Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18-02-2025 08:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe
-
Size
80KB
-
MD5
f42bdfb526b25e30aa34398337dd8dfb
-
SHA1
38c9e3582e3cf1d352ea222408bae1aeb64ff429
-
SHA256
fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c
-
SHA512
bd68ced0d62e94f347e2561344b535a44a365b262186b6e389b39804b483716132364dad6eb1c32a8dccd4219e55b5d1a4e15a5acfa8c095c660ac046f2fb259
-
SSDEEP
1536:Y41JEOJzOhWlKXXCwsurYKnFNzofrst3ufT/FRxnd:Y49z/lKXXdFvN8Yt3ujFfd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/1552-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/868-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/868-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-61-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2664-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-186-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/528-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/688-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-262-0x0000000000280000-0x00000000002AA000-memory.dmp family_blackmoon behavioral1/memory/1212-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/544-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/268-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-372-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2640-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-438-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/3016-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-478-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2816-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-627-0x00000000002F0000-0x000000000031A000-memory.dmp family_blackmoon behavioral1/memory/2696-663-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2664-679-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2992-682-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-697-0x0000000001B50000-0x0000000001B7A000-memory.dmp family_blackmoon behavioral1/memory/832-705-0x00000000001E0000-0x000000000020A000-memory.dmp family_blackmoon behavioral1/memory/1740-696-0x0000000001B50000-0x0000000001B7A000-memory.dmp family_blackmoon behavioral1/memory/1728-757-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-766-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1368-796-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2300-1025-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-1084-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-1212-0x00000000002F0000-0x000000000031A000-memory.dmp family_blackmoon behavioral1/memory/2980-1291-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2232-1321-0x00000000002D0000-0x00000000002FA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1700 xrxljvx.exe 868 nrjnd.exe 2940 jdhxrvn.exe 2924 vxhvnp.exe 3020 ltplvvd.exe 2616 pnrjx.exe 2664 btfljhp.exe 2680 hprpdn.exe 2708 lhnnvjd.exe 2828 dlpjv.exe 1712 tdpldh.exe 1928 trdbtx.exe 3008 bvxrrfd.exe 2660 vttfxxf.exe 2168 pxnpbj.exe 1908 hxfbjt.exe 528 xrhdfdl.exe 2816 rllhhph.exe 688 hxvdhfb.exe 1612 lvlxf.exe 2120 vdhbx.exe 896 hjbfbpf.exe 1488 fhxlnn.exe 1212 htjdtt.exe 2348 rbpjpd.exe 544 rxppp.exe 268 pbrljd.exe 1672 ttvrt.exe 3032 lxhxx.exe 2552 ftvnh.exe 1708 xnvbt.exe 2940 xdnhlr.exe 2876 lxvxtjv.exe 2892 jhrfx.exe 2456 nbblpfd.exe 3012 dxbtd.exe 2640 fhvdv.exe 2616 nppbrp.exe 2276 blldrx.exe 2976 vnrpjxt.exe 2680 dbthhxf.exe 3016 lxfxv.exe 2608 pbxnf.exe 2836 nxfvvpn.exe 2820 rltvb.exe 2532 ptfrrp.exe 1752 drdlfj.exe 2572 rfnnn.exe 1044 vldjnp.exe 1504 ftltbv.exe 2288 hfbptd.exe 1352 nptjlr.exe 528 tfxvb.exe 2816 dxbvh.exe 1184 prjtxlt.exe 2864 txblbj.exe 1716 rxdthnj.exe 1056 dflrfr.exe 1472 jtbnfd.exe 1232 lffnl.exe 932 ftlpj.exe 2312 phnrnp.exe 1976 xlrth.exe 1668 xhpxh.exe -
resource yara_rule behavioral1/memory/1552-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/528-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/688-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-757-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-891-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/2300-1025-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-1084-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlhjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dffxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpljjtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfhjldp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhrfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpxnjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfjxplt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpjhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prjtxlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfxhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpfjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvhnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xthhvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfdldrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdlrpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxtrprb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltxtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjddl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfhvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lndjxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drrfnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxnxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjxppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjfnlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhnvbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdhxrvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvhxrxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlxxplp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdxvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhxnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrpvvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1552 wrote to memory of 1700 1552 fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe 31 PID 1552 wrote to memory of 1700 1552 fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe 31 PID 1552 wrote to memory of 1700 1552 fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe 31 PID 1552 wrote to memory of 1700 1552 fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe 31 PID 1700 wrote to memory of 868 1700 xrxljvx.exe 32 PID 1700 wrote to memory of 868 1700 xrxljvx.exe 32 PID 1700 wrote to memory of 868 1700 xrxljvx.exe 32 PID 1700 wrote to memory of 868 1700 xrxljvx.exe 32 PID 868 wrote to memory of 2940 868 nrjnd.exe 33 PID 868 wrote to memory of 2940 868 nrjnd.exe 33 PID 868 wrote to memory of 2940 868 nrjnd.exe 33 PID 868 wrote to memory of 2940 868 nrjnd.exe 33 PID 2940 wrote to memory of 2924 2940 jdhxrvn.exe 34 PID 2940 wrote to memory of 2924 2940 jdhxrvn.exe 34 PID 2940 wrote to memory of 2924 2940 jdhxrvn.exe 34 PID 2940 wrote to memory of 2924 2940 jdhxrvn.exe 34 PID 2924 wrote to memory of 3020 2924 vxhvnp.exe 35 PID 2924 wrote to memory of 3020 2924 vxhvnp.exe 35 PID 2924 wrote to memory of 3020 2924 vxhvnp.exe 35 PID 2924 wrote to memory of 3020 2924 vxhvnp.exe 35 PID 3020 wrote to memory of 2616 3020 ltplvvd.exe 36 PID 3020 wrote to memory of 2616 3020 ltplvvd.exe 36 PID 3020 wrote to memory of 2616 3020 ltplvvd.exe 36 PID 3020 wrote to memory of 2616 3020 ltplvvd.exe 36 PID 2616 wrote to memory of 2664 2616 pnrjx.exe 37 PID 2616 wrote to memory of 2664 2616 pnrjx.exe 37 PID 2616 wrote to memory of 2664 2616 pnrjx.exe 37 PID 2616 wrote to memory of 2664 2616 pnrjx.exe 37 PID 2664 wrote to memory of 2680 2664 btfljhp.exe 38 PID 2664 wrote to memory of 2680 2664 btfljhp.exe 38 PID 2664 wrote to memory of 2680 2664 btfljhp.exe 38 PID 2664 wrote to memory of 2680 2664 btfljhp.exe 38 PID 2680 wrote to memory of 2708 2680 hprpdn.exe 39 PID 2680 wrote to memory of 2708 2680 hprpdn.exe 39 PID 2680 wrote to memory of 2708 2680 hprpdn.exe 39 PID 2680 wrote to memory of 2708 2680 hprpdn.exe 39 PID 2708 wrote to memory of 2828 2708 lhnnvjd.exe 40 PID 2708 wrote to memory of 2828 2708 lhnnvjd.exe 40 PID 2708 wrote to memory of 2828 2708 lhnnvjd.exe 40 PID 2708 wrote to memory of 2828 2708 lhnnvjd.exe 40 PID 2828 wrote to memory of 1712 2828 dlpjv.exe 41 PID 2828 wrote to memory of 1712 2828 dlpjv.exe 41 PID 2828 wrote to memory of 1712 2828 dlpjv.exe 41 PID 2828 wrote to memory of 1712 2828 dlpjv.exe 41 PID 1712 wrote to memory of 1928 1712 tdpldh.exe 42 PID 1712 wrote to memory of 1928 1712 tdpldh.exe 42 PID 1712 wrote to memory of 1928 1712 tdpldh.exe 42 PID 1712 wrote to memory of 1928 1712 tdpldh.exe 42 PID 1928 wrote to memory of 3008 1928 trdbtx.exe 43 PID 1928 wrote to memory of 3008 1928 trdbtx.exe 43 PID 1928 wrote to memory of 3008 1928 trdbtx.exe 43 PID 1928 wrote to memory of 3008 1928 trdbtx.exe 43 PID 3008 wrote to memory of 2660 3008 bvxrrfd.exe 44 PID 3008 wrote to memory of 2660 3008 bvxrrfd.exe 44 PID 3008 wrote to memory of 2660 3008 bvxrrfd.exe 44 PID 3008 wrote to memory of 2660 3008 bvxrrfd.exe 44 PID 2660 wrote to memory of 2168 2660 vttfxxf.exe 45 PID 2660 wrote to memory of 2168 2660 vttfxxf.exe 45 PID 2660 wrote to memory of 2168 2660 vttfxxf.exe 45 PID 2660 wrote to memory of 2168 2660 vttfxxf.exe 45 PID 2168 wrote to memory of 1908 2168 pxnpbj.exe 46 PID 2168 wrote to memory of 1908 2168 pxnpbj.exe 46 PID 2168 wrote to memory of 1908 2168 pxnpbj.exe 46 PID 2168 wrote to memory of 1908 2168 pxnpbj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe"C:\Users\Admin\AppData\Local\Temp\fb4c6e82b6cd2da31223dbab1b100b119af2364e16ce77309dbfe56b1d626f9c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\xrxljvx.exec:\xrxljvx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\nrjnd.exec:\nrjnd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\jdhxrvn.exec:\jdhxrvn.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\vxhvnp.exec:\vxhvnp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\ltplvvd.exec:\ltplvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\pnrjx.exec:\pnrjx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\btfljhp.exec:\btfljhp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\hprpdn.exec:\hprpdn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\lhnnvjd.exec:\lhnnvjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\dlpjv.exec:\dlpjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\tdpldh.exec:\tdpldh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\trdbtx.exec:\trdbtx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\bvxrrfd.exec:\bvxrrfd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\vttfxxf.exec:\vttfxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\pxnpbj.exec:\pxnpbj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\hxfbjt.exec:\hxfbjt.exe17⤵
- Executes dropped EXE
PID:1908 -
\??\c:\xrhdfdl.exec:\xrhdfdl.exe18⤵
- Executes dropped EXE
PID:528 -
\??\c:\rllhhph.exec:\rllhhph.exe19⤵
- Executes dropped EXE
PID:2816 -
\??\c:\hxvdhfb.exec:\hxvdhfb.exe20⤵
- Executes dropped EXE
PID:688 -
\??\c:\lvlxf.exec:\lvlxf.exe21⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vdhbx.exec:\vdhbx.exe22⤵
- Executes dropped EXE
PID:2120 -
\??\c:\hjbfbpf.exec:\hjbfbpf.exe23⤵
- Executes dropped EXE
PID:896 -
\??\c:\fhxlnn.exec:\fhxlnn.exe24⤵
- Executes dropped EXE
PID:1488 -
\??\c:\htjdtt.exec:\htjdtt.exe25⤵
- Executes dropped EXE
PID:1212 -
\??\c:\rbpjpd.exec:\rbpjpd.exe26⤵
- Executes dropped EXE
PID:2348 -
\??\c:\rxppp.exec:\rxppp.exe27⤵
- Executes dropped EXE
PID:544 -
\??\c:\pbrljd.exec:\pbrljd.exe28⤵
- Executes dropped EXE
PID:268 -
\??\c:\ttvrt.exec:\ttvrt.exe29⤵
- Executes dropped EXE
PID:1672 -
\??\c:\lxhxx.exec:\lxhxx.exe30⤵
- Executes dropped EXE
PID:3032 -
\??\c:\ftvnh.exec:\ftvnh.exe31⤵
- Executes dropped EXE
PID:2552 -
\??\c:\xnvbt.exec:\xnvbt.exe32⤵
- Executes dropped EXE
PID:1708 -
\??\c:\xdnhlr.exec:\xdnhlr.exe33⤵
- Executes dropped EXE
PID:2940 -
\??\c:\lxvxtjv.exec:\lxvxtjv.exe34⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jhrfx.exec:\jhrfx.exe35⤵
- Executes dropped EXE
PID:2892 -
\??\c:\nbblpfd.exec:\nbblpfd.exe36⤵
- Executes dropped EXE
PID:2456 -
\??\c:\dxbtd.exec:\dxbtd.exe37⤵
- Executes dropped EXE
PID:3012 -
\??\c:\fhvdv.exec:\fhvdv.exe38⤵
- Executes dropped EXE
PID:2640 -
\??\c:\nppbrp.exec:\nppbrp.exe39⤵
- Executes dropped EXE
PID:2616 -
\??\c:\blldrx.exec:\blldrx.exe40⤵
- Executes dropped EXE
PID:2276 -
\??\c:\vnrpjxt.exec:\vnrpjxt.exe41⤵
- Executes dropped EXE
PID:2976 -
\??\c:\dbthhxf.exec:\dbthhxf.exe42⤵
- Executes dropped EXE
PID:2680 -
\??\c:\lxfxv.exec:\lxfxv.exe43⤵
- Executes dropped EXE
PID:3016 -
\??\c:\pbxnf.exec:\pbxnf.exe44⤵
- Executes dropped EXE
PID:2608 -
\??\c:\nxfvvpn.exec:\nxfvvpn.exe45⤵
- Executes dropped EXE
PID:2836 -
\??\c:\rltvb.exec:\rltvb.exe46⤵
- Executes dropped EXE
PID:2820 -
\??\c:\ptfrrp.exec:\ptfrrp.exe47⤵
- Executes dropped EXE
PID:2532 -
\??\c:\drdlfj.exec:\drdlfj.exe48⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rfnnn.exec:\rfnnn.exe49⤵
- Executes dropped EXE
PID:2572 -
\??\c:\vldjnp.exec:\vldjnp.exe50⤵
- Executes dropped EXE
PID:1044 -
\??\c:\ftltbv.exec:\ftltbv.exe51⤵
- Executes dropped EXE
PID:1504 -
\??\c:\hfbptd.exec:\hfbptd.exe52⤵
- Executes dropped EXE
PID:2288 -
\??\c:\nptjlr.exec:\nptjlr.exe53⤵
- Executes dropped EXE
PID:1352 -
\??\c:\tfxvb.exec:\tfxvb.exe54⤵
- Executes dropped EXE
PID:528 -
\??\c:\dxbvh.exec:\dxbvh.exe55⤵
- Executes dropped EXE
PID:2816 -
\??\c:\prjtxlt.exec:\prjtxlt.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1184 -
\??\c:\txblbj.exec:\txblbj.exe57⤵
- Executes dropped EXE
PID:2864 -
\??\c:\rxdthnj.exec:\rxdthnj.exe58⤵
- Executes dropped EXE
PID:1716 -
\??\c:\dflrfr.exec:\dflrfr.exe59⤵
- Executes dropped EXE
PID:1056 -
\??\c:\jtbnfd.exec:\jtbnfd.exe60⤵
- Executes dropped EXE
PID:1472 -
\??\c:\lffnl.exec:\lffnl.exe61⤵
- Executes dropped EXE
PID:1232 -
\??\c:\ftlpj.exec:\ftlpj.exe62⤵
- Executes dropped EXE
PID:932 -
\??\c:\phnrnp.exec:\phnrnp.exe63⤵
- Executes dropped EXE
PID:2312 -
\??\c:\xlrth.exec:\xlrth.exe64⤵
- Executes dropped EXE
PID:1976 -
\??\c:\xhpxh.exec:\xhpxh.exe65⤵
- Executes dropped EXE
PID:1668 -
\??\c:\lptxlnt.exec:\lptxlnt.exe66⤵PID:2068
-
\??\c:\pxvvtlt.exec:\pxvvtlt.exe67⤵PID:536
-
\??\c:\hvljptf.exec:\hvljptf.exe68⤵PID:2340
-
\??\c:\lvfdt.exec:\lvfdt.exe69⤵PID:1732
-
\??\c:\dnbbhf.exec:\dnbbhf.exe70⤵PID:3056
-
\??\c:\bhpdrht.exec:\bhpdrht.exe71⤵PID:2440
-
\??\c:\lhbhbrt.exec:\lhbhbrt.exe72⤵PID:2924
-
\??\c:\vbbrld.exec:\vbbrld.exe73⤵PID:2900
-
\??\c:\vhbthlx.exec:\vhbthlx.exe74⤵PID:2192
-
\??\c:\jjnjln.exec:\jjnjln.exe75⤵PID:2380
-
\??\c:\lnbvlpt.exec:\lnbvlpt.exe76⤵PID:2696
-
\??\c:\jrndrl.exec:\jrndrl.exe77⤵PID:2376
-
\??\c:\vvvfjl.exec:\vvvfjl.exe78⤵PID:2664
-
\??\c:\jfnbpjh.exec:\jfnbpjh.exe79⤵PID:2992
-
\??\c:\pdxbnff.exec:\pdxbnff.exe80⤵PID:1740
-
\??\c:\rjdjjhr.exec:\rjdjjhr.exe81⤵PID:832
-
\??\c:\xtjlflb.exec:\xtjlflb.exe82⤵PID:2516
-
\??\c:\dnjdl.exec:\dnjdl.exe83⤵PID:1464
-
\??\c:\dftrvl.exec:\dftrvl.exe84⤵PID:1460
-
\??\c:\tfhjldp.exec:\tfhjldp.exe85⤵
- System Location Discovery: System Language Discovery
PID:1900 -
\??\c:\lvfhdbh.exec:\lvfhdbh.exe86⤵PID:3008
-
\??\c:\jxhdxd.exec:\jxhdxd.exe87⤵PID:1068
-
\??\c:\hptbhx.exec:\hptbhx.exe88⤵PID:1728
-
\??\c:\rbjrlx.exec:\rbjrlx.exe89⤵PID:1812
-
\??\c:\tlfbhf.exec:\tlfbhf.exe90⤵PID:1064
-
\??\c:\vlhfd.exec:\vlhfd.exe91⤵PID:1480
-
\??\c:\vfdvl.exec:\vfdvl.exe92⤵PID:3052
-
\??\c:\fnpvhn.exec:\fnpvhn.exe93⤵PID:1368
-
\??\c:\rlrlb.exec:\rlrlb.exe94⤵PID:1824
-
\??\c:\fjlxlxr.exec:\fjlxlxr.exe95⤵PID:2864
-
\??\c:\jnbbffh.exec:\jnbbffh.exe96⤵PID:2120
-
\??\c:\hndpdp.exec:\hndpdp.exe97⤵PID:1540
-
\??\c:\pnnhtf.exec:\pnnhtf.exe98⤵PID:2416
-
\??\c:\tpnlrrf.exec:\tpnlrrf.exe99⤵PID:2352
-
\??\c:\hpphj.exec:\hpphj.exe100⤵PID:1528
-
\??\c:\nnhnb.exec:\nnhnb.exe101⤵PID:1360
-
\??\c:\dpptt.exec:\dpptt.exe102⤵PID:2196
-
\??\c:\rbvtb.exec:\rbvtb.exe103⤵PID:2704
-
\??\c:\nhjthxj.exec:\nhjthxj.exe104⤵PID:1668
-
\??\c:\jfdnp.exec:\jfdnp.exe105⤵PID:3028
-
\??\c:\flrxhd.exec:\flrxhd.exe106⤵PID:1720
-
\??\c:\bvrvp.exec:\bvrvp.exe107⤵PID:3032
-
\??\c:\nvnhpj.exec:\nvnhpj.exe108⤵PID:1732
-
\??\c:\vxldvj.exec:\vxldvj.exe109⤵PID:2388
-
\??\c:\rnljb.exec:\rnljb.exe110⤵PID:2908
-
\??\c:\tptrnfp.exec:\tptrnfp.exe111⤵PID:2772
-
\??\c:\pnvhxt.exec:\pnvhxt.exe112⤵PID:2956
-
\??\c:\nvrjxv.exec:\nvrjxv.exe113⤵PID:2052
-
\??\c:\rfptpfn.exec:\rfptpfn.exe114⤵PID:3020
-
\??\c:\dbtbhbv.exec:\dbtbhbv.exe115⤵PID:2676
-
\??\c:\hnrpt.exec:\hnrpt.exe116⤵PID:2124
-
\??\c:\bhljph.exec:\bhljph.exe117⤵PID:1692
-
\??\c:\fldxbrr.exec:\fldxbrr.exe118⤵PID:2688
-
\??\c:\tlvdxn.exec:\tlvdxn.exe119⤵PID:2680
-
\??\c:\hvpdfll.exec:\hvpdfll.exe120⤵PID:1740
-
\??\c:\ddlbvpp.exec:\ddlbvpp.exe121⤵PID:1948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-