Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
acee09c0230d5d153be1b65285aa5c60c738e19f9d30a8c85855fbda46baa134N.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
acee09c0230d5d153be1b65285aa5c60c738e19f9d30a8c85855fbda46baa134N.exe
-
Size
455KB
-
MD5
a396c6182b8886a2a8247faa8f4cbb80
-
SHA1
c5a6dd5df9d3ce6b0ecfb155d81c18ef0d7e4858
-
SHA256
acee09c0230d5d153be1b65285aa5c60c738e19f9d30a8c85855fbda46baa134
-
SHA512
f6b025a112b5e2d539b9645e19fed8d6276e66266c8265891eec98942340bba8a2578c4f73697274d378bb11c765528958d88810aefeccd4414fa13f438a863c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeh:q7Tc2NYHUrAwfMp3CDh
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2560-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1236-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/396-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/856-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-340-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2928-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-444-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3016-452-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3016-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-567-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2644-616-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2892-676-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1660-696-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-725-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1944-757-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1944-777-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2560 vfxnl.exe 1620 djvjrx.exe 2068 bvjtrdj.exe 2616 dxnlfhl.exe 2936 jlrjfl.exe 2732 lntfll.exe 2748 xtbpp.exe 2896 tdfpxfd.exe 2796 jvpdl.exe 2448 rptth.exe 1796 npvjhlr.exe 3040 ldtxthd.exe 2964 vhftpjb.exe 1348 vbnfhf.exe 3016 xblhtn.exe 2288 vnrndj.exe 396 fvblhp.exe 1688 djnxr.exe 836 xxxnbdx.exe 2232 vjlddth.exe 2180 rjrvn.exe 856 jjjbv.exe 1120 xtjdb.exe 1776 plndlrx.exe 2596 pvjfdn.exe 1432 dxltt.exe 796 xvjvjt.exe 1700 vftfbv.exe 1684 tfdphx.exe 2620 fnhdtdd.exe 1596 jtvtrxn.exe 2176 hxtdvl.exe 2292 nlhff.exe 2380 hplvdp.exe 1528 dflhft.exe 2624 xjnvh.exe 2868 xnpdv.exe 1124 rnbtff.exe 2928 jdrrnn.exe 584 brpllj.exe 2760 ffjxbhr.exe 2888 xlljhhf.exe 2736 ltbndl.exe 2776 vvlfvrd.exe 2344 dbxlxxr.exe 2704 rrbpx.exe 1784 dddhph.exe 3028 ffxfff.exe 1316 fjvflp.exe 2812 pxtjjf.exe 2092 vbrtxrh.exe 2072 dlbpnbv.exe 3016 frlhhl.exe 2288 bjfnr.exe 1840 jppplp.exe 1648 tntftdf.exe 2276 lvhjlhx.exe 1488 llndnxn.exe 2488 dvptbtv.exe 2316 nrpbd.exe 1336 hnlnpdj.exe 856 dlphb.exe 1708 dpfdt.exe 2500 prrxxfh.exe -
resource yara_rule behavioral1/memory/2560-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1236-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-40-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2936-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1124-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-355-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/2888-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-696-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pntjft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvfpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtfpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbdnjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpxxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnflv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdndl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpxbhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjlvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrddb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbtbdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnrbxhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtdvrrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjftt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvbflv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djtnvxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlnxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpnrjjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lppnpfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfdjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blfflpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxtdvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hplvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtdfnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npfjfvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpfrxpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfrjbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrtxvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfjlpbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vflphv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjfhrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdtjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptrbvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntdvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxdbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffblfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpxbhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxxbrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbntpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxdfpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npnpjlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxhjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npvjhlr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1236 wrote to memory of 2560 1236 acee09c0230d5d153be1b65285aa5c60c738e19f9d30a8c85855fbda46baa134N.exe 30 PID 1236 wrote to memory of 2560 1236 acee09c0230d5d153be1b65285aa5c60c738e19f9d30a8c85855fbda46baa134N.exe 30 PID 1236 wrote to memory of 2560 1236 acee09c0230d5d153be1b65285aa5c60c738e19f9d30a8c85855fbda46baa134N.exe 30 PID 1236 wrote to memory of 2560 1236 acee09c0230d5d153be1b65285aa5c60c738e19f9d30a8c85855fbda46baa134N.exe 30 PID 2560 wrote to memory of 1620 2560 vfxnl.exe 31 PID 2560 wrote to memory of 1620 2560 vfxnl.exe 31 PID 2560 wrote to memory of 1620 2560 vfxnl.exe 31 PID 2560 wrote to memory of 1620 2560 vfxnl.exe 31 PID 1620 wrote to memory of 2068 1620 djvjrx.exe 32 PID 1620 wrote to memory of 2068 1620 djvjrx.exe 32 PID 1620 wrote to memory of 2068 1620 djvjrx.exe 32 PID 1620 wrote to memory of 2068 1620 djvjrx.exe 32 PID 2068 wrote to memory of 2616 2068 bvjtrdj.exe 33 PID 2068 wrote to memory of 2616 2068 bvjtrdj.exe 33 PID 2068 wrote to memory of 2616 2068 bvjtrdj.exe 33 PID 2068 wrote to memory of 2616 2068 bvjtrdj.exe 33 PID 2616 wrote to memory of 2936 2616 dxnlfhl.exe 34 PID 2616 wrote to memory of 2936 2616 dxnlfhl.exe 34 PID 2616 wrote to memory of 2936 2616 dxnlfhl.exe 34 PID 2616 wrote to memory of 2936 2616 dxnlfhl.exe 34 PID 2936 wrote to memory of 2732 2936 jlrjfl.exe 35 PID 2936 wrote to memory of 2732 2936 jlrjfl.exe 35 PID 2936 wrote to memory of 2732 2936 jlrjfl.exe 35 PID 2936 wrote to memory of 2732 2936 jlrjfl.exe 35 PID 2732 wrote to memory of 2748 2732 lntfll.exe 36 PID 2732 wrote to memory of 2748 2732 lntfll.exe 36 PID 2732 wrote to memory of 2748 2732 lntfll.exe 36 PID 2732 wrote to memory of 2748 2732 lntfll.exe 36 PID 2748 wrote to memory of 2896 2748 xtbpp.exe 37 PID 2748 wrote to memory of 2896 2748 xtbpp.exe 37 PID 2748 wrote to memory of 2896 2748 xtbpp.exe 37 PID 2748 wrote to memory of 2896 2748 xtbpp.exe 37 PID 2896 wrote to memory of 2796 2896 tdfpxfd.exe 38 PID 2896 wrote to memory of 2796 2896 tdfpxfd.exe 38 PID 2896 wrote to memory of 2796 2896 tdfpxfd.exe 38 PID 2896 wrote to memory of 2796 2896 tdfpxfd.exe 38 PID 2796 wrote to memory of 2448 2796 jvpdl.exe 39 PID 2796 wrote to memory of 2448 2796 jvpdl.exe 39 PID 2796 wrote to memory of 2448 2796 jvpdl.exe 39 PID 2796 wrote to memory of 2448 2796 jvpdl.exe 39 PID 2448 wrote to memory of 1796 2448 rptth.exe 40 PID 2448 wrote to memory of 1796 2448 rptth.exe 40 PID 2448 wrote to memory of 1796 2448 rptth.exe 40 PID 2448 wrote to memory of 1796 2448 rptth.exe 40 PID 1796 wrote to memory of 3040 1796 npvjhlr.exe 41 PID 1796 wrote to memory of 3040 1796 npvjhlr.exe 41 PID 1796 wrote to memory of 3040 1796 npvjhlr.exe 41 PID 1796 wrote to memory of 3040 1796 npvjhlr.exe 41 PID 3040 wrote to memory of 2964 3040 ldtxthd.exe 42 PID 3040 wrote to memory of 2964 3040 ldtxthd.exe 42 PID 3040 wrote to memory of 2964 3040 ldtxthd.exe 42 PID 3040 wrote to memory of 2964 3040 ldtxthd.exe 42 PID 2964 wrote to memory of 1348 2964 vhftpjb.exe 43 PID 2964 wrote to memory of 1348 2964 vhftpjb.exe 43 PID 2964 wrote to memory of 1348 2964 vhftpjb.exe 43 PID 2964 wrote to memory of 1348 2964 vhftpjb.exe 43 PID 1348 wrote to memory of 3016 1348 vbnfhf.exe 44 PID 1348 wrote to memory of 3016 1348 vbnfhf.exe 44 PID 1348 wrote to memory of 3016 1348 vbnfhf.exe 44 PID 1348 wrote to memory of 3016 1348 vbnfhf.exe 44 PID 3016 wrote to memory of 2288 3016 xblhtn.exe 45 PID 3016 wrote to memory of 2288 3016 xblhtn.exe 45 PID 3016 wrote to memory of 2288 3016 xblhtn.exe 45 PID 3016 wrote to memory of 2288 3016 xblhtn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\acee09c0230d5d153be1b65285aa5c60c738e19f9d30a8c85855fbda46baa134N.exe"C:\Users\Admin\AppData\Local\Temp\acee09c0230d5d153be1b65285aa5c60c738e19f9d30a8c85855fbda46baa134N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\vfxnl.exec:\vfxnl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\djvjrx.exec:\djvjrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\bvjtrdj.exec:\bvjtrdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\dxnlfhl.exec:\dxnlfhl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\jlrjfl.exec:\jlrjfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\lntfll.exec:\lntfll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\xtbpp.exec:\xtbpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\tdfpxfd.exec:\tdfpxfd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\jvpdl.exec:\jvpdl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\rptth.exec:\rptth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\npvjhlr.exec:\npvjhlr.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\ldtxthd.exec:\ldtxthd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\vhftpjb.exec:\vhftpjb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\vbnfhf.exec:\vbnfhf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\xblhtn.exec:\xblhtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\vnrndj.exec:\vnrndj.exe17⤵
- Executes dropped EXE
PID:2288 -
\??\c:\fvblhp.exec:\fvblhp.exe18⤵
- Executes dropped EXE
PID:396 -
\??\c:\djnxr.exec:\djnxr.exe19⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xxxnbdx.exec:\xxxnbdx.exe20⤵
- Executes dropped EXE
PID:836 -
\??\c:\vjlddth.exec:\vjlddth.exe21⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rjrvn.exec:\rjrvn.exe22⤵
- Executes dropped EXE
PID:2180 -
\??\c:\jjjbv.exec:\jjjbv.exe23⤵
- Executes dropped EXE
PID:856 -
\??\c:\xtjdb.exec:\xtjdb.exe24⤵
- Executes dropped EXE
PID:1120 -
\??\c:\plndlrx.exec:\plndlrx.exe25⤵
- Executes dropped EXE
PID:1776 -
\??\c:\pvjfdn.exec:\pvjfdn.exe26⤵
- Executes dropped EXE
PID:2596 -
\??\c:\dxltt.exec:\dxltt.exe27⤵
- Executes dropped EXE
PID:1432 -
\??\c:\xvjvjt.exec:\xvjvjt.exe28⤵
- Executes dropped EXE
PID:796 -
\??\c:\vftfbv.exec:\vftfbv.exe29⤵
- Executes dropped EXE
PID:1700 -
\??\c:\tfdphx.exec:\tfdphx.exe30⤵
- Executes dropped EXE
PID:1684 -
\??\c:\fnhdtdd.exec:\fnhdtdd.exe31⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jtvtrxn.exec:\jtvtrxn.exe32⤵
- Executes dropped EXE
PID:1596 -
\??\c:\hxtdvl.exec:\hxtdvl.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2176 -
\??\c:\nlhff.exec:\nlhff.exe34⤵
- Executes dropped EXE
PID:2292 -
\??\c:\hplvdp.exec:\hplvdp.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2380 -
\??\c:\dflhft.exec:\dflhft.exe36⤵
- Executes dropped EXE
PID:1528 -
\??\c:\xjnvh.exec:\xjnvh.exe37⤵
- Executes dropped EXE
PID:2624 -
\??\c:\xnpdv.exec:\xnpdv.exe38⤵
- Executes dropped EXE
PID:2868 -
\??\c:\rnbtff.exec:\rnbtff.exe39⤵
- Executes dropped EXE
PID:1124 -
\??\c:\jdrrnn.exec:\jdrrnn.exe40⤵
- Executes dropped EXE
PID:2928 -
\??\c:\brpllj.exec:\brpllj.exe41⤵
- Executes dropped EXE
PID:584 -
\??\c:\ffjxbhr.exec:\ffjxbhr.exe42⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xlljhhf.exec:\xlljhhf.exe43⤵
- Executes dropped EXE
PID:2888 -
\??\c:\ltbndl.exec:\ltbndl.exe44⤵
- Executes dropped EXE
PID:2736 -
\??\c:\vvlfvrd.exec:\vvlfvrd.exe45⤵
- Executes dropped EXE
PID:2776 -
\??\c:\dbxlxxr.exec:\dbxlxxr.exe46⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rrbpx.exec:\rrbpx.exe47⤵
- Executes dropped EXE
PID:2704 -
\??\c:\dddhph.exec:\dddhph.exe48⤵
- Executes dropped EXE
PID:1784 -
\??\c:\ffxfff.exec:\ffxfff.exe49⤵
- Executes dropped EXE
PID:3028 -
\??\c:\fjvflp.exec:\fjvflp.exe50⤵
- Executes dropped EXE
PID:1316 -
\??\c:\pxtjjf.exec:\pxtjjf.exe51⤵
- Executes dropped EXE
PID:2812 -
\??\c:\vbrtxrh.exec:\vbrtxrh.exe52⤵
- Executes dropped EXE
PID:2092 -
\??\c:\dlbpnbv.exec:\dlbpnbv.exe53⤵
- Executes dropped EXE
PID:2072 -
\??\c:\frlhhl.exec:\frlhhl.exe54⤵
- Executes dropped EXE
PID:3016 -
\??\c:\bjfnr.exec:\bjfnr.exe55⤵
- Executes dropped EXE
PID:2288 -
\??\c:\jppplp.exec:\jppplp.exe56⤵
- Executes dropped EXE
PID:1840 -
\??\c:\tntftdf.exec:\tntftdf.exe57⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lvhjlhx.exec:\lvhjlhx.exe58⤵
- Executes dropped EXE
PID:2276 -
\??\c:\llndnxn.exec:\llndnxn.exe59⤵
- Executes dropped EXE
PID:1488 -
\??\c:\dvptbtv.exec:\dvptbtv.exe60⤵
- Executes dropped EXE
PID:2488 -
\??\c:\nrpbd.exec:\nrpbd.exe61⤵
- Executes dropped EXE
PID:2316 -
\??\c:\hnlnpdj.exec:\hnlnpdj.exe62⤵
- Executes dropped EXE
PID:1336 -
\??\c:\dlphb.exec:\dlphb.exe63⤵
- Executes dropped EXE
PID:856 -
\??\c:\dpfdt.exec:\dpfdt.exe64⤵
- Executes dropped EXE
PID:1708 -
\??\c:\prrxxfh.exec:\prrxxfh.exe65⤵
- Executes dropped EXE
PID:2500 -
\??\c:\dfrjbnt.exec:\dfrjbnt.exe66⤵
- System Location Discovery: System Language Discovery
PID:2064 -
\??\c:\rdhrv.exec:\rdhrv.exe67⤵PID:1704
-
\??\c:\hvvxlln.exec:\hvvxlln.exe68⤵PID:1004
-
\??\c:\vlbrdh.exec:\vlbrdh.exe69⤵PID:108
-
\??\c:\vhxrbtd.exec:\vhxrbtd.exe70⤵PID:2504
-
\??\c:\bdpbhtd.exec:\bdpbhtd.exe71⤵PID:1020
-
\??\c:\xvdrt.exec:\xvdrt.exe72⤵PID:2464
-
\??\c:\bdldvr.exec:\bdldvr.exe73⤵PID:2360
-
\??\c:\lbdfdtn.exec:\lbdfdtn.exe74⤵PID:896
-
\??\c:\hpvbfl.exec:\hpvbfl.exe75⤵PID:1596
-
\??\c:\rtbxx.exec:\rtbxx.exe76⤵PID:2204
-
\??\c:\plfdpnl.exec:\plfdpnl.exe77⤵PID:1272
-
\??\c:\vflphv.exec:\vflphv.exe78⤵
- System Location Discovery: System Language Discovery
PID:1480 -
\??\c:\tjpjjnt.exec:\tjpjjnt.exe79⤵PID:2644
-
\??\c:\xjpbf.exec:\xjpbf.exe80⤵PID:2816
-
\??\c:\htvtp.exec:\htvtp.exe81⤵PID:2196
-
\??\c:\vjvvx.exec:\vjvvx.exe82⤵PID:2616
-
\??\c:\tjtfvp.exec:\tjtfvp.exe83⤵PID:2856
-
\??\c:\frxlvx.exec:\frxlvx.exe84⤵PID:2840
-
\??\c:\tlrrvrv.exec:\tlrrvrv.exe85⤵PID:2136
-
\??\c:\lvflhpv.exec:\lvflhpv.exe86⤵PID:2760
-
\??\c:\lprnf.exec:\lprnf.exe87⤵PID:2888
-
\??\c:\nxbdrpv.exec:\nxbdrpv.exe88⤵PID:2892
-
\??\c:\vvdjjvx.exec:\vvdjjvx.exe89⤵PID:2776
-
\??\c:\pfhxbj.exec:\pfhxbj.exe90⤵PID:1632
-
\??\c:\tdvxv.exec:\tdvxv.exe91⤵PID:2704
-
\??\c:\thbpv.exec:\thbpv.exe92⤵PID:1660
-
\??\c:\tpnvtp.exec:\tpnvtp.exe93⤵PID:2420
-
\??\c:\bdpvbnl.exec:\bdpvbnl.exe94⤵PID:1316
-
\??\c:\vxpbbb.exec:\vxpbbb.exe95⤵PID:3044
-
\??\c:\rbjvh.exec:\rbjvh.exe96⤵PID:2820
-
\??\c:\pdnxlrd.exec:\pdnxlrd.exe97⤵PID:1676
-
\??\c:\rfjvrp.exec:\rfjvrp.exe98⤵PID:320
-
\??\c:\ltlbxt.exec:\ltlbxt.exe99⤵PID:2356
-
\??\c:\rdfhpx.exec:\rdfhpx.exe100⤵PID:1944
-
\??\c:\bnvrnvn.exec:\bnvrnvn.exe101⤵PID:2148
-
\??\c:\lbnfft.exec:\lbnfft.exe102⤵PID:2496
-
\??\c:\xdrtbl.exec:\xdrtbl.exe103⤵PID:2520
-
\??\c:\jnlbpdd.exec:\jnlbpdd.exe104⤵PID:1276
-
\??\c:\nvfpvt.exec:\nvfpvt.exe105⤵PID:2280
-
\??\c:\fbhvn.exec:\fbhvn.exe106⤵PID:1044
-
\??\c:\hxffpbr.exec:\hxffpbr.exe107⤵PID:1564
-
\??\c:\fnjrvdx.exec:\fnjrvdx.exe108⤵PID:456
-
\??\c:\plplh.exec:\plplh.exe109⤵PID:1976
-
\??\c:\vljdhth.exec:\vljdhth.exe110⤵PID:2600
-
\??\c:\djjpxvl.exec:\djjpxvl.exe111⤵PID:2688
-
\??\c:\nxpvr.exec:\nxpvr.exe112⤵PID:1004
-
\??\c:\hhbfn.exec:\hhbfn.exe113⤵PID:940
-
\??\c:\lfxtp.exec:\lfxtp.exe114⤵PID:2252
-
\??\c:\bvrfdpr.exec:\bvrfdpr.exe115⤵PID:2188
-
\??\c:\ffblfn.exec:\ffblfn.exe116⤵
- System Location Discovery: System Language Discovery
PID:2464 -
\??\c:\vvrlb.exec:\vvrlb.exe117⤵PID:2360
-
\??\c:\dhvxjt.exec:\dhvxjt.exe118⤵PID:912
-
\??\c:\vltfv.exec:\vltfv.exe119⤵PID:2560
-
\??\c:\xvlrlbr.exec:\xvlrlbr.exe120⤵PID:2204
-
\??\c:\xdbndjf.exec:\xdbndjf.exe121⤵PID:1536
-
\??\c:\xnlnb.exec:\xnlnb.exe122⤵PID:1628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-