Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad7fdb334d287c23dd8f3a7f3ae30c4785fffd5dd018afd4add3ce5564f54852.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ad7fdb334d287c23dd8f3a7f3ae30c4785fffd5dd018afd4add3ce5564f54852.exe
-
Size
454KB
-
MD5
5bd3c5a83b4a45614e163ce8d8c4648e
-
SHA1
810a05636b2e38176953f9714a6ae652ae93654c
-
SHA256
ad7fdb334d287c23dd8f3a7f3ae30c4785fffd5dd018afd4add3ce5564f54852
-
SHA512
df12dadf9b63696841f17015d2ded03a68e2819edf165428d73690d4f0b26fb1dbba085c03cfaf241b76c9c003da024e2a466b14a407562265439edd5566d879
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeL:q7Tc2NYHUrAwfMp3CDL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2092-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-93-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2840-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1840-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/296-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-376-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1672-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1396-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1396-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1012-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-500-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2352-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-565-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2388-568-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-587-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2668-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-704-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2100-711-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2428-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2832 fjbbrb.exe 2744 vjjfnl.exe 3004 drbxh.exe 2644 pxnpj.exe 2676 hjblhh.exe 2696 jjdpf.exe 2888 vfhbppd.exe 964 xvxnlb.exe 1672 bhtnvh.exe 2840 lrfpvfp.exe 2680 bjllf.exe 2104 pfvfd.exe 1960 hpvhtnj.exe 1272 dftnx.exe 1632 dxltt.exe 296 bvfbf.exe 2412 pnlxfb.exe 1840 jflrxj.exe 2260 xlxnt.exe 2492 dpbdpvn.exe 1364 vtblb.exe 1012 vpfjp.exe 2992 rvblt.exe 1468 bxvrb.exe 1464 tjjpd.exe 2016 tfjdfph.exe 1788 nbtdvv.exe 1496 fjvbt.exe 1976 hvvlv.exe 2516 nhjfjth.exe 2388 jjtbptn.exe 2248 rpppn.exe 2836 dfrhr.exe 1504 fjrdbn.exe 2436 xnplff.exe 3008 pfplth.exe 2908 ftdbjhh.exe 2932 nnpdxv.exe 2864 ntvtvvx.exe 2960 nxxnb.exe 2372 pdhdxxl.exe 2324 fhpxr.exe 2276 njtdpl.exe 1672 lhnnffl.exe 3028 xjttd.exe 2688 jffnnd.exe 1968 hfhlnb.exe 2432 dnrtbd.exe 2588 lhvdl.exe 2304 lltjd.exe 1572 jprhn.exe 1632 tfbjfdr.exe 2192 dnrhxlv.exe 1780 jdtrlvf.exe 2480 tntjlxd.exe 1396 pdvxrt.exe 2496 djndxdp.exe 2144 lftddl.exe 972 bbrvlf.exe 1012 fbvhpd.exe 1952 dhjvbr.exe 2580 trhrhv.exe 1656 ppprdvh.exe 1972 rxftn.exe -
resource yara_rule behavioral1/memory/2092-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/296-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-424-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1396-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-562-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/3008-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-704-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2100-711-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2428-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-741-0x00000000003A0000-0x00000000003CA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vldhvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrlrhvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxftn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnflnrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpjpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtxlfjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpfln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frtnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpllp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xljjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htvnrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fphrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfxnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnprthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlvxlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnxnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blffxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdntdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrphnpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rthnfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfjjnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbnttj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfbxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpptxrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndvdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blpnddn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltpbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbxhbdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httftt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnvtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtnfppl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhntdbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlfrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjlfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnxlxhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xphvlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txlrlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drxdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrfhnjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdlbndn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhfndrv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2832 2092 ad7fdb334d287c23dd8f3a7f3ae30c4785fffd5dd018afd4add3ce5564f54852.exe 30 PID 2092 wrote to memory of 2832 2092 ad7fdb334d287c23dd8f3a7f3ae30c4785fffd5dd018afd4add3ce5564f54852.exe 30 PID 2092 wrote to memory of 2832 2092 ad7fdb334d287c23dd8f3a7f3ae30c4785fffd5dd018afd4add3ce5564f54852.exe 30 PID 2092 wrote to memory of 2832 2092 ad7fdb334d287c23dd8f3a7f3ae30c4785fffd5dd018afd4add3ce5564f54852.exe 30 PID 2832 wrote to memory of 2744 2832 fjbbrb.exe 31 PID 2832 wrote to memory of 2744 2832 fjbbrb.exe 31 PID 2832 wrote to memory of 2744 2832 fjbbrb.exe 31 PID 2832 wrote to memory of 2744 2832 fjbbrb.exe 31 PID 2744 wrote to memory of 3004 2744 vjjfnl.exe 32 PID 2744 wrote to memory of 3004 2744 vjjfnl.exe 32 PID 2744 wrote to memory of 3004 2744 vjjfnl.exe 32 PID 2744 wrote to memory of 3004 2744 vjjfnl.exe 32 PID 3004 wrote to memory of 2644 3004 drbxh.exe 33 PID 3004 wrote to memory of 2644 3004 drbxh.exe 33 PID 3004 wrote to memory of 2644 3004 drbxh.exe 33 PID 3004 wrote to memory of 2644 3004 drbxh.exe 33 PID 2644 wrote to memory of 2676 2644 pxnpj.exe 34 PID 2644 wrote to memory of 2676 2644 pxnpj.exe 34 PID 2644 wrote to memory of 2676 2644 pxnpj.exe 34 PID 2644 wrote to memory of 2676 2644 pxnpj.exe 34 PID 2676 wrote to memory of 2696 2676 hjblhh.exe 35 PID 2676 wrote to memory of 2696 2676 hjblhh.exe 35 PID 2676 wrote to memory of 2696 2676 hjblhh.exe 35 PID 2676 wrote to memory of 2696 2676 hjblhh.exe 35 PID 2696 wrote to memory of 2888 2696 jjdpf.exe 36 PID 2696 wrote to memory of 2888 2696 jjdpf.exe 36 PID 2696 wrote to memory of 2888 2696 jjdpf.exe 36 PID 2696 wrote to memory of 2888 2696 jjdpf.exe 36 PID 2888 wrote to memory of 964 2888 vfhbppd.exe 37 PID 2888 wrote to memory of 964 2888 vfhbppd.exe 37 PID 2888 wrote to memory of 964 2888 vfhbppd.exe 37 PID 2888 wrote to memory of 964 2888 vfhbppd.exe 37 PID 964 wrote to memory of 1672 964 xvxnlb.exe 38 PID 964 wrote to memory of 1672 964 xvxnlb.exe 38 PID 964 wrote to memory of 1672 964 xvxnlb.exe 38 PID 964 wrote to memory of 1672 964 xvxnlb.exe 38 PID 1672 wrote to memory of 2840 1672 bhtnvh.exe 39 PID 1672 wrote to memory of 2840 1672 bhtnvh.exe 39 PID 1672 wrote to memory of 2840 1672 bhtnvh.exe 39 PID 1672 wrote to memory of 2840 1672 bhtnvh.exe 39 PID 2840 wrote to memory of 2680 2840 lrfpvfp.exe 40 PID 2840 wrote to memory of 2680 2840 lrfpvfp.exe 40 PID 2840 wrote to memory of 2680 2840 lrfpvfp.exe 40 PID 2840 wrote to memory of 2680 2840 lrfpvfp.exe 40 PID 2680 wrote to memory of 2104 2680 bjllf.exe 41 PID 2680 wrote to memory of 2104 2680 bjllf.exe 41 PID 2680 wrote to memory of 2104 2680 bjllf.exe 41 PID 2680 wrote to memory of 2104 2680 bjllf.exe 41 PID 2104 wrote to memory of 1960 2104 pfvfd.exe 42 PID 2104 wrote to memory of 1960 2104 pfvfd.exe 42 PID 2104 wrote to memory of 1960 2104 pfvfd.exe 42 PID 2104 wrote to memory of 1960 2104 pfvfd.exe 42 PID 1960 wrote to memory of 1272 1960 hpvhtnj.exe 43 PID 1960 wrote to memory of 1272 1960 hpvhtnj.exe 43 PID 1960 wrote to memory of 1272 1960 hpvhtnj.exe 43 PID 1960 wrote to memory of 1272 1960 hpvhtnj.exe 43 PID 1272 wrote to memory of 1632 1272 dftnx.exe 44 PID 1272 wrote to memory of 1632 1272 dftnx.exe 44 PID 1272 wrote to memory of 1632 1272 dftnx.exe 44 PID 1272 wrote to memory of 1632 1272 dftnx.exe 44 PID 1632 wrote to memory of 296 1632 dxltt.exe 45 PID 1632 wrote to memory of 296 1632 dxltt.exe 45 PID 1632 wrote to memory of 296 1632 dxltt.exe 45 PID 1632 wrote to memory of 296 1632 dxltt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad7fdb334d287c23dd8f3a7f3ae30c4785fffd5dd018afd4add3ce5564f54852.exe"C:\Users\Admin\AppData\Local\Temp\ad7fdb334d287c23dd8f3a7f3ae30c4785fffd5dd018afd4add3ce5564f54852.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\fjbbrb.exec:\fjbbrb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\vjjfnl.exec:\vjjfnl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\drbxh.exec:\drbxh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\pxnpj.exec:\pxnpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\hjblhh.exec:\hjblhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\jjdpf.exec:\jjdpf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\vfhbppd.exec:\vfhbppd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\xvxnlb.exec:\xvxnlb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\bhtnvh.exec:\bhtnvh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\lrfpvfp.exec:\lrfpvfp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\bjllf.exec:\bjllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\pfvfd.exec:\pfvfd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\hpvhtnj.exec:\hpvhtnj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\dftnx.exec:\dftnx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\dxltt.exec:\dxltt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\bvfbf.exec:\bvfbf.exe17⤵
- Executes dropped EXE
PID:296 -
\??\c:\pnlxfb.exec:\pnlxfb.exe18⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jflrxj.exec:\jflrxj.exe19⤵
- Executes dropped EXE
PID:1840 -
\??\c:\xlxnt.exec:\xlxnt.exe20⤵
- Executes dropped EXE
PID:2260 -
\??\c:\dpbdpvn.exec:\dpbdpvn.exe21⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vtblb.exec:\vtblb.exe22⤵
- Executes dropped EXE
PID:1364 -
\??\c:\vpfjp.exec:\vpfjp.exe23⤵
- Executes dropped EXE
PID:1012 -
\??\c:\rvblt.exec:\rvblt.exe24⤵
- Executes dropped EXE
PID:2992 -
\??\c:\bxvrb.exec:\bxvrb.exe25⤵
- Executes dropped EXE
PID:1468 -
\??\c:\tjjpd.exec:\tjjpd.exe26⤵
- Executes dropped EXE
PID:1464 -
\??\c:\tfjdfph.exec:\tfjdfph.exe27⤵
- Executes dropped EXE
PID:2016 -
\??\c:\nbtdvv.exec:\nbtdvv.exe28⤵
- Executes dropped EXE
PID:1788 -
\??\c:\fjvbt.exec:\fjvbt.exe29⤵
- Executes dropped EXE
PID:1496 -
\??\c:\hvvlv.exec:\hvvlv.exe30⤵
- Executes dropped EXE
PID:1976 -
\??\c:\nhjfjth.exec:\nhjfjth.exe31⤵
- Executes dropped EXE
PID:2516 -
\??\c:\jjtbptn.exec:\jjtbptn.exe32⤵
- Executes dropped EXE
PID:2388 -
\??\c:\rpppn.exec:\rpppn.exe33⤵
- Executes dropped EXE
PID:2248 -
\??\c:\dfrhr.exec:\dfrhr.exe34⤵
- Executes dropped EXE
PID:2836 -
\??\c:\fjrdbn.exec:\fjrdbn.exe35⤵
- Executes dropped EXE
PID:1504 -
\??\c:\xnplff.exec:\xnplff.exe36⤵
- Executes dropped EXE
PID:2436 -
\??\c:\pfplth.exec:\pfplth.exe37⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ftdbjhh.exec:\ftdbjhh.exe38⤵
- Executes dropped EXE
PID:2908 -
\??\c:\nnpdxv.exec:\nnpdxv.exe39⤵
- Executes dropped EXE
PID:2932 -
\??\c:\ntvtvvx.exec:\ntvtvvx.exe40⤵
- Executes dropped EXE
PID:2864 -
\??\c:\nxxnb.exec:\nxxnb.exe41⤵
- Executes dropped EXE
PID:2960 -
\??\c:\pdhdxxl.exec:\pdhdxxl.exe42⤵
- Executes dropped EXE
PID:2372 -
\??\c:\fhpxr.exec:\fhpxr.exe43⤵
- Executes dropped EXE
PID:2324 -
\??\c:\njtdpl.exec:\njtdpl.exe44⤵
- Executes dropped EXE
PID:2276 -
\??\c:\lhnnffl.exec:\lhnnffl.exe45⤵
- Executes dropped EXE
PID:1672 -
\??\c:\xjttd.exec:\xjttd.exe46⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jffnnd.exec:\jffnnd.exe47⤵
- Executes dropped EXE
PID:2688 -
\??\c:\hfhlnb.exec:\hfhlnb.exe48⤵
- Executes dropped EXE
PID:1968 -
\??\c:\dnrtbd.exec:\dnrtbd.exe49⤵
- Executes dropped EXE
PID:2432 -
\??\c:\lhvdl.exec:\lhvdl.exe50⤵
- Executes dropped EXE
PID:2588 -
\??\c:\lltjd.exec:\lltjd.exe51⤵
- Executes dropped EXE
PID:2304 -
\??\c:\jprhn.exec:\jprhn.exe52⤵
- Executes dropped EXE
PID:1572 -
\??\c:\tfbjfdr.exec:\tfbjfdr.exe53⤵
- Executes dropped EXE
PID:1632 -
\??\c:\dnrhxlv.exec:\dnrhxlv.exe54⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jdtrlvf.exec:\jdtrlvf.exe55⤵
- Executes dropped EXE
PID:1780 -
\??\c:\tntjlxd.exec:\tntjlxd.exe56⤵
- Executes dropped EXE
PID:2480 -
\??\c:\pdvxrt.exec:\pdvxrt.exe57⤵
- Executes dropped EXE
PID:1396 -
\??\c:\djndxdp.exec:\djndxdp.exe58⤵
- Executes dropped EXE
PID:2496 -
\??\c:\lftddl.exec:\lftddl.exe59⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bbrvlf.exec:\bbrvlf.exe60⤵
- Executes dropped EXE
PID:972 -
\??\c:\fbvhpd.exec:\fbvhpd.exe61⤵
- Executes dropped EXE
PID:1012 -
\??\c:\dhjvbr.exec:\dhjvbr.exe62⤵
- Executes dropped EXE
PID:1952 -
\??\c:\trhrhv.exec:\trhrhv.exe63⤵
- Executes dropped EXE
PID:2580 -
\??\c:\ppprdvh.exec:\ppprdvh.exe64⤵
- Executes dropped EXE
PID:1656 -
\??\c:\rxftn.exec:\rxftn.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1972 -
\??\c:\ntpvjhr.exec:\ntpvjhr.exe66⤵PID:2352
-
\??\c:\ptnvvj.exec:\ptnvvj.exe67⤵PID:1588
-
\??\c:\nrdrd.exec:\nrdrd.exe68⤵PID:1788
-
\??\c:\fpjpdj.exec:\fpjpdj.exe69⤵
- System Location Discovery: System Language Discovery
PID:1496 -
\??\c:\lxhvvv.exec:\lxhvvv.exe70⤵PID:2268
-
\??\c:\djrrdpx.exec:\djrrdpx.exe71⤵PID:1560
-
\??\c:\hptvdn.exec:\hptvdn.exe72⤵PID:2388
-
\??\c:\htthf.exec:\htthf.exe73⤵PID:1552
-
\??\c:\jhjxrt.exec:\jhjxrt.exe74⤵PID:2848
-
\??\c:\dxhnjjr.exec:\dxhnjjr.exe75⤵PID:2760
-
\??\c:\rlflrh.exec:\rlflrh.exe76⤵PID:2880
-
\??\c:\vhpbrb.exec:\vhpbrb.exe77⤵PID:2436
-
\??\c:\bxbhfxj.exec:\bxbhfxj.exe78⤵PID:3008
-
\??\c:\fphrn.exec:\fphrn.exe79⤵
- System Location Discovery: System Language Discovery
PID:2644 -
\??\c:\lrrrd.exec:\lrrrd.exe80⤵PID:2656
-
\??\c:\tbrft.exec:\tbrft.exe81⤵PID:2900
-
\??\c:\jjtjpjn.exec:\jjtjpjn.exe82⤵PID:2668
-
\??\c:\vtvnr.exec:\vtvnr.exe83⤵PID:2696
-
\??\c:\jdvppfn.exec:\jdvppfn.exe84⤵PID:964
-
\??\c:\dtnbln.exec:\dtnbln.exe85⤵PID:2124
-
\??\c:\nfnbp.exec:\nfnbp.exe86⤵PID:1916
-
\??\c:\ltrvl.exec:\ltrvl.exe87⤵PID:932
-
\??\c:\dntfrj.exec:\dntfrj.exe88⤵PID:1240
-
\??\c:\bntlrn.exec:\bntlrn.exe89⤵PID:2708
-
\??\c:\xdxlnb.exec:\xdxlnb.exe90⤵PID:2912
-
\??\c:\dtdpt.exec:\dtdpt.exe91⤵PID:1960
-
\??\c:\dbfbd.exec:\dbfbd.exe92⤵PID:1272
-
\??\c:\pblbpn.exec:\pblbpn.exe93⤵PID:2100
-
\??\c:\jddnvpf.exec:\jddnvpf.exe94⤵PID:2428
-
\??\c:\pbvldnh.exec:\pbvldnh.exe95⤵PID:2928
-
\??\c:\frtnf.exec:\frtnf.exe96⤵PID:1944
-
\??\c:\jfntf.exec:\jfntf.exe97⤵PID:2288
-
\??\c:\jhhjtbh.exec:\jhhjtbh.exe98⤵PID:820
-
\??\c:\hxbltd.exec:\hxbltd.exe99⤵PID:976
-
\??\c:\jrrdp.exec:\jrrdp.exe100⤵PID:316
-
\??\c:\vvvpvl.exec:\vvvpvl.exe101⤵PID:1668
-
\??\c:\dnhbvh.exec:\dnhbvh.exe102⤵PID:2356
-
\??\c:\pftbj.exec:\pftbj.exe103⤵PID:1772
-
\??\c:\dtxlfjf.exec:\dtxlfjf.exe104⤵
- System Location Discovery: System Language Discovery
PID:1952 -
\??\c:\jbjhpv.exec:\jbjhpv.exe105⤵PID:1576
-
\??\c:\dpnfh.exec:\dpnfh.exe106⤵PID:2368
-
\??\c:\vldhvx.exec:\vldhvx.exe107⤵
- System Location Discovery: System Language Discovery
PID:748 -
\??\c:\fvtdb.exec:\fvtdb.exe108⤵PID:1276
-
\??\c:\fxpjtf.exec:\fxpjtf.exe109⤵PID:1932
-
\??\c:\dxtrxvl.exec:\dxtrxvl.exe110⤵PID:1940
-
\??\c:\nxbpt.exec:\nxbpt.exe111⤵PID:1020
-
\??\c:\dnffxrh.exec:\dnffxrh.exe112⤵PID:1808
-
\??\c:\jxvtpn.exec:\jxvtpn.exe113⤵PID:1724
-
\??\c:\bxjjb.exec:\bxjjb.exe114⤵PID:1560
-
\??\c:\xldvn.exec:\xldvn.exe115⤵PID:2388
-
\??\c:\pbrtx.exec:\pbrtx.exe116⤵PID:1040
-
\??\c:\lfpndtr.exec:\lfpndtr.exe117⤵PID:1544
-
\??\c:\fxtrjbt.exec:\fxtrjbt.exe118⤵PID:2772
-
\??\c:\flhrr.exec:\flhrr.exe119⤵PID:2380
-
\??\c:\fjxtpvx.exec:\fjxtpvx.exe120⤵PID:2812
-
\??\c:\vdffx.exec:\vdffx.exe121⤵PID:2908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-