXE
PID:368 -
\??\c:\pdnhdt.exec:\pdnhdt.exe60⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xjtdhxn.exec:\xjtdhxn.exe61⤵
- Executes dropped EXE
PID:2128 -
\??\c:\flldl.exec:\flldl.exe62⤵
- Executes dropped EXE
PID:892 -
\??\c:\lvxjf.exec:\lvxjf.exe63⤵
- Executes dropped EXE
PID:2188 -
\??\c:\tpljj.exec:\tpljj.exe64⤵
- Executes dropped EXE
PID:2140 -
\??\c:\vxnnpbv.exec:\vxnnpbv.exe65⤵
- Executes dropped EXE
PID:2460 -
\??\c:\ppfhxlt.exec:\ppfhxlt.exe66⤵PID:592
-
\??\c:\xdtvphx.exec:\xdtvphx.exe67⤵PID:1496
-
\??\c:\xptldp.exec:\xptldp.exe68⤵PID:1052
-
\??\c:\vdlplnf.exec:\vdlplnf.exe69⤵PID:2092
-
\??\c:\rjdlb.exec:\rjdlb.exe70⤵PID:1544
-
\??\c:\nbnbj.exec:\nbnbj.exe71⤵PID:1236
-
\??\c:\tdlnt.exec:\tdlnt.exe72⤵PID:2596
-
\??\c:\lvjhhv.exec:\lvjhhv.exe73⤵PID:2580
-
\??\c:\bxrjtd.exec:\bxrjtd.exe74⤵PID:2716
-
\??\c:\jxpbj.exec:\jxpbj.exe75⤵PID:772
-
\??\c:\vlblhpr.exec:\vlblhpr.exe76⤵
- System Location Discovery: System Language Discovery
PID:2576 -
\??\c:\rnnjjv.exec:\rnnjjv.exe77⤵PID:2956
-
\??\c:\pjltffx.exec:\pjltffx.exe78⤵PID:2912
-
\??\c:\dfxprh.exec:\dfxprh.exe79⤵PID:2880
-
\??\c:\bjlvftl.exec:\bjlvftl.exe80⤵PID:2288
-
\??\c:\xrtjh.exec:\xrtjh.exe81⤵PID:2032
-
\??\c:\hrrjdbr.exec:\hrrjdbr.exe82⤵PID:3020
-
\??\c:\fhpll.exec:\fhpll.exe83⤵PID:2816
-
\??\c:\xprjx.exec:\xprjx.exe84⤵PID:2844
-
\??\c:\nntpprn.exec:\nntpprn.exe85⤵PID:2820
-
\??\c:\rfptd.exec:\rfptd.exe86⤵PID:2744
-
\??\c:\lbndtr.exec:\lbndtr.exe87⤵PID:2868
-
\??\c:\vtblb.exec:\vtblb.exe88⤵PID:1920
-
\??\c:\jtnrh.exec:\jtnrh.exe89⤵PID:2452
-
\??\c:\pttxpl.exec:\pttxpl.exe90⤵PID:572
-
\??\c:\lvpnnjh.exec:\lvpnnjh.exe91⤵PID:2304
-
\??\c:\jpbnvd.exec:\jpbnvd.exe92⤵PID:2332
-
\??\c:\rrhfx.exec:\rrhfx.exe93⤵
- System Location Discovery: System Language Discovery
PID:2872 -
\??\c:\jlhftft.exec:\jlhftft.exe94⤵PID:1148
-
\??\c:\njljl.exec:\njljl.exe95⤵PID:1352
-
\??\c:\dljftp.exec:\dljftp.exe96⤵PID:1016
-
\??\c:\vldhfb.exec:\vldhfb.exe97⤵PID:2300
-
\??\c:\dtdhppp.exec:\dtdhppp.exe98⤵PID:2216
-
\??\c:\xfthl.exec:\xfthl.exe99⤵PID:1880
-
\??\c:\rbtvtf.exec:\rbtvtf.exe100⤵PID:2148
-
\??\c:\jtdxvl.exec:\jtdxvl.exe101⤵PID:2632
-
\??\c:\pdhxrh.exec:\pdhxrh.exe102⤵PID:2504
-
\??\c:\btbfnh.exec:\btbfnh.exe103⤵PID:1820
-
\??\c:\hxvxxl.exec:\hxvxxl.exe104⤵PID:840
-
\??\c:\jllnnhh.exec:\jllnnhh.exe105⤵PID:2004
-
\??\c:\tvphd.exec:\tvphd.exe106⤵PID:2584
-
\??\c:\hbhlthj.exec:\hbhlthj.exe107⤵PID:2132
-
\??\c:\pbrfxbv.exec:\pbrfxbv.exe108⤵PID:1868
-
\??\c:\rrxnxd.exec:\rrxnxd.exe109⤵PID:680
-
\??\c:\xlftp.exec:\xlftp.exe110⤵PID:1536
-
\??\c:\tnrxrf.exec:\tnrxrf.exe111⤵PID:1772
-
\??\c:\thxjn.exec:\thxjn.exe112⤵PID:2028
-
\??\c:\fdtdr.exec:\fdtdr.exe113⤵PID:1436
-
\??\c:\xttbjlh.exec:\xttbjlh.exe114⤵PID:1752
-
\??\c:\hdfdnbj.exec:\hdfdnbj.exe115⤵PID:2596
-
\??\c:\vxbltvh.exec:\vxbltvh.exe116⤵PID:2636
-
\??\c:\vtjtp.exec:\vtjtp.exe117⤵PID:2560
-
\??\c:\rjlbdd.exec:\rjlbdd.exe118⤵PID:2620
-
\??\c:\bhhlvd.exec:\bhhlvd.exe119⤵PID:2576
-
\??\c:\tftdvp.exec:\tftdvp.exe120⤵PID:2956
-
\??\c:\flpxp.exec:\flpxp.exe121⤵PID:2968
-
\??\c:\rbfnx.exec:\rbfnx.exe122⤵PID:2976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-