Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:01
Behavioral task
behavioral1
Sample
63448f7a15593c12dfaacd43ee45b66fc71efdc9c0c0e1469c44d3869c508a7c.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
63448f7a15593c12dfaacd43ee45b66fc71efdc9c0c0e1469c44d3869c508a7c.exe
-
Size
332KB
-
MD5
38d8924f73df6b266def758ff82faf91
-
SHA1
0f7a0848b582805636c8ba3f51daea758539a29f
-
SHA256
63448f7a15593c12dfaacd43ee45b66fc71efdc9c0c0e1469c44d3869c508a7c
-
SHA512
bc6c23bd697d58a37986f42c633cf41abaf214b88b22ed32512cda158321d41579457547eedf7c9fbca423724665ef146ad44e8e05ad9815b13d95a2267991c3
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbe3:R4wFHoSHYHUrAwfMp3CD3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2280-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-12-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2188-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-29-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2724-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-46-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2876-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1192-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2052-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2376-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-83-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1936-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/560-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/924-149-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2716-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2032-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1212-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/856-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2912-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-353-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2756-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1872-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/276-470-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1744-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1540-508-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2040-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-572-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2388-578-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2752-621-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1948-663-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2988-693-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1068-704-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1688-763-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1212-785-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-891-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1364-1075-0x0000000077050000-0x000000007716F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2188 thdbx.exe 1708 bhlpx.exe 2448 rtxnfjd.exe 2724 tjtnrl.exe 2876 xptfjpj.exe 1192 hhvbjtf.exe 2996 tlxfrhj.exe 2052 djtpv.exe 320 bhppdp.exe 2376 bhdxpx.exe 656 hntht.exe 1936 xbbfhxp.exe 832 pbhbfr.exe 2860 brrbph.exe 560 pbtpx.exe 1920 txpvjn.exe 924 jbbdl.exe 2476 ftllpx.exe 2808 tbvpxjv.exe 2716 xthvxjj.exe 2176 vjrvbv.exe 1180 lrlxt.exe 3052 rbtjx.exe 640 djddvv.exe 1148 njtdj.exe 328 rhthbbx.exe 2856 pfdhrbx.exe 2032 phfhl.exe 1524 bbdndtb.exe 1212 lpvllpj.exe 3028 bhtvh.exe 2368 jbnjrf.exe 1532 fvdlxt.exe 856 bpvjdbd.exe 788 jjtjtl.exe 524 jxpfr.exe 2064 hvxnr.exe 1552 jrxdr.exe 1620 rlfbjt.exe 2200 nntbh.exe 2448 nvlrvjn.exe 2724 njpth.exe 3056 hftltv.exe 2928 jvbhnt.exe 2656 xhnvb.exe 2912 vrlhl.exe 2920 vnfdlr.exe 2756 btrff.exe 2676 bxxtvd.exe 2080 hbtxdp.exe 2576 jjnfblt.exe 1872 dbhlh.exe 2708 rxjrlj.exe 2916 htrpljd.exe 832 jbnhvp.exe 2840 rxvdp.exe 1152 rjtpb.exe 2516 hpllr.exe 2364 fhvtfxv.exe 1284 drnpbj.exe 924 txdrbxn.exe 2404 xxlxh.exe 1044 nfbbphb.exe 2344 vhhpjvp.exe -
resource yara_rule behavioral1/memory/2280-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000012262-5.dat upx behavioral1/memory/2280-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2188-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2188-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1708-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c23-18.dat upx behavioral1/files/0x0007000000016cab-25.dat upx behavioral1/files/0x0007000000016cd8-42.dat upx behavioral1/memory/2724-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016ccc-35.dat upx behavioral1/memory/2448-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016ce0-53.dat upx behavioral1/memory/2876-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1192-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016ce9-59.dat upx behavioral1/files/0x00050000000194a3-67.dat upx behavioral1/memory/2052-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2996-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194eb-76.dat upx behavioral1/memory/2376-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016ace-86.dat upx behavioral1/memory/320-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ef-93.dat upx behavioral1/files/0x000500000001950f-103.dat upx behavioral1/memory/1936-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1936-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019515-110.dat upx behavioral1/files/0x000500000001957c-126.dat upx behavioral1/memory/2860-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019547-119.dat upx behavioral1/memory/1920-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a7-135.dat upx behavioral1/memory/560-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195a9-142.dat upx behavioral1/files/0x00050000000195ab-150.dat upx behavioral1/files/0x00050000000195ad-157.dat upx behavioral1/files/0x00050000000195b1-176.dat upx behavioral1/memory/2716-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195af-168.dat upx behavioral1/memory/2808-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b3-186.dat upx behavioral1/memory/2176-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b5-192.dat upx behavioral1/memory/3052-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b7-201.dat upx behavioral1/files/0x00050000000195bb-209.dat upx behavioral1/files/0x00050000000195bd-215.dat upx behavioral1/files/0x00050000000195c1-222.dat upx behavioral1/memory/2032-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c3-231.dat upx behavioral1/files/0x00050000000195c5-238.dat upx behavioral1/files/0x00050000000195c6-246.dat upx behavioral1/files/0x00050000000195c7-254.dat upx behavioral1/memory/1212-253-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960c-262.dat upx behavioral1/memory/1532-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/856-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2200-310-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2928-331-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2912-347-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-359-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1872-378-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1908-448-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnjthj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpftt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthtvjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbrbbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdndj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfhbprj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njtdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djxftr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hltfplj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdxbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xblprp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvjhfdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvlrvjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvxvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvxvnvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpjrnrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjxbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjhjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdjbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbpjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpbfbvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrlhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvrtjhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnftjdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prhrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhdpbjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xntbbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djljrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdtljnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdljp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlntdpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjrdxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpntdbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxpfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phxhxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjffxrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnrrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpjhx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2188 2280 63448f7a15593c12dfaacd43ee45b66fc71efdc9c0c0e1469c44d3869c508a7c.exe 31 PID 2280 wrote to memory of 2188 2280 63448f7a15593c12dfaacd43ee45b66fc71efdc9c0c0e1469c44d3869c508a7c.exe 31 PID 2280 wrote to memory of 2188 2280 63448f7a15593c12dfaacd43ee45b66fc71efdc9c0c0e1469c44d3869c508a7c.exe 31 PID 2280 wrote to memory of 2188 2280 63448f7a15593c12dfaacd43ee45b66fc71efdc9c0c0e1469c44d3869c508a7c.exe 31 PID 2188 wrote to memory of 1708 2188 thdbx.exe 32 PID 2188 wrote to memory of 1708 2188 thdbx.exe 32 PID 2188 wrote to memory of 1708 2188 thdbx.exe 32 PID 2188 wrote to memory of 1708 2188 thdbx.exe 32 PID 1708 wrote to memory of 2448 1708 bhlpx.exe 33 PID 1708 wrote to memory of 2448 1708 bhlpx.exe 33 PID 1708 wrote to memory of 2448 1708 bhlpx.exe 33 PID 1708 wrote to memory of 2448 1708 bhlpx.exe 33 PID 2448 wrote to memory of 2724 2448 rtxnfjd.exe 34 PID 2448 wrote to memory of 2724 2448 rtxnfjd.exe 34 PID 2448 wrote to memory of 2724 2448 rtxnfjd.exe 34 PID 2448 wrote to memory of 2724 2448 rtxnfjd.exe 34 PID 2724 wrote to memory of 2876 2724 tjtnrl.exe 35 PID 2724 wrote to memory of 2876 2724 tjtnrl.exe 35 PID 2724 wrote to memory of 2876 2724 tjtnrl.exe 35 PID 2724 wrote to memory of 2876 2724 tjtnrl.exe 35 PID 2876 wrote to memory of 1192 2876 xptfjpj.exe 36 PID 2876 wrote to memory of 1192 2876 xptfjpj.exe 36 PID 2876 wrote to memory of 1192 2876 xptfjpj.exe 36 PID 2876 wrote to memory of 1192 2876 xptfjpj.exe 36 PID 1192 wrote to memory of 2996 1192 hhvbjtf.exe 37 PID 1192 wrote to memory of 2996 1192 hhvbjtf.exe 37 PID 1192 wrote to memory of 2996 1192 hhvbjtf.exe 37 PID 1192 wrote to memory of 2996 1192 hhvbjtf.exe 37 PID 2996 wrote to memory of 2052 2996 tlxfrhj.exe 38 PID 2996 wrote to memory of 2052 2996 tlxfrhj.exe 38 PID 2996 wrote to memory of 2052 2996 tlxfrhj.exe 38 PID 2996 wrote to memory of 2052 2996 tlxfrhj.exe 38 PID 2052 wrote to memory of 320 2052 djtpv.exe 39 PID 2052 wrote to memory of 320 2052 djtpv.exe 39 PID 2052 wrote to memory of 320 2052 djtpv.exe 39 PID 2052 wrote to memory of 320 2052 djtpv.exe 39 PID 320 wrote to memory of 2376 320 bhppdp.exe 40 PID 320 wrote to memory of 2376 320 bhppdp.exe 40 PID 320 wrote to memory of 2376 320 bhppdp.exe 40 PID 320 wrote to memory of 2376 320 bhppdp.exe 40 PID 2376 wrote to memory of 656 2376 bhdxpx.exe 41 PID 2376 wrote to memory of 656 2376 bhdxpx.exe 41 PID 2376 wrote to memory of 656 2376 bhdxpx.exe 41 PID 2376 wrote to memory of 656 2376 bhdxpx.exe 41 PID 656 wrote to memory of 1936 656 hntht.exe 42 PID 656 wrote to memory of 1936 656 hntht.exe 42 PID 656 wrote to memory of 1936 656 hntht.exe 42 PID 656 wrote to memory of 1936 656 hntht.exe 42 PID 1936 wrote to memory of 832 1936 xbbfhxp.exe 43 PID 1936 wrote to memory of 832 1936 xbbfhxp.exe 43 PID 1936 wrote to memory of 832 1936 xbbfhxp.exe 43 PID 1936 wrote to memory of 832 1936 xbbfhxp.exe 43 PID 832 wrote to memory of 2860 832 pbhbfr.exe 44 PID 832 wrote to memory of 2860 832 pbhbfr.exe 44 PID 832 wrote to memory of 2860 832 pbhbfr.exe 44 PID 832 wrote to memory of 2860 832 pbhbfr.exe 44 PID 2860 wrote to memory of 560 2860 brrbph.exe 45 PID 2860 wrote to memory of 560 2860 brrbph.exe 45 PID 2860 wrote to memory of 560 2860 brrbph.exe 45 PID 2860 wrote to memory of 560 2860 brrbph.exe 45 PID 560 wrote to memory of 1920 560 pbtpx.exe 46 PID 560 wrote to memory of 1920 560 pbtpx.exe 46 PID 560 wrote to memory of 1920 560 pbtpx.exe 46 PID 560 wrote to memory of 1920 560 pbtpx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\63448f7a15593c12dfaacd43ee45b66fc71efdc9c0c0e1469c44d3869c508a7c.exe"C:\Users\Admin\AppData\Local\Temp\63448f7a15593c12dfaacd43ee45b66fc71efdc9c0c0e1469c44d3869c508a7c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\thdbx.exec:\thdbx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\bhlpx.exec:\bhlpx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\rtxnfjd.exec:\rtxnfjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\tjtnrl.exec:\tjtnrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\xptfjpj.exec:\xptfjpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\hhvbjtf.exec:\hhvbjtf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\tlxfrhj.exec:\tlxfrhj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\djtpv.exec:\djtpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\bhppdp.exec:\bhppdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\bhdxpx.exec:\bhdxpx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\hntht.exec:\hntht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\xbbfhxp.exec:\xbbfhxp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\pbhbfr.exec:\pbhbfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\brrbph.exec:\brrbph.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\pbtpx.exec:\pbtpx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\txpvjn.exec:\txpvjn.exe17⤵
- Executes dropped EXE
PID:1920 -
\??\c:\jbbdl.exec:\jbbdl.exe18⤵
- Executes dropped EXE
PID:924 -
\??\c:\ftllpx.exec:\ftllpx.exe19⤵
- Executes dropped EXE
PID:2476 -
\??\c:\tbvpxjv.exec:\tbvpxjv.exe20⤵
- Executes dropped EXE
PID:2808 -
\??\c:\xthvxjj.exec:\xthvxjj.exe21⤵
- Executes dropped EXE
PID:2716 -
\??\c:\vjrvbv.exec:\vjrvbv.exe22⤵
- Executes dropped EXE
PID:2176 -
\??\c:\lrlxt.exec:\lrlxt.exe23⤵
- Executes dropped EXE
PID:1180 -
\??\c:\rbtjx.exec:\rbtjx.exe24⤵
- Executes dropped EXE
PID:3052 -
\??\c:\djddvv.exec:\djddvv.exe25⤵
- Executes dropped EXE
PID:640 -
\??\c:\njtdj.exec:\njtdj.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1148 -
\??\c:\rhthbbx.exec:\rhthbbx.exe27⤵
- Executes dropped EXE
PID:328 -
\??\c:\pfdhrbx.exec:\pfdhrbx.exe28⤵
- Executes dropped EXE
PID:2856 -
\??\c:\phfhl.exec:\phfhl.exe29⤵
- Executes dropped EXE
PID:2032 -
\??\c:\bbdndtb.exec:\bbdndtb.exe30⤵
- Executes dropped EXE
PID:1524 -
\??\c:\lpvllpj.exec:\lpvllpj.exe31⤵
- Executes dropped EXE
PID:1212 -
\??\c:\bhtvh.exec:\bhtvh.exe32⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jbnjrf.exec:\jbnjrf.exe33⤵
- Executes dropped EXE
PID:2368 -
\??\c:\fvdlxt.exec:\fvdlxt.exe34⤵
- Executes dropped EXE
PID:1532 -
\??\c:\bpvjdbd.exec:\bpvjdbd.exe35⤵
- Executes dropped EXE
PID:856 -
\??\c:\jjtjtl.exec:\jjtjtl.exe36⤵
- Executes dropped EXE
PID:788 -
\??\c:\jxpfr.exec:\jxpfr.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:524 -
\??\c:\hvxnr.exec:\hvxnr.exe38⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jrxdr.exec:\jrxdr.exe39⤵
- Executes dropped EXE
PID:1552 -
\??\c:\rlfbjt.exec:\rlfbjt.exe40⤵
- Executes dropped EXE
PID:1620 -
\??\c:\nntbh.exec:\nntbh.exe41⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nvlrvjn.exec:\nvlrvjn.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2448 -
\??\c:\njpth.exec:\njpth.exe43⤵
- Executes dropped EXE
PID:2724 -
\??\c:\hftltv.exec:\hftltv.exe44⤵
- Executes dropped EXE
PID:3056 -
\??\c:\jvbhnt.exec:\jvbhnt.exe45⤵
- Executes dropped EXE
PID:2928 -
\??\c:\xhnvb.exec:\xhnvb.exe46⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vrlhl.exec:\vrlhl.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2912 -
\??\c:\vnfdlr.exec:\vnfdlr.exe48⤵
- Executes dropped EXE
PID:2920 -
\??\c:\btrff.exec:\btrff.exe49⤵
- Executes dropped EXE
PID:2756 -
\??\c:\bxxtvd.exec:\bxxtvd.exe50⤵
- Executes dropped EXE
PID:2676 -
\??\c:\hbtxdp.exec:\hbtxdp.exe51⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jjnfblt.exec:\jjnfblt.exe52⤵
- Executes dropped EXE
PID:2576 -
\??\c:\dbhlh.exec:\dbhlh.exe53⤵
- Executes dropped EXE
PID:1872 -
\??\c:\rxjrlj.exec:\rxjrlj.exe54⤵
- Executes dropped EXE
PID:2708 -
\??\c:\htrpljd.exec:\htrpljd.exe55⤵
- Executes dropped EXE
PID:2916 -
\??\c:\jbnhvp.exec:\jbnhvp.exe56⤵
- Executes dropped EXE
PID:832 -
\??\c:\rxvdp.exec:\rxvdp.exe57⤵
- Executes dropped EXE
PID:2840 -
\??\c:\rjtpb.exec:\rjtpb.exe58⤵
- Executes dropped EXE
PID:1152 -
\??\c:\hpllr.exec:\hpllr.exe59⤵
- Executes dropped EXE
PID:2516 -
\??\c:\fhvtfxv.exec:\fhvtfxv.exe60⤵
- Executes dropped EXE
PID:2364 -
\??\c:\drnpbj.exec:\drnpbj.exe61⤵
- Executes dropped EXE
PID:1284 -
\??\c:\txdrbxn.exec:\txdrbxn.exe62⤵
- Executes dropped EXE
PID:924 -
\??\c:\xxlxh.exec:\xxlxh.exe63⤵
- Executes dropped EXE
PID:2404 -
\??\c:\nfbbphb.exec:\nfbbphb.exe64⤵
- Executes dropped EXE
PID:1044 -
\??\c:\vhhpjvp.exec:\vhhpjvp.exe65⤵
- Executes dropped EXE
PID:2344 -
\??\c:\nhbjnd.exec:\nhbjnd.exe66⤵PID:2564
-
\??\c:\rnrdlv.exec:\rnrdlv.exe67⤵PID:1908
-
\??\c:\bnnln.exec:\bnnln.exe68⤵PID:1352
-
\??\c:\lbjptn.exec:\lbjptn.exe69⤵PID:1964
-
\??\c:\bnrbjvp.exec:\bnrbjvp.exe70⤵PID:276
-
\??\c:\rblfxbb.exec:\rblfxbb.exe71⤵PID:1164
-
\??\c:\jlntdpl.exec:\jlntdpl.exe72⤵
- System Location Discovery: System Language Discovery
PID:952 -
\??\c:\fnpnjp.exec:\fnpnjp.exe73⤵PID:1148
-
\??\c:\xtlxf.exec:\xtlxf.exe74⤵PID:1744
-
\??\c:\hdjrl.exec:\hdjrl.exe75⤵PID:648
-
\??\c:\lxfbtjr.exec:\lxfbtjr.exe76⤵PID:1788
-
\??\c:\pdvpjh.exec:\pdvpjh.exe77⤵PID:1540
-
\??\c:\phjvrlr.exec:\phjvrlr.exe78⤵PID:1828
-
\??\c:\blflvb.exec:\blflvb.exe79⤵PID:2040
-
\??\c:\nhvjh.exec:\nhvjh.exe80⤵PID:2488
-
\??\c:\fdrdpt.exec:\fdrdpt.exe81⤵PID:1344
-
\??\c:\vfplftf.exec:\vfplftf.exe82⤵PID:1820
-
\??\c:\ptxhrhn.exec:\ptxhrhn.exe83⤵PID:1012
-
\??\c:\xrpvp.exec:\xrpvp.exe84⤵PID:880
-
\??\c:\nvpvft.exec:\nvpvft.exe85⤵PID:2340
-
\??\c:\djjhj.exec:\djjhj.exe86⤵PID:1604
-
\??\c:\njxnf.exec:\njxnf.exe87⤵PID:2552
-
\??\c:\nbdrjn.exec:\nbdrjn.exe88⤵PID:1516
-
\??\c:\ddrxbtt.exec:\ddrxbtt.exe89⤵PID:1708
-
\??\c:\ffvrxn.exec:\ffvrxn.exe90⤵PID:2388
-
\??\c:\txhbn.exec:\txhbn.exe91⤵PID:2892
-
\??\c:\dvvthjn.exec:\dvvthjn.exe92⤵PID:2776
-
\??\c:\lxhdplb.exec:\lxhdplb.exe93⤵PID:2924
-
\??\c:\rftljdf.exec:\rftljdf.exe94⤵PID:2824
-
\??\c:\ljbjd.exec:\ljbjd.exe95⤵PID:2752
-
\??\c:\jpjbbj.exec:\jpjbbj.exe96⤵PID:2380
-
\??\c:\rjpdxj.exec:\rjpdxj.exe97⤵PID:1904
-
\??\c:\rxlxdj.exec:\rxlxdj.exe98⤵PID:2104
-
\??\c:\xxbjdj.exec:\xxbjdj.exe99⤵PID:1104
-
\??\c:\bljlxf.exec:\bljlxf.exe100⤵PID:1312
-
\??\c:\rffhf.exec:\rffhf.exe101⤵PID:1616
-
\??\c:\tjrbj.exec:\tjrbj.exe102⤵PID:1648
-
\??\c:\fphxfnv.exec:\fphxfnv.exe103⤵PID:3000
-
\??\c:\bldtr.exec:\bldtr.exe104⤵PID:1868
-
\??\c:\njxltf.exec:\njxltf.exe105⤵PID:2804
-
\??\c:\pnpfp.exec:\pnpfp.exe106⤵PID:1948
-
\??\c:\dxrttbf.exec:\dxrttbf.exe107⤵PID:2820
-
\??\c:\xrxnxhh.exec:\xrxnxhh.exe108⤵PID:1464
-
\??\c:\brfdld.exec:\brfdld.exe109⤵PID:1892
-
\??\c:\dbxfhx.exec:\dbxfhx.exe110⤵PID:2232
-
\??\c:\jpfjhn.exec:\jpfjhn.exe111⤵PID:2988
-
\??\c:\jdxtn.exec:\jdxtn.exe112⤵PID:3004
-
\??\c:\fhjtxd.exec:\fhjtxd.exe113⤵PID:1068
-
\??\c:\dhndn.exec:\dhndn.exe114⤵PID:1484
-
\??\c:\xdbnrnd.exec:\xdbnrnd.exe115⤵PID:2176
-
\??\c:\fvtlv.exec:\fvtlv.exe116⤵PID:1052
-
\??\c:\lthpjn.exec:\lthpjn.exe117⤵PID:1348
-
\??\c:\pfrpxd.exec:\pfrpxd.exe118⤵PID:1964
-
\??\c:\jpxvnhn.exec:\jpxvnhn.exe119⤵PID:1800
-
\??\c:\xpfrhr.exec:\xpfrhr.exe120⤵PID:1164
-
\??\c:\fvxvnvh.exec:\fvxvnvh.exe121⤵
- System Location Discovery: System Language Discovery
PID:968
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-