Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
af5db2664a151bcebaac00a6355efaf62fcc4a536103c030c3e4fb94afdb2f9a.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
af5db2664a151bcebaac00a6355efaf62fcc4a536103c030c3e4fb94afdb2f9a.exe
-
Size
455KB
-
MD5
4bed566b2149fed0c323bd73e2d77dd4
-
SHA1
49272a9ebcaac02d1aa6ac8950128971b257c473
-
SHA256
af5db2664a151bcebaac00a6355efaf62fcc4a536103c030c3e4fb94afdb2f9a
-
SHA512
ca356614d891875e0d3e71ffd46dae2407f4f3b9a2c9d7271b928ee97c09437c117a44550faf84a375ec223a04ccc6c802feac37360bf3e8d0f8acd4e7ff3dbd
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2108-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-42-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2872-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-73-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2760-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-174-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2196-182-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1644-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-238-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1308-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1172-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-355-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2764-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-470-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2704-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-548-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2212-606-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2652-686-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1016-913-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-951-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3064 bpfnppb.exe 2276 pjblnt.exe 2960 bxrvvp.exe 2872 pjfljnh.exe 3020 xlhdt.exe 2760 nphjdv.exe 2784 lvdrb.exe 2724 lthjpxf.exe 2180 nhhpf.exe 2404 vxbhfff.exe 1312 xvjbxx.exe 1472 jlfpnr.exe 3004 dpljb.exe 1208 tvjxfd.exe 2236 jrlbxn.exe 296 vfbldhj.exe 1708 fjjpdp.exe 2196 fxpjp.exe 2056 txlrr.exe 1644 jpttddx.exe 1816 rdnth.exe 1936 npnvbl.exe 2320 nvfvptb.exe 1308 nrtrt.exe 1464 hldhx.exe 932 hxvrbtn.exe 2204 dhdpl.exe 1180 htrbvtl.exe 1716 bbhbvdj.exe 1144 prnfd.exe 2672 tdhlxn.exe 1736 fbvtd.exe 2832 rrvlvf.exe 1172 hbthr.exe 2888 tvjjvtp.exe 2896 nrdfndd.exe 2992 fxxplf.exe 1468 dbblbx.exe 2776 vlddftj.exe 2764 lfvnth.exe 2792 pfpnbn.exe 2504 jjhxh.exe 1184 xjrhllt.exe 2580 tdhrlnt.exe 1600 tvlhpd.exe 2180 vbftrv.exe 3012 jrfdtjr.exe 3044 rvlhl.exe 3048 lnvxp.exe 2176 lhrpbt.exe 3004 jhnrfj.exe 2568 vdjrb.exe 2296 pdplhpt.exe 1248 bphnjh.exe 2280 dtbnnfr.exe 2304 dnbpb.exe 2440 hhrtlf.exe 2088 xpjtfl.exe 2704 ndvtv.exe 1136 vrxjtv.exe 1816 dnxtf.exe 2116 vrhvh.exe 2320 jrftbt.exe 1532 hnjbht.exe -
resource yara_rule behavioral1/memory/2108-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-875-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-900-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1016-913-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjfjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjtjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vptdpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jljlrnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpjxbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlbrjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndljbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnptvbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtvxpxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfdtnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlrlvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prvfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trrrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdnxdnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxbvnpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlfpnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttllt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vntjvlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvddtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btxhrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhjxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbfntp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlhttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfxhtnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdrnfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdtbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txrtvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvjfddf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dftpfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhfxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdprfvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrjbvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxjhdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbldf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlxpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlfpnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhnbhfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvtxbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnxlnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dljfdlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2108 wrote to memory of 3064 2108 af5db2664a151bcebaac00a6355efaf62fcc4a536103c030c3e4fb94afdb2f9a.exe 30 PID 2108 wrote to memory of 3064 2108 af5db2664a151bcebaac00a6355efaf62fcc4a536103c030c3e4fb94afdb2f9a.exe 30 PID 2108 wrote to memory of 3064 2108 af5db2664a151bcebaac00a6355efaf62fcc4a536103c030c3e4fb94afdb2f9a.exe 30 PID 2108 wrote to memory of 3064 2108 af5db2664a151bcebaac00a6355efaf62fcc4a536103c030c3e4fb94afdb2f9a.exe 30 PID 3064 wrote to memory of 2276 3064 bpfnppb.exe 31 PID 3064 wrote to memory of 2276 3064 bpfnppb.exe 31 PID 3064 wrote to memory of 2276 3064 bpfnppb.exe 31 PID 3064 wrote to memory of 2276 3064 bpfnppb.exe 31 PID 2276 wrote to memory of 2960 2276 pjblnt.exe 32 PID 2276 wrote to memory of 2960 2276 pjblnt.exe 32 PID 2276 wrote to memory of 2960 2276 pjblnt.exe 32 PID 2276 wrote to memory of 2960 2276 pjblnt.exe 32 PID 2960 wrote to memory of 2872 2960 bxrvvp.exe 33 PID 2960 wrote to memory of 2872 2960 bxrvvp.exe 33 PID 2960 wrote to memory of 2872 2960 bxrvvp.exe 33 PID 2960 wrote to memory of 2872 2960 bxrvvp.exe 33 PID 2872 wrote to memory of 3020 2872 pjfljnh.exe 34 PID 2872 wrote to memory of 3020 2872 pjfljnh.exe 34 PID 2872 wrote to memory of 3020 2872 pjfljnh.exe 34 PID 2872 wrote to memory of 3020 2872 pjfljnh.exe 34 PID 3020 wrote to memory of 2760 3020 xlhdt.exe 35 PID 3020 wrote to memory of 2760 3020 xlhdt.exe 35 PID 3020 wrote to memory of 2760 3020 xlhdt.exe 35 PID 3020 wrote to memory of 2760 3020 xlhdt.exe 35 PID 2760 wrote to memory of 2784 2760 nphjdv.exe 36 PID 2760 wrote to memory of 2784 2760 nphjdv.exe 36 PID 2760 wrote to memory of 2784 2760 nphjdv.exe 36 PID 2760 wrote to memory of 2784 2760 nphjdv.exe 36 PID 2784 wrote to memory of 2724 2784 lvdrb.exe 37 PID 2784 wrote to memory of 2724 2784 lvdrb.exe 37 PID 2784 wrote to memory of 2724 2784 lvdrb.exe 37 PID 2784 wrote to memory of 2724 2784 lvdrb.exe 37 PID 2724 wrote to memory of 2180 2724 lthjpxf.exe 38 PID 2724 wrote to memory of 2180 2724 lthjpxf.exe 38 PID 2724 wrote to memory of 2180 2724 lthjpxf.exe 38 PID 2724 wrote to memory of 2180 2724 lthjpxf.exe 38 PID 2180 wrote to memory of 2404 2180 nhhpf.exe 39 PID 2180 wrote to memory of 2404 2180 nhhpf.exe 39 PID 2180 wrote to memory of 2404 2180 nhhpf.exe 39 PID 2180 wrote to memory of 2404 2180 nhhpf.exe 39 PID 2404 wrote to memory of 1312 2404 vxbhfff.exe 40 PID 2404 wrote to memory of 1312 2404 vxbhfff.exe 40 PID 2404 wrote to memory of 1312 2404 vxbhfff.exe 40 PID 2404 wrote to memory of 1312 2404 vxbhfff.exe 40 PID 1312 wrote to memory of 1472 1312 xvjbxx.exe 41 PID 1312 wrote to memory of 1472 1312 xvjbxx.exe 41 PID 1312 wrote to memory of 1472 1312 xvjbxx.exe 41 PID 1312 wrote to memory of 1472 1312 xvjbxx.exe 41 PID 1472 wrote to memory of 3004 1472 jlfpnr.exe 42 PID 1472 wrote to memory of 3004 1472 jlfpnr.exe 42 PID 1472 wrote to memory of 3004 1472 jlfpnr.exe 42 PID 1472 wrote to memory of 3004 1472 jlfpnr.exe 42 PID 3004 wrote to memory of 1208 3004 dpljb.exe 43 PID 3004 wrote to memory of 1208 3004 dpljb.exe 43 PID 3004 wrote to memory of 1208 3004 dpljb.exe 43 PID 3004 wrote to memory of 1208 3004 dpljb.exe 43 PID 1208 wrote to memory of 2236 1208 tvjxfd.exe 44 PID 1208 wrote to memory of 2236 1208 tvjxfd.exe 44 PID 1208 wrote to memory of 2236 1208 tvjxfd.exe 44 PID 1208 wrote to memory of 2236 1208 tvjxfd.exe 44 PID 2236 wrote to memory of 296 2236 jrlbxn.exe 45 PID 2236 wrote to memory of 296 2236 jrlbxn.exe 45 PID 2236 wrote to memory of 296 2236 jrlbxn.exe 45 PID 2236 wrote to memory of 296 2236 jrlbxn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\af5db2664a151bcebaac00a6355efaf62fcc4a536103c030c3e4fb94afdb2f9a.exe"C:\Users\Admin\AppData\Local\Temp\af5db2664a151bcebaac00a6355efaf62fcc4a536103c030c3e4fb94afdb2f9a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\bpfnppb.exec:\bpfnppb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\pjblnt.exec:\pjblnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\bxrvvp.exec:\bxrvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\pjfljnh.exec:\pjfljnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\xlhdt.exec:\xlhdt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\nphjdv.exec:\nphjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\lvdrb.exec:\lvdrb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\lthjpxf.exec:\lthjpxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\nhhpf.exec:\nhhpf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\vxbhfff.exec:\vxbhfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\xvjbxx.exec:\xvjbxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\jlfpnr.exec:\jlfpnr.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\dpljb.exec:\dpljb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\tvjxfd.exec:\tvjxfd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\jrlbxn.exec:\jrlbxn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\vfbldhj.exec:\vfbldhj.exe17⤵
- Executes dropped EXE
PID:296 -
\??\c:\fjjpdp.exec:\fjjpdp.exe18⤵
- Executes dropped EXE
PID:1708 -
\??\c:\fxpjp.exec:\fxpjp.exe19⤵
- Executes dropped EXE
PID:2196 -
\??\c:\txlrr.exec:\txlrr.exe20⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jpttddx.exec:\jpttddx.exe21⤵
- Executes dropped EXE
PID:1644 -
\??\c:\rdnth.exec:\rdnth.exe22⤵
- Executes dropped EXE
PID:1816 -
\??\c:\npnvbl.exec:\npnvbl.exe23⤵
- Executes dropped EXE
PID:1936 -
\??\c:\nvfvptb.exec:\nvfvptb.exe24⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nrtrt.exec:\nrtrt.exe25⤵
- Executes dropped EXE
PID:1308 -
\??\c:\hldhx.exec:\hldhx.exe26⤵
- Executes dropped EXE
PID:1464 -
\??\c:\hxvrbtn.exec:\hxvrbtn.exe27⤵
- Executes dropped EXE
PID:932 -
\??\c:\dhdpl.exec:\dhdpl.exe28⤵
- Executes dropped EXE
PID:2204 -
\??\c:\htrbvtl.exec:\htrbvtl.exe29⤵
- Executes dropped EXE
PID:1180 -
\??\c:\bbhbvdj.exec:\bbhbvdj.exe30⤵
- Executes dropped EXE
PID:1716 -
\??\c:\prnfd.exec:\prnfd.exe31⤵
- Executes dropped EXE
PID:1144 -
\??\c:\tdhlxn.exec:\tdhlxn.exe32⤵
- Executes dropped EXE
PID:2672 -
\??\c:\fbvtd.exec:\fbvtd.exe33⤵
- Executes dropped EXE
PID:1736 -
\??\c:\rrvlvf.exec:\rrvlvf.exe34⤵
- Executes dropped EXE
PID:2832 -
\??\c:\hbthr.exec:\hbthr.exe35⤵
- Executes dropped EXE
PID:1172 -
\??\c:\tvjjvtp.exec:\tvjjvtp.exe36⤵
- Executes dropped EXE
PID:2888 -
\??\c:\nrdfndd.exec:\nrdfndd.exe37⤵
- Executes dropped EXE
PID:2896 -
\??\c:\fxxplf.exec:\fxxplf.exe38⤵
- Executes dropped EXE
PID:2992 -
\??\c:\dbblbx.exec:\dbblbx.exe39⤵
- Executes dropped EXE
PID:1468 -
\??\c:\vlddftj.exec:\vlddftj.exe40⤵
- Executes dropped EXE
PID:2776 -
\??\c:\lfvnth.exec:\lfvnth.exe41⤵
- Executes dropped EXE
PID:2764 -
\??\c:\pfpnbn.exec:\pfpnbn.exe42⤵
- Executes dropped EXE
PID:2792 -
\??\c:\jjhxh.exec:\jjhxh.exe43⤵
- Executes dropped EXE
PID:2504 -
\??\c:\xjrhllt.exec:\xjrhllt.exe44⤵
- Executes dropped EXE
PID:1184 -
\??\c:\tdhrlnt.exec:\tdhrlnt.exe45⤵
- Executes dropped EXE
PID:2580 -
\??\c:\tvlhpd.exec:\tvlhpd.exe46⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vbftrv.exec:\vbftrv.exe47⤵
- Executes dropped EXE
PID:2180 -
\??\c:\jrfdtjr.exec:\jrfdtjr.exe48⤵
- Executes dropped EXE
PID:3012 -
\??\c:\rvlhl.exec:\rvlhl.exe49⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lnvxp.exec:\lnvxp.exe50⤵
- Executes dropped EXE
PID:3048 -
\??\c:\lhrpbt.exec:\lhrpbt.exe51⤵
- Executes dropped EXE
PID:2176 -
\??\c:\jhnrfj.exec:\jhnrfj.exe52⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vdjrb.exec:\vdjrb.exe53⤵
- Executes dropped EXE
PID:2568 -
\??\c:\pdplhpt.exec:\pdplhpt.exe54⤵
- Executes dropped EXE
PID:2296 -
\??\c:\bphnjh.exec:\bphnjh.exe55⤵
- Executes dropped EXE
PID:1248 -
\??\c:\dtbnnfr.exec:\dtbnnfr.exe56⤵
- Executes dropped EXE
PID:2280 -
\??\c:\dnbpb.exec:\dnbpb.exe57⤵
- Executes dropped EXE
PID:2304 -
\??\c:\hhrtlf.exec:\hhrtlf.exe58⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xpjtfl.exec:\xpjtfl.exe59⤵
- Executes dropped EXE
PID:2088 -
\??\c:\ndvtv.exec:\ndvtv.exe60⤵
- Executes dropped EXE
PID:2704 -
\??\c:\vrxjtv.exec:\vrxjtv.exe61⤵
- Executes dropped EXE
PID:1136 -
\??\c:\dnxtf.exec:\dnxtf.exe62⤵
- Executes dropped EXE
PID:1816 -
\??\c:\vrhvh.exec:\vrhvh.exe63⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jrftbt.exec:\jrftbt.exe64⤵
- Executes dropped EXE
PID:2320 -
\??\c:\hnjbht.exec:\hnjbht.exe65⤵
- Executes dropped EXE
PID:1532 -
\??\c:\ddnrtv.exec:\ddnrtv.exe66⤵PID:1804
-
\??\c:\vpfjl.exec:\vpfjl.exe67⤵PID:1596
-
\??\c:\xxpnp.exec:\xxpnp.exe68⤵PID:1568
-
\??\c:\txlxxp.exec:\txlxxp.exe69⤵PID:936
-
\??\c:\tbfxrnj.exec:\tbfxrnj.exe70⤵PID:756
-
\??\c:\nljvv.exec:\nljvv.exe71⤵PID:2684
-
\??\c:\pthxfh.exec:\pthxfh.exe72⤵PID:1716
-
\??\c:\tlhtvl.exec:\tlhtvl.exe73⤵PID:892
-
\??\c:\hpphb.exec:\hpphb.exe74⤵PID:2572
-
\??\c:\nftxlp.exec:\nftxlp.exe75⤵PID:2108
-
\??\c:\vddnvx.exec:\vddnvx.exe76⤵PID:1560
-
\??\c:\jhnbhfp.exec:\jhnbhfp.exe77⤵
- System Location Discovery: System Language Discovery
PID:2212 -
\??\c:\hplrh.exec:\hplrh.exe78⤵PID:2884
-
\??\c:\ffrlr.exec:\ffrlr.exe79⤵PID:2888
-
\??\c:\rlvfl.exec:\rlvfl.exe80⤵PID:2160
-
\??\c:\lhnflx.exec:\lhnflx.exe81⤵PID:2992
-
\??\c:\xvdnnxt.exec:\xvdnnxt.exe82⤵PID:2748
-
\??\c:\pnhfdj.exec:\pnhfdj.exe83⤵PID:2904
-
\??\c:\xnbldhj.exec:\xnbldhj.exe84⤵PID:3020
-
\??\c:\djhxnld.exec:\djhxnld.exe85⤵PID:2356
-
\??\c:\btbpd.exec:\btbpd.exe86⤵PID:640
-
\??\c:\bdxjj.exec:\bdxjj.exe87⤵PID:1168
-
\??\c:\nnnnf.exec:\nnnnf.exe88⤵PID:776
-
\??\c:\bbxbh.exec:\bbxbh.exe89⤵PID:2648
-
\??\c:\hvjdphp.exec:\hvjdphp.exe90⤵PID:2652
-
\??\c:\hbtnxhr.exec:\hbtnxhr.exe91⤵PID:2516
-
\??\c:\bvdrtdp.exec:\bvdrtdp.exe92⤵PID:3060
-
\??\c:\vbrtt.exec:\vbrtt.exe93⤵PID:2340
-
\??\c:\nxdjxjf.exec:\nxdjxjf.exe94⤵PID:1068
-
\??\c:\fhbvv.exec:\fhbvv.exe95⤵PID:3032
-
\??\c:\dltnh.exec:\dltnh.exe96⤵PID:2264
-
\??\c:\nlllp.exec:\nlllp.exe97⤵PID:560
-
\??\c:\tnxddd.exec:\tnxddd.exe98⤵PID:1496
-
\??\c:\blbjjnb.exec:\blbjjnb.exe99⤵PID:676
-
\??\c:\hdvtr.exec:\hdvtr.exe100⤵PID:2292
-
\??\c:\pthdn.exec:\pthdn.exe101⤵PID:2196
-
\??\c:\xptnv.exec:\xptnv.exe102⤵PID:2512
-
\??\c:\rhfnvn.exec:\rhfnvn.exe103⤵PID:2712
-
\??\c:\nttjr.exec:\nttjr.exe104⤵PID:1900
-
\??\c:\xjhlvfj.exec:\xjhlvfj.exe105⤵PID:960
-
\??\c:\lrxflj.exec:\lrxflj.exe106⤵PID:1632
-
\??\c:\rhlftdd.exec:\rhlftdd.exe107⤵PID:708
-
\??\c:\xvxhndx.exec:\xvxhndx.exe108⤵PID:620
-
\??\c:\ptdfp.exec:\ptdfp.exe109⤵PID:924
-
\??\c:\prrbdrn.exec:\prrbdrn.exe110⤵PID:2320
-
\??\c:\rpjrj.exec:\rpjrj.exe111⤵PID:2668
-
\??\c:\lhnrj.exec:\lhnrj.exe112⤵PID:236
-
\??\c:\jvhpj.exec:\jvhpj.exe113⤵PID:2204
-
\??\c:\fbxnjvf.exec:\fbxnjvf.exe114⤵PID:1180
-
\??\c:\thvbbp.exec:\thvbbp.exe115⤵PID:2676
-
\??\c:\hdptbjl.exec:\hdptbjl.exe116⤵PID:2392
-
\??\c:\xlbrjh.exec:\xlbrjh.exe117⤵
- System Location Discovery: System Language Discovery
PID:1288 -
\??\c:\vtjhpf.exec:\vtjhpf.exe118⤵PID:1040
-
\??\c:\rxjrjx.exec:\rxjrjx.exe119⤵PID:2408
-
\??\c:\vjvddtx.exec:\vjvddtx.exe120⤵
- System Location Discovery: System Language Discovery
PID:2124 -
\??\c:\thfnt.exec:\thfnt.exe121⤵PID:1696
-
\??\c:\bpffl.exec:\bpffl.exe122⤵PID:1592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-