Analysis
- max time kernel
120s - max time network
19s - platform
windows7_x64 - resource
win7-20241010-en - resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system - submitted
08/01/2025, 14:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8cea0e0ce7b02cce0e0428e60e83490485971fec8f6ff656e272b577df34f1ebN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
- Target 8cea0e0ce7b02cce0e0428e60e83490485971fec8f6ff656e272b577df34f1ebN.exe
- Size 454KB
- Sample250108-rntphssrfv
- SHA256 8cea0e0ce7b02cce0e0428e60e83490485971fec8f6ff656e272b577df34f1eb
- MD5 5dca0daa2a67e538fd85313e4d5a2780
- SHA1 477cdc6ea6f3fcfcc64fd890e7933f77c3ec1cac
- SHA512 df79cc8ac5b4103615630a00370c5bd314d1f4d37972b7886eff79e6ef199637d0c3ad2c891c75f7070ce3bd53ad9787aa099f87e7900173c31e5b02ca0c6731
- SSDEEP 6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeZ:q7Tc2NYHUrAwfMp3CDZ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blackmoon family
- Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2100-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-57-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2136-63-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2772-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-191-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2492-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/456-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-287-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2616-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-389-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2892-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-551-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2476-578-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2476-599-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2096-612-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2396-618-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2616-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-772-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 912 vxbdv.exe 1892 ptprrf.exe 1128 fxnbtbj.exe 2576 prptt.exe 2948 xtprbt.exe 2136 ppbbphv.exe 2772 prdptp.exe 2756 tthtp.exe 2376 tfphr.exe 1784 xrnvpb.exe 1872 flppxb.exe 1520 fhlnbtb.exe 2812 rvnhnnv.exe 1584 pfjrrr.exe 2124 ldjdht.exe 1556 vrnrnj.exe 320 vvnfpn.exe 2424 xdhpb.exe 1612 dbhdxfx.exe 2492 lfdbl.exe 1680 npddxpt.exe 2028 brnjpnp.exe 1852 tnptnj.exe 456 tbxxv.exe 1772 xntlh.exe 2484 vrhvp.exe 108 trrtfb.exe 1312 jxvlxxh.exe 2652 dbxhft.exe 2188 jdblnfl.exe 1032 rbnflpp.exe 1544 lnpjx.exe 2204 dvdhnjt.exe 1460 rrpnbd.exe 912 vjtjrrh.exe 2912 rlfxp.exe 2616 vfldj.exe 2624 nnrjpl.exe 924 njdjjj.exe 2880 pdhjlxp.exe 2840 dnxjdp.exe 2888 bhttjv.exe 2980 jnvpbvv.exe 2744 vjnrlj.exe 2892 xxxdv.exe 1632 rnbndn.exe 2376 rvdvxjn.exe 956 xbxvn.exe 1716 jhnrppn.exe 3024 pdtbr.exe 3064 vprljn.exe 1672 prfjbbv.exe 2216 hbfhjtf.exe 1676 rljvt.exe 396 vnvpl.exe 1592 vtfjbht.exe 760 pdbppt.exe 2076 lvxbxr.exe 2512 nvrlx.exe 2120 lvhdrvx.exe 1276 tvvpvbh.exe 2280 fdfjfb.exe 2128 ljvjxpv.exe 1844 dbrfnvn.exe -
resource yara_rule behavioral1/memory/2100-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/456-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-487-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1844-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-633-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1688-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-798-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-848-0x0000000000400000-0x000000000042A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvtnrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfbxrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntxhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvjnpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbxhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdbvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptpvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppxpnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbbrbnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxvbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrrph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhbrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdhlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndxbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfvph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxbxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlvld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxttp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljbppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpbtppt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdvdrhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvdrxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvndl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnjpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvtbnhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxjnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffrjhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvfbtfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdrnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnjxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtrvnpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnvjvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfdbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrfpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbftvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrpjnfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnfjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djrth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrxjvnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxnprvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjphdvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrjjrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnfrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvldd.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 912 2100 8cea0e0ce7b02cce0e0428e60e83490485971fec8f6ff656e272b577df34f1ebN.exe 30 PID 2100 wrote to memory of 912 2100 8cea0e0ce7b02cce0e0428e60e83490485971fec8f6ff656e272b577df34f1ebN.exe 30 PID 2100 wrote to memory of 912 2100 8cea0e0ce7b02cce0e0428e60e83490485971fec8f6ff656e272b577df34f1ebN.exe 30 PID 2100 wrote to memory of 912 2100 8cea0e0ce7b02cce0e0428e60e83490485971fec8f6ff656e272b577df34f1ebN.exe 30 PID 912 wrote to memory of 1892 912 vxbdv.exe 31 PID 912 wrote to memory of 1892 912 vxbdv.exe 31 PID 912 wrote to memory of 1892 912 vxbdv.exe 31 PID 912 wrote to memory of 1892 912 vxbdv.exe 31 PID 1892 wrote to memory of 1128 1892 ptprrf.exe 32 PID 1892 wrote to memory of 1128 1892 ptprrf.exe 32 PID 1892 wrote to memory of 1128 1892 ptprrf.exe 32 PID 1892 wrote to memory of 1128 1892 ptprrf.exe 32 PID 1128 wrote to memory of 2576 1128 fxnbtbj.exe 33 PID 1128 wrote to memory of 2576 1128 fxnbtbj.exe 33 PID 1128 wrote to memory of 2576 1128 fxnbtbj.exe 33 PID 1128 wrote to memory of 2576 1128 fxnbtbj.exe 33 PID 2576 wrote to memory of 2948 2576 prptt.exe 34 PID 2576 wrote to memory of 2948 2576 prptt.exe 34 PID 2576 wrote to memory of 2948 2576 prptt.exe 34 PID 2576 wrote to memory of 2948 2576 prptt.exe 34 PID 2948 wrote to memory of 2136 2948 xtprbt.exe 35 PID 2948 wrote to memory of 2136 2948 xtprbt.exe 35 PID 2948 wrote to memory of 2136 2948 xtprbt.exe 35 PID 2948 wrote to memory of 2136 2948 xtprbt.exe 35 PID 2136 wrote to memory of 2772 2136 ppbbphv.exe 36 PID 2136 wrote to memory of 2772 2136 ppbbphv.exe 36 PID 2136 wrote to memory of 2772 2136 ppbbphv.exe 36 PID 2136 wrote to memory of 2772 2136 ppbbphv.exe 36 PID 2772 wrote to memory of 2756 2772 prdptp.exe 37 PID 2772 wrote to memory of 2756 2772 prdptp.exe 37 PID 2772 wrote to memory of 2756 2772 prdptp.exe 37 PID 2772 wrote to memory of 2756 2772 prdptp.exe 37 PID 2756 wrote to memory of 2376 2756 tthtp.exe 38 PID 2756 wrote to memory of 2376 2756 tthtp.exe 38 PID 2756 wrote to memory of 2376 2756 tthtp.exe 38 PID 2756 wrote to memory of 2376 2756 tthtp.exe 38 PID 2376 wrote to memory of 1784 2376 tfphr.exe 39 PID 2376 wrote to memory of 1784 2376 tfphr.exe 39 PID 2376 wrote to memory of 1784 2376 tfphr.exe 39 PID 2376 wrote to memory of 1784 2376 tfphr.exe 39 PID 1784 wrote to memory of 1872 1784 xrnvpb.exe 40 PID 1784 wrote to memory of 1872 1784 xrnvpb.exe 40 PID 1784 wrote to memory of 1872 1784 xrnvpb.exe 40 PID 1784 wrote to memory of 1872 1784 xrnvpb.exe 40 PID 1872 wrote to memory of 1520 1872 flppxb.exe 41 PID 1872 wrote to memory of 1520 1872 flppxb.exe 41 PID 1872 wrote to memory of 1520 1872 flppxb.exe 41 PID 1872 wrote to memory of 1520 1872 flppxb.exe 41 PID 1520 wrote to memory of 2812 1520 fhlnbtb.exe 42 PID 1520 wrote to memory of 2812 1520 fhlnbtb.exe 42 PID 1520 wrote to memory of 2812 1520 fhlnbtb.exe 42 PID 1520 wrote to memory of 2812 1520 fhlnbtb.exe 42 PID 2812 wrote to memory of 1584 2812 rvnhnnv.exe 43 PID 2812 wrote to memory of 1584 2812 rvnhnnv.exe 43 PID 2812 wrote to memory of 1584 2812 rvnhnnv.exe 43 PID 2812 wrote to memory of 1584 2812 rvnhnnv.exe 43 PID 1584 wrote to memory of 2124 1584 pfjrrr.exe 44 PID 1584 wrote to memory of 2124 1584 pfjrrr.exe 44 PID 1584 wrote to memory of 2124 1584 pfjrrr.exe 44 PID 1584 wrote to memory of 2124 1584 pfjrrr.exe 44 PID 2124 wrote to memory of 1556 2124 ldjdht.exe 45 PID 2124 wrote to memory of 1556 2124 ldjdht.exe 45 PID 2124 wrote to memory of 1556 2124 ldjdht.exe 45 PID 2124 wrote to memory of 1556 2124 ldjdht.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cea0e0ce7b02cce0e0428e60e83490485971fec8f6ff656e272b577df34f1ebN.exe"C:\Users\Admin\AppData\Local\Temp\8cea0e0ce7b02cce0e0428e60e83490485971fec8f6ff656e272b577df34f1ebN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\vxbdv.exec:\vxbdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\ptprrf.exec:\ptprrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\fxnbtbj.exec:\fxnbtbj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\prptt.exec:\prptt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\xtprbt.exec:\xtprbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\ppbbphv.exec:\ppbbphv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\prdptp.exec:\prdptp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\tthtp.exec:\tthtp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\tfphr.exec:\tfphr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\xrnvpb.exec:\xrnvpb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\flppxb.exec:\flppxb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\fhlnbtb.exec:\fhlnbtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\rvnhnnv.exec:\rvnhnnv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\pfjrrr.exec:\pfjrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\ldjdht.exec:\ldjdht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\vrnrnj.exec:\vrnrnj.exe17⤵
- Executes dropped EXE
PID:1556 -
\??\c:\vvnfpn.exec:\vvnfpn.exe18⤵
- Executes dropped EXE
PID:320 -
\??\c:\xdhpb.exec:\xdhpb.exe19⤵
- Executes dropped EXE
PID:2424 -
\??\c:\dbhdxfx.exec:\dbhdxfx.exe20⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lfdbl.exec:\lfdbl.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2492 -
\??\c:\npddxpt.exec:\npddxpt.exe22⤵
- Executes dropped EXE
PID:1680 -
\??\c:\brnjpnp.exec:\brnjpnp.exe23⤵
- Executes dropped EXE
PID:2028 -
\??\c:\tnptnj.exec:\tnptnj.exe24⤵
- Executes dropped EXE
PID:1852 -
\??\c:\tbxxv.exec:\tbxxv.exe25⤵
- Executes dropped EXE
PID:456 -
\??\c:\xntlh.exec:\xntlh.exe26⤵
- Executes dropped EXE
PID:1772 -
\??\c:\vrhvp.exec:\vrhvp.exe27⤵
- Executes dropped EXE
PID:2484 -
\??\c:\trrtfb.exec:\trrtfb.exe28⤵
- Executes dropped EXE
PID:108 -
\??\c:\jxvlxxh.exec:\jxvlxxh.exe29⤵
- Executes dropped EXE
PID:1312 -
\??\c:\dbxhft.exec:\dbxhft.exe30⤵
- Executes dropped EXE
PID:2652 -
\??\c:\jdblnfl.exec:\jdblnfl.exe31⤵
- Executes dropped EXE
PID:2188 -
\??\c:\rbnflpp.exec:\rbnflpp.exe32⤵
- Executes dropped EXE
PID:1032 -
\??\c:\lnpjx.exec:\lnpjx.exe33⤵
- Executes dropped EXE
PID:1544 -
\??\c:\dvdhnjt.exec:\dvdhnjt.exe34⤵
- Executes dropped EXE
PID:2204 -
\??\c:\rrpnbd.exec:\rrpnbd.exe35⤵
- Executes dropped EXE
PID:1460 -
\??\c:\vjtjrrh.exec:\vjtjrrh.exe36⤵
- Executes dropped EXE
PID:912 -
\??\c:\rlfxp.exec:\rlfxp.exe37⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vfldj.exec:\vfldj.exe38⤵
- Executes dropped EXE
PID:2616 -
\??\c:\nnrjpl.exec:\nnrjpl.exe39⤵
- Executes dropped EXE
PID:2624 -
\??\c:\njdjjj.exec:\njdjjj.exe40⤵
- Executes dropped EXE
PID:924 -
\??\c:\pdhjlxp.exec:\pdhjlxp.exe41⤵
- Executes dropped EXE
PID:2880 -
\??\c:\dnxjdp.exec:\dnxjdp.exe42⤵
- Executes dropped EXE
PID:2840 -
\??\c:\bhttjv.exec:\bhttjv.exe43⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jnvpbvv.exec:\jnvpbvv.exe44⤵
- Executes dropped EXE
PID:2980 -
\??\c:\vjnrlj.exec:\vjnrlj.exe45⤵
- Executes dropped EXE
PID:2744 -
\??\c:\xxxdv.exec:\xxxdv.exe46⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rnbndn.exec:\rnbndn.exe47⤵
- Executes dropped EXE
PID:1632 -
\??\c:\rvdvxjn.exec:\rvdvxjn.exe48⤵
- Executes dropped EXE
PID:2376 -
\??\c:\xbxvn.exec:\xbxvn.exe49⤵
- Executes dropped EXE
PID:956 -
\??\c:\jhnrppn.exec:\jhnrppn.exe50⤵
- Executes dropped EXE
PID:1716 -
\??\c:\pdtbr.exec:\pdtbr.exe51⤵
- Executes dropped EXE
PID:3024 -
\??\c:\vprljn.exec:\vprljn.exe52⤵
- Executes dropped EXE
PID:3064 -
\??\c:\prfjbbv.exec:\prfjbbv.exe53⤵
- Executes dropped EXE
PID:1672 -
\??\c:\hbfhjtf.exec:\hbfhjtf.exe54⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rljvt.exec:\rljvt.exe55⤵
- Executes dropped EXE
PID:1676 -
\??\c:\vnvpl.exec:\vnvpl.exe56⤵
- Executes dropped EXE
PID:396 -
\??\c:\vtfjbht.exec:\vtfjbht.exe57⤵
- Executes dropped EXE
PID:1592 -
\??\c:\pdbppt.exec:\pdbppt.exe58⤵
- Executes dropped EXE
PID:760 -
\??\c:\lvxbxr.exec:\lvxbxr.exe59⤵
- Executes dropped EXE
PID:2076 -
\??\c:\nvrlx.exec:\nvrlx.exe60⤵
- Executes dropped EXE
PID:2512 -
\??\c:\lvhdrvx.exec:\lvhdrvx.exe61⤵
- Executes dropped EXE
PID:2120 -
\??\c:\tvvpvbh.exec:\tvvpvbh.exe62⤵
- Executes dropped EXE
PID:1276 -
\??\c:\fdfjfb.exec:\fdfjfb.exe63⤵
- Executes dropped EXE
PID:2280 -
\??\c:\ljvjxpv.exec:\ljvjxpv.exe64⤵
- Executes dropped EXE
PID:2128 -
\??\c:\dbrfnvn.exec:\dbrfnvn.exe65⤵
- Executes dropped EXE
PID:1844 -
\??\c:\ptjjvld.exec:\ptjjvld.exe66⤵PID:2412
-
\??\c:\rfldp.exec:\rfldp.exe67⤵PID:2584
-
\??\c:\bndbrj.exec:\bndbrj.exe68⤵PID:2524
-
\??\c:\bhftnrv.exec:\bhftnrv.exe69⤵PID:1232
-
\??\c:\npdvh.exec:\npdvh.exe70⤵PID:1164
-
\??\c:\rdrnhp.exec:\rdrnhp.exe71⤵PID:2252
-
\??\c:\hvtdt.exec:\hvtdt.exe72⤵PID:2472
-
\??\c:\rfptrp.exec:\rfptrp.exe73⤵PID:2476
-
\??\c:\nfjtdbr.exec:\nfjtdbr.exe74⤵PID:1484
-
\??\c:\dndhhvb.exec:\dndhhvb.exe75⤵PID:2656
-
\??\c:\xbhjd.exec:\xbhjd.exe76⤵PID:1032
-
\??\c:\dfnhhlr.exec:\dfnhhlr.exe77⤵PID:1528
-
\??\c:\hfpvx.exec:\hfpvx.exe78⤵PID:2096
-
\??\c:\bjvhnfn.exec:\bjvhnfn.exe79⤵PID:2396
-
\??\c:\hjtfvrn.exec:\hjtfvrn.exe80⤵PID:3008
-
\??\c:\dhjxfvb.exec:\dhjxfvb.exe81⤵PID:2068
-
\??\c:\vrnljrr.exec:\vrnljrr.exe82⤵PID:2616
-
\??\c:\nptvxff.exec:\nptvxff.exe83⤵PID:2996
-
\??\c:\tvndl.exec:\tvndl.exe84⤵
- System Location Discovery: System Language Discovery
PID:1236 -
\??\c:\jptvtp.exec:\jptvtp.exe85⤵PID:3004
-
\??\c:\ljbplbn.exec:\ljbplbn.exe86⤵PID:2956
-
\??\c:\rlrxt.exec:\rlrxt.exe87⤵PID:2736
-
\??\c:\rbvdx.exec:\rbvdx.exe88⤵PID:2772
-
\??\c:\rtpxrn.exec:\rtpxrn.exe89⤵PID:2756
-
\??\c:\rdbvd.exec:\rdbvd.exe90⤵
- System Location Discovery: System Language Discovery
PID:1344 -
\??\c:\ffxtn.exec:\ffxtn.exe91⤵PID:2388
-
\??\c:\vtpjd.exec:\vtpjd.exe92⤵PID:1740
-
\??\c:\rxhhn.exec:\rxhhn.exe93⤵PID:2712
-
\??\c:\vptbxx.exec:\vptbxx.exe94⤵PID:1316
-
\??\c:\lpfftvr.exec:\lpfftvr.exe95⤵PID:3060
-
\??\c:\nffnt.exec:\nffnt.exe96⤵PID:296
-
\??\c:\vxhfjp.exec:\vxhfjp.exe97⤵PID:2072
-
\??\c:\lhrjnhj.exec:\lhrjnhj.exe98⤵PID:1576
-
\??\c:\fjppr.exec:\fjppr.exe99⤵PID:1948
-
\??\c:\bljbhl.exec:\bljbhl.exe100⤵PID:1688
-
\??\c:\vlvrdv.exec:\vlvrdv.exe101⤵PID:2148
-
\??\c:\frtxlp.exec:\frtxlp.exe102⤵PID:640
-
\??\c:\rbldn.exec:\rbldn.exe103⤵PID:2144
-
\??\c:\lrjpftv.exec:\lrjpftv.exe104⤵PID:2172
-
\??\c:\vdfvv.exec:\vdfvv.exe105⤵PID:904
-
\??\c:\pfhxjx.exec:\pfhxjx.exe106⤵PID:2492
-
\??\c:\ntldl.exec:\ntldl.exe107⤵PID:1564
-
\??\c:\tjdfnlx.exec:\tjdfnlx.exe108⤵PID:2280
-
\??\c:\nxrjrxn.exec:\nxrjrxn.exe109⤵PID:2128
-
\??\c:\rtdflh.exec:\rtdflh.exe110⤵PID:2432
-
\??\c:\lvffp.exec:\lvffp.exe111⤵PID:2412
-
\??\c:\vhnxtt.exec:\vhnxtt.exe112⤵PID:2584
-
\??\c:\rtrfn.exec:\rtrfn.exe113⤵PID:1004
-
\??\c:\nnjdnbp.exec:\nnjdnbp.exe114⤵PID:1904
-
\??\c:\fxtnhnp.exec:\fxtnhnp.exe115⤵PID:1548
-
\??\c:\fhpvnrn.exec:\fhpvnrn.exe116⤵PID:1608
-
\??\c:\lrrfpvv.exec:\lrrfpvv.exe117⤵
- System Location Discovery: System Language Discovery
PID:2464 -
\??\c:\nrbvfr.exec:\nrbvfr.exe118⤵PID:1028
-
\??\c:\dnpvbt.exec:\dnpvbt.exe119⤵PID:1860
-
\??\c:\dpvxnf.exec:\dpvxnf.exe120⤵PID:2644
-
\??\c:\hpvtxb.exec:\hpvtxb.exe121⤵PID:1524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-