Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 09:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3a80e1d2e269b3b21e8b03fe2cca82692eaf86f00c94c60f43641858da2160d2N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
3a80e1d2e269b3b21e8b03fe2cca82692eaf86f00c94c60f43641858da2160d2N.exe
-
Size
454KB
-
MD5
395efe4a4df26e6eff64afcddb882e80
-
SHA1
83a2a5bf5cdeac831ed55744cc64b20980f57ffc
-
SHA256
3a80e1d2e269b3b21e8b03fe2cca82692eaf86f00c94c60f43641858da2160d2
-
SHA512
3e2c7319acb67e97e96d383c2493be70a2c1863db85d4ad8934a8135928474729b8ff583a7b0d62840fdc03d6c7bd19c5ded04049d52ebbb556e8dc8c47a3e23
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeH5:q7Tc2NYHUrAwfMp3CDH5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/108-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/636-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-104-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3016-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-222-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1948-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1460-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-276-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2344-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-318-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2408-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-374-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2704-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-546-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2576-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/608-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-576-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2728-652-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/808-784-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 636 hfdtldv.exe 2976 lxnnbvl.exe 2424 tbpnjf.exe 2904 frdrltp.exe 2696 xvdnprv.exe 2224 dfrdvbp.exe 2732 bvvpvd.exe 896 npdxnbr.exe 2288 btlxfvv.exe 1620 lbhxtrx.exe 3016 phnvtjt.exe 1576 rhrfbft.exe 1680 nljbjh.exe 1476 nxhxvh.exe 236 jfhjbj.exe 3040 rxpvblh.exe 1984 ftrbl.exe 2568 xhpff.exe 2452 tprvv.exe 2536 htvhh.exe 2268 nnpvdt.exe 1932 lhhbl.exe 2420 hltvvp.exe 2212 dhllljj.exe 1948 prvlvdh.exe 1496 pnvlbr.exe 1460 ltjlht.exe 2044 trjjvb.exe 2220 dhvtlr.exe 2464 lvnnn.exe 1108 bnpfhf.exe 2608 hvvjp.exe 2344 xbldfl.exe 2000 rpjdft.exe 2332 hhhxlvd.exe 2528 tdnhn.exe 2408 vlbvhb.exe 2896 vfbjn.exe 2148 fhjhf.exe 2560 dtnpbr.exe 2280 dhxlx.exe 2224 jjxprxb.exe 2684 hlftvb.exe 2704 thfdv.exe 2024 blvpf.exe 2292 dxpvtnv.exe 1620 rfvvdh.exe 2760 tvjljl.exe 3016 xvrllh.exe 1576 vfjpx.exe 2312 xffnhnj.exe 1680 fpnhvj.exe 1208 jdtpdd.exe 3044 tlhld.exe 3040 bbntx.exe 1632 fpdpjt.exe 2184 dpjhrbd.exe 320 bbftxx.exe 2452 htfpl.exe 2536 brlbnd.exe 952 nhbvpnj.exe 1624 hxblld.exe 1652 fnxrvr.exe 2420 hhlxlpb.exe -
resource yara_rule behavioral1/memory/108-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/636-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-652-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/3060-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-784-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-797-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-843-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2376-865-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbdrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpxxnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnhtjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjhhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trttj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpltjtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrndp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdbhlnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvpnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnntxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlvtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhrvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbpvhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvfxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbtftvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpjdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxxflp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdxtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpprpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phdthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pblnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnntp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlnld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxbhhtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxbpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvnnrnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljxjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phhddbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhxdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljvptnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvhrtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftnnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htfnr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 108 wrote to memory of 636 108 3a80e1d2e269b3b21e8b03fe2cca82692eaf86f00c94c60f43641858da2160d2N.exe 29 PID 108 wrote to memory of 636 108 3a80e1d2e269b3b21e8b03fe2cca82692eaf86f00c94c60f43641858da2160d2N.exe 29 PID 108 wrote to memory of 636 108 3a80e1d2e269b3b21e8b03fe2cca82692eaf86f00c94c60f43641858da2160d2N.exe 29 PID 108 wrote to memory of 636 108 3a80e1d2e269b3b21e8b03fe2cca82692eaf86f00c94c60f43641858da2160d2N.exe 29 PID 636 wrote to memory of 2976 636 hfdtldv.exe 30 PID 636 wrote to memory of 2976 636 hfdtldv.exe 30 PID 636 wrote to memory of 2976 636 hfdtldv.exe 30 PID 636 wrote to memory of 2976 636 hfdtldv.exe 30 PID 2976 wrote to memory of 2424 2976 lxnnbvl.exe 31 PID 2976 wrote to memory of 2424 2976 lxnnbvl.exe 31 PID 2976 wrote to memory of 2424 2976 lxnnbvl.exe 31 PID 2976 wrote to memory of 2424 2976 lxnnbvl.exe 31 PID 2424 wrote to memory of 2904 2424 tbpnjf.exe 32 PID 2424 wrote to memory of 2904 2424 tbpnjf.exe 32 PID 2424 wrote to memory of 2904 2424 tbpnjf.exe 32 PID 2424 wrote to memory of 2904 2424 tbpnjf.exe 32 PID 2904 wrote to memory of 2696 2904 frdrltp.exe 33 PID 2904 wrote to memory of 2696 2904 frdrltp.exe 33 PID 2904 wrote to memory of 2696 2904 frdrltp.exe 33 PID 2904 wrote to memory of 2696 2904 frdrltp.exe 33 PID 2696 wrote to memory of 2224 2696 xvdnprv.exe 34 PID 2696 wrote to memory of 2224 2696 xvdnprv.exe 34 PID 2696 wrote to memory of 2224 2696 xvdnprv.exe 34 PID 2696 wrote to memory of 2224 2696 xvdnprv.exe 34 PID 2224 wrote to memory of 2732 2224 dfrdvbp.exe 35 PID 2224 wrote to memory of 2732 2224 dfrdvbp.exe 35 PID 2224 wrote to memory of 2732 2224 dfrdvbp.exe 35 PID 2224 wrote to memory of 2732 2224 dfrdvbp.exe 35 PID 2732 wrote to memory of 896 2732 bvvpvd.exe 36 PID 2732 wrote to memory of 896 2732 bvvpvd.exe 36 PID 2732 wrote to memory of 896 2732 bvvpvd.exe 36 PID 2732 wrote to memory of 896 2732 bvvpvd.exe 36 PID 896 wrote to memory of 2288 896 npdxnbr.exe 37 PID 896 wrote to memory of 2288 896 npdxnbr.exe 37 PID 896 wrote to memory of 2288 896 npdxnbr.exe 37 PID 896 wrote to memory of 2288 896 npdxnbr.exe 37 PID 2288 wrote to memory of 1620 2288 btlxfvv.exe 38 PID 2288 wrote to memory of 1620 2288 btlxfvv.exe 38 PID 2288 wrote to memory of 1620 2288 btlxfvv.exe 38 PID 2288 wrote to memory of 1620 2288 btlxfvv.exe 38 PID 1620 wrote to memory of 3016 1620 lbhxtrx.exe 39 PID 1620 wrote to memory of 3016 1620 lbhxtrx.exe 39 PID 1620 wrote to memory of 3016 1620 lbhxtrx.exe 39 PID 1620 wrote to memory of 3016 1620 lbhxtrx.exe 39 PID 3016 wrote to memory of 1576 3016 phnvtjt.exe 40 PID 3016 wrote to memory of 1576 3016 phnvtjt.exe 40 PID 3016 wrote to memory of 1576 3016 phnvtjt.exe 40 PID 3016 wrote to memory of 1576 3016 phnvtjt.exe 40 PID 1576 wrote to memory of 1680 1576 rhrfbft.exe 41 PID 1576 wrote to memory of 1680 1576 rhrfbft.exe 41 PID 1576 wrote to memory of 1680 1576 rhrfbft.exe 41 PID 1576 wrote to memory of 1680 1576 rhrfbft.exe 41 PID 1680 wrote to memory of 1476 1680 nljbjh.exe 42 PID 1680 wrote to memory of 1476 1680 nljbjh.exe 42 PID 1680 wrote to memory of 1476 1680 nljbjh.exe 42 PID 1680 wrote to memory of 1476 1680 nljbjh.exe 42 PID 1476 wrote to memory of 236 1476 nxhxvh.exe 43 PID 1476 wrote to memory of 236 1476 nxhxvh.exe 43 PID 1476 wrote to memory of 236 1476 nxhxvh.exe 43 PID 1476 wrote to memory of 236 1476 nxhxvh.exe 43 PID 236 wrote to memory of 3040 236 jfhjbj.exe 44 PID 236 wrote to memory of 3040 236 jfhjbj.exe 44 PID 236 wrote to memory of 3040 236 jfhjbj.exe 44 PID 236 wrote to memory of 3040 236 jfhjbj.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a80e1d2e269b3b21e8b03fe2cca82692eaf86f00c94c60f43641858da2160d2N.exe"C:\Users\Admin\AppData\Local\Temp\3a80e1d2e269b3b21e8b03fe2cca82692eaf86f00c94c60f43641858da2160d2N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:108 -
\??\c:\hfdtldv.exec:\hfdtldv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\lxnnbvl.exec:\lxnnbvl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\tbpnjf.exec:\tbpnjf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\frdrltp.exec:\frdrltp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\xvdnprv.exec:\xvdnprv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\dfrdvbp.exec:\dfrdvbp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\bvvpvd.exec:\bvvpvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\npdxnbr.exec:\npdxnbr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\btlxfvv.exec:\btlxfvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\lbhxtrx.exec:\lbhxtrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\phnvtjt.exec:\phnvtjt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\rhrfbft.exec:\rhrfbft.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\nljbjh.exec:\nljbjh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\nxhxvh.exec:\nxhxvh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\jfhjbj.exec:\jfhjbj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
\??\c:\rxpvblh.exec:\rxpvblh.exe17⤵
- Executes dropped EXE
PID:3040 -
\??\c:\ftrbl.exec:\ftrbl.exe18⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xhpff.exec:\xhpff.exe19⤵
- Executes dropped EXE
PID:2568 -
\??\c:\tprvv.exec:\tprvv.exe20⤵
- Executes dropped EXE
PID:2452 -
\??\c:\htvhh.exec:\htvhh.exe21⤵
- Executes dropped EXE
PID:2536 -
\??\c:\nnpvdt.exec:\nnpvdt.exe22⤵
- Executes dropped EXE
PID:2268 -
\??\c:\lhhbl.exec:\lhhbl.exe23⤵
- Executes dropped EXE
PID:1932 -
\??\c:\hltvvp.exec:\hltvvp.exe24⤵
- Executes dropped EXE
PID:2420 -
\??\c:\dhllljj.exec:\dhllljj.exe25⤵
- Executes dropped EXE
PID:2212 -
\??\c:\prvlvdh.exec:\prvlvdh.exe26⤵
- Executes dropped EXE
PID:1948 -
\??\c:\pnvlbr.exec:\pnvlbr.exe27⤵
- Executes dropped EXE
PID:1496 -
\??\c:\ltjlht.exec:\ltjlht.exe28⤵
- Executes dropped EXE
PID:1460 -
\??\c:\trjjvb.exec:\trjjvb.exe29⤵
- Executes dropped EXE
PID:2044 -
\??\c:\dhvtlr.exec:\dhvtlr.exe30⤵
- Executes dropped EXE
PID:2220 -
\??\c:\lvnnn.exec:\lvnnn.exe31⤵
- Executes dropped EXE
PID:2464 -
\??\c:\bnpfhf.exec:\bnpfhf.exe32⤵
- Executes dropped EXE
PID:1108 -
\??\c:\hvvjp.exec:\hvvjp.exe33⤵
- Executes dropped EXE
PID:2608 -
\??\c:\xbldfl.exec:\xbldfl.exe34⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rpjdft.exec:\rpjdft.exe35⤵
- Executes dropped EXE
PID:2000 -
\??\c:\hhhxlvd.exec:\hhhxlvd.exe36⤵
- Executes dropped EXE
PID:2332 -
\??\c:\tdnhn.exec:\tdnhn.exe37⤵
- Executes dropped EXE
PID:2528 -
\??\c:\vlbvhb.exec:\vlbvhb.exe38⤵
- Executes dropped EXE
PID:2408 -
\??\c:\vfbjn.exec:\vfbjn.exe39⤵
- Executes dropped EXE
PID:2896 -
\??\c:\fhjhf.exec:\fhjhf.exe40⤵
- Executes dropped EXE
PID:2148 -
\??\c:\dtnpbr.exec:\dtnpbr.exe41⤵
- Executes dropped EXE
PID:2560 -
\??\c:\dhxlx.exec:\dhxlx.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2280 -
\??\c:\jjxprxb.exec:\jjxprxb.exe43⤵
- Executes dropped EXE
PID:2224 -
\??\c:\hlftvb.exec:\hlftvb.exe44⤵
- Executes dropped EXE
PID:2684 -
\??\c:\thfdv.exec:\thfdv.exe45⤵
- Executes dropped EXE
PID:2704 -
\??\c:\blvpf.exec:\blvpf.exe46⤵
- Executes dropped EXE
PID:2024 -
\??\c:\dxpvtnv.exec:\dxpvtnv.exe47⤵
- Executes dropped EXE
PID:2292 -
\??\c:\rfvvdh.exec:\rfvvdh.exe48⤵
- Executes dropped EXE
PID:1620 -
\??\c:\tvjljl.exec:\tvjljl.exe49⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xvrllh.exec:\xvrllh.exe50⤵
- Executes dropped EXE
PID:3016 -
\??\c:\vfjpx.exec:\vfjpx.exe51⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xffnhnj.exec:\xffnhnj.exe52⤵
- Executes dropped EXE
PID:2312 -
\??\c:\fpnhvj.exec:\fpnhvj.exe53⤵
- Executes dropped EXE
PID:1680 -
\??\c:\jdtpdd.exec:\jdtpdd.exe54⤵
- Executes dropped EXE
PID:1208 -
\??\c:\tlhld.exec:\tlhld.exe55⤵
- Executes dropped EXE
PID:3044 -
\??\c:\bbntx.exec:\bbntx.exe56⤵
- Executes dropped EXE
PID:3040 -
\??\c:\fpdpjt.exec:\fpdpjt.exe57⤵
- Executes dropped EXE
PID:1632 -
\??\c:\dpjhrbd.exec:\dpjhrbd.exe58⤵
- Executes dropped EXE
PID:2184 -
\??\c:\bbftxx.exec:\bbftxx.exe59⤵
- Executes dropped EXE
PID:320 -
\??\c:\htfpl.exec:\htfpl.exe60⤵
- Executes dropped EXE
PID:2452 -
\??\c:\brlbnd.exec:\brlbnd.exe61⤵
- Executes dropped EXE
PID:2536 -
\??\c:\nhbvpnj.exec:\nhbvpnj.exe62⤵
- Executes dropped EXE
PID:952 -
\??\c:\hxblld.exec:\hxblld.exe63⤵
- Executes dropped EXE
PID:1624 -
\??\c:\fnxrvr.exec:\fnxrvr.exe64⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hhlxlpb.exec:\hhlxlpb.exe65⤵
- Executes dropped EXE
PID:2420 -
\??\c:\dthptp.exec:\dthptp.exe66⤵PID:1056
-
\??\c:\hlnvvt.exec:\hlnvvt.exe67⤵PID:1548
-
\??\c:\hjhlx.exec:\hjhlx.exe68⤵PID:1948
-
\??\c:\dnxdtt.exec:\dnxdtt.exe69⤵PID:1784
-
\??\c:\xnhtp.exec:\xnhtp.exe70⤵PID:1416
-
\??\c:\fdlbxp.exec:\fdlbxp.exe71⤵PID:1180
-
\??\c:\ljffr.exec:\ljffr.exe72⤵PID:608
-
\??\c:\bfxlnl.exec:\bfxlnl.exe73⤵PID:2576
-
\??\c:\fplbb.exec:\fplbb.exe74⤵PID:1420
-
\??\c:\vpvhl.exec:\vpvhl.exe75⤵PID:672
-
\??\c:\brvxfrl.exec:\brvxfrl.exe76⤵PID:2608
-
\??\c:\vdrpr.exec:\vdrpr.exe77⤵PID:1608
-
\??\c:\vjdbd.exec:\vjdbd.exe78⤵PID:1600
-
\??\c:\rbxvv.exec:\rbxvv.exe79⤵PID:1716
-
\??\c:\pdfndl.exec:\pdfndl.exe80⤵PID:1372
-
\??\c:\dvjtntr.exec:\dvjtntr.exe81⤵PID:2408
-
\??\c:\jxrtn.exec:\jxrtn.exe82⤵PID:2796
-
\??\c:\nlprj.exec:\nlprj.exe83⤵PID:2148
-
\??\c:\flrbp.exec:\flrbp.exe84⤵PID:2724
-
\??\c:\xvldl.exec:\xvldl.exe85⤵PID:2856
-
\??\c:\lxdtl.exec:\lxdtl.exe86⤵PID:2728
-
\??\c:\vhhrpft.exec:\vhhrpft.exe87⤵PID:2732
-
\??\c:\fltvrx.exec:\fltvrx.exe88⤵PID:2768
-
\??\c:\nblpl.exec:\nblpl.exe89⤵PID:2668
-
\??\c:\jprvb.exec:\jprvb.exe90⤵PID:2296
-
\??\c:\xdbjvfr.exec:\xdbjvfr.exe91⤵PID:3060
-
\??\c:\xbvhf.exec:\xbvhf.exe92⤵PID:1424
-
\??\c:\tnvnvb.exec:\tnvnvb.exe93⤵PID:1732
-
\??\c:\vvlfb.exec:\vvlfb.exe94⤵PID:1120
-
\??\c:\ttbxvb.exec:\ttbxvb.exe95⤵PID:2676
-
\??\c:\lpnfpj.exec:\lpnfpj.exe96⤵PID:3004
-
\??\c:\vxtfhth.exec:\vxtfhth.exe97⤵PID:2984
-
\??\c:\fnpfpvp.exec:\fnpfpvp.exe98⤵PID:1628
-
\??\c:\rthtlbf.exec:\rthtlbf.exe99⤵PID:1988
-
\??\c:\tlbfd.exec:\tlbfd.exe100⤵PID:1408
-
\??\c:\lvrtxl.exec:\lvrtxl.exe101⤵PID:2568
-
\??\c:\bbxxtll.exec:\bbxxtll.exe102⤵PID:2508
-
\??\c:\tpfbnt.exec:\tpfbnt.exe103⤵PID:544
-
\??\c:\pdxtx.exec:\pdxtx.exe104⤵
- System Location Discovery: System Language Discovery
PID:2140 -
\??\c:\nllrp.exec:\nllrp.exe105⤵PID:1808
-
\??\c:\ttllr.exec:\ttllr.exe106⤵PID:808
-
\??\c:\pdfxd.exec:\pdfxd.exe107⤵PID:1540
-
\??\c:\vrjrpl.exec:\vrjrpl.exe108⤵PID:1652
-
\??\c:\pvrftl.exec:\pvrftl.exe109⤵PID:2652
-
\??\c:\ftlllxb.exec:\ftlllxb.exe110⤵PID:1056
-
\??\c:\nbbjvd.exec:\nbbjvd.exe111⤵PID:772
-
\??\c:\jdrhnr.exec:\jdrhnr.exe112⤵PID:1900
-
\??\c:\rntvfp.exec:\rntvfp.exe113⤵PID:1096
-
\??\c:\pvnpnv.exec:\pvnpnv.exe114⤵PID:2044
-
\??\c:\rfndvjn.exec:\rfndvjn.exe115⤵PID:576
-
\??\c:\nvbnfbj.exec:\nvbnfbj.exe116⤵PID:608
-
\??\c:\xbtrdtf.exec:\xbtrdtf.exe117⤵PID:2464
-
\??\c:\lhxtjj.exec:\lhxtjj.exe118⤵PID:1420
-
\??\c:\jdpprpp.exec:\jdpprpp.exe119⤵
- System Location Discovery: System Language Discovery
PID:2376 -
\??\c:\lrrdf.exec:\lrrdf.exe120⤵PID:1596
-
\??\c:\tbxprj.exec:\tbxprj.exe121⤵PID:3068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-