Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e035aa52668eb3c0540108e2d7c42c34525e5a2e0f609c6f404095ce4d5327c6.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
e035aa52668eb3c0540108e2d7c42c34525e5a2e0f609c6f404095ce4d5327c6.exe
-
Size
455KB
-
MD5
0dd232fa9e6dbaf8f3b4bbc5d485d365
-
SHA1
ed60023357b13686f347090aff2e41dc1d8d758d
-
SHA256
e035aa52668eb3c0540108e2d7c42c34525e5a2e0f609c6f404095ce4d5327c6
-
SHA512
628c1b58882d86e55fec70d852abf4156cf36827e2a5955d92d450482c5711866f3c2497743ae8232bd34a95c88141a281367abcea70d487eef78e6b9a5a1eec
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT2:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2344-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-28-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2480-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-47-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2924-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1116-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1228-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/276-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-242-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1720-252-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1720-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-450-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2392-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-689-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2096-733-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-800-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-807-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/868-808-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2396 fjxtb.exe 2480 vdblbrp.exe 2832 pbjnff.exe 2688 xbdnhnp.exe 2924 dlbjb.exe 2936 lvpfff.exe 2676 jdpjfxd.exe 2852 hbllhfv.exe 1168 brxplxl.exe 1876 dvtjlbh.exe 2444 rtfrt.exe 2432 dtvnr.exe 2336 phlvlbv.exe 900 xfrnvlr.exe 1116 rfhdfvt.exe 1228 bphhf.exe 1436 hjtjpn.exe 276 nrtdbv.exe 2512 blxpbnd.exe 2204 jdfpnb.exe 2280 dfxjnh.exe 2556 pvnppf.exe 2460 ftvphv.exe 2268 rnplfv.exe 2548 bnvhx.exe 1720 rnnttt.exe 1616 vrjjnbv.exe 1952 lvjrj.exe 1944 bjnvvpr.exe 2640 nfjjrhr.exe 1364 hdbrxpp.exe 3004 ptrpfvp.exe 2588 bnrbhjd.exe 1248 lnnrt.exe 1716 bjjjb.exe 2068 vjpnbfn.exe 2896 tlpbprt.exe 2480 brxfxdh.exe 2956 hfjlld.exe 2768 rltfl.exe 2720 nbdjb.exe 2736 ttjtnpr.exe 2680 vtdltl.exe 2756 fthvxj.exe 2516 bvldljj.exe 2064 llprf.exe 2300 vjpnrxn.exe 1560 npbrd.exe 2084 drxfp.exe 2000 hvvnxf.exe 1680 hbrhhdb.exe 972 bpbddv.exe 2032 hjbhjjh.exe 2928 nxfrr.exe 2016 hnjvx.exe 2784 dvttnlb.exe 1380 hlnhjtd.exe 1064 xdrvpvj.exe 2860 ntphxl.exe 2632 fhffhpl.exe 2176 tfhfd.exe 1664 nbxrrf.exe 2504 jprdjl.exe 1072 vlnvvd.exe -
resource yara_rule behavioral1/memory/2344-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-733-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-800-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-808-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-846-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdbrxpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prjrjhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxhdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvjfhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhtvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdbvvft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rftplbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndrjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llppn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbjvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blbrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjnpjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvlnjnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfvhbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phndn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhvnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntphxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfnnjjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbdtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jflvpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnldxjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvfdvrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvndldp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bllrfnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvnxfrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdblhtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptnpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjrlft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnbnvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrpnrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnfbfhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfljdpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nblrjxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tffdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2396 2344 e035aa52668eb3c0540108e2d7c42c34525e5a2e0f609c6f404095ce4d5327c6.exe 29 PID 2344 wrote to memory of 2396 2344 e035aa52668eb3c0540108e2d7c42c34525e5a2e0f609c6f404095ce4d5327c6.exe 29 PID 2344 wrote to memory of 2396 2344 e035aa52668eb3c0540108e2d7c42c34525e5a2e0f609c6f404095ce4d5327c6.exe 29 PID 2344 wrote to memory of 2396 2344 e035aa52668eb3c0540108e2d7c42c34525e5a2e0f609c6f404095ce4d5327c6.exe 29 PID 2396 wrote to memory of 2480 2396 fjxtb.exe 30 PID 2396 wrote to memory of 2480 2396 fjxtb.exe 30 PID 2396 wrote to memory of 2480 2396 fjxtb.exe 30 PID 2396 wrote to memory of 2480 2396 fjxtb.exe 30 PID 2480 wrote to memory of 2832 2480 vdblbrp.exe 31 PID 2480 wrote to memory of 2832 2480 vdblbrp.exe 31 PID 2480 wrote to memory of 2832 2480 vdblbrp.exe 31 PID 2480 wrote to memory of 2832 2480 vdblbrp.exe 31 PID 2832 wrote to memory of 2688 2832 pbjnff.exe 32 PID 2832 wrote to memory of 2688 2832 pbjnff.exe 32 PID 2832 wrote to memory of 2688 2832 pbjnff.exe 32 PID 2832 wrote to memory of 2688 2832 pbjnff.exe 32 PID 2688 wrote to memory of 2924 2688 xbdnhnp.exe 33 PID 2688 wrote to memory of 2924 2688 xbdnhnp.exe 33 PID 2688 wrote to memory of 2924 2688 xbdnhnp.exe 33 PID 2688 wrote to memory of 2924 2688 xbdnhnp.exe 33 PID 2924 wrote to memory of 2936 2924 dlbjb.exe 34 PID 2924 wrote to memory of 2936 2924 dlbjb.exe 34 PID 2924 wrote to memory of 2936 2924 dlbjb.exe 34 PID 2924 wrote to memory of 2936 2924 dlbjb.exe 34 PID 2936 wrote to memory of 2676 2936 lvpfff.exe 35 PID 2936 wrote to memory of 2676 2936 lvpfff.exe 35 PID 2936 wrote to memory of 2676 2936 lvpfff.exe 35 PID 2936 wrote to memory of 2676 2936 lvpfff.exe 35 PID 2676 wrote to memory of 2852 2676 jdpjfxd.exe 36 PID 2676 wrote to memory of 2852 2676 jdpjfxd.exe 36 PID 2676 wrote to memory of 2852 2676 jdpjfxd.exe 36 PID 2676 wrote to memory of 2852 2676 jdpjfxd.exe 36 PID 2852 wrote to memory of 1168 2852 hbllhfv.exe 37 PID 2852 wrote to memory of 1168 2852 hbllhfv.exe 37 PID 2852 wrote to memory of 1168 2852 hbllhfv.exe 37 PID 2852 wrote to memory of 1168 2852 hbllhfv.exe 37 PID 1168 wrote to memory of 1876 1168 brxplxl.exe 38 PID 1168 wrote to memory of 1876 1168 brxplxl.exe 38 PID 1168 wrote to memory of 1876 1168 brxplxl.exe 38 PID 1168 wrote to memory of 1876 1168 brxplxl.exe 38 PID 1876 wrote to memory of 2444 1876 dvtjlbh.exe 39 PID 1876 wrote to memory of 2444 1876 dvtjlbh.exe 39 PID 1876 wrote to memory of 2444 1876 dvtjlbh.exe 39 PID 1876 wrote to memory of 2444 1876 dvtjlbh.exe 39 PID 2444 wrote to memory of 2432 2444 rtfrt.exe 40 PID 2444 wrote to memory of 2432 2444 rtfrt.exe 40 PID 2444 wrote to memory of 2432 2444 rtfrt.exe 40 PID 2444 wrote to memory of 2432 2444 rtfrt.exe 40 PID 2432 wrote to memory of 2336 2432 dtvnr.exe 41 PID 2432 wrote to memory of 2336 2432 dtvnr.exe 41 PID 2432 wrote to memory of 2336 2432 dtvnr.exe 41 PID 2432 wrote to memory of 2336 2432 dtvnr.exe 41 PID 2336 wrote to memory of 900 2336 phlvlbv.exe 42 PID 2336 wrote to memory of 900 2336 phlvlbv.exe 42 PID 2336 wrote to memory of 900 2336 phlvlbv.exe 42 PID 2336 wrote to memory of 900 2336 phlvlbv.exe 42 PID 900 wrote to memory of 1116 900 xfrnvlr.exe 43 PID 900 wrote to memory of 1116 900 xfrnvlr.exe 43 PID 900 wrote to memory of 1116 900 xfrnvlr.exe 43 PID 900 wrote to memory of 1116 900 xfrnvlr.exe 43 PID 1116 wrote to memory of 1228 1116 rfhdfvt.exe 44 PID 1116 wrote to memory of 1228 1116 rfhdfvt.exe 44 PID 1116 wrote to memory of 1228 1116 rfhdfvt.exe 44 PID 1116 wrote to memory of 1228 1116 rfhdfvt.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\e035aa52668eb3c0540108e2d7c42c34525e5a2e0f609c6f404095ce4d5327c6.exe"C:\Users\Admin\AppData\Local\Temp\e035aa52668eb3c0540108e2d7c42c34525e5a2e0f609c6f404095ce4d5327c6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\fjxtb.exec:\fjxtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\vdblbrp.exec:\vdblbrp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\pbjnff.exec:\pbjnff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\xbdnhnp.exec:\xbdnhnp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\dlbjb.exec:\dlbjb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\lvpfff.exec:\lvpfff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\jdpjfxd.exec:\jdpjfxd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\hbllhfv.exec:\hbllhfv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\brxplxl.exec:\brxplxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\dvtjlbh.exec:\dvtjlbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\rtfrt.exec:\rtfrt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\dtvnr.exec:\dtvnr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\phlvlbv.exec:\phlvlbv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\xfrnvlr.exec:\xfrnvlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
\??\c:\rfhdfvt.exec:\rfhdfvt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\bphhf.exec:\bphhf.exe17⤵
- Executes dropped EXE
PID:1228 -
\??\c:\hjtjpn.exec:\hjtjpn.exe18⤵
- Executes dropped EXE
PID:1436 -
\??\c:\nrtdbv.exec:\nrtdbv.exe19⤵
- Executes dropped EXE
PID:276 -
\??\c:\blxpbnd.exec:\blxpbnd.exe20⤵
- Executes dropped EXE
PID:2512 -
\??\c:\jdfpnb.exec:\jdfpnb.exe21⤵
- Executes dropped EXE
PID:2204 -
\??\c:\dfxjnh.exec:\dfxjnh.exe22⤵
- Executes dropped EXE
PID:2280 -
\??\c:\pvnppf.exec:\pvnppf.exe23⤵
- Executes dropped EXE
PID:2556 -
\??\c:\ftvphv.exec:\ftvphv.exe24⤵
- Executes dropped EXE
PID:2460 -
\??\c:\rnplfv.exec:\rnplfv.exe25⤵
- Executes dropped EXE
PID:2268 -
\??\c:\bnvhx.exec:\bnvhx.exe26⤵
- Executes dropped EXE
PID:2548 -
\??\c:\rnnttt.exec:\rnnttt.exe27⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vrjjnbv.exec:\vrjjnbv.exe28⤵
- Executes dropped EXE
PID:1616 -
\??\c:\lvjrj.exec:\lvjrj.exe29⤵
- Executes dropped EXE
PID:1952 -
\??\c:\bjnvvpr.exec:\bjnvvpr.exe30⤵
- Executes dropped EXE
PID:1944 -
\??\c:\nfjjrhr.exec:\nfjjrhr.exe31⤵
- Executes dropped EXE
PID:2640 -
\??\c:\hdbrxpp.exec:\hdbrxpp.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1364 -
\??\c:\ptrpfvp.exec:\ptrpfvp.exe33⤵
- Executes dropped EXE
PID:3004 -
\??\c:\bnrbhjd.exec:\bnrbhjd.exe34⤵
- Executes dropped EXE
PID:2588 -
\??\c:\lnnrt.exec:\lnnrt.exe35⤵
- Executes dropped EXE
PID:1248 -
\??\c:\bjjjb.exec:\bjjjb.exe36⤵
- Executes dropped EXE
PID:1716 -
\??\c:\vjpnbfn.exec:\vjpnbfn.exe37⤵
- Executes dropped EXE
PID:2068 -
\??\c:\tlpbprt.exec:\tlpbprt.exe38⤵
- Executes dropped EXE
PID:2896 -
\??\c:\brxfxdh.exec:\brxfxdh.exe39⤵
- Executes dropped EXE
PID:2480 -
\??\c:\hfjlld.exec:\hfjlld.exe40⤵
- Executes dropped EXE
PID:2956 -
\??\c:\rltfl.exec:\rltfl.exe41⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nbdjb.exec:\nbdjb.exe42⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ttjtnpr.exec:\ttjtnpr.exe43⤵
- Executes dropped EXE
PID:2736 -
\??\c:\vtdltl.exec:\vtdltl.exe44⤵
- Executes dropped EXE
PID:2680 -
\??\c:\fthvxj.exec:\fthvxj.exe45⤵
- Executes dropped EXE
PID:2756 -
\??\c:\bvldljj.exec:\bvldljj.exe46⤵
- Executes dropped EXE
PID:2516 -
\??\c:\llprf.exec:\llprf.exe47⤵
- Executes dropped EXE
PID:2064 -
\??\c:\vjpnrxn.exec:\vjpnrxn.exe48⤵
- Executes dropped EXE
PID:2300 -
\??\c:\npbrd.exec:\npbrd.exe49⤵
- Executes dropped EXE
PID:1560 -
\??\c:\drxfp.exec:\drxfp.exe50⤵
- Executes dropped EXE
PID:2084 -
\??\c:\hvvnxf.exec:\hvvnxf.exe51⤵
- Executes dropped EXE
PID:2000 -
\??\c:\hbrhhdb.exec:\hbrhhdb.exe52⤵
- Executes dropped EXE
PID:1680 -
\??\c:\bpbddv.exec:\bpbddv.exe53⤵
- Executes dropped EXE
PID:972 -
\??\c:\hjbhjjh.exec:\hjbhjjh.exe54⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nxfrr.exec:\nxfrr.exe55⤵
- Executes dropped EXE
PID:2928 -
\??\c:\hnjvx.exec:\hnjvx.exe56⤵
- Executes dropped EXE
PID:2016 -
\??\c:\dvttnlb.exec:\dvttnlb.exe57⤵
- Executes dropped EXE
PID:2784 -
\??\c:\hlnhjtd.exec:\hlnhjtd.exe58⤵
- Executes dropped EXE
PID:1380 -
\??\c:\xdrvpvj.exec:\xdrvpvj.exe59⤵
- Executes dropped EXE
PID:1064 -
\??\c:\ntphxl.exec:\ntphxl.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2860 -
\??\c:\fhffhpl.exec:\fhffhpl.exe61⤵
- Executes dropped EXE
PID:2632 -
\??\c:\tfhfd.exec:\tfhfd.exe62⤵
- Executes dropped EXE
PID:2176 -
\??\c:\nbxrrf.exec:\nbxrrf.exe63⤵
- Executes dropped EXE
PID:1664 -
\??\c:\jprdjl.exec:\jprdjl.exe64⤵
- Executes dropped EXE
PID:2504 -
\??\c:\vlnvvd.exec:\vlnvvd.exe65⤵
- Executes dropped EXE
PID:1072 -
\??\c:\nbldhb.exec:\nbldhb.exe66⤵PID:1576
-
\??\c:\tbtpd.exec:\tbtpd.exe67⤵PID:2416
-
\??\c:\tdnxrx.exec:\tdnxrx.exe68⤵PID:2268
-
\??\c:\hpfjrb.exec:\hpfjrb.exe69⤵PID:1988
-
\??\c:\vnvll.exec:\vnvll.exe70⤵PID:1464
-
\??\c:\rldxbd.exec:\rldxbd.exe71⤵PID:1956
-
\??\c:\bphxr.exec:\bphxr.exe72⤵PID:1052
-
\??\c:\tnrpp.exec:\tnrpp.exe73⤵PID:1984
-
\??\c:\bbprlxv.exec:\bbprlxv.exe74⤵PID:1624
-
\??\c:\dpfpt.exec:\dpfpt.exe75⤵PID:1308
-
\??\c:\dfxtp.exec:\dfxtp.exe76⤵PID:1448
-
\??\c:\jhfrj.exec:\jhfrj.exe77⤵PID:872
-
\??\c:\fxdpvp.exec:\fxdpvp.exe78⤵PID:2508
-
\??\c:\fptjpv.exec:\fptjpv.exe79⤵PID:2056
-
\??\c:\jdhvn.exec:\jdhvn.exe80⤵PID:2396
-
\??\c:\pvjrvb.exec:\pvjrvb.exe81⤵PID:2528
-
\??\c:\vvddn.exec:\vvddn.exe82⤵PID:2888
-
\??\c:\tjbfx.exec:\tjbfx.exe83⤵PID:2392
-
\??\c:\hnbljfn.exec:\hnbljfn.exe84⤵PID:2800
-
\??\c:\jpbvhv.exec:\jpbvhv.exe85⤵PID:2368
-
\??\c:\tpbrn.exec:\tpbrn.exe86⤵PID:2848
-
\??\c:\rdvrvn.exec:\rdvrvn.exe87⤵PID:2900
-
\??\c:\fbphdnt.exec:\fbphdnt.exe88⤵PID:2864
-
\??\c:\thlfxtt.exec:\thlfxtt.exe89⤵PID:2100
-
\??\c:\xppjj.exec:\xppjj.exe90⤵PID:2208
-
\??\c:\tprjv.exec:\tprjv.exe91⤵PID:2132
-
\??\c:\brhfth.exec:\brhfth.exe92⤵PID:2292
-
\??\c:\pbrdhdj.exec:\pbrdhdj.exe93⤵PID:2456
-
\??\c:\xvfvbp.exec:\xvfvbp.exe94⤵PID:2444
-
\??\c:\dnfhtff.exec:\dnfhtff.exe95⤵PID:2432
-
\??\c:\rtrhdx.exec:\rtrhdx.exe96⤵PID:2000
-
\??\c:\jrrhxn.exec:\jrrhxn.exe97⤵PID:1684
-
\??\c:\pdnjx.exec:\pdnjx.exe98⤵PID:2096
-
\??\c:\vxxnxnv.exec:\vxxnxnv.exe99⤵PID:2952
-
\??\c:\nbtbdn.exec:\nbtbdn.exe100⤵PID:2372
-
\??\c:\nblnnj.exec:\nblnnj.exe101⤵PID:2016
-
\??\c:\xvlpxlh.exec:\xvlpxlh.exe102⤵PID:1792
-
\??\c:\dbjndt.exec:\dbjndt.exe103⤵PID:2192
-
\??\c:\dpnhfnj.exec:\dpnhfnj.exe104⤵PID:3040
-
\??\c:\pxxpv.exec:\pxxpv.exe105⤵PID:2220
-
\??\c:\ljjpnd.exec:\ljjpnd.exe106⤵PID:2264
-
\??\c:\dhlpbln.exec:\dhlpbln.exe107⤵PID:2316
-
\??\c:\nfdffjl.exec:\nfdffjl.exe108⤵PID:1532
-
\??\c:\lrpnnf.exec:\lrpnnf.exe109⤵PID:2424
-
\??\c:\njxdrvb.exec:\njxdrvb.exe110⤵PID:868
-
\??\c:\xffnf.exec:\xffnf.exe111⤵PID:2416
-
\??\c:\fbrlldp.exec:\fbrlldp.exe112⤵PID:2268
-
\??\c:\bpdtvjl.exec:\bpdtvjl.exe113⤵PID:1672
-
\??\c:\lbptrlv.exec:\lbptrlv.exe114⤵PID:1408
-
\??\c:\hhfbl.exec:\hhfbl.exe115⤵PID:1956
-
\??\c:\rxldd.exec:\rxldd.exe116⤵PID:1052
-
\??\c:\fxhhl.exec:\fxhhl.exe117⤵PID:1984
-
\??\c:\rtbdl.exec:\rtbdl.exe118⤵PID:1624
-
\??\c:\pdblhtx.exec:\pdblhtx.exe119⤵
- System Location Discovery: System Language Discovery
PID:1308 -
\??\c:\tjjjl.exec:\tjjjl.exe120⤵PID:1364
-
\??\c:\jfljn.exec:\jfljn.exe121⤵PID:872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-