Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 09:08
Behavioral task
behavioral1
Sample
30a24d6ff33872843a6abb8796f07675a5c708a640389a4f38c272905a247d8d.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
30a24d6ff33872843a6abb8796f07675a5c708a640389a4f38c272905a247d8d.exe
-
Size
335KB
-
MD5
5d2fe108fc2768b5411bc15a03f02654
-
SHA1
a9ce0407c8e9cbe70c104a43621790775047da77
-
SHA256
30a24d6ff33872843a6abb8796f07675a5c708a640389a4f38c272905a247d8d
-
SHA512
cf8c112d48f75ccb4eefd01b2f03012f543853740a7c3fd026cb134f1b6b7e67f098561485c044c997790ff74427416d5cb1a9b5fc5834a276f64fc45475b03b
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeRCE:R4wFHoSHYHUrAwfMp3CDRCE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2280-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-12-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2548-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-32-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2892-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1152-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1152-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1464-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1072-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1072-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2132-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1616-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-307-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2896-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2160-347-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2148-355-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1740-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-488-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-504-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1460-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-714-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-6490-0x00000000778B0000-0x00000000779AA000-memory.dmp family_blackmoon behavioral1/memory/2656-6489-0x0000000077790000-0x00000000778AF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2548 nlnhblt.exe 3064 pblpfbf.exe 2836 jdljtj.exe 2952 hnpdx.exe 2892 rvlvrf.exe 2924 dpdrhln.exe 2712 ndvft.exe 2804 pdnvpf.exe 2752 rvvnrl.exe 2428 lxhpj.exe 2672 tlhnl.exe 1152 dhjxfr.exe 1576 ljxdbxj.exe 3008 nvvtnnp.exe 948 pfxttpd.exe 1464 fxfrt.exe 2944 jfdjlb.exe 1072 bdvnbp.exe 1632 tdxtjp.exe 320 trhlbhp.exe 2584 jrlbhtr.exe 2276 ddjtvrd.exe 2132 vlhdltb.exe 1624 tbjtrnv.exe 1540 bpbtrf.exe 2232 fpnjxjr.exe 1968 nldbhdp.exe 1496 bpjnf.exe 1784 vbpfxf.exe 2932 jhlblb.exe 972 rrvnv.exe 2624 tjrnb.exe 1108 xnjdxx.exe 1616 pxfbh.exe 2264 lftpl.exe 2368 lfxjdh.exe 1716 rfjvtnp.exe 2000 hnbld.exe 2548 vhnfn.exe 2556 ftbbll.exe 2896 fnpbv.exe 2148 fvjrx.exe 2560 vlndhpd.exe 2160 vjxpvld.exe 2892 flldbr.exe 2864 dtbpfhh.exe 2692 nrbrtt.exe 2708 rbbfphn.exe 2024 dthhxnx.exe 2752 phvrl.exe 2428 xlxfnpn.exe 908 rrvhjtx.exe 2780 plrlx.exe 2092 nxnplp.exe 2108 vvdnn.exe 872 dxjtpp.exe 1476 jntxt.exe 2996 vxjhnb.exe 3036 hnvnfhx.exe 3020 jvdfxbd.exe 2984 njfhddh.exe 1072 nfvnlr.exe 1740 nhldlrn.exe 756 vfddtj.exe -
resource yara_rule behavioral1/memory/2280-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2280-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2548-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001227e-7.dat upx behavioral1/files/0x0008000000016d0c-18.dat upx behavioral1/memory/2548-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d1c-26.dat upx behavioral1/memory/3064-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d3f-43.dat upx behavioral1/memory/2892-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2952-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d2c-36.dat upx behavioral1/memory/2836-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0002000000018334-52.dat upx behavioral1/files/0x0009000000018b05-58.dat upx behavioral1/files/0x0009000000016cd8-70.dat upx behavioral1/memory/2804-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2712-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001950f-78.dat upx behavioral1/memory/2752-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2804-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019515-86.dat upx behavioral1/files/0x0005000000019547-92.dat upx behavioral1/memory/2672-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1152-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001957c-103.dat upx behavioral1/files/0x00050000000195a7-111.dat upx behavioral1/memory/1152-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a9-119.dat upx behavioral1/files/0x00050000000195ab-127.dat upx behavioral1/files/0x00050000000195ad-135.dat upx behavioral1/memory/1464-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195af-143.dat upx behavioral1/memory/2944-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1072-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b1-154.dat upx behavioral1/memory/2944-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b3-162.dat upx behavioral1/memory/1072-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b5-173.dat upx behavioral1/memory/1632-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/320-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b7-180.dat upx behavioral1/memory/320-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2584-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195bb-188.dat upx behavioral1/files/0x00050000000195bd-197.dat upx behavioral1/memory/2276-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2132-204-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00050000000195c1-206.dat upx behavioral1/memory/2132-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1624-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c3-214.dat upx behavioral1/files/0x00050000000195c5-222.dat upx behavioral1/files/0x00050000000195c6-229.dat upx behavioral1/files/0x00050000000195c7-238.dat upx behavioral1/memory/1968-239-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1968-237-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001960c-247.dat upx behavioral1/files/0x0005000000019643-254.dat upx behavioral1/memory/2932-261-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001975a-262.dat upx behavioral1/memory/972-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019761-270.dat upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvdrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxhbvll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvlpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlhjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhjxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhbrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txrptvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvtfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbfppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbptvfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdxhpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdvnbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrbrtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnnpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prffv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdvth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlbplvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldpllxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhldhtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfbdbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trhlbhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbbnvvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvdpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvdbrxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxpvfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpptx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftpxvtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjlllj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llldvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppfhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpdldv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxpnjvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfdxvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lprxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhtnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppxddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvhppx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjlbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfbrh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2548 2280 30a24d6ff33872843a6abb8796f07675a5c708a640389a4f38c272905a247d8d.exe 29 PID 2280 wrote to memory of 2548 2280 30a24d6ff33872843a6abb8796f07675a5c708a640389a4f38c272905a247d8d.exe 29 PID 2280 wrote to memory of 2548 2280 30a24d6ff33872843a6abb8796f07675a5c708a640389a4f38c272905a247d8d.exe 29 PID 2280 wrote to memory of 2548 2280 30a24d6ff33872843a6abb8796f07675a5c708a640389a4f38c272905a247d8d.exe 29 PID 2548 wrote to memory of 3064 2548 nlnhblt.exe 30 PID 2548 wrote to memory of 3064 2548 nlnhblt.exe 30 PID 2548 wrote to memory of 3064 2548 nlnhblt.exe 30 PID 2548 wrote to memory of 3064 2548 nlnhblt.exe 30 PID 3064 wrote to memory of 2836 3064 pblpfbf.exe 31 PID 3064 wrote to memory of 2836 3064 pblpfbf.exe 31 PID 3064 wrote to memory of 2836 3064 pblpfbf.exe 31 PID 3064 wrote to memory of 2836 3064 pblpfbf.exe 31 PID 2836 wrote to memory of 2952 2836 jdljtj.exe 32 PID 2836 wrote to memory of 2952 2836 jdljtj.exe 32 PID 2836 wrote to memory of 2952 2836 jdljtj.exe 32 PID 2836 wrote to memory of 2952 2836 jdljtj.exe 32 PID 2952 wrote to memory of 2892 2952 hnpdx.exe 33 PID 2952 wrote to memory of 2892 2952 hnpdx.exe 33 PID 2952 wrote to memory of 2892 2952 hnpdx.exe 33 PID 2952 wrote to memory of 2892 2952 hnpdx.exe 33 PID 2892 wrote to memory of 2924 2892 rvlvrf.exe 34 PID 2892 wrote to memory of 2924 2892 rvlvrf.exe 34 PID 2892 wrote to memory of 2924 2892 rvlvrf.exe 34 PID 2892 wrote to memory of 2924 2892 rvlvrf.exe 34 PID 2924 wrote to memory of 2712 2924 dpdrhln.exe 35 PID 2924 wrote to memory of 2712 2924 dpdrhln.exe 35 PID 2924 wrote to memory of 2712 2924 dpdrhln.exe 35 PID 2924 wrote to memory of 2712 2924 dpdrhln.exe 35 PID 2712 wrote to memory of 2804 2712 ndvft.exe 36 PID 2712 wrote to memory of 2804 2712 ndvft.exe 36 PID 2712 wrote to memory of 2804 2712 ndvft.exe 36 PID 2712 wrote to memory of 2804 2712 ndvft.exe 36 PID 2804 wrote to memory of 2752 2804 pdnvpf.exe 37 PID 2804 wrote to memory of 2752 2804 pdnvpf.exe 37 PID 2804 wrote to memory of 2752 2804 pdnvpf.exe 37 PID 2804 wrote to memory of 2752 2804 pdnvpf.exe 37 PID 2752 wrote to memory of 2428 2752 rvvnrl.exe 38 PID 2752 wrote to memory of 2428 2752 rvvnrl.exe 38 PID 2752 wrote to memory of 2428 2752 rvvnrl.exe 38 PID 2752 wrote to memory of 2428 2752 rvvnrl.exe 38 PID 2428 wrote to memory of 2672 2428 lxhpj.exe 39 PID 2428 wrote to memory of 2672 2428 lxhpj.exe 39 PID 2428 wrote to memory of 2672 2428 lxhpj.exe 39 PID 2428 wrote to memory of 2672 2428 lxhpj.exe 39 PID 2672 wrote to memory of 1152 2672 tlhnl.exe 40 PID 2672 wrote to memory of 1152 2672 tlhnl.exe 40 PID 2672 wrote to memory of 1152 2672 tlhnl.exe 40 PID 2672 wrote to memory of 1152 2672 tlhnl.exe 40 PID 1152 wrote to memory of 1576 1152 dhjxfr.exe 41 PID 1152 wrote to memory of 1576 1152 dhjxfr.exe 41 PID 1152 wrote to memory of 1576 1152 dhjxfr.exe 41 PID 1152 wrote to memory of 1576 1152 dhjxfr.exe 41 PID 1576 wrote to memory of 3008 1576 ljxdbxj.exe 42 PID 1576 wrote to memory of 3008 1576 ljxdbxj.exe 42 PID 1576 wrote to memory of 3008 1576 ljxdbxj.exe 42 PID 1576 wrote to memory of 3008 1576 ljxdbxj.exe 42 PID 3008 wrote to memory of 948 3008 nvvtnnp.exe 43 PID 3008 wrote to memory of 948 3008 nvvtnnp.exe 43 PID 3008 wrote to memory of 948 3008 nvvtnnp.exe 43 PID 3008 wrote to memory of 948 3008 nvvtnnp.exe 43 PID 948 wrote to memory of 1464 948 pfxttpd.exe 44 PID 948 wrote to memory of 1464 948 pfxttpd.exe 44 PID 948 wrote to memory of 1464 948 pfxttpd.exe 44 PID 948 wrote to memory of 1464 948 pfxttpd.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\30a24d6ff33872843a6abb8796f07675a5c708a640389a4f38c272905a247d8d.exe"C:\Users\Admin\AppData\Local\Temp\30a24d6ff33872843a6abb8796f07675a5c708a640389a4f38c272905a247d8d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\nlnhblt.exec:\nlnhblt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\pblpfbf.exec:\pblpfbf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\jdljtj.exec:\jdljtj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\hnpdx.exec:\hnpdx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\rvlvrf.exec:\rvlvrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\dpdrhln.exec:\dpdrhln.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\ndvft.exec:\ndvft.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\pdnvpf.exec:\pdnvpf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\rvvnrl.exec:\rvvnrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\lxhpj.exec:\lxhpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\tlhnl.exec:\tlhnl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\dhjxfr.exec:\dhjxfr.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\ljxdbxj.exec:\ljxdbxj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\nvvtnnp.exec:\nvvtnnp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\pfxttpd.exec:\pfxttpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\fxfrt.exec:\fxfrt.exe17⤵
- Executes dropped EXE
PID:1464 -
\??\c:\jfdjlb.exec:\jfdjlb.exe18⤵
- Executes dropped EXE
PID:2944 -
\??\c:\bdvnbp.exec:\bdvnbp.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1072 -
\??\c:\tdxtjp.exec:\tdxtjp.exe20⤵
- Executes dropped EXE
PID:1632 -
\??\c:\trhlbhp.exec:\trhlbhp.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:320 -
\??\c:\jrlbhtr.exec:\jrlbhtr.exe22⤵
- Executes dropped EXE
PID:2584 -
\??\c:\ddjtvrd.exec:\ddjtvrd.exe23⤵
- Executes dropped EXE
PID:2276 -
\??\c:\vlhdltb.exec:\vlhdltb.exe24⤵
- Executes dropped EXE
PID:2132 -
\??\c:\tbjtrnv.exec:\tbjtrnv.exe25⤵
- Executes dropped EXE
PID:1624 -
\??\c:\bpbtrf.exec:\bpbtrf.exe26⤵
- Executes dropped EXE
PID:1540 -
\??\c:\fpnjxjr.exec:\fpnjxjr.exe27⤵
- Executes dropped EXE
PID:2232 -
\??\c:\nldbhdp.exec:\nldbhdp.exe28⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bpjnf.exec:\bpjnf.exe29⤵
- Executes dropped EXE
PID:1496 -
\??\c:\vbpfxf.exec:\vbpfxf.exe30⤵
- Executes dropped EXE
PID:1784 -
\??\c:\jhlblb.exec:\jhlblb.exe31⤵
- Executes dropped EXE
PID:2932 -
\??\c:\rrvnv.exec:\rrvnv.exe32⤵
- Executes dropped EXE
PID:972 -
\??\c:\tjrnb.exec:\tjrnb.exe33⤵
- Executes dropped EXE
PID:2624 -
\??\c:\xnjdxx.exec:\xnjdxx.exe34⤵
- Executes dropped EXE
PID:1108 -
\??\c:\pxfbh.exec:\pxfbh.exe35⤵
- Executes dropped EXE
PID:1616 -
\??\c:\lftpl.exec:\lftpl.exe36⤵
- Executes dropped EXE
PID:2264 -
\??\c:\lfxjdh.exec:\lfxjdh.exe37⤵
- Executes dropped EXE
PID:2368 -
\??\c:\rfjvtnp.exec:\rfjvtnp.exe38⤵
- Executes dropped EXE
PID:1716 -
\??\c:\hnbld.exec:\hnbld.exe39⤵
- Executes dropped EXE
PID:2000 -
\??\c:\vhnfn.exec:\vhnfn.exe40⤵
- Executes dropped EXE
PID:2548 -
\??\c:\ftbbll.exec:\ftbbll.exe41⤵
- Executes dropped EXE
PID:2556 -
\??\c:\fnpbv.exec:\fnpbv.exe42⤵
- Executes dropped EXE
PID:2896 -
\??\c:\fvjrx.exec:\fvjrx.exe43⤵
- Executes dropped EXE
PID:2148 -
\??\c:\vlndhpd.exec:\vlndhpd.exe44⤵
- Executes dropped EXE
PID:2560 -
\??\c:\vjxpvld.exec:\vjxpvld.exe45⤵
- Executes dropped EXE
PID:2160 -
\??\c:\flldbr.exec:\flldbr.exe46⤵
- Executes dropped EXE
PID:2892 -
\??\c:\dtbpfhh.exec:\dtbpfhh.exe47⤵
- Executes dropped EXE
PID:2864 -
\??\c:\nrbrtt.exec:\nrbrtt.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2692 -
\??\c:\rbbfphn.exec:\rbbfphn.exe49⤵
- Executes dropped EXE
PID:2708 -
\??\c:\dthhxnx.exec:\dthhxnx.exe50⤵
- Executes dropped EXE
PID:2024 -
\??\c:\phvrl.exec:\phvrl.exe51⤵
- Executes dropped EXE
PID:2752 -
\??\c:\xlxfnpn.exec:\xlxfnpn.exe52⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rrvhjtx.exec:\rrvhjtx.exe53⤵
- Executes dropped EXE
PID:908 -
\??\c:\plrlx.exec:\plrlx.exe54⤵
- Executes dropped EXE
PID:2780 -
\??\c:\nxnplp.exec:\nxnplp.exe55⤵
- Executes dropped EXE
PID:2092 -
\??\c:\vvdnn.exec:\vvdnn.exe56⤵
- Executes dropped EXE
PID:2108 -
\??\c:\dxjtpp.exec:\dxjtpp.exe57⤵
- Executes dropped EXE
PID:872 -
\??\c:\jntxt.exec:\jntxt.exe58⤵
- Executes dropped EXE
PID:1476 -
\??\c:\vxjhnb.exec:\vxjhnb.exe59⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hnvnfhx.exec:\hnvnfhx.exe60⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jvdfxbd.exec:\jvdfxbd.exe61⤵
- Executes dropped EXE
PID:3020 -
\??\c:\njfhddh.exec:\njfhddh.exe62⤵
- Executes dropped EXE
PID:2984 -
\??\c:\nfvnlr.exec:\nfvnlr.exe63⤵
- Executes dropped EXE
PID:1072 -
\??\c:\nhldlrn.exec:\nhldlrn.exe64⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vfddtj.exec:\vfddtj.exe65⤵
- Executes dropped EXE
PID:756 -
\??\c:\dhhlnl.exec:\dhhlnl.exe66⤵PID:320
-
\??\c:\vjbfdn.exec:\vjbfdn.exe67⤵PID:2544
-
\??\c:\rfpxhtj.exec:\rfpxhtj.exe68⤵PID:2584
-
\??\c:\hjfrpnx.exec:\hjfrpnx.exe69⤵PID:2276
-
\??\c:\xtnhb.exec:\xtnhb.exe70⤵PID:2060
-
\??\c:\hjttdl.exec:\hjttdl.exe71⤵PID:2492
-
\??\c:\dffrl.exec:\dffrl.exe72⤵PID:1144
-
\??\c:\lnlvh.exec:\lnlvh.exe73⤵PID:2392
-
\??\c:\lnnttt.exec:\lnnttt.exe74⤵PID:2496
-
\??\c:\ppfhht.exec:\ppfhht.exe75⤵
- System Location Discovery: System Language Discovery
PID:1888 -
\??\c:\rxlfnjn.exec:\rxlfnjn.exe76⤵PID:772
-
\??\c:\dvlfvn.exec:\dvlfvn.exe77⤵PID:1460
-
\??\c:\dtdhhbr.exec:\dtdhhbr.exe78⤵PID:1700
-
\??\c:\xvnbtr.exec:\xvnbtr.exe79⤵PID:1704
-
\??\c:\tlvphxx.exec:\tlvphxx.exe80⤵PID:2932
-
\??\c:\hlfnn.exec:\hlfnn.exe81⤵PID:2632
-
\??\c:\lljxp.exec:\lljxp.exe82⤵PID:2612
-
\??\c:\rpxlrd.exec:\rpxlrd.exe83⤵PID:1420
-
\??\c:\vdtfl.exec:\vdtfl.exe84⤵PID:1960
-
\??\c:\vdlbbl.exec:\vdlbbl.exe85⤵PID:2376
-
\??\c:\fpltbfd.exec:\fpltbfd.exe86⤵PID:2280
-
\??\c:\pvldjf.exec:\pvldjf.exe87⤵PID:2368
-
\??\c:\ltfdr.exec:\ltfdr.exe88⤵PID:2976
-
\??\c:\dbldv.exec:\dbldv.exe89⤵PID:3068
-
\??\c:\lptjj.exec:\lptjj.exe90⤵PID:2408
-
\??\c:\lvtpdnb.exec:\lvtpdnb.exe91⤵PID:3064
-
\??\c:\jttxlpd.exec:\jttxlpd.exe92⤵PID:2964
-
\??\c:\bxxxr.exec:\bxxxr.exe93⤵PID:2796
-
\??\c:\vtdbbtx.exec:\vtdbbtx.exe94⤵PID:2960
-
\??\c:\dtlvdj.exec:\dtlvdj.exe95⤵PID:2224
-
\??\c:\vtlpn.exec:\vtlpn.exe96⤵PID:3056
-
\??\c:\xxjvv.exec:\xxjvv.exe97⤵PID:2892
-
\??\c:\dtpbh.exec:\dtpbh.exe98⤵PID:1712
-
\??\c:\vtxrfr.exec:\vtxrfr.exe99⤵PID:2036
-
\??\c:\fdpdt.exec:\fdpdt.exe100⤵PID:2292
-
\??\c:\tbjftjh.exec:\tbjftjh.exe101⤵PID:2296
-
\??\c:\trdlddb.exec:\trdlddb.exe102⤵PID:2396
-
\??\c:\ppltpnf.exec:\ppltpnf.exe103⤵PID:2668
-
\??\c:\rbnlrj.exec:\rbnlrj.exe104⤵PID:1152
-
\??\c:\nlvdjj.exec:\nlvdjj.exe105⤵PID:2780
-
\??\c:\dbljr.exec:\dbljr.exe106⤵PID:2092
-
\??\c:\pjdnj.exec:\pjdnj.exe107⤵PID:2312
-
\??\c:\nvtfbj.exec:\nvtfbj.exe108⤵PID:2740
-
\??\c:\lrhlf.exec:\lrhlf.exe109⤵PID:236
-
\??\c:\ntfrh.exec:\ntfrh.exe110⤵PID:1464
-
\??\c:\xxdpt.exec:\xxdpt.exe111⤵PID:3036
-
\??\c:\jllxl.exec:\jllxl.exe112⤵PID:1640
-
\??\c:\hftjjj.exec:\hftjjj.exe113⤵PID:1988
-
\??\c:\pvnhd.exec:\pvnhd.exe114⤵PID:784
-
\??\c:\prhhrnj.exec:\prhhrnj.exe115⤵PID:2448
-
\??\c:\pvpxjn.exec:\pvpxjn.exe116⤵PID:2452
-
\??\c:\pfvlpt.exec:\pfvlpt.exe117⤵PID:2260
-
\??\c:\ljthtv.exec:\ljthtv.exe118⤵PID:2416
-
\??\c:\pprjh.exec:\pprjh.exe119⤵PID:2584
-
\??\c:\dlxbvd.exec:\dlxbvd.exe120⤵PID:1808
-
\??\c:\bpjjhv.exec:\bpjjhv.exe121⤵PID:2788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-