Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 01:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7d2a67e0fdb957ee2d8607d193563b81ed334582911412a9f829d3492fc0bdbb.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
7d2a67e0fdb957ee2d8607d193563b81ed334582911412a9f829d3492fc0bdbb.exe
-
Size
457KB
-
MD5
8228290a8cff928c919db0bf6e5c77fd
-
SHA1
21421f457d36cadc521b5206e97877e1bd7a9da7
-
SHA256
7d2a67e0fdb957ee2d8607d193563b81ed334582911412a9f829d3492fc0bdbb
-
SHA512
c9d2b6038abaed0bd8d2f3c17b517d4b4fc558bd449365e0e734a368eccac5b632d82f0530b862799a3dea4fc8c240f8d4492f526ffeb5e94cbf418a0db9187f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbelN:q7Tc2NYHUrAwfMp3CD3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2244-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-81-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2608-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/868-88-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1532-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-307-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2900-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-493-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1992-518-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/524-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/524-557-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1240-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-590-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1616-609-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2148-610-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2368-704-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1960-773-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2448 hpjthnl.exe 2956 vpdrpvr.exe 2888 lvfhjf.exe 2908 nrnbpp.exe 2772 hhhpxp.exe 2752 nbrhxn.exe 2620 trnvnxn.exe 2608 brnnn.exe 868 nrtlx.exe 1708 lhvxh.exe 1532 ljtdxdr.exe 2692 xdrvtv.exe 2340 vvhvv.exe 3024 bvdrnxr.exe 1972 dbjfljp.exe 2420 nhtnnjh.exe 1932 ffxnpr.exe 2116 hhrxft.exe 2484 jxbjjd.exe 2564 rrlfp.exe 2060 xptrpx.exe 980 fjltl.exe 1992 jnvxpbj.exe 704 ljffvf.exe 236 tnvddhn.exe 2388 vxpvntf.exe 1944 tnpfl.exe 2680 lpjvhhh.exe 2660 pplvtf.exe 2440 hbjpl.exe 1152 vtdfl.exe 1716 jbndhl.exe 2248 hlxnt.exe 2968 lfnjrjr.exe 2980 rtbvf.exe 2876 vrlnjtl.exe 2900 vtrjfx.exe 2920 drxtf.exe 2884 hjxxb.exe 2748 hjhtjbh.exe 1376 hlpdj.exe 2824 hnhlnt.exe 3048 rpfllp.exe 568 jdvdrvt.exe 2556 nftlrxp.exe 2064 fxthlfd.exe 2020 dttffrv.exe 316 xxfjll.exe 3064 nvfljtr.exe 3052 xpffdt.exe 3060 blhpxf.exe 2940 bbjhv.exe 2656 rhrlj.exe 1176 vjdrld.exe 324 ljjrtt.exe 2460 tlbhd.exe 2452 hnblxjd.exe 2500 nfrlvh.exe 2564 bxpflt.exe 2124 rppvjrb.exe 1096 jrhbjlv.exe 2160 xfrtlpx.exe 1992 dffvpp.exe 704 jxbnnt.exe -
resource yara_rule behavioral1/memory/2244-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-399-0x0000000001C80000-0x0000000001CAA000-memory.dmp upx behavioral1/memory/2020-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/704-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/524-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-704-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2308-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-760-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-807-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxnvnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brjfjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrtdxtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xppdprf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvfbfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnvtvlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhtdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxrnrhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flvbfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfprrrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvlvvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhnldxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhlxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtxvbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnpxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rptrvjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntltf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtxlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrhvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdxrjlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drxtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npxbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2448 2244 7d2a67e0fdb957ee2d8607d193563b81ed334582911412a9f829d3492fc0bdbb.exe 30 PID 2244 wrote to memory of 2448 2244 7d2a67e0fdb957ee2d8607d193563b81ed334582911412a9f829d3492fc0bdbb.exe 30 PID 2244 wrote to memory of 2448 2244 7d2a67e0fdb957ee2d8607d193563b81ed334582911412a9f829d3492fc0bdbb.exe 30 PID 2244 wrote to memory of 2448 2244 7d2a67e0fdb957ee2d8607d193563b81ed334582911412a9f829d3492fc0bdbb.exe 30 PID 2448 wrote to memory of 2956 2448 hpjthnl.exe 31 PID 2448 wrote to memory of 2956 2448 hpjthnl.exe 31 PID 2448 wrote to memory of 2956 2448 hpjthnl.exe 31 PID 2448 wrote to memory of 2956 2448 hpjthnl.exe 31 PID 2956 wrote to memory of 2888 2956 vpdrpvr.exe 32 PID 2956 wrote to memory of 2888 2956 vpdrpvr.exe 32 PID 2956 wrote to memory of 2888 2956 vpdrpvr.exe 32 PID 2956 wrote to memory of 2888 2956 vpdrpvr.exe 32 PID 2888 wrote to memory of 2908 2888 lvfhjf.exe 33 PID 2888 wrote to memory of 2908 2888 lvfhjf.exe 33 PID 2888 wrote to memory of 2908 2888 lvfhjf.exe 33 PID 2888 wrote to memory of 2908 2888 lvfhjf.exe 33 PID 2908 wrote to memory of 2772 2908 nrnbpp.exe 34 PID 2908 wrote to memory of 2772 2908 nrnbpp.exe 34 PID 2908 wrote to memory of 2772 2908 nrnbpp.exe 34 PID 2908 wrote to memory of 2772 2908 nrnbpp.exe 34 PID 2772 wrote to memory of 2752 2772 hhhpxp.exe 35 PID 2772 wrote to memory of 2752 2772 hhhpxp.exe 35 PID 2772 wrote to memory of 2752 2772 hhhpxp.exe 35 PID 2772 wrote to memory of 2752 2772 hhhpxp.exe 35 PID 2752 wrote to memory of 2620 2752 nbrhxn.exe 36 PID 2752 wrote to memory of 2620 2752 nbrhxn.exe 36 PID 2752 wrote to memory of 2620 2752 nbrhxn.exe 36 PID 2752 wrote to memory of 2620 2752 nbrhxn.exe 36 PID 2620 wrote to memory of 2608 2620 trnvnxn.exe 37 PID 2620 wrote to memory of 2608 2620 trnvnxn.exe 37 PID 2620 wrote to memory of 2608 2620 trnvnxn.exe 37 PID 2620 wrote to memory of 2608 2620 trnvnxn.exe 37 PID 2608 wrote to memory of 868 2608 brnnn.exe 38 PID 2608 wrote to memory of 868 2608 brnnn.exe 38 PID 2608 wrote to memory of 868 2608 brnnn.exe 38 PID 2608 wrote to memory of 868 2608 brnnn.exe 38 PID 868 wrote to memory of 1708 868 nrtlx.exe 39 PID 868 wrote to memory of 1708 868 nrtlx.exe 39 PID 868 wrote to memory of 1708 868 nrtlx.exe 39 PID 868 wrote to memory of 1708 868 nrtlx.exe 39 PID 1708 wrote to memory of 1532 1708 lhvxh.exe 40 PID 1708 wrote to memory of 1532 1708 lhvxh.exe 40 PID 1708 wrote to memory of 1532 1708 lhvxh.exe 40 PID 1708 wrote to memory of 1532 1708 lhvxh.exe 40 PID 1532 wrote to memory of 2692 1532 ljtdxdr.exe 41 PID 1532 wrote to memory of 2692 1532 ljtdxdr.exe 41 PID 1532 wrote to memory of 2692 1532 ljtdxdr.exe 41 PID 1532 wrote to memory of 2692 1532 ljtdxdr.exe 41 PID 2692 wrote to memory of 2340 2692 xdrvtv.exe 42 PID 2692 wrote to memory of 2340 2692 xdrvtv.exe 42 PID 2692 wrote to memory of 2340 2692 xdrvtv.exe 42 PID 2692 wrote to memory of 2340 2692 xdrvtv.exe 42 PID 2340 wrote to memory of 3024 2340 vvhvv.exe 43 PID 2340 wrote to memory of 3024 2340 vvhvv.exe 43 PID 2340 wrote to memory of 3024 2340 vvhvv.exe 43 PID 2340 wrote to memory of 3024 2340 vvhvv.exe 43 PID 3024 wrote to memory of 1972 3024 bvdrnxr.exe 44 PID 3024 wrote to memory of 1972 3024 bvdrnxr.exe 44 PID 3024 wrote to memory of 1972 3024 bvdrnxr.exe 44 PID 3024 wrote to memory of 1972 3024 bvdrnxr.exe 44 PID 1972 wrote to memory of 2420 1972 dbjfljp.exe 45 PID 1972 wrote to memory of 2420 1972 dbjfljp.exe 45 PID 1972 wrote to memory of 2420 1972 dbjfljp.exe 45 PID 1972 wrote to memory of 2420 1972 dbjfljp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d2a67e0fdb957ee2d8607d193563b81ed334582911412a9f829d3492fc0bdbb.exe"C:\Users\Admin\AppData\Local\Temp\7d2a67e0fdb957ee2d8607d193563b81ed334582911412a9f829d3492fc0bdbb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\hpjthnl.exec:\hpjthnl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\vpdrpvr.exec:\vpdrpvr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\lvfhjf.exec:\lvfhjf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\nrnbpp.exec:\nrnbpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\hhhpxp.exec:\hhhpxp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\nbrhxn.exec:\nbrhxn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\trnvnxn.exec:\trnvnxn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\brnnn.exec:\brnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\nrtlx.exec:\nrtlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\lhvxh.exec:\lhvxh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\ljtdxdr.exec:\ljtdxdr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\xdrvtv.exec:\xdrvtv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\vvhvv.exec:\vvhvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\bvdrnxr.exec:\bvdrnxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\dbjfljp.exec:\dbjfljp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\nhtnnjh.exec:\nhtnnjh.exe17⤵
- Executes dropped EXE
PID:2420 -
\??\c:\ffxnpr.exec:\ffxnpr.exe18⤵
- Executes dropped EXE
PID:1932 -
\??\c:\hhrxft.exec:\hhrxft.exe19⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jxbjjd.exec:\jxbjjd.exe20⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rrlfp.exec:\rrlfp.exe21⤵
- Executes dropped EXE
PID:2564 -
\??\c:\xptrpx.exec:\xptrpx.exe22⤵
- Executes dropped EXE
PID:2060 -
\??\c:\fjltl.exec:\fjltl.exe23⤵
- Executes dropped EXE
PID:980 -
\??\c:\jnvxpbj.exec:\jnvxpbj.exe24⤵
- Executes dropped EXE
PID:1992 -
\??\c:\ljffvf.exec:\ljffvf.exe25⤵
- Executes dropped EXE
PID:704 -
\??\c:\tnvddhn.exec:\tnvddhn.exe26⤵
- Executes dropped EXE
PID:236 -
\??\c:\vxpvntf.exec:\vxpvntf.exe27⤵
- Executes dropped EXE
PID:2388 -
\??\c:\tnpfl.exec:\tnpfl.exe28⤵
- Executes dropped EXE
PID:1944 -
\??\c:\lpjvhhh.exec:\lpjvhhh.exe29⤵
- Executes dropped EXE
PID:2680 -
\??\c:\pplvtf.exec:\pplvtf.exe30⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hbjpl.exec:\hbjpl.exe31⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vtdfl.exec:\vtdfl.exe32⤵
- Executes dropped EXE
PID:1152 -
\??\c:\jbndhl.exec:\jbndhl.exe33⤵
- Executes dropped EXE
PID:1716 -
\??\c:\hlxnt.exec:\hlxnt.exe34⤵
- Executes dropped EXE
PID:2248 -
\??\c:\lfnjrjr.exec:\lfnjrjr.exe35⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rtbvf.exec:\rtbvf.exe36⤵
- Executes dropped EXE
PID:2980 -
\??\c:\vrlnjtl.exec:\vrlnjtl.exe37⤵
- Executes dropped EXE
PID:2876 -
\??\c:\vtrjfx.exec:\vtrjfx.exe38⤵
- Executes dropped EXE
PID:2900 -
\??\c:\drxtf.exec:\drxtf.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2920 -
\??\c:\hjxxb.exec:\hjxxb.exe40⤵
- Executes dropped EXE
PID:2884 -
\??\c:\hjhtjbh.exec:\hjhtjbh.exe41⤵
- Executes dropped EXE
PID:2748 -
\??\c:\hlpdj.exec:\hlpdj.exe42⤵
- Executes dropped EXE
PID:1376 -
\??\c:\hnhlnt.exec:\hnhlnt.exe43⤵
- Executes dropped EXE
PID:2824 -
\??\c:\rpfllp.exec:\rpfllp.exe44⤵
- Executes dropped EXE
PID:3048 -
\??\c:\jdvdrvt.exec:\jdvdrvt.exe45⤵
- Executes dropped EXE
PID:568 -
\??\c:\nftlrxp.exec:\nftlrxp.exe46⤵
- Executes dropped EXE
PID:2556 -
\??\c:\fxthlfd.exec:\fxthlfd.exe47⤵
- Executes dropped EXE
PID:2064 -
\??\c:\dttffrv.exec:\dttffrv.exe48⤵
- Executes dropped EXE
PID:2020 -
\??\c:\xxfjll.exec:\xxfjll.exe49⤵
- Executes dropped EXE
PID:316 -
\??\c:\nvfljtr.exec:\nvfljtr.exe50⤵
- Executes dropped EXE
PID:3064 -
\??\c:\xpffdt.exec:\xpffdt.exe51⤵
- Executes dropped EXE
PID:3052 -
\??\c:\blhpxf.exec:\blhpxf.exe52⤵
- Executes dropped EXE
PID:3060 -
\??\c:\bbjhv.exec:\bbjhv.exe53⤵
- Executes dropped EXE
PID:2940 -
\??\c:\rhrlj.exec:\rhrlj.exe54⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vjdrld.exec:\vjdrld.exe55⤵
- Executes dropped EXE
PID:1176 -
\??\c:\ljjrtt.exec:\ljjrtt.exe56⤵
- Executes dropped EXE
PID:324 -
\??\c:\tlbhd.exec:\tlbhd.exe57⤵
- Executes dropped EXE
PID:2460 -
\??\c:\hnblxjd.exec:\hnblxjd.exe58⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nfrlvh.exec:\nfrlvh.exe59⤵
- Executes dropped EXE
PID:2500 -
\??\c:\bxpflt.exec:\bxpflt.exe60⤵
- Executes dropped EXE
PID:2564 -
\??\c:\rppvjrb.exec:\rppvjrb.exe61⤵
- Executes dropped EXE
PID:2124 -
\??\c:\jrhbjlv.exec:\jrhbjlv.exe62⤵
- Executes dropped EXE
PID:1096 -
\??\c:\xfrtlpx.exec:\xfrtlpx.exe63⤵
- Executes dropped EXE
PID:2160 -
\??\c:\dffvpp.exec:\dffvpp.exe64⤵
- Executes dropped EXE
PID:1992 -
\??\c:\jxbnnt.exec:\jxbnnt.exe65⤵
- Executes dropped EXE
PID:704 -
\??\c:\jthdnl.exec:\jthdnl.exe66⤵PID:524
-
\??\c:\bjtjd.exec:\bjtjd.exe67⤵PID:676
-
\??\c:\nhtrrjf.exec:\nhtrrjf.exe68⤵PID:2100
-
\??\c:\fjpvpjh.exec:\fjpvpjh.exe69⤵PID:584
-
\??\c:\lbfnhvf.exec:\lbfnhvf.exe70⤵PID:2316
-
\??\c:\dlxfvxd.exec:\dlxfvxd.exe71⤵PID:1060
-
\??\c:\jnjbn.exec:\jnjbn.exe72⤵PID:2440
-
\??\c:\xthnlx.exec:\xthnlx.exe73⤵PID:1240
-
\??\c:\ntntptf.exec:\ntntptf.exe74⤵PID:2148
-
\??\c:\rxlhd.exec:\rxlhd.exe75⤵PID:2224
-
\??\c:\bdhbjdr.exec:\bdhbjdr.exe76⤵PID:2244
-
\??\c:\tvhjl.exec:\tvhjl.exe77⤵PID:1616
-
\??\c:\xxfbb.exec:\xxfbb.exe78⤵PID:2960
-
\??\c:\bdxxdv.exec:\bdxxdv.exe79⤵PID:2880
-
\??\c:\lxrvh.exec:\lxrvh.exe80⤵PID:3008
-
\??\c:\fjxjn.exec:\fjxjn.exe81⤵PID:2168
-
\??\c:\nfprrrd.exec:\nfprrrd.exe82⤵
- System Location Discovery: System Language Discovery
PID:2176 -
\??\c:\xhnhp.exec:\xhnhp.exe83⤵PID:2764
-
\??\c:\fxnfv.exec:\fxnfv.exe84⤵PID:2744
-
\??\c:\xvvpnnr.exec:\xvvpnnr.exe85⤵PID:2812
-
\??\c:\njrrnpf.exec:\njrrnpf.exe86⤵PID:2612
-
\??\c:\xpnxllb.exec:\xpnxllb.exe87⤵PID:944
-
\??\c:\pjdbj.exec:\pjdbj.exe88⤵PID:2180
-
\??\c:\jnbfft.exec:\jnbfft.exe89⤵PID:964
-
\??\c:\lllphpp.exec:\lllphpp.exe90⤵PID:1140
-
\??\c:\brlpvv.exec:\brlpvv.exe91⤵PID:3044
-
\??\c:\vtlvx.exec:\vtlvx.exe92⤵PID:1144
-
\??\c:\rrbprf.exec:\rrbprf.exe93⤵PID:2368
-
\??\c:\xvfbfr.exec:\xvfbfr.exe94⤵
- System Location Discovery: System Language Discovery
PID:2184 -
\??\c:\lvhjpbj.exec:\lvhjpbj.exe95⤵PID:2340
-
\??\c:\xvtxd.exec:\xvtxd.exe96⤵PID:2516
-
\??\c:\jffrjt.exec:\jffrjt.exe97⤵PID:2504
-
\??\c:\jftvl.exec:\jftvl.exe98⤵PID:2608
-
\??\c:\lhpvt.exec:\lhpvt.exe99⤵PID:2220
-
\??\c:\jtrbpjr.exec:\jtrbpjr.exe100⤵PID:2308
-
\??\c:\blrrfn.exec:\blrrfn.exe101⤵PID:1204
-
\??\c:\jbthb.exec:\jbthb.exe102⤵PID:2288
-
\??\c:\drlrt.exec:\drlrt.exe103⤵PID:1960
-
\??\c:\lbtlhdr.exec:\lbtlhdr.exe104⤵PID:1072
-
\??\c:\djjfpr.exec:\djjfpr.exe105⤵PID:1020
-
\??\c:\tdrnt.exec:\tdrnt.exe106⤵PID:780
-
\??\c:\fftlh.exec:\fftlh.exe107⤵PID:2640
-
\??\c:\brldpv.exec:\brldpv.exe108⤵PID:948
-
\??\c:\jbblnb.exec:\jbblnb.exe109⤵PID:2724
-
\??\c:\bbbxh.exec:\bbbxh.exe110⤵PID:236
-
\??\c:\fvnrlb.exec:\fvnrlb.exe111⤵PID:1216
-
\??\c:\njrvlt.exec:\njrvlt.exe112⤵PID:676
-
\??\c:\fbdfpv.exec:\fbdfpv.exe113⤵PID:596
-
\??\c:\hrfltlh.exec:\hrfltlh.exe114⤵PID:2680
-
\??\c:\nvnrhd.exec:\nvnrhd.exe115⤵PID:2660
-
\??\c:\blftj.exec:\blftj.exe116⤵PID:1696
-
\??\c:\dbtfpv.exec:\dbtfpv.exe117⤵PID:2440
-
\??\c:\xlxnhf.exec:\xlxnhf.exe118⤵PID:1240
-
\??\c:\bpfnhdn.exec:\bpfnhdn.exe119⤵PID:2148
-
\??\c:\ppxfdl.exec:\ppxfdl.exe120⤵PID:664
-
\??\c:\jndvxhj.exec:\jndvxhj.exe121⤵PID:2244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-