Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9e5276d89713ea695a0454b289fe730e4d12ff1a4648ed5b350edd6ad990434aN.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
9e5276d89713ea695a0454b289fe730e4d12ff1a4648ed5b350edd6ad990434aN.exe
-
Size
454KB
-
MD5
f702d732e9d5f4715ec37a72b0dc4610
-
SHA1
7a404fccb7006749d5ae682a8fed678568a9c2b2
-
SHA256
9e5276d89713ea695a0454b289fe730e4d12ff1a4648ed5b350edd6ad990434a
-
SHA512
fefaefb6fb8a814387442663f188a7dde957b302526bad33edb3666fc787b090de78fc74ff29b0d99d085694936009ac39d79ee459c94656e9b1248c3d83c5f9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/3040-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1412-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/372-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-411-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2952-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/692-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-568-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-583-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1952-582-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2380-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-671-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/884-679-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1672-864-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2272-1011-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2032-1059-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2940 drfjr.exe 2760 nxdfrbp.exe 2900 fvdnrt.exe 3048 nblfvll.exe 1076 bllhr.exe 2716 xdvxldv.exe 2400 pvtxlxp.exe 2636 fffbpr.exe 2228 rnxlhf.exe 2580 ltjltfh.exe 3032 vjjjppj.exe 2992 dblbbh.exe 2232 hppjpd.exe 1532 rpbbhp.exe 2372 vdltphl.exe 1912 lxfdht.exe 516 bflxf.exe 2464 jxddr.exe 2472 jxptfpx.exe 2468 vnrxtr.exe 1320 tftllhb.exe 2984 xbrrlf.exe 1232 xfbjft.exe 660 djjrv.exe 1972 bhdtp.exe 1412 pbdjv.exe 372 vvtdd.exe 1680 vlbrr.exe 1628 dplttjv.exe 1312 lnhxb.exe 1952 xhdfx.exe 1668 rlhxjdx.exe 1884 vpnjvll.exe 2496 nrxnl.exe 1600 dppth.exe 2792 ljbhd.exe 2340 pbxlfv.exe 3064 jfjhxl.exe 2900 hhnpbnv.exe 2860 prdfhbn.exe 3016 tpxhxbp.exe 2644 blhpr.exe 1056 pjphlj.exe 2820 bjdxfrx.exe 2400 trvljhr.exe 2636 vfvnrt.exe 1376 xfvbr.exe 1524 dtxlxf.exe 2908 pfhrh.exe 3032 trpbfh.exe 988 vlpblxx.exe 2952 fltrn.exe 1620 phlpxrn.exe 2720 ttblt.exe 1092 xdjnx.exe 1740 bjvbv.exe 2408 tnpthb.exe 2832 ntdlhd.exe 2032 ltxbdr.exe 1944 rxnrrv.exe 2148 xjrxhx.exe 784 ddtddn.exe 1124 xnbbhdh.exe 692 vrbrt.exe -
resource yara_rule behavioral1/memory/3040-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/372-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-843-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-884-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-891-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-944-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntvnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flvdhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrfrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddfpvjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nffpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdbdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbljv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thpln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhddl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhltl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjnnbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhltxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrthxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thxbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbjpdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtxfvnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddbdnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvlbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntphj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltpnvrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvnnxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdrbtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfnlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrvnfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnpltxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpjbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bljbpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvttld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndnnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjffj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjblldj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjtttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rblpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtlxplt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2940 3040 9e5276d89713ea695a0454b289fe730e4d12ff1a4648ed5b350edd6ad990434aN.exe 30 PID 3040 wrote to memory of 2940 3040 9e5276d89713ea695a0454b289fe730e4d12ff1a4648ed5b350edd6ad990434aN.exe 30 PID 3040 wrote to memory of 2940 3040 9e5276d89713ea695a0454b289fe730e4d12ff1a4648ed5b350edd6ad990434aN.exe 30 PID 3040 wrote to memory of 2940 3040 9e5276d89713ea695a0454b289fe730e4d12ff1a4648ed5b350edd6ad990434aN.exe 30 PID 2940 wrote to memory of 2760 2940 drfjr.exe 31 PID 2940 wrote to memory of 2760 2940 drfjr.exe 31 PID 2940 wrote to memory of 2760 2940 drfjr.exe 31 PID 2940 wrote to memory of 2760 2940 drfjr.exe 31 PID 2760 wrote to memory of 2900 2760 nxdfrbp.exe 32 PID 2760 wrote to memory of 2900 2760 nxdfrbp.exe 32 PID 2760 wrote to memory of 2900 2760 nxdfrbp.exe 32 PID 2760 wrote to memory of 2900 2760 nxdfrbp.exe 32 PID 2900 wrote to memory of 3048 2900 fvdnrt.exe 33 PID 2900 wrote to memory of 3048 2900 fvdnrt.exe 33 PID 2900 wrote to memory of 3048 2900 fvdnrt.exe 33 PID 2900 wrote to memory of 3048 2900 fvdnrt.exe 33 PID 3048 wrote to memory of 1076 3048 nblfvll.exe 34 PID 3048 wrote to memory of 1076 3048 nblfvll.exe 34 PID 3048 wrote to memory of 1076 3048 nblfvll.exe 34 PID 3048 wrote to memory of 1076 3048 nblfvll.exe 34 PID 1076 wrote to memory of 2716 1076 bllhr.exe 35 PID 1076 wrote to memory of 2716 1076 bllhr.exe 35 PID 1076 wrote to memory of 2716 1076 bllhr.exe 35 PID 1076 wrote to memory of 2716 1076 bllhr.exe 35 PID 2716 wrote to memory of 2400 2716 xdvxldv.exe 36 PID 2716 wrote to memory of 2400 2716 xdvxldv.exe 36 PID 2716 wrote to memory of 2400 2716 xdvxldv.exe 36 PID 2716 wrote to memory of 2400 2716 xdvxldv.exe 36 PID 2400 wrote to memory of 2636 2400 pvtxlxp.exe 37 PID 2400 wrote to memory of 2636 2400 pvtxlxp.exe 37 PID 2400 wrote to memory of 2636 2400 pvtxlxp.exe 37 PID 2400 wrote to memory of 2636 2400 pvtxlxp.exe 37 PID 2636 wrote to memory of 2228 2636 fffbpr.exe 38 PID 2636 wrote to memory of 2228 2636 fffbpr.exe 38 PID 2636 wrote to memory of 2228 2636 fffbpr.exe 38 PID 2636 wrote to memory of 2228 2636 fffbpr.exe 38 PID 2228 wrote to memory of 2580 2228 rnxlhf.exe 39 PID 2228 wrote to memory of 2580 2228 rnxlhf.exe 39 PID 2228 wrote to memory of 2580 2228 rnxlhf.exe 39 PID 2228 wrote to memory of 2580 2228 rnxlhf.exe 39 PID 2580 wrote to memory of 3032 2580 ltjltfh.exe 40 PID 2580 wrote to memory of 3032 2580 ltjltfh.exe 40 PID 2580 wrote to memory of 3032 2580 ltjltfh.exe 40 PID 2580 wrote to memory of 3032 2580 ltjltfh.exe 40 PID 3032 wrote to memory of 2992 3032 vjjjppj.exe 41 PID 3032 wrote to memory of 2992 3032 vjjjppj.exe 41 PID 3032 wrote to memory of 2992 3032 vjjjppj.exe 41 PID 3032 wrote to memory of 2992 3032 vjjjppj.exe 41 PID 2992 wrote to memory of 2232 2992 dblbbh.exe 42 PID 2992 wrote to memory of 2232 2992 dblbbh.exe 42 PID 2992 wrote to memory of 2232 2992 dblbbh.exe 42 PID 2992 wrote to memory of 2232 2992 dblbbh.exe 42 PID 2232 wrote to memory of 1532 2232 hppjpd.exe 43 PID 2232 wrote to memory of 1532 2232 hppjpd.exe 43 PID 2232 wrote to memory of 1532 2232 hppjpd.exe 43 PID 2232 wrote to memory of 1532 2232 hppjpd.exe 43 PID 1532 wrote to memory of 2372 1532 rpbbhp.exe 44 PID 1532 wrote to memory of 2372 1532 rpbbhp.exe 44 PID 1532 wrote to memory of 2372 1532 rpbbhp.exe 44 PID 1532 wrote to memory of 2372 1532 rpbbhp.exe 44 PID 2372 wrote to memory of 1912 2372 vdltphl.exe 45 PID 2372 wrote to memory of 1912 2372 vdltphl.exe 45 PID 2372 wrote to memory of 1912 2372 vdltphl.exe 45 PID 2372 wrote to memory of 1912 2372 vdltphl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e5276d89713ea695a0454b289fe730e4d12ff1a4648ed5b350edd6ad990434aN.exe"C:\Users\Admin\AppData\Local\Temp\9e5276d89713ea695a0454b289fe730e4d12ff1a4648ed5b350edd6ad990434aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\drfjr.exec:\drfjr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\nxdfrbp.exec:\nxdfrbp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\fvdnrt.exec:\fvdnrt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\nblfvll.exec:\nblfvll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\bllhr.exec:\bllhr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\xdvxldv.exec:\xdvxldv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\pvtxlxp.exec:\pvtxlxp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\fffbpr.exec:\fffbpr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\rnxlhf.exec:\rnxlhf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\ltjltfh.exec:\ltjltfh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\vjjjppj.exec:\vjjjppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\dblbbh.exec:\dblbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\hppjpd.exec:\hppjpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\rpbbhp.exec:\rpbbhp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\vdltphl.exec:\vdltphl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\lxfdht.exec:\lxfdht.exe17⤵
- Executes dropped EXE
PID:1912 -
\??\c:\bflxf.exec:\bflxf.exe18⤵
- Executes dropped EXE
PID:516 -
\??\c:\jxddr.exec:\jxddr.exe19⤵
- Executes dropped EXE
PID:2464 -
\??\c:\jxptfpx.exec:\jxptfpx.exe20⤵
- Executes dropped EXE
PID:2472 -
\??\c:\vnrxtr.exec:\vnrxtr.exe21⤵
- Executes dropped EXE
PID:2468 -
\??\c:\tftllhb.exec:\tftllhb.exe22⤵
- Executes dropped EXE
PID:1320 -
\??\c:\xbrrlf.exec:\xbrrlf.exe23⤵
- Executes dropped EXE
PID:2984 -
\??\c:\xfbjft.exec:\xfbjft.exe24⤵
- Executes dropped EXE
PID:1232 -
\??\c:\djjrv.exec:\djjrv.exe25⤵
- Executes dropped EXE
PID:660 -
\??\c:\bhdtp.exec:\bhdtp.exe26⤵
- Executes dropped EXE
PID:1972 -
\??\c:\pbdjv.exec:\pbdjv.exe27⤵
- Executes dropped EXE
PID:1412 -
\??\c:\vvtdd.exec:\vvtdd.exe28⤵
- Executes dropped EXE
PID:372 -
\??\c:\vlbrr.exec:\vlbrr.exe29⤵
- Executes dropped EXE
PID:1680 -
\??\c:\dplttjv.exec:\dplttjv.exe30⤵
- Executes dropped EXE
PID:1628 -
\??\c:\lnhxb.exec:\lnhxb.exe31⤵
- Executes dropped EXE
PID:1312 -
\??\c:\xhdfx.exec:\xhdfx.exe32⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rlhxjdx.exec:\rlhxjdx.exe33⤵
- Executes dropped EXE
PID:1668 -
\??\c:\vpnjvll.exec:\vpnjvll.exe34⤵
- Executes dropped EXE
PID:1884 -
\??\c:\nrxnl.exec:\nrxnl.exe35⤵
- Executes dropped EXE
PID:2496 -
\??\c:\dppth.exec:\dppth.exe36⤵
- Executes dropped EXE
PID:1600 -
\??\c:\ljbhd.exec:\ljbhd.exe37⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pbxlfv.exec:\pbxlfv.exe38⤵
- Executes dropped EXE
PID:2340 -
\??\c:\jfjhxl.exec:\jfjhxl.exe39⤵
- Executes dropped EXE
PID:3064 -
\??\c:\hhnpbnv.exec:\hhnpbnv.exe40⤵
- Executes dropped EXE
PID:2900 -
\??\c:\prdfhbn.exec:\prdfhbn.exe41⤵
- Executes dropped EXE
PID:2860 -
\??\c:\tpxhxbp.exec:\tpxhxbp.exe42⤵
- Executes dropped EXE
PID:3016 -
\??\c:\blhpr.exec:\blhpr.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\pjphlj.exec:\pjphlj.exe44⤵
- Executes dropped EXE
PID:1056 -
\??\c:\bjdxfrx.exec:\bjdxfrx.exe45⤵
- Executes dropped EXE
PID:2820 -
\??\c:\trvljhr.exec:\trvljhr.exe46⤵
- Executes dropped EXE
PID:2400 -
\??\c:\vfvnrt.exec:\vfvnrt.exe47⤵
- Executes dropped EXE
PID:2636 -
\??\c:\xfvbr.exec:\xfvbr.exe48⤵
- Executes dropped EXE
PID:1376 -
\??\c:\dtxlxf.exec:\dtxlxf.exe49⤵
- Executes dropped EXE
PID:1524 -
\??\c:\pfhrh.exec:\pfhrh.exe50⤵
- Executes dropped EXE
PID:2908 -
\??\c:\trpbfh.exec:\trpbfh.exe51⤵
- Executes dropped EXE
PID:3032 -
\??\c:\vlpblxx.exec:\vlpblxx.exe52⤵
- Executes dropped EXE
PID:988 -
\??\c:\fltrn.exec:\fltrn.exe53⤵
- Executes dropped EXE
PID:2952 -
\??\c:\phlpxrn.exec:\phlpxrn.exe54⤵
- Executes dropped EXE
PID:1620 -
\??\c:\ttblt.exec:\ttblt.exe55⤵
- Executes dropped EXE
PID:2720 -
\??\c:\xdjnx.exec:\xdjnx.exe56⤵
- Executes dropped EXE
PID:1092 -
\??\c:\bjvbv.exec:\bjvbv.exe57⤵
- Executes dropped EXE
PID:1740 -
\??\c:\tnpthb.exec:\tnpthb.exe58⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ntdlhd.exec:\ntdlhd.exe59⤵
- Executes dropped EXE
PID:2832 -
\??\c:\ltxbdr.exec:\ltxbdr.exe60⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rxnrrv.exec:\rxnrrv.exe61⤵
- Executes dropped EXE
PID:1944 -
\??\c:\xjrxhx.exec:\xjrxhx.exe62⤵
- Executes dropped EXE
PID:2148 -
\??\c:\ddtddn.exec:\ddtddn.exe63⤵
- Executes dropped EXE
PID:784 -
\??\c:\xnbbhdh.exec:\xnbbhdh.exe64⤵
- Executes dropped EXE
PID:1124 -
\??\c:\vrbrt.exec:\vrbrt.exe65⤵
- Executes dropped EXE
PID:692 -
\??\c:\tdvjdhj.exec:\tdvjdhj.exe66⤵PID:1232
-
\??\c:\npljrtp.exec:\npljrtp.exe67⤵PID:1580
-
\??\c:\tdvlfd.exec:\tdvlfd.exe68⤵PID:1316
-
\??\c:\flxhvn.exec:\flxhvn.exe69⤵PID:1796
-
\??\c:\ljhnrp.exec:\ljhnrp.exe70⤵PID:1412
-
\??\c:\lbddt.exec:\lbddt.exe71⤵PID:3068
-
\??\c:\hrjdd.exec:\hrjdd.exe72⤵PID:612
-
\??\c:\tjthp.exec:\tjthp.exe73⤵PID:1744
-
\??\c:\tdxdfpp.exec:\tdxdfpp.exe74⤵PID:1468
-
\??\c:\hvtdnr.exec:\hvtdnr.exe75⤵PID:2180
-
\??\c:\prltjv.exec:\prltjv.exe76⤵PID:1952
-
\??\c:\flttd.exec:\flttd.exe77⤵PID:1668
-
\??\c:\tvrjvfj.exec:\tvrjvfj.exe78⤵PID:1884
-
\??\c:\jxtrpfp.exec:\jxtrpfp.exe79⤵PID:2496
-
\??\c:\tjpjj.exec:\tjpjj.exe80⤵PID:1596
-
\??\c:\bnjdpd.exec:\bnjdpd.exe81⤵PID:3036
-
\??\c:\hpxxdpd.exec:\hpxxdpd.exe82⤵PID:2872
-
\??\c:\bhflbn.exec:\bhflbn.exe83⤵PID:2656
-
\??\c:\drdrrtf.exec:\drdrrtf.exe84⤵PID:2516
-
\??\c:\pvvtffv.exec:\pvvtffv.exe85⤵PID:2672
-
\??\c:\thpln.exec:\thpln.exe86⤵
- System Location Discovery: System Language Discovery
PID:2488 -
\??\c:\bvbvf.exec:\bvbvf.exe87⤵PID:2212
-
\??\c:\jjtljh.exec:\jjtljh.exe88⤵PID:2716
-
\??\c:\nnjhfp.exec:\nnjhfp.exe89⤵PID:3012
-
\??\c:\vlhfl.exec:\vlhfl.exe90⤵PID:2380
-
\??\c:\rbtflrt.exec:\rbtflrt.exe91⤵PID:884
-
\??\c:\prbbx.exec:\prbbx.exe92⤵PID:2592
-
\??\c:\jpdljtl.exec:\jpdljtl.exe93⤵PID:2964
-
\??\c:\tdplf.exec:\tdplf.exe94⤵PID:2960
-
\??\c:\ldpflh.exec:\ldpflh.exe95⤵PID:3032
-
\??\c:\ltdfjx.exec:\ltdfjx.exe96⤵PID:3024
-
\??\c:\tnhdbpb.exec:\tnhdbpb.exe97⤵PID:2848
-
\??\c:\ffprjj.exec:\ffprjj.exe98⤵PID:2368
-
\??\c:\vnvdfdp.exec:\vnvdfdp.exe99⤵PID:584
-
\??\c:\xjnjhtx.exec:\xjnjhtx.exe100⤵PID:264
-
\??\c:\nxtnjlf.exec:\nxtnjlf.exe101⤵PID:2076
-
\??\c:\lffhxpb.exec:\lffhxpb.exe102⤵PID:1360
-
\??\c:\dprxh.exec:\dprxh.exe103⤵PID:2464
-
\??\c:\flppv.exec:\flppv.exe104⤵
- System Location Discovery: System Language Discovery
PID:2832 -
\??\c:\dvxtd.exec:\dvxtd.exe105⤵PID:2032
-
\??\c:\trdhxvr.exec:\trdhxvr.exe106⤵PID:1624
-
\??\c:\jhttb.exec:\jhttb.exe107⤵PID:2148
-
\??\c:\jthhh.exec:\jthhh.exe108⤵PID:2984
-
\??\c:\rjptfr.exec:\rjptfr.exe109⤵PID:2492
-
\??\c:\rlnvr.exec:\rlnvr.exe110⤵PID:1060
-
\??\c:\rxhtf.exec:\rxhtf.exe111⤵PID:1232
-
\??\c:\dlvdnx.exec:\dlvdnx.exe112⤵PID:1580
-
\??\c:\xbdlbd.exec:\xbdlbd.exe113⤵PID:1316
-
\??\c:\jdxhjd.exec:\jdxhjd.exe114⤵PID:1796
-
\??\c:\trnbj.exec:\trnbj.exe115⤵PID:1916
-
\??\c:\fpdxj.exec:\fpdxj.exe116⤵PID:744
-
\??\c:\jlldlpb.exec:\jlldlpb.exe117⤵PID:544
-
\??\c:\dxplxnh.exec:\dxplxnh.exe118⤵PID:2540
-
\??\c:\lpxtp.exec:\lpxtp.exe119⤵PID:1864
-
\??\c:\ldnvvx.exec:\ldnvvx.exe120⤵PID:1672
-
\??\c:\fvjxtph.exec:\fvjxtph.exe121⤵PID:1900
-
\??\c:\vhhpp.exec:\vhhpp.exe122⤵PID:2292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-