Analysis
-
max time kernel
155s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18-02-2025 07:40
Behavioral task
behavioral1
Sample
ed50f8332ec622363962ef35385f228c75eef11f8da485222a9f3cb0f1498a58.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ed50f8332ec622363962ef35385f228c75eef11f8da485222a9f3cb0f1498a58.exe
-
Size
334KB
-
MD5
859196f26a3f989742f0b6597c231aa7
-
SHA1
745c83505fb366f60dfa8ce8141bd6c7f40c2d9f
-
SHA256
ed50f8332ec622363962ef35385f228c75eef11f8da485222a9f3cb0f1498a58
-
SHA512
9154896ccc4c0115eef588dfbb947c0e23be3c75ecb48713263b835508448d2eba5f8c343c80964b4fae58e672f8067851bc8c0cc559b8973d78d1474491d87b
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbebg:R4wFHoSHYHUrAwfMp3CDbg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2620-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-33-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2880-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1460-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/692-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/692-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1988-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1892-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1492-459-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1908-448-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-299-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2072-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/272-239-0x00000000002D0000-0x00000000002F7000-memory.dmp family_blackmoon behavioral1/memory/992-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1164-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/776-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-180-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2636-170-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1128-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1460-113-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2652-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1824-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-574-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-640-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2940-703-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2940-726-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2468-813-0x0000000077580000-0x000000007769F000-memory.dmp family_blackmoon behavioral1/memory/1596-820-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-914-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1892-1054-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2328-1112-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3036-1139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3036-1146-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2944-1210-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2776-1241-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2468-7230-0x00000000776A0000-0x000000007779A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3044 prvnvjh.exe 2760 vxnrbxn.exe 2532 fbfvnb.exe 2880 nbthvph.exe 2824 tdnbv.exe 3052 vdfjff.exe 3008 tnhrjnb.exe 2896 xtjrd.exe 2676 vjvpr.exe 2752 bfdfvn.exe 2044 ttjvb.exe 2568 njldb.exe 1460 rtpjfbr.exe 692 dthjpjj.exe 1644 fdjnl.exe 1128 dfpbrvt.exe 2008 vbrxh.exe 1988 ftvlpbn.exe 2968 jbrjnnr.exe 2636 vbfnndp.exe 2248 rvptl.exe 1868 lrvlp.exe 2772 fvpjl.exe 776 ntnbxn.exe 1164 hpdnhn.exe 992 bftnt.exe 1412 jlprbvf.exe 1968 njrnvlf.exe 272 lpxhhhr.exe 2216 bpjdpfv.exe 2072 pbhxpvx.exe 1892 rrxlb.exe 572 bdfjd.exe 2244 rrpdfff.exe 896 lrnlx.exe 2492 lvlxj.exe 1592 hfpdl.exe 1600 xnnfb.exe 2584 tdlnh.exe 3044 xxdvvv.exe 2068 hpvlxf.exe 1692 jtvvxv.exe 2920 xhpbtrf.exe 2784 jvdll.exe 2824 xhhhv.exe 3036 rfxxdn.exe 1264 xdnfbt.exe 2844 ptjvdn.exe 2716 jfffrnb.exe 2732 jbjvr.exe 2316 lnhdtt.exe 2800 hjdpdh.exe 2736 tpfdr.exe 1664 frpdrb.exe 1032 nvfbl.exe 2332 jrltptf.exe 1496 jdntrtx.exe 2056 fnfbl.exe 1128 rpvvl.exe 2744 nbjlpdt.exe 1208 vvhph.exe 1988 tfdffhl.exe 3004 rxjnrlb.exe 2052 tbxlp.exe -
resource yara_rule behavioral1/memory/2620-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2620-3-0x0000000000230000-0x0000000000257000-memory.dmp upx behavioral1/files/0x000e000000012267-7.dat upx behavioral1/memory/3044-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016d3f-18.dat upx behavioral1/memory/3044-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d69-26.dat upx behavioral1/memory/2760-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016fc9-34.dat upx behavioral1/memory/2880-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016fe5-43.dat upx behavioral1/memory/2532-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000170f8-51.dat upx behavioral1/memory/2824-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3052-59-0x00000000003A0000-0x00000000003C7000-memory.dmp upx behavioral1/memory/3008-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001756e-58.dat upx behavioral1/files/0x00050000000195b3-68.dat upx behavioral1/memory/2896-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b5-75.dat upx behavioral1/memory/3008-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195b7-83.dat upx behavioral1/memory/2752-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195bb-92.dat upx behavioral1/files/0x00050000000195bd-99.dat upx behavioral1/files/0x00050000000195c1-106.dat upx behavioral1/memory/1460-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c3-117.dat upx behavioral1/memory/692-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/692-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c5-124.dat upx behavioral1/files/0x00050000000195c6-133.dat upx behavioral1/files/0x00050000000195c7-140.dat upx behavioral1/files/0x000500000001960c-148.dat upx behavioral1/memory/2008-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1988-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019643-155.dat upx behavioral1/files/0x000500000001975a-164.dat upx behavioral1/memory/2636-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019761-171.dat upx behavioral1/files/0x0005000000019820-190.dat upx behavioral1/files/0x000500000001998d-197.dat upx behavioral1/files/0x0005000000019bf5-204.dat upx behavioral1/files/0x0005000000019bf6-212.dat upx behavioral1/files/0x0005000000019bf9-221.dat upx behavioral1/files/0x0005000000019c3c-229.dat upx behavioral1/files/0x0005000000019d61-236.dat upx behavioral1/memory/2216-244-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d6d-251.dat upx behavioral1/memory/1968-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1892-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019e92-261.dat upx behavioral1/memory/2068-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2920-330-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1908-448-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2056-407-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1496-400-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2800-374-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-342-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2920-328-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2072-260-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d62-245.dat upx behavioral1/memory/992-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2772-216-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjlpnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhxhnxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhxht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfnxnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xphbjpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttjvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvxhnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthblrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdrbnrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvhph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnpvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvvdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnjbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjjvhfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vptjlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpvhtfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxjhfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrflhrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnhxpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxfbdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxnrbxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xntvdth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbjdjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfxprd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrddxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrnhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtfvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bppbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdlvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnpvjbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxptrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxjxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvhjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlfftt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndhntbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrrvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lftlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvbxvft.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2620 wrote to memory of 3044 2620 ed50f8332ec622363962ef35385f228c75eef11f8da485222a9f3cb0f1498a58.exe 31 PID 2620 wrote to memory of 3044 2620 ed50f8332ec622363962ef35385f228c75eef11f8da485222a9f3cb0f1498a58.exe 31 PID 2620 wrote to memory of 3044 2620 ed50f8332ec622363962ef35385f228c75eef11f8da485222a9f3cb0f1498a58.exe 31 PID 2620 wrote to memory of 3044 2620 ed50f8332ec622363962ef35385f228c75eef11f8da485222a9f3cb0f1498a58.exe 31 PID 3044 wrote to memory of 2760 3044 prvnvjh.exe 32 PID 3044 wrote to memory of 2760 3044 prvnvjh.exe 32 PID 3044 wrote to memory of 2760 3044 prvnvjh.exe 32 PID 3044 wrote to memory of 2760 3044 prvnvjh.exe 32 PID 2760 wrote to memory of 2532 2760 vxnrbxn.exe 33 PID 2760 wrote to memory of 2532 2760 vxnrbxn.exe 33 PID 2760 wrote to memory of 2532 2760 vxnrbxn.exe 33 PID 2760 wrote to memory of 2532 2760 vxnrbxn.exe 33 PID 2532 wrote to memory of 2880 2532 fbfvnb.exe 34 PID 2532 wrote to memory of 2880 2532 fbfvnb.exe 34 PID 2532 wrote to memory of 2880 2532 fbfvnb.exe 34 PID 2532 wrote to memory of 2880 2532 fbfvnb.exe 34 PID 2880 wrote to memory of 2824 2880 nbthvph.exe 75 PID 2880 wrote to memory of 2824 2880 nbthvph.exe 75 PID 2880 wrote to memory of 2824 2880 nbthvph.exe 75 PID 2880 wrote to memory of 2824 2880 nbthvph.exe 75 PID 2824 wrote to memory of 3052 2824 tdnbv.exe 36 PID 2824 wrote to memory of 3052 2824 tdnbv.exe 36 PID 2824 wrote to memory of 3052 2824 tdnbv.exe 36 PID 2824 wrote to memory of 3052 2824 tdnbv.exe 36 PID 3052 wrote to memory of 3008 3052 vdfjff.exe 37 PID 3052 wrote to memory of 3008 3052 vdfjff.exe 37 PID 3052 wrote to memory of 3008 3052 vdfjff.exe 37 PID 3052 wrote to memory of 3008 3052 vdfjff.exe 37 PID 3008 wrote to memory of 2896 3008 tnhrjnb.exe 38 PID 3008 wrote to memory of 2896 3008 tnhrjnb.exe 38 PID 3008 wrote to memory of 2896 3008 tnhrjnb.exe 38 PID 3008 wrote to memory of 2896 3008 tnhrjnb.exe 38 PID 2896 wrote to memory of 2676 2896 xtjrd.exe 39 PID 2896 wrote to memory of 2676 2896 xtjrd.exe 39 PID 2896 wrote to memory of 2676 2896 xtjrd.exe 39 PID 2896 wrote to memory of 2676 2896 xtjrd.exe 39 PID 2676 wrote to memory of 2752 2676 vjvpr.exe 40 PID 2676 wrote to memory of 2752 2676 vjvpr.exe 40 PID 2676 wrote to memory of 2752 2676 vjvpr.exe 40 PID 2676 wrote to memory of 2752 2676 vjvpr.exe 40 PID 2752 wrote to memory of 2044 2752 bfdfvn.exe 41 PID 2752 wrote to memory of 2044 2752 bfdfvn.exe 41 PID 2752 wrote to memory of 2044 2752 bfdfvn.exe 41 PID 2752 wrote to memory of 2044 2752 bfdfvn.exe 41 PID 2044 wrote to memory of 2568 2044 ttjvb.exe 42 PID 2044 wrote to memory of 2568 2044 ttjvb.exe 42 PID 2044 wrote to memory of 2568 2044 ttjvb.exe 42 PID 2044 wrote to memory of 2568 2044 ttjvb.exe 42 PID 2568 wrote to memory of 1460 2568 njldb.exe 43 PID 2568 wrote to memory of 1460 2568 njldb.exe 43 PID 2568 wrote to memory of 1460 2568 njldb.exe 43 PID 2568 wrote to memory of 1460 2568 njldb.exe 43 PID 1460 wrote to memory of 692 1460 rtpjfbr.exe 44 PID 1460 wrote to memory of 692 1460 rtpjfbr.exe 44 PID 1460 wrote to memory of 692 1460 rtpjfbr.exe 44 PID 1460 wrote to memory of 692 1460 rtpjfbr.exe 44 PID 692 wrote to memory of 1644 692 dthjpjj.exe 45 PID 692 wrote to memory of 1644 692 dthjpjj.exe 45 PID 692 wrote to memory of 1644 692 dthjpjj.exe 45 PID 692 wrote to memory of 1644 692 dthjpjj.exe 45 PID 1644 wrote to memory of 1128 1644 fdjnl.exe 89 PID 1644 wrote to memory of 1128 1644 fdjnl.exe 89 PID 1644 wrote to memory of 1128 1644 fdjnl.exe 89 PID 1644 wrote to memory of 1128 1644 fdjnl.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed50f8332ec622363962ef35385f228c75eef11f8da485222a9f3cb0f1498a58.exe"C:\Users\Admin\AppData\Local\Temp\ed50f8332ec622363962ef35385f228c75eef11f8da485222a9f3cb0f1498a58.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\prvnvjh.exec:\prvnvjh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\vxnrbxn.exec:\vxnrbxn.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\fbfvnb.exec:\fbfvnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\nbthvph.exec:\nbthvph.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\tdnbv.exec:\tdnbv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\vdfjff.exec:\vdfjff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\tnhrjnb.exec:\tnhrjnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\xtjrd.exec:\xtjrd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\vjvpr.exec:\vjvpr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\bfdfvn.exec:\bfdfvn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\ttjvb.exec:\ttjvb.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\njldb.exec:\njldb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\rtpjfbr.exec:\rtpjfbr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\dthjpjj.exec:\dthjpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\fdjnl.exec:\fdjnl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\dfpbrvt.exec:\dfpbrvt.exe17⤵
- Executes dropped EXE
PID:1128 -
\??\c:\vbrxh.exec:\vbrxh.exe18⤵
- Executes dropped EXE
PID:2008 -
\??\c:\ftvlpbn.exec:\ftvlpbn.exe19⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jbrjnnr.exec:\jbrjnnr.exe20⤵
- Executes dropped EXE
PID:2968 -
\??\c:\vbfnndp.exec:\vbfnndp.exe21⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rvptl.exec:\rvptl.exe22⤵
- Executes dropped EXE
PID:2248 -
\??\c:\lrvlp.exec:\lrvlp.exe23⤵
- Executes dropped EXE
PID:1868 -
\??\c:\fvpjl.exec:\fvpjl.exe24⤵
- Executes dropped EXE
PID:2772 -
\??\c:\ntnbxn.exec:\ntnbxn.exe25⤵
- Executes dropped EXE
PID:776 -
\??\c:\hpdnhn.exec:\hpdnhn.exe26⤵
- Executes dropped EXE
PID:1164 -
\??\c:\bftnt.exec:\bftnt.exe27⤵
- Executes dropped EXE
PID:992 -
\??\c:\jlprbvf.exec:\jlprbvf.exe28⤵
- Executes dropped EXE
PID:1412 -
\??\c:\njrnvlf.exec:\njrnvlf.exe29⤵
- Executes dropped EXE
PID:1968 -
\??\c:\lpxhhhr.exec:\lpxhhhr.exe30⤵
- Executes dropped EXE
PID:272 -
\??\c:\bpjdpfv.exec:\bpjdpfv.exe31⤵
- Executes dropped EXE
PID:2216 -
\??\c:\pbhxpvx.exec:\pbhxpvx.exe32⤵
- Executes dropped EXE
PID:2072 -
\??\c:\rrxlb.exec:\rrxlb.exe33⤵
- Executes dropped EXE
PID:1892 -
\??\c:\bdfjd.exec:\bdfjd.exe34⤵
- Executes dropped EXE
PID:572 -
\??\c:\rrpdfff.exec:\rrpdfff.exe35⤵
- Executes dropped EXE
PID:2244 -
\??\c:\lrnlx.exec:\lrnlx.exe36⤵
- Executes dropped EXE
PID:896 -
\??\c:\lvlxj.exec:\lvlxj.exe37⤵
- Executes dropped EXE
PID:2492 -
\??\c:\hfpdl.exec:\hfpdl.exe38⤵
- Executes dropped EXE
PID:1592 -
\??\c:\xnnfb.exec:\xnnfb.exe39⤵
- Executes dropped EXE
PID:1600 -
\??\c:\tdlnh.exec:\tdlnh.exe40⤵
- Executes dropped EXE
PID:2584 -
\??\c:\xxdvvv.exec:\xxdvvv.exe41⤵
- Executes dropped EXE
PID:3044 -
\??\c:\hpvlxf.exec:\hpvlxf.exe42⤵
- Executes dropped EXE
PID:2068 -
\??\c:\jtvvxv.exec:\jtvvxv.exe43⤵
- Executes dropped EXE
PID:1692 -
\??\c:\xhpbtrf.exec:\xhpbtrf.exe44⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jvdll.exec:\jvdll.exe45⤵
- Executes dropped EXE
PID:2784 -
\??\c:\xhhhv.exec:\xhhhv.exe46⤵
- Executes dropped EXE
PID:2824 -
\??\c:\rfxxdn.exec:\rfxxdn.exe47⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xdnfbt.exec:\xdnfbt.exe48⤵
- Executes dropped EXE
PID:1264 -
\??\c:\ptjvdn.exec:\ptjvdn.exe49⤵
- Executes dropped EXE
PID:2844 -
\??\c:\jfffrnb.exec:\jfffrnb.exe50⤵
- Executes dropped EXE
PID:2716 -
\??\c:\jbjvr.exec:\jbjvr.exe51⤵
- Executes dropped EXE
PID:2732 -
\??\c:\lnhdtt.exec:\lnhdtt.exe52⤵
- Executes dropped EXE
PID:2316 -
\??\c:\hjdpdh.exec:\hjdpdh.exe53⤵
- Executes dropped EXE
PID:2800 -
\??\c:\tpfdr.exec:\tpfdr.exe54⤵
- Executes dropped EXE
PID:2736 -
\??\c:\frpdrb.exec:\frpdrb.exe55⤵
- Executes dropped EXE
PID:1664 -
\??\c:\nvfbl.exec:\nvfbl.exe56⤵
- Executes dropped EXE
PID:1032 -
\??\c:\jrltptf.exec:\jrltptf.exe57⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jdntrtx.exec:\jdntrtx.exe58⤵
- Executes dropped EXE
PID:1496 -
\??\c:\fnfbl.exec:\fnfbl.exe59⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rpvvl.exec:\rpvvl.exe60⤵
- Executes dropped EXE
PID:1128 -
\??\c:\nbjlpdt.exec:\nbjlpdt.exe61⤵
- Executes dropped EXE
PID:2744 -
\??\c:\vvhph.exec:\vvhph.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1208 -
\??\c:\tfdffhl.exec:\tfdffhl.exe63⤵
- Executes dropped EXE
PID:1988 -
\??\c:\rxjnrlb.exec:\rxjnrlb.exe64⤵
- Executes dropped EXE
PID:3004 -
\??\c:\tbxlp.exec:\tbxlp.exe65⤵
- Executes dropped EXE
PID:2052 -
\??\c:\rxfbh.exec:\rxfbh.exe66⤵PID:1908
-
\??\c:\dnhjnf.exec:\dnhjnf.exe67⤵PID:112
-
\??\c:\bffjrrb.exec:\bffjrrb.exe68⤵PID:1492
-
\??\c:\tbbvddt.exec:\tbbvddt.exe69⤵PID:2588
-
\??\c:\lrpbp.exec:\lrpbp.exe70⤵PID:2984
-
\??\c:\xbftbth.exec:\xbftbth.exe71⤵PID:1652
-
\??\c:\npdhp.exec:\npdhp.exe72⤵PID:1324
-
\??\c:\lxbbnv.exec:\lxbbnv.exe73⤵PID:2652
-
\??\c:\vrjdf.exec:\vrjdf.exe74⤵PID:1736
-
\??\c:\dxprfv.exec:\dxprfv.exe75⤵PID:1516
-
\??\c:\vnvfj.exec:\vnvfj.exe76⤵PID:432
-
\??\c:\ptbnf.exec:\ptbnf.exe77⤵PID:272
-
\??\c:\jbbbpr.exec:\jbbbpr.exe78⤵PID:2272
-
\??\c:\dxrdprb.exec:\dxrdprb.exe79⤵PID:1824
-
\??\c:\rdflxf.exec:\rdflxf.exe80⤵PID:1768
-
\??\c:\xbvvh.exec:\xbvvh.exe81⤵PID:820
-
\??\c:\dtnxfd.exec:\dtnxfd.exe82⤵PID:1912
-
\??\c:\dhhdbth.exec:\dhhdbth.exe83⤵PID:2524
-
\??\c:\lpbrhxf.exec:\lpbrhxf.exe84⤵PID:2432
-
\??\c:\pfnbrj.exec:\pfnbrj.exe85⤵PID:1724
-
\??\c:\ffffxh.exec:\ffffxh.exe86⤵PID:1760
-
\??\c:\rjbrhp.exec:\rjbrhp.exe87⤵PID:2304
-
\??\c:\txbrn.exec:\txbrn.exe88⤵PID:2620
-
\??\c:\pbxjhxl.exec:\pbxjhxl.exe89⤵PID:2632
-
\??\c:\jlbfbr.exec:\jlbfbr.exe90⤵PID:2108
-
\??\c:\fvfjbjl.exec:\fvfjbjl.exe91⤵PID:2360
-
\??\c:\fhxht.exec:\fhxht.exe92⤵
- System Location Discovery: System Language Discovery
PID:2808 -
\??\c:\tnrhj.exec:\tnrhj.exe93⤵PID:2540
-
\??\c:\fhtjhtj.exec:\fhtjhtj.exe94⤵PID:2812
-
\??\c:\rtrdvp.exec:\rtrdvp.exe95⤵PID:3068
-
\??\c:\jfbrnx.exec:\jfbrnx.exe96⤵PID:2876
-
\??\c:\phxxhnt.exec:\phxxhnt.exe97⤵PID:2704
-
\??\c:\fhpbr.exec:\fhpbr.exe98⤵PID:2848
-
\??\c:\xjfph.exec:\xjfph.exe99⤵PID:1264
-
\??\c:\tvhdb.exec:\tvhdb.exe100⤵PID:2700
-
\??\c:\tdlhttj.exec:\tdlhttj.exe101⤵PID:1532
-
\??\c:\fppvx.exec:\fppvx.exe102⤵PID:2120
-
\??\c:\rbldhj.exec:\rbldhj.exe103⤵PID:2116
-
\??\c:\bbxxn.exec:\bbxxn.exe104⤵PID:2044
-
\??\c:\pnprdv.exec:\pnprdv.exe105⤵PID:2936
-
\??\c:\xdjrj.exec:\xdjrj.exe106⤵PID:1964
-
\??\c:\fvlhp.exec:\fvlhp.exe107⤵PID:2656
-
\??\c:\nbddjn.exec:\nbddjn.exe108⤵PID:1956
-
\??\c:\nvtthx.exec:\nvtthx.exe109⤵PID:1180
-
\??\c:\nlbbbnj.exec:\nlbbbnj.exe110⤵PID:2032
-
\??\c:\hnxtr.exec:\hnxtr.exe111⤵PID:2340
-
\??\c:\hvdnv.exec:\hvdnv.exe112⤵PID:2780
-
\??\c:\nddtxh.exec:\nddtxh.exe113⤵PID:2960
-
\??\c:\fpnbn.exec:\fpnbn.exe114⤵PID:1772
-
\??\c:\tnnfr.exec:\tnnfr.exe115⤵PID:2940
-
\??\c:\brnrxrd.exec:\brnrxrd.exe116⤵PID:2636
-
\??\c:\rbrbb.exec:\rbrbb.exe117⤵PID:836
-
\??\c:\npdpbd.exec:\npdpbd.exe118⤵PID:880
-
\??\c:\rhxjhv.exec:\rhxjhv.exe119⤵PID:2440
-
\??\c:\bflvl.exec:\bflvl.exe120⤵PID:2124
-
\??\c:\nfxlx.exec:\nfxlx.exe121⤵PID:1980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-