Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01efc569cc5999e89491ac44735545a2cc63e69eec61c838da721cac1307c10c.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
01efc569cc5999e89491ac44735545a2cc63e69eec61c838da721cac1307c10c.exe
-
Size
455KB
-
MD5
a32a6266eb542f252805902f75778a0e
-
SHA1
4b673bc9699b60cee66c611e1718590a1328c537
-
SHA256
01efc569cc5999e89491ac44735545a2cc63e69eec61c838da721cac1307c10c
-
SHA512
8b251340f918b6aff0a6e8000f94942befc302b190627e6ed9777173a358fdc3dba2a9ade46527d297162d05ddfd960ff556a3dadc73ffde0fcc345fa21ffba4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeA:q7Tc2NYHUrAwfMp3CDA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2908-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-26-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3036-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-79-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1800-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-159-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/916-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/620-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-418-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2296-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-437-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2576-478-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2240-485-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1388-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-564-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1292-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-609-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2852-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-631-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/984-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-686-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-694-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/568-740-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/904-786-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-908-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2824 lrrlh.exe 2672 nxhlpd.exe 3036 jrbnd.exe 2664 hjjpbj.exe 2740 hfvdvx.exe 2360 vvflb.exe 2004 htljrrl.exe 2116 pnndfp.exe 1800 ffhntj.exe 2164 lvdlplr.exe 2608 xxrdbpp.exe 2356 nxbdtbf.exe 2300 lntphv.exe 2516 vprtbn.exe 2452 tbvbdf.exe 916 hddjnb.exe 756 jdtbl.exe 2160 npvdrj.exe 1944 nbjxjnn.exe 2284 hrxrb.exe 2752 jhfjv.exe 620 pxhpjpd.exe 2096 ntntr.exe 1088 vhtfhbn.exe 2432 lvhxvfn.exe 2204 lprvdnp.exe 1732 xthbxrf.exe 1120 jjbbfn.exe 2492 pflprn.exe 1656 fdrplh.exe 1796 jvtxff.exe 2524 nvvpjd.exe 2508 xfxrvx.exe 1712 jnlfhxl.exe 2800 fxtdt.exe 2796 xlrvl.exe 2104 lxhldb.exe 2804 nhvxbtt.exe 2676 fvjrdlh.exe 2476 pjbptfv.exe 1644 xxndxld.exe 1212 dntldh.exe 1324 bbbbnp.exe 1524 jpdbx.exe 2536 bjvnvl.exe 2480 dprjtj.exe 264 fvpdj.exe 2164 ttlbv.exe 2280 vxtxbtr.exe 2444 djbvbr.exe 2768 bbvvr.exe 2316 lhfpr.exe 2296 fnnxjn.exe 1544 vvvhjx.exe 3048 nvhrjhr.exe 916 tjjfll.exe 2412 lhrrprt.exe 748 jjpfnvf.exe 2576 plvdv.exe 2240 nxxvn.exe 1652 lxrnbd.exe 1848 rjrrdrx.exe 620 pbbxxl.exe 2648 dlhxrfp.exe -
resource yara_rule behavioral1/memory/2908-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-620-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/984-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-786-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-882-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/580-908-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npxvjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtxrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttdnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhtrlrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjrrdrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhdjjxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxhpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbbxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvnnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfxpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddbvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdbvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntjlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bprvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlhjrhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjdldxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdtvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjvhxrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrrhvxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvhpvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnjfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnjxhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxpbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prxphf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbfdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvhbhhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfjrnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhbfnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnffj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrvhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffdhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrvxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvhxvfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbjrbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfvjjxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrrthpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvbrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfdfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhbptv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrvpj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2908 wrote to memory of 2824 2908 01efc569cc5999e89491ac44735545a2cc63e69eec61c838da721cac1307c10c.exe 30 PID 2908 wrote to memory of 2824 2908 01efc569cc5999e89491ac44735545a2cc63e69eec61c838da721cac1307c10c.exe 30 PID 2908 wrote to memory of 2824 2908 01efc569cc5999e89491ac44735545a2cc63e69eec61c838da721cac1307c10c.exe 30 PID 2908 wrote to memory of 2824 2908 01efc569cc5999e89491ac44735545a2cc63e69eec61c838da721cac1307c10c.exe 30 PID 2824 wrote to memory of 2672 2824 lrrlh.exe 31 PID 2824 wrote to memory of 2672 2824 lrrlh.exe 31 PID 2824 wrote to memory of 2672 2824 lrrlh.exe 31 PID 2824 wrote to memory of 2672 2824 lrrlh.exe 31 PID 2672 wrote to memory of 3036 2672 nxhlpd.exe 32 PID 2672 wrote to memory of 3036 2672 nxhlpd.exe 32 PID 2672 wrote to memory of 3036 2672 nxhlpd.exe 32 PID 2672 wrote to memory of 3036 2672 nxhlpd.exe 32 PID 3036 wrote to memory of 2664 3036 jrbnd.exe 33 PID 3036 wrote to memory of 2664 3036 jrbnd.exe 33 PID 3036 wrote to memory of 2664 3036 jrbnd.exe 33 PID 3036 wrote to memory of 2664 3036 jrbnd.exe 33 PID 2664 wrote to memory of 2740 2664 hjjpbj.exe 34 PID 2664 wrote to memory of 2740 2664 hjjpbj.exe 34 PID 2664 wrote to memory of 2740 2664 hjjpbj.exe 34 PID 2664 wrote to memory of 2740 2664 hjjpbj.exe 34 PID 2740 wrote to memory of 2360 2740 hfvdvx.exe 35 PID 2740 wrote to memory of 2360 2740 hfvdvx.exe 35 PID 2740 wrote to memory of 2360 2740 hfvdvx.exe 35 PID 2740 wrote to memory of 2360 2740 hfvdvx.exe 35 PID 2360 wrote to memory of 2004 2360 vvflb.exe 36 PID 2360 wrote to memory of 2004 2360 vvflb.exe 36 PID 2360 wrote to memory of 2004 2360 vvflb.exe 36 PID 2360 wrote to memory of 2004 2360 vvflb.exe 36 PID 2004 wrote to memory of 2116 2004 htljrrl.exe 37 PID 2004 wrote to memory of 2116 2004 htljrrl.exe 37 PID 2004 wrote to memory of 2116 2004 htljrrl.exe 37 PID 2004 wrote to memory of 2116 2004 htljrrl.exe 37 PID 2116 wrote to memory of 1800 2116 pnndfp.exe 38 PID 2116 wrote to memory of 1800 2116 pnndfp.exe 38 PID 2116 wrote to memory of 1800 2116 pnndfp.exe 38 PID 2116 wrote to memory of 1800 2116 pnndfp.exe 38 PID 1800 wrote to memory of 2164 1800 ffhntj.exe 39 PID 1800 wrote to memory of 2164 1800 ffhntj.exe 39 PID 1800 wrote to memory of 2164 1800 ffhntj.exe 39 PID 1800 wrote to memory of 2164 1800 ffhntj.exe 39 PID 2164 wrote to memory of 2608 2164 lvdlplr.exe 40 PID 2164 wrote to memory of 2608 2164 lvdlplr.exe 40 PID 2164 wrote to memory of 2608 2164 lvdlplr.exe 40 PID 2164 wrote to memory of 2608 2164 lvdlplr.exe 40 PID 2608 wrote to memory of 2356 2608 xxrdbpp.exe 41 PID 2608 wrote to memory of 2356 2608 xxrdbpp.exe 41 PID 2608 wrote to memory of 2356 2608 xxrdbpp.exe 41 PID 2608 wrote to memory of 2356 2608 xxrdbpp.exe 41 PID 2356 wrote to memory of 2300 2356 nxbdtbf.exe 42 PID 2356 wrote to memory of 2300 2356 nxbdtbf.exe 42 PID 2356 wrote to memory of 2300 2356 nxbdtbf.exe 42 PID 2356 wrote to memory of 2300 2356 nxbdtbf.exe 42 PID 2300 wrote to memory of 2516 2300 lntphv.exe 43 PID 2300 wrote to memory of 2516 2300 lntphv.exe 43 PID 2300 wrote to memory of 2516 2300 lntphv.exe 43 PID 2300 wrote to memory of 2516 2300 lntphv.exe 43 PID 2516 wrote to memory of 2452 2516 vprtbn.exe 44 PID 2516 wrote to memory of 2452 2516 vprtbn.exe 44 PID 2516 wrote to memory of 2452 2516 vprtbn.exe 44 PID 2516 wrote to memory of 2452 2516 vprtbn.exe 44 PID 2452 wrote to memory of 916 2452 tbvbdf.exe 45 PID 2452 wrote to memory of 916 2452 tbvbdf.exe 45 PID 2452 wrote to memory of 916 2452 tbvbdf.exe 45 PID 2452 wrote to memory of 916 2452 tbvbdf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\01efc569cc5999e89491ac44735545a2cc63e69eec61c838da721cac1307c10c.exe"C:\Users\Admin\AppData\Local\Temp\01efc569cc5999e89491ac44735545a2cc63e69eec61c838da721cac1307c10c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\lrrlh.exec:\lrrlh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\nxhlpd.exec:\nxhlpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\jrbnd.exec:\jrbnd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\hjjpbj.exec:\hjjpbj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\hfvdvx.exec:\hfvdvx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\vvflb.exec:\vvflb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\htljrrl.exec:\htljrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\pnndfp.exec:\pnndfp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\ffhntj.exec:\ffhntj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\lvdlplr.exec:\lvdlplr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\xxrdbpp.exec:\xxrdbpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\nxbdtbf.exec:\nxbdtbf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\lntphv.exec:\lntphv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\vprtbn.exec:\vprtbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\tbvbdf.exec:\tbvbdf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\hddjnb.exec:\hddjnb.exe17⤵
- Executes dropped EXE
PID:916 -
\??\c:\jdtbl.exec:\jdtbl.exe18⤵
- Executes dropped EXE
PID:756 -
\??\c:\npvdrj.exec:\npvdrj.exe19⤵
- Executes dropped EXE
PID:2160 -
\??\c:\nbjxjnn.exec:\nbjxjnn.exe20⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hrxrb.exec:\hrxrb.exe21⤵
- Executes dropped EXE
PID:2284 -
\??\c:\jhfjv.exec:\jhfjv.exe22⤵
- Executes dropped EXE
PID:2752 -
\??\c:\pxhpjpd.exec:\pxhpjpd.exe23⤵
- Executes dropped EXE
PID:620 -
\??\c:\ntntr.exec:\ntntr.exe24⤵
- Executes dropped EXE
PID:2096 -
\??\c:\vhtfhbn.exec:\vhtfhbn.exe25⤵
- Executes dropped EXE
PID:1088 -
\??\c:\lvhxvfn.exec:\lvhxvfn.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2432 -
\??\c:\lprvdnp.exec:\lprvdnp.exe27⤵
- Executes dropped EXE
PID:2204 -
\??\c:\xthbxrf.exec:\xthbxrf.exe28⤵
- Executes dropped EXE
PID:1732 -
\??\c:\jjbbfn.exec:\jjbbfn.exe29⤵
- Executes dropped EXE
PID:1120 -
\??\c:\pflprn.exec:\pflprn.exe30⤵
- Executes dropped EXE
PID:2492 -
\??\c:\fdrplh.exec:\fdrplh.exe31⤵
- Executes dropped EXE
PID:1656 -
\??\c:\jvtxff.exec:\jvtxff.exe32⤵
- Executes dropped EXE
PID:1796 -
\??\c:\nvvpjd.exec:\nvvpjd.exe33⤵
- Executes dropped EXE
PID:2524 -
\??\c:\xfxrvx.exec:\xfxrvx.exe34⤵
- Executes dropped EXE
PID:2508 -
\??\c:\jnlfhxl.exec:\jnlfhxl.exe35⤵
- Executes dropped EXE
PID:1712 -
\??\c:\fxtdt.exec:\fxtdt.exe36⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xlrvl.exec:\xlrvl.exe37⤵
- Executes dropped EXE
PID:2796 -
\??\c:\lxhldb.exec:\lxhldb.exe38⤵
- Executes dropped EXE
PID:2104 -
\??\c:\nhvxbtt.exec:\nhvxbtt.exe39⤵
- Executes dropped EXE
PID:2804 -
\??\c:\fvjrdlh.exec:\fvjrdlh.exe40⤵
- Executes dropped EXE
PID:2676 -
\??\c:\pjbptfv.exec:\pjbptfv.exe41⤵
- Executes dropped EXE
PID:2476 -
\??\c:\xxndxld.exec:\xxndxld.exe42⤵
- Executes dropped EXE
PID:1644 -
\??\c:\dntldh.exec:\dntldh.exe43⤵
- Executes dropped EXE
PID:1212 -
\??\c:\bbbbnp.exec:\bbbbnp.exe44⤵
- Executes dropped EXE
PID:1324 -
\??\c:\jpdbx.exec:\jpdbx.exe45⤵
- Executes dropped EXE
PID:1524 -
\??\c:\bjvnvl.exec:\bjvnvl.exe46⤵
- Executes dropped EXE
PID:2536 -
\??\c:\dprjtj.exec:\dprjtj.exe47⤵
- Executes dropped EXE
PID:2480 -
\??\c:\fvpdj.exec:\fvpdj.exe48⤵
- Executes dropped EXE
PID:264 -
\??\c:\ttlbv.exec:\ttlbv.exe49⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vxtxbtr.exec:\vxtxbtr.exe50⤵
- Executes dropped EXE
PID:2280 -
\??\c:\djbvbr.exec:\djbvbr.exe51⤵
- Executes dropped EXE
PID:2444 -
\??\c:\bbvvr.exec:\bbvvr.exe52⤵
- Executes dropped EXE
PID:2768 -
\??\c:\lhfpr.exec:\lhfpr.exe53⤵
- Executes dropped EXE
PID:2316 -
\??\c:\fnnxjn.exec:\fnnxjn.exe54⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vvvhjx.exec:\vvvhjx.exe55⤵
- Executes dropped EXE
PID:1544 -
\??\c:\nvhrjhr.exec:\nvhrjhr.exe56⤵
- Executes dropped EXE
PID:3048 -
\??\c:\tjjfll.exec:\tjjfll.exe57⤵
- Executes dropped EXE
PID:916 -
\??\c:\lhrrprt.exec:\lhrrprt.exe58⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jjpfnvf.exec:\jjpfnvf.exe59⤵
- Executes dropped EXE
PID:748 -
\??\c:\plvdv.exec:\plvdv.exe60⤵
- Executes dropped EXE
PID:2576 -
\??\c:\nxxvn.exec:\nxxvn.exe61⤵
- Executes dropped EXE
PID:2240 -
\??\c:\lxrnbd.exec:\lxrnbd.exe62⤵
- Executes dropped EXE
PID:1652 -
\??\c:\rjrrdrx.exec:\rjrrdrx.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1848 -
\??\c:\pbbxxl.exec:\pbbxxl.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:620 -
\??\c:\dlhxrfp.exec:\dlhxrfp.exe65⤵
- Executes dropped EXE
PID:2648 -
\??\c:\hrjnjb.exec:\hrjnjb.exe66⤵PID:1872
-
\??\c:\hvrvtbb.exec:\hvrvtbb.exe67⤵PID:1552
-
\??\c:\dnxrtjr.exec:\dnxrtjr.exe68⤵PID:1780
-
\??\c:\nbflhnv.exec:\nbflhnv.exe69⤵PID:2624
-
\??\c:\njdxn.exec:\njdxn.exe70⤵PID:1388
-
\??\c:\jflprfj.exec:\jflprfj.exe71⤵PID:1672
-
\??\c:\tftvp.exec:\tftvp.exe72⤵PID:2020
-
\??\c:\rhdhd.exec:\rhdhd.exe73⤵PID:2276
-
\??\c:\ljxrd.exec:\ljxrd.exe74⤵PID:1292
-
\??\c:\ntrhjl.exec:\ntrhjl.exe75⤵PID:1564
-
\??\c:\lhhtjhx.exec:\lhhtjhx.exe76⤵PID:2748
-
\??\c:\bbpfvld.exec:\bbpfvld.exe77⤵PID:1988
-
\??\c:\jtrhvpj.exec:\jtrhvpj.exe78⤵PID:1280
-
\??\c:\dtfppjt.exec:\dtfppjt.exe79⤵PID:1608
-
\??\c:\lpbvnb.exec:\lpbvnb.exe80⤵PID:2800
-
\??\c:\lrndvj.exec:\lrndvj.exe81⤵PID:2824
-
\??\c:\tdxnj.exec:\tdxnj.exe82⤵PID:2852
-
\??\c:\lhhdpjj.exec:\lhhdpjj.exe83⤵PID:2696
-
\??\c:\xjdldxl.exec:\xjdldxl.exe84⤵
- System Location Discovery: System Language Discovery
PID:2308 -
\??\c:\npxvjr.exec:\npxvjr.exe85⤵
- System Location Discovery: System Language Discovery
PID:984 -
\??\c:\jpxvh.exec:\jpxvh.exe86⤵PID:436
-
\??\c:\hxjdn.exec:\hxjdn.exe87⤵PID:2424
-
\??\c:\jbpxjh.exec:\jbpxjh.exe88⤵PID:2116
-
\??\c:\tfvvfl.exec:\tfvvfl.exe89⤵PID:2564
-
\??\c:\trrnjlp.exec:\trrnjlp.exe90⤵PID:1816
-
\??\c:\fdjnh.exec:\fdjnh.exe91⤵PID:2288
-
\??\c:\rbvrxrt.exec:\rbvrxrt.exe92⤵PID:1304
-
\??\c:\bhlht.exec:\bhlht.exe93⤵PID:1940
-
\??\c:\dltjp.exec:\dltjp.exe94⤵PID:2192
-
\??\c:\vhhdxjp.exec:\vhhdxjp.exe95⤵PID:2972
-
\??\c:\nvvhdr.exec:\nvvhdr.exe96⤵PID:1256
-
\??\c:\ffnfpr.exec:\ffnfpr.exe97⤵PID:716
-
\??\c:\xfnnxph.exec:\xfnnxph.exe98⤵PID:2452
-
\??\c:\rfnvjn.exec:\rfnvjn.exe99⤵PID:568
-
\??\c:\dfbplbf.exec:\dfbplbf.exe100⤵PID:2372
-
\??\c:\nxhpxr.exec:\nxhpxr.exe101⤵PID:2128
-
\??\c:\jbljj.exec:\jbljj.exe102⤵PID:2504
-
\??\c:\pdvvjld.exec:\pdvvjld.exe103⤵PID:2052
-
\??\c:\bdxpjbl.exec:\bdxpjbl.exe104⤵PID:2284
-
\??\c:\pvlhn.exec:\pvlhn.exe105⤵PID:1720
-
\??\c:\rfdfx.exec:\rfdfx.exe106⤵
- System Location Discovery: System Language Discovery
PID:904 -
\??\c:\rfndxtd.exec:\rfndxtd.exe107⤵PID:1540
-
\??\c:\jrvdvj.exec:\jrvdvj.exe108⤵PID:1568
-
\??\c:\bvdpxt.exec:\bvdpxt.exe109⤵PID:1264
-
\??\c:\thbtft.exec:\thbtft.exe110⤵PID:2432
-
\??\c:\nfpttrt.exec:\nfpttrt.exe111⤵PID:2204
-
\??\c:\vvvrvln.exec:\vvvrvln.exe112⤵PID:2604
-
\??\c:\hhfjbvb.exec:\hhfjbvb.exe113⤵PID:1812
-
\??\c:\jhxbvbt.exec:\jhxbvbt.exe114⤵PID:3024
-
\??\c:\ffbvx.exec:\ffbvx.exe115⤵PID:2984
-
\??\c:\lrvxl.exec:\lrvxl.exe116⤵
- System Location Discovery: System Language Discovery
PID:1980 -
\??\c:\lbfpfn.exec:\lbfpfn.exe117⤵PID:1796
-
\??\c:\vxjdxtj.exec:\vxjdxtj.exe118⤵PID:1828
-
\??\c:\bnpxv.exec:\bnpxv.exe119⤵PID:2524
-
\??\c:\jtjdhlt.exec:\jtjdhlt.exe120⤵PID:2140
-
\??\c:\frdptl.exec:\frdptl.exe121⤵PID:2340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-