Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7621f22429ebf567eed13b7597d6800884383c1ed954a293320b513400d0c32fN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
7621f22429ebf567eed13b7597d6800884383c1ed954a293320b513400d0c32fN.exe
-
Size
455KB
-
MD5
561c25565682e0de06e06bb2118474f0
-
SHA1
a5850a4b91e09a9bcaee11de23c602c870387735
-
SHA256
7621f22429ebf567eed13b7597d6800884383c1ed954a293320b513400d0c32f
-
SHA512
fa5b2e3f3d9a4a57b421e477bebe7ce861e6d28bc515df9136b0e9bc1c6b0bf50c1c386f541040c2851c24825fb6405c4c2b589482b5da84f348673cfcb79c29
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbel8:q7Tc2NYHUrAwfMp3CDl8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2524-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-170-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2632-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-204-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2384-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1356-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/704-319-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2524-318-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2984-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-372-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1336-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-434-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/3068-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-514-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1512-544-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1624-541-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1332-578-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1332-598-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2976-644-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2552-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/644-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2076 pbblj.exe 2912 jrvrvr.exe 2924 vdjrtlt.exe 3064 pdplb.exe 2908 rxdlt.exe 2756 vllpxl.exe 2940 plfrfxv.exe 2544 xdtdt.exe 1388 nnvvh.exe 1044 hdlbvv.exe 2628 rxxrr.exe 1948 frpnhnr.exe 1828 fnrbvp.exe 3004 nrphf.exe 2480 xhjlxd.exe 2348 dhvpnb.exe 792 vfjrrrj.exe 2216 thrpp.exe 588 bbdfb.exe 2312 tpdxthx.exe 2632 nthfnfv.exe 2384 vrfjp.exe 2692 vnvhd.exe 1964 vddhfb.exe 1356 htvhrvt.exe 596 jjxdtl.exe 1648 tplhr.exe 1436 llfhv.exe 1328 bnlpftr.exe 704 jxlpd.exe 1040 ljprfrj.exe 1660 rrbtfx.exe 2524 jdtrrd.exe 2956 htntpt.exe 2920 hlnbr.exe 2984 pfbfj.exe 2904 pnjrvx.exe 2124 hnrhrf.exe 1988 xffnx.exe 536 htxxnh.exe 2800 vvdhbtf.exe 1336 txlvn.exe 2056 hdxdthx.exe 2740 hlrbh.exe 2452 tdrlv.exe 2472 vbljl.exe 572 jvrpfr.exe 1856 ttxdf.exe 316 fjhbvh.exe 1952 trhhrn.exe 3068 hlvdl.exe 1412 ptjrrp.exe 2300 rndhp.exe 1016 pvvxpf.exe 384 vtdttt.exe 2164 drjnbx.exe 2216 rvtht.exe 588 nldvnff.exe 2260 rpbdnr.exe 1876 xptxbn.exe 2188 tlvntx.exe 2108 vnbtndx.exe 1624 jnrrrbt.exe 1208 hdtlfj.exe -
resource yara_rule behavioral1/memory/2076-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-178-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2632-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/644-676-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfvdjvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdnxtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbpvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjfltb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvftdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vprbjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvndj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lphxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvxfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdxvxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpdbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxbxbbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjjtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxjtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhjlxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlvfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdtltn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnbxnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlxbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phhvxtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvbnnfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdtnllp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jljbjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvhpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhpfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxhpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbjfdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnfptl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfpxhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrdpnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdhpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btllnbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpbdnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thxrhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxpvxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxfpnpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfxxndr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjdplrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrvrvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvrbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfpdrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbjfpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljnfp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 2076 2524 7621f22429ebf567eed13b7597d6800884383c1ed954a293320b513400d0c32fN.exe 30 PID 2524 wrote to memory of 2076 2524 7621f22429ebf567eed13b7597d6800884383c1ed954a293320b513400d0c32fN.exe 30 PID 2524 wrote to memory of 2076 2524 7621f22429ebf567eed13b7597d6800884383c1ed954a293320b513400d0c32fN.exe 30 PID 2524 wrote to memory of 2076 2524 7621f22429ebf567eed13b7597d6800884383c1ed954a293320b513400d0c32fN.exe 30 PID 2076 wrote to memory of 2912 2076 pbblj.exe 31 PID 2076 wrote to memory of 2912 2076 pbblj.exe 31 PID 2076 wrote to memory of 2912 2076 pbblj.exe 31 PID 2076 wrote to memory of 2912 2076 pbblj.exe 31 PID 2912 wrote to memory of 2924 2912 jrvrvr.exe 32 PID 2912 wrote to memory of 2924 2912 jrvrvr.exe 32 PID 2912 wrote to memory of 2924 2912 jrvrvr.exe 32 PID 2912 wrote to memory of 2924 2912 jrvrvr.exe 32 PID 2924 wrote to memory of 3064 2924 vdjrtlt.exe 33 PID 2924 wrote to memory of 3064 2924 vdjrtlt.exe 33 PID 2924 wrote to memory of 3064 2924 vdjrtlt.exe 33 PID 2924 wrote to memory of 3064 2924 vdjrtlt.exe 33 PID 3064 wrote to memory of 2908 3064 pdplb.exe 34 PID 3064 wrote to memory of 2908 3064 pdplb.exe 34 PID 3064 wrote to memory of 2908 3064 pdplb.exe 34 PID 3064 wrote to memory of 2908 3064 pdplb.exe 34 PID 2908 wrote to memory of 2756 2908 rxdlt.exe 35 PID 2908 wrote to memory of 2756 2908 rxdlt.exe 35 PID 2908 wrote to memory of 2756 2908 rxdlt.exe 35 PID 2908 wrote to memory of 2756 2908 rxdlt.exe 35 PID 2756 wrote to memory of 2940 2756 vllpxl.exe 36 PID 2756 wrote to memory of 2940 2756 vllpxl.exe 36 PID 2756 wrote to memory of 2940 2756 vllpxl.exe 36 PID 2756 wrote to memory of 2940 2756 vllpxl.exe 36 PID 2940 wrote to memory of 2544 2940 plfrfxv.exe 37 PID 2940 wrote to memory of 2544 2940 plfrfxv.exe 37 PID 2940 wrote to memory of 2544 2940 plfrfxv.exe 37 PID 2940 wrote to memory of 2544 2940 plfrfxv.exe 37 PID 2544 wrote to memory of 1388 2544 xdtdt.exe 38 PID 2544 wrote to memory of 1388 2544 xdtdt.exe 38 PID 2544 wrote to memory of 1388 2544 xdtdt.exe 38 PID 2544 wrote to memory of 1388 2544 xdtdt.exe 38 PID 1388 wrote to memory of 1044 1388 nnvvh.exe 39 PID 1388 wrote to memory of 1044 1388 nnvvh.exe 39 PID 1388 wrote to memory of 1044 1388 nnvvh.exe 39 PID 1388 wrote to memory of 1044 1388 nnvvh.exe 39 PID 1044 wrote to memory of 2628 1044 hdlbvv.exe 40 PID 1044 wrote to memory of 2628 1044 hdlbvv.exe 40 PID 1044 wrote to memory of 2628 1044 hdlbvv.exe 40 PID 1044 wrote to memory of 2628 1044 hdlbvv.exe 40 PID 2628 wrote to memory of 1948 2628 rxxrr.exe 41 PID 2628 wrote to memory of 1948 2628 rxxrr.exe 41 PID 2628 wrote to memory of 1948 2628 rxxrr.exe 41 PID 2628 wrote to memory of 1948 2628 rxxrr.exe 41 PID 1948 wrote to memory of 1828 1948 frpnhnr.exe 42 PID 1948 wrote to memory of 1828 1948 frpnhnr.exe 42 PID 1948 wrote to memory of 1828 1948 frpnhnr.exe 42 PID 1948 wrote to memory of 1828 1948 frpnhnr.exe 42 PID 1828 wrote to memory of 3004 1828 fnrbvp.exe 43 PID 1828 wrote to memory of 3004 1828 fnrbvp.exe 43 PID 1828 wrote to memory of 3004 1828 fnrbvp.exe 43 PID 1828 wrote to memory of 3004 1828 fnrbvp.exe 43 PID 3004 wrote to memory of 2480 3004 nrphf.exe 44 PID 3004 wrote to memory of 2480 3004 nrphf.exe 44 PID 3004 wrote to memory of 2480 3004 nrphf.exe 44 PID 3004 wrote to memory of 2480 3004 nrphf.exe 44 PID 2480 wrote to memory of 2348 2480 xhjlxd.exe 45 PID 2480 wrote to memory of 2348 2480 xhjlxd.exe 45 PID 2480 wrote to memory of 2348 2480 xhjlxd.exe 45 PID 2480 wrote to memory of 2348 2480 xhjlxd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7621f22429ebf567eed13b7597d6800884383c1ed954a293320b513400d0c32fN.exe"C:\Users\Admin\AppData\Local\Temp\7621f22429ebf567eed13b7597d6800884383c1ed954a293320b513400d0c32fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\pbblj.exec:\pbblj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\jrvrvr.exec:\jrvrvr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\vdjrtlt.exec:\vdjrtlt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\pdplb.exec:\pdplb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\rxdlt.exec:\rxdlt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\vllpxl.exec:\vllpxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\plfrfxv.exec:\plfrfxv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\xdtdt.exec:\xdtdt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\nnvvh.exec:\nnvvh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\hdlbvv.exec:\hdlbvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\rxxrr.exec:\rxxrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\frpnhnr.exec:\frpnhnr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\fnrbvp.exec:\fnrbvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\nrphf.exec:\nrphf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\xhjlxd.exec:\xhjlxd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\dhvpnb.exec:\dhvpnb.exe17⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vfjrrrj.exec:\vfjrrrj.exe18⤵
- Executes dropped EXE
PID:792 -
\??\c:\thrpp.exec:\thrpp.exe19⤵
- Executes dropped EXE
PID:2216 -
\??\c:\bbdfb.exec:\bbdfb.exe20⤵
- Executes dropped EXE
PID:588 -
\??\c:\tpdxthx.exec:\tpdxthx.exe21⤵
- Executes dropped EXE
PID:2312 -
\??\c:\nthfnfv.exec:\nthfnfv.exe22⤵
- Executes dropped EXE
PID:2632 -
\??\c:\vrfjp.exec:\vrfjp.exe23⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vnvhd.exec:\vnvhd.exe24⤵
- Executes dropped EXE
PID:2692 -
\??\c:\vddhfb.exec:\vddhfb.exe25⤵
- Executes dropped EXE
PID:1964 -
\??\c:\htvhrvt.exec:\htvhrvt.exe26⤵
- Executes dropped EXE
PID:1356 -
\??\c:\jjxdtl.exec:\jjxdtl.exe27⤵
- Executes dropped EXE
PID:596 -
\??\c:\tplhr.exec:\tplhr.exe28⤵
- Executes dropped EXE
PID:1648 -
\??\c:\llfhv.exec:\llfhv.exe29⤵
- Executes dropped EXE
PID:1436 -
\??\c:\bnlpftr.exec:\bnlpftr.exe30⤵
- Executes dropped EXE
PID:1328 -
\??\c:\jxlpd.exec:\jxlpd.exe31⤵
- Executes dropped EXE
PID:704 -
\??\c:\ljprfrj.exec:\ljprfrj.exe32⤵
- Executes dropped EXE
PID:1040 -
\??\c:\rrbtfx.exec:\rrbtfx.exe33⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jdtrrd.exec:\jdtrrd.exe34⤵
- Executes dropped EXE
PID:2524 -
\??\c:\htntpt.exec:\htntpt.exe35⤵
- Executes dropped EXE
PID:2956 -
\??\c:\hlnbr.exec:\hlnbr.exe36⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pfbfj.exec:\pfbfj.exe37⤵
- Executes dropped EXE
PID:2984 -
\??\c:\pnjrvx.exec:\pnjrvx.exe38⤵
- Executes dropped EXE
PID:2904 -
\??\c:\hnrhrf.exec:\hnrhrf.exe39⤵
- Executes dropped EXE
PID:2124 -
\??\c:\xffnx.exec:\xffnx.exe40⤵
- Executes dropped EXE
PID:1988 -
\??\c:\htxxnh.exec:\htxxnh.exe41⤵
- Executes dropped EXE
PID:536 -
\??\c:\vvdhbtf.exec:\vvdhbtf.exe42⤵
- Executes dropped EXE
PID:2800 -
\??\c:\txlvn.exec:\txlvn.exe43⤵
- Executes dropped EXE
PID:1336 -
\??\c:\hdxdthx.exec:\hdxdthx.exe44⤵
- Executes dropped EXE
PID:2056 -
\??\c:\hlrbh.exec:\hlrbh.exe45⤵
- Executes dropped EXE
PID:2740 -
\??\c:\tdrlv.exec:\tdrlv.exe46⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vbljl.exec:\vbljl.exe47⤵
- Executes dropped EXE
PID:2472 -
\??\c:\jvrpfr.exec:\jvrpfr.exe48⤵
- Executes dropped EXE
PID:572 -
\??\c:\ttxdf.exec:\ttxdf.exe49⤵
- Executes dropped EXE
PID:1856 -
\??\c:\fjhbvh.exec:\fjhbvh.exe50⤵
- Executes dropped EXE
PID:316 -
\??\c:\trhhrn.exec:\trhhrn.exe51⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hlvdl.exec:\hlvdl.exe52⤵
- Executes dropped EXE
PID:3068 -
\??\c:\ptjrrp.exec:\ptjrrp.exe53⤵
- Executes dropped EXE
PID:1412 -
\??\c:\rndhp.exec:\rndhp.exe54⤵
- Executes dropped EXE
PID:2300 -
\??\c:\pvvxpf.exec:\pvvxpf.exe55⤵
- Executes dropped EXE
PID:1016 -
\??\c:\vtdttt.exec:\vtdttt.exe56⤵
- Executes dropped EXE
PID:384 -
\??\c:\drjnbx.exec:\drjnbx.exe57⤵
- Executes dropped EXE
PID:2164 -
\??\c:\rvtht.exec:\rvtht.exe58⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nldvnff.exec:\nldvnff.exe59⤵
- Executes dropped EXE
PID:588 -
\??\c:\rpbdnr.exec:\rpbdnr.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2260 -
\??\c:\xptxbn.exec:\xptxbn.exe61⤵
- Executes dropped EXE
PID:1876 -
\??\c:\tlvntx.exec:\tlvntx.exe62⤵
- Executes dropped EXE
PID:2188 -
\??\c:\vnbtndx.exec:\vnbtndx.exe63⤵
- Executes dropped EXE
PID:2108 -
\??\c:\jnrrrbt.exec:\jnrrrbt.exe64⤵
- Executes dropped EXE
PID:1624 -
\??\c:\hdtlfj.exec:\hdtlfj.exe65⤵
- Executes dropped EXE
PID:1208 -
\??\c:\fxxhlvj.exec:\fxxhlvj.exe66⤵PID:1492
-
\??\c:\pplrnv.exec:\pplrnv.exe67⤵PID:1512
-
\??\c:\fjltr.exec:\fjltr.exe68⤵PID:2624
-
\??\c:\rptff.exec:\rptff.exe69⤵PID:2092
-
\??\c:\xxbnppn.exec:\xxbnppn.exe70⤵PID:1812
-
\??\c:\flvhrp.exec:\flvhrp.exe71⤵PID:2012
-
\??\c:\nvppbv.exec:\nvppbv.exe72⤵PID:1332
-
\??\c:\hhlltfj.exec:\hhlltfj.exe73⤵PID:1236
-
\??\c:\nvbjl.exec:\nvbjl.exe74⤵PID:1568
-
\??\c:\rjtjdj.exec:\rjtjdj.exe75⤵PID:2764
-
\??\c:\bdpfjnd.exec:\bdpfjnd.exe76⤵PID:2488
-
\??\c:\ltvxxdp.exec:\ltvxxdp.exe77⤵PID:2576
-
\??\c:\fnrpnx.exec:\fnrpnx.exe78⤵PID:2244
-
\??\c:\ndjvdfp.exec:\ndjvdfp.exe79⤵PID:2976
-
\??\c:\lldbxh.exec:\lldbxh.exe80⤵PID:3020
-
\??\c:\jfhtn.exec:\jfhtn.exe81⤵PID:2888
-
\??\c:\vxpbx.exec:\vxpbx.exe82⤵PID:2932
-
\??\c:\tfvnl.exec:\tfvnl.exe83⤵PID:3028
-
\??\c:\rnljb.exec:\rnljb.exe84⤵PID:2908
-
\??\c:\jxptj.exec:\jxptj.exe85⤵PID:2848
-
\??\c:\vbppjvn.exec:\vbppjvn.exe86⤵PID:2552
-
\??\c:\bdjrld.exec:\bdjrld.exe87⤵PID:644
-
\??\c:\rnpffnd.exec:\rnpffnd.exe88⤵PID:2940
-
\??\c:\djrjd.exec:\djrjd.exe89⤵PID:1388
-
\??\c:\lrndrjb.exec:\lrndrjb.exe90⤵PID:1472
-
\??\c:\phvjlt.exec:\phvjlt.exe91⤵PID:2240
-
\??\c:\lpjjjj.exec:\lpjjjj.exe92⤵PID:784
-
\??\c:\xjfnv.exec:\xjfnv.exe93⤵PID:1948
-
\??\c:\hrrxjxn.exec:\hrrxjxn.exe94⤵PID:2872
-
\??\c:\rndtvt.exec:\rndtvt.exe95⤵PID:2368
-
\??\c:\pdxvxn.exec:\pdxvxn.exe96⤵
- System Location Discovery: System Language Discovery
PID:2448 -
\??\c:\rbxxxj.exec:\rbxxxj.exe97⤵PID:1412
-
\??\c:\ljjjb.exec:\ljjjb.exe98⤵PID:1712
-
\??\c:\fpvnlp.exec:\fpvnlp.exe99⤵PID:2372
-
\??\c:\djtbd.exec:\djtbd.exe100⤵PID:2036
-
\??\c:\fdxlrf.exec:\fdxlrf.exe101⤵PID:2392
-
\??\c:\lrrttb.exec:\lrrttb.exe102⤵
- System Location Discovery: System Language Discovery
PID:2052 -
\??\c:\tdhxr.exec:\tdhxr.exe103⤵PID:2232
-
\??\c:\hxfpnpr.exec:\hxfpnpr.exe104⤵
- System Location Discovery: System Language Discovery
PID:976 -
\??\c:\ddvxfb.exec:\ddvxfb.exe105⤵
- System Location Discovery: System Language Discovery
PID:2200 -
\??\c:\pjhjrjv.exec:\pjhjrjv.exe106⤵PID:2068
-
\??\c:\xnfjdjj.exec:\xnfjdjj.exe107⤵PID:2584
-
\??\c:\jlpdtfd.exec:\jlpdtfd.exe108⤵PID:2064
-
\??\c:\pblbjl.exec:\pblbjl.exe109⤵PID:2228
-
\??\c:\rpvrnvx.exec:\rpvrnvx.exe110⤵PID:880
-
\??\c:\djfxpnb.exec:\djfxpnb.exe111⤵PID:2640
-
\??\c:\jxftbr.exec:\jxftbr.exe112⤵PID:1936
-
\??\c:\lxfnj.exec:\lxfnj.exe113⤵PID:2624
-
\??\c:\vptpn.exec:\vptpn.exe114⤵PID:2736
-
\??\c:\dnvjxd.exec:\dnvjxd.exe115⤵PID:1764
-
\??\c:\dbdhtth.exec:\dbdhtth.exe116⤵PID:1168
-
\??\c:\pvvtjxn.exec:\pvvtjxn.exe117⤵PID:1752
-
\??\c:\hlxdnrf.exec:\hlxdnrf.exe118⤵PID:2612
-
\??\c:\prvvb.exec:\prvvb.exe119⤵PID:2620
-
\??\c:\hxdrr.exec:\hxdrr.exe120⤵PID:2764
-
\??\c:\ljjnl.exec:\ljjnl.exe121⤵PID:2864
-
\??\c:\ljjxlvb.exec:\ljjxlvb.exe122⤵PID:2576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-