Analysis
-
max time kernel
152s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18-02-2025 07:29
Behavioral task
behavioral1
Sample
ed50f8332ec622363962ef35385f228c75eef11f8da485222a9f3cb0f1498a58.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ed50f8332ec622363962ef35385f228c75eef11f8da485222a9f3cb0f1498a58.exe
-
Size
334KB
-
MD5
859196f26a3f989742f0b6597c231aa7
-
SHA1
745c83505fb366f60dfa8ce8141bd6c7f40c2d9f
-
SHA256
ed50f8332ec622363962ef35385f228c75eef11f8da485222a9f3cb0f1498a58
-
SHA512
9154896ccc4c0115eef588dfbb947c0e23be3c75ecb48713263b835508448d2eba5f8c343c80964b4fae58e672f8067851bc8c0cc559b8973d78d1474491d87b
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbebg:R4wFHoSHYHUrAwfMp3CDbg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/564-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-14-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2804-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-50-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2688-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1500-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2412-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1756-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/572-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1872-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1692-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1540-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-288-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2492-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-295-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1120-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1400-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-501-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/904-513-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2004-536-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1308-543-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1988-560-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1568-571-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3024-641-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1412-924-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-954-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2768 hllnf.exe 2804 tnfflvf.exe 2920 plnfd.exe 2792 drbhj.exe 2700 fbnhh.exe 2688 dfdlhtl.exe 2844 tddtx.exe 1456 vpvpnt.exe 2908 rtflnx.exe 1500 bhxtlr.exe 2608 rplxjn.exe 2412 fhddd.exe 2984 vhnrtt.exe 2208 xfhth.exe 2988 xplpxb.exe 1756 tptnpjl.exe 2948 ljvnvjt.exe 572 fjxpvrr.exe 2380 htvjlr.exe 1144 fhdrtn.exe 1840 bnjjtj.exe 2116 fjlfdx.exe 1328 frjvtvj.exe 2024 ndnlft.exe 2516 jlrtr.exe 2632 tdtvhr.exe 2084 njfjbj.exe 1872 vbfhx.exe 592 frvhb.exe 1308 xntbpl.exe 1692 ndtfpft.exe 2260 bhdnb.exe 1664 bfnbprd.exe 1888 hbhbhp.exe 1540 vvbjtx.exe 2556 pblfpn.exe 2492 lrfrnj.exe 2352 phbrdff.exe 1612 fdjhr.exe 2820 fjhvf.exe 2876 pllhb.exe 2804 tdddh.exe 1600 tvdhx.exe 3048 pvtvx.exe 2840 jhvxhxh.exe 2708 flrrf.exe 2676 vllrnn.exe 2588 xfxbpr.exe 944 pxpvx.exe 1120 tlfjrbd.exe 1548 jnjbb.exe 2908 rttxxh.exe 2620 ffjfn.exe 1936 tjltnxj.exe 1560 plbpn.exe 2736 fddnldr.exe 3008 fvjxn.exe 2972 vbrddx.exe 2776 jlrrhb.exe 2320 ftvtl.exe 2416 vhvdpff.exe 1960 fhbbp.exe 612 jjdjt.exe 320 bhjtltj.exe -
resource yara_rule behavioral1/memory/564-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/564-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000012263-5.dat upx behavioral1/files/0x00080000000186bb-16.dat upx behavioral1/memory/2768-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000186c3-24.dat upx behavioral1/memory/2920-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2804-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2920-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000018b05-33.dat upx behavioral1/files/0x0007000000018b50-43.dat upx behavioral1/memory/2792-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b54-52.dat upx behavioral1/memory/2700-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x001500000001756e-59.dat upx behavioral1/memory/2844-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2688-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b59-69.dat upx behavioral1/memory/2844-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001948c-78.dat upx behavioral1/files/0x000500000001975a-84.dat upx behavioral1/memory/1500-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019761-92.dat upx behavioral1/memory/2608-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000197fd-101.dat upx behavioral1/memory/2412-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2412-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019820-110.dat upx behavioral1/files/0x000500000001998d-117.dat upx behavioral1/memory/2984-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2208-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf5-127.dat upx behavioral1/files/0x0005000000019bf6-133.dat upx behavioral1/memory/1756-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf9-141.dat upx behavioral1/memory/2948-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/572-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c3c-149.dat upx behavioral1/memory/572-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d61-158.dat upx behavioral1/files/0x0005000000019d62-165.dat upx behavioral1/memory/2380-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d6d-173.dat upx behavioral1/files/0x0005000000019e92-180.dat upx behavioral1/files/0x0005000000019fd4-190.dat upx behavioral1/files/0x0005000000019fdd-197.dat upx behavioral1/memory/2024-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a03c-207.dat upx behavioral1/memory/2024-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a049-213.dat upx behavioral1/memory/2632-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a0b6-221.dat upx behavioral1/files/0x000500000001a309-228.dat upx behavioral1/files/0x000500000001a3ab-236.dat upx behavioral1/memory/1872-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a3f6-243.dat upx behavioral1/files/0x000500000001a3f8-250.dat upx behavioral1/files/0x000500000001a3fd-258.dat upx behavioral1/memory/1692-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2260-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1540-276-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1540-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2492-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1120-363-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhjtltj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvttpjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhtrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtlhrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbxpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjxrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llbpbdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpnxjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvfjph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rprvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xldjhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpdrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxtfbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltjxlln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbllfjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbpjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbfrfbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npppf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlpxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxjtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrvffp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtrfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drbnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtlnjtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbftfbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbbnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thvpxhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptlpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjxdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfdhvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frvhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdhltv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbtpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfvnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrnxbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btrxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlxhhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpfbldd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfbpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpfhhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnftht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpljh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdxxhpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pphtbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfjdfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdphd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 564 wrote to memory of 2768 564 ed50f8332ec622363962ef35385f228c75eef11f8da485222a9f3cb0f1498a58.exe 30 PID 564 wrote to memory of 2768 564 ed50f8332ec622363962ef35385f228c75eef11f8da485222a9f3cb0f1498a58.exe 30 PID 564 wrote to memory of 2768 564 ed50f8332ec622363962ef35385f228c75eef11f8da485222a9f3cb0f1498a58.exe 30 PID 564 wrote to memory of 2768 564 ed50f8332ec622363962ef35385f228c75eef11f8da485222a9f3cb0f1498a58.exe 30 PID 2768 wrote to memory of 2804 2768 hllnf.exe 31 PID 2768 wrote to memory of 2804 2768 hllnf.exe 31 PID 2768 wrote to memory of 2804 2768 hllnf.exe 31 PID 2768 wrote to memory of 2804 2768 hllnf.exe 31 PID 2804 wrote to memory of 2920 2804 tnfflvf.exe 32 PID 2804 wrote to memory of 2920 2804 tnfflvf.exe 32 PID 2804 wrote to memory of 2920 2804 tnfflvf.exe 32 PID 2804 wrote to memory of 2920 2804 tnfflvf.exe 32 PID 2920 wrote to memory of 2792 2920 plnfd.exe 33 PID 2920 wrote to memory of 2792 2920 plnfd.exe 33 PID 2920 wrote to memory of 2792 2920 plnfd.exe 33 PID 2920 wrote to memory of 2792 2920 plnfd.exe 33 PID 2792 wrote to memory of 2700 2792 drbhj.exe 34 PID 2792 wrote to memory of 2700 2792 drbhj.exe 34 PID 2792 wrote to memory of 2700 2792 drbhj.exe 34 PID 2792 wrote to memory of 2700 2792 drbhj.exe 34 PID 2700 wrote to memory of 2688 2700 fbnhh.exe 35 PID 2700 wrote to memory of 2688 2700 fbnhh.exe 35 PID 2700 wrote to memory of 2688 2700 fbnhh.exe 35 PID 2700 wrote to memory of 2688 2700 fbnhh.exe 35 PID 2688 wrote to memory of 2844 2688 dfdlhtl.exe 36 PID 2688 wrote to memory of 2844 2688 dfdlhtl.exe 36 PID 2688 wrote to memory of 2844 2688 dfdlhtl.exe 36 PID 2688 wrote to memory of 2844 2688 dfdlhtl.exe 36 PID 2844 wrote to memory of 1456 2844 tddtx.exe 37 PID 2844 wrote to memory of 1456 2844 tddtx.exe 37 PID 2844 wrote to memory of 1456 2844 tddtx.exe 37 PID 2844 wrote to memory of 1456 2844 tddtx.exe 37 PID 1456 wrote to memory of 2908 1456 vpvpnt.exe 38 PID 1456 wrote to memory of 2908 1456 vpvpnt.exe 38 PID 1456 wrote to memory of 2908 1456 vpvpnt.exe 38 PID 1456 wrote to memory of 2908 1456 vpvpnt.exe 38 PID 2908 wrote to memory of 1500 2908 rtflnx.exe 39 PID 2908 wrote to memory of 1500 2908 rtflnx.exe 39 PID 2908 wrote to memory of 1500 2908 rtflnx.exe 39 PID 2908 wrote to memory of 1500 2908 rtflnx.exe 39 PID 1500 wrote to memory of 2608 1500 bhxtlr.exe 40 PID 1500 wrote to memory of 2608 1500 bhxtlr.exe 40 PID 1500 wrote to memory of 2608 1500 bhxtlr.exe 40 PID 1500 wrote to memory of 2608 1500 bhxtlr.exe 40 PID 2608 wrote to memory of 2412 2608 rplxjn.exe 41 PID 2608 wrote to memory of 2412 2608 rplxjn.exe 41 PID 2608 wrote to memory of 2412 2608 rplxjn.exe 41 PID 2608 wrote to memory of 2412 2608 rplxjn.exe 41 PID 2412 wrote to memory of 2984 2412 fhddd.exe 42 PID 2412 wrote to memory of 2984 2412 fhddd.exe 42 PID 2412 wrote to memory of 2984 2412 fhddd.exe 42 PID 2412 wrote to memory of 2984 2412 fhddd.exe 42 PID 2984 wrote to memory of 2208 2984 vhnrtt.exe 43 PID 2984 wrote to memory of 2208 2984 vhnrtt.exe 43 PID 2984 wrote to memory of 2208 2984 vhnrtt.exe 43 PID 2984 wrote to memory of 2208 2984 vhnrtt.exe 43 PID 2208 wrote to memory of 2988 2208 xfhth.exe 44 PID 2208 wrote to memory of 2988 2208 xfhth.exe 44 PID 2208 wrote to memory of 2988 2208 xfhth.exe 44 PID 2208 wrote to memory of 2988 2208 xfhth.exe 44 PID 2988 wrote to memory of 1756 2988 xplpxb.exe 45 PID 2988 wrote to memory of 1756 2988 xplpxb.exe 45 PID 2988 wrote to memory of 1756 2988 xplpxb.exe 45 PID 2988 wrote to memory of 1756 2988 xplpxb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed50f8332ec622363962ef35385f228c75eef11f8da485222a9f3cb0f1498a58.exe"C:\Users\Admin\AppData\Local\Temp\ed50f8332ec622363962ef35385f228c75eef11f8da485222a9f3cb0f1498a58.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\hllnf.exec:\hllnf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\tnfflvf.exec:\tnfflvf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\plnfd.exec:\plnfd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\drbhj.exec:\drbhj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\fbnhh.exec:\fbnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\dfdlhtl.exec:\dfdlhtl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\tddtx.exec:\tddtx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\vpvpnt.exec:\vpvpnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\rtflnx.exec:\rtflnx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\bhxtlr.exec:\bhxtlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\rplxjn.exec:\rplxjn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\fhddd.exec:\fhddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\vhnrtt.exec:\vhnrtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\xfhth.exec:\xfhth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\xplpxb.exec:\xplpxb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\tptnpjl.exec:\tptnpjl.exe17⤵
- Executes dropped EXE
PID:1756 -
\??\c:\ljvnvjt.exec:\ljvnvjt.exe18⤵
- Executes dropped EXE
PID:2948 -
\??\c:\fjxpvrr.exec:\fjxpvrr.exe19⤵
- Executes dropped EXE
PID:572 -
\??\c:\htvjlr.exec:\htvjlr.exe20⤵
- Executes dropped EXE
PID:2380 -
\??\c:\fhdrtn.exec:\fhdrtn.exe21⤵
- Executes dropped EXE
PID:1144 -
\??\c:\bnjjtj.exec:\bnjjtj.exe22⤵
- Executes dropped EXE
PID:1840 -
\??\c:\fjlfdx.exec:\fjlfdx.exe23⤵
- Executes dropped EXE
PID:2116 -
\??\c:\frjvtvj.exec:\frjvtvj.exe24⤵
- Executes dropped EXE
PID:1328 -
\??\c:\ndnlft.exec:\ndnlft.exe25⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jlrtr.exec:\jlrtr.exe26⤵
- Executes dropped EXE
PID:2516 -
\??\c:\tdtvhr.exec:\tdtvhr.exe27⤵
- Executes dropped EXE
PID:2632 -
\??\c:\njfjbj.exec:\njfjbj.exe28⤵
- Executes dropped EXE
PID:2084 -
\??\c:\vbfhx.exec:\vbfhx.exe29⤵
- Executes dropped EXE
PID:1872 -
\??\c:\frvhb.exec:\frvhb.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:592 -
\??\c:\xntbpl.exec:\xntbpl.exe31⤵
- Executes dropped EXE
PID:1308 -
\??\c:\ndtfpft.exec:\ndtfpft.exe32⤵
- Executes dropped EXE
PID:1692 -
\??\c:\bhdnb.exec:\bhdnb.exe33⤵
- Executes dropped EXE
PID:2260 -
\??\c:\bfnbprd.exec:\bfnbprd.exe34⤵
- Executes dropped EXE
PID:1664 -
\??\c:\hbhbhp.exec:\hbhbhp.exe35⤵
- Executes dropped EXE
PID:1888 -
\??\c:\vvbjtx.exec:\vvbjtx.exe36⤵
- Executes dropped EXE
PID:1540 -
\??\c:\pblfpn.exec:\pblfpn.exe37⤵
- Executes dropped EXE
PID:2556 -
\??\c:\lrfrnj.exec:\lrfrnj.exe38⤵
- Executes dropped EXE
PID:2492 -
\??\c:\phbrdff.exec:\phbrdff.exe39⤵
- Executes dropped EXE
PID:2352 -
\??\c:\fdjhr.exec:\fdjhr.exe40⤵
- Executes dropped EXE
PID:1612 -
\??\c:\fjhvf.exec:\fjhvf.exe41⤵
- Executes dropped EXE
PID:2820 -
\??\c:\pllhb.exec:\pllhb.exe42⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tdddh.exec:\tdddh.exe43⤵
- Executes dropped EXE
PID:2804 -
\??\c:\tvdhx.exec:\tvdhx.exe44⤵
- Executes dropped EXE
PID:1600 -
\??\c:\pvtvx.exec:\pvtvx.exe45⤵
- Executes dropped EXE
PID:3048 -
\??\c:\jhvxhxh.exec:\jhvxhxh.exe46⤵
- Executes dropped EXE
PID:2840 -
\??\c:\flrrf.exec:\flrrf.exe47⤵
- Executes dropped EXE
PID:2708 -
\??\c:\vllrnn.exec:\vllrnn.exe48⤵
- Executes dropped EXE
PID:2676 -
\??\c:\xfxbpr.exec:\xfxbpr.exe49⤵
- Executes dropped EXE
PID:2588 -
\??\c:\pxpvx.exec:\pxpvx.exe50⤵
- Executes dropped EXE
PID:944 -
\??\c:\tlfjrbd.exec:\tlfjrbd.exe51⤵
- Executes dropped EXE
PID:1120 -
\??\c:\jnjbb.exec:\jnjbb.exe52⤵
- Executes dropped EXE
PID:1548 -
\??\c:\rttxxh.exec:\rttxxh.exe53⤵
- Executes dropped EXE
PID:2908 -
\??\c:\ffjfn.exec:\ffjfn.exe54⤵
- Executes dropped EXE
PID:2620 -
\??\c:\tjltnxj.exec:\tjltnxj.exe55⤵
- Executes dropped EXE
PID:1936 -
\??\c:\plbpn.exec:\plbpn.exe56⤵
- Executes dropped EXE
PID:1560 -
\??\c:\fddnldr.exec:\fddnldr.exe57⤵
- Executes dropped EXE
PID:2736 -
\??\c:\fvjxn.exec:\fvjxn.exe58⤵
- Executes dropped EXE
PID:3008 -
\??\c:\vbrddx.exec:\vbrddx.exe59⤵
- Executes dropped EXE
PID:2972 -
\??\c:\jlrrhb.exec:\jlrrhb.exe60⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ftvtl.exec:\ftvtl.exe61⤵
- Executes dropped EXE
PID:2320 -
\??\c:\vhvdpff.exec:\vhvdpff.exe62⤵
- Executes dropped EXE
PID:2416 -
\??\c:\fhbbp.exec:\fhbbp.exe63⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jjdjt.exec:\jjdjt.exe64⤵
- Executes dropped EXE
PID:612 -
\??\c:\bhjtltj.exec:\bhjtltj.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:320 -
\??\c:\rddjvn.exec:\rddjvn.exe66⤵PID:1400
-
\??\c:\xbtpf.exec:\xbtpf.exe67⤵
- System Location Discovery: System Language Discovery
PID:2452 -
\??\c:\hdhph.exec:\hdhph.exe68⤵PID:2348
-
\??\c:\hfdvpt.exec:\hfdvpt.exe69⤵PID:2512
-
\??\c:\lndpr.exec:\lndpr.exe70⤵PID:2076
-
\??\c:\jdfjpnh.exec:\jdfjpnh.exe71⤵PID:1428
-
\??\c:\brfxl.exec:\brfxl.exe72⤵PID:1796
-
\??\c:\xjlth.exec:\xjlth.exe73⤵PID:700
-
\??\c:\lldpppv.exec:\lldpppv.exe74⤵PID:1724
-
\??\c:\dlfbjd.exec:\dlfbjd.exe75⤵PID:772
-
\??\c:\rtnhfnf.exec:\rtnhfnf.exe76⤵PID:1848
-
\??\c:\hnlfvr.exec:\hnlfvr.exe77⤵PID:2164
-
\??\c:\hhvrj.exec:\hhvrj.exe78⤵PID:2232
-
\??\c:\rrvxhf.exec:\rrvxhf.exe79⤵PID:904
-
\??\c:\tpdrl.exec:\tpdrl.exe80⤵
- System Location Discovery: System Language Discovery
PID:2092 -
\??\c:\dnptrb.exec:\dnptrb.exe81⤵PID:1308
-
\??\c:\thvpxhf.exec:\thvpxhf.exe82⤵
- System Location Discovery: System Language Discovery
PID:2308 -
\??\c:\nhfvfnt.exec:\nhfvfnt.exe83⤵PID:2004
-
\??\c:\npxvnrf.exec:\npxvnrf.exe84⤵PID:2528
-
\??\c:\hrhjr.exec:\hrhjr.exe85⤵PID:1908
-
\??\c:\phndx.exec:\phndx.exe86⤵PID:1568
-
\??\c:\dtffjt.exec:\dtffjt.exe87⤵PID:1988
-
\??\c:\rxdjpt.exec:\rxdjpt.exe88⤵PID:564
-
\??\c:\vbjbjd.exec:\vbjbjd.exe89⤵PID:1528
-
\??\c:\rfffvlr.exec:\rfffvlr.exe90⤵PID:2784
-
\??\c:\hrvhp.exec:\hrvhp.exe91⤵PID:2924
-
\??\c:\tlxhhr.exec:\tlxhhr.exe92⤵
- System Location Discovery: System Language Discovery
PID:2868 -
\??\c:\llvbtf.exec:\llvbtf.exe93⤵PID:2684
-
\??\c:\lfpvdf.exec:\lfpvdf.exe94⤵PID:2936
-
\??\c:\pvblx.exec:\pvblx.exe95⤵PID:2884
-
\??\c:\rpfbldd.exec:\rpfbldd.exe96⤵
- System Location Discovery: System Language Discovery
PID:1752 -
\??\c:\npffl.exec:\npffl.exe97⤵PID:2336
-
\??\c:\fvxphpf.exec:\fvxphpf.exe98⤵PID:2676
-
\??\c:\rjjrx.exec:\rjjrx.exe99⤵PID:2060
-
\??\c:\hnvlt.exec:\hnvlt.exe100⤵PID:2660
-
\??\c:\tlbrln.exec:\tlbrln.exe101⤵PID:2200
-
\??\c:\lrbbl.exec:\lrbbl.exe102⤵PID:3024
-
\??\c:\xvlvhx.exec:\xvlvhx.exe103⤵PID:2616
-
\??\c:\fnrbfvx.exec:\fnrbfvx.exe104⤵PID:2608
-
\??\c:\bpnxlhd.exec:\bpnxlhd.exe105⤵PID:2628
-
\??\c:\jhxlx.exec:\jhxlx.exe106⤵PID:1784
-
\??\c:\rxxjh.exec:\rxxjh.exe107⤵PID:2736
-
\??\c:\bbnjph.exec:\bbnjph.exe108⤵PID:3020
-
\??\c:\rbhbbd.exec:\rbhbbd.exe109⤵PID:2212
-
\??\c:\tbnrxtl.exec:\tbnrxtl.exe110⤵PID:2988
-
\??\c:\bltnhx.exec:\bltnhx.exe111⤵PID:1564
-
\??\c:\rxjxxv.exec:\rxjxxv.exe112⤵PID:1968
-
\??\c:\rjlfvpt.exec:\rjlfvpt.exe113⤵PID:780
-
\??\c:\rrvbf.exec:\rrvbf.exe114⤵PID:560
-
\??\c:\tdldt.exec:\tdldt.exe115⤵PID:2368
-
\??\c:\fntpfp.exec:\fntpfp.exe116⤵PID:2600
-
\??\c:\fbflxr.exec:\fbflxr.exe117⤵PID:2276
-
\??\c:\htvhv.exec:\htvhv.exe118⤵PID:1220
-
\??\c:\ltblv.exec:\ltblv.exe119⤵PID:2184
-
\??\c:\brjbrln.exec:\brjbrln.exe120⤵PID:980
-
\??\c:\vxdnrrx.exec:\vxdnrrx.exe121⤵PID:964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-