Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 03:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bc06e6894a0f1bcfa0f45adb876cc6cae4c63d2a9a40f8c3dade3472cac3a8a1.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
bc06e6894a0f1bcfa0f45adb876cc6cae4c63d2a9a40f8c3dade3472cac3a8a1.exe
-
Size
456KB
-
MD5
6bb4d0bb3633cba5f72db32e381c33de
-
SHA1
c214dbc819de06c33c2a2740c5413f09dbda5683
-
SHA256
bc06e6894a0f1bcfa0f45adb876cc6cae4c63d2a9a40f8c3dade3472cac3a8a1
-
SHA512
011f3fa40ebe188d3e5aa4fb79a91535e6f9b9a93d7a6aecdf1a006321564fbe88dfb4ce9d4f738a833f0e0135cd89fc46fd5e7fffdcef8ce4b4c32c14d990c1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRo:q7Tc2NYHUrAwfMp3CDRo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2484-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-43-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2640-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-173-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1964-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-424-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2272-460-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2012-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-633-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/264-701-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/1676-750-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1308-969-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2816 tjxtj.exe 2820 bxfpd.exe 2860 fnhxbll.exe 2900 xbnlnh.exe 2792 rdxrvx.exe 2640 pxfld.exe 2072 drfdf.exe 1252 bhjtt.exe 1240 fxldbrd.exe 3036 xjlhr.exe 520 plphprd.exe 2104 tvrljrj.exe 1964 xndfdn.exe 1308 tdpvh.exe 1048 pnljxl.exe 1488 vrbhtn.exe 2368 lvtvpp.exe 2468 ttnpv.exe 2356 vttpbvl.exe 2256 txnhrth.exe 1364 lbffv.exe 668 bvnxrj.exe 2992 bdffpv.exe 1980 tldfv.exe 2352 jtrbn.exe 1684 nxtbx.exe 2212 nnddlpb.exe 2532 tjflhrp.exe 2540 rjlrlh.exe 1032 vtflrd.exe 1732 rjltjd.exe 2384 xvrnfn.exe 2892 bhvfv.exe 1548 lnbdf.exe 2752 jthdbdx.exe 3020 thfjr.exe 2800 xttrbd.exe 2900 dbdjvhp.exe 2692 thrrht.exe 2416 rttlb.exe 2632 jnfptnl.exe 2668 ltrbr.exe 1916 fvfxjhv.exe 3028 nbtnhf.exe 1852 lxvnrvp.exe 1132 vltbr.exe 2508 tpbbjtf.exe 1696 tlptjbb.exe 2920 jjrjlj.exe 572 plfjbv.exe 1632 lbhdvh.exe 2296 lbvtv.exe 580 vvlbvx.exe 1488 ftlttnf.exe 1912 dhpfrf.exe 752 vfrjjdr.exe 2272 jjthlt.exe 2356 rxfxfv.exe 1580 fbnbplt.exe 2580 njnrhb.exe 2396 jfnplxp.exe 2012 dnbtpr.exe 2992 nhpxnjn.exe 1980 jblfvb.exe -
resource yara_rule behavioral1/memory/2484-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-701-0x0000000001C70000-0x0000000001C9A000-memory.dmp upx behavioral1/memory/2468-724-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-861-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-900-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-908-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/664-955-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-969-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-1056-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfppllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdfnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttttlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbdhtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhrpxjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpdfjlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvttr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnvln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbbtdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbftr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtxjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjddl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltddl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddhlhxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbvtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlvxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brthvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndjldv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjrrnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrbpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjjxhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvrrxpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jptrvfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhdpphb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrxljbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxhnjbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnbvjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dldfbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2484 wrote to memory of 2816 2484 bc06e6894a0f1bcfa0f45adb876cc6cae4c63d2a9a40f8c3dade3472cac3a8a1.exe 30 PID 2484 wrote to memory of 2816 2484 bc06e6894a0f1bcfa0f45adb876cc6cae4c63d2a9a40f8c3dade3472cac3a8a1.exe 30 PID 2484 wrote to memory of 2816 2484 bc06e6894a0f1bcfa0f45adb876cc6cae4c63d2a9a40f8c3dade3472cac3a8a1.exe 30 PID 2484 wrote to memory of 2816 2484 bc06e6894a0f1bcfa0f45adb876cc6cae4c63d2a9a40f8c3dade3472cac3a8a1.exe 30 PID 2816 wrote to memory of 2820 2816 tjxtj.exe 31 PID 2816 wrote to memory of 2820 2816 tjxtj.exe 31 PID 2816 wrote to memory of 2820 2816 tjxtj.exe 31 PID 2816 wrote to memory of 2820 2816 tjxtj.exe 31 PID 2820 wrote to memory of 2860 2820 bxfpd.exe 32 PID 2820 wrote to memory of 2860 2820 bxfpd.exe 32 PID 2820 wrote to memory of 2860 2820 bxfpd.exe 32 PID 2820 wrote to memory of 2860 2820 bxfpd.exe 32 PID 2860 wrote to memory of 2900 2860 fnhxbll.exe 67 PID 2860 wrote to memory of 2900 2860 fnhxbll.exe 67 PID 2860 wrote to memory of 2900 2860 fnhxbll.exe 67 PID 2860 wrote to memory of 2900 2860 fnhxbll.exe 67 PID 2900 wrote to memory of 2792 2900 xbnlnh.exe 34 PID 2900 wrote to memory of 2792 2900 xbnlnh.exe 34 PID 2900 wrote to memory of 2792 2900 xbnlnh.exe 34 PID 2900 wrote to memory of 2792 2900 xbnlnh.exe 34 PID 2792 wrote to memory of 2640 2792 rdxrvx.exe 35 PID 2792 wrote to memory of 2640 2792 rdxrvx.exe 35 PID 2792 wrote to memory of 2640 2792 rdxrvx.exe 35 PID 2792 wrote to memory of 2640 2792 rdxrvx.exe 35 PID 2640 wrote to memory of 2072 2640 pxfld.exe 36 PID 2640 wrote to memory of 2072 2640 pxfld.exe 36 PID 2640 wrote to memory of 2072 2640 pxfld.exe 36 PID 2640 wrote to memory of 2072 2640 pxfld.exe 36 PID 2072 wrote to memory of 1252 2072 drfdf.exe 37 PID 2072 wrote to memory of 1252 2072 drfdf.exe 37 PID 2072 wrote to memory of 1252 2072 drfdf.exe 37 PID 2072 wrote to memory of 1252 2072 drfdf.exe 37 PID 1252 wrote to memory of 1240 1252 bhjtt.exe 38 PID 1252 wrote to memory of 1240 1252 bhjtt.exe 38 PID 1252 wrote to memory of 1240 1252 bhjtt.exe 38 PID 1252 wrote to memory of 1240 1252 bhjtt.exe 38 PID 1240 wrote to memory of 3036 1240 fxldbrd.exe 39 PID 1240 wrote to memory of 3036 1240 fxldbrd.exe 39 PID 1240 wrote to memory of 3036 1240 fxldbrd.exe 39 PID 1240 wrote to memory of 3036 1240 fxldbrd.exe 39 PID 3036 wrote to memory of 520 3036 xjlhr.exe 40 PID 3036 wrote to memory of 520 3036 xjlhr.exe 40 PID 3036 wrote to memory of 520 3036 xjlhr.exe 40 PID 3036 wrote to memory of 520 3036 xjlhr.exe 40 PID 520 wrote to memory of 2104 520 plphprd.exe 41 PID 520 wrote to memory of 2104 520 plphprd.exe 41 PID 520 wrote to memory of 2104 520 plphprd.exe 41 PID 520 wrote to memory of 2104 520 plphprd.exe 41 PID 2104 wrote to memory of 1964 2104 tvrljrj.exe 42 PID 2104 wrote to memory of 1964 2104 tvrljrj.exe 42 PID 2104 wrote to memory of 1964 2104 tvrljrj.exe 42 PID 2104 wrote to memory of 1964 2104 tvrljrj.exe 42 PID 1964 wrote to memory of 1308 1964 xndfdn.exe 43 PID 1964 wrote to memory of 1308 1964 xndfdn.exe 43 PID 1964 wrote to memory of 1308 1964 xndfdn.exe 43 PID 1964 wrote to memory of 1308 1964 xndfdn.exe 43 PID 1308 wrote to memory of 1048 1308 tdpvh.exe 44 PID 1308 wrote to memory of 1048 1308 tdpvh.exe 44 PID 1308 wrote to memory of 1048 1308 tdpvh.exe 44 PID 1308 wrote to memory of 1048 1308 tdpvh.exe 44 PID 1048 wrote to memory of 1488 1048 pnljxl.exe 45 PID 1048 wrote to memory of 1488 1048 pnljxl.exe 45 PID 1048 wrote to memory of 1488 1048 pnljxl.exe 45 PID 1048 wrote to memory of 1488 1048 pnljxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc06e6894a0f1bcfa0f45adb876cc6cae4c63d2a9a40f8c3dade3472cac3a8a1.exe"C:\Users\Admin\AppData\Local\Temp\bc06e6894a0f1bcfa0f45adb876cc6cae4c63d2a9a40f8c3dade3472cac3a8a1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\tjxtj.exec:\tjxtj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\bxfpd.exec:\bxfpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\fnhxbll.exec:\fnhxbll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\xbnlnh.exec:\xbnlnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\rdxrvx.exec:\rdxrvx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\pxfld.exec:\pxfld.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\drfdf.exec:\drfdf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\bhjtt.exec:\bhjtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\fxldbrd.exec:\fxldbrd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\xjlhr.exec:\xjlhr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\plphprd.exec:\plphprd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:520 -
\??\c:\tvrljrj.exec:\tvrljrj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\xndfdn.exec:\xndfdn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\tdpvh.exec:\tdpvh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\pnljxl.exec:\pnljxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\vrbhtn.exec:\vrbhtn.exe17⤵
- Executes dropped EXE
PID:1488 -
\??\c:\lvtvpp.exec:\lvtvpp.exe18⤵
- Executes dropped EXE
PID:2368 -
\??\c:\ttnpv.exec:\ttnpv.exe19⤵
- Executes dropped EXE
PID:2468 -
\??\c:\vttpbvl.exec:\vttpbvl.exe20⤵
- Executes dropped EXE
PID:2356 -
\??\c:\txnhrth.exec:\txnhrth.exe21⤵
- Executes dropped EXE
PID:2256 -
\??\c:\lbffv.exec:\lbffv.exe22⤵
- Executes dropped EXE
PID:1364 -
\??\c:\bvnxrj.exec:\bvnxrj.exe23⤵
- Executes dropped EXE
PID:668 -
\??\c:\bdffpv.exec:\bdffpv.exe24⤵
- Executes dropped EXE
PID:2992 -
\??\c:\tldfv.exec:\tldfv.exe25⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jtrbn.exec:\jtrbn.exe26⤵
- Executes dropped EXE
PID:2352 -
\??\c:\nxtbx.exec:\nxtbx.exe27⤵
- Executes dropped EXE
PID:1684 -
\??\c:\nnddlpb.exec:\nnddlpb.exe28⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tjflhrp.exec:\tjflhrp.exe29⤵
- Executes dropped EXE
PID:2532 -
\??\c:\rjlrlh.exec:\rjlrlh.exe30⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vtflrd.exec:\vtflrd.exe31⤵
- Executes dropped EXE
PID:1032 -
\??\c:\rjltjd.exec:\rjltjd.exe32⤵
- Executes dropped EXE
PID:1732 -
\??\c:\xvrnfn.exec:\xvrnfn.exe33⤵
- Executes dropped EXE
PID:2384 -
\??\c:\bhvfv.exec:\bhvfv.exe34⤵
- Executes dropped EXE
PID:2892 -
\??\c:\lnbdf.exec:\lnbdf.exe35⤵
- Executes dropped EXE
PID:1548 -
\??\c:\jthdbdx.exec:\jthdbdx.exe36⤵
- Executes dropped EXE
PID:2752 -
\??\c:\thfjr.exec:\thfjr.exe37⤵
- Executes dropped EXE
PID:3020 -
\??\c:\xttrbd.exec:\xttrbd.exe38⤵
- Executes dropped EXE
PID:2800 -
\??\c:\dbdjvhp.exec:\dbdjvhp.exe39⤵
- Executes dropped EXE
PID:2900 -
\??\c:\thrrht.exec:\thrrht.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rttlb.exec:\rttlb.exe41⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jnfptnl.exec:\jnfptnl.exe42⤵
- Executes dropped EXE
PID:2632 -
\??\c:\ltrbr.exec:\ltrbr.exe43⤵
- Executes dropped EXE
PID:2668 -
\??\c:\fvfxjhv.exec:\fvfxjhv.exe44⤵
- Executes dropped EXE
PID:1916 -
\??\c:\nbtnhf.exec:\nbtnhf.exe45⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lxvnrvp.exec:\lxvnrvp.exe46⤵
- Executes dropped EXE
PID:1852 -
\??\c:\vltbr.exec:\vltbr.exe47⤵
- Executes dropped EXE
PID:1132 -
\??\c:\tpbbjtf.exec:\tpbbjtf.exe48⤵
- Executes dropped EXE
PID:2508 -
\??\c:\tlptjbb.exec:\tlptjbb.exe49⤵
- Executes dropped EXE
PID:1696 -
\??\c:\jjrjlj.exec:\jjrjlj.exe50⤵
- Executes dropped EXE
PID:2920 -
\??\c:\plfjbv.exec:\plfjbv.exe51⤵
- Executes dropped EXE
PID:572 -
\??\c:\lbhdvh.exec:\lbhdvh.exe52⤵
- Executes dropped EXE
PID:1632 -
\??\c:\lbvtv.exec:\lbvtv.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2296 -
\??\c:\vvlbvx.exec:\vvlbvx.exe54⤵
- Executes dropped EXE
PID:580 -
\??\c:\ftlttnf.exec:\ftlttnf.exe55⤵
- Executes dropped EXE
PID:1488 -
\??\c:\dhpfrf.exec:\dhpfrf.exe56⤵
- Executes dropped EXE
PID:1912 -
\??\c:\vfrjjdr.exec:\vfrjjdr.exe57⤵
- Executes dropped EXE
PID:752 -
\??\c:\jjthlt.exec:\jjthlt.exe58⤵
- Executes dropped EXE
PID:2272 -
\??\c:\rxfxfv.exec:\rxfxfv.exe59⤵
- Executes dropped EXE
PID:2356 -
\??\c:\fbnbplt.exec:\fbnbplt.exe60⤵
- Executes dropped EXE
PID:1580 -
\??\c:\njnrhb.exec:\njnrhb.exe61⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jfnplxp.exec:\jfnplxp.exe62⤵
- Executes dropped EXE
PID:2396 -
\??\c:\dnbtpr.exec:\dnbtpr.exe63⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nhpxnjn.exec:\nhpxnjn.exe64⤵
- Executes dropped EXE
PID:2992 -
\??\c:\jblfvb.exec:\jblfvb.exe65⤵
- Executes dropped EXE
PID:1980 -
\??\c:\lldrnx.exec:\lldrnx.exe66⤵PID:2056
-
\??\c:\pbtjhh.exec:\pbtjhh.exe67⤵PID:2552
-
\??\c:\nnbpv.exec:\nnbpv.exe68⤵PID:1932
-
\??\c:\jxfdjxv.exec:\jxfdjxv.exe69⤵PID:1788
-
\??\c:\rjvtvx.exec:\rjvtvx.exe70⤵PID:2132
-
\??\c:\hhljr.exec:\hhljr.exe71⤵PID:1316
-
\??\c:\bbxjj.exec:\bbxjj.exe72⤵PID:2420
-
\??\c:\hhhhlth.exec:\hhhhlth.exe73⤵PID:2584
-
\??\c:\lvbvhbt.exec:\lvbvhbt.exe74⤵PID:2184
-
\??\c:\rvxbb.exec:\rvxbb.exe75⤵PID:1724
-
\??\c:\lplbr.exec:\lplbr.exe76⤵PID:2248
-
\??\c:\rhjbxln.exec:\rhjbxln.exe77⤵PID:2776
-
\??\c:\xpjxhx.exec:\xpjxhx.exe78⤵PID:2824
-
\??\c:\lxvlxv.exec:\lxvlxv.exe79⤵PID:2736
-
\??\c:\jvrnxvh.exec:\jvrnxvh.exe80⤵PID:2644
-
\??\c:\drtrdtv.exec:\drtrdtv.exe81⤵PID:2648
-
\??\c:\bvdbll.exec:\bvdbll.exe82⤵PID:2960
-
\??\c:\ptthj.exec:\ptthj.exe83⤵PID:2756
-
\??\c:\blfdlxx.exec:\blfdlxx.exe84⤵PID:2324
-
\??\c:\rvpdjt.exec:\rvpdjt.exe85⤵PID:2092
-
\??\c:\dblthj.exec:\dblthj.exe86⤵PID:604
-
\??\c:\bnnbxdv.exec:\bnnbxdv.exe87⤵PID:2276
-
\??\c:\bdltx.exec:\bdltx.exe88⤵PID:2124
-
\??\c:\jfxhrtb.exec:\jfxhrtb.exe89⤵PID:756
-
\??\c:\fvfvtv.exec:\fvfvtv.exe90⤵PID:1008
-
\??\c:\rvftpff.exec:\rvftpff.exe91⤵PID:2796
-
\??\c:\vrrxj.exec:\vrrxj.exe92⤵PID:1824
-
\??\c:\pptdprl.exec:\pptdprl.exe93⤵PID:3032
-
\??\c:\vldxvn.exec:\vldxvn.exe94⤵PID:2708
-
\??\c:\djnbr.exec:\djnbr.exe95⤵PID:1956
-
\??\c:\vbhddvn.exec:\vbhddvn.exe96⤵PID:264
-
\??\c:\nvdbbh.exec:\nvdbbh.exe97⤵PID:2412
-
\??\c:\jplrn.exec:\jplrn.exe98⤵PID:1840
-
\??\c:\hlrttr.exec:\hlrttr.exe99⤵PID:2108
-
\??\c:\rpvlf.exec:\rpvlf.exe100⤵PID:2468
-
\??\c:\htntbpr.exec:\htntbpr.exe101⤵PID:2928
-
\??\c:\jppln.exec:\jppln.exe102⤵PID:2512
-
\??\c:\nndhfxl.exec:\nndhfxl.exe103⤵PID:1676
-
\??\c:\jtbpn.exec:\jtbpn.exe104⤵PID:316
-
\??\c:\jvhxhb.exec:\jvhxhb.exe105⤵PID:668
-
\??\c:\tjvttd.exec:\tjvttd.exe106⤵PID:2168
-
\??\c:\hvxlndn.exec:\hvxlndn.exe107⤵PID:1036
-
\??\c:\ljdnx.exec:\ljdnx.exe108⤵PID:2496
-
\??\c:\rvlxj.exec:\rvlxj.exe109⤵PID:2596
-
\??\c:\thhvth.exec:\thhvth.exe110⤵PID:1276
-
\??\c:\fnxthxd.exec:\fnxthxd.exe111⤵PID:1056
-
\??\c:\bhftfn.exec:\bhftfn.exe112⤵PID:2212
-
\??\c:\lpbplxj.exec:\lpbplxj.exe113⤵PID:1320
-
\??\c:\lvffvjl.exec:\lvffvjl.exe114⤵PID:2540
-
\??\c:\pvxbl.exec:\pvxbl.exe115⤵PID:880
-
\??\c:\rrrvldf.exec:\rrrvldf.exe116⤵PID:1732
-
\??\c:\nvpnrlx.exec:\nvpnrlx.exe117⤵PID:1288
-
\??\c:\fvxbpln.exec:\fvxbpln.exe118⤵PID:1552
-
\??\c:\prnndjh.exec:\prnndjh.exe119⤵PID:2828
-
\??\c:\ldbxpr.exec:\ldbxpr.exe120⤵PID:1688
-
\??\c:\nvdxrn.exec:\nvdxrn.exe121⤵PID:2528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-