Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 07:50
Behavioral task
behavioral1
Sample
a3eef08e2c65ed9b534aa8b15e5178f0N.exe
Resource
win7-20240704-en
6 signatures
120 seconds
General
-
Target
a3eef08e2c65ed9b534aa8b15e5178f0N.exe
-
Size
143KB
-
MD5
a3eef08e2c65ed9b534aa8b15e5178f0
-
SHA1
dd2e6ba715e171f6219dd7085ecc3187644da45f
-
SHA256
5b34bbf518bd3fc681dcd1b231405977c86398ed962a6e769e2215bcca73acaf
-
SHA512
9c047b439e7cae9d57592673b3a013a5d51836cf3b1669c3164567ad9a6038291f1d88b59e0aea8291f10ff71758a20859198acb25e67f61b0f83f77f925e6d1
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BWlPFH4to1odt1:kcm4FmowdHoSphraHcpOFltH4to1st1
Malware Config
Signatures
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2284-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2036-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-44-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2672-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-92-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1556-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/876-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1852-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2080-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2140-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1336-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1012-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1140-284-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/884-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-299-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1152-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-338-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/3064-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-353-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2676-355-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2676-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-396-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1876-420-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1148-488-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-502-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/984-511-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/984-543-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/884-571-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3060-595-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-633-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2376-659-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-836-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2172-843-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2800-918-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1748-981-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1004-1104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-1142-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2036 dbvnlb.exe 2608 hjhvhnj.exe 2728 fdrrtlt.exe 2672 xptbvx.exe 2756 rpjpl.exe 2820 drlvl.exe 2560 vrvhxb.exe 2544 ljlhpv.exe 2556 dblnjvr.exe 1556 ntxfbjn.exe 876 xtfrbj.exe 2500 vjlnnr.exe 2300 hfbnb.exe 1632 nrphr.exe 1852 fljtrbr.exe 2080 tfltddt.exe 1336 bxxrv.exe 2140 bndbht.exe 2396 hxbnn.exe 2232 vhjln.exe 1152 xtlfhtl.exe 1112 rvrfv.exe 896 fdxpl.exe 608 pvpbp.exe 2208 vblbnjh.exe 2604 jbpxnvp.exe 612 tjhjv.exe 1732 lbjhbrr.exe 1012 thldp.exe 1000 jjpxjfv.exe 1140 dpvddn.exe 884 hpvxdbf.exe 1964 vxhdrp.exe 2812 pbtfhx.exe 1608 xbhvnn.exe 2816 dhjxd.exe 2732 xbndfdf.exe 2640 dxrpf.exe 2744 vxpbv.exe 3064 ljnhntv.exe 2676 dndnl.exe 2800 ttvnj.exe 2564 vpjtrnn.exe 2516 rbdftdt.exe 1324 xttrj.exe 2556 jrhdnhj.exe 1556 tfdjv.exe 1092 rxfrjdv.exe 1760 trbpprd.exe 2500 nntpjj.exe 1876 pdrthh.exe 752 lhdtxhb.exe 2096 dnrxbbp.exe 2224 jnfrbb.exe 2104 rnvltr.exe 2044 nflxlr.exe 2140 lnfdtvr.exe 1168 djlljhh.exe 1872 fjljt.exe 684 ffjpbfn.exe 1148 jtxvtxp.exe 888 fjvbrvh.exe 2844 dvrblbx.exe 984 jhvrdv.exe -
resource yara_rule behavioral1/memory/2284-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2284-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d90-10.dat upx behavioral1/memory/2036-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2036-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b03-17.dat upx behavioral1/files/0x0006000000018b3e-26.dat upx behavioral1/files/0x0006000000018b4d-36.dat upx behavioral1/memory/2728-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2672-44-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2672-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b54-45.dat upx behavioral1/memory/2756-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b58-54.dat upx behavioral1/memory/2820-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2820-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018f3e-64.dat upx behavioral1/memory/2560-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fc1-74.dat upx behavioral1/files/0x0005000000018fc2-82.dat upx behavioral1/memory/2544-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2556-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fcb-93.dat upx behavioral1/memory/1556-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fcd-103.dat upx behavioral1/files/0x0005000000018fe2-112.dat upx behavioral1/memory/876-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2500-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fe4-121.dat upx behavioral1/files/0x0005000000019078-131.dat upx behavioral1/memory/2300-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0004000000017801-138.dat upx behavioral1/files/0x0004000000019206-147.dat upx behavioral1/memory/1852-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00040000000192a8-157.dat upx behavioral1/memory/2080-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/876-155-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00040000000192ad-166.dat upx behavioral1/files/0x0004000000019380-175.dat upx behavioral1/memory/2140-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0004000000019438-183.dat upx behavioral1/memory/1336-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0004000000019461-192.dat upx behavioral1/files/0x0004000000019485-201.dat upx behavioral1/files/0x00040000000194ec-211.dat upx behavioral1/memory/896-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019571-220.dat upx behavioral1/files/0x0005000000019575-227.dat upx behavioral1/files/0x000500000001962f-236.dat upx behavioral1/files/0x000500000001966c-244.dat upx behavioral1/memory/2604-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000196af-253.dat upx behavioral1/files/0x0005000000019f50-260.dat upx behavioral1/files/0x000500000001a056-268.dat upx behavioral1/files/0x000500000001a1e8-276.dat upx behavioral1/memory/1012-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a1ee-285.dat upx behavioral1/memory/884-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2396-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1152-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2232-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2816-313-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3064-339-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjxhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xttrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptnvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltrlntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjnjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vblrxnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftvlpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxdrrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddxvbvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbnhvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljrflbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnfdtvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfdrrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptltvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbhdlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdlvrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdtpnbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntjjlhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfvtdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrdxhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfjfnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pttbfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlltpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnthx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlhnbfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbvnnvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjlnnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnhrrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htpjdnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbfhhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdlthdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htdvpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdrnjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbdhnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvfvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfdbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjhnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdlvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvbjhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhftp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvvpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbjjnvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvptrnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nphblp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2284 wrote to memory of 2036 2284 a3eef08e2c65ed9b534aa8b15e5178f0N.exe 31 PID 2284 wrote to memory of 2036 2284 a3eef08e2c65ed9b534aa8b15e5178f0N.exe 31 PID 2284 wrote to memory of 2036 2284 a3eef08e2c65ed9b534aa8b15e5178f0N.exe 31 PID 2284 wrote to memory of 2036 2284 a3eef08e2c65ed9b534aa8b15e5178f0N.exe 31 PID 2036 wrote to memory of 2608 2036 dbvnlb.exe 32 PID 2036 wrote to memory of 2608 2036 dbvnlb.exe 32 PID 2036 wrote to memory of 2608 2036 dbvnlb.exe 32 PID 2036 wrote to memory of 2608 2036 dbvnlb.exe 32 PID 2608 wrote to memory of 2728 2608 hjhvhnj.exe 33 PID 2608 wrote to memory of 2728 2608 hjhvhnj.exe 33 PID 2608 wrote to memory of 2728 2608 hjhvhnj.exe 33 PID 2608 wrote to memory of 2728 2608 hjhvhnj.exe 33 PID 2728 wrote to memory of 2672 2728 fdrrtlt.exe 34 PID 2728 wrote to memory of 2672 2728 fdrrtlt.exe 34 PID 2728 wrote to memory of 2672 2728 fdrrtlt.exe 34 PID 2728 wrote to memory of 2672 2728 fdrrtlt.exe 34 PID 2672 wrote to memory of 2756 2672 xptbvx.exe 35 PID 2672 wrote to memory of 2756 2672 xptbvx.exe 35 PID 2672 wrote to memory of 2756 2672 xptbvx.exe 35 PID 2672 wrote to memory of 2756 2672 xptbvx.exe 35 PID 2756 wrote to memory of 2820 2756 rpjpl.exe 36 PID 2756 wrote to memory of 2820 2756 rpjpl.exe 36 PID 2756 wrote to memory of 2820 2756 rpjpl.exe 36 PID 2756 wrote to memory of 2820 2756 rpjpl.exe 36 PID 2820 wrote to memory of 2560 2820 drlvl.exe 37 PID 2820 wrote to memory of 2560 2820 drlvl.exe 37 PID 2820 wrote to memory of 2560 2820 drlvl.exe 37 PID 2820 wrote to memory of 2560 2820 drlvl.exe 37 PID 2560 wrote to memory of 2544 2560 vrvhxb.exe 38 PID 2560 wrote to memory of 2544 2560 vrvhxb.exe 38 PID 2560 wrote to memory of 2544 2560 vrvhxb.exe 38 PID 2560 wrote to memory of 2544 2560 vrvhxb.exe 38 PID 2544 wrote to memory of 2556 2544 ljlhpv.exe 39 PID 2544 wrote to memory of 2556 2544 ljlhpv.exe 39 PID 2544 wrote to memory of 2556 2544 ljlhpv.exe 39 PID 2544 wrote to memory of 2556 2544 ljlhpv.exe 39 PID 2556 wrote to memory of 1556 2556 dblnjvr.exe 40 PID 2556 wrote to memory of 1556 2556 dblnjvr.exe 40 PID 2556 wrote to memory of 1556 2556 dblnjvr.exe 40 PID 2556 wrote to memory of 1556 2556 dblnjvr.exe 40 PID 1556 wrote to memory of 876 1556 ntxfbjn.exe 41 PID 1556 wrote to memory of 876 1556 ntxfbjn.exe 41 PID 1556 wrote to memory of 876 1556 ntxfbjn.exe 41 PID 1556 wrote to memory of 876 1556 ntxfbjn.exe 41 PID 876 wrote to memory of 2500 876 xtfrbj.exe 42 PID 876 wrote to memory of 2500 876 xtfrbj.exe 42 PID 876 wrote to memory of 2500 876 xtfrbj.exe 42 PID 876 wrote to memory of 2500 876 xtfrbj.exe 42 PID 2500 wrote to memory of 2300 2500 vjlnnr.exe 43 PID 2500 wrote to memory of 2300 2500 vjlnnr.exe 43 PID 2500 wrote to memory of 2300 2500 vjlnnr.exe 43 PID 2500 wrote to memory of 2300 2500 vjlnnr.exe 43 PID 2300 wrote to memory of 1632 2300 hfbnb.exe 44 PID 2300 wrote to memory of 1632 2300 hfbnb.exe 44 PID 2300 wrote to memory of 1632 2300 hfbnb.exe 44 PID 2300 wrote to memory of 1632 2300 hfbnb.exe 44 PID 1632 wrote to memory of 1852 1632 nrphr.exe 45 PID 1632 wrote to memory of 1852 1632 nrphr.exe 45 PID 1632 wrote to memory of 1852 1632 nrphr.exe 45 PID 1632 wrote to memory of 1852 1632 nrphr.exe 45 PID 1852 wrote to memory of 2080 1852 fljtrbr.exe 46 PID 1852 wrote to memory of 2080 1852 fljtrbr.exe 46 PID 1852 wrote to memory of 2080 1852 fljtrbr.exe 46 PID 1852 wrote to memory of 2080 1852 fljtrbr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3eef08e2c65ed9b534aa8b15e5178f0N.exe"C:\Users\Admin\AppData\Local\Temp\a3eef08e2c65ed9b534aa8b15e5178f0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\dbvnlb.exec:\dbvnlb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\hjhvhnj.exec:\hjhvhnj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\fdrrtlt.exec:\fdrrtlt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\xptbvx.exec:\xptbvx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\rpjpl.exec:\rpjpl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\drlvl.exec:\drlvl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\vrvhxb.exec:\vrvhxb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\ljlhpv.exec:\ljlhpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\dblnjvr.exec:\dblnjvr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\ntxfbjn.exec:\ntxfbjn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\xtfrbj.exec:\xtfrbj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\vjlnnr.exec:\vjlnnr.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\hfbnb.exec:\hfbnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\nrphr.exec:\nrphr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\fljtrbr.exec:\fljtrbr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\tfltddt.exec:\tfltddt.exe17⤵
- Executes dropped EXE
PID:2080 -
\??\c:\bxxrv.exec:\bxxrv.exe18⤵
- Executes dropped EXE
PID:1336 -
\??\c:\bndbht.exec:\bndbht.exe19⤵
- Executes dropped EXE
PID:2140 -
\??\c:\hxbnn.exec:\hxbnn.exe20⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vhjln.exec:\vhjln.exe21⤵
- Executes dropped EXE
PID:2232 -
\??\c:\xtlfhtl.exec:\xtlfhtl.exe22⤵
- Executes dropped EXE
PID:1152 -
\??\c:\rvrfv.exec:\rvrfv.exe23⤵
- Executes dropped EXE
PID:1112 -
\??\c:\fdxpl.exec:\fdxpl.exe24⤵
- Executes dropped EXE
PID:896 -
\??\c:\pvpbp.exec:\pvpbp.exe25⤵
- Executes dropped EXE
PID:608 -
\??\c:\vblbnjh.exec:\vblbnjh.exe26⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jbpxnvp.exec:\jbpxnvp.exe27⤵
- Executes dropped EXE
PID:2604 -
\??\c:\tjhjv.exec:\tjhjv.exe28⤵
- Executes dropped EXE
PID:612 -
\??\c:\lbjhbrr.exec:\lbjhbrr.exe29⤵
- Executes dropped EXE
PID:1732 -
\??\c:\thldp.exec:\thldp.exe30⤵
- Executes dropped EXE
PID:1012 -
\??\c:\jjpxjfv.exec:\jjpxjfv.exe31⤵
- Executes dropped EXE
PID:1000 -
\??\c:\dpvddn.exec:\dpvddn.exe32⤵
- Executes dropped EXE
PID:1140 -
\??\c:\hpvxdbf.exec:\hpvxdbf.exe33⤵
- Executes dropped EXE
PID:884 -
\??\c:\vxhdrp.exec:\vxhdrp.exe34⤵
- Executes dropped EXE
PID:1964 -
\??\c:\pbtfhx.exec:\pbtfhx.exe35⤵
- Executes dropped EXE
PID:2812 -
\??\c:\xbhvnn.exec:\xbhvnn.exe36⤵
- Executes dropped EXE
PID:1608 -
\??\c:\dhjxd.exec:\dhjxd.exe37⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xbndfdf.exec:\xbndfdf.exe38⤵
- Executes dropped EXE
PID:2732 -
\??\c:\dxrpf.exec:\dxrpf.exe39⤵
- Executes dropped EXE
PID:2640 -
\??\c:\vxpbv.exec:\vxpbv.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\ljnhntv.exec:\ljnhntv.exe41⤵
- Executes dropped EXE
PID:3064 -
\??\c:\dndnl.exec:\dndnl.exe42⤵
- Executes dropped EXE
PID:2676 -
\??\c:\ttvnj.exec:\ttvnj.exe43⤵
- Executes dropped EXE
PID:2800 -
\??\c:\vpjtrnn.exec:\vpjtrnn.exe44⤵
- Executes dropped EXE
PID:2564 -
\??\c:\rbdftdt.exec:\rbdftdt.exe45⤵
- Executes dropped EXE
PID:2516 -
\??\c:\xttrj.exec:\xttrj.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1324 -
\??\c:\jrhdnhj.exec:\jrhdnhj.exe47⤵
- Executes dropped EXE
PID:2556 -
\??\c:\tfdjv.exec:\tfdjv.exe48⤵
- Executes dropped EXE
PID:1556 -
\??\c:\rxfrjdv.exec:\rxfrjdv.exe49⤵
- Executes dropped EXE
PID:1092 -
\??\c:\trbpprd.exec:\trbpprd.exe50⤵
- Executes dropped EXE
PID:1760 -
\??\c:\nntpjj.exec:\nntpjj.exe51⤵
- Executes dropped EXE
PID:2500 -
\??\c:\pdrthh.exec:\pdrthh.exe52⤵
- Executes dropped EXE
PID:1876 -
\??\c:\lhdtxhb.exec:\lhdtxhb.exe53⤵
- Executes dropped EXE
PID:752 -
\??\c:\dnrxbbp.exec:\dnrxbbp.exe54⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jnfrbb.exec:\jnfrbb.exe55⤵
- Executes dropped EXE
PID:2224 -
\??\c:\rnvltr.exec:\rnvltr.exe56⤵
- Executes dropped EXE
PID:2104 -
\??\c:\nflxlr.exec:\nflxlr.exe57⤵
- Executes dropped EXE
PID:2044 -
\??\c:\lnfdtvr.exec:\lnfdtvr.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2140 -
\??\c:\djlljhh.exec:\djlljhh.exe59⤵
- Executes dropped EXE
PID:1168 -
\??\c:\fjljt.exec:\fjljt.exe60⤵
- Executes dropped EXE
PID:1872 -
\??\c:\ffjpbfn.exec:\ffjpbfn.exe61⤵
- Executes dropped EXE
PID:684 -
\??\c:\jtxvtxp.exec:\jtxvtxp.exe62⤵
- Executes dropped EXE
PID:1148 -
\??\c:\fjvbrvh.exec:\fjvbrvh.exe63⤵
- Executes dropped EXE
PID:888 -
\??\c:\dvrblbx.exec:\dvrblbx.exe64⤵
- Executes dropped EXE
PID:2844 -
\??\c:\jhvrdv.exec:\jhvrdv.exe65⤵
- Executes dropped EXE
PID:984 -
\??\c:\frtln.exec:\frtln.exe66⤵PID:1792
-
\??\c:\rblvth.exec:\rblvth.exe67⤵PID:3008
-
\??\c:\nxpvx.exec:\nxpvx.exe68⤵PID:2604
-
\??\c:\fnvnjn.exec:\fnvnjn.exe69⤵PID:1728
-
\??\c:\xhbnf.exec:\xhbnf.exe70⤵PID:2580
-
\??\c:\lfvdn.exec:\lfvdn.exe71⤵PID:1004
-
\??\c:\tlhbph.exec:\tlhbph.exe72⤵PID:2420
-
\??\c:\jxtdrh.exec:\jxtdrh.exe73⤵PID:1644
-
\??\c:\pldxlrr.exec:\pldxlrr.exe74⤵PID:2124
-
\??\c:\pvllr.exec:\pvllr.exe75⤵PID:884
-
\??\c:\xftlhft.exec:\xftlhft.exe76⤵PID:2020
-
\??\c:\pnnvpfx.exec:\pnnvpfx.exe77⤵PID:1576
-
\??\c:\ffvtx.exec:\ffvtx.exe78⤵PID:2876
-
\??\c:\rvnjxpb.exec:\rvnjxpb.exe79⤵PID:3060
-
\??\c:\lplvvp.exec:\lplvvp.exe80⤵PID:2608
-
\??\c:\pjjrl.exec:\pjjrl.exe81⤵PID:2728
-
\??\c:\bpplxfv.exec:\bpplxfv.exe82⤵PID:2364
-
\??\c:\tjbxphd.exec:\tjbxphd.exe83⤵PID:2888
-
\??\c:\xpvdvtn.exec:\xpvdvtn.exe84⤵PID:3064
-
\??\c:\rvfnbb.exec:\rvfnbb.exe85⤵PID:2960
-
\??\c:\hrlhdvh.exec:\hrlhdvh.exe86⤵PID:2588
-
\??\c:\nfthj.exec:\nfthj.exe87⤵PID:2988
-
\??\c:\nlbtr.exec:\nlbtr.exe88⤵PID:2376
-
\??\c:\lvlhvjj.exec:\lvlhvjj.exe89⤵PID:1484
-
\??\c:\vrtttr.exec:\vrtttr.exe90⤵PID:824
-
\??\c:\xjjvrj.exec:\xjjvrj.exe91⤵PID:2492
-
\??\c:\pbrjv.exec:\pbrjv.exe92⤵PID:1524
-
\??\c:\hxnftf.exec:\hxnftf.exe93⤵PID:468
-
\??\c:\xfvpnv.exec:\xfvpnv.exe94⤵PID:1724
-
\??\c:\bdfjxv.exec:\bdfjxv.exe95⤵PID:1096
-
\??\c:\bhlppff.exec:\bhlppff.exe96⤵PID:1984
-
\??\c:\rrxvpd.exec:\rrxvpd.exe97⤵PID:2612
-
\??\c:\bdfrbxh.exec:\bdfrbxh.exe98⤵PID:1892
-
\??\c:\rvnrrvd.exec:\rvnrrvd.exe99⤵PID:2460
-
\??\c:\vthrbxl.exec:\vthrbxl.exe100⤵PID:2268
-
\??\c:\dbbbh.exec:\dbbbh.exe101⤵PID:2216
-
\??\c:\brhfhdd.exec:\brhfhdd.exe102⤵PID:1980
-
\??\c:\dlvbxbd.exec:\dlvbxbd.exe103⤵PID:2852
-
\??\c:\rxhhr.exec:\rxhhr.exe104⤵PID:2708
-
\??\c:\bnjxnb.exec:\bnjxnb.exe105⤵PID:1804
-
\??\c:\dthtxx.exec:\dthtxx.exe106⤵PID:1112
-
\??\c:\fjrxlxb.exec:\fjrxlxb.exe107⤵PID:1296
-
\??\c:\lpptl.exec:\lpptl.exe108⤵PID:2844
-
\??\c:\pflvjn.exec:\pflvjn.exe109⤵PID:1548
-
\??\c:\vtfxdj.exec:\vtfxdj.exe110⤵PID:1792
-
\??\c:\flbxf.exec:\flbxf.exe111⤵PID:272
-
\??\c:\lrfjfnf.exec:\lrfjfnf.exe112⤵
- System Location Discovery: System Language Discovery
PID:540 -
\??\c:\hrfxjvt.exec:\hrfxjvt.exe113⤵PID:1728
-
\??\c:\hblddt.exec:\hblddt.exe114⤵PID:1488
-
\??\c:\rjjnrll.exec:\rjjnrll.exe115⤵PID:1952
-
\??\c:\rpbpj.exec:\rpbpj.exe116⤵PID:1648
-
\??\c:\xhfbb.exec:\xhfbb.exe117⤵PID:2172
-
\??\c:\lvrrvl.exec:\lvrrvl.exe118⤵PID:1512
-
\??\c:\fbpbhbh.exec:\fbpbhbh.exe119⤵PID:1020
-
\??\c:\bbpbvp.exec:\bbpbvp.exe120⤵PID:2064
-
\??\c:\lbrffhn.exec:\lbrffhn.exe121⤵PID:2704
-
\??\c:\bpbpx.exec:\bpbpx.exe122⤵PID:2660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-