Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 03:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b5b9a838155ee9f2880603a8df59ceed0cb589d8ea1d02e6343749e785699be2.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b5b9a838155ee9f2880603a8df59ceed0cb589d8ea1d02e6343749e785699be2.exe
-
Size
453KB
-
MD5
1e2b62573b80ea2cd28e47c275b4b134
-
SHA1
bbeb5fb820a5483617467bd176e69b0f5f7b0834
-
SHA256
b5b9a838155ee9f2880603a8df59ceed0cb589d8ea1d02e6343749e785699be2
-
SHA512
b924fd7b30cdde181b37343dcf14ea251d15279b67c7cd3132668d0a2a0c58a70620040b88d801a0e9a03242d3383e94e6a6769dece56e02d60e5a7876ee4bb9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeb0:q7Tc2NYHUrAwfMp3CDb0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2100-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-27-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2876-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-155-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1948-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-168-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1720-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-283-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1028-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-305-0x0000000077090000-0x00000000771AF000-memory.dmp family_blackmoon behavioral1/memory/1892-328-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1892-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/816-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/856-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-536-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/272-544-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-641-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-665-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2800-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-715-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1840-761-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-869-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 912 pdpnd.exe 1892 xltrd.exe 1212 lxnvh.exe 2872 dpxbfj.exe 2876 jdrbrl.exe 2992 vdhpnnx.exe 3052 btllpf.exe 2780 lprpxj.exe 2776 vjhfbh.exe 2768 thjxj.exe 956 xtxtjt.exe 3036 xrjfx.exe 2712 rlvtx.exe 2092 ljpjdlj.exe 1672 hrpphlj.exe 324 llntlx.exe 1948 lxxrr.exe 1688 rljvb.exe 836 plnhhp.exe 2144 rvnrxvf.exe 2488 trxrr.exe 1720 dlfxl.exe 2028 dpxfr.exe 1976 prntjt.exe 788 vtndrr.exe 1448 nfbrn.exe 1372 hdnbbnf.exe 1904 rftfhvf.exe 2672 rpnnv.exe 2464 lrbphjd.exe 1028 nrhll.exe 1036 pddjvft.exe 1692 fhhpf.exe 1272 pnpxpf.exe 912 xvjprl.exe 1892 jfhrln.exe 668 rldfpr.exe 2948 tvlfvdt.exe 2088 vvvtbp.exe 2840 dfvlh.exe 2972 vbjxbh.exe 1656 pphdvt.exe 3052 lbhdr.exe 816 ltlpp.exe 2800 bttfx.exe 2352 vbxjdl.exe 2784 thbjf.exe 1872 lnjvb.exe 3040 fvlldd.exe 2968 pjxvtbx.exe 2976 hnpttj.exe 2632 vldbrbx.exe 2900 pdjpnb.exe 2160 dvdddnt.exe 1944 njfxn.exe 320 hbblrt.exe 2428 vjvdrf.exe 2148 hhtvpv.exe 2056 lhlxhx.exe 2516 vhfjp.exe 2120 bnrdhj.exe 856 nrdjnd.exe 520 pvpdrx.exe 764 llxlltv.exe -
resource yara_rule behavioral1/memory/2100-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-328-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1892-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/816-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-536-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/796-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-665-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2800-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-708-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-815-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-835-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjbvxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhdxblf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lddpnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxxlrpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnpbpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trdrbfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjlhjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllnjhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njnhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjxjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxvlbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrbvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljpbrvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdhdnph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbxtln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drntl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjtfndb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvnrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnrlffn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lprpxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlfldnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phjhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thdjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltbhxpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnxbrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpbdnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbltxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brhlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpnhtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 912 2100 b5b9a838155ee9f2880603a8df59ceed0cb589d8ea1d02e6343749e785699be2.exe 30 PID 2100 wrote to memory of 912 2100 b5b9a838155ee9f2880603a8df59ceed0cb589d8ea1d02e6343749e785699be2.exe 30 PID 2100 wrote to memory of 912 2100 b5b9a838155ee9f2880603a8df59ceed0cb589d8ea1d02e6343749e785699be2.exe 30 PID 2100 wrote to memory of 912 2100 b5b9a838155ee9f2880603a8df59ceed0cb589d8ea1d02e6343749e785699be2.exe 30 PID 912 wrote to memory of 1892 912 pdpnd.exe 31 PID 912 wrote to memory of 1892 912 pdpnd.exe 31 PID 912 wrote to memory of 1892 912 pdpnd.exe 31 PID 912 wrote to memory of 1892 912 pdpnd.exe 31 PID 1892 wrote to memory of 1212 1892 xltrd.exe 32 PID 1892 wrote to memory of 1212 1892 xltrd.exe 32 PID 1892 wrote to memory of 1212 1892 xltrd.exe 32 PID 1892 wrote to memory of 1212 1892 xltrd.exe 32 PID 1212 wrote to memory of 2872 1212 lxnvh.exe 33 PID 1212 wrote to memory of 2872 1212 lxnvh.exe 33 PID 1212 wrote to memory of 2872 1212 lxnvh.exe 33 PID 1212 wrote to memory of 2872 1212 lxnvh.exe 33 PID 2872 wrote to memory of 2876 2872 dpxbfj.exe 34 PID 2872 wrote to memory of 2876 2872 dpxbfj.exe 34 PID 2872 wrote to memory of 2876 2872 dpxbfj.exe 34 PID 2872 wrote to memory of 2876 2872 dpxbfj.exe 34 PID 2876 wrote to memory of 2992 2876 jdrbrl.exe 35 PID 2876 wrote to memory of 2992 2876 jdrbrl.exe 35 PID 2876 wrote to memory of 2992 2876 jdrbrl.exe 35 PID 2876 wrote to memory of 2992 2876 jdrbrl.exe 35 PID 2992 wrote to memory of 3052 2992 vdhpnnx.exe 36 PID 2992 wrote to memory of 3052 2992 vdhpnnx.exe 36 PID 2992 wrote to memory of 3052 2992 vdhpnnx.exe 36 PID 2992 wrote to memory of 3052 2992 vdhpnnx.exe 36 PID 3052 wrote to memory of 2780 3052 btllpf.exe 37 PID 3052 wrote to memory of 2780 3052 btllpf.exe 37 PID 3052 wrote to memory of 2780 3052 btllpf.exe 37 PID 3052 wrote to memory of 2780 3052 btllpf.exe 37 PID 2780 wrote to memory of 2776 2780 lprpxj.exe 38 PID 2780 wrote to memory of 2776 2780 lprpxj.exe 38 PID 2780 wrote to memory of 2776 2780 lprpxj.exe 38 PID 2780 wrote to memory of 2776 2780 lprpxj.exe 38 PID 2776 wrote to memory of 2768 2776 vjhfbh.exe 39 PID 2776 wrote to memory of 2768 2776 vjhfbh.exe 39 PID 2776 wrote to memory of 2768 2776 vjhfbh.exe 39 PID 2776 wrote to memory of 2768 2776 vjhfbh.exe 39 PID 2768 wrote to memory of 956 2768 thjxj.exe 40 PID 2768 wrote to memory of 956 2768 thjxj.exe 40 PID 2768 wrote to memory of 956 2768 thjxj.exe 40 PID 2768 wrote to memory of 956 2768 thjxj.exe 40 PID 956 wrote to memory of 3036 956 xtxtjt.exe 41 PID 956 wrote to memory of 3036 956 xtxtjt.exe 41 PID 956 wrote to memory of 3036 956 xtxtjt.exe 41 PID 956 wrote to memory of 3036 956 xtxtjt.exe 41 PID 3036 wrote to memory of 2712 3036 xrjfx.exe 42 PID 3036 wrote to memory of 2712 3036 xrjfx.exe 42 PID 3036 wrote to memory of 2712 3036 xrjfx.exe 42 PID 3036 wrote to memory of 2712 3036 xrjfx.exe 42 PID 2712 wrote to memory of 2092 2712 rlvtx.exe 43 PID 2712 wrote to memory of 2092 2712 rlvtx.exe 43 PID 2712 wrote to memory of 2092 2712 rlvtx.exe 43 PID 2712 wrote to memory of 2092 2712 rlvtx.exe 43 PID 2092 wrote to memory of 1672 2092 ljpjdlj.exe 44 PID 2092 wrote to memory of 1672 2092 ljpjdlj.exe 44 PID 2092 wrote to memory of 1672 2092 ljpjdlj.exe 44 PID 2092 wrote to memory of 1672 2092 ljpjdlj.exe 44 PID 1672 wrote to memory of 324 1672 hrpphlj.exe 45 PID 1672 wrote to memory of 324 1672 hrpphlj.exe 45 PID 1672 wrote to memory of 324 1672 hrpphlj.exe 45 PID 1672 wrote to memory of 324 1672 hrpphlj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5b9a838155ee9f2880603a8df59ceed0cb589d8ea1d02e6343749e785699be2.exe"C:\Users\Admin\AppData\Local\Temp\b5b9a838155ee9f2880603a8df59ceed0cb589d8ea1d02e6343749e785699be2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\pdpnd.exec:\pdpnd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\xltrd.exec:\xltrd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\lxnvh.exec:\lxnvh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\dpxbfj.exec:\dpxbfj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\jdrbrl.exec:\jdrbrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\vdhpnnx.exec:\vdhpnnx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\btllpf.exec:\btllpf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\lprpxj.exec:\lprpxj.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\vjhfbh.exec:\vjhfbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\thjxj.exec:\thjxj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\xtxtjt.exec:\xtxtjt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\xrjfx.exec:\xrjfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\rlvtx.exec:\rlvtx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\ljpjdlj.exec:\ljpjdlj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\hrpphlj.exec:\hrpphlj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\llntlx.exec:\llntlx.exe17⤵
- Executes dropped EXE
PID:324 -
\??\c:\lxxrr.exec:\lxxrr.exe18⤵
- Executes dropped EXE
PID:1948 -
\??\c:\rljvb.exec:\rljvb.exe19⤵
- Executes dropped EXE
PID:1688 -
\??\c:\plnhhp.exec:\plnhhp.exe20⤵
- Executes dropped EXE
PID:836 -
\??\c:\rvnrxvf.exec:\rvnrxvf.exe21⤵
- Executes dropped EXE
PID:2144 -
\??\c:\trxrr.exec:\trxrr.exe22⤵
- Executes dropped EXE
PID:2488 -
\??\c:\dlfxl.exec:\dlfxl.exe23⤵
- Executes dropped EXE
PID:1720 -
\??\c:\dpxfr.exec:\dpxfr.exe24⤵
- Executes dropped EXE
PID:2028 -
\??\c:\prntjt.exec:\prntjt.exe25⤵
- Executes dropped EXE
PID:1976 -
\??\c:\vtndrr.exec:\vtndrr.exe26⤵
- Executes dropped EXE
PID:788 -
\??\c:\nfbrn.exec:\nfbrn.exe27⤵
- Executes dropped EXE
PID:1448 -
\??\c:\hdnbbnf.exec:\hdnbbnf.exe28⤵
- Executes dropped EXE
PID:1372 -
\??\c:\rftfhvf.exec:\rftfhvf.exe29⤵
- Executes dropped EXE
PID:1904 -
\??\c:\rpnnv.exec:\rpnnv.exe30⤵
- Executes dropped EXE
PID:2672 -
\??\c:\lrbphjd.exec:\lrbphjd.exe31⤵
- Executes dropped EXE
PID:2464 -
\??\c:\nrhll.exec:\nrhll.exe32⤵
- Executes dropped EXE
PID:1028 -
\??\c:\pddjvft.exec:\pddjvft.exe33⤵
- Executes dropped EXE
PID:1036 -
\??\c:\fhhpf.exec:\fhhpf.exe34⤵
- Executes dropped EXE
PID:1692 -
\??\c:\pdvtxpv.exec:\pdvtxpv.exe35⤵PID:1532
-
\??\c:\pnpxpf.exec:\pnpxpf.exe36⤵
- Executes dropped EXE
PID:1272 -
\??\c:\xvjprl.exec:\xvjprl.exe37⤵
- Executes dropped EXE
PID:912 -
\??\c:\jfhrln.exec:\jfhrln.exe38⤵
- Executes dropped EXE
PID:1892 -
\??\c:\rldfpr.exec:\rldfpr.exe39⤵
- Executes dropped EXE
PID:668 -
\??\c:\tvlfvdt.exec:\tvlfvdt.exe40⤵
- Executes dropped EXE
PID:2948 -
\??\c:\vvvtbp.exec:\vvvtbp.exe41⤵
- Executes dropped EXE
PID:2088 -
\??\c:\dfvlh.exec:\dfvlh.exe42⤵
- Executes dropped EXE
PID:2840 -
\??\c:\vbjxbh.exec:\vbjxbh.exe43⤵
- Executes dropped EXE
PID:2972 -
\??\c:\pphdvt.exec:\pphdvt.exe44⤵
- Executes dropped EXE
PID:1656 -
\??\c:\lbhdr.exec:\lbhdr.exe45⤵
- Executes dropped EXE
PID:3052 -
\??\c:\ltlpp.exec:\ltlpp.exe46⤵
- Executes dropped EXE
PID:816 -
\??\c:\bttfx.exec:\bttfx.exe47⤵
- Executes dropped EXE
PID:2800 -
\??\c:\vbxjdl.exec:\vbxjdl.exe48⤵
- Executes dropped EXE
PID:2352 -
\??\c:\thbjf.exec:\thbjf.exe49⤵
- Executes dropped EXE
PID:2784 -
\??\c:\lnjvb.exec:\lnjvb.exe50⤵
- Executes dropped EXE
PID:1872 -
\??\c:\fvlldd.exec:\fvlldd.exe51⤵
- Executes dropped EXE
PID:3040 -
\??\c:\pjxvtbx.exec:\pjxvtbx.exe52⤵
- Executes dropped EXE
PID:2968 -
\??\c:\hnpttj.exec:\hnpttj.exe53⤵
- Executes dropped EXE
PID:2976 -
\??\c:\vldbrbx.exec:\vldbrbx.exe54⤵
- Executes dropped EXE
PID:2632 -
\??\c:\pdjpnb.exec:\pdjpnb.exe55⤵
- Executes dropped EXE
PID:2900 -
\??\c:\dvdddnt.exec:\dvdddnt.exe56⤵
- Executes dropped EXE
PID:2160 -
\??\c:\njfxn.exec:\njfxn.exe57⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hbblrt.exec:\hbblrt.exe58⤵
- Executes dropped EXE
PID:320 -
\??\c:\vjvdrf.exec:\vjvdrf.exe59⤵
- Executes dropped EXE
PID:2428 -
\??\c:\hhtvpv.exec:\hhtvpv.exe60⤵
- Executes dropped EXE
PID:2148 -
\??\c:\lhlxhx.exec:\lhlxhx.exe61⤵
- Executes dropped EXE
PID:2056 -
\??\c:\vhfjp.exec:\vhfjp.exe62⤵
- Executes dropped EXE
PID:2516 -
\??\c:\bnrdhj.exec:\bnrdhj.exe63⤵
- Executes dropped EXE
PID:2120 -
\??\c:\nrdjnd.exec:\nrdjnd.exe64⤵
- Executes dropped EXE
PID:856 -
\??\c:\pvpdrx.exec:\pvpdrx.exe65⤵
- Executes dropped EXE
PID:520 -
\??\c:\llxlltv.exec:\llxlltv.exe66⤵
- Executes dropped EXE
PID:764 -
\??\c:\xxbtdt.exec:\xxbtdt.exe67⤵PID:272
-
\??\c:\tfhjtt.exec:\tfhjtt.exe68⤵PID:2064
-
\??\c:\dbhtf.exec:\dbhtf.exe69⤵PID:2536
-
\??\c:\xxddt.exec:\xxddt.exe70⤵PID:2688
-
\??\c:\trxlfd.exec:\trxlfd.exe71⤵PID:796
-
\??\c:\dnnxrf.exec:\dnnxrf.exe72⤵PID:2440
-
\??\c:\xdxhl.exec:\xdxhl.exe73⤵PID:1684
-
\??\c:\bnlfhd.exec:\bnlfhd.exe74⤵PID:2208
-
\??\c:\xjnxl.exec:\xjnxl.exe75⤵PID:2480
-
\??\c:\pfxvf.exec:\pfxvf.exe76⤵PID:1732
-
\??\c:\xdbbjt.exec:\xdbbjt.exe77⤵PID:2176
-
\??\c:\vtvnh.exec:\vtvnh.exe78⤵PID:1860
-
\??\c:\bxxlrpv.exec:\bxxlrpv.exe79⤵
- System Location Discovery: System Language Discovery
PID:1236 -
\??\c:\xvtfpt.exec:\xvtfpt.exe80⤵PID:1628
-
\??\c:\lhvdv.exec:\lhvdv.exe81⤵PID:2396
-
\??\c:\dtdjx.exec:\dtdjx.exe82⤵PID:1916
-
\??\c:\xprtf.exec:\xprtf.exe83⤵PID:2804
-
\??\c:\tpttxbd.exec:\tpttxbd.exe84⤵PID:2940
-
\??\c:\hdrrpbd.exec:\hdrrpbd.exe85⤵PID:2732
-
\??\c:\vdnlxb.exec:\vdnlxb.exe86⤵PID:2924
-
\??\c:\xhbfl.exec:\xhbfl.exe87⤵PID:2612
-
\??\c:\tfbjv.exec:\tfbjv.exe88⤵PID:2984
-
\??\c:\lpfnv.exec:\lpfnv.exe89⤵PID:2680
-
\??\c:\plrxfx.exec:\plrxfx.exe90⤵PID:2836
-
\??\c:\thdjjb.exec:\thdjjb.exe91⤵PID:1956
-
\??\c:\tlhhn.exec:\tlhhn.exe92⤵PID:2800
-
\??\c:\tnhnnbp.exec:\tnhnnbp.exe93⤵PID:2352
-
\??\c:\pxjlnr.exec:\pxjlnr.exe94⤵PID:2324
-
\??\c:\thdjf.exec:\thdjf.exe95⤵
- System Location Discovery: System Language Discovery
PID:964 -
\??\c:\xpffv.exec:\xpffv.exe96⤵PID:3032
-
\??\c:\ldhtp.exec:\ldhtp.exe97⤵PID:2548
-
\??\c:\jdlntn.exec:\jdlntn.exe98⤵PID:3044
-
\??\c:\lxlljxt.exec:\lxlljxt.exe99⤵PID:2124
-
\??\c:\brtpvnt.exec:\brtpvnt.exe100⤵PID:1672
-
\??\c:\xvjjjxp.exec:\xvjjjxp.exe101⤵PID:2356
-
\??\c:\tdxld.exec:\tdxld.exe102⤵PID:1944
-
\??\c:\nbppvvr.exec:\nbppvvr.exe103⤵PID:1840
-
\??\c:\bpbpht.exec:\bpbpht.exe104⤵PID:2428
-
\??\c:\rjnlfhh.exec:\rjnlfhh.exe105⤵PID:2148
-
\??\c:\xfxrvrr.exec:\xfxrvrr.exe106⤵PID:2056
-
\??\c:\vjjvrl.exec:\vjjvrl.exe107⤵PID:1680
-
\??\c:\rpttjrl.exec:\rpttjrl.exe108⤵PID:2244
-
\??\c:\tvfjlnv.exec:\tvfjlnv.exe109⤵PID:856
-
\??\c:\dthlvh.exec:\dthlvh.exe110⤵PID:1440
-
\??\c:\hlnrjp.exec:\hlnrjp.exe111⤵PID:1280
-
\??\c:\btbnhrx.exec:\btbnhrx.exe112⤵PID:2600
-
\??\c:\vlhpbdx.exec:\vlhpbdx.exe113⤵PID:1428
-
\??\c:\xjfxrx.exec:\xjfxrx.exe114⤵PID:944
-
\??\c:\npdln.exec:\npdln.exe115⤵PID:2524
-
\??\c:\xdhdnph.exec:\xdhdnph.exe116⤵
- System Location Discovery: System Language Discovery
PID:2392 -
\??\c:\ntdhbx.exec:\ntdhbx.exe117⤵PID:1020
-
\??\c:\vlnpt.exec:\vlnpt.exe118⤵PID:1928
-
\??\c:\lbxtln.exec:\lbxtln.exe119⤵
- System Location Discovery: System Language Discovery
PID:2188 -
\??\c:\bvrtl.exec:\bvrtl.exe120⤵PID:2564
-
\??\c:\ttlpn.exec:\ttlpn.exe121⤵PID:2308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-