Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 02:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9a37341b9cc6e5645fb8cd303be2bed92e3d8bd8e6fd20e7fe44e04941046cf0.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
9a37341b9cc6e5645fb8cd303be2bed92e3d8bd8e6fd20e7fe44e04941046cf0.exe
-
Size
453KB
-
MD5
da7357f566fd1212dec4f1ed125473e7
-
SHA1
a6d78770e3915ae2e4dff9cca217ecce68250310
-
SHA256
9a37341b9cc6e5645fb8cd303be2bed92e3d8bd8e6fd20e7fe44e04941046cf0
-
SHA512
e1018237cec738e7c3d67cf183f889c3cf4184be587f5694b016b4567cc8b103a5e6f3d48baef8f1c8bc4dc2450f23c6e38788fb4fc82bcdbe04650310ea5fbe
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2044-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-105-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1676-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/648-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-345-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2480-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-391-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1704-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-507-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2088-513-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2088-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/748-550-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2272-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-673-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2992-681-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-688-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1140-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-725-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2584 bvrvt.exe 2620 hfxjlbv.exe 1980 jhblp.exe 2396 bvnff.exe 2900 vldbjxd.exe 2808 pjvffl.exe 2812 hfdpvr.exe 2168 jnvvlp.exe 2708 vdxjtj.exe 2684 bbfpb.exe 1676 vxbptr.exe 2344 rbrxlbf.exe 2892 jxfnd.exe 1152 vdxdvt.exe 2032 hphdlxx.exe 1716 dfhln.exe 1964 ndfdp.exe 1952 rrvvbbf.exe 2956 rbdtdh.exe 2284 fbbjnjf.exe 3048 rrjnx.exe 1696 txntpnf.exe 2088 hnfhnhr.exe 1496 txbhxx.exe 1584 tvrnbfl.exe 1756 dbtvnlp.exe 1688 rbbfnj.exe 648 ttnbnp.exe 2240 bbrtff.exe 1640 ldffpfx.exe 2252 rvpvtpx.exe 1732 ndlxrht.exe 2568 ftpnt.exe 1796 hpvftvj.exe 1972 dnrxnp.exe 1800 flvvrtf.exe 2836 xbbfhbv.exe 2480 fnlrhrp.exe 2916 fxhbh.exe 2776 rxjtlx.exe 2248 ljvvh.exe 2076 fpbnhj.exe 2676 nptjrp.exe 2968 jpvlbd.exe 2664 vtdvrj.exe 2728 tfrrnfn.exe 2412 rtnrrl.exe 2636 dvdpth.exe 1648 brrrll.exe 1116 dlnnrv.exe 624 tbxhnbr.exe 2080 prtlr.exe 1704 hhfdl.exe 2000 nflhx.exe 1940 vvxtlf.exe 3044 hrjxbfx.exe 3032 bbhbdv.exe 2872 xbhpprr.exe 2284 dltjr.exe 1476 hrhjbb.exe 2256 hnxlhjf.exe 584 nnddhpl.exe 2088 jjbvv.exe 1340 xflfh.exe -
resource yara_rule behavioral1/memory/2044-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-202-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/1696-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/648-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/648-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-425-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/624-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-507-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1340-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/748-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1140-710-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrdljlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pldrvfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfxrfdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdnlxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfvtrhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrrnrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dntrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbrvxtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvvxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brbjpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtvbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdjjrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfjbjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tftldfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brvbdbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fprbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnrfnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljnpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btpvpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brnhjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fppbhbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfhrlnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtdvrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxxthd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpvftvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpvpxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plbrjxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvffvjf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2044 wrote to memory of 2584 2044 9a37341b9cc6e5645fb8cd303be2bed92e3d8bd8e6fd20e7fe44e04941046cf0.exe 30 PID 2044 wrote to memory of 2584 2044 9a37341b9cc6e5645fb8cd303be2bed92e3d8bd8e6fd20e7fe44e04941046cf0.exe 30 PID 2044 wrote to memory of 2584 2044 9a37341b9cc6e5645fb8cd303be2bed92e3d8bd8e6fd20e7fe44e04941046cf0.exe 30 PID 2044 wrote to memory of 2584 2044 9a37341b9cc6e5645fb8cd303be2bed92e3d8bd8e6fd20e7fe44e04941046cf0.exe 30 PID 2584 wrote to memory of 2620 2584 bvrvt.exe 31 PID 2584 wrote to memory of 2620 2584 bvrvt.exe 31 PID 2584 wrote to memory of 2620 2584 bvrvt.exe 31 PID 2584 wrote to memory of 2620 2584 bvrvt.exe 31 PID 2620 wrote to memory of 1980 2620 hfxjlbv.exe 32 PID 2620 wrote to memory of 1980 2620 hfxjlbv.exe 32 PID 2620 wrote to memory of 1980 2620 hfxjlbv.exe 32 PID 2620 wrote to memory of 1980 2620 hfxjlbv.exe 32 PID 1980 wrote to memory of 2396 1980 jhblp.exe 33 PID 1980 wrote to memory of 2396 1980 jhblp.exe 33 PID 1980 wrote to memory of 2396 1980 jhblp.exe 33 PID 1980 wrote to memory of 2396 1980 jhblp.exe 33 PID 2396 wrote to memory of 2900 2396 bvnff.exe 34 PID 2396 wrote to memory of 2900 2396 bvnff.exe 34 PID 2396 wrote to memory of 2900 2396 bvnff.exe 34 PID 2396 wrote to memory of 2900 2396 bvnff.exe 34 PID 2900 wrote to memory of 2808 2900 vldbjxd.exe 35 PID 2900 wrote to memory of 2808 2900 vldbjxd.exe 35 PID 2900 wrote to memory of 2808 2900 vldbjxd.exe 35 PID 2900 wrote to memory of 2808 2900 vldbjxd.exe 35 PID 2808 wrote to memory of 2812 2808 pjvffl.exe 36 PID 2808 wrote to memory of 2812 2808 pjvffl.exe 36 PID 2808 wrote to memory of 2812 2808 pjvffl.exe 36 PID 2808 wrote to memory of 2812 2808 pjvffl.exe 36 PID 2812 wrote to memory of 2168 2812 hfdpvr.exe 37 PID 2812 wrote to memory of 2168 2812 hfdpvr.exe 37 PID 2812 wrote to memory of 2168 2812 hfdpvr.exe 37 PID 2812 wrote to memory of 2168 2812 hfdpvr.exe 37 PID 2168 wrote to memory of 2708 2168 jnvvlp.exe 38 PID 2168 wrote to memory of 2708 2168 jnvvlp.exe 38 PID 2168 wrote to memory of 2708 2168 jnvvlp.exe 38 PID 2168 wrote to memory of 2708 2168 jnvvlp.exe 38 PID 2708 wrote to memory of 2684 2708 vdxjtj.exe 39 PID 2708 wrote to memory of 2684 2708 vdxjtj.exe 39 PID 2708 wrote to memory of 2684 2708 vdxjtj.exe 39 PID 2708 wrote to memory of 2684 2708 vdxjtj.exe 39 PID 2684 wrote to memory of 1676 2684 bbfpb.exe 40 PID 2684 wrote to memory of 1676 2684 bbfpb.exe 40 PID 2684 wrote to memory of 1676 2684 bbfpb.exe 40 PID 2684 wrote to memory of 1676 2684 bbfpb.exe 40 PID 1676 wrote to memory of 2344 1676 vxbptr.exe 41 PID 1676 wrote to memory of 2344 1676 vxbptr.exe 41 PID 1676 wrote to memory of 2344 1676 vxbptr.exe 41 PID 1676 wrote to memory of 2344 1676 vxbptr.exe 41 PID 2344 wrote to memory of 2892 2344 rbrxlbf.exe 42 PID 2344 wrote to memory of 2892 2344 rbrxlbf.exe 42 PID 2344 wrote to memory of 2892 2344 rbrxlbf.exe 42 PID 2344 wrote to memory of 2892 2344 rbrxlbf.exe 42 PID 2892 wrote to memory of 1152 2892 jxfnd.exe 43 PID 2892 wrote to memory of 1152 2892 jxfnd.exe 43 PID 2892 wrote to memory of 1152 2892 jxfnd.exe 43 PID 2892 wrote to memory of 1152 2892 jxfnd.exe 43 PID 1152 wrote to memory of 2032 1152 vdxdvt.exe 44 PID 1152 wrote to memory of 2032 1152 vdxdvt.exe 44 PID 1152 wrote to memory of 2032 1152 vdxdvt.exe 44 PID 1152 wrote to memory of 2032 1152 vdxdvt.exe 44 PID 2032 wrote to memory of 1716 2032 hphdlxx.exe 45 PID 2032 wrote to memory of 1716 2032 hphdlxx.exe 45 PID 2032 wrote to memory of 1716 2032 hphdlxx.exe 45 PID 2032 wrote to memory of 1716 2032 hphdlxx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a37341b9cc6e5645fb8cd303be2bed92e3d8bd8e6fd20e7fe44e04941046cf0.exe"C:\Users\Admin\AppData\Local\Temp\9a37341b9cc6e5645fb8cd303be2bed92e3d8bd8e6fd20e7fe44e04941046cf0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\bvrvt.exec:\bvrvt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\hfxjlbv.exec:\hfxjlbv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\jhblp.exec:\jhblp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\bvnff.exec:\bvnff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\vldbjxd.exec:\vldbjxd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\pjvffl.exec:\pjvffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\hfdpvr.exec:\hfdpvr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\jnvvlp.exec:\jnvvlp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\vdxjtj.exec:\vdxjtj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\bbfpb.exec:\bbfpb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\vxbptr.exec:\vxbptr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\rbrxlbf.exec:\rbrxlbf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\jxfnd.exec:\jxfnd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\vdxdvt.exec:\vdxdvt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\hphdlxx.exec:\hphdlxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\dfhln.exec:\dfhln.exe17⤵
- Executes dropped EXE
PID:1716 -
\??\c:\ndfdp.exec:\ndfdp.exe18⤵
- Executes dropped EXE
PID:1964 -
\??\c:\rrvvbbf.exec:\rrvvbbf.exe19⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rbdtdh.exec:\rbdtdh.exe20⤵
- Executes dropped EXE
PID:2956 -
\??\c:\fbbjnjf.exec:\fbbjnjf.exe21⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rrjnx.exec:\rrjnx.exe22⤵
- Executes dropped EXE
PID:3048 -
\??\c:\txntpnf.exec:\txntpnf.exe23⤵
- Executes dropped EXE
PID:1696 -
\??\c:\hnfhnhr.exec:\hnfhnhr.exe24⤵
- Executes dropped EXE
PID:2088 -
\??\c:\txbhxx.exec:\txbhxx.exe25⤵
- Executes dropped EXE
PID:1496 -
\??\c:\tvrnbfl.exec:\tvrnbfl.exe26⤵
- Executes dropped EXE
PID:1584 -
\??\c:\dbtvnlp.exec:\dbtvnlp.exe27⤵
- Executes dropped EXE
PID:1756 -
\??\c:\rbbfnj.exec:\rbbfnj.exe28⤵
- Executes dropped EXE
PID:1688 -
\??\c:\ttnbnp.exec:\ttnbnp.exe29⤵
- Executes dropped EXE
PID:648 -
\??\c:\bbrtff.exec:\bbrtff.exe30⤵
- Executes dropped EXE
PID:2240 -
\??\c:\ldffpfx.exec:\ldffpfx.exe31⤵
- Executes dropped EXE
PID:1640 -
\??\c:\rvpvtpx.exec:\rvpvtpx.exe32⤵
- Executes dropped EXE
PID:2252 -
\??\c:\ndlxrht.exec:\ndlxrht.exe33⤵
- Executes dropped EXE
PID:1732 -
\??\c:\ftpnt.exec:\ftpnt.exe34⤵
- Executes dropped EXE
PID:2568 -
\??\c:\hpvftvj.exec:\hpvftvj.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1796 -
\??\c:\dnrxnp.exec:\dnrxnp.exe36⤵
- Executes dropped EXE
PID:1972 -
\??\c:\flvvrtf.exec:\flvvrtf.exe37⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xbbfhbv.exec:\xbbfhbv.exe38⤵
- Executes dropped EXE
PID:2836 -
\??\c:\fnlrhrp.exec:\fnlrhrp.exe39⤵
- Executes dropped EXE
PID:2480 -
\??\c:\fxhbh.exec:\fxhbh.exe40⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rxjtlx.exec:\rxjtlx.exe41⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ljvvh.exec:\ljvvh.exe42⤵
- Executes dropped EXE
PID:2248 -
\??\c:\fpbnhj.exec:\fpbnhj.exe43⤵
- Executes dropped EXE
PID:2076 -
\??\c:\nptjrp.exec:\nptjrp.exe44⤵
- Executes dropped EXE
PID:2676 -
\??\c:\jpvlbd.exec:\jpvlbd.exe45⤵
- Executes dropped EXE
PID:2968 -
\??\c:\vtdvrj.exec:\vtdvrj.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2664 -
\??\c:\tfrrnfn.exec:\tfrrnfn.exe47⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rtnrrl.exec:\rtnrrl.exe48⤵
- Executes dropped EXE
PID:2412 -
\??\c:\dvdpth.exec:\dvdpth.exe49⤵
- Executes dropped EXE
PID:2636 -
\??\c:\brrrll.exec:\brrrll.exe50⤵
- Executes dropped EXE
PID:1648 -
\??\c:\dlnnrv.exec:\dlnnrv.exe51⤵
- Executes dropped EXE
PID:1116 -
\??\c:\tbxhnbr.exec:\tbxhnbr.exe52⤵
- Executes dropped EXE
PID:624 -
\??\c:\prtlr.exec:\prtlr.exe53⤵
- Executes dropped EXE
PID:2080 -
\??\c:\hhfdl.exec:\hhfdl.exe54⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nflhx.exec:\nflhx.exe55⤵
- Executes dropped EXE
PID:2000 -
\??\c:\vvxtlf.exec:\vvxtlf.exe56⤵
- Executes dropped EXE
PID:1940 -
\??\c:\hrjxbfx.exec:\hrjxbfx.exe57⤵
- Executes dropped EXE
PID:3044 -
\??\c:\bbhbdv.exec:\bbhbdv.exe58⤵
- Executes dropped EXE
PID:3032 -
\??\c:\xbhpprr.exec:\xbhpprr.exe59⤵
- Executes dropped EXE
PID:2872 -
\??\c:\dltjr.exec:\dltjr.exe60⤵
- Executes dropped EXE
PID:2284 -
\??\c:\hrhjbb.exec:\hrhjbb.exe61⤵
- Executes dropped EXE
PID:1476 -
\??\c:\hnxlhjf.exec:\hnxlhjf.exe62⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nnddhpl.exec:\nnddhpl.exe63⤵
- Executes dropped EXE
PID:584 -
\??\c:\jjbvv.exec:\jjbvv.exe64⤵
- Executes dropped EXE
PID:2088 -
\??\c:\xflfh.exec:\xflfh.exe65⤵
- Executes dropped EXE
PID:1340 -
\??\c:\thhtd.exec:\thhtd.exe66⤵PID:2008
-
\??\c:\rhllppn.exec:\rhllppn.exe67⤵PID:1528
-
\??\c:\xdljjr.exec:\xdljjr.exe68⤵PID:1364
-
\??\c:\bvnbrr.exec:\bvnbrr.exe69⤵PID:748
-
\??\c:\hdnlxh.exec:\hdnlxh.exe70⤵
- System Location Discovery: System Language Discovery
PID:1500 -
\??\c:\fptlj.exec:\fptlj.exe71⤵PID:1852
-
\??\c:\jbbbhn.exec:\jbbbhn.exe72⤵PID:2388
-
\??\c:\tvrtxl.exec:\tvrtxl.exe73⤵PID:2272
-
\??\c:\jhrdftl.exec:\jhrdftl.exe74⤵PID:1740
-
\??\c:\bxvjddr.exec:\bxvjddr.exe75⤵PID:2128
-
\??\c:\trvlrv.exec:\trvlrv.exe76⤵PID:2584
-
\??\c:\ftvph.exec:\ftvph.exe77⤵PID:1320
-
\??\c:\rbnrnnl.exec:\rbnrnnl.exe78⤵PID:1972
-
\??\c:\rjnjvfn.exec:\rjnjvfn.exe79⤵PID:2124
-
\??\c:\tldbdtx.exec:\tldbdtx.exe80⤵PID:2188
-
\??\c:\bhdnlnj.exec:\bhdnlnj.exe81⤵PID:2920
-
\??\c:\rtxjjb.exec:\rtxjjb.exe82⤵PID:2220
-
\??\c:\vjvrnbp.exec:\vjvrnbp.exe83⤵PID:2660
-
\??\c:\nxtdt.exec:\nxtdt.exe84⤵PID:2876
-
\??\c:\dttnf.exec:\dttnf.exe85⤵PID:2076
-
\??\c:\llrxf.exec:\llrxf.exe86⤵PID:2988
-
\??\c:\vphph.exec:\vphph.exe87⤵PID:2944
-
\??\c:\fhxbh.exec:\fhxbh.exe88⤵PID:2664
-
\??\c:\bbnpt.exec:\bbnpt.exe89⤵PID:2992
-
\??\c:\nrrln.exec:\nrrln.exe90⤵PID:1700
-
\??\c:\jvlhnf.exec:\jvlhnf.exe91⤵PID:2344
-
\??\c:\dnbtbp.exec:\dnbtbp.exe92⤵PID:1648
-
\??\c:\bfrnjx.exec:\bfrnjx.exe93⤵PID:1140
-
\??\c:\vxnxrhd.exec:\vxnxrhd.exe94⤵PID:624
-
\??\c:\nrvlp.exec:\nrvlp.exe95⤵PID:2640
-
\??\c:\htjdbnx.exec:\htjdbnx.exe96⤵PID:1488
-
\??\c:\fvvphx.exec:\fvvphx.exe97⤵PID:1148
-
\??\c:\rbvrlt.exec:\rbvrlt.exe98⤵PID:1940
-
\??\c:\jjbvh.exec:\jjbvh.exe99⤵PID:2964
-
\??\c:\vjtpfn.exec:\vjtpfn.exe100⤵PID:2516
-
\??\c:\jjtjr.exec:\jjtjr.exe101⤵PID:3040
-
\??\c:\flpxl.exec:\flpxl.exe102⤵PID:2072
-
\??\c:\tvpdjh.exec:\tvpdjh.exe103⤵PID:772
-
\??\c:\txlrfdl.exec:\txlrfdl.exe104⤵PID:2256
-
\??\c:\xjfbbd.exec:\xjfbbd.exe105⤵PID:2548
-
\??\c:\tjdttfp.exec:\tjdttfp.exe106⤵PID:1752
-
\??\c:\fnbhptv.exec:\fnbhptv.exe107⤵PID:964
-
\??\c:\jpbvn.exec:\jpbvn.exe108⤵PID:1368
-
\??\c:\bddlbp.exec:\bddlbp.exe109⤵PID:864
-
\??\c:\bjvfbhj.exec:\bjvfbhj.exe110⤵PID:2400
-
\??\c:\vfdnvrh.exec:\vfdnvrh.exe111⤵PID:2300
-
\??\c:\dphrbtj.exec:\dphrbtj.exe112⤵PID:276
-
\??\c:\bfvbn.exec:\bfvbn.exe113⤵PID:676
-
\??\c:\hpjljjl.exec:\hpjljjl.exe114⤵PID:2116
-
\??\c:\dlprxpj.exec:\dlprxpj.exe115⤵PID:1236
-
\??\c:\fntjlbr.exec:\fntjlbr.exe116⤵PID:1740
-
\??\c:\bfjnl.exec:\bfjnl.exe117⤵PID:1572
-
\??\c:\rlpjbxf.exec:\rlpjbxf.exe118⤵PID:2068
-
\??\c:\jjrfnfv.exec:\jjrfnfv.exe119⤵PID:2028
-
\??\c:\bvfxhr.exec:\bvfxhr.exe120⤵PID:2464
-
\??\c:\xhnjxhr.exec:\xhnjxhr.exe121⤵PID:2212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-