Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 23:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
814d978bde9b22a623eb91b1062d62f0173bd0fcdf439c9dcef44a6e51407f4c.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
814d978bde9b22a623eb91b1062d62f0173bd0fcdf439c9dcef44a6e51407f4c.exe
-
Size
454KB
-
MD5
98a36b6efbadfb162c9385dd15051be9
-
SHA1
946f0af36c66a31e3c22bfe16a90c57a667eb0e1
-
SHA256
814d978bde9b22a623eb91b1062d62f0173bd0fcdf439c9dcef44a6e51407f4c
-
SHA512
f43b3c058475550871e80983f675d30fba1e39980a035727d19c9dc8fae34de311040cca6b95ad4ab368f0dcbed29dfaa9d0ad23ff511682702929f3f86f3989
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbef:q7Tc2NYHUrAwfMp3CDf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2768-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-55-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2736-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1100-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-95-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1988-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-195-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1804-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/976-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-229-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1624-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-265-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1596-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-335-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1492-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-356-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1912-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-366-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-397-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/2332-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/932-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-587-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2068-591-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1600-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-612-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1972-638-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2312-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-787-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1624-801-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2804 tvfrvxr.exe 2940 thpft.exe 2944 nvhrf.exe 2684 dtbnrbj.exe 2776 lxlxjn.exe 2736 dnhdxv.exe 2180 nrvtp.exe 1100 vpxjvr.exe 2636 rnttd.exe 1448 trhbp.exe 1988 brdljrr.exe 2980 fltrjd.exe 3008 dntdt.exe 1872 brjjf.exe 2448 bfdhdtf.exe 428 xxpfd.exe 2420 dlxdhlb.exe 2056 pvjnrx.exe 2504 nvtxv.exe 1804 rbfnf.exe 976 txtppx.exe 1348 prfbd.exe 628 hjljvlx.exe 1624 rvrhbth.exe 1920 xrlpp.exe 1744 pjttb.exe 2560 rpntxtj.exe 1720 ldvfh.exe 2576 lxhtbf.exe 2068 dbbjdp.exe 1452 xfdjdt.exe 1884 xbfbr.exe 2792 bbthvb.exe 1596 bltrh.exe 2804 lvpdtjf.exe 2144 tvvhvtt.exe 3060 ffjtp.exe 1492 xjtfxlp.exe 2664 rrndl.exe 1912 tbdnlx.exe 2732 xbrthvt.exe 392 xlnrnh.exe 2200 lvxbv.exe 3028 djfbf.exe 2616 hnlhj.exe 2208 rvdpnhd.exe 2332 flvnvn.exe 1988 djbjft.exe 2980 vnbvxfp.exe 3004 hnjjjtf.exe 1900 vlvrjr.exe 700 fvhvfv.exe 436 fhphfv.exe 932 ptlfrd.exe 2488 bplph.exe 2384 jtjvvpr.exe 2244 nndtvb.exe 2456 xjdfrn.exe 2080 hjfhr.exe 704 vjlrl.exe 2552 hbxhl.exe 984 jpvhxld.exe 2024 bhflf.exe 1464 hrtbxf.exe -
resource yara_rule behavioral1/memory/2768-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/436-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-513-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2320-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-607-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1972-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-787-0x00000000001B0000-0x00000000001DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbfrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtnljf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxbxxbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbjbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbjvddt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvbbjrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpxhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brnrjfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frddbrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfhbjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frtrrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvvhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbtdldp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljpdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpvjrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtjhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdnrbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhjtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfhxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnpflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdplbnx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2768 wrote to memory of 2804 2768 814d978bde9b22a623eb91b1062d62f0173bd0fcdf439c9dcef44a6e51407f4c.exe 30 PID 2768 wrote to memory of 2804 2768 814d978bde9b22a623eb91b1062d62f0173bd0fcdf439c9dcef44a6e51407f4c.exe 30 PID 2768 wrote to memory of 2804 2768 814d978bde9b22a623eb91b1062d62f0173bd0fcdf439c9dcef44a6e51407f4c.exe 30 PID 2768 wrote to memory of 2804 2768 814d978bde9b22a623eb91b1062d62f0173bd0fcdf439c9dcef44a6e51407f4c.exe 30 PID 2804 wrote to memory of 2940 2804 tvfrvxr.exe 31 PID 2804 wrote to memory of 2940 2804 tvfrvxr.exe 31 PID 2804 wrote to memory of 2940 2804 tvfrvxr.exe 31 PID 2804 wrote to memory of 2940 2804 tvfrvxr.exe 31 PID 2940 wrote to memory of 2944 2940 thpft.exe 32 PID 2940 wrote to memory of 2944 2940 thpft.exe 32 PID 2940 wrote to memory of 2944 2940 thpft.exe 32 PID 2940 wrote to memory of 2944 2940 thpft.exe 32 PID 2944 wrote to memory of 2684 2944 nvhrf.exe 33 PID 2944 wrote to memory of 2684 2944 nvhrf.exe 33 PID 2944 wrote to memory of 2684 2944 nvhrf.exe 33 PID 2944 wrote to memory of 2684 2944 nvhrf.exe 33 PID 2684 wrote to memory of 2776 2684 dtbnrbj.exe 34 PID 2684 wrote to memory of 2776 2684 dtbnrbj.exe 34 PID 2684 wrote to memory of 2776 2684 dtbnrbj.exe 34 PID 2684 wrote to memory of 2776 2684 dtbnrbj.exe 34 PID 2776 wrote to memory of 2736 2776 lxlxjn.exe 35 PID 2776 wrote to memory of 2736 2776 lxlxjn.exe 35 PID 2776 wrote to memory of 2736 2776 lxlxjn.exe 35 PID 2776 wrote to memory of 2736 2776 lxlxjn.exe 35 PID 2736 wrote to memory of 2180 2736 dnhdxv.exe 36 PID 2736 wrote to memory of 2180 2736 dnhdxv.exe 36 PID 2736 wrote to memory of 2180 2736 dnhdxv.exe 36 PID 2736 wrote to memory of 2180 2736 dnhdxv.exe 36 PID 2180 wrote to memory of 1100 2180 nrvtp.exe 37 PID 2180 wrote to memory of 1100 2180 nrvtp.exe 37 PID 2180 wrote to memory of 1100 2180 nrvtp.exe 37 PID 2180 wrote to memory of 1100 2180 nrvtp.exe 37 PID 1100 wrote to memory of 2636 1100 vpxjvr.exe 38 PID 1100 wrote to memory of 2636 1100 vpxjvr.exe 38 PID 1100 wrote to memory of 2636 1100 vpxjvr.exe 38 PID 1100 wrote to memory of 2636 1100 vpxjvr.exe 38 PID 2636 wrote to memory of 1448 2636 rnttd.exe 39 PID 2636 wrote to memory of 1448 2636 rnttd.exe 39 PID 2636 wrote to memory of 1448 2636 rnttd.exe 39 PID 2636 wrote to memory of 1448 2636 rnttd.exe 39 PID 1448 wrote to memory of 1988 1448 trhbp.exe 40 PID 1448 wrote to memory of 1988 1448 trhbp.exe 40 PID 1448 wrote to memory of 1988 1448 trhbp.exe 40 PID 1448 wrote to memory of 1988 1448 trhbp.exe 40 PID 1988 wrote to memory of 2980 1988 brdljrr.exe 41 PID 1988 wrote to memory of 2980 1988 brdljrr.exe 41 PID 1988 wrote to memory of 2980 1988 brdljrr.exe 41 PID 1988 wrote to memory of 2980 1988 brdljrr.exe 41 PID 2980 wrote to memory of 3008 2980 fltrjd.exe 42 PID 2980 wrote to memory of 3008 2980 fltrjd.exe 42 PID 2980 wrote to memory of 3008 2980 fltrjd.exe 42 PID 2980 wrote to memory of 3008 2980 fltrjd.exe 42 PID 3008 wrote to memory of 1872 3008 dntdt.exe 43 PID 3008 wrote to memory of 1872 3008 dntdt.exe 43 PID 3008 wrote to memory of 1872 3008 dntdt.exe 43 PID 3008 wrote to memory of 1872 3008 dntdt.exe 43 PID 1872 wrote to memory of 2448 1872 brjjf.exe 44 PID 1872 wrote to memory of 2448 1872 brjjf.exe 44 PID 1872 wrote to memory of 2448 1872 brjjf.exe 44 PID 1872 wrote to memory of 2448 1872 brjjf.exe 44 PID 2448 wrote to memory of 428 2448 bfdhdtf.exe 45 PID 2448 wrote to memory of 428 2448 bfdhdtf.exe 45 PID 2448 wrote to memory of 428 2448 bfdhdtf.exe 45 PID 2448 wrote to memory of 428 2448 bfdhdtf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\814d978bde9b22a623eb91b1062d62f0173bd0fcdf439c9dcef44a6e51407f4c.exe"C:\Users\Admin\AppData\Local\Temp\814d978bde9b22a623eb91b1062d62f0173bd0fcdf439c9dcef44a6e51407f4c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\tvfrvxr.exec:\tvfrvxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\thpft.exec:\thpft.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\nvhrf.exec:\nvhrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\dtbnrbj.exec:\dtbnrbj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\lxlxjn.exec:\lxlxjn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\dnhdxv.exec:\dnhdxv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\nrvtp.exec:\nrvtp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\vpxjvr.exec:\vpxjvr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\rnttd.exec:\rnttd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\trhbp.exec:\trhbp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\brdljrr.exec:\brdljrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\fltrjd.exec:\fltrjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\dntdt.exec:\dntdt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\brjjf.exec:\brjjf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\bfdhdtf.exec:\bfdhdtf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\xxpfd.exec:\xxpfd.exe17⤵
- Executes dropped EXE
PID:428 -
\??\c:\dlxdhlb.exec:\dlxdhlb.exe18⤵
- Executes dropped EXE
PID:2420 -
\??\c:\pvjnrx.exec:\pvjnrx.exe19⤵
- Executes dropped EXE
PID:2056 -
\??\c:\nvtxv.exec:\nvtxv.exe20⤵
- Executes dropped EXE
PID:2504 -
\??\c:\rbfnf.exec:\rbfnf.exe21⤵
- Executes dropped EXE
PID:1804 -
\??\c:\txtppx.exec:\txtppx.exe22⤵
- Executes dropped EXE
PID:976 -
\??\c:\prfbd.exec:\prfbd.exe23⤵
- Executes dropped EXE
PID:1348 -
\??\c:\hjljvlx.exec:\hjljvlx.exe24⤵
- Executes dropped EXE
PID:628 -
\??\c:\rvrhbth.exec:\rvrhbth.exe25⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xrlpp.exec:\xrlpp.exe26⤵
- Executes dropped EXE
PID:1920 -
\??\c:\pjttb.exec:\pjttb.exe27⤵
- Executes dropped EXE
PID:1744 -
\??\c:\rpntxtj.exec:\rpntxtj.exe28⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ldvfh.exec:\ldvfh.exe29⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lxhtbf.exec:\lxhtbf.exe30⤵
- Executes dropped EXE
PID:2576 -
\??\c:\dbbjdp.exec:\dbbjdp.exe31⤵
- Executes dropped EXE
PID:2068 -
\??\c:\xfdjdt.exec:\xfdjdt.exe32⤵
- Executes dropped EXE
PID:1452 -
\??\c:\xbfbr.exec:\xbfbr.exe33⤵
- Executes dropped EXE
PID:1884 -
\??\c:\bbthvb.exec:\bbthvb.exe34⤵
- Executes dropped EXE
PID:2792 -
\??\c:\bltrh.exec:\bltrh.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\lvpdtjf.exec:\lvpdtjf.exe36⤵
- Executes dropped EXE
PID:2804 -
\??\c:\tvvhvtt.exec:\tvvhvtt.exe37⤵
- Executes dropped EXE
PID:2144 -
\??\c:\ffjtp.exec:\ffjtp.exe38⤵
- Executes dropped EXE
PID:3060 -
\??\c:\xjtfxlp.exec:\xjtfxlp.exe39⤵
- Executes dropped EXE
PID:1492 -
\??\c:\rrndl.exec:\rrndl.exe40⤵
- Executes dropped EXE
PID:2664 -
\??\c:\tbdnlx.exec:\tbdnlx.exe41⤵
- Executes dropped EXE
PID:1912 -
\??\c:\xbrthvt.exec:\xbrthvt.exe42⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xlnrnh.exec:\xlnrnh.exe43⤵
- Executes dropped EXE
PID:392 -
\??\c:\lvxbv.exec:\lvxbv.exe44⤵
- Executes dropped EXE
PID:2200 -
\??\c:\djfbf.exec:\djfbf.exe45⤵
- Executes dropped EXE
PID:3028 -
\??\c:\hnlhj.exec:\hnlhj.exe46⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rvdpnhd.exec:\rvdpnhd.exe47⤵
- Executes dropped EXE
PID:2208 -
\??\c:\flvnvn.exec:\flvnvn.exe48⤵
- Executes dropped EXE
PID:2332 -
\??\c:\djbjft.exec:\djbjft.exe49⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vnbvxfp.exec:\vnbvxfp.exe50⤵
- Executes dropped EXE
PID:2980 -
\??\c:\hnjjjtf.exec:\hnjjjtf.exe51⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vlvrjr.exec:\vlvrjr.exe52⤵
- Executes dropped EXE
PID:1900 -
\??\c:\fvhvfv.exec:\fvhvfv.exe53⤵
- Executes dropped EXE
PID:700 -
\??\c:\fhphfv.exec:\fhphfv.exe54⤵
- Executes dropped EXE
PID:436 -
\??\c:\ptlfrd.exec:\ptlfrd.exe55⤵
- Executes dropped EXE
PID:932 -
\??\c:\bplph.exec:\bplph.exe56⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jtjvvpr.exec:\jtjvvpr.exe57⤵
- Executes dropped EXE
PID:2384 -
\??\c:\nndtvb.exec:\nndtvb.exe58⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xjdfrn.exec:\xjdfrn.exe59⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hjfhr.exec:\hjfhr.exe60⤵
- Executes dropped EXE
PID:2080 -
\??\c:\vjlrl.exec:\vjlrl.exe61⤵
- Executes dropped EXE
PID:704 -
\??\c:\hbxhl.exec:\hbxhl.exe62⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jpvhxld.exec:\jpvhxld.exe63⤵
- Executes dropped EXE
PID:984 -
\??\c:\bhflf.exec:\bhflf.exe64⤵
- Executes dropped EXE
PID:2024 -
\??\c:\hrtbxf.exec:\hrtbxf.exe65⤵
- Executes dropped EXE
PID:1464 -
\??\c:\rlrfflx.exec:\rlrfflx.exe66⤵PID:1668
-
\??\c:\jbrjjln.exec:\jbrjjln.exe67⤵PID:1116
-
\??\c:\tjhvf.exec:\tjhvf.exe68⤵PID:2580
-
\??\c:\jxfljdb.exec:\jxfljdb.exe69⤵PID:996
-
\??\c:\ddvfvfb.exec:\ddvfvfb.exe70⤵PID:2612
-
\??\c:\rfrntfr.exec:\rfrntfr.exe71⤵PID:2320
-
\??\c:\bfnxfr.exec:\bfnxfr.exe72⤵PID:2576
-
\??\c:\djffh.exec:\djffh.exe73⤵PID:2068
-
\??\c:\bbtxf.exec:\bbtxf.exe74⤵PID:1456
-
\??\c:\frtrrp.exec:\frtrrp.exe75⤵PID:3052
-
\??\c:\xvrnv.exec:\xvrnv.exe76⤵PID:1600
-
\??\c:\pbtdldp.exec:\pbtdldp.exe77⤵
- System Location Discovery: System Language Discovery
PID:2928 -
\??\c:\vxxlv.exec:\vxxlv.exe78⤵PID:2872
-
\??\c:\tpbfb.exec:\tpbfb.exe79⤵PID:2144
-
\??\c:\jrvdfbp.exec:\jrvdfbp.exe80⤵PID:2852
-
\??\c:\bjvdff.exec:\bjvdff.exe81⤵PID:2848
-
\??\c:\xrjxjxv.exec:\xrjxjxv.exe82⤵PID:1972
-
\??\c:\jtpnh.exec:\jtpnh.exe83⤵PID:2108
-
\??\c:\dxffv.exec:\dxffv.exe84⤵PID:1788
-
\??\c:\drdjpl.exec:\drdjpl.exe85⤵PID:2216
-
\??\c:\rtfldv.exec:\rtfldv.exe86⤵PID:1100
-
\??\c:\rtrvfp.exec:\rtrvfp.exe87⤵PID:2316
-
\??\c:\xrbdjnh.exec:\xrbdjnh.exe88⤵PID:2232
-
\??\c:\frhfrr.exec:\frhfrr.exe89⤵PID:2172
-
\??\c:\vfxppn.exec:\vfxppn.exe90⤵PID:2844
-
\??\c:\lhlphfv.exec:\lhlphfv.exe91⤵PID:2988
-
\??\c:\lrbtn.exec:\lrbtn.exe92⤵PID:3044
-
\??\c:\tdvdl.exec:\tdvdl.exe93⤵PID:2312
-
\??\c:\rvvhbfp.exec:\rvvhbfp.exe94⤵PID:2992
-
\??\c:\fftnh.exec:\fftnh.exe95⤵PID:1388
-
\??\c:\xnxrrh.exec:\xnxrrh.exe96⤵PID:2288
-
\??\c:\rljjb.exec:\rljjb.exe97⤵PID:436
-
\??\c:\xfpbxlv.exec:\xfpbxlv.exe98⤵PID:236
-
\??\c:\pdndvx.exec:\pdndvx.exe99⤵PID:2404
-
\??\c:\hpnrfd.exec:\hpnrfd.exe100⤵PID:1948
-
\??\c:\vhjpjn.exec:\vhjpjn.exe101⤵PID:948
-
\??\c:\jfdnbjj.exec:\jfdnbjj.exe102⤵PID:2456
-
\??\c:\fvrbpn.exec:\fvrbpn.exe103⤵PID:2084
-
\??\c:\jrpfb.exec:\jrpfb.exe104⤵PID:1392
-
\??\c:\xlflf.exec:\xlflf.exe105⤵PID:2552
-
\??\c:\hrfxbv.exec:\hrfxbv.exe106⤵PID:936
-
\??\c:\bhrjdhb.exec:\bhrjdhb.exe107⤵PID:1624
-
\??\c:\pxphht.exec:\pxphht.exe108⤵PID:1920
-
\??\c:\vbrlb.exec:\vbrlb.exe109⤵PID:1708
-
\??\c:\xvxhllv.exec:\xvxhllv.exe110⤵PID:2036
-
\??\c:\nbthd.exec:\nbthd.exe111⤵PID:1508
-
\??\c:\drplpbl.exec:\drplpbl.exe112⤵PID:1608
-
\??\c:\vbfxdx.exec:\vbfxdx.exe113⤵PID:1436
-
\??\c:\jdlxr.exec:\jdlxr.exe114⤵PID:2340
-
\??\c:\rnjpp.exec:\rnjpp.exe115⤵PID:888
-
\??\c:\lpjhvb.exec:\lpjhvb.exe116⤵PID:2632
-
\??\c:\nlplh.exec:\nlplh.exe117⤵PID:1680
-
\??\c:\lxbtxnx.exec:\lxbtxnx.exe118⤵PID:3052
-
\??\c:\ldjhh.exec:\ldjhh.exe119⤵PID:2892
-
\??\c:\frhhtd.exec:\frhhtd.exe120⤵PID:2696
-
\??\c:\nxvvf.exec:\nxvvf.exe121⤵PID:2932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-