Analysis
-
max time kernel
152s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18-02-2025 04:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aa1341a7efc786b0881d17eb79c44e9c269def79997197bf3cc3ddc0d15aacb4.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
aa1341a7efc786b0881d17eb79c44e9c269def79997197bf3cc3ddc0d15aacb4.exe
-
Size
457KB
-
MD5
ae84c0d570e5da7da0ef2b42fa59aece
-
SHA1
1f5b9df4edff452262fe5aeaeb206d415daa7c36
-
SHA256
aa1341a7efc786b0881d17eb79c44e9c269def79997197bf3cc3ddc0d15aacb4
-
SHA512
1d9c629a753f225c555ddb6c09dcf619d09e8b20071a70db11a9de516004cff77d8c70882a60828390e8a5f0ed968004ed1cc63f4ffbae1ecf51a718646d0f95
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe4n:q7Tc2NYHUrAwfMp3CD4n
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2352-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-87-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2200-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1464-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1396-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1236-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-544-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/676-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/676-558-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2704-610-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2228-650-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2740-651-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3008-677-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1148-697-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/700-778-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2788-907-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2472 bjhth.exe 2912 ptlrf.exe 1076 lrflr.exe 2764 nrxvbd.exe 2888 rfnpx.exe 2708 vrbhdtf.exe 2228 tvdnd.exe 1120 jxljv.exe 2200 tvhdp.exe 1560 xvnph.exe 2968 rlddr.exe 2224 npnpr.exe 1756 ddnlr.exe 1688 dnfvdxp.exe 2488 prrldnv.exe 2420 vlhft.exe 2404 fvvlppd.exe 2244 xhdxphr.exe 2220 dvnffrf.exe 964 lhdtd.exe 908 lnpbfp.exe 1040 drhdx.exe 1748 fdbrh.exe 1464 txjvbn.exe 1864 bhhhp.exe 3040 thdflrh.exe 2280 rrplprj.exe 2112 tbrrdfl.exe 2140 bpdflnh.exe 2156 ljtxl.exe 1572 ppxvhl.exe 1396 rnbvxh.exe 2864 fptvnn.exe 2456 jlpvrtj.exe 1600 vvddhhj.exe 2936 xpplpx.exe 2916 lxxbnh.exe 2840 vnhjp.exe 1016 xdxjd.exe 2748 rrlphrr.exe 2428 lnjtr.exe 1548 jpdfv.exe 948 flxxjj.exe 2148 jvvnth.exe 2624 tfhdh.exe 2952 fttjvrj.exe 3028 fnxdb.exe 2776 tnthl.exe 3060 jfrfjj.exe 2196 hhtrxll.exe 1960 jhnxp.exe 2948 nvtpdn.exe 1028 nhvrt.exe 2484 rdxdj.exe 2348 dprjpht.exe 1916 rtdvtlt.exe 2244 nvbxvt.exe 1236 tpblb.exe 2056 xthdfhr.exe 584 nfpplnj.exe 1376 nrpbfl.exe 1732 dhhdjbt.exe 1748 vjlhtx.exe 1880 hfdblrx.exe -
resource yara_rule behavioral1/memory/2352-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1236-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-842-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-907-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-933-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btxrxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxprxtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plvxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbjfvhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jltvrlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbrjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlbdhrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrfnjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvrlbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvxhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njtdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tddjbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbtbxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlpll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rthjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxbxhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prprvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbxtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbpxjbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blfdrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntrxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txbvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drdbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpdvrnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhnlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfrbrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtbplp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtfjtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvnjxnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfjtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhhdjbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdnbfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbpjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fptnxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhfhxhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtdfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlpxjpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfdblrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbdfjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdhtph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbtpplt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvnlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pltjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lljpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdbtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxdrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfhdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plbvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdvlnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxpdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrvjxvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdlfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xplvxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvdlrdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfjjvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnbvxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfrtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npnxrvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfvlft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fljnfj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2472 2352 aa1341a7efc786b0881d17eb79c44e9c269def79997197bf3cc3ddc0d15aacb4.exe 30 PID 2352 wrote to memory of 2472 2352 aa1341a7efc786b0881d17eb79c44e9c269def79997197bf3cc3ddc0d15aacb4.exe 30 PID 2352 wrote to memory of 2472 2352 aa1341a7efc786b0881d17eb79c44e9c269def79997197bf3cc3ddc0d15aacb4.exe 30 PID 2352 wrote to memory of 2472 2352 aa1341a7efc786b0881d17eb79c44e9c269def79997197bf3cc3ddc0d15aacb4.exe 30 PID 2472 wrote to memory of 2912 2472 bjhth.exe 31 PID 2472 wrote to memory of 2912 2472 bjhth.exe 31 PID 2472 wrote to memory of 2912 2472 bjhth.exe 31 PID 2472 wrote to memory of 2912 2472 bjhth.exe 31 PID 2912 wrote to memory of 1076 2912 ptlrf.exe 32 PID 2912 wrote to memory of 1076 2912 ptlrf.exe 32 PID 2912 wrote to memory of 1076 2912 ptlrf.exe 32 PID 2912 wrote to memory of 1076 2912 ptlrf.exe 32 PID 1076 wrote to memory of 2764 1076 lrflr.exe 33 PID 1076 wrote to memory of 2764 1076 lrflr.exe 33 PID 1076 wrote to memory of 2764 1076 lrflr.exe 33 PID 1076 wrote to memory of 2764 1076 lrflr.exe 33 PID 2764 wrote to memory of 2888 2764 nrxvbd.exe 34 PID 2764 wrote to memory of 2888 2764 nrxvbd.exe 34 PID 2764 wrote to memory of 2888 2764 nrxvbd.exe 34 PID 2764 wrote to memory of 2888 2764 nrxvbd.exe 34 PID 2888 wrote to memory of 2708 2888 rfnpx.exe 35 PID 2888 wrote to memory of 2708 2888 rfnpx.exe 35 PID 2888 wrote to memory of 2708 2888 rfnpx.exe 35 PID 2888 wrote to memory of 2708 2888 rfnpx.exe 35 PID 2708 wrote to memory of 2228 2708 vrbhdtf.exe 36 PID 2708 wrote to memory of 2228 2708 vrbhdtf.exe 36 PID 2708 wrote to memory of 2228 2708 vrbhdtf.exe 36 PID 2708 wrote to memory of 2228 2708 vrbhdtf.exe 36 PID 2228 wrote to memory of 1120 2228 tvdnd.exe 37 PID 2228 wrote to memory of 1120 2228 tvdnd.exe 37 PID 2228 wrote to memory of 1120 2228 tvdnd.exe 37 PID 2228 wrote to memory of 1120 2228 tvdnd.exe 37 PID 1120 wrote to memory of 2200 1120 jxljv.exe 38 PID 1120 wrote to memory of 2200 1120 jxljv.exe 38 PID 1120 wrote to memory of 2200 1120 jxljv.exe 38 PID 1120 wrote to memory of 2200 1120 jxljv.exe 38 PID 2200 wrote to memory of 1560 2200 tvhdp.exe 39 PID 2200 wrote to memory of 1560 2200 tvhdp.exe 39 PID 2200 wrote to memory of 1560 2200 tvhdp.exe 39 PID 2200 wrote to memory of 1560 2200 tvhdp.exe 39 PID 1560 wrote to memory of 2968 1560 xvnph.exe 40 PID 1560 wrote to memory of 2968 1560 xvnph.exe 40 PID 1560 wrote to memory of 2968 1560 xvnph.exe 40 PID 1560 wrote to memory of 2968 1560 xvnph.exe 40 PID 2968 wrote to memory of 2224 2968 rlddr.exe 41 PID 2968 wrote to memory of 2224 2968 rlddr.exe 41 PID 2968 wrote to memory of 2224 2968 rlddr.exe 41 PID 2968 wrote to memory of 2224 2968 rlddr.exe 41 PID 2224 wrote to memory of 1756 2224 npnpr.exe 42 PID 2224 wrote to memory of 1756 2224 npnpr.exe 42 PID 2224 wrote to memory of 1756 2224 npnpr.exe 42 PID 2224 wrote to memory of 1756 2224 npnpr.exe 42 PID 1756 wrote to memory of 1688 1756 ddnlr.exe 43 PID 1756 wrote to memory of 1688 1756 ddnlr.exe 43 PID 1756 wrote to memory of 1688 1756 ddnlr.exe 43 PID 1756 wrote to memory of 1688 1756 ddnlr.exe 43 PID 1688 wrote to memory of 2488 1688 dnfvdxp.exe 44 PID 1688 wrote to memory of 2488 1688 dnfvdxp.exe 44 PID 1688 wrote to memory of 2488 1688 dnfvdxp.exe 44 PID 1688 wrote to memory of 2488 1688 dnfvdxp.exe 44 PID 2488 wrote to memory of 2420 2488 prrldnv.exe 45 PID 2488 wrote to memory of 2420 2488 prrldnv.exe 45 PID 2488 wrote to memory of 2420 2488 prrldnv.exe 45 PID 2488 wrote to memory of 2420 2488 prrldnv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa1341a7efc786b0881d17eb79c44e9c269def79997197bf3cc3ddc0d15aacb4.exe"C:\Users\Admin\AppData\Local\Temp\aa1341a7efc786b0881d17eb79c44e9c269def79997197bf3cc3ddc0d15aacb4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\bjhth.exec:\bjhth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\ptlrf.exec:\ptlrf.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\lrflr.exec:\lrflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\nrxvbd.exec:\nrxvbd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\rfnpx.exec:\rfnpx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\vrbhdtf.exec:\vrbhdtf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\tvdnd.exec:\tvdnd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\jxljv.exec:\jxljv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\tvhdp.exec:\tvhdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\xvnph.exec:\xvnph.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\rlddr.exec:\rlddr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\npnpr.exec:\npnpr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\ddnlr.exec:\ddnlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\dnfvdxp.exec:\dnfvdxp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\prrldnv.exec:\prrldnv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\vlhft.exec:\vlhft.exe17⤵
- Executes dropped EXE
PID:2420 -
\??\c:\fvvlppd.exec:\fvvlppd.exe18⤵
- Executes dropped EXE
PID:2404 -
\??\c:\xhdxphr.exec:\xhdxphr.exe19⤵
- Executes dropped EXE
PID:2244 -
\??\c:\dvnffrf.exec:\dvnffrf.exe20⤵
- Executes dropped EXE
PID:2220 -
\??\c:\lhdtd.exec:\lhdtd.exe21⤵
- Executes dropped EXE
PID:964 -
\??\c:\lnpbfp.exec:\lnpbfp.exe22⤵
- Executes dropped EXE
PID:908 -
\??\c:\drhdx.exec:\drhdx.exe23⤵
- Executes dropped EXE
PID:1040 -
\??\c:\fdbrh.exec:\fdbrh.exe24⤵
- Executes dropped EXE
PID:1748 -
\??\c:\txjvbn.exec:\txjvbn.exe25⤵
- Executes dropped EXE
PID:1464 -
\??\c:\bhhhp.exec:\bhhhp.exe26⤵
- Executes dropped EXE
PID:1864 -
\??\c:\thdflrh.exec:\thdflrh.exe27⤵
- Executes dropped EXE
PID:3040 -
\??\c:\rrplprj.exec:\rrplprj.exe28⤵
- Executes dropped EXE
PID:2280 -
\??\c:\tbrrdfl.exec:\tbrrdfl.exe29⤵
- Executes dropped EXE
PID:2112 -
\??\c:\bpdflnh.exec:\bpdflnh.exe30⤵
- Executes dropped EXE
PID:2140 -
\??\c:\ljtxl.exec:\ljtxl.exe31⤵
- Executes dropped EXE
PID:2156 -
\??\c:\ppxvhl.exec:\ppxvhl.exe32⤵
- Executes dropped EXE
PID:1572 -
\??\c:\rnbvxh.exec:\rnbvxh.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1396 -
\??\c:\fptvnn.exec:\fptvnn.exe34⤵
- Executes dropped EXE
PID:2864 -
\??\c:\jlpvrtj.exec:\jlpvrtj.exe35⤵
- Executes dropped EXE
PID:2456 -
\??\c:\vvddhhj.exec:\vvddhhj.exe36⤵
- Executes dropped EXE
PID:1600 -
\??\c:\xpplpx.exec:\xpplpx.exe37⤵
- Executes dropped EXE
PID:2936 -
\??\c:\lxxbnh.exec:\lxxbnh.exe38⤵
- Executes dropped EXE
PID:2916 -
\??\c:\vnhjp.exec:\vnhjp.exe39⤵
- Executes dropped EXE
PID:2840 -
\??\c:\xdxjd.exec:\xdxjd.exe40⤵
- Executes dropped EXE
PID:1016 -
\??\c:\rrlphrr.exec:\rrlphrr.exe41⤵
- Executes dropped EXE
PID:2748 -
\??\c:\lnjtr.exec:\lnjtr.exe42⤵
- Executes dropped EXE
PID:2428 -
\??\c:\jpdfv.exec:\jpdfv.exe43⤵
- Executes dropped EXE
PID:1548 -
\??\c:\flxxjj.exec:\flxxjj.exe44⤵
- Executes dropped EXE
PID:948 -
\??\c:\jvvnth.exec:\jvvnth.exe45⤵
- Executes dropped EXE
PID:2148 -
\??\c:\tfhdh.exec:\tfhdh.exe46⤵
- Executes dropped EXE
PID:2624 -
\??\c:\fttjvrj.exec:\fttjvrj.exe47⤵
- Executes dropped EXE
PID:2952 -
\??\c:\fnxdb.exec:\fnxdb.exe48⤵
- Executes dropped EXE
PID:3028 -
\??\c:\tnthl.exec:\tnthl.exe49⤵
- Executes dropped EXE
PID:2776 -
\??\c:\jfrfjj.exec:\jfrfjj.exe50⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hhtrxll.exec:\hhtrxll.exe51⤵
- Executes dropped EXE
PID:2196 -
\??\c:\jhnxp.exec:\jhnxp.exe52⤵
- Executes dropped EXE
PID:1960 -
\??\c:\nvtpdn.exec:\nvtpdn.exe53⤵
- Executes dropped EXE
PID:2948 -
\??\c:\nhvrt.exec:\nhvrt.exe54⤵
- Executes dropped EXE
PID:1028 -
\??\c:\rdxdj.exec:\rdxdj.exe55⤵
- Executes dropped EXE
PID:2484 -
\??\c:\dprjpht.exec:\dprjpht.exe56⤵
- Executes dropped EXE
PID:2348 -
\??\c:\rtdvtlt.exec:\rtdvtlt.exe57⤵
- Executes dropped EXE
PID:1916 -
\??\c:\nvbxvt.exec:\nvbxvt.exe58⤵
- Executes dropped EXE
PID:2244 -
\??\c:\tpblb.exec:\tpblb.exe59⤵
- Executes dropped EXE
PID:1236 -
\??\c:\xthdfhr.exec:\xthdfhr.exe60⤵
- Executes dropped EXE
PID:2056 -
\??\c:\nfpplnj.exec:\nfpplnj.exe61⤵
- Executes dropped EXE
PID:584 -
\??\c:\nrpbfl.exec:\nrpbfl.exe62⤵
- Executes dropped EXE
PID:1376 -
\??\c:\dhhdjbt.exec:\dhhdjbt.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1732 -
\??\c:\vjlhtx.exec:\vjlhtx.exe64⤵
- Executes dropped EXE
PID:1748 -
\??\c:\hfdblrx.exec:\hfdblrx.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1880 -
\??\c:\dhnnp.exec:\dhnnp.exe66⤵PID:2236
-
\??\c:\vdrfphh.exec:\vdrfphh.exe67⤵PID:3040
-
\??\c:\xxbfnhf.exec:\xxbfnhf.exe68⤵PID:2288
-
\??\c:\bdvnvx.exec:\bdvnvx.exe69⤵PID:2004
-
\??\c:\bnhdxph.exec:\bnhdxph.exe70⤵PID:2400
-
\??\c:\dlnbpr.exec:\dlnbpr.exe71⤵PID:676
-
\??\c:\jfhbxp.exec:\jfhbxp.exe72⤵PID:2532
-
\??\c:\vvnlv.exec:\vvnlv.exe73⤵
- System Location Discovery: System Language Discovery
PID:2540 -
\??\c:\fdhhjn.exec:\fdhhjn.exe74⤵PID:2820
-
\??\c:\hhdrvxl.exec:\hhdrvxl.exe75⤵PID:1396
-
\??\c:\nprfdt.exec:\nprfdt.exe76⤵PID:2860
-
\??\c:\brjft.exec:\brjft.exe77⤵PID:2808
-
\??\c:\pltnlnh.exec:\pltnlnh.exe78⤵PID:2836
-
\??\c:\nvvpdvv.exec:\nvvpdvv.exe79⤵PID:2704
-
\??\c:\pbrjf.exec:\pbrjf.exe80⤵
- System Location Discovery: System Language Discovery
PID:1676 -
\??\c:\pdlpltv.exec:\pdlpltv.exe81⤵PID:2788
-
\??\c:\jdjtntp.exec:\jdjtntp.exe82⤵PID:2740
-
\??\c:\dfpfbjn.exec:\dfpfbjn.exe83⤵PID:2728
-
\??\c:\nvdtlj.exec:\nvdtlj.exe84⤵PID:2204
-
\??\c:\dbtjflr.exec:\dbtjflr.exe85⤵PID:2228
-
\??\c:\xtvjxd.exec:\xtvjxd.exe86⤵PID:1128
-
\??\c:\hbvlvnd.exec:\hbvlvnd.exe87⤵PID:2620
-
\??\c:\xhrvpp.exec:\xhrvpp.exe88⤵PID:2332
-
\??\c:\ltddjtf.exec:\ltddjtf.exe89⤵PID:3008
-
\??\c:\pfrlrfh.exec:\pfrlrfh.exe90⤵PID:2372
-
\??\c:\bxdnhhx.exec:\bxdnhhx.exe91⤵PID:2968
-
\??\c:\bpnrpr.exec:\bpnrpr.exe92⤵PID:1148
-
\??\c:\lpjbd.exec:\lpjbd.exe93⤵PID:2408
-
\??\c:\bjbltv.exec:\bjbltv.exe94⤵PID:780
-
\??\c:\xhvfvlp.exec:\xhvfvlp.exe95⤵PID:596
-
\??\c:\bjlrfb.exec:\bjlrfb.exe96⤵PID:572
-
\??\c:\dtxlbnv.exec:\dtxlbnv.exe97⤵PID:2432
-
\??\c:\vvtbh.exec:\vvtbh.exe98⤵PID:2484
-
\??\c:\drvthdr.exec:\drvthdr.exe99⤵PID:2404
-
\??\c:\ddphnhl.exec:\ddphnhl.exe100⤵PID:1916
-
\??\c:\npbjdt.exec:\npbjdt.exe101⤵PID:2104
-
\??\c:\ptpdpr.exec:\ptpdpr.exe102⤵PID:700
-
\??\c:\vjnntf.exec:\vjnntf.exe103⤵PID:1020
-
\??\c:\jjjldbh.exec:\jjjldbh.exe104⤵PID:2056
-
\??\c:\tfrtb.exec:\tfrtb.exe105⤵
- System Location Discovery: System Language Discovery
PID:1040 -
\??\c:\fftxfrp.exec:\fftxfrp.exe106⤵PID:2164
-
\??\c:\rdlhtb.exec:\rdlhtb.exe107⤵PID:2644
-
\??\c:\vrhhj.exec:\vrhhj.exe108⤵PID:932
-
\??\c:\tvbrv.exec:\tvbrv.exe109⤵PID:592
-
\??\c:\tfhjvx.exec:\tfhjvx.exe110⤵PID:1692
-
\??\c:\lnhpbf.exec:\lnhpbf.exe111⤵PID:2236
-
\??\c:\lphlprd.exec:\lphlprd.exe112⤵PID:2280
-
\??\c:\xxbtbvj.exec:\xxbtbvj.exe113⤵PID:2528
-
\??\c:\ntnjdxf.exec:\ntnjdxf.exe114⤵PID:1596
-
\??\c:\bpxrxdj.exec:\bpxrxdj.exe115⤵PID:896
-
\??\c:\dfllt.exec:\dfllt.exe116⤵PID:1568
-
\??\c:\jdrvn.exec:\jdrvn.exe117⤵PID:2532
-
\??\c:\hxtpl.exec:\hxtpl.exe118⤵PID:2492
-
\??\c:\htxbrfn.exec:\htxbrfn.exe119⤵PID:2820
-
\??\c:\nfljxfx.exec:\nfljxfx.exe120⤵PID:1508
-
\??\c:\tptfn.exec:\tptfn.exe121⤵PID:1532
-
\??\c:\vlnxr.exec:\vlnxr.exe122⤵PID:2976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-