Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 22:30
Behavioral task
behavioral1
Sample
8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe
Resource
win7-20241010-en
General
-
Target
8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe
-
Size
79KB
-
MD5
cb863cf8e93ff7a43298f94c189444f3
-
SHA1
3588f9310b77dbf1090386779171d43b3650f89e
-
SHA256
8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3
-
SHA512
449141698b3ab7120a47c017e3c2c91b2df0874e0916db01ac9fd6c123684116006c8112987981807f664c2298e00ed911efddd0c8dc047bb03804d120221841
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzx8/p7ke2B:xhOmTsF93UYfwC6GIout03LzGFE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2916-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1652-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2424-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2088-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-307-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2896-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1236-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1172-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/676-466-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1520-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-511-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1708-282-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1708-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1512-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-577-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2128-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-590-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1932-663-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1948-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1948-149-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1520-761-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1804-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-829-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2740-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2996-940-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2304-1050-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1512-1019-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1888-1144-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1644-1171-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2040-1270-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1624-1277-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/736-1295-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1056-1335-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2864 pvbhpp.exe 2812 vrprjv.exe 2916 fnxxnrb.exe 3028 rvdvl.exe 2884 rtvnbx.exe 2740 vvjjd.exe 2288 nfdnpvb.exe 2972 txdvnhd.exe 1804 fdjxrld.exe 2300 dtnpnhf.exe 1652 dthndtl.exe 1936 rxrdj.exe 2424 lxtbbf.exe 3008 dbbnl.exe 1948 bxvbddx.exe 868 ltvvfd.exe 1084 tpdvf.exe 1748 trlnbfh.exe 2488 fnjnh.exe 2128 rjrhvrd.exe 2088 bbrvphr.exe 2560 hhljvp.exe 1512 vnpdtfd.exe 2536 bbnjb.exe 1736 dfhnj.exe 1588 xvnrvl.exe 1664 lnldnrl.exe 284 xtrhfr.exe 1008 pbhpj.exe 1708 ftxbjv.exe 2592 ljblh.exe 3052 nbjdl.exe 2904 lnhdv.exe 2856 dnbfpxv.exe 2896 pptlxx.exe 2692 vbrfbtr.exe 2788 bxvfdr.exe 2756 jrxrnh.exe 1236 ltlpd.exe 1888 xblbpd.exe 1036 tlvpdfd.exe 2712 jjlvxnp.exe 1172 lnfnj.exe 2216 hbdnfxd.exe 2260 jtttj.exe 2928 hfhxdh.exe 2152 vjvvrr.exe 2176 bxfjd.exe 3020 ndfrd.exe 2420 dnvjrph.exe 2988 bpjnbdf.exe 3000 fffdtpp.exe 2816 fppphl.exe 676 rbhff.exe 760 bpnlln.exe 2064 vtddhnr.exe 2444 trjhv.exe 2632 vvhrft.exe 1624 trtrv.exe 2560 rbtxv.exe 1520 bxhvb.exe 2448 tphntdf.exe 2120 btxxf.exe 1736 vtbdj.exe -
resource yara_rule behavioral1/memory/2796-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000012262-5.dat upx behavioral1/memory/2864-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x002c000000016d70-19.dat upx behavioral1/memory/2916-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2972-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000018b28-86.dat upx behavioral1/files/0x00050000000195c5-95.dat upx behavioral1/files/0x00050000000195c6-103.dat upx behavioral1/memory/1652-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1936-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2424-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019643-133.dat upx behavioral1/files/0x000500000001975a-141.dat upx behavioral1/files/0x0005000000019761-152.dat upx behavioral1/files/0x00050000000197fd-159.dat upx behavioral1/files/0x000d000000016fc9-167.dat upx behavioral1/files/0x0005000000019820-176.dat upx behavioral1/memory/1748-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf5-185.dat upx behavioral1/files/0x0005000000019bf6-194.dat upx behavioral1/memory/2088-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf9-204.dat upx behavioral1/files/0x0005000000019d61-221.dat upx behavioral1/files/0x0005000000019d6d-240.dat upx behavioral1/files/0x0005000000019e92-247.dat upx behavioral1/files/0x0005000000019fdd-264.dat upx behavioral1/files/0x000500000001a03c-273.dat upx behavioral1/files/0x000500000001a049-283.dat upx behavioral1/files/0x000500000001a0b6-293.dat upx behavioral1/memory/2592-291-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2856-306-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2896-320-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2692-327-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1236-346-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1172-373-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2260-386-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2928-393-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2988-420-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2444-458-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1520-491-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2448-498-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1708-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1232-525-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1008-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019fd4-257.dat upx behavioral1/memory/1664-248-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d62-232.dat upx behavioral1/memory/2536-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1512-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019c3c-213.dat upx behavioral1/memory/2560-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2128-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2896-590-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1932-663-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1948-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1520-761-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/732-748-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960c-123.dat upx behavioral1/memory/2424-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c7-112.dat upx behavioral1/memory/1804-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2972-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000018b05-77.dat upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtvnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxdfft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrrjdnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnphjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfttfht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjtbfdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfvrtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxhvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhlfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxdnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bldhvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbhtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnpjphx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvnlnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbrbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjbnjrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhthd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlrpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndtbpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjbdthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fphptx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxfbpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnxvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnlhjjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbrpff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddrvbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trtrrtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnxllvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfhtph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbtbbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2796 wrote to memory of 2864 2796 8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe 30 PID 2796 wrote to memory of 2864 2796 8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe 30 PID 2796 wrote to memory of 2864 2796 8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe 30 PID 2796 wrote to memory of 2864 2796 8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe 30 PID 2864 wrote to memory of 2812 2864 pvbhpp.exe 31 PID 2864 wrote to memory of 2812 2864 pvbhpp.exe 31 PID 2864 wrote to memory of 2812 2864 pvbhpp.exe 31 PID 2864 wrote to memory of 2812 2864 pvbhpp.exe 31 PID 2812 wrote to memory of 2916 2812 vrprjv.exe 32 PID 2812 wrote to memory of 2916 2812 vrprjv.exe 32 PID 2812 wrote to memory of 2916 2812 vrprjv.exe 32 PID 2812 wrote to memory of 2916 2812 vrprjv.exe 32 PID 2916 wrote to memory of 3028 2916 fnxxnrb.exe 33 PID 2916 wrote to memory of 3028 2916 fnxxnrb.exe 33 PID 2916 wrote to memory of 3028 2916 fnxxnrb.exe 33 PID 2916 wrote to memory of 3028 2916 fnxxnrb.exe 33 PID 3028 wrote to memory of 2884 3028 rvdvl.exe 319 PID 3028 wrote to memory of 2884 3028 rvdvl.exe 319 PID 3028 wrote to memory of 2884 3028 rvdvl.exe 319 PID 3028 wrote to memory of 2884 3028 rvdvl.exe 319 PID 2884 wrote to memory of 2740 2884 rtvnbx.exe 366 PID 2884 wrote to memory of 2740 2884 rtvnbx.exe 366 PID 2884 wrote to memory of 2740 2884 rtvnbx.exe 366 PID 2884 wrote to memory of 2740 2884 rtvnbx.exe 366 PID 2740 wrote to memory of 2288 2740 vvjjd.exe 36 PID 2740 wrote to memory of 2288 2740 vvjjd.exe 36 PID 2740 wrote to memory of 2288 2740 vvjjd.exe 36 PID 2740 wrote to memory of 2288 2740 vvjjd.exe 36 PID 2288 wrote to memory of 2972 2288 nfdnpvb.exe 37 PID 2288 wrote to memory of 2972 2288 nfdnpvb.exe 37 PID 2288 wrote to memory of 2972 2288 nfdnpvb.exe 37 PID 2288 wrote to memory of 2972 2288 nfdnpvb.exe 37 PID 2972 wrote to memory of 1804 2972 txdvnhd.exe 326 PID 2972 wrote to memory of 1804 2972 txdvnhd.exe 326 PID 2972 wrote to memory of 1804 2972 txdvnhd.exe 326 PID 2972 wrote to memory of 1804 2972 txdvnhd.exe 326 PID 1804 wrote to memory of 2300 1804 fdjxrld.exe 157 PID 1804 wrote to memory of 2300 1804 fdjxrld.exe 157 PID 1804 wrote to memory of 2300 1804 fdjxrld.exe 157 PID 1804 wrote to memory of 2300 1804 fdjxrld.exe 157 PID 2300 wrote to memory of 1652 2300 dtnpnhf.exe 331 PID 2300 wrote to memory of 1652 2300 dtnpnhf.exe 331 PID 2300 wrote to memory of 1652 2300 dtnpnhf.exe 331 PID 2300 wrote to memory of 1652 2300 dtnpnhf.exe 331 PID 1652 wrote to memory of 1936 1652 dthndtl.exe 290 PID 1652 wrote to memory of 1936 1652 dthndtl.exe 290 PID 1652 wrote to memory of 1936 1652 dthndtl.exe 290 PID 1652 wrote to memory of 1936 1652 dthndtl.exe 290 PID 1936 wrote to memory of 2424 1936 rxrdj.exe 422 PID 1936 wrote to memory of 2424 1936 rxrdj.exe 422 PID 1936 wrote to memory of 2424 1936 rxrdj.exe 422 PID 1936 wrote to memory of 2424 1936 rxrdj.exe 422 PID 2424 wrote to memory of 3008 2424 lxtbbf.exe 43 PID 2424 wrote to memory of 3008 2424 lxtbbf.exe 43 PID 2424 wrote to memory of 3008 2424 lxtbbf.exe 43 PID 2424 wrote to memory of 3008 2424 lxtbbf.exe 43 PID 3008 wrote to memory of 1948 3008 dbbnl.exe 420 PID 3008 wrote to memory of 1948 3008 dbbnl.exe 420 PID 3008 wrote to memory of 1948 3008 dbbnl.exe 420 PID 3008 wrote to memory of 1948 3008 dbbnl.exe 420 PID 1948 wrote to memory of 868 1948 bxvbddx.exe 250 PID 1948 wrote to memory of 868 1948 bxvbddx.exe 250 PID 1948 wrote to memory of 868 1948 bxvbddx.exe 250 PID 1948 wrote to memory of 868 1948 bxvbddx.exe 250
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe"C:\Users\Admin\AppData\Local\Temp\8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\pvbhpp.exec:\pvbhpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\vrprjv.exec:\vrprjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\fnxxnrb.exec:\fnxxnrb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\rvdvl.exec:\rvdvl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\rtvnbx.exec:\rtvnbx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\vvjjd.exec:\vvjjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\nfdnpvb.exec:\nfdnpvb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\txdvnhd.exec:\txdvnhd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\fdjxrld.exec:\fdjxrld.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\dtnpnhf.exec:\dtnpnhf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\dthndtl.exec:\dthndtl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\rxrdj.exec:\rxrdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\lxtbbf.exec:\lxtbbf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\dbbnl.exec:\dbbnl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\bxvbddx.exec:\bxvbddx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\ltvvfd.exec:\ltvvfd.exe17⤵
- Executes dropped EXE
PID:868 -
\??\c:\tpdvf.exec:\tpdvf.exe18⤵
- Executes dropped EXE
PID:1084 -
\??\c:\trlnbfh.exec:\trlnbfh.exe19⤵
- Executes dropped EXE
PID:1748 -
\??\c:\fnjnh.exec:\fnjnh.exe20⤵
- Executes dropped EXE
PID:2488 -
\??\c:\rjrhvrd.exec:\rjrhvrd.exe21⤵
- Executes dropped EXE
PID:2128 -
\??\c:\bbrvphr.exec:\bbrvphr.exe22⤵
- Executes dropped EXE
PID:2088 -
\??\c:\hhljvp.exec:\hhljvp.exe23⤵
- Executes dropped EXE
PID:2560 -
\??\c:\vnpdtfd.exec:\vnpdtfd.exe24⤵
- Executes dropped EXE
PID:1512 -
\??\c:\bbnjb.exec:\bbnjb.exe25⤵
- Executes dropped EXE
PID:2536 -
\??\c:\dfhnj.exec:\dfhnj.exe26⤵
- Executes dropped EXE
PID:1736 -
\??\c:\xvnrvl.exec:\xvnrvl.exe27⤵
- Executes dropped EXE
PID:1588 -
\??\c:\lnldnrl.exec:\lnldnrl.exe28⤵
- Executes dropped EXE
PID:1664 -
\??\c:\xtrhfr.exec:\xtrhfr.exe29⤵
- Executes dropped EXE
PID:284 -
\??\c:\pbhpj.exec:\pbhpj.exe30⤵
- Executes dropped EXE
PID:1008 -
\??\c:\ftxbjv.exec:\ftxbjv.exe31⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ljblh.exec:\ljblh.exe32⤵
- Executes dropped EXE
PID:2592 -
\??\c:\nbjdl.exec:\nbjdl.exe33⤵
- Executes dropped EXE
PID:3052 -
\??\c:\lnhdv.exec:\lnhdv.exe34⤵
- Executes dropped EXE
PID:2904 -
\??\c:\dnbfpxv.exec:\dnbfpxv.exe35⤵
- Executes dropped EXE
PID:2856 -
\??\c:\pptlxx.exec:\pptlxx.exe36⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vbrfbtr.exec:\vbrfbtr.exe37⤵
- Executes dropped EXE
PID:2692 -
\??\c:\bxvfdr.exec:\bxvfdr.exe38⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jrxrnh.exec:\jrxrnh.exe39⤵
- Executes dropped EXE
PID:2756 -
\??\c:\ltlpd.exec:\ltlpd.exe40⤵
- Executes dropped EXE
PID:1236 -
\??\c:\xblbpd.exec:\xblbpd.exe41⤵
- Executes dropped EXE
PID:1888 -
\??\c:\tlvpdfd.exec:\tlvpdfd.exe42⤵
- Executes dropped EXE
PID:1036 -
\??\c:\jjlvxnp.exec:\jjlvxnp.exe43⤵
- Executes dropped EXE
PID:2712 -
\??\c:\lnfnj.exec:\lnfnj.exe44⤵
- Executes dropped EXE
PID:1172 -
\??\c:\hbdnfxd.exec:\hbdnfxd.exe45⤵
- Executes dropped EXE
PID:2216 -
\??\c:\jtttj.exec:\jtttj.exe46⤵
- Executes dropped EXE
PID:2260 -
\??\c:\hfhxdh.exec:\hfhxdh.exe47⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vjvvrr.exec:\vjvvrr.exe48⤵
- Executes dropped EXE
PID:2152 -
\??\c:\bxfjd.exec:\bxfjd.exe49⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ndfrd.exec:\ndfrd.exe50⤵
- Executes dropped EXE
PID:3020 -
\??\c:\dnvjrph.exec:\dnvjrph.exe51⤵
- Executes dropped EXE
PID:2420 -
\??\c:\bpjnbdf.exec:\bpjnbdf.exe52⤵
- Executes dropped EXE
PID:2988 -
\??\c:\fffdtpp.exec:\fffdtpp.exe53⤵
- Executes dropped EXE
PID:3000 -
\??\c:\fppphl.exec:\fppphl.exe54⤵
- Executes dropped EXE
PID:2816 -
\??\c:\rbhff.exec:\rbhff.exe55⤵
- Executes dropped EXE
PID:676 -
\??\c:\bpnlln.exec:\bpnlln.exe56⤵
- Executes dropped EXE
PID:760 -
\??\c:\vtddhnr.exec:\vtddhnr.exe57⤵
- Executes dropped EXE
PID:2064 -
\??\c:\trjhv.exec:\trjhv.exe58⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vvhrft.exec:\vvhrft.exe59⤵
- Executes dropped EXE
PID:2632 -
\??\c:\trtrv.exec:\trtrv.exe60⤵
- Executes dropped EXE
PID:1624 -
\??\c:\rbtxv.exec:\rbtxv.exe61⤵
- Executes dropped EXE
PID:2560 -
\??\c:\bxhvb.exec:\bxhvb.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1520 -
\??\c:\tphntdf.exec:\tphntdf.exe63⤵
- Executes dropped EXE
PID:2448 -
\??\c:\btxxf.exec:\btxxf.exe64⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vtbdj.exec:\vtbdj.exe65⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nvnfr.exec:\nvnfr.exe66⤵PID:1752
-
\??\c:\rtphd.exec:\rtphd.exe67⤵PID:2468
-
\??\c:\nfnfr.exec:\nfnfr.exe68⤵PID:1232
-
\??\c:\rbjllr.exec:\rbjllr.exe69⤵PID:1688
-
\??\c:\pvvbfr.exec:\pvvbfr.exe70⤵PID:2116
-
\??\c:\ndbvtx.exec:\ndbvtx.exe71⤵PID:1708
-
\??\c:\nvfjhx.exec:\nvfjhx.exe72⤵PID:2676
-
\??\c:\vvvlv.exec:\vvvlv.exe73⤵PID:588
-
\??\c:\xjjxr.exec:\xjjxr.exe74⤵PID:1568
-
\??\c:\nrvphp.exec:\nrvphp.exe75⤵PID:2696
-
\??\c:\jtjtpp.exec:\jtjtpp.exe76⤵PID:2268
-
\??\c:\rlbvn.exec:\rlbvn.exe77⤵PID:2896
-
\??\c:\lnpbt.exec:\lnpbt.exe78⤵PID:3028
-
\??\c:\thjdp.exec:\thjdp.exe79⤵PID:2724
-
\??\c:\bfbldvn.exec:\bfbldvn.exe80⤵PID:1420
-
\??\c:\dvjhhnv.exec:\dvjhhnv.exe81⤵PID:3016
-
\??\c:\ppjblld.exec:\ppjblld.exe82⤵PID:1276
-
\??\c:\fhrvn.exec:\fhrvn.exe83⤵PID:2096
-
\??\c:\dpxhx.exec:\dpxhx.exe84⤵PID:2644
-
\??\c:\bxddj.exec:\bxddj.exe85⤵PID:1596
-
\??\c:\xlthdb.exec:\xlthdb.exe86⤵PID:2524
-
\??\c:\dvtrdt.exec:\dvtrdt.exe87⤵PID:2852
-
\??\c:\bjntnnd.exec:\bjntnnd.exe88⤵PID:1156
-
\??\c:\nnnph.exec:\nnnph.exe89⤵PID:1932
-
\??\c:\bdnxjr.exec:\bdnxjr.exe90⤵PID:2152
-
\??\c:\bfnvjv.exec:\bfnvjv.exe91⤵PID:2176
-
\??\c:\frdhvb.exec:\frdhvb.exe92⤵PID:1944
-
\??\c:\rfxvprx.exec:\rfxvprx.exe93⤵PID:648
-
\??\c:\ptvpjx.exec:\ptvpjx.exe94⤵PID:1188
-
\??\c:\vjbrjpj.exec:\vjbrjpj.exe95⤵PID:2136
-
\??\c:\vbrrrd.exec:\vbrrrd.exe96⤵PID:2144
-
\??\c:\bxdndpt.exec:\bxdndpt.exe97⤵PID:2252
-
\??\c:\bbbrj.exec:\bbbrj.exe98⤵PID:2376
-
\??\c:\fnndjlb.exec:\fnndjlb.exe99⤵PID:516
-
\??\c:\rthdlf.exec:\rthdlf.exe100⤵PID:2400
-
\??\c:\brhpx.exec:\brhpx.exe101⤵PID:788
-
\??\c:\fllnrtd.exec:\fllnrtd.exe102⤵PID:1800
-
\??\c:\bbxxltf.exec:\bbxxltf.exe103⤵PID:1624
-
\??\c:\pfnfdtp.exec:\pfnfdtp.exe104⤵PID:732
-
\??\c:\fhndd.exec:\fhndd.exe105⤵PID:1520
-
\??\c:\jhtvftx.exec:\jhtvftx.exe106⤵PID:1816
-
\??\c:\ffhxntj.exec:\ffhxntj.exe107⤵PID:2312
-
\??\c:\ndjvvj.exec:\ndjvvj.exe108⤵PID:1736
-
\??\c:\nltrbb.exec:\nltrbb.exe109⤵PID:1956
-
\??\c:\bjnfft.exec:\bjnfft.exe110⤵PID:612
-
\??\c:\dptpx.exec:\dptpx.exe111⤵PID:1068
-
\??\c:\ddrvbp.exec:\ddrvbp.exe112⤵
- System Location Discovery: System Language Discovery
PID:2308 -
\??\c:\jdvhdpj.exec:\jdvhdpj.exe113⤵PID:2636
-
\??\c:\tnhxf.exec:\tnhxf.exe114⤵PID:284
-
\??\c:\fdrbrfv.exec:\fdrbrfv.exe115⤵PID:2872
-
\??\c:\vvbpphr.exec:\vvbpphr.exe116⤵PID:2920
-
\??\c:\vxnlvn.exec:\vxnlvn.exe117⤵PID:2708
-
\??\c:\brxlx.exec:\brxlx.exe118⤵PID:2924
-
\??\c:\rjbnjrf.exec:\rjbnjrf.exe119⤵
- System Location Discovery: System Language Discovery
PID:2840 -
\??\c:\dnbbnpj.exec:\dnbbnpj.exe120⤵PID:1668
-
\??\c:\brhbtld.exec:\brhbtld.exe121⤵PID:2780
-
\??\c:\pxlrjdd.exec:\pxlrjdd.exe122⤵PID:1768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-