Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
17-01-2025 02:08
Behavioral task
behavioral1
Sample
1671111d584ac310c1bc0426a0bfbe8d81a5b920983e6884b17c4351afc06b93N.exe
Resource
win7-20241010-en
windows7-x64
9 signatures
120 seconds
General
-
Target
1671111d584ac310c1bc0426a0bfbe8d81a5b920983e6884b17c4351afc06b93N.exe
-
Size
3.7MB
-
MD5
c46229b4ead71b5d5197560ec8a98a90
-
SHA1
3df3de24c2ebc74847ab5ea14e122978b0f7c364
-
SHA256
1671111d584ac310c1bc0426a0bfbe8d81a5b920983e6884b17c4351afc06b93
-
SHA512
029027421d5aaf403675218f8d5d41162520d2df327718cda16175aac32bff3c2dcef424de539d882dcda021c7c500e00a73c31e6f3e38ef62f6268867671104
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98B:U6XLq/qPPslzKx/dJg1ErmNI
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2060-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2384-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1144-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-121-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1636-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-162-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2280-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1908-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1064-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/108-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/964-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1324-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1768-271-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2160-283-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2584-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-345-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2900-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1032-412-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2024-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-487-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1616-513-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/908-517-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1912-542-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2012-671-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/968-785-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/296-798-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/948-846-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1880-960-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 2384 nlltx.exe 3044 ffrvtlr.exe 2196 lppjfb.exe 2768 nlbrtx.exe 2880 ptrjdtv.exe 2804 pdnrn.exe 2952 pbdlrh.exe 2948 ljdjlv.exe 2732 hfxhfbj.exe 2316 dtbvbjj.exe 1144 txbffvr.exe 2644 hfjfx.exe 1188 bhllr.exe 2576 hnjxjr.exe 1636 lbhpdd.exe 2016 hvptt.exe 2960 dbfbf.exe 2280 prrfdt.exe 1908 lhllnt.exe 880 pxtbhbx.exe 108 xxvxjd.exe 1064 hvnjjp.exe 1324 pvnnf.exe 964 xrnrbvr.exe 1192 xptvttn.exe 1088 jvxhrt.exe 2072 tfhjhvb.exe 1768 rlhhnn.exe 2160 tpxpv.exe 896 fjlhdvx.exe 1576 fppjxhx.exe 2616 lnxvbf.exe 2584 rtbhpn.exe 2104 fhjhdvt.exe 2864 jnhrb.exe 2488 vxrvr.exe 2900 jbjhj.exe 2824 njbnvr.exe 2796 ptrfldv.exe 3052 vpvxdx.exe 1528 pbjnt.exe 3000 bfbppp.exe 2720 dvbnd.exe 2656 ffdpvdb.exe 2664 rxxthlr.exe 1144 vtljtf.exe 1032 ptlffxv.exe 2744 lnrfhx.exe 1208 lnlhrd.exe 2024 dnflxff.exe 2368 ttxbhlv.exe 2776 jnvld.exe 2004 xlnvhfl.exe 2428 fpbnrv.exe 2276 lhjnj.exe 112 ffxnl.exe 2424 xhbfpnr.exe 880 trrbldt.exe 2484 dxvdb.exe 1164 bnlrxp.exe 3032 rbdxdb.exe 1828 djvdbhh.exe 1616 ftbhp.exe 908 xdlfnj.exe -
resource yara_rule behavioral1/memory/2060-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000e000000012267-5.dat upx behavioral1/memory/2060-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2384-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000016d64-18.dat upx behavioral1/memory/3044-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d3f-28.dat upx behavioral1/files/0x0008000000016d69-38.dat upx behavioral1/memory/2196-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2880-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016fc9-49.dat upx behavioral1/files/0x0007000000016fe5-58.dat upx behavioral1/files/0x00070000000170f8-68.dat upx behavioral1/memory/2804-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001756e-77.dat upx behavioral1/memory/2952-76-0x00000000003B0000-0x00000000003D7000-memory.dmp upx behavioral1/files/0x00050000000195b3-86.dat upx behavioral1/memory/2948-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b5-94.dat upx behavioral1/memory/2316-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2732-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1144-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195bb-106.dat upx behavioral1/memory/1144-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195bd-117.dat upx behavioral1/memory/2644-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c1-127.dat upx behavioral1/files/0x00050000000195c3-137.dat upx behavioral1/files/0x00050000000195c5-145.dat upx behavioral1/memory/1636-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c6-153.dat upx behavioral1/memory/2016-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c7-163.dat upx behavioral1/files/0x000500000001960c-172.dat upx behavioral1/files/0x0005000000019643-181.dat upx behavioral1/memory/2280-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1908-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001975a-192.dat upx behavioral1/files/0x0005000000019761-200.dat upx behavioral1/memory/1064-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/108-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000197fd-210.dat upx behavioral1/files/0x0005000000019820-221.dat upx behavioral1/files/0x000500000001998d-230.dat upx behavioral1/memory/964-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1324-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf5-240.dat upx behavioral1/files/0x0005000000019bf6-249.dat upx behavioral1/memory/1088-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf9-259.dat upx behavioral1/files/0x0005000000019c3c-267.dat upx behavioral1/files/0x0005000000019d61-277.dat upx behavioral1/files/0x0005000000019d62-287.dat upx behavioral1/files/0x0005000000019d6d-295.dat upx behavioral1/files/0x0005000000019e92-301.dat upx behavioral1/memory/2584-317-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-330-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2488-331-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-338-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-346-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2796-359-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3000-373-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2744-415-0x00000000003A0000-0x00000000003C7000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrjnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxrbphd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnvhdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtbthrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllvbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xndrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnjbbvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjfhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjdjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vphnhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbjbdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drfjhfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lldxrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fljfxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvhvfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvxlft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbdxdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jndjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnhrrbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthtrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fttvjpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trjxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnbpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htfrbbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlvff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvbthp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fptrvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxflp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdlfnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtbhpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvnpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxrjdfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvbvtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfbdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljdjlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpnfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jftvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptnthd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxdrhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfnpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxnddxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfjnjbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptlffxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfnxbrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvnjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhjnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjvpfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbrvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjnjnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbxbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfjfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrbnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvxpttj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fptvxxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhxljxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpbvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjhjrfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvjxj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2384 2060 1671111d584ac310c1bc0426a0bfbe8d81a5b920983e6884b17c4351afc06b93N.exe 30 PID 2060 wrote to memory of 2384 2060 1671111d584ac310c1bc0426a0bfbe8d81a5b920983e6884b17c4351afc06b93N.exe 30 PID 2060 wrote to memory of 2384 2060 1671111d584ac310c1bc0426a0bfbe8d81a5b920983e6884b17c4351afc06b93N.exe 30 PID 2060 wrote to memory of 2384 2060 1671111d584ac310c1bc0426a0bfbe8d81a5b920983e6884b17c4351afc06b93N.exe 30 PID 2384 wrote to memory of 3044 2384 nlltx.exe 31 PID 2384 wrote to memory of 3044 2384 nlltx.exe 31 PID 2384 wrote to memory of 3044 2384 nlltx.exe 31 PID 2384 wrote to memory of 3044 2384 nlltx.exe 31 PID 3044 wrote to memory of 2196 3044 ffrvtlr.exe 32 PID 3044 wrote to memory of 2196 3044 ffrvtlr.exe 32 PID 3044 wrote to memory of 2196 3044 ffrvtlr.exe 32 PID 3044 wrote to memory of 2196 3044 ffrvtlr.exe 32 PID 2196 wrote to memory of 2768 2196 lppjfb.exe 33 PID 2196 wrote to memory of 2768 2196 lppjfb.exe 33 PID 2196 wrote to memory of 2768 2196 lppjfb.exe 33 PID 2196 wrote to memory of 2768 2196 lppjfb.exe 33 PID 2768 wrote to memory of 2880 2768 nlbrtx.exe 34 PID 2768 wrote to memory of 2880 2768 nlbrtx.exe 34 PID 2768 wrote to memory of 2880 2768 nlbrtx.exe 34 PID 2768 wrote to memory of 2880 2768 nlbrtx.exe 34 PID 2880 wrote to memory of 2804 2880 ptrjdtv.exe 35 PID 2880 wrote to memory of 2804 2880 ptrjdtv.exe 35 PID 2880 wrote to memory of 2804 2880 ptrjdtv.exe 35 PID 2880 wrote to memory of 2804 2880 ptrjdtv.exe 35 PID 2804 wrote to memory of 2952 2804 pdnrn.exe 36 PID 2804 wrote to memory of 2952 2804 pdnrn.exe 36 PID 2804 wrote to memory of 2952 2804 pdnrn.exe 36 PID 2804 wrote to memory of 2952 2804 pdnrn.exe 36 PID 2952 wrote to memory of 2948 2952 pbdlrh.exe 37 PID 2952 wrote to memory of 2948 2952 pbdlrh.exe 37 PID 2952 wrote to memory of 2948 2952 pbdlrh.exe 37 PID 2952 wrote to memory of 2948 2952 pbdlrh.exe 37 PID 2948 wrote to memory of 2732 2948 ljdjlv.exe 39 PID 2948 wrote to memory of 2732 2948 ljdjlv.exe 39 PID 2948 wrote to memory of 2732 2948 ljdjlv.exe 39 PID 2948 wrote to memory of 2732 2948 ljdjlv.exe 39 PID 2732 wrote to memory of 2316 2732 hfxhfbj.exe 40 PID 2732 wrote to memory of 2316 2732 hfxhfbj.exe 40 PID 2732 wrote to memory of 2316 2732 hfxhfbj.exe 40 PID 2732 wrote to memory of 2316 2732 hfxhfbj.exe 40 PID 2316 wrote to memory of 1144 2316 dtbvbjj.exe 41 PID 2316 wrote to memory of 1144 2316 dtbvbjj.exe 41 PID 2316 wrote to memory of 1144 2316 dtbvbjj.exe 41 PID 2316 wrote to memory of 1144 2316 dtbvbjj.exe 41 PID 1144 wrote to memory of 2644 1144 txbffvr.exe 42 PID 1144 wrote to memory of 2644 1144 txbffvr.exe 42 PID 1144 wrote to memory of 2644 1144 txbffvr.exe 42 PID 1144 wrote to memory of 2644 1144 txbffvr.exe 42 PID 2644 wrote to memory of 1188 2644 hfjfx.exe 43 PID 2644 wrote to memory of 1188 2644 hfjfx.exe 43 PID 2644 wrote to memory of 1188 2644 hfjfx.exe 43 PID 2644 wrote to memory of 1188 2644 hfjfx.exe 43 PID 1188 wrote to memory of 2576 1188 bhllr.exe 44 PID 1188 wrote to memory of 2576 1188 bhllr.exe 44 PID 1188 wrote to memory of 2576 1188 bhllr.exe 44 PID 1188 wrote to memory of 2576 1188 bhllr.exe 44 PID 2576 wrote to memory of 1636 2576 hnjxjr.exe 45 PID 2576 wrote to memory of 1636 2576 hnjxjr.exe 45 PID 2576 wrote to memory of 1636 2576 hnjxjr.exe 45 PID 2576 wrote to memory of 1636 2576 hnjxjr.exe 45 PID 1636 wrote to memory of 2016 1636 lbhpdd.exe 46 PID 1636 wrote to memory of 2016 1636 lbhpdd.exe 46 PID 1636 wrote to memory of 2016 1636 lbhpdd.exe 46 PID 1636 wrote to memory of 2016 1636 lbhpdd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\1671111d584ac310c1bc0426a0bfbe8d81a5b920983e6884b17c4351afc06b93N.exe"C:\Users\Admin\AppData\Local\Temp\1671111d584ac310c1bc0426a0bfbe8d81a5b920983e6884b17c4351afc06b93N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\nlltx.exec:\nlltx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\ffrvtlr.exec:\ffrvtlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\lppjfb.exec:\lppjfb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\nlbrtx.exec:\nlbrtx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\ptrjdtv.exec:\ptrjdtv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\pdnrn.exec:\pdnrn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\pbdlrh.exec:\pbdlrh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\ljdjlv.exec:\ljdjlv.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\hfxhfbj.exec:\hfxhfbj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\dtbvbjj.exec:\dtbvbjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\txbffvr.exec:\txbffvr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\hfjfx.exec:\hfjfx.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\bhllr.exec:\bhllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\hnjxjr.exec:\hnjxjr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\lbhpdd.exec:\lbhpdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\hvptt.exec:\hvptt.exe17⤵
- Executes dropped EXE
PID:2016 -
\??\c:\dbfbf.exec:\dbfbf.exe18⤵
- Executes dropped EXE
PID:2960 -
\??\c:\prrfdt.exec:\prrfdt.exe19⤵
- Executes dropped EXE
PID:2280 -
\??\c:\lhllnt.exec:\lhllnt.exe20⤵
- Executes dropped EXE
PID:1908 -
\??\c:\pxtbhbx.exec:\pxtbhbx.exe21⤵
- Executes dropped EXE
PID:880 -
\??\c:\xxvxjd.exec:\xxvxjd.exe22⤵
- Executes dropped EXE
PID:108 -
\??\c:\hvnjjp.exec:\hvnjjp.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1064 -
\??\c:\pvnnf.exec:\pvnnf.exe24⤵
- Executes dropped EXE
PID:1324 -
\??\c:\xrnrbvr.exec:\xrnrbvr.exe25⤵
- Executes dropped EXE
PID:964 -
\??\c:\xptvttn.exec:\xptvttn.exe26⤵
- Executes dropped EXE
PID:1192 -
\??\c:\jvxhrt.exec:\jvxhrt.exe27⤵
- Executes dropped EXE
PID:1088 -
\??\c:\tfhjhvb.exec:\tfhjhvb.exe28⤵
- Executes dropped EXE
PID:2072 -
\??\c:\rlhhnn.exec:\rlhhnn.exe29⤵
- Executes dropped EXE
PID:1768 -
\??\c:\tpxpv.exec:\tpxpv.exe30⤵
- Executes dropped EXE
PID:2160 -
\??\c:\fjlhdvx.exec:\fjlhdvx.exe31⤵
- Executes dropped EXE
PID:896 -
\??\c:\fppjxhx.exec:\fppjxhx.exe32⤵
- Executes dropped EXE
PID:1576 -
\??\c:\lnxvbf.exec:\lnxvbf.exe33⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rtbhpn.exec:\rtbhpn.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2584 -
\??\c:\fhjhdvt.exec:\fhjhdvt.exe35⤵
- Executes dropped EXE
PID:2104 -
\??\c:\jnhrb.exec:\jnhrb.exe36⤵
- Executes dropped EXE
PID:2864 -
\??\c:\vxrvr.exec:\vxrvr.exe37⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jbjhj.exec:\jbjhj.exe38⤵
- Executes dropped EXE
PID:2900 -
\??\c:\njbnvr.exec:\njbnvr.exe39⤵
- Executes dropped EXE
PID:2824 -
\??\c:\ptrfldv.exec:\ptrfldv.exe40⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vpvxdx.exec:\vpvxdx.exe41⤵
- Executes dropped EXE
PID:3052 -
\??\c:\pbjnt.exec:\pbjnt.exe42⤵
- Executes dropped EXE
PID:1528 -
\??\c:\bfbppp.exec:\bfbppp.exe43⤵
- Executes dropped EXE
PID:3000 -
\??\c:\dvbnd.exec:\dvbnd.exe44⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ffdpvdb.exec:\ffdpvdb.exe45⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rxxthlr.exec:\rxxthlr.exe46⤵
- Executes dropped EXE
PID:2664 -
\??\c:\vtljtf.exec:\vtljtf.exe47⤵
- Executes dropped EXE
PID:1144 -
\??\c:\ptlffxv.exec:\ptlffxv.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1032 -
\??\c:\lnrfhx.exec:\lnrfhx.exe49⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lnlhrd.exec:\lnlhrd.exe50⤵
- Executes dropped EXE
PID:1208 -
\??\c:\dnflxff.exec:\dnflxff.exe51⤵
- Executes dropped EXE
PID:2024 -
\??\c:\ttxbhlv.exec:\ttxbhlv.exe52⤵
- Executes dropped EXE
PID:2368 -
\??\c:\jnvld.exec:\jnvld.exe53⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xlnvhfl.exec:\xlnvhfl.exe54⤵
- Executes dropped EXE
PID:2004 -
\??\c:\fpbnrv.exec:\fpbnrv.exe55⤵
- Executes dropped EXE
PID:2428 -
\??\c:\lhjnj.exec:\lhjnj.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2276 -
\??\c:\ffxnl.exec:\ffxnl.exe57⤵
- Executes dropped EXE
PID:112 -
\??\c:\xhbfpnr.exec:\xhbfpnr.exe58⤵
- Executes dropped EXE
PID:2424 -
\??\c:\trrbldt.exec:\trrbldt.exe59⤵
- Executes dropped EXE
PID:880 -
\??\c:\dxvdb.exec:\dxvdb.exe60⤵
- Executes dropped EXE
PID:2484 -
\??\c:\bnlrxp.exec:\bnlrxp.exe61⤵
- Executes dropped EXE
PID:1164 -
\??\c:\rbdxdb.exec:\rbdxdb.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3032 -
\??\c:\djvdbhh.exec:\djvdbhh.exe63⤵
- Executes dropped EXE
PID:1828 -
\??\c:\ftbhp.exec:\ftbhp.exe64⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xdlfnj.exec:\xdlfnj.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:908 -
\??\c:\dpldrrr.exec:\dpldrrr.exe66⤵PID:2036
-
\??\c:\bnlfb.exec:\bnlfb.exe67⤵PID:640
-
\??\c:\bhffhp.exec:\bhffhp.exe68⤵PID:1912
-
\??\c:\bjltvb.exec:\bjltvb.exe69⤵PID:2504
-
\??\c:\hdddj.exec:\hdddj.exe70⤵PID:2200
-
\??\c:\txjnlvf.exec:\txjnlvf.exe71⤵PID:1896
-
\??\c:\hrnfff.exec:\hrnfff.exe72⤵PID:2432
-
\??\c:\vrxfp.exec:\vrxfp.exe73⤵PID:2612
-
\??\c:\npfxx.exec:\npfxx.exe74⤵PID:2408
-
\??\c:\tlrbdf.exec:\tlrbdf.exe75⤵PID:2604
-
\??\c:\rdrfxtp.exec:\rdrfxtp.exe76⤵PID:2632
-
\??\c:\lvdptn.exec:\lvdptn.exe77⤵PID:2384
-
\??\c:\vpbvf.exec:\vpbvf.exe78⤵
- System Location Discovery: System Language Discovery
PID:1920 -
\??\c:\bprpn.exec:\bprpn.exe79⤵PID:584
-
\??\c:\tlffvj.exec:\tlffvj.exe80⤵PID:2360
-
\??\c:\vxltnhb.exec:\vxltnhb.exe81⤵PID:2488
-
\??\c:\njrrxf.exec:\njrrxf.exe82⤵PID:2900
-
\??\c:\xvnjnxb.exec:\xvnjnxb.exe83⤵PID:2788
-
\??\c:\nlvvl.exec:\nlvvl.exe84⤵PID:2764
-
\??\c:\pvtfvn.exec:\pvtfvn.exe85⤵PID:2896
-
\??\c:\pnfbv.exec:\pnfbv.exe86⤵PID:2868
-
\??\c:\rtjrt.exec:\rtjrt.exe87⤵PID:2848
-
\??\c:\fxvln.exec:\fxvln.exe88⤵PID:2044
-
\??\c:\nthxpl.exec:\nthxpl.exe89⤵PID:2012
-
\??\c:\bfhjpt.exec:\bfhjpt.exe90⤵PID:1832
-
\??\c:\txlxxx.exec:\txlxxx.exe91⤵PID:2028
-
\??\c:\tvhtf.exec:\tvhtf.exe92⤵PID:2944
-
\??\c:\xnnxxtv.exec:\xnnxxtv.exe93⤵PID:1460
-
\??\c:\pjxddnn.exec:\pjxddnn.exe94⤵PID:1096
-
\??\c:\rpfljvj.exec:\rpfljvj.exe95⤵PID:1956
-
\??\c:\xtljbb.exec:\xtljbb.exe96⤵PID:1984
-
\??\c:\jndrrb.exec:\jndrrb.exe97⤵PID:836
-
\??\c:\ljjnplv.exec:\ljjnplv.exe98⤵PID:2988
-
\??\c:\jhfjpb.exec:\jhfjpb.exe99⤵PID:2064
-
\??\c:\hvnjf.exec:\hvnjf.exe100⤵PID:2348
-
\??\c:\bnrtrj.exec:\bnrtrj.exe101⤵PID:2248
-
\??\c:\thrjj.exec:\thrjj.exe102⤵PID:560
-
\??\c:\nplnp.exec:\nplnp.exe103⤵PID:432
-
\??\c:\dhdxblr.exec:\dhdxblr.exe104⤵PID:2440
-
\??\c:\xpndv.exec:\xpndv.exe105⤵PID:2236
-
\??\c:\xxtxlnn.exec:\xxtxlnn.exe106⤵PID:968
-
\??\c:\tvptflh.exec:\tvptflh.exe107⤵PID:1184
-
\??\c:\ndttj.exec:\ndttj.exe108⤵PID:1036
-
\??\c:\xrjlb.exec:\xrjlb.exe109⤵PID:296
-
\??\c:\lvnpp.exec:\lvnpp.exe110⤵
- System Location Discovery: System Language Discovery
PID:2260 -
\??\c:\nfldhfv.exec:\nfldhfv.exe111⤵PID:1100
-
\??\c:\hffjv.exec:\hffjv.exe112⤵PID:2072
-
\??\c:\jjnbf.exec:\jjnbf.exe113⤵PID:1732
-
\??\c:\pnltb.exec:\pnltb.exe114⤵PID:1016
-
\??\c:\hjnvv.exec:\hjnvv.exe115⤵PID:2572
-
\??\c:\xxhttd.exec:\xxhttd.exe116⤵PID:948
-
\??\c:\vhvpbrr.exec:\vhvpbrr.exe117⤵PID:1560
-
\??\c:\vlbnh.exec:\vlbnh.exe118⤵PID:2060
-
\??\c:\rbjbdv.exec:\rbjbdv.exe119⤵
- System Location Discovery: System Language Discovery
PID:2620 -
\??\c:\nrjnd.exec:\nrjnd.exe120⤵PID:276
-
\??\c:\xhlhd.exec:\xhlhd.exe121⤵PID:2584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-