Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b00d05f5dd57b2b99670ef31b4f3854a891ce9e678bd7eb35d25dd4888a98766.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b00d05f5dd57b2b99670ef31b4f3854a891ce9e678bd7eb35d25dd4888a98766.exe
-
Size
454KB
-
MD5
12051df08edd9f228d3a691cc512d3e8
-
SHA1
ac2da967dc845ef0138f42f63e80152782ff2f9b
-
SHA256
b00d05f5dd57b2b99670ef31b4f3854a891ce9e678bd7eb35d25dd4888a98766
-
SHA512
378dfe12a849616d4087ad6f07e572227e80c104b627a5b8a98bf403af18780f2497d91e8f1909fcd3b6eea084b0c64dcff4cdd1ebafb5623685d068908f68ae
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbePI:q7Tc2NYHUrAwfMp3CDw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/1832-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-75-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1356-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-161-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2516-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-207-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/916-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/676-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1116-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1008-431-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1940-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-573-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1580-580-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1976-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-705-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2080-726-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1264-741-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1004-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2564 nlhhvp.exe 1796 nnfhr.exe 2500 jdxfj.exe 2092 bfbrhrd.exe 2440 vhfrxrr.exe 2796 httbxf.exe 2940 vpdnfr.exe 1356 ntphr.exe 2692 nfdrpb.exe 2820 nvbhlxr.exe 1804 fvjljnp.exe 2840 hhpvjj.exe 1920 tfhdjld.exe 2884 lxnrxr.exe 2112 bnnhd.exe 2000 tdhtd.exe 1948 lfntpl.exe 2960 pvdldvt.exe 2516 xbnpdjv.exe 2384 pbfth.exe 916 xrltt.exe 2200 tjdhr.exe 2544 tdtpffd.exe 1392 xfhnffr.exe 1736 jfdrdfl.exe 580 rbfrpf.exe 1556 xhtrpf.exe 2236 fvddt.exe 2116 hvvhbh.exe 2524 hxlvnrv.exe 676 jjpjxf.exe 2264 jvlvrfb.exe 2584 xrdjvn.exe 1576 lflfl.exe 1684 nnxrr.exe 2492 lthfld.exe 2028 hdnpxfh.exe 2396 xrbvx.exe 2092 fdxxnfr.exe 2780 dppxvbn.exe 2900 rvnxjbr.exe 2512 djnfn.exe 2932 jjdxr.exe 2968 bdnrl.exe 2196 dxbhttf.exe 2988 jpfrrdf.exe 1616 txbhh.exe 884 pbhlhnx.exe 2892 jpvbn.exe 1116 tntfxxl.exe 1992 hhdrr.exe 1008 nnbrn.exe 2340 hbvdrd.exe 2540 rjtfddl.exe 2000 hnpxf.exe 1376 ftrlxj.exe 1940 dlfbrrt.exe 2996 jbjvlpp.exe 2860 hfrxh.exe 2072 jpdjbrx.exe 1696 fpfdj.exe 2180 vbxhnv.exe 820 xlhfb.exe 1788 ddnvb.exe -
resource yara_rule behavioral1/memory/1832-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-75-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1356-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-431-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1940-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-573-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1976-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-801-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-849-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frtdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdtrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xppvpxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbltnbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbjnhnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflhjbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnxxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvlpjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxrxbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbpxbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbfvtvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjtxfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbvdrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddnvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnxbjfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrbdjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrdlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvvhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxbbdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfxbtxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdthrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhrrnpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtvlbrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nllfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhrhtxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfxbrdl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1832 wrote to memory of 2564 1832 b00d05f5dd57b2b99670ef31b4f3854a891ce9e678bd7eb35d25dd4888a98766.exe 30 PID 1832 wrote to memory of 2564 1832 b00d05f5dd57b2b99670ef31b4f3854a891ce9e678bd7eb35d25dd4888a98766.exe 30 PID 1832 wrote to memory of 2564 1832 b00d05f5dd57b2b99670ef31b4f3854a891ce9e678bd7eb35d25dd4888a98766.exe 30 PID 1832 wrote to memory of 2564 1832 b00d05f5dd57b2b99670ef31b4f3854a891ce9e678bd7eb35d25dd4888a98766.exe 30 PID 2564 wrote to memory of 1796 2564 nlhhvp.exe 31 PID 2564 wrote to memory of 1796 2564 nlhhvp.exe 31 PID 2564 wrote to memory of 1796 2564 nlhhvp.exe 31 PID 2564 wrote to memory of 1796 2564 nlhhvp.exe 31 PID 1796 wrote to memory of 2500 1796 nnfhr.exe 32 PID 1796 wrote to memory of 2500 1796 nnfhr.exe 32 PID 1796 wrote to memory of 2500 1796 nnfhr.exe 32 PID 1796 wrote to memory of 2500 1796 nnfhr.exe 32 PID 2500 wrote to memory of 2092 2500 jdxfj.exe 33 PID 2500 wrote to memory of 2092 2500 jdxfj.exe 33 PID 2500 wrote to memory of 2092 2500 jdxfj.exe 33 PID 2500 wrote to memory of 2092 2500 jdxfj.exe 33 PID 2092 wrote to memory of 2440 2092 bfbrhrd.exe 34 PID 2092 wrote to memory of 2440 2092 bfbrhrd.exe 34 PID 2092 wrote to memory of 2440 2092 bfbrhrd.exe 34 PID 2092 wrote to memory of 2440 2092 bfbrhrd.exe 34 PID 2440 wrote to memory of 2796 2440 vhfrxrr.exe 35 PID 2440 wrote to memory of 2796 2440 vhfrxrr.exe 35 PID 2440 wrote to memory of 2796 2440 vhfrxrr.exe 35 PID 2440 wrote to memory of 2796 2440 vhfrxrr.exe 35 PID 2796 wrote to memory of 2940 2796 httbxf.exe 36 PID 2796 wrote to memory of 2940 2796 httbxf.exe 36 PID 2796 wrote to memory of 2940 2796 httbxf.exe 36 PID 2796 wrote to memory of 2940 2796 httbxf.exe 36 PID 2940 wrote to memory of 1356 2940 vpdnfr.exe 37 PID 2940 wrote to memory of 1356 2940 vpdnfr.exe 37 PID 2940 wrote to memory of 1356 2940 vpdnfr.exe 37 PID 2940 wrote to memory of 1356 2940 vpdnfr.exe 37 PID 1356 wrote to memory of 2692 1356 ntphr.exe 38 PID 1356 wrote to memory of 2692 1356 ntphr.exe 38 PID 1356 wrote to memory of 2692 1356 ntphr.exe 38 PID 1356 wrote to memory of 2692 1356 ntphr.exe 38 PID 2692 wrote to memory of 2820 2692 nfdrpb.exe 39 PID 2692 wrote to memory of 2820 2692 nfdrpb.exe 39 PID 2692 wrote to memory of 2820 2692 nfdrpb.exe 39 PID 2692 wrote to memory of 2820 2692 nfdrpb.exe 39 PID 2820 wrote to memory of 1804 2820 nvbhlxr.exe 40 PID 2820 wrote to memory of 1804 2820 nvbhlxr.exe 40 PID 2820 wrote to memory of 1804 2820 nvbhlxr.exe 40 PID 2820 wrote to memory of 1804 2820 nvbhlxr.exe 40 PID 1804 wrote to memory of 2840 1804 fvjljnp.exe 41 PID 1804 wrote to memory of 2840 1804 fvjljnp.exe 41 PID 1804 wrote to memory of 2840 1804 fvjljnp.exe 41 PID 1804 wrote to memory of 2840 1804 fvjljnp.exe 41 PID 2840 wrote to memory of 1920 2840 hhpvjj.exe 42 PID 2840 wrote to memory of 1920 2840 hhpvjj.exe 42 PID 2840 wrote to memory of 1920 2840 hhpvjj.exe 42 PID 2840 wrote to memory of 1920 2840 hhpvjj.exe 42 PID 1920 wrote to memory of 2884 1920 tfhdjld.exe 43 PID 1920 wrote to memory of 2884 1920 tfhdjld.exe 43 PID 1920 wrote to memory of 2884 1920 tfhdjld.exe 43 PID 1920 wrote to memory of 2884 1920 tfhdjld.exe 43 PID 2884 wrote to memory of 2112 2884 lxnrxr.exe 44 PID 2884 wrote to memory of 2112 2884 lxnrxr.exe 44 PID 2884 wrote to memory of 2112 2884 lxnrxr.exe 44 PID 2884 wrote to memory of 2112 2884 lxnrxr.exe 44 PID 2112 wrote to memory of 2000 2112 bnnhd.exe 45 PID 2112 wrote to memory of 2000 2112 bnnhd.exe 45 PID 2112 wrote to memory of 2000 2112 bnnhd.exe 45 PID 2112 wrote to memory of 2000 2112 bnnhd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b00d05f5dd57b2b99670ef31b4f3854a891ce9e678bd7eb35d25dd4888a98766.exe"C:\Users\Admin\AppData\Local\Temp\b00d05f5dd57b2b99670ef31b4f3854a891ce9e678bd7eb35d25dd4888a98766.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\nlhhvp.exec:\nlhhvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\nnfhr.exec:\nnfhr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\jdxfj.exec:\jdxfj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\bfbrhrd.exec:\bfbrhrd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\vhfrxrr.exec:\vhfrxrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\httbxf.exec:\httbxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\vpdnfr.exec:\vpdnfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\ntphr.exec:\ntphr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\nfdrpb.exec:\nfdrpb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\nvbhlxr.exec:\nvbhlxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\fvjljnp.exec:\fvjljnp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\hhpvjj.exec:\hhpvjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\tfhdjld.exec:\tfhdjld.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\lxnrxr.exec:\lxnrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\bnnhd.exec:\bnnhd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\tdhtd.exec:\tdhtd.exe17⤵
- Executes dropped EXE
PID:2000 -
\??\c:\lfntpl.exec:\lfntpl.exe18⤵
- Executes dropped EXE
PID:1948 -
\??\c:\pvdldvt.exec:\pvdldvt.exe19⤵
- Executes dropped EXE
PID:2960 -
\??\c:\xbnpdjv.exec:\xbnpdjv.exe20⤵
- Executes dropped EXE
PID:2516 -
\??\c:\pbfth.exec:\pbfth.exe21⤵
- Executes dropped EXE
PID:2384 -
\??\c:\xrltt.exec:\xrltt.exe22⤵
- Executes dropped EXE
PID:916 -
\??\c:\tjdhr.exec:\tjdhr.exe23⤵
- Executes dropped EXE
PID:2200 -
\??\c:\tdtpffd.exec:\tdtpffd.exe24⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xfhnffr.exec:\xfhnffr.exe25⤵
- Executes dropped EXE
PID:1392 -
\??\c:\jfdrdfl.exec:\jfdrdfl.exe26⤵
- Executes dropped EXE
PID:1736 -
\??\c:\rbfrpf.exec:\rbfrpf.exe27⤵
- Executes dropped EXE
PID:580 -
\??\c:\xhtrpf.exec:\xhtrpf.exe28⤵
- Executes dropped EXE
PID:1556 -
\??\c:\fvddt.exec:\fvddt.exe29⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hvvhbh.exec:\hvvhbh.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2116 -
\??\c:\hxlvnrv.exec:\hxlvnrv.exe31⤵
- Executes dropped EXE
PID:2524 -
\??\c:\jjpjxf.exec:\jjpjxf.exe32⤵
- Executes dropped EXE
PID:676 -
\??\c:\jvlvrfb.exec:\jvlvrfb.exe33⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xrdjvn.exec:\xrdjvn.exe34⤵
- Executes dropped EXE
PID:2584 -
\??\c:\lflfl.exec:\lflfl.exe35⤵
- Executes dropped EXE
PID:1576 -
\??\c:\nnxrr.exec:\nnxrr.exe36⤵
- Executes dropped EXE
PID:1684 -
\??\c:\lthfld.exec:\lthfld.exe37⤵
- Executes dropped EXE
PID:2492 -
\??\c:\hdnpxfh.exec:\hdnpxfh.exe38⤵
- Executes dropped EXE
PID:2028 -
\??\c:\xrbvx.exec:\xrbvx.exe39⤵
- Executes dropped EXE
PID:2396 -
\??\c:\fdxxnfr.exec:\fdxxnfr.exe40⤵
- Executes dropped EXE
PID:2092 -
\??\c:\dppxvbn.exec:\dppxvbn.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\rvnxjbr.exec:\rvnxjbr.exe42⤵
- Executes dropped EXE
PID:2900 -
\??\c:\djnfn.exec:\djnfn.exe43⤵
- Executes dropped EXE
PID:2512 -
\??\c:\jjdxr.exec:\jjdxr.exe44⤵
- Executes dropped EXE
PID:2932 -
\??\c:\bdnrl.exec:\bdnrl.exe45⤵
- Executes dropped EXE
PID:2968 -
\??\c:\dxbhttf.exec:\dxbhttf.exe46⤵
- Executes dropped EXE
PID:2196 -
\??\c:\jpfrrdf.exec:\jpfrrdf.exe47⤵
- Executes dropped EXE
PID:2988 -
\??\c:\txbhh.exec:\txbhh.exe48⤵
- Executes dropped EXE
PID:1616 -
\??\c:\pbhlhnx.exec:\pbhlhnx.exe49⤵
- Executes dropped EXE
PID:884 -
\??\c:\jpvbn.exec:\jpvbn.exe50⤵
- Executes dropped EXE
PID:2892 -
\??\c:\tntfxxl.exec:\tntfxxl.exe51⤵
- Executes dropped EXE
PID:1116 -
\??\c:\hhdrr.exec:\hhdrr.exe52⤵
- Executes dropped EXE
PID:1992 -
\??\c:\nnbrn.exec:\nnbrn.exe53⤵
- Executes dropped EXE
PID:1008 -
\??\c:\hbvdrd.exec:\hbvdrd.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2340 -
\??\c:\rjtfddl.exec:\rjtfddl.exe55⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hnpxf.exec:\hnpxf.exe56⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ftrlxj.exec:\ftrlxj.exe57⤵
- Executes dropped EXE
PID:1376 -
\??\c:\dlfbrrt.exec:\dlfbrrt.exe58⤵
- Executes dropped EXE
PID:1940 -
\??\c:\jbjvlpp.exec:\jbjvlpp.exe59⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hfrxh.exec:\hfrxh.exe60⤵
- Executes dropped EXE
PID:2860 -
\??\c:\jpdjbrx.exec:\jpdjbrx.exe61⤵
- Executes dropped EXE
PID:2072 -
\??\c:\fpfdj.exec:\fpfdj.exe62⤵
- Executes dropped EXE
PID:1696 -
\??\c:\vbxhnv.exec:\vbxhnv.exe63⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xlhfb.exec:\xlhfb.exe64⤵
- Executes dropped EXE
PID:820 -
\??\c:\ddnvb.exec:\ddnvb.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1788 -
\??\c:\rvptv.exec:\rvptv.exe66⤵PID:1872
-
\??\c:\trtlt.exec:\trtlt.exe67⤵PID:1772
-
\??\c:\lhnrx.exec:\lhnrx.exe68⤵PID:1736
-
\??\c:\jjdrjpl.exec:\jjdrjpl.exe69⤵PID:1528
-
\??\c:\ppdtrfx.exec:\ppdtrfx.exe70⤵
- System Location Discovery: System Language Discovery
PID:1144 -
\??\c:\fhbpn.exec:\fhbpn.exe71⤵PID:1580
-
\??\c:\bxlnhth.exec:\bxlnhth.exe72⤵PID:272
-
\??\c:\rhjjhd.exec:\rhjjhd.exe73⤵PID:672
-
\??\c:\thdrlh.exec:\thdrlh.exe74⤵PID:2524
-
\??\c:\xxtxdj.exec:\xxtxdj.exe75⤵PID:308
-
\??\c:\plflttr.exec:\plflttr.exe76⤵PID:2036
-
\??\c:\ntxlfb.exec:\ntxlfb.exe77⤵PID:1540
-
\??\c:\pnbtll.exec:\pnbtll.exe78⤵PID:2584
-
\??\c:\nvnfntl.exec:\nvnfntl.exe79⤵PID:1320
-
\??\c:\bvvlxx.exec:\bvvlxx.exe80⤵PID:1976
-
\??\c:\nxdlbn.exec:\nxdlbn.exe81⤵PID:2124
-
\??\c:\rvlvrjr.exec:\rvlvrjr.exe82⤵PID:2756
-
\??\c:\xhbjdrj.exec:\xhbjdrj.exe83⤵PID:2924
-
\??\c:\lvvbdd.exec:\lvvbdd.exe84⤵PID:2904
-
\??\c:\ftbxbl.exec:\ftbxbl.exe85⤵PID:2980
-
\??\c:\jhflblx.exec:\jhflblx.exe86⤵PID:2952
-
\??\c:\pttjxt.exec:\pttjxt.exe87⤵PID:2800
-
\??\c:\lnnbrrv.exec:\lnnbrrv.exe88⤵PID:2004
-
\??\c:\lxphn.exec:\lxphn.exe89⤵PID:1960
-
\??\c:\nhtvtvj.exec:\nhtvtvj.exe90⤵PID:2820
-
\??\c:\hxvrv.exec:\hxvrv.exe91⤵PID:1616
-
\??\c:\vrdlvtj.exec:\vrdlvtj.exe92⤵PID:1040
-
\??\c:\pljfhln.exec:\pljfhln.exe93⤵PID:1256
-
\??\c:\llnxrp.exec:\llnxrp.exe94⤵PID:2080
-
\??\c:\ftdrpr.exec:\ftdrpr.exe95⤵PID:1704
-
\??\c:\tbvtx.exec:\tbvtx.exe96⤵PID:1264
-
\??\c:\nvvdh.exec:\nvvdh.exe97⤵PID:1944
-
\??\c:\pnllp.exec:\pnllp.exe98⤵PID:3004
-
\??\c:\xvbhj.exec:\xvbhj.exe99⤵PID:852
-
\??\c:\djjrpp.exec:\djjrpp.exe100⤵PID:2432
-
\??\c:\xffbjjv.exec:\xffbjjv.exe101⤵PID:2960
-
\??\c:\rlxph.exec:\rlxph.exe102⤵PID:2384
-
\??\c:\vtdnvvf.exec:\vtdnvvf.exe103⤵PID:2072
-
\??\c:\jfpvf.exec:\jfpvf.exe104⤵PID:2088
-
\??\c:\dbxlr.exec:\dbxlr.exe105⤵PID:2180
-
\??\c:\ltbjt.exec:\ltbjt.exe106⤵PID:820
-
\??\c:\jvxhbnd.exec:\jvxhbnd.exe107⤵PID:1004
-
\??\c:\tdvhj.exec:\tdvhj.exe108⤵PID:1872
-
\??\c:\rpnbd.exec:\rpnbd.exe109⤵PID:1772
-
\??\c:\xlhxh.exec:\xlhxh.exe110⤵PID:1736
-
\??\c:\jxdvrph.exec:\jxdvrph.exe111⤵PID:1528
-
\??\c:\fnbrtjh.exec:\fnbrtjh.exe112⤵PID:1144
-
\??\c:\prpbh.exec:\prpbh.exe113⤵PID:1580
-
\??\c:\ljxdbbt.exec:\ljxdbbt.exe114⤵PID:272
-
\??\c:\vfxvthf.exec:\vfxvthf.exe115⤵PID:1732
-
\??\c:\dlhdj.exec:\dlhdj.exe116⤵PID:2228
-
\??\c:\fpnfdv.exec:\fpnfdv.exe117⤵PID:1636
-
\??\c:\nbdhx.exec:\nbdhx.exe118⤵PID:2280
-
\??\c:\rrpjpf.exec:\rrpjpf.exe119⤵PID:2564
-
\??\c:\nppjltd.exec:\nppjltd.exe120⤵PID:2976
-
\??\c:\lpjjl.exec:\lpjjl.exe121⤵PID:2500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-