Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1821c84c1caa70d90b5ea715dcf3d3e40f3e69e8424dbd9b091debbb62e9cda9N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
1821c84c1caa70d90b5ea715dcf3d3e40f3e69e8424dbd9b091debbb62e9cda9N.exe
-
Size
455KB
-
MD5
63735d0109649ba5a13d48129ba5c330
-
SHA1
d594f5e63043be232c1989e88b866e6f8ac79d31
-
SHA256
1821c84c1caa70d90b5ea715dcf3d3e40f3e69e8424dbd9b091debbb62e9cda9
-
SHA512
ce5602b3bd7857190572092a1f611449ea96300176920a53008386b4865c870be247cd5e5d1c9b501b9c57be35fe66d014b130ee88d3ab672d02c70701d9121b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbec:q7Tc2NYHUrAwfMp3CDc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2412-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-37-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2424-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-126-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2120-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/852-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/856-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1224-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-333-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2832-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-357-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2728-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-601-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2900-661-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3044-746-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2008 jdvrr.exe 2440 bhjnl.exe 2424 nhflxh.exe 2912 dtnxtf.exe 2144 jdbjrd.exe 2712 jxnlf.exe 2036 ttprhl.exe 2768 rrddh.exe 2236 rhlbt.exe 944 thltxtr.exe 3000 txflp.exe 2120 jtlbr.exe 852 dbbldpp.exe 3004 lxdjv.exe 2944 hdbvb.exe 856 bdtltj.exe 1612 ptbph.exe 320 lvrvhx.exe 2096 ddpdlb.exe 1224 djvlt.exe 592 plxbtlp.exe 2492 njltp.exe 1060 vltrnbh.exe 2244 fpxhb.exe 1548 drpxdb.exe 456 pfhhvrn.exe 1416 ptrtdx.exe 1528 lndtxtt.exe 2640 vvjpx.exe 1960 rprxn.exe 2520 vffdhlp.exe 1736 lrphrrt.exe 2412 nrntb.exe 1716 bttnf.exe 2532 bdjxdtd.exe 2172 fnxlrhl.exe 2832 tvljtjt.exe 2424 pfdfhrd.exe 2916 lblhhrp.exe 3056 jdbhfl.exe 2864 jdtpl.exe 2728 vdpjvp.exe 2756 xvvpbr.exe 2768 hdffjxf.exe 2672 fdvjpt.exe 1036 fbbddr.exe 3024 jtvrf.exe 2760 rnjvhfp.exe 1928 pfxtrh.exe 2740 thhjjbh.exe 980 bhlbvx.exe 3052 hjvjdbh.exe 1628 dvppp.exe 1072 lnhft.exe 1740 rdtdx.exe 2448 llptr.exe 2516 tnrjv.exe 2096 dhpnpt.exe 2276 hdfhhlx.exe 2872 trnpj.exe 2592 rpppd.exe 1828 nbtnnnn.exe 2392 dbjhvb.exe 880 phfjpx.exe -
resource yara_rule behavioral1/memory/2412-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-185-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1224-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-197-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/592-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-753-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlhlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjpjltv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbvvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfltj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfbpnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljfhxbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvxnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtprp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtlhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drpxdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrrbvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlrbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxdrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlbvnrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdrhbdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvfxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxdvrpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnlbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdxpnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hndxrlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdvjpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbpllp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bblflb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpfvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbdxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltlpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbtjld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjnvjbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdfhhlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbftv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlhft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtlbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbjxfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlrfrbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnxvdhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhlvhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phdplhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rprxbvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfbjjvb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2008 2412 1821c84c1caa70d90b5ea715dcf3d3e40f3e69e8424dbd9b091debbb62e9cda9N.exe 29 PID 2412 wrote to memory of 2008 2412 1821c84c1caa70d90b5ea715dcf3d3e40f3e69e8424dbd9b091debbb62e9cda9N.exe 29 PID 2412 wrote to memory of 2008 2412 1821c84c1caa70d90b5ea715dcf3d3e40f3e69e8424dbd9b091debbb62e9cda9N.exe 29 PID 2412 wrote to memory of 2008 2412 1821c84c1caa70d90b5ea715dcf3d3e40f3e69e8424dbd9b091debbb62e9cda9N.exe 29 PID 2008 wrote to memory of 2440 2008 jdvrr.exe 30 PID 2008 wrote to memory of 2440 2008 jdvrr.exe 30 PID 2008 wrote to memory of 2440 2008 jdvrr.exe 30 PID 2008 wrote to memory of 2440 2008 jdvrr.exe 30 PID 2440 wrote to memory of 2424 2440 bhjnl.exe 31 PID 2440 wrote to memory of 2424 2440 bhjnl.exe 31 PID 2440 wrote to memory of 2424 2440 bhjnl.exe 31 PID 2440 wrote to memory of 2424 2440 bhjnl.exe 31 PID 2424 wrote to memory of 2912 2424 nhflxh.exe 32 PID 2424 wrote to memory of 2912 2424 nhflxh.exe 32 PID 2424 wrote to memory of 2912 2424 nhflxh.exe 32 PID 2424 wrote to memory of 2912 2424 nhflxh.exe 32 PID 2912 wrote to memory of 2144 2912 dtnxtf.exe 33 PID 2912 wrote to memory of 2144 2912 dtnxtf.exe 33 PID 2912 wrote to memory of 2144 2912 dtnxtf.exe 33 PID 2912 wrote to memory of 2144 2912 dtnxtf.exe 33 PID 2144 wrote to memory of 2712 2144 jdbjrd.exe 34 PID 2144 wrote to memory of 2712 2144 jdbjrd.exe 34 PID 2144 wrote to memory of 2712 2144 jdbjrd.exe 34 PID 2144 wrote to memory of 2712 2144 jdbjrd.exe 34 PID 2712 wrote to memory of 2036 2712 jxnlf.exe 35 PID 2712 wrote to memory of 2036 2712 jxnlf.exe 35 PID 2712 wrote to memory of 2036 2712 jxnlf.exe 35 PID 2712 wrote to memory of 2036 2712 jxnlf.exe 35 PID 2036 wrote to memory of 2768 2036 ttprhl.exe 36 PID 2036 wrote to memory of 2768 2036 ttprhl.exe 36 PID 2036 wrote to memory of 2768 2036 ttprhl.exe 36 PID 2036 wrote to memory of 2768 2036 ttprhl.exe 36 PID 2768 wrote to memory of 2236 2768 rrddh.exe 37 PID 2768 wrote to memory of 2236 2768 rrddh.exe 37 PID 2768 wrote to memory of 2236 2768 rrddh.exe 37 PID 2768 wrote to memory of 2236 2768 rrddh.exe 37 PID 2236 wrote to memory of 944 2236 rhlbt.exe 38 PID 2236 wrote to memory of 944 2236 rhlbt.exe 38 PID 2236 wrote to memory of 944 2236 rhlbt.exe 38 PID 2236 wrote to memory of 944 2236 rhlbt.exe 38 PID 944 wrote to memory of 3000 944 thltxtr.exe 39 PID 944 wrote to memory of 3000 944 thltxtr.exe 39 PID 944 wrote to memory of 3000 944 thltxtr.exe 39 PID 944 wrote to memory of 3000 944 thltxtr.exe 39 PID 3000 wrote to memory of 2120 3000 txflp.exe 40 PID 3000 wrote to memory of 2120 3000 txflp.exe 40 PID 3000 wrote to memory of 2120 3000 txflp.exe 40 PID 3000 wrote to memory of 2120 3000 txflp.exe 40 PID 2120 wrote to memory of 852 2120 jtlbr.exe 41 PID 2120 wrote to memory of 852 2120 jtlbr.exe 41 PID 2120 wrote to memory of 852 2120 jtlbr.exe 41 PID 2120 wrote to memory of 852 2120 jtlbr.exe 41 PID 852 wrote to memory of 3004 852 dbbldpp.exe 42 PID 852 wrote to memory of 3004 852 dbbldpp.exe 42 PID 852 wrote to memory of 3004 852 dbbldpp.exe 42 PID 852 wrote to memory of 3004 852 dbbldpp.exe 42 PID 3004 wrote to memory of 2944 3004 lxdjv.exe 43 PID 3004 wrote to memory of 2944 3004 lxdjv.exe 43 PID 3004 wrote to memory of 2944 3004 lxdjv.exe 43 PID 3004 wrote to memory of 2944 3004 lxdjv.exe 43 PID 2944 wrote to memory of 856 2944 hdbvb.exe 44 PID 2944 wrote to memory of 856 2944 hdbvb.exe 44 PID 2944 wrote to memory of 856 2944 hdbvb.exe 44 PID 2944 wrote to memory of 856 2944 hdbvb.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\1821c84c1caa70d90b5ea715dcf3d3e40f3e69e8424dbd9b091debbb62e9cda9N.exe"C:\Users\Admin\AppData\Local\Temp\1821c84c1caa70d90b5ea715dcf3d3e40f3e69e8424dbd9b091debbb62e9cda9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\jdvrr.exec:\jdvrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\bhjnl.exec:\bhjnl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\nhflxh.exec:\nhflxh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\dtnxtf.exec:\dtnxtf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\jdbjrd.exec:\jdbjrd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\jxnlf.exec:\jxnlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\ttprhl.exec:\ttprhl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\rrddh.exec:\rrddh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\rhlbt.exec:\rhlbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\thltxtr.exec:\thltxtr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\txflp.exec:\txflp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\jtlbr.exec:\jtlbr.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\dbbldpp.exec:\dbbldpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\lxdjv.exec:\lxdjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\hdbvb.exec:\hdbvb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\bdtltj.exec:\bdtltj.exe17⤵
- Executes dropped EXE
PID:856 -
\??\c:\ptbph.exec:\ptbph.exe18⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lvrvhx.exec:\lvrvhx.exe19⤵
- Executes dropped EXE
PID:320 -
\??\c:\ddpdlb.exec:\ddpdlb.exe20⤵
- Executes dropped EXE
PID:2096 -
\??\c:\djvlt.exec:\djvlt.exe21⤵
- Executes dropped EXE
PID:1224 -
\??\c:\plxbtlp.exec:\plxbtlp.exe22⤵
- Executes dropped EXE
PID:592 -
\??\c:\njltp.exec:\njltp.exe23⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vltrnbh.exec:\vltrnbh.exe24⤵
- Executes dropped EXE
PID:1060 -
\??\c:\fpxhb.exec:\fpxhb.exe25⤵
- Executes dropped EXE
PID:2244 -
\??\c:\drpxdb.exec:\drpxdb.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1548 -
\??\c:\pfhhvrn.exec:\pfhhvrn.exe27⤵
- Executes dropped EXE
PID:456 -
\??\c:\ptrtdx.exec:\ptrtdx.exe28⤵
- Executes dropped EXE
PID:1416 -
\??\c:\lndtxtt.exec:\lndtxtt.exe29⤵
- Executes dropped EXE
PID:1528 -
\??\c:\vvjpx.exec:\vvjpx.exe30⤵
- Executes dropped EXE
PID:2640 -
\??\c:\rprxn.exec:\rprxn.exe31⤵
- Executes dropped EXE
PID:1960 -
\??\c:\vffdhlp.exec:\vffdhlp.exe32⤵
- Executes dropped EXE
PID:2520 -
\??\c:\lrphrrt.exec:\lrphrrt.exe33⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nrntb.exec:\nrntb.exe34⤵
- Executes dropped EXE
PID:2412 -
\??\c:\bttnf.exec:\bttnf.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1716 -
\??\c:\bdjxdtd.exec:\bdjxdtd.exe36⤵
- Executes dropped EXE
PID:2532 -
\??\c:\fnxlrhl.exec:\fnxlrhl.exe37⤵
- Executes dropped EXE
PID:2172 -
\??\c:\tvljtjt.exec:\tvljtjt.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\pfdfhrd.exec:\pfdfhrd.exe39⤵
- Executes dropped EXE
PID:2424 -
\??\c:\lblhhrp.exec:\lblhhrp.exe40⤵
- Executes dropped EXE
PID:2916 -
\??\c:\jdbhfl.exec:\jdbhfl.exe41⤵
- Executes dropped EXE
PID:3056 -
\??\c:\jdtpl.exec:\jdtpl.exe42⤵
- Executes dropped EXE
PID:2864 -
\??\c:\vdpjvp.exec:\vdpjvp.exe43⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xvvpbr.exec:\xvvpbr.exe44⤵
- Executes dropped EXE
PID:2756 -
\??\c:\hdffjxf.exec:\hdffjxf.exe45⤵
- Executes dropped EXE
PID:2768 -
\??\c:\fdvjpt.exec:\fdvjpt.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2672 -
\??\c:\fbbddr.exec:\fbbddr.exe47⤵
- Executes dropped EXE
PID:1036 -
\??\c:\jtvrf.exec:\jtvrf.exe48⤵
- Executes dropped EXE
PID:3024 -
\??\c:\rnjvhfp.exec:\rnjvhfp.exe49⤵
- Executes dropped EXE
PID:2760 -
\??\c:\pfxtrh.exec:\pfxtrh.exe50⤵
- Executes dropped EXE
PID:1928 -
\??\c:\thhjjbh.exec:\thhjjbh.exe51⤵
- Executes dropped EXE
PID:2740 -
\??\c:\bhlbvx.exec:\bhlbvx.exe52⤵
- Executes dropped EXE
PID:980 -
\??\c:\hjvjdbh.exec:\hjvjdbh.exe53⤵
- Executes dropped EXE
PID:3052 -
\??\c:\dvppp.exec:\dvppp.exe54⤵
- Executes dropped EXE
PID:1628 -
\??\c:\lnhft.exec:\lnhft.exe55⤵
- Executes dropped EXE
PID:1072 -
\??\c:\rdtdx.exec:\rdtdx.exe56⤵
- Executes dropped EXE
PID:1740 -
\??\c:\llptr.exec:\llptr.exe57⤵
- Executes dropped EXE
PID:2448 -
\??\c:\tnrjv.exec:\tnrjv.exe58⤵
- Executes dropped EXE
PID:2516 -
\??\c:\dhpnpt.exec:\dhpnpt.exe59⤵
- Executes dropped EXE
PID:2096 -
\??\c:\hdfhhlx.exec:\hdfhhlx.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2276 -
\??\c:\trnpj.exec:\trnpj.exe61⤵
- Executes dropped EXE
PID:2872 -
\??\c:\rpppd.exec:\rpppd.exe62⤵
- Executes dropped EXE
PID:2592 -
\??\c:\nbtnnnn.exec:\nbtnnnn.exe63⤵
- Executes dropped EXE
PID:1828 -
\??\c:\dbjhvb.exec:\dbjhvb.exe64⤵
- Executes dropped EXE
PID:2392 -
\??\c:\phfjpx.exec:\phfjpx.exe65⤵
- Executes dropped EXE
PID:880 -
\??\c:\dltdjtp.exec:\dltdjtp.exe66⤵PID:1796
-
\??\c:\rvxhjft.exec:\rvxhjft.exe67⤵PID:2616
-
\??\c:\trvpbtv.exec:\trvpbtv.exe68⤵PID:1028
-
\??\c:\xnpltf.exec:\xnpltf.exe69⤵PID:608
-
\??\c:\nbnbvf.exec:\nbnbvf.exe70⤵PID:588
-
\??\c:\tbhjjlt.exec:\tbhjjlt.exe71⤵PID:2624
-
\??\c:\xlpddpd.exec:\xlpddpd.exe72⤵PID:1512
-
\??\c:\rxphd.exec:\rxphd.exe73⤵PID:1316
-
\??\c:\vfldrb.exec:\vfldrb.exe74⤵PID:2484
-
\??\c:\ntdlfxr.exec:\ntdlfxr.exe75⤵PID:2356
-
\??\c:\jltrpl.exec:\jltrpl.exe76⤵PID:2548
-
\??\c:\vtdpl.exec:\vtdpl.exe77⤵PID:1244
-
\??\c:\pdnrtx.exec:\pdnrtx.exe78⤵PID:2528
-
\??\c:\hlltdpl.exec:\hlltdpl.exe79⤵PID:2784
-
\??\c:\tdrtv.exec:\tdrtv.exe80⤵PID:2172
-
\??\c:\fxjpfj.exec:\fxjpfj.exe81⤵PID:2956
-
\??\c:\ffnvh.exec:\ffnvh.exe82⤵PID:2900
-
\??\c:\dnhdj.exec:\dnhdj.exe83⤵PID:2936
-
\??\c:\hnldtx.exec:\hnldtx.exe84⤵PID:3056
-
\??\c:\blftx.exec:\blftx.exe85⤵PID:108
-
\??\c:\hvrbbbd.exec:\hvrbbbd.exe86⤵PID:2720
-
\??\c:\vbxfx.exec:\vbxfx.exe87⤵PID:2752
-
\??\c:\jhbtlb.exec:\jhbtlb.exe88⤵PID:2744
-
\??\c:\fvvfpt.exec:\fvvfpt.exe89⤵PID:2032
-
\??\c:\vhdjjd.exec:\vhdjjd.exe90⤵PID:3032
-
\??\c:\dpvdbj.exec:\dpvdbj.exe91⤵PID:1036
-
\??\c:\bbdhllx.exec:\bbdhllx.exe92⤵PID:2312
-
\??\c:\xtpljv.exec:\xtpljv.exe93⤵PID:2760
-
\??\c:\pddln.exec:\pddln.exe94⤵PID:2676
-
\??\c:\lrfvhb.exec:\lrfvhb.exe95⤵PID:3044
-
\??\c:\tnnfh.exec:\tnnfh.exe96⤵PID:3020
-
\??\c:\tlxth.exec:\tlxth.exe97⤵PID:2944
-
\??\c:\hrrbvpp.exec:\hrrbvpp.exe98⤵
- System Location Discovery: System Language Discovery
PID:700 -
\??\c:\vlxnf.exec:\vlxnf.exe99⤵PID:1072
-
\??\c:\hjdfr.exec:\hjdfr.exe100⤵PID:1740
-
\??\c:\rvltb.exec:\rvltb.exe101⤵PID:2448
-
\??\c:\dllnlp.exec:\dllnlp.exe102⤵PID:2268
-
\??\c:\ltfddh.exec:\ltfddh.exe103⤵PID:2140
-
\??\c:\bpdhl.exec:\bpdhl.exe104⤵PID:808
-
\??\c:\hhjfdv.exec:\hhjfdv.exe105⤵PID:1652
-
\??\c:\jvffxv.exec:\jvffxv.exe106⤵PID:2200
-
\??\c:\dlrbb.exec:\dlrbb.exe107⤵
- System Location Discovery: System Language Discovery
PID:1144 -
\??\c:\xbnrfdt.exec:\xbnrfdt.exe108⤵PID:2580
-
\??\c:\fjjtrb.exec:\fjjtrb.exe109⤵PID:1900
-
\??\c:\bjdxjvp.exec:\bjdxjvp.exe110⤵PID:2044
-
\??\c:\frjjj.exec:\frjjj.exe111⤵PID:2932
-
\??\c:\jlxlf.exec:\jlxlf.exe112⤵PID:972
-
\??\c:\xvrhbn.exec:\xvrhbn.exe113⤵PID:608
-
\??\c:\ttnlntt.exec:\ttnlntt.exe114⤵PID:2644
-
\??\c:\pnhnvxj.exec:\pnhnvxj.exe115⤵PID:2480
-
\??\c:\frlxr.exec:\frlxr.exe116⤵PID:2264
-
\??\c:\xlbdbj.exec:\xlbdbj.exe117⤵PID:1316
-
\??\c:\xbhxpvf.exec:\xbhxpvf.exe118⤵PID:2280
-
\??\c:\nvbbfbh.exec:\nvbbfbh.exe119⤵PID:2028
-
\??\c:\hljddhn.exec:\hljddhn.exe120⤵PID:2412
-
\??\c:\bhdvl.exec:\bhdvl.exe121⤵PID:1244
-
\??\c:\vdfxxxr.exec:\vdfxxxr.exe122⤵PID:2880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-