Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28/03/2025, 19:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
483f039b0f92eb151472b1176352cf11aec7467014e4336451153ea8424890bc.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
483f039b0f92eb151472b1176352cf11aec7467014e4336451153ea8424890bc.exe
-
Size
459KB
-
MD5
d64b05071ab0080438a78c78456565fd
-
SHA1
c017f81d2cb3e9ecb2db8faece9a1fcd7bd7cc9e
-
SHA256
483f039b0f92eb151472b1176352cf11aec7467014e4336451153ea8424890bc
-
SHA512
6191500fe8f025850fa0bddd969e29b04c6aee3ef9431dafb71abd32c8ad6a7537c1dbd28445397142c2e8633312a986214b674fb1b78132b9260da19a715cdb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeG:q7Tc2NYHUrAwfMp3CDG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/1736-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-43-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/3060-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-231-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/960-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-250-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2204-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-349-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2304-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-454-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1400-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-502-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1876-530-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2248-692-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2740-713-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-745-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/612-811-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2368 frnrp.exe 2184 xxhpt.exe 584 dplbpj.exe 2168 xndrh.exe 3060 jrrvpvh.exe 3040 jlfxxpv.exe 2512 bfbhb.exe 2928 nnfjtlt.exe 2484 lrvjrjb.exe 1316 pvbfrvj.exe 1192 xrxll.exe 1516 jrpnvjv.exe 2136 hvhbxht.exe 1952 njxdjf.exe 1108 rrjvjf.exe 2356 jvjdj.exe 1028 trvfb.exe 1304 bjttvp.exe 556 vhjln.exe 2124 pndtxf.exe 2436 jthxrn.exe 624 jfvpl.exe 2672 ppvnff.exe 768 tpnpd.exe 960 txrlhp.exe 1564 pdrlhd.exe 2204 ljtdrnd.exe 1204 trnrrv.exe 2388 nttvbhf.exe 2760 dfpvjdl.exe 1524 pvfrnbx.exe 892 dtjfjbb.exe 2044 vrfnpf.exe 1624 jpjxjlb.exe 2368 jfvvdr.exe 3000 lvpptp.exe 2024 hthtrrr.exe 2912 lpvjbv.exe 3052 vprbxbn.exe 2304 djjnxl.exe 2924 lvblvph.exe 2896 rjppv.exe 2804 hnldb.exe 2524 tbhftnt.exe 2928 vjljxx.exe 2484 dxvhnn.exe 944 xjxtlf.exe 1248 bvtrl.exe 2996 nrtffrj.exe 1516 pjdfxt.exe 2860 jdjdttp.exe 1836 frxjrrd.exe 1324 fvvbr.exe 3036 xfvhpbj.exe 1632 rbhxr.exe 1400 fhfjfp.exe 1016 fvffh.exe 2504 lvlxv.exe 1424 bjdffj.exe 2656 ftfvrpl.exe 2472 xdhjtf.exe 2280 htblt.exe 1876 dbdxflt.exe 756 vttrj.exe -
resource yara_rule behavioral1/memory/1736-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-454-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/1400-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-772-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-786-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-811-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjhvlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhrhfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbdhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frnrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdlrhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrpfrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thfthfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blpnnrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jljbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pprrvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffvtxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbjtlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlvph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxpth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxdjfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhxjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvjnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjhnjpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvftnrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxvtbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrfnpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pplhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rprhfnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbpnvld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjrbxpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdrnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvtdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjnnjxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnhrvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfhnnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnpjbrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbbhjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnnxvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbdxflt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrjbbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2368 1736 483f039b0f92eb151472b1176352cf11aec7467014e4336451153ea8424890bc.exe 30 PID 1736 wrote to memory of 2368 1736 483f039b0f92eb151472b1176352cf11aec7467014e4336451153ea8424890bc.exe 30 PID 1736 wrote to memory of 2368 1736 483f039b0f92eb151472b1176352cf11aec7467014e4336451153ea8424890bc.exe 30 PID 1736 wrote to memory of 2368 1736 483f039b0f92eb151472b1176352cf11aec7467014e4336451153ea8424890bc.exe 30 PID 2368 wrote to memory of 2184 2368 frnrp.exe 31 PID 2368 wrote to memory of 2184 2368 frnrp.exe 31 PID 2368 wrote to memory of 2184 2368 frnrp.exe 31 PID 2368 wrote to memory of 2184 2368 frnrp.exe 31 PID 2184 wrote to memory of 584 2184 xxhpt.exe 32 PID 2184 wrote to memory of 584 2184 xxhpt.exe 32 PID 2184 wrote to memory of 584 2184 xxhpt.exe 32 PID 2184 wrote to memory of 584 2184 xxhpt.exe 32 PID 584 wrote to memory of 2168 584 dplbpj.exe 33 PID 584 wrote to memory of 2168 584 dplbpj.exe 33 PID 584 wrote to memory of 2168 584 dplbpj.exe 33 PID 584 wrote to memory of 2168 584 dplbpj.exe 33 PID 2168 wrote to memory of 3060 2168 xndrh.exe 34 PID 2168 wrote to memory of 3060 2168 xndrh.exe 34 PID 2168 wrote to memory of 3060 2168 xndrh.exe 34 PID 2168 wrote to memory of 3060 2168 xndrh.exe 34 PID 3060 wrote to memory of 3040 3060 jrrvpvh.exe 35 PID 3060 wrote to memory of 3040 3060 jrrvpvh.exe 35 PID 3060 wrote to memory of 3040 3060 jrrvpvh.exe 35 PID 3060 wrote to memory of 3040 3060 jrrvpvh.exe 35 PID 3040 wrote to memory of 2512 3040 jlfxxpv.exe 36 PID 3040 wrote to memory of 2512 3040 jlfxxpv.exe 36 PID 3040 wrote to memory of 2512 3040 jlfxxpv.exe 36 PID 3040 wrote to memory of 2512 3040 jlfxxpv.exe 36 PID 2512 wrote to memory of 2928 2512 bfbhb.exe 37 PID 2512 wrote to memory of 2928 2512 bfbhb.exe 37 PID 2512 wrote to memory of 2928 2512 bfbhb.exe 37 PID 2512 wrote to memory of 2928 2512 bfbhb.exe 37 PID 2928 wrote to memory of 2484 2928 nnfjtlt.exe 38 PID 2928 wrote to memory of 2484 2928 nnfjtlt.exe 38 PID 2928 wrote to memory of 2484 2928 nnfjtlt.exe 38 PID 2928 wrote to memory of 2484 2928 nnfjtlt.exe 38 PID 2484 wrote to memory of 1316 2484 lrvjrjb.exe 39 PID 2484 wrote to memory of 1316 2484 lrvjrjb.exe 39 PID 2484 wrote to memory of 1316 2484 lrvjrjb.exe 39 PID 2484 wrote to memory of 1316 2484 lrvjrjb.exe 39 PID 1316 wrote to memory of 1192 1316 pvbfrvj.exe 40 PID 1316 wrote to memory of 1192 1316 pvbfrvj.exe 40 PID 1316 wrote to memory of 1192 1316 pvbfrvj.exe 40 PID 1316 wrote to memory of 1192 1316 pvbfrvj.exe 40 PID 1192 wrote to memory of 1516 1192 xrxll.exe 41 PID 1192 wrote to memory of 1516 1192 xrxll.exe 41 PID 1192 wrote to memory of 1516 1192 xrxll.exe 41 PID 1192 wrote to memory of 1516 1192 xrxll.exe 41 PID 1516 wrote to memory of 2136 1516 jrpnvjv.exe 42 PID 1516 wrote to memory of 2136 1516 jrpnvjv.exe 42 PID 1516 wrote to memory of 2136 1516 jrpnvjv.exe 42 PID 1516 wrote to memory of 2136 1516 jrpnvjv.exe 42 PID 2136 wrote to memory of 1952 2136 hvhbxht.exe 43 PID 2136 wrote to memory of 1952 2136 hvhbxht.exe 43 PID 2136 wrote to memory of 1952 2136 hvhbxht.exe 43 PID 2136 wrote to memory of 1952 2136 hvhbxht.exe 43 PID 1952 wrote to memory of 1108 1952 njxdjf.exe 44 PID 1952 wrote to memory of 1108 1952 njxdjf.exe 44 PID 1952 wrote to memory of 1108 1952 njxdjf.exe 44 PID 1952 wrote to memory of 1108 1952 njxdjf.exe 44 PID 1108 wrote to memory of 2356 1108 rrjvjf.exe 45 PID 1108 wrote to memory of 2356 1108 rrjvjf.exe 45 PID 1108 wrote to memory of 2356 1108 rrjvjf.exe 45 PID 1108 wrote to memory of 2356 1108 rrjvjf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\483f039b0f92eb151472b1176352cf11aec7467014e4336451153ea8424890bc.exe"C:\Users\Admin\AppData\Local\Temp\483f039b0f92eb151472b1176352cf11aec7467014e4336451153ea8424890bc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\frnrp.exec:\frnrp.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\xxhpt.exec:\xxhpt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\dplbpj.exec:\dplbpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:584 -
\??\c:\xndrh.exec:\xndrh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\jrrvpvh.exec:\jrrvpvh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\jlfxxpv.exec:\jlfxxpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\bfbhb.exec:\bfbhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\nnfjtlt.exec:\nnfjtlt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\lrvjrjb.exec:\lrvjrjb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\pvbfrvj.exec:\pvbfrvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\xrxll.exec:\xrxll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\jrpnvjv.exec:\jrpnvjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\hvhbxht.exec:\hvhbxht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\njxdjf.exec:\njxdjf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\rrjvjf.exec:\rrjvjf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\jvjdj.exec:\jvjdj.exe17⤵
- Executes dropped EXE
PID:2356 -
\??\c:\trvfb.exec:\trvfb.exe18⤵
- Executes dropped EXE
PID:1028 -
\??\c:\bjttvp.exec:\bjttvp.exe19⤵
- Executes dropped EXE
PID:1304 -
\??\c:\vhjln.exec:\vhjln.exe20⤵
- Executes dropped EXE
PID:556 -
\??\c:\pndtxf.exec:\pndtxf.exe21⤵
- Executes dropped EXE
PID:2124 -
\??\c:\jthxrn.exec:\jthxrn.exe22⤵
- Executes dropped EXE
PID:2436 -
\??\c:\jfvpl.exec:\jfvpl.exe23⤵
- Executes dropped EXE
PID:624 -
\??\c:\ppvnff.exec:\ppvnff.exe24⤵
- Executes dropped EXE
PID:2672 -
\??\c:\tpnpd.exec:\tpnpd.exe25⤵
- Executes dropped EXE
PID:768 -
\??\c:\txrlhp.exec:\txrlhp.exe26⤵
- Executes dropped EXE
PID:960 -
\??\c:\pdrlhd.exec:\pdrlhd.exe27⤵
- Executes dropped EXE
PID:1564 -
\??\c:\ljtdrnd.exec:\ljtdrnd.exe28⤵
- Executes dropped EXE
PID:2204 -
\??\c:\trnrrv.exec:\trnrrv.exe29⤵
- Executes dropped EXE
PID:1204 -
\??\c:\nttvbhf.exec:\nttvbhf.exe30⤵
- Executes dropped EXE
PID:2388 -
\??\c:\dfpvjdl.exec:\dfpvjdl.exe31⤵
- Executes dropped EXE
PID:2760 -
\??\c:\pvfrnbx.exec:\pvfrnbx.exe32⤵
- Executes dropped EXE
PID:1524 -
\??\c:\dtjfjbb.exec:\dtjfjbb.exe33⤵
- Executes dropped EXE
PID:892 -
\??\c:\vrfnpf.exec:\vrfnpf.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2044 -
\??\c:\jpjxjlb.exec:\jpjxjlb.exe35⤵
- Executes dropped EXE
PID:1624 -
\??\c:\jfvvdr.exec:\jfvvdr.exe36⤵
- Executes dropped EXE
PID:2368 -
\??\c:\lvpptp.exec:\lvpptp.exe37⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hthtrrr.exec:\hthtrrr.exe38⤵
- Executes dropped EXE
PID:2024 -
\??\c:\lpvjbv.exec:\lpvjbv.exe39⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vprbxbn.exec:\vprbxbn.exe40⤵
- Executes dropped EXE
PID:3052 -
\??\c:\djjnxl.exec:\djjnxl.exe41⤵
- Executes dropped EXE
PID:2304 -
\??\c:\lvblvph.exec:\lvblvph.exe42⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rjppv.exec:\rjppv.exe43⤵
- Executes dropped EXE
PID:2896 -
\??\c:\hnldb.exec:\hnldb.exe44⤵
- Executes dropped EXE
PID:2804 -
\??\c:\tbhftnt.exec:\tbhftnt.exe45⤵
- Executes dropped EXE
PID:2524 -
\??\c:\vjljxx.exec:\vjljxx.exe46⤵
- Executes dropped EXE
PID:2928 -
\??\c:\dxvhnn.exec:\dxvhnn.exe47⤵
- Executes dropped EXE
PID:2484 -
\??\c:\xjxtlf.exec:\xjxtlf.exe48⤵
- Executes dropped EXE
PID:944 -
\??\c:\bvtrl.exec:\bvtrl.exe49⤵
- Executes dropped EXE
PID:1248 -
\??\c:\nrtffrj.exec:\nrtffrj.exe50⤵
- Executes dropped EXE
PID:2996 -
\??\c:\pjdfxt.exec:\pjdfxt.exe51⤵
- Executes dropped EXE
PID:1516 -
\??\c:\jdjdttp.exec:\jdjdttp.exe52⤵
- Executes dropped EXE
PID:2860 -
\??\c:\frxjrrd.exec:\frxjrrd.exe53⤵
- Executes dropped EXE
PID:1836 -
\??\c:\fvvbr.exec:\fvvbr.exe54⤵
- Executes dropped EXE
PID:1324 -
\??\c:\xfvhpbj.exec:\xfvhpbj.exe55⤵
- Executes dropped EXE
PID:3036 -
\??\c:\rbhxr.exec:\rbhxr.exe56⤵
- Executes dropped EXE
PID:1632 -
\??\c:\fhfjfp.exec:\fhfjfp.exe57⤵
- Executes dropped EXE
PID:1400 -
\??\c:\fvffh.exec:\fvffh.exe58⤵
- Executes dropped EXE
PID:1016 -
\??\c:\lvlxv.exec:\lvlxv.exe59⤵
- Executes dropped EXE
PID:2504 -
\??\c:\bjdffj.exec:\bjdffj.exe60⤵
- Executes dropped EXE
PID:1424 -
\??\c:\ftfvrpl.exec:\ftfvrpl.exe61⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xdhjtf.exec:\xdhjtf.exe62⤵
- Executes dropped EXE
PID:2472 -
\??\c:\htblt.exec:\htblt.exe63⤵
- Executes dropped EXE
PID:2280 -
\??\c:\dbdxflt.exec:\dbdxflt.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1876 -
\??\c:\vttrj.exec:\vttrj.exe65⤵
- Executes dropped EXE
PID:756 -
\??\c:\fjpnfpp.exec:\fjpnfpp.exe66⤵PID:1420
-
\??\c:\fbtpt.exec:\fbtpt.exe67⤵PID:1600
-
\??\c:\tjhvlt.exec:\tjhvlt.exe68⤵
- System Location Discovery: System Language Discovery
PID:2552 -
\??\c:\txbbtt.exec:\txbbtt.exe69⤵PID:1712
-
\??\c:\xnvxxx.exec:\xnvxxx.exe70⤵PID:1064
-
\??\c:\nbrxr.exec:\nbrxr.exe71⤵PID:1656
-
\??\c:\jdvlflj.exec:\jdvlflj.exe72⤵PID:2056
-
\??\c:\ttbxn.exec:\ttbxn.exe73⤵PID:276
-
\??\c:\vnhrvh.exec:\vnhrvh.exe74⤵
- System Location Discovery: System Language Discovery
PID:2632 -
\??\c:\pndrrph.exec:\pndrrph.exe75⤵PID:2608
-
\??\c:\vjrnft.exec:\vjrnft.exe76⤵PID:1256
-
\??\c:\vlxnf.exec:\vlxnf.exe77⤵PID:1736
-
\??\c:\btdjpr.exec:\btdjpr.exe78⤵PID:1704
-
\??\c:\ddxdhr.exec:\ddxdhr.exe79⤵PID:1984
-
\??\c:\ftdrf.exec:\ftdrf.exe80⤵PID:2128
-
\??\c:\nfrxlx.exec:\nfrxlx.exe81⤵PID:2040
-
\??\c:\dljldjf.exec:\dljldjf.exe82⤵PID:3068
-
\??\c:\xfnpb.exec:\xfnpb.exe83⤵PID:2168
-
\??\c:\jfltht.exec:\jfltht.exe84⤵PID:3032
-
\??\c:\rvthxh.exec:\rvthxh.exe85⤵PID:1628
-
\??\c:\ptfdbrr.exec:\ptfdbrr.exe86⤵PID:2852
-
\??\c:\bbfjfr.exec:\bbfjfr.exe87⤵PID:2944
-
\??\c:\rjfdbvf.exec:\rjfdbvf.exe88⤵PID:2248
-
\??\c:\dvjxbvn.exec:\dvjxbvn.exe89⤵PID:2548
-
\??\c:\lhvdjp.exec:\lhvdjp.exe90⤵PID:940
-
\??\c:\rrrbrnx.exec:\rrrbrnx.exe91⤵PID:2332
-
\??\c:\rvlpvn.exec:\rvlpvn.exe92⤵PID:1444
-
\??\c:\drflt.exec:\drflt.exe93⤵PID:3056
-
\??\c:\ddpxvv.exec:\ddpxvv.exe94⤵PID:2740
-
\??\c:\xdfrfvr.exec:\xdfrfvr.exe95⤵PID:1660
-
\??\c:\dhtjdb.exec:\dhtjdb.exe96⤵PID:1352
-
\??\c:\rtvpt.exec:\rtvpt.exe97⤵PID:2032
-
\??\c:\nldtbjh.exec:\nldtbjh.exe98⤵PID:580
-
\??\c:\ptrnf.exec:\ptrnf.exe99⤵PID:1348
-
\??\c:\vdrnbt.exec:\vdrnbt.exe100⤵
- System Location Discovery: System Language Discovery
PID:2196 -
\??\c:\dpxnx.exec:\dpxnx.exe101⤵PID:2508
-
\??\c:\xprjt.exec:\xprjt.exe102⤵PID:520
-
\??\c:\rhfnvt.exec:\rhfnvt.exe103⤵PID:556
-
\??\c:\jrbnj.exec:\jrbnj.exe104⤵PID:2124
-
\??\c:\rdjvbtp.exec:\rdjvbtp.exe105⤵PID:2228
-
\??\c:\prtllj.exec:\prtllj.exe106⤵PID:912
-
\??\c:\hbfvpt.exec:\hbfvpt.exe107⤵PID:1164
-
\??\c:\phdjx.exec:\phdjx.exe108⤵PID:2000
-
\??\c:\fxltlt.exec:\fxltlt.exe109⤵PID:612
-
\??\c:\frtfjpj.exec:\frtfjpj.exe110⤵PID:1540
-
\??\c:\pprrvh.exec:\pprrvh.exe111⤵
- System Location Discovery: System Language Discovery
PID:2568 -
\??\c:\xjtlb.exec:\xjtlb.exe112⤵PID:1308
-
\??\c:\rrhbrdd.exec:\rrhbrdd.exe113⤵PID:1232
-
\??\c:\lxvjf.exec:\lxvjf.exe114⤵PID:576
-
\??\c:\nhpdh.exec:\nhpdh.exe115⤵PID:1656
-
\??\c:\nvtdj.exec:\nvtdj.exe116⤵
- System Location Discovery: System Language Discovery
PID:1728 -
\??\c:\nbxfld.exec:\nbxfld.exe117⤵PID:2616
-
\??\c:\fpddxjp.exec:\fpddxjp.exe118⤵PID:1528
-
\??\c:\lpjjvr.exec:\lpjjvr.exe119⤵PID:2104
-
\??\c:\lpbll.exec:\lpbll.exe120⤵PID:760
-
\??\c:\fnjdjhb.exec:\fnjdjhb.exe121⤵PID:1624
-
\??\c:\fnlvl.exec:\fnlvl.exe122⤵PID:872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-