Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 01:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe
-
Size
456KB
-
MD5
7c5ae6140ef8bdf10df5bff29e5eaa3d
-
SHA1
5e67f88f4c47fd7f230a393a5ede8bbbdc0b5e6a
-
SHA256
84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683
-
SHA512
d9c85c3aa5bf2c03b0eda75ef9fb2cf1449304c6023b9e24c1e77b1afcc95c7786136ad92a1ece457c855da0accf1a5a093efc4bccfd52a7396f90154f75e27e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1:q7Tc2NYHUrAwfMp3CD1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2396-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-37-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2540-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-45-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2884-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-74-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2292-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/936-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-315-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1144-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-422-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1832-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-480-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/648-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-516-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/856-538-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2468-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-576-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2824-643-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2736-702-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2552-774-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/316-808-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1028-835-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2436-848-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2060 brfdb.exe 2044 hndrd.exe 2952 txpjpt.exe 2540 ppprfd.exe 2884 lbpnjb.exe 2896 rlppvl.exe 2828 vdtrh.exe 2292 djdrph.exe 2672 jxbrxp.exe 1324 nltjdh.exe 2412 phlprpl.exe 1156 thhpdff.exe 2728 bvthl.exe 1532 jpjjxj.exe 2968 nldvhdp.exe 3000 pjvplx.exe 1656 hrlvvv.exe 1908 dllnp.exe 2236 jtbbttv.exe 3052 nbxvjdd.exe 2408 tjdthrf.exe 2192 tnnvjjb.exe 2320 fhnvt.exe 560 xvfdp.exe 1492 vvlhbl.exe 1104 vfvfbp.exe 1816 rbljlrp.exe 936 rrvvb.exe 1520 nntbdjl.exe 1580 djlnvp.exe 696 dhdljb.exe 1744 djlxrt.exe 2640 tprhh.exe 636 hhhjjrt.exe 2244 rvvpt.exe 1644 tttdxf.exe 1144 fltfrt.exe 2432 vbbnpf.exe 2812 hfvvl.exe 2868 vpfnj.exe 2920 pxnpnr.exe 2768 rxlprl.exe 1664 xnlpjxh.exe 1920 hlrxh.exe 2668 dfjrr.exe 2672 tfrrdvp.exe 772 hvxdnd.exe 2852 ttlbb.exe 2656 brdrttx.exe 2984 rpfhvvb.exe 2728 phjjvf.exe 1800 vdjnn.exe 2128 dtjnt.exe 2096 txbdrnx.exe 840 jrbrb.exe 1832 tvvvltb.exe 1908 hpjfdtf.exe 2844 tdbdl.exe 2416 jfvvjbv.exe 460 tbnjh.exe 1684 ffvrjt.exe 648 blnfrb.exe 960 lxtbf.exe 1584 nhxxl.exe -
resource yara_rule behavioral1/memory/2396-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/936-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/460-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-480-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/648-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-636-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1664-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-676-0x0000000001C80000-0x0000000001CAA000-memory.dmp upx behavioral1/memory/2736-702-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1760-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-776-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhrrnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbrnpxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtrtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbvpdfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dndnntv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppfnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pldvphv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prlrbfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldhdxxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnjpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxhdpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlrtdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnjdxpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prtldbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpftrpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnhdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vllvrvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxjpfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djtllv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxbrnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trdfnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npnnljj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brfdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhtxbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljfhdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fntrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbxlxfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltdndn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfhvfhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbxfbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpjdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldjrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njfjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blnfrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvphbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2396 wrote to memory of 2060 2396 84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe 29 PID 2396 wrote to memory of 2060 2396 84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe 29 PID 2396 wrote to memory of 2060 2396 84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe 29 PID 2396 wrote to memory of 2060 2396 84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe 29 PID 2060 wrote to memory of 2044 2060 brfdb.exe 30 PID 2060 wrote to memory of 2044 2060 brfdb.exe 30 PID 2060 wrote to memory of 2044 2060 brfdb.exe 30 PID 2060 wrote to memory of 2044 2060 brfdb.exe 30 PID 2044 wrote to memory of 2952 2044 hndrd.exe 31 PID 2044 wrote to memory of 2952 2044 hndrd.exe 31 PID 2044 wrote to memory of 2952 2044 hndrd.exe 31 PID 2044 wrote to memory of 2952 2044 hndrd.exe 31 PID 2952 wrote to memory of 2540 2952 txpjpt.exe 32 PID 2952 wrote to memory of 2540 2952 txpjpt.exe 32 PID 2952 wrote to memory of 2540 2952 txpjpt.exe 32 PID 2952 wrote to memory of 2540 2952 txpjpt.exe 32 PID 2540 wrote to memory of 2884 2540 ppprfd.exe 33 PID 2540 wrote to memory of 2884 2540 ppprfd.exe 33 PID 2540 wrote to memory of 2884 2540 ppprfd.exe 33 PID 2540 wrote to memory of 2884 2540 ppprfd.exe 33 PID 2884 wrote to memory of 2896 2884 lbpnjb.exe 34 PID 2884 wrote to memory of 2896 2884 lbpnjb.exe 34 PID 2884 wrote to memory of 2896 2884 lbpnjb.exe 34 PID 2884 wrote to memory of 2896 2884 lbpnjb.exe 34 PID 2896 wrote to memory of 2828 2896 rlppvl.exe 35 PID 2896 wrote to memory of 2828 2896 rlppvl.exe 35 PID 2896 wrote to memory of 2828 2896 rlppvl.exe 35 PID 2896 wrote to memory of 2828 2896 rlppvl.exe 35 PID 2828 wrote to memory of 2292 2828 vdtrh.exe 36 PID 2828 wrote to memory of 2292 2828 vdtrh.exe 36 PID 2828 wrote to memory of 2292 2828 vdtrh.exe 36 PID 2828 wrote to memory of 2292 2828 vdtrh.exe 36 PID 2292 wrote to memory of 2672 2292 djdrph.exe 37 PID 2292 wrote to memory of 2672 2292 djdrph.exe 37 PID 2292 wrote to memory of 2672 2292 djdrph.exe 37 PID 2292 wrote to memory of 2672 2292 djdrph.exe 37 PID 2672 wrote to memory of 1324 2672 jxbrxp.exe 38 PID 2672 wrote to memory of 1324 2672 jxbrxp.exe 38 PID 2672 wrote to memory of 1324 2672 jxbrxp.exe 38 PID 2672 wrote to memory of 1324 2672 jxbrxp.exe 38 PID 1324 wrote to memory of 2412 1324 nltjdh.exe 39 PID 1324 wrote to memory of 2412 1324 nltjdh.exe 39 PID 1324 wrote to memory of 2412 1324 nltjdh.exe 39 PID 1324 wrote to memory of 2412 1324 nltjdh.exe 39 PID 2412 wrote to memory of 1156 2412 phlprpl.exe 40 PID 2412 wrote to memory of 1156 2412 phlprpl.exe 40 PID 2412 wrote to memory of 1156 2412 phlprpl.exe 40 PID 2412 wrote to memory of 1156 2412 phlprpl.exe 40 PID 1156 wrote to memory of 2728 1156 thhpdff.exe 41 PID 1156 wrote to memory of 2728 1156 thhpdff.exe 41 PID 1156 wrote to memory of 2728 1156 thhpdff.exe 41 PID 1156 wrote to memory of 2728 1156 thhpdff.exe 41 PID 2728 wrote to memory of 1532 2728 bvthl.exe 42 PID 2728 wrote to memory of 1532 2728 bvthl.exe 42 PID 2728 wrote to memory of 1532 2728 bvthl.exe 42 PID 2728 wrote to memory of 1532 2728 bvthl.exe 42 PID 1532 wrote to memory of 2968 1532 jpjjxj.exe 43 PID 1532 wrote to memory of 2968 1532 jpjjxj.exe 43 PID 1532 wrote to memory of 2968 1532 jpjjxj.exe 43 PID 1532 wrote to memory of 2968 1532 jpjjxj.exe 43 PID 2968 wrote to memory of 3000 2968 nldvhdp.exe 44 PID 2968 wrote to memory of 3000 2968 nldvhdp.exe 44 PID 2968 wrote to memory of 3000 2968 nldvhdp.exe 44 PID 2968 wrote to memory of 3000 2968 nldvhdp.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe"C:\Users\Admin\AppData\Local\Temp\84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\brfdb.exec:\brfdb.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\hndrd.exec:\hndrd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\txpjpt.exec:\txpjpt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\ppprfd.exec:\ppprfd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\lbpnjb.exec:\lbpnjb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\rlppvl.exec:\rlppvl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\vdtrh.exec:\vdtrh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\djdrph.exec:\djdrph.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\jxbrxp.exec:\jxbrxp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\nltjdh.exec:\nltjdh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\phlprpl.exec:\phlprpl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\thhpdff.exec:\thhpdff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\bvthl.exec:\bvthl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\jpjjxj.exec:\jpjjxj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\nldvhdp.exec:\nldvhdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\pjvplx.exec:\pjvplx.exe17⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hrlvvv.exec:\hrlvvv.exe18⤵
- Executes dropped EXE
PID:1656 -
\??\c:\dllnp.exec:\dllnp.exe19⤵
- Executes dropped EXE
PID:1908 -
\??\c:\jtbbttv.exec:\jtbbttv.exe20⤵
- Executes dropped EXE
PID:2236 -
\??\c:\nbxvjdd.exec:\nbxvjdd.exe21⤵
- Executes dropped EXE
PID:3052 -
\??\c:\tjdthrf.exec:\tjdthrf.exe22⤵
- Executes dropped EXE
PID:2408 -
\??\c:\tnnvjjb.exec:\tnnvjjb.exe23⤵
- Executes dropped EXE
PID:2192 -
\??\c:\fhnvt.exec:\fhnvt.exe24⤵
- Executes dropped EXE
PID:2320 -
\??\c:\xvfdp.exec:\xvfdp.exe25⤵
- Executes dropped EXE
PID:560 -
\??\c:\vvlhbl.exec:\vvlhbl.exe26⤵
- Executes dropped EXE
PID:1492 -
\??\c:\vfvfbp.exec:\vfvfbp.exe27⤵
- Executes dropped EXE
PID:1104 -
\??\c:\rbljlrp.exec:\rbljlrp.exe28⤵
- Executes dropped EXE
PID:1816 -
\??\c:\rrvvb.exec:\rrvvb.exe29⤵
- Executes dropped EXE
PID:936 -
\??\c:\nntbdjl.exec:\nntbdjl.exe30⤵
- Executes dropped EXE
PID:1520 -
\??\c:\djlnvp.exec:\djlnvp.exe31⤵
- Executes dropped EXE
PID:1580 -
\??\c:\dhdljb.exec:\dhdljb.exe32⤵
- Executes dropped EXE
PID:696 -
\??\c:\djlxrt.exec:\djlxrt.exe33⤵
- Executes dropped EXE
PID:1744 -
\??\c:\tprhh.exec:\tprhh.exe34⤵
- Executes dropped EXE
PID:2640 -
\??\c:\hhhjjrt.exec:\hhhjjrt.exe35⤵
- Executes dropped EXE
PID:636 -
\??\c:\rvvpt.exec:\rvvpt.exe36⤵
- Executes dropped EXE
PID:2244 -
\??\c:\tttdxf.exec:\tttdxf.exe37⤵
- Executes dropped EXE
PID:1644 -
\??\c:\fltfrt.exec:\fltfrt.exe38⤵
- Executes dropped EXE
PID:1144 -
\??\c:\vbbnpf.exec:\vbbnpf.exe39⤵
- Executes dropped EXE
PID:2432 -
\??\c:\hfvvl.exec:\hfvvl.exe40⤵
- Executes dropped EXE
PID:2812 -
\??\c:\vpfnj.exec:\vpfnj.exe41⤵
- Executes dropped EXE
PID:2868 -
\??\c:\pxnpnr.exec:\pxnpnr.exe42⤵
- Executes dropped EXE
PID:2920 -
\??\c:\rxlprl.exec:\rxlprl.exe43⤵
- Executes dropped EXE
PID:2768 -
\??\c:\xnlpjxh.exec:\xnlpjxh.exe44⤵
- Executes dropped EXE
PID:1664 -
\??\c:\hlrxh.exec:\hlrxh.exe45⤵
- Executes dropped EXE
PID:1920 -
\??\c:\dfjrr.exec:\dfjrr.exe46⤵
- Executes dropped EXE
PID:2668 -
\??\c:\tfrrdvp.exec:\tfrrdvp.exe47⤵
- Executes dropped EXE
PID:2672 -
\??\c:\hvxdnd.exec:\hvxdnd.exe48⤵
- Executes dropped EXE
PID:772 -
\??\c:\ttlbb.exec:\ttlbb.exe49⤵
- Executes dropped EXE
PID:2852 -
\??\c:\brdrttx.exec:\brdrttx.exe50⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rpfhvvb.exec:\rpfhvvb.exe51⤵
- Executes dropped EXE
PID:2984 -
\??\c:\phjjvf.exec:\phjjvf.exe52⤵
- Executes dropped EXE
PID:2728 -
\??\c:\vdjnn.exec:\vdjnn.exe53⤵
- Executes dropped EXE
PID:1800 -
\??\c:\dtjnt.exec:\dtjnt.exe54⤵
- Executes dropped EXE
PID:2128 -
\??\c:\txbdrnx.exec:\txbdrnx.exe55⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jrbrb.exec:\jrbrb.exe56⤵
- Executes dropped EXE
PID:840 -
\??\c:\tvvvltb.exec:\tvvvltb.exe57⤵
- Executes dropped EXE
PID:1832 -
\??\c:\hpjfdtf.exec:\hpjfdtf.exe58⤵
- Executes dropped EXE
PID:1908 -
\??\c:\tdbdl.exec:\tdbdl.exe59⤵
- Executes dropped EXE
PID:2844 -
\??\c:\jfvvjbv.exec:\jfvvjbv.exe60⤵
- Executes dropped EXE
PID:2416 -
\??\c:\tbnjh.exec:\tbnjh.exe61⤵
- Executes dropped EXE
PID:460 -
\??\c:\ffvrjt.exec:\ffvrjt.exe62⤵
- Executes dropped EXE
PID:1684 -
\??\c:\blnfrb.exec:\blnfrb.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:648 -
\??\c:\lxtbf.exec:\lxtbf.exe64⤵
- Executes dropped EXE
PID:960 -
\??\c:\nhxxl.exec:\nhxxl.exe65⤵
- Executes dropped EXE
PID:1584 -
\??\c:\hhtrt.exec:\hhtrt.exe66⤵PID:2032
-
\??\c:\htvdt.exec:\htvdt.exe67⤵PID:1960
-
\??\c:\dntbt.exec:\dntbt.exe68⤵PID:856
-
\??\c:\hfllrjp.exec:\hfllrjp.exe69⤵PID:2468
-
\??\c:\rlrpdd.exec:\rlrpdd.exe70⤵PID:2024
-
\??\c:\dhlhfpf.exec:\dhlhfpf.exe71⤵PID:320
-
\??\c:\hphptrn.exec:\hphptrn.exe72⤵PID:1936
-
\??\c:\btfvv.exec:\btfvv.exe73⤵PID:1364
-
\??\c:\pxldrb.exec:\pxldrb.exe74⤵PID:2348
-
\??\c:\dxnvf.exec:\dxnvf.exe75⤵PID:1744
-
\??\c:\drnhrll.exec:\drnhrll.exe76⤵PID:804
-
\??\c:\rlttjb.exec:\rlttjb.exe77⤵PID:636
-
\??\c:\prbnrj.exec:\prbnrj.exe78⤵PID:3020
-
\??\c:\fffjrd.exec:\fffjrd.exe79⤵PID:2760
-
\??\c:\rfrlr.exec:\rfrlr.exe80⤵PID:2856
-
\??\c:\xltrp.exec:\xltrp.exe81⤵PID:2824
-
\??\c:\hdjvhrj.exec:\hdjvhrj.exe82⤵PID:2932
-
\??\c:\rdhtnx.exec:\rdhtnx.exe83⤵PID:2900
-
\??\c:\lrpvp.exec:\lrpvp.exe84⤵PID:2528
-
\??\c:\nftbx.exec:\nftbx.exe85⤵PID:3028
-
\??\c:\xljbl.exec:\xljbl.exe86⤵PID:2704
-
\??\c:\lbvpvff.exec:\lbvpvff.exe87⤵PID:1664
-
\??\c:\vjfbbpt.exec:\vjfbbpt.exe88⤵PID:2688
-
\??\c:\ppvnjjl.exec:\ppvnjjl.exe89⤵PID:2680
-
\??\c:\lbfxrf.exec:\lbfxrf.exe90⤵PID:2708
-
\??\c:\fbxrd.exec:\fbxrd.exe91⤵PID:2872
-
\??\c:\fldfjb.exec:\fldfjb.exe92⤵PID:576
-
\??\c:\rhhxtp.exec:\rhhxtp.exe93⤵PID:2736
-
\??\c:\xthhvdj.exec:\xthhvdj.exe94⤵PID:1996
-
\??\c:\xtnpbxn.exec:\xtnpbxn.exe95⤵PID:1760
-
\??\c:\hrtxtd.exec:\hrtxtd.exe96⤵PID:2912
-
\??\c:\vpnlvl.exec:\vpnlvl.exe97⤵PID:3000
-
\??\c:\lbxpnv.exec:\lbxpnv.exe98⤵PID:1636
-
\??\c:\bjpvxtn.exec:\bjpvxtn.exe99⤵PID:2080
-
\??\c:\frnjjdb.exec:\frnjjdb.exe100⤵PID:2464
-
\??\c:\xvhdll.exec:\xvhdll.exe101⤵PID:2552
-
\??\c:\bdpfxl.exec:\bdpfxl.exe102⤵PID:2212
-
\??\c:\vbrnpxx.exec:\vbrnpxx.exe103⤵
- System Location Discovery: System Language Discovery
PID:2160 -
\??\c:\pxlrtxp.exec:\pxlrtxp.exe104⤵PID:2408
-
\??\c:\bddfdj.exec:\bddfdj.exe105⤵PID:2532
-
\??\c:\lvllr.exec:\lvllr.exe106⤵PID:2280
-
\??\c:\dnthrbl.exec:\dnthrbl.exe107⤵PID:560
-
\??\c:\hhvbtlx.exec:\hhvbtlx.exe108⤵PID:2228
-
\??\c:\ltbtbbv.exec:\ltbtbbv.exe109⤵PID:316
-
\??\c:\bttbl.exec:\bttbl.exe110⤵PID:1772
-
\??\c:\nbbfdd.exec:\nbbfdd.exe111⤵PID:2536
-
\??\c:\xxnvnl.exec:\xxnvnl.exe112⤵PID:2020
-
\??\c:\ftxhbt.exec:\ftxhbt.exe113⤵PID:1028
-
\??\c:\pnnffr.exec:\pnnffr.exe114⤵PID:2492
-
\??\c:\fxjhdrt.exec:\fxjhdrt.exe115⤵PID:2436
-
\??\c:\ptptlp.exec:\ptptlp.exe116⤵PID:2524
-
\??\c:\vhhrf.exec:\vhhrf.exe117⤵PID:2620
-
\??\c:\rblldd.exec:\rblldd.exe118⤵PID:2176
-
\??\c:\vpvtrpt.exec:\vpvtrpt.exe119⤵PID:2072
-
\??\c:\rjvltp.exec:\rjvltp.exe120⤵PID:636
-
\??\c:\pbxnh.exec:\pbxnh.exe121⤵PID:3020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-