Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 08:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
acbea3b6008d38e56c2eb82050c57d9b7109503f66b58696475fa97190270900.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
acbea3b6008d38e56c2eb82050c57d9b7109503f66b58696475fa97190270900.exe
-
Size
455KB
-
MD5
61dce5939c45622c9995ff8a063968dd
-
SHA1
c4e0bb4253ea8ede87d9ffa3bd2583ec8811d48e
-
SHA256
acbea3b6008d38e56c2eb82050c57d9b7109503f66b58696475fa97190270900
-
SHA512
ed81ae810e4f00147e705d1a33e06a432fb6352d1ec3431a99faef6213879d04b1d933f9a2fd2d35ff04aff7d474d30b7b6310d27a0c3aaaf4ac3f78f125fb89
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbew:q7Tc2NYHUrAwfMp3CDw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2272-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/524-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-48-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2628-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-53-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2756-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-164-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/640-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/648-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/672-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-288-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1408-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/804-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-313-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2008-320-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2388-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-378-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2632-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-476-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/756-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1012-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1012-559-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2640-658-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2640-678-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1868-686-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-684-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 524 lnbjl.exe 2000 pvnhbrj.exe 2388 xjflxrv.exe 2760 hvdxr.exe 2940 nnrffnv.exe 2628 hrxnjlj.exe 2996 rjlffrf.exe 2756 hldth.exe 2616 vrtnlfb.exe 1312 pvrvpp.exe 2832 jrthhfj.exe 1916 drrhptl.exe 2840 vtbvfx.exe 560 rpvddb.exe 2944 lhrhrtp.exe 1892 vlvjlht.exe 1972 bfntbl.exe 2168 njtjb.exe 2176 hfdth.exe 1812 bbtjt.exe 2816 pndbvrf.exe 640 fxljlf.exe 1184 htnptjx.exe 1716 rbdvnl.exe 648 rfdppj.exe 2308 tjtpvn.exe 2040 tvltbv.exe 2092 bfflp.exe 672 lllnn.exe 568 jjthhjl.exe 1408 ftvpnrl.exe 804 lbrtxfn.exe 1592 djlddn.exe 2008 nbfdljl.exe 868 nfnhdxx.exe 2388 lltdjd.exe 2900 htrbbp.exe 2904 xvdnrn.exe 2192 vpvplv.exe 2164 fxrfrpj.exe 2380 xxndp.exe 2788 bxfbvhr.exe 2640 tbtjrht.exe 2632 fldpvx.exe 1692 dhbvvj.exe 2992 ltfbpj.exe 1868 hxvjtv.exe 2860 lvjtp.exe 1948 rvnlj.exe 2516 bnbpnl.exe 2364 lvddh.exe 3008 ndhln.exe 1892 fhlxbb.exe 2404 tlpjbv.exe 936 nvvlr.exe 2564 dfhtt.exe 1180 njplj.exe 1352 xjlndv.exe 1964 jpffdtj.exe 1368 fntpvtp.exe 756 vvjtfff.exe 1612 ndhnd.exe 1772 vjbftrf.exe 828 fplvd.exe -
resource yara_rule behavioral1/memory/2272-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/524-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-48-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2628-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-200-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/640-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/648-239-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2308-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/648-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-276-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1408-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/804-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-935-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdtdnnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntxhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpdbtpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thvtdnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djfrjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnxvxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfhjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbpvxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhhxpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rltpxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpfnlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbxvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbbtpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjnpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjdlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blvrprd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbxtdlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfflp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtppnfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxttbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vflxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjnjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjhdfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpdhnlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrltj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrdjbvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vblfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbfvbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxdjvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrxpnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxhjn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2272 wrote to memory of 524 2272 acbea3b6008d38e56c2eb82050c57d9b7109503f66b58696475fa97190270900.exe 31 PID 2272 wrote to memory of 524 2272 acbea3b6008d38e56c2eb82050c57d9b7109503f66b58696475fa97190270900.exe 31 PID 2272 wrote to memory of 524 2272 acbea3b6008d38e56c2eb82050c57d9b7109503f66b58696475fa97190270900.exe 31 PID 2272 wrote to memory of 524 2272 acbea3b6008d38e56c2eb82050c57d9b7109503f66b58696475fa97190270900.exe 31 PID 524 wrote to memory of 2000 524 lnbjl.exe 32 PID 524 wrote to memory of 2000 524 lnbjl.exe 32 PID 524 wrote to memory of 2000 524 lnbjl.exe 32 PID 524 wrote to memory of 2000 524 lnbjl.exe 32 PID 2000 wrote to memory of 2388 2000 pvnhbrj.exe 33 PID 2000 wrote to memory of 2388 2000 pvnhbrj.exe 33 PID 2000 wrote to memory of 2388 2000 pvnhbrj.exe 33 PID 2000 wrote to memory of 2388 2000 pvnhbrj.exe 33 PID 2388 wrote to memory of 2760 2388 xjflxrv.exe 34 PID 2388 wrote to memory of 2760 2388 xjflxrv.exe 34 PID 2388 wrote to memory of 2760 2388 xjflxrv.exe 34 PID 2388 wrote to memory of 2760 2388 xjflxrv.exe 34 PID 2760 wrote to memory of 2940 2760 hvdxr.exe 35 PID 2760 wrote to memory of 2940 2760 hvdxr.exe 35 PID 2760 wrote to memory of 2940 2760 hvdxr.exe 35 PID 2760 wrote to memory of 2940 2760 hvdxr.exe 35 PID 2940 wrote to memory of 2628 2940 nnrffnv.exe 36 PID 2940 wrote to memory of 2628 2940 nnrffnv.exe 36 PID 2940 wrote to memory of 2628 2940 nnrffnv.exe 36 PID 2940 wrote to memory of 2628 2940 nnrffnv.exe 36 PID 2628 wrote to memory of 2996 2628 hrxnjlj.exe 37 PID 2628 wrote to memory of 2996 2628 hrxnjlj.exe 37 PID 2628 wrote to memory of 2996 2628 hrxnjlj.exe 37 PID 2628 wrote to memory of 2996 2628 hrxnjlj.exe 37 PID 2996 wrote to memory of 2756 2996 rjlffrf.exe 38 PID 2996 wrote to memory of 2756 2996 rjlffrf.exe 38 PID 2996 wrote to memory of 2756 2996 rjlffrf.exe 38 PID 2996 wrote to memory of 2756 2996 rjlffrf.exe 38 PID 2756 wrote to memory of 2616 2756 hldth.exe 39 PID 2756 wrote to memory of 2616 2756 hldth.exe 39 PID 2756 wrote to memory of 2616 2756 hldth.exe 39 PID 2756 wrote to memory of 2616 2756 hldth.exe 39 PID 2616 wrote to memory of 1312 2616 vrtnlfb.exe 40 PID 2616 wrote to memory of 1312 2616 vrtnlfb.exe 40 PID 2616 wrote to memory of 1312 2616 vrtnlfb.exe 40 PID 2616 wrote to memory of 1312 2616 vrtnlfb.exe 40 PID 1312 wrote to memory of 2832 1312 pvrvpp.exe 41 PID 1312 wrote to memory of 2832 1312 pvrvpp.exe 41 PID 1312 wrote to memory of 2832 1312 pvrvpp.exe 41 PID 1312 wrote to memory of 2832 1312 pvrvpp.exe 41 PID 2832 wrote to memory of 1916 2832 jrthhfj.exe 42 PID 2832 wrote to memory of 1916 2832 jrthhfj.exe 42 PID 2832 wrote to memory of 1916 2832 jrthhfj.exe 42 PID 2832 wrote to memory of 1916 2832 jrthhfj.exe 42 PID 1916 wrote to memory of 2840 1916 drrhptl.exe 43 PID 1916 wrote to memory of 2840 1916 drrhptl.exe 43 PID 1916 wrote to memory of 2840 1916 drrhptl.exe 43 PID 1916 wrote to memory of 2840 1916 drrhptl.exe 43 PID 2840 wrote to memory of 560 2840 vtbvfx.exe 44 PID 2840 wrote to memory of 560 2840 vtbvfx.exe 44 PID 2840 wrote to memory of 560 2840 vtbvfx.exe 44 PID 2840 wrote to memory of 560 2840 vtbvfx.exe 44 PID 560 wrote to memory of 2944 560 rpvddb.exe 45 PID 560 wrote to memory of 2944 560 rpvddb.exe 45 PID 560 wrote to memory of 2944 560 rpvddb.exe 45 PID 560 wrote to memory of 2944 560 rpvddb.exe 45 PID 2944 wrote to memory of 1892 2944 lhrhrtp.exe 46 PID 2944 wrote to memory of 1892 2944 lhrhrtp.exe 46 PID 2944 wrote to memory of 1892 2944 lhrhrtp.exe 46 PID 2944 wrote to memory of 1892 2944 lhrhrtp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\acbea3b6008d38e56c2eb82050c57d9b7109503f66b58696475fa97190270900.exe"C:\Users\Admin\AppData\Local\Temp\acbea3b6008d38e56c2eb82050c57d9b7109503f66b58696475fa97190270900.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\lnbjl.exec:\lnbjl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:524 -
\??\c:\pvnhbrj.exec:\pvnhbrj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\xjflxrv.exec:\xjflxrv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\hvdxr.exec:\hvdxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\nnrffnv.exec:\nnrffnv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\hrxnjlj.exec:\hrxnjlj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\rjlffrf.exec:\rjlffrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\hldth.exec:\hldth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\vrtnlfb.exec:\vrtnlfb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\pvrvpp.exec:\pvrvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\jrthhfj.exec:\jrthhfj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\drrhptl.exec:\drrhptl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\vtbvfx.exec:\vtbvfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rpvddb.exec:\rpvddb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\lhrhrtp.exec:\lhrhrtp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\vlvjlht.exec:\vlvjlht.exe17⤵
- Executes dropped EXE
PID:1892 -
\??\c:\bfntbl.exec:\bfntbl.exe18⤵
- Executes dropped EXE
PID:1972 -
\??\c:\njtjb.exec:\njtjb.exe19⤵
- Executes dropped EXE
PID:2168 -
\??\c:\hfdth.exec:\hfdth.exe20⤵
- Executes dropped EXE
PID:2176 -
\??\c:\bbtjt.exec:\bbtjt.exe21⤵
- Executes dropped EXE
PID:1812 -
\??\c:\pndbvrf.exec:\pndbvrf.exe22⤵
- Executes dropped EXE
PID:2816 -
\??\c:\fxljlf.exec:\fxljlf.exe23⤵
- Executes dropped EXE
PID:640 -
\??\c:\htnptjx.exec:\htnptjx.exe24⤵
- Executes dropped EXE
PID:1184 -
\??\c:\rbdvnl.exec:\rbdvnl.exe25⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rfdppj.exec:\rfdppj.exe26⤵
- Executes dropped EXE
PID:648 -
\??\c:\tjtpvn.exec:\tjtpvn.exe27⤵
- Executes dropped EXE
PID:2308 -
\??\c:\tvltbv.exec:\tvltbv.exe28⤵
- Executes dropped EXE
PID:2040 -
\??\c:\bfflp.exec:\bfflp.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2092 -
\??\c:\lllnn.exec:\lllnn.exe30⤵
- Executes dropped EXE
PID:672 -
\??\c:\jjthhjl.exec:\jjthhjl.exe31⤵
- Executes dropped EXE
PID:568 -
\??\c:\ftvpnrl.exec:\ftvpnrl.exe32⤵
- Executes dropped EXE
PID:1408 -
\??\c:\lbrtxfn.exec:\lbrtxfn.exe33⤵
- Executes dropped EXE
PID:804 -
\??\c:\djlddn.exec:\djlddn.exe34⤵
- Executes dropped EXE
PID:1592 -
\??\c:\nbfdljl.exec:\nbfdljl.exe35⤵
- Executes dropped EXE
PID:2008 -
\??\c:\nfnhdxx.exec:\nfnhdxx.exe36⤵
- Executes dropped EXE
PID:868 -
\??\c:\lltdjd.exec:\lltdjd.exe37⤵
- Executes dropped EXE
PID:2388 -
\??\c:\htrbbp.exec:\htrbbp.exe38⤵
- Executes dropped EXE
PID:2900 -
\??\c:\xvdnrn.exec:\xvdnrn.exe39⤵
- Executes dropped EXE
PID:2904 -
\??\c:\vpvplv.exec:\vpvplv.exe40⤵
- Executes dropped EXE
PID:2192 -
\??\c:\fxrfrpj.exec:\fxrfrpj.exe41⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xxndp.exec:\xxndp.exe42⤵
- Executes dropped EXE
PID:2380 -
\??\c:\bxfbvhr.exec:\bxfbvhr.exe43⤵
- Executes dropped EXE
PID:2788 -
\??\c:\tbtjrht.exec:\tbtjrht.exe44⤵
- Executes dropped EXE
PID:2640 -
\??\c:\fldpvx.exec:\fldpvx.exe45⤵
- Executes dropped EXE
PID:2632 -
\??\c:\dhbvvj.exec:\dhbvvj.exe46⤵
- Executes dropped EXE
PID:1692 -
\??\c:\ltfbpj.exec:\ltfbpj.exe47⤵
- Executes dropped EXE
PID:2992 -
\??\c:\hxvjtv.exec:\hxvjtv.exe48⤵
- Executes dropped EXE
PID:1868 -
\??\c:\lvjtp.exec:\lvjtp.exe49⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rvnlj.exec:\rvnlj.exe50⤵
- Executes dropped EXE
PID:1948 -
\??\c:\bnbpnl.exec:\bnbpnl.exe51⤵
- Executes dropped EXE
PID:2516 -
\??\c:\lvddh.exec:\lvddh.exe52⤵
- Executes dropped EXE
PID:2364 -
\??\c:\ndhln.exec:\ndhln.exe53⤵
- Executes dropped EXE
PID:3008 -
\??\c:\fhlxbb.exec:\fhlxbb.exe54⤵
- Executes dropped EXE
PID:1892 -
\??\c:\tlpjbv.exec:\tlpjbv.exe55⤵
- Executes dropped EXE
PID:2404 -
\??\c:\nvvlr.exec:\nvvlr.exe56⤵
- Executes dropped EXE
PID:936 -
\??\c:\dfhtt.exec:\dfhtt.exe57⤵
- Executes dropped EXE
PID:2564 -
\??\c:\njplj.exec:\njplj.exe58⤵
- Executes dropped EXE
PID:1180 -
\??\c:\xjlndv.exec:\xjlndv.exe59⤵
- Executes dropped EXE
PID:1352 -
\??\c:\jpffdtj.exec:\jpffdtj.exe60⤵
- Executes dropped EXE
PID:1964 -
\??\c:\fntpvtp.exec:\fntpvtp.exe61⤵
- Executes dropped EXE
PID:1368 -
\??\c:\vvjtfff.exec:\vvjtfff.exe62⤵
- Executes dropped EXE
PID:756 -
\??\c:\ndhnd.exec:\ndhnd.exe63⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vjbftrf.exec:\vjbftrf.exe64⤵
- Executes dropped EXE
PID:1772 -
\??\c:\fplvd.exec:\fplvd.exe65⤵
- Executes dropped EXE
PID:828 -
\??\c:\drxxdj.exec:\drxxdj.exe66⤵PID:1540
-
\??\c:\fbxntj.exec:\fbxntj.exe67⤵PID:572
-
\??\c:\hdxphv.exec:\hdxphv.exe68⤵PID:1828
-
\??\c:\frrjlr.exec:\frrjlr.exe69⤵PID:856
-
\??\c:\ffbbjtx.exec:\ffbbjtx.exe70⤵PID:2116
-
\??\c:\djbntpb.exec:\djbntpb.exe71⤵PID:1012
-
\??\c:\lhjnn.exec:\lhjnn.exe72⤵PID:1340
-
\??\c:\xvbffpb.exec:\xvbffpb.exe73⤵PID:2260
-
\??\c:\rpptftp.exec:\rpptftp.exe74⤵PID:1604
-
\??\c:\tlrhrb.exec:\tlrhrb.exe75⤵PID:524
-
\??\c:\hvhvb.exec:\hvhvb.exe76⤵PID:2304
-
\??\c:\xhpbxf.exec:\xhpbxf.exe77⤵PID:2812
-
\??\c:\lvnjtx.exec:\lvnjtx.exe78⤵PID:2880
-
\??\c:\fbdnp.exec:\fbdnp.exe79⤵PID:2728
-
\??\c:\lhtvhhb.exec:\lhtvhhb.exe80⤵PID:2900
-
\??\c:\xnphdr.exec:\xnphdr.exe81⤵PID:2904
-
\??\c:\vflxn.exec:\vflxn.exe82⤵
- System Location Discovery: System Language Discovery
PID:2192 -
\??\c:\brbllnx.exec:\brbllnx.exe83⤵PID:2164
-
\??\c:\lndphl.exec:\lndphl.exe84⤵PID:2380
-
\??\c:\ldhdhjl.exec:\ldhdhjl.exe85⤵PID:2788
-
\??\c:\jxvlpl.exec:\jxvlpl.exe86⤵PID:2640
-
\??\c:\bplpnhn.exec:\bplpnhn.exe87⤵PID:1872
-
\??\c:\dljttjv.exec:\dljttjv.exe88⤵PID:1692
-
\??\c:\lnttjfd.exec:\lnttjfd.exe89⤵PID:2992
-
\??\c:\tvvrf.exec:\tvvrf.exe90⤵PID:1868
-
\??\c:\vjvvdb.exec:\vjvvdb.exe91⤵PID:1984
-
\??\c:\dplfl.exec:\dplfl.exe92⤵PID:1884
-
\??\c:\rxjvd.exec:\rxjvd.exe93⤵PID:1464
-
\??\c:\ttpbr.exec:\ttpbr.exe94⤵PID:2396
-
\??\c:\fdrnftj.exec:\fdrnftj.exe95⤵PID:2572
-
\??\c:\fndpl.exec:\fndpl.exe96⤵PID:1044
-
\??\c:\hrdptpl.exec:\hrdptpl.exe97⤵PID:2716
-
\??\c:\ldnnfhd.exec:\ldnnfhd.exe98⤵PID:936
-
\??\c:\hbjbn.exec:\hbjbn.exe99⤵PID:2096
-
\??\c:\fjtbxjn.exec:\fjtbxjn.exe100⤵PID:1076
-
\??\c:\bvrfbf.exec:\bvrfbf.exe101⤵PID:1156
-
\??\c:\vlnlbxt.exec:\vlnlbxt.exe102⤵PID:1480
-
\??\c:\jrtprhx.exec:\jrtprhx.exe103⤵PID:1368
-
\??\c:\pnndtx.exec:\pnndtx.exe104⤵PID:2120
-
\??\c:\hfjdb.exec:\hfjdb.exe105⤵PID:1748
-
\??\c:\djfrjd.exec:\djfrjd.exe106⤵
- System Location Discovery: System Language Discovery
PID:2032 -
\??\c:\tbrffh.exec:\tbrffh.exe107⤵PID:1416
-
\??\c:\pnpnv.exec:\pnpnv.exe108⤵PID:676
-
\??\c:\vxrfn.exec:\vxrfn.exe109⤵PID:2704
-
\??\c:\dbrnnp.exec:\dbrnnp.exe110⤵PID:1976
-
\??\c:\rvfrp.exec:\rvfrp.exe111⤵PID:2368
-
\??\c:\fbddjn.exec:\fbddjn.exe112⤵PID:2180
-
\??\c:\nhjtn.exec:\nhjtn.exe113⤵PID:1204
-
\??\c:\bhxrrf.exec:\bhxrrf.exe114⤵PID:880
-
\??\c:\tvlhfl.exec:\tvlhfl.exe115⤵PID:2212
-
\??\c:\rvnnrvh.exec:\rvnnrvh.exe116⤵PID:1720
-
\??\c:\fjbft.exec:\fjbft.exe117⤵PID:2556
-
\??\c:\vrprv.exec:\vrprv.exe118⤵PID:524
-
\??\c:\pnvprhj.exec:\pnvprhj.exe119⤵PID:2008
-
\??\c:\nvnxdpb.exec:\nvnxdpb.exe120⤵PID:2724
-
\??\c:\fbrldhp.exec:\fbrldhp.exe121⤵PID:2876
-
\??\c:\nbpftrd.exec:\nbpftrd.exe122⤵PID:2936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-