Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
11-01-2025 06:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6d06474d2f164f14ce276d780052024a3c3273703338ab82c075d040a7089905N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
6d06474d2f164f14ce276d780052024a3c3273703338ab82c075d040a7089905N.exe
-
Size
455KB
-
MD5
35807a47b499a8de05d3dd26a04e0020
-
SHA1
c2baaaad0e16bf8fbb5754bc07d38f3d7c2c9735
-
SHA256
6d06474d2f164f14ce276d780052024a3c3273703338ab82c075d040a7089905
-
SHA512
16c3d53a8ff3ab07f57c0479e27795cb3bdf2932b04b91dd6d6b9692bd6ea28af6d06a9ceb4fdb44e4fbba862c244e800dff2cd8904257e822f1dfbbdff809ee
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeP8:q7Tc2NYHUrAwfMp3CDP8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2432-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/432-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-276-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1676-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-292-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1724-302-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2344-306-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2420-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-453-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2320-454-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2464-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-474-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2160-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-502-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2204-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1428-528-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1428-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-522-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1664-539-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1664-559-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2860-598-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1360-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-841-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2276 ldhfjrn.exe 3008 jdjhfj.exe 2072 ltxdll.exe 2896 jnlpjjv.exe 2772 tfvln.exe 2780 thfvbvj.exe 2768 hfrhrfj.exe 3048 nlhvvxh.exe 432 jnrbbx.exe 1748 btvnx.exe 2532 flptfbx.exe 2920 rxlxt.exe 3056 pljflf.exe 2416 bbnbxl.exe 2908 ttxtnj.exe 1636 bldfpvf.exe 1920 xrbfnjf.exe 2140 dfbvb.exe 2108 jbbtr.exe 904 tdrlxdn.exe 900 vxxpd.exe 580 pvxvrbt.exe 944 vjlhhf.exe 1872 phhrx.exe 1428 hrbft.exe 1712 jrrhf.exe 552 fvtbbx.exe 1660 njtfh.exe 1288 bthbb.exe 1676 lnlhllr.exe 1992 tthvh.exe 1968 bfvbvpt.exe 1724 fdlxf.exe 2344 ttnvfnd.exe 2992 xnvftn.exe 2420 lvrrdf.exe 3028 tpptbbx.exe 2912 ppfjvxr.exe 3000 hrtnxnd.exe 2720 lxttvr.exe 3016 tvvjvln.exe 2600 jpnbrf.exe 2632 jvtfr.exe 1576 jvvfrvj.exe 1396 jrvllxv.exe 2500 hnvrf.exe 752 bbnvvv.exe 2776 htvtlv.exe 3060 jdbdp.exe 2920 pvlhhv.exe 2892 bfdffv.exe 2320 xpbljh.exe 2676 jrbnp.exe 2908 bbtdn.exe 1084 vnnfl.exe 1920 pbvpd.exe 2464 nvfvlv.exe 2060 ddhvp.exe 2160 bxnnrrr.exe 2332 tpvxpjt.exe 2456 hrtrpl.exe 1620 ldrxbln.exe 604 xfxxxb.exe 2204 brfvp.exe -
resource yara_rule behavioral1/memory/2276-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/432-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-454-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2464-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-509-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1428-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-522-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2860-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-708-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-728-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2472-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-841-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-854-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-879-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-918-0x00000000001B0000-0x00000000001DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvrnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxvdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljdll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thrbrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dllvjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btjnprr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xftrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfvbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnjvtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfndnhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlpth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjlhhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntfnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbpnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnfvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlxvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjlpxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrrdpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjhphl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvlrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxtvbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xltjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbrjhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbrpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndrbhfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trffj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjrhdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvxhfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxvbbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptfnlbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvllb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlffnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhlft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtfjxhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxnjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nndbrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvhbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbffn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2432 wrote to memory of 2276 2432 6d06474d2f164f14ce276d780052024a3c3273703338ab82c075d040a7089905N.exe 29 PID 2432 wrote to memory of 2276 2432 6d06474d2f164f14ce276d780052024a3c3273703338ab82c075d040a7089905N.exe 29 PID 2432 wrote to memory of 2276 2432 6d06474d2f164f14ce276d780052024a3c3273703338ab82c075d040a7089905N.exe 29 PID 2432 wrote to memory of 2276 2432 6d06474d2f164f14ce276d780052024a3c3273703338ab82c075d040a7089905N.exe 29 PID 2276 wrote to memory of 3008 2276 ldhfjrn.exe 30 PID 2276 wrote to memory of 3008 2276 ldhfjrn.exe 30 PID 2276 wrote to memory of 3008 2276 ldhfjrn.exe 30 PID 2276 wrote to memory of 3008 2276 ldhfjrn.exe 30 PID 3008 wrote to memory of 2072 3008 jdjhfj.exe 31 PID 3008 wrote to memory of 2072 3008 jdjhfj.exe 31 PID 3008 wrote to memory of 2072 3008 jdjhfj.exe 31 PID 3008 wrote to memory of 2072 3008 jdjhfj.exe 31 PID 2072 wrote to memory of 2896 2072 ltxdll.exe 32 PID 2072 wrote to memory of 2896 2072 ltxdll.exe 32 PID 2072 wrote to memory of 2896 2072 ltxdll.exe 32 PID 2072 wrote to memory of 2896 2072 ltxdll.exe 32 PID 2896 wrote to memory of 2772 2896 jnlpjjv.exe 33 PID 2896 wrote to memory of 2772 2896 jnlpjjv.exe 33 PID 2896 wrote to memory of 2772 2896 jnlpjjv.exe 33 PID 2896 wrote to memory of 2772 2896 jnlpjjv.exe 33 PID 2772 wrote to memory of 2780 2772 tfvln.exe 34 PID 2772 wrote to memory of 2780 2772 tfvln.exe 34 PID 2772 wrote to memory of 2780 2772 tfvln.exe 34 PID 2772 wrote to memory of 2780 2772 tfvln.exe 34 PID 2780 wrote to memory of 2768 2780 thfvbvj.exe 35 PID 2780 wrote to memory of 2768 2780 thfvbvj.exe 35 PID 2780 wrote to memory of 2768 2780 thfvbvj.exe 35 PID 2780 wrote to memory of 2768 2780 thfvbvj.exe 35 PID 2768 wrote to memory of 3048 2768 hfrhrfj.exe 36 PID 2768 wrote to memory of 3048 2768 hfrhrfj.exe 36 PID 2768 wrote to memory of 3048 2768 hfrhrfj.exe 36 PID 2768 wrote to memory of 3048 2768 hfrhrfj.exe 36 PID 3048 wrote to memory of 432 3048 nlhvvxh.exe 37 PID 3048 wrote to memory of 432 3048 nlhvvxh.exe 37 PID 3048 wrote to memory of 432 3048 nlhvvxh.exe 37 PID 3048 wrote to memory of 432 3048 nlhvvxh.exe 37 PID 432 wrote to memory of 1748 432 jnrbbx.exe 38 PID 432 wrote to memory of 1748 432 jnrbbx.exe 38 PID 432 wrote to memory of 1748 432 jnrbbx.exe 38 PID 432 wrote to memory of 1748 432 jnrbbx.exe 38 PID 1748 wrote to memory of 2532 1748 btvnx.exe 39 PID 1748 wrote to memory of 2532 1748 btvnx.exe 39 PID 1748 wrote to memory of 2532 1748 btvnx.exe 39 PID 1748 wrote to memory of 2532 1748 btvnx.exe 39 PID 2532 wrote to memory of 2920 2532 flptfbx.exe 40 PID 2532 wrote to memory of 2920 2532 flptfbx.exe 40 PID 2532 wrote to memory of 2920 2532 flptfbx.exe 40 PID 2532 wrote to memory of 2920 2532 flptfbx.exe 40 PID 2920 wrote to memory of 3056 2920 rxlxt.exe 41 PID 2920 wrote to memory of 3056 2920 rxlxt.exe 41 PID 2920 wrote to memory of 3056 2920 rxlxt.exe 41 PID 2920 wrote to memory of 3056 2920 rxlxt.exe 41 PID 3056 wrote to memory of 2416 3056 pljflf.exe 42 PID 3056 wrote to memory of 2416 3056 pljflf.exe 42 PID 3056 wrote to memory of 2416 3056 pljflf.exe 42 PID 3056 wrote to memory of 2416 3056 pljflf.exe 42 PID 2416 wrote to memory of 2908 2416 bbnbxl.exe 43 PID 2416 wrote to memory of 2908 2416 bbnbxl.exe 43 PID 2416 wrote to memory of 2908 2416 bbnbxl.exe 43 PID 2416 wrote to memory of 2908 2416 bbnbxl.exe 43 PID 2908 wrote to memory of 1636 2908 ttxtnj.exe 44 PID 2908 wrote to memory of 1636 2908 ttxtnj.exe 44 PID 2908 wrote to memory of 1636 2908 ttxtnj.exe 44 PID 2908 wrote to memory of 1636 2908 ttxtnj.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d06474d2f164f14ce276d780052024a3c3273703338ab82c075d040a7089905N.exe"C:\Users\Admin\AppData\Local\Temp\6d06474d2f164f14ce276d780052024a3c3273703338ab82c075d040a7089905N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\ldhfjrn.exec:\ldhfjrn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\jdjhfj.exec:\jdjhfj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\ltxdll.exec:\ltxdll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\jnlpjjv.exec:\jnlpjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\tfvln.exec:\tfvln.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\thfvbvj.exec:\thfvbvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\hfrhrfj.exec:\hfrhrfj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\nlhvvxh.exec:\nlhvvxh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\jnrbbx.exec:\jnrbbx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\btvnx.exec:\btvnx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\flptfbx.exec:\flptfbx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\rxlxt.exec:\rxlxt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\pljflf.exec:\pljflf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\bbnbxl.exec:\bbnbxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\ttxtnj.exec:\ttxtnj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\bldfpvf.exec:\bldfpvf.exe17⤵
- Executes dropped EXE
PID:1636 -
\??\c:\xrbfnjf.exec:\xrbfnjf.exe18⤵
- Executes dropped EXE
PID:1920 -
\??\c:\dfbvb.exec:\dfbvb.exe19⤵
- Executes dropped EXE
PID:2140 -
\??\c:\jbbtr.exec:\jbbtr.exe20⤵
- Executes dropped EXE
PID:2108 -
\??\c:\tdrlxdn.exec:\tdrlxdn.exe21⤵
- Executes dropped EXE
PID:904 -
\??\c:\vxxpd.exec:\vxxpd.exe22⤵
- Executes dropped EXE
PID:900 -
\??\c:\pvxvrbt.exec:\pvxvrbt.exe23⤵
- Executes dropped EXE
PID:580 -
\??\c:\vjlhhf.exec:\vjlhhf.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:944 -
\??\c:\phhrx.exec:\phhrx.exe25⤵
- Executes dropped EXE
PID:1872 -
\??\c:\hrbft.exec:\hrbft.exe26⤵
- Executes dropped EXE
PID:1428 -
\??\c:\jrrhf.exec:\jrrhf.exe27⤵
- Executes dropped EXE
PID:1712 -
\??\c:\fvtbbx.exec:\fvtbbx.exe28⤵
- Executes dropped EXE
PID:552 -
\??\c:\njtfh.exec:\njtfh.exe29⤵
- Executes dropped EXE
PID:1660 -
\??\c:\bthbb.exec:\bthbb.exe30⤵
- Executes dropped EXE
PID:1288 -
\??\c:\lnlhllr.exec:\lnlhllr.exe31⤵
- Executes dropped EXE
PID:1676 -
\??\c:\tthvh.exec:\tthvh.exe32⤵
- Executes dropped EXE
PID:1992 -
\??\c:\bfvbvpt.exec:\bfvbvpt.exe33⤵
- Executes dropped EXE
PID:1968 -
\??\c:\fdlxf.exec:\fdlxf.exe34⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ttnvfnd.exec:\ttnvfnd.exe35⤵
- Executes dropped EXE
PID:2344 -
\??\c:\phjxb.exec:\phjxb.exe36⤵PID:2096
-
\??\c:\xnvftn.exec:\xnvftn.exe37⤵
- Executes dropped EXE
PID:2992 -
\??\c:\lvrrdf.exec:\lvrrdf.exe38⤵
- Executes dropped EXE
PID:2420 -
\??\c:\tpptbbx.exec:\tpptbbx.exe39⤵
- Executes dropped EXE
PID:3028 -
\??\c:\ppfjvxr.exec:\ppfjvxr.exe40⤵
- Executes dropped EXE
PID:2912 -
\??\c:\hrtnxnd.exec:\hrtnxnd.exe41⤵
- Executes dropped EXE
PID:3000 -
\??\c:\lxttvr.exec:\lxttvr.exe42⤵
- Executes dropped EXE
PID:2720 -
\??\c:\tvvjvln.exec:\tvvjvln.exe43⤵
- Executes dropped EXE
PID:3016 -
\??\c:\jpnbrf.exec:\jpnbrf.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\jvtfr.exec:\jvtfr.exe45⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jvvfrvj.exec:\jvvfrvj.exe46⤵
- Executes dropped EXE
PID:1576 -
\??\c:\jrvllxv.exec:\jrvllxv.exe47⤵
- Executes dropped EXE
PID:1396 -
\??\c:\hnvrf.exec:\hnvrf.exe48⤵
- Executes dropped EXE
PID:2500 -
\??\c:\bbnvvv.exec:\bbnvvv.exe49⤵
- Executes dropped EXE
PID:752 -
\??\c:\htvtlv.exec:\htvtlv.exe50⤵
- Executes dropped EXE
PID:2776 -
\??\c:\jdbdp.exec:\jdbdp.exe51⤵
- Executes dropped EXE
PID:3060 -
\??\c:\pvlhhv.exec:\pvlhhv.exe52⤵
- Executes dropped EXE
PID:2920 -
\??\c:\bfdffv.exec:\bfdffv.exe53⤵
- Executes dropped EXE
PID:2892 -
\??\c:\xpbljh.exec:\xpbljh.exe54⤵
- Executes dropped EXE
PID:2320 -
\??\c:\jrbnp.exec:\jrbnp.exe55⤵
- Executes dropped EXE
PID:2676 -
\??\c:\bbtdn.exec:\bbtdn.exe56⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vnnfl.exec:\vnnfl.exe57⤵
- Executes dropped EXE
PID:1084 -
\??\c:\pbvpd.exec:\pbvpd.exe58⤵
- Executes dropped EXE
PID:1920 -
\??\c:\nvfvlv.exec:\nvfvlv.exe59⤵
- Executes dropped EXE
PID:2464 -
\??\c:\ddhvp.exec:\ddhvp.exe60⤵
- Executes dropped EXE
PID:2060 -
\??\c:\bxnnrrr.exec:\bxnnrrr.exe61⤵
- Executes dropped EXE
PID:2160 -
\??\c:\tpvxpjt.exec:\tpvxpjt.exe62⤵
- Executes dropped EXE
PID:2332 -
\??\c:\hrtrpl.exec:\hrtrpl.exe63⤵
- Executes dropped EXE
PID:2456 -
\??\c:\ldrxbln.exec:\ldrxbln.exe64⤵
- Executes dropped EXE
PID:1620 -
\??\c:\xfxxxb.exec:\xfxxxb.exe65⤵
- Executes dropped EXE
PID:604 -
\??\c:\brfvp.exec:\brfvp.exe66⤵
- Executes dropped EXE
PID:2204 -
\??\c:\rrhvffd.exec:\rrhvffd.exe67⤵PID:1480
-
\??\c:\bfvjhrb.exec:\bfvjhrb.exe68⤵PID:1428
-
\??\c:\bxlhlvd.exec:\bxlhlvd.exe69⤵PID:1664
-
\??\c:\xhnxv.exec:\xhnxv.exe70⤵PID:1008
-
\??\c:\thljvfx.exec:\thljvfx.exe71⤵PID:1848
-
\??\c:\vddtf.exec:\vddtf.exe72⤵PID:2648
-
\??\c:\vntnvx.exec:\vntnvx.exe73⤵PID:2388
-
\??\c:\dbvfxv.exec:\dbvfxv.exe74⤵PID:2796
-
\??\c:\ljrhxdl.exec:\ljrhxdl.exe75⤵PID:2152
-
\??\c:\xlxtvbb.exec:\xlxtvbb.exe76⤵
- System Location Discovery: System Language Discovery
PID:1800 -
\??\c:\tjdtvbv.exec:\tjdtvbv.exe77⤵PID:864
-
\??\c:\flvflxl.exec:\flvflxl.exe78⤵PID:2860
-
\??\c:\tjplllr.exec:\tjplllr.exe79⤵PID:2096
-
\??\c:\tjdlh.exec:\tjdlh.exe80⤵PID:2868
-
\??\c:\bfnrtbn.exec:\bfnrtbn.exe81⤵PID:2136
-
\??\c:\ffbxdr.exec:\ffbxdr.exe82⤵PID:2844
-
\??\c:\xrlfpl.exec:\xrlfpl.exe83⤵PID:2620
-
\??\c:\fxdlr.exec:\fxdlr.exe84⤵PID:2912
-
\??\c:\bbnvtr.exec:\bbnvtr.exe85⤵PID:2748
-
\??\c:\jtprdfl.exec:\jtprdfl.exe86⤵PID:2572
-
\??\c:\jhfbt.exec:\jhfbt.exe87⤵PID:2576
-
\??\c:\nvhtfr.exec:\nvhtfr.exe88⤵PID:2268
-
\??\c:\xjjnbb.exec:\xjjnbb.exe89⤵PID:2088
-
\??\c:\vplxtd.exec:\vplxtd.exe90⤵PID:1576
-
\??\c:\bjnnb.exec:\bjnnb.exe91⤵PID:1396
-
\??\c:\hxvdj.exec:\hxvdj.exe92⤵PID:2500
-
\??\c:\tfnphnj.exec:\tfnphnj.exe93⤵PID:2784
-
\??\c:\hrftlxp.exec:\hrftlxp.exe94⤵PID:2964
-
\??\c:\tvxhjtv.exec:\tvxhjtv.exe95⤵PID:2176
-
\??\c:\vvvpn.exec:\vvvpn.exe96⤵PID:2292
-
\??\c:\bbnfnth.exec:\bbnfnth.exe97⤵PID:1360
-
\??\c:\fnvlfl.exec:\fnvlfl.exe98⤵PID:1788
-
\??\c:\tvrtx.exec:\tvrtx.exe99⤵PID:836
-
\??\c:\dljnvpv.exec:\dljnvpv.exe100⤵PID:1028
-
\??\c:\frthlh.exec:\frthlh.exe101⤵PID:1084
-
\??\c:\xdtndv.exec:\xdtndv.exe102⤵PID:2472
-
\??\c:\rldnxn.exec:\rldnxn.exe103⤵PID:2464
-
\??\c:\jtlttd.exec:\jtlttd.exe104⤵PID:2668
-
\??\c:\rjhxxxh.exec:\rjhxxxh.exe105⤵PID:1584
-
\??\c:\jlppxv.exec:\jlppxv.exe106⤵PID:900
-
\??\c:\nrrvhnv.exec:\nrrvhnv.exe107⤵PID:808
-
\??\c:\fvvdvl.exec:\fvvdvl.exe108⤵PID:1620
-
\??\c:\brfdf.exec:\brfdf.exe109⤵PID:604
-
\??\c:\vnntn.exec:\vnntn.exe110⤵PID:1872
-
\??\c:\trffj.exec:\trffj.exe111⤵
- System Location Discovery: System Language Discovery
PID:1480 -
\??\c:\vrhdrvd.exec:\vrhdrvd.exe112⤵PID:2800
-
\??\c:\jdrtx.exec:\jdrtx.exe113⤵PID:1652
-
\??\c:\jrxhjll.exec:\jrxhjll.exe114⤵PID:1796
-
\??\c:\bpfjnr.exec:\bpfjnr.exe115⤵PID:916
-
\??\c:\rvrrt.exec:\rvrrt.exe116⤵PID:2340
-
\??\c:\btlrxfj.exec:\btlrxfj.exe117⤵PID:1676
-
\??\c:\hbnfph.exec:\hbnfph.exe118⤵PID:2652
-
\??\c:\dpbntvh.exec:\dpbntvh.exe119⤵PID:520
-
\??\c:\xrfddj.exec:\xrfddj.exe120⤵PID:1012
-
\??\c:\ptvxbj.exec:\ptvxbj.exe121⤵PID:1724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-