Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08/01/2025, 05:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3a067a03dd22d5739b81960f17ea39c41274627e3d8c48f174a75fc68ed364d5N.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
3a067a03dd22d5739b81960f17ea39c41274627e3d8c48f174a75fc68ed364d5N.exe
-
Size
454KB
-
MD5
fc224304566d25384e8edcfc8405f090
-
SHA1
49932501d5596c3c6973cb4662472be21de94579
-
SHA256
3a067a03dd22d5739b81960f17ea39c41274627e3d8c48f174a75fc68ed364d5
-
SHA512
83bed7664387e29d7c964ba69fe0e251ebe1eb22216d4a40e1be8c880c763ae51782ef84fd48d22326213433276a2c94339f43f3a8b514956455eb4351ea73d8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe8:q7Tc2NYHUrAwfMp3CD8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2528-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-46-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3020-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1472-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-261-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2596-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-336-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-391-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1468-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-499-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3040-616-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/536-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-930-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/784-948-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2952-968-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-989-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1540-1009-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2348-1010-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2168-1042-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2168-1063-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2076 pvltb.exe 1476 phvxt.exe 2988 ttbfvbb.exe 3020 lvvpbtr.exe 2964 fntlp.exe 2936 nrhnd.exe 2756 jftltvb.exe 836 jxbvx.exe 2472 ldxvptt.exe 1472 hdfhxj.exe 2948 vtjrf.exe 1928 fbtfb.exe 1952 lrtxxdl.exe 2112 ttfjp.exe 3024 ftvjnxr.exe 1800 llhnth.exe 2380 vhvfplr.exe 1524 pppnvp.exe 1204 fthfx.exe 2232 fnbxtnx.exe 2168 btdlbbv.exe 1716 xjnvf.exe 2584 jlfvbhl.exe 1208 xtpfrh.exe 1492 frbpt.exe 680 xflnn.exe 2092 htvjhnr.exe 2664 dtdflb.exe 816 fpvlj.exe 1688 jppfrd.exe 2596 lvxlvh.exe 2620 jptlp.exe 2528 rrpxpn.exe 2912 vvxtp.exe 2968 pvlpb.exe 2980 pvrljvb.exe 2288 rdrttv.exe 2208 ntphbfr.exe 2032 jxvjdtr.exe 2964 nxprnp.exe 2792 vdfnrp.exe 2816 xnpvtjv.exe 2780 dphxpxn.exe 2564 nxdbxhh.exe 1920 jtfvf.exe 1468 xjvlt.exe 932 vjljb.exe 2240 thjfxhf.exe 1656 lnpnd.exe 3004 thrbj.exe 980 hnhfjdf.exe 1148 tljpnp.exe 2328 tnvxdhf.exe 1540 dvdfpl.exe 2184 fnlrdd.exe 2356 nbrth.exe 2176 txbnn.exe 1260 xtdfd.exe 2196 jxjdxhl.exe 2232 lnxdjr.exe 904 fhdrv.exe 2128 ttxjf.exe 1624 hptlj.exe 2572 xlpfvnp.exe -
resource yara_rule behavioral1/memory/2528-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-336-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2816-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-616-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/536-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-862-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-930-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-968-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-975-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhrjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljnhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxttxbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbhfxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrpxpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbntj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffhbnvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jndvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fthfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdrttv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xptnjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbfrvnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljlbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlpfvnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfvnhrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfbvffn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbxjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbtfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrhhbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnrfhlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbpvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxxpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htvjhnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlbdth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llbrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpbdrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntpvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdnpxrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfrnxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbrjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxpjth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdprbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvltb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlfvbhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtbjxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdfvdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnlrbbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhjpll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xphhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpfld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdtxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxbnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntvxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtvfhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dthdhnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrxtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vndljdd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2076 2528 3a067a03dd22d5739b81960f17ea39c41274627e3d8c48f174a75fc68ed364d5N.exe 30 PID 2528 wrote to memory of 2076 2528 3a067a03dd22d5739b81960f17ea39c41274627e3d8c48f174a75fc68ed364d5N.exe 30 PID 2528 wrote to memory of 2076 2528 3a067a03dd22d5739b81960f17ea39c41274627e3d8c48f174a75fc68ed364d5N.exe 30 PID 2528 wrote to memory of 2076 2528 3a067a03dd22d5739b81960f17ea39c41274627e3d8c48f174a75fc68ed364d5N.exe 30 PID 2076 wrote to memory of 1476 2076 pvltb.exe 31 PID 2076 wrote to memory of 1476 2076 pvltb.exe 31 PID 2076 wrote to memory of 1476 2076 pvltb.exe 31 PID 2076 wrote to memory of 1476 2076 pvltb.exe 31 PID 1476 wrote to memory of 2988 1476 phvxt.exe 32 PID 1476 wrote to memory of 2988 1476 phvxt.exe 32 PID 1476 wrote to memory of 2988 1476 phvxt.exe 32 PID 1476 wrote to memory of 2988 1476 phvxt.exe 32 PID 2988 wrote to memory of 3020 2988 ttbfvbb.exe 33 PID 2988 wrote to memory of 3020 2988 ttbfvbb.exe 33 PID 2988 wrote to memory of 3020 2988 ttbfvbb.exe 33 PID 2988 wrote to memory of 3020 2988 ttbfvbb.exe 33 PID 3020 wrote to memory of 2964 3020 lvvpbtr.exe 34 PID 3020 wrote to memory of 2964 3020 lvvpbtr.exe 34 PID 3020 wrote to memory of 2964 3020 lvvpbtr.exe 34 PID 3020 wrote to memory of 2964 3020 lvvpbtr.exe 34 PID 2964 wrote to memory of 2936 2964 fntlp.exe 35 PID 2964 wrote to memory of 2936 2964 fntlp.exe 35 PID 2964 wrote to memory of 2936 2964 fntlp.exe 35 PID 2964 wrote to memory of 2936 2964 fntlp.exe 35 PID 2936 wrote to memory of 2756 2936 nrhnd.exe 36 PID 2936 wrote to memory of 2756 2936 nrhnd.exe 36 PID 2936 wrote to memory of 2756 2936 nrhnd.exe 36 PID 2936 wrote to memory of 2756 2936 nrhnd.exe 36 PID 2756 wrote to memory of 836 2756 jftltvb.exe 37 PID 2756 wrote to memory of 836 2756 jftltvb.exe 37 PID 2756 wrote to memory of 836 2756 jftltvb.exe 37 PID 2756 wrote to memory of 836 2756 jftltvb.exe 37 PID 836 wrote to memory of 2472 836 jxbvx.exe 38 PID 836 wrote to memory of 2472 836 jxbvx.exe 38 PID 836 wrote to memory of 2472 836 jxbvx.exe 38 PID 836 wrote to memory of 2472 836 jxbvx.exe 38 PID 2472 wrote to memory of 1472 2472 ldxvptt.exe 39 PID 2472 wrote to memory of 1472 2472 ldxvptt.exe 39 PID 2472 wrote to memory of 1472 2472 ldxvptt.exe 39 PID 2472 wrote to memory of 1472 2472 ldxvptt.exe 39 PID 1472 wrote to memory of 2948 1472 hdfhxj.exe 40 PID 1472 wrote to memory of 2948 1472 hdfhxj.exe 40 PID 1472 wrote to memory of 2948 1472 hdfhxj.exe 40 PID 1472 wrote to memory of 2948 1472 hdfhxj.exe 40 PID 2948 wrote to memory of 1928 2948 vtjrf.exe 41 PID 2948 wrote to memory of 1928 2948 vtjrf.exe 41 PID 2948 wrote to memory of 1928 2948 vtjrf.exe 41 PID 2948 wrote to memory of 1928 2948 vtjrf.exe 41 PID 1928 wrote to memory of 1952 1928 fbtfb.exe 42 PID 1928 wrote to memory of 1952 1928 fbtfb.exe 42 PID 1928 wrote to memory of 1952 1928 fbtfb.exe 42 PID 1928 wrote to memory of 1952 1928 fbtfb.exe 42 PID 1952 wrote to memory of 2112 1952 lrtxxdl.exe 43 PID 1952 wrote to memory of 2112 1952 lrtxxdl.exe 43 PID 1952 wrote to memory of 2112 1952 lrtxxdl.exe 43 PID 1952 wrote to memory of 2112 1952 lrtxxdl.exe 43 PID 2112 wrote to memory of 3024 2112 ttfjp.exe 44 PID 2112 wrote to memory of 3024 2112 ttfjp.exe 44 PID 2112 wrote to memory of 3024 2112 ttfjp.exe 44 PID 2112 wrote to memory of 3024 2112 ttfjp.exe 44 PID 3024 wrote to memory of 1800 3024 ftvjnxr.exe 45 PID 3024 wrote to memory of 1800 3024 ftvjnxr.exe 45 PID 3024 wrote to memory of 1800 3024 ftvjnxr.exe 45 PID 3024 wrote to memory of 1800 3024 ftvjnxr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a067a03dd22d5739b81960f17ea39c41274627e3d8c48f174a75fc68ed364d5N.exe"C:\Users\Admin\AppData\Local\Temp\3a067a03dd22d5739b81960f17ea39c41274627e3d8c48f174a75fc68ed364d5N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\pvltb.exec:\pvltb.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\phvxt.exec:\phvxt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\ttbfvbb.exec:\ttbfvbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\lvvpbtr.exec:\lvvpbtr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\fntlp.exec:\fntlp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\nrhnd.exec:\nrhnd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\jftltvb.exec:\jftltvb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\jxbvx.exec:\jxbvx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\ldxvptt.exec:\ldxvptt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\hdfhxj.exec:\hdfhxj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\vtjrf.exec:\vtjrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\fbtfb.exec:\fbtfb.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\lrtxxdl.exec:\lrtxxdl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\ttfjp.exec:\ttfjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\ftvjnxr.exec:\ftvjnxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\llhnth.exec:\llhnth.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1800 -
\??\c:\vhvfplr.exec:\vhvfplr.exe18⤵
- Executes dropped EXE
PID:2380 -
\??\c:\pppnvp.exec:\pppnvp.exe19⤵
- Executes dropped EXE
PID:1524 -
\??\c:\fthfx.exec:\fthfx.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1204 -
\??\c:\fnbxtnx.exec:\fnbxtnx.exe21⤵
- Executes dropped EXE
PID:2232 -
\??\c:\btdlbbv.exec:\btdlbbv.exe22⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xjnvf.exec:\xjnvf.exe23⤵
- Executes dropped EXE
PID:1716 -
\??\c:\jlfvbhl.exec:\jlfvbhl.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2584 -
\??\c:\xtpfrh.exec:\xtpfrh.exe25⤵
- Executes dropped EXE
PID:1208 -
\??\c:\frbpt.exec:\frbpt.exe26⤵
- Executes dropped EXE
PID:1492 -
\??\c:\xflnn.exec:\xflnn.exe27⤵
- Executes dropped EXE
PID:680 -
\??\c:\htvjhnr.exec:\htvjhnr.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2092 -
\??\c:\dtdflb.exec:\dtdflb.exe29⤵
- Executes dropped EXE
PID:2664 -
\??\c:\fpvlj.exec:\fpvlj.exe30⤵
- Executes dropped EXE
PID:816 -
\??\c:\jppfrd.exec:\jppfrd.exe31⤵
- Executes dropped EXE
PID:1688 -
\??\c:\lvxlvh.exec:\lvxlvh.exe32⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jptlp.exec:\jptlp.exe33⤵
- Executes dropped EXE
PID:2620 -
\??\c:\rrpxpn.exec:\rrpxpn.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2528 -
\??\c:\vvxtp.exec:\vvxtp.exe35⤵
- Executes dropped EXE
PID:2912 -
\??\c:\pvlpb.exec:\pvlpb.exe36⤵
- Executes dropped EXE
PID:2968 -
\??\c:\pvrljvb.exec:\pvrljvb.exe37⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rdrttv.exec:\rdrttv.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2288 -
\??\c:\ntphbfr.exec:\ntphbfr.exe39⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jxvjdtr.exec:\jxvjdtr.exe40⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nxprnp.exec:\nxprnp.exe41⤵
- Executes dropped EXE
PID:2964 -
\??\c:\vdfnrp.exec:\vdfnrp.exe42⤵
- Executes dropped EXE
PID:2792 -
\??\c:\xnpvtjv.exec:\xnpvtjv.exe43⤵
- Executes dropped EXE
PID:2816 -
\??\c:\dphxpxn.exec:\dphxpxn.exe44⤵
- Executes dropped EXE
PID:2780 -
\??\c:\nxdbxhh.exec:\nxdbxhh.exe45⤵
- Executes dropped EXE
PID:2564 -
\??\c:\jtfvf.exec:\jtfvf.exe46⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xjvlt.exec:\xjvlt.exe47⤵
- Executes dropped EXE
PID:1468 -
\??\c:\vjljb.exec:\vjljb.exe48⤵
- Executes dropped EXE
PID:932 -
\??\c:\thjfxhf.exec:\thjfxhf.exe49⤵
- Executes dropped EXE
PID:2240 -
\??\c:\lnpnd.exec:\lnpnd.exe50⤵
- Executes dropped EXE
PID:1656 -
\??\c:\thrbj.exec:\thrbj.exe51⤵
- Executes dropped EXE
PID:3004 -
\??\c:\hnhfjdf.exec:\hnhfjdf.exe52⤵
- Executes dropped EXE
PID:980 -
\??\c:\tljpnp.exec:\tljpnp.exe53⤵
- Executes dropped EXE
PID:1148 -
\??\c:\tnvxdhf.exec:\tnvxdhf.exe54⤵
- Executes dropped EXE
PID:2328 -
\??\c:\dvdfpl.exec:\dvdfpl.exe55⤵
- Executes dropped EXE
PID:1540 -
\??\c:\fnlrdd.exec:\fnlrdd.exe56⤵
- Executes dropped EXE
PID:2184 -
\??\c:\nbrth.exec:\nbrth.exe57⤵
- Executes dropped EXE
PID:2356 -
\??\c:\txbnn.exec:\txbnn.exe58⤵
- Executes dropped EXE
PID:2176 -
\??\c:\xtdfd.exec:\xtdfd.exe59⤵
- Executes dropped EXE
PID:1260 -
\??\c:\jxjdxhl.exec:\jxjdxhl.exe60⤵
- Executes dropped EXE
PID:2196 -
\??\c:\lnxdjr.exec:\lnxdjr.exe61⤵
- Executes dropped EXE
PID:2232 -
\??\c:\fhdrv.exec:\fhdrv.exe62⤵
- Executes dropped EXE
PID:904 -
\??\c:\ttxjf.exec:\ttxjf.exe63⤵
- Executes dropped EXE
PID:2128 -
\??\c:\hptlj.exec:\hptlj.exe64⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xlpfvnp.exec:\xlpfvnp.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2572 -
\??\c:\rvrxb.exec:\rvrxb.exe66⤵PID:1208
-
\??\c:\lfdjfph.exec:\lfdjfph.exe67⤵PID:2600
-
\??\c:\bbbhrv.exec:\bbbhrv.exe68⤵PID:2060
-
\??\c:\rhvln.exec:\rhvln.exe69⤵PID:2028
-
\??\c:\dnxbxjj.exec:\dnxbxjj.exe70⤵PID:1300
-
\??\c:\djnrbtr.exec:\djnrbtr.exe71⤵PID:1060
-
\??\c:\vdtxt.exec:\vdtxt.exe72⤵
- System Location Discovery: System Language Discovery
PID:1764 -
\??\c:\bxxfx.exec:\bxxfx.exe73⤵PID:2008
-
\??\c:\xxxdnvl.exec:\xxxdnvl.exe74⤵PID:1808
-
\??\c:\npxdtph.exec:\npxdtph.exe75⤵PID:1568
-
\??\c:\jhxrlb.exec:\jhxrlb.exe76⤵PID:2548
-
\??\c:\tdtxf.exec:\tdtxf.exe77⤵PID:604
-
\??\c:\nldpp.exec:\nldpp.exe78⤵PID:2244
-
\??\c:\btrlpfr.exec:\btrlpfr.exe79⤵PID:2968
-
\??\c:\njrnp.exec:\njrnp.exe80⤵PID:3012
-
\??\c:\vxxjdh.exec:\vxxjdh.exe81⤵PID:2288
-
\??\c:\hltnf.exec:\hltnf.exe82⤵PID:3040
-
\??\c:\vbxxbn.exec:\vbxxbn.exe83⤵PID:2032
-
\??\c:\jnntdpt.exec:\jnntdpt.exe84⤵PID:536
-
\??\c:\nxxdxlx.exec:\nxxdxlx.exe85⤵PID:2788
-
\??\c:\xrbfvl.exec:\xrbfvl.exe86⤵PID:2844
-
\??\c:\frdpf.exec:\frdpf.exe87⤵PID:1836
-
\??\c:\dfrnf.exec:\dfrnf.exe88⤵PID:1700
-
\??\c:\xhrdt.exec:\xhrdt.exe89⤵PID:2268
-
\??\c:\lrnxn.exec:\lrnxn.exe90⤵PID:2700
-
\??\c:\xxnjjbn.exec:\xxnjjbn.exe91⤵PID:1564
-
\??\c:\ntpvf.exec:\ntpvf.exe92⤵
- System Location Discovery: System Language Discovery
PID:2416 -
\??\c:\jvbnxh.exec:\jvbnxh.exe93⤵PID:2832
-
\??\c:\pnjbnt.exec:\pnjbnt.exe94⤵PID:2480
-
\??\c:\bvdprxl.exec:\bvdprxl.exe95⤵PID:1108
-
\??\c:\tjdlbx.exec:\tjdlbx.exe96⤵PID:2448
-
\??\c:\hntvxt.exec:\hntvxt.exe97⤵
- System Location Discovery: System Language Discovery
PID:1016 -
\??\c:\pvtpdt.exec:\pvtpdt.exe98⤵PID:2328
-
\??\c:\tpljxj.exec:\tpljxj.exe99⤵PID:2080
-
\??\c:\rrlhrtf.exec:\rrlhrtf.exe100⤵PID:2164
-
\??\c:\htrvxnb.exec:\htrvxnb.exe101⤵PID:2180
-
\??\c:\dtxjd.exec:\dtxjd.exe102⤵PID:2312
-
\??\c:\hddvhj.exec:\hddvhj.exe103⤵PID:2632
-
\??\c:\ntjxb.exec:\ntjxb.exe104⤵PID:2440
-
\??\c:\hhlrhj.exec:\hhlrhj.exe105⤵PID:2188
-
\??\c:\tttlhv.exec:\tttlhv.exe106⤵PID:1104
-
\??\c:\xpnppl.exec:\xpnppl.exe107⤵PID:2004
-
\??\c:\jjhpfj.exec:\jjhpfj.exe108⤵PID:1384
-
\??\c:\pjbrbr.exec:\pjbrbr.exe109⤵PID:1100
-
\??\c:\dlntvrp.exec:\dlntvrp.exe110⤵PID:2572
-
\??\c:\ndphp.exec:\ndphp.exe111⤵PID:1492
-
\??\c:\lpvnjxh.exec:\lpvnjxh.exe112⤵PID:1544
-
\??\c:\bjrbjl.exec:\bjrbjl.exe113⤵PID:108
-
\??\c:\dhfvv.exec:\dhfvv.exe114⤵PID:1236
-
\??\c:\flndf.exec:\flndf.exe115⤵PID:1328
-
\??\c:\jxltprt.exec:\jxltprt.exe116⤵PID:2608
-
\??\c:\vfdnl.exec:\vfdnl.exe117⤵PID:1752
-
\??\c:\jlrhd.exec:\jlrhd.exe118⤵PID:1040
-
\??\c:\hfrpppp.exec:\hfrpppp.exe119⤵PID:2616
-
\??\c:\jprnpvp.exec:\jprnpvp.exe120⤵PID:2620
-
\??\c:\vnfxdv.exec:\vnfxdv.exe121⤵PID:1692
-
\??\c:\pxvrt.exec:\pxvrt.exe122⤵PID:2912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-