Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 23:36
Static task
static1
Behavioral task
behavioral1
Sample
892cabcf2f712dbd6d20073858c3090fc34596eb03fa9d9d2143d1c0c9549d7e.exe
Resource
win7-20241010-en
General
-
Target
892cabcf2f712dbd6d20073858c3090fc34596eb03fa9d9d2143d1c0c9549d7e.exe
-
Size
454KB
-
MD5
32c503734c19314ee45dd6faee045a7e
-
SHA1
7e30ff9341d3c82ebe21fa4b68dc8bcaca8809a3
-
SHA256
892cabcf2f712dbd6d20073858c3090fc34596eb03fa9d9d2143d1c0c9549d7e
-
SHA512
69e660f4d669c3451cf05f8fe1b7bde9afdc9603d6010ea27d67c694215f1dec3bb74bb0412d6b84206dc10e5cbe80beb55b9544047745add4fbfdd1171d666b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbecMt:q7Tc2NYHUrAwfMp3CDpt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2448-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-45-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2916-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1292-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-208-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2156-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1116-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-298-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2644-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-415-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2316-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-522-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1020-564-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2784-640-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-654-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2424-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-706-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-714-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1580-771-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2900-918-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1956-1013-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2768 vptdtrb.exe 2724 dlvlr.exe 2436 tbjll.exe 2916 jbphpd.exe 2792 tnfdl.exe 2640 ltptjpt.exe 2072 nvnnfv.exe 2688 jhlnrt.exe 2200 brnrb.exe 2004 rtxbr.exe 2316 dxxrp.exe 2720 rjtlp.exe 1816 pnxlfvt.exe 2008 dlrlbnh.exe 1452 tvrtnhf.exe 752 hdjrv.exe 1744 fjbpxrb.exe 2164 rltrrl.exe 1292 drfdv.exe 2244 prpphdl.exe 2512 bjbnp.exe 2156 hhfrdb.exe 1116 lhbppvn.exe 1056 ttvjldv.exe 1492 vptlrf.exe 1984 rfpjdxb.exe 360 lddfr.exe 2220 dvtblbn.exe 1560 vpjxr.exe 1316 hxpvnpj.exe 2216 pbhnntr.exe 1040 pfxlvn.exe 2448 ldnlbvp.exe 2816 dbfnvbh.exe 1552 tfpnb.exe 2628 nxhtj.exe 3004 pfbnr.exe 2644 jtrllfx.exe 2916 fvhhx.exe 2616 rtptlv.exe 1936 fxnnn.exe 2640 bxxbnt.exe 1380 fljxr.exe 428 tfjtfdb.exe 2148 hlxjlbh.exe 2500 trdnv.exe 2312 lxdfx.exe 2948 djrvll.exe 2316 fjvhp.exe 1304 ndjnxh.exe 864 hlnptlt.exe 572 dbtpjvj.exe 2152 jnntj.exe 2020 plhlb.exe 752 fxtjr.exe 2160 trfdr.exe 2348 vlvbrfj.exe 2364 hvpntxj.exe 2396 dnttbh.exe 2244 rxfpjvj.exe 768 rjjnhll.exe 1844 pfljlt.exe 1088 xpnrf.exe 1980 xxnhvv.exe -
resource yara_rule behavioral1/memory/2448-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-298-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2644-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-522-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1784-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-819-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-866-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-919-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-1000-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxnfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndndh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdpxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbfdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvnfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbbpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltptjpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phbxpvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjjll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrtfnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhjldn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjrxphp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttvblj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljxxlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dltvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftnvbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnlfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlhxppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdhvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpltl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlbtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvvbpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdjrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllhhph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrvpntd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhldltl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlbldf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jptnhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txpftnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpthjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttfdpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfpxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjptxjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfnxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2448 wrote to memory of 2768 2448 892cabcf2f712dbd6d20073858c3090fc34596eb03fa9d9d2143d1c0c9549d7e.exe 30 PID 2448 wrote to memory of 2768 2448 892cabcf2f712dbd6d20073858c3090fc34596eb03fa9d9d2143d1c0c9549d7e.exe 30 PID 2448 wrote to memory of 2768 2448 892cabcf2f712dbd6d20073858c3090fc34596eb03fa9d9d2143d1c0c9549d7e.exe 30 PID 2448 wrote to memory of 2768 2448 892cabcf2f712dbd6d20073858c3090fc34596eb03fa9d9d2143d1c0c9549d7e.exe 30 PID 2768 wrote to memory of 2724 2768 vptdtrb.exe 31 PID 2768 wrote to memory of 2724 2768 vptdtrb.exe 31 PID 2768 wrote to memory of 2724 2768 vptdtrb.exe 31 PID 2768 wrote to memory of 2724 2768 vptdtrb.exe 31 PID 2724 wrote to memory of 2436 2724 dlvlr.exe 32 PID 2724 wrote to memory of 2436 2724 dlvlr.exe 32 PID 2724 wrote to memory of 2436 2724 dlvlr.exe 32 PID 2724 wrote to memory of 2436 2724 dlvlr.exe 32 PID 2436 wrote to memory of 2916 2436 tbjll.exe 33 PID 2436 wrote to memory of 2916 2436 tbjll.exe 33 PID 2436 wrote to memory of 2916 2436 tbjll.exe 33 PID 2436 wrote to memory of 2916 2436 tbjll.exe 33 PID 2916 wrote to memory of 2792 2916 jbphpd.exe 34 PID 2916 wrote to memory of 2792 2916 jbphpd.exe 34 PID 2916 wrote to memory of 2792 2916 jbphpd.exe 34 PID 2916 wrote to memory of 2792 2916 jbphpd.exe 34 PID 2792 wrote to memory of 2640 2792 tnfdl.exe 35 PID 2792 wrote to memory of 2640 2792 tnfdl.exe 35 PID 2792 wrote to memory of 2640 2792 tnfdl.exe 35 PID 2792 wrote to memory of 2640 2792 tnfdl.exe 35 PID 2640 wrote to memory of 2072 2640 ltptjpt.exe 36 PID 2640 wrote to memory of 2072 2640 ltptjpt.exe 36 PID 2640 wrote to memory of 2072 2640 ltptjpt.exe 36 PID 2640 wrote to memory of 2072 2640 ltptjpt.exe 36 PID 2072 wrote to memory of 2688 2072 nvnnfv.exe 37 PID 2072 wrote to memory of 2688 2072 nvnnfv.exe 37 PID 2072 wrote to memory of 2688 2072 nvnnfv.exe 37 PID 2072 wrote to memory of 2688 2072 nvnnfv.exe 37 PID 2688 wrote to memory of 2200 2688 jhlnrt.exe 38 PID 2688 wrote to memory of 2200 2688 jhlnrt.exe 38 PID 2688 wrote to memory of 2200 2688 jhlnrt.exe 38 PID 2688 wrote to memory of 2200 2688 jhlnrt.exe 38 PID 2200 wrote to memory of 2004 2200 brnrb.exe 39 PID 2200 wrote to memory of 2004 2200 brnrb.exe 39 PID 2200 wrote to memory of 2004 2200 brnrb.exe 39 PID 2200 wrote to memory of 2004 2200 brnrb.exe 39 PID 2004 wrote to memory of 2316 2004 rtxbr.exe 40 PID 2004 wrote to memory of 2316 2004 rtxbr.exe 40 PID 2004 wrote to memory of 2316 2004 rtxbr.exe 40 PID 2004 wrote to memory of 2316 2004 rtxbr.exe 40 PID 2316 wrote to memory of 2720 2316 dxxrp.exe 41 PID 2316 wrote to memory of 2720 2316 dxxrp.exe 41 PID 2316 wrote to memory of 2720 2316 dxxrp.exe 41 PID 2316 wrote to memory of 2720 2316 dxxrp.exe 41 PID 2720 wrote to memory of 1816 2720 rjtlp.exe 42 PID 2720 wrote to memory of 1816 2720 rjtlp.exe 42 PID 2720 wrote to memory of 1816 2720 rjtlp.exe 42 PID 2720 wrote to memory of 1816 2720 rjtlp.exe 42 PID 1816 wrote to memory of 2008 1816 pnxlfvt.exe 43 PID 1816 wrote to memory of 2008 1816 pnxlfvt.exe 43 PID 1816 wrote to memory of 2008 1816 pnxlfvt.exe 43 PID 1816 wrote to memory of 2008 1816 pnxlfvt.exe 43 PID 2008 wrote to memory of 1452 2008 dlrlbnh.exe 44 PID 2008 wrote to memory of 1452 2008 dlrlbnh.exe 44 PID 2008 wrote to memory of 1452 2008 dlrlbnh.exe 44 PID 2008 wrote to memory of 1452 2008 dlrlbnh.exe 44 PID 1452 wrote to memory of 752 1452 tvrtnhf.exe 45 PID 1452 wrote to memory of 752 1452 tvrtnhf.exe 45 PID 1452 wrote to memory of 752 1452 tvrtnhf.exe 45 PID 1452 wrote to memory of 752 1452 tvrtnhf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\892cabcf2f712dbd6d20073858c3090fc34596eb03fa9d9d2143d1c0c9549d7e.exe"C:\Users\Admin\AppData\Local\Temp\892cabcf2f712dbd6d20073858c3090fc34596eb03fa9d9d2143d1c0c9549d7e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\vptdtrb.exec:\vptdtrb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\dlvlr.exec:\dlvlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\tbjll.exec:\tbjll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\jbphpd.exec:\jbphpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\tnfdl.exec:\tnfdl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\ltptjpt.exec:\ltptjpt.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\nvnnfv.exec:\nvnnfv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\jhlnrt.exec:\jhlnrt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\brnrb.exec:\brnrb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\rtxbr.exec:\rtxbr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\dxxrp.exec:\dxxrp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\rjtlp.exec:\rjtlp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\pnxlfvt.exec:\pnxlfvt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\dlrlbnh.exec:\dlrlbnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\tvrtnhf.exec:\tvrtnhf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\hdjrv.exec:\hdjrv.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:752 -
\??\c:\fjbpxrb.exec:\fjbpxrb.exe18⤵
- Executes dropped EXE
PID:1744 -
\??\c:\rltrrl.exec:\rltrrl.exe19⤵
- Executes dropped EXE
PID:2164 -
\??\c:\drfdv.exec:\drfdv.exe20⤵
- Executes dropped EXE
PID:1292 -
\??\c:\prpphdl.exec:\prpphdl.exe21⤵
- Executes dropped EXE
PID:2244 -
\??\c:\bjbnp.exec:\bjbnp.exe22⤵
- Executes dropped EXE
PID:2512 -
\??\c:\hhfrdb.exec:\hhfrdb.exe23⤵
- Executes dropped EXE
PID:2156 -
\??\c:\lhbppvn.exec:\lhbppvn.exe24⤵
- Executes dropped EXE
PID:1116 -
\??\c:\ttvjldv.exec:\ttvjldv.exe25⤵
- Executes dropped EXE
PID:1056 -
\??\c:\vptlrf.exec:\vptlrf.exe26⤵
- Executes dropped EXE
PID:1492 -
\??\c:\rfpjdxb.exec:\rfpjdxb.exe27⤵
- Executes dropped EXE
PID:1984 -
\??\c:\lddfr.exec:\lddfr.exe28⤵
- Executes dropped EXE
PID:360 -
\??\c:\dvtblbn.exec:\dvtblbn.exe29⤵
- Executes dropped EXE
PID:2220 -
\??\c:\vpjxr.exec:\vpjxr.exe30⤵
- Executes dropped EXE
PID:1560 -
\??\c:\hxpvnpj.exec:\hxpvnpj.exe31⤵
- Executes dropped EXE
PID:1316 -
\??\c:\pbhnntr.exec:\pbhnntr.exe32⤵
- Executes dropped EXE
PID:2216 -
\??\c:\pfxlvn.exec:\pfxlvn.exe33⤵
- Executes dropped EXE
PID:1040 -
\??\c:\ldnlbvp.exec:\ldnlbvp.exe34⤵
- Executes dropped EXE
PID:2448 -
\??\c:\dbfnvbh.exec:\dbfnvbh.exe35⤵
- Executes dropped EXE
PID:2816 -
\??\c:\tfpnb.exec:\tfpnb.exe36⤵
- Executes dropped EXE
PID:1552 -
\??\c:\nxhtj.exec:\nxhtj.exe37⤵
- Executes dropped EXE
PID:2628 -
\??\c:\pfbnr.exec:\pfbnr.exe38⤵
- Executes dropped EXE
PID:3004 -
\??\c:\jtrllfx.exec:\jtrllfx.exe39⤵
- Executes dropped EXE
PID:2644 -
\??\c:\fvhhx.exec:\fvhhx.exe40⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rtptlv.exec:\rtptlv.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\fxnnn.exec:\fxnnn.exe42⤵
- Executes dropped EXE
PID:1936 -
\??\c:\bxxbnt.exec:\bxxbnt.exe43⤵
- Executes dropped EXE
PID:2640 -
\??\c:\fljxr.exec:\fljxr.exe44⤵
- Executes dropped EXE
PID:1380 -
\??\c:\tfjtfdb.exec:\tfjtfdb.exe45⤵
- Executes dropped EXE
PID:428 -
\??\c:\hlxjlbh.exec:\hlxjlbh.exe46⤵
- Executes dropped EXE
PID:2148 -
\??\c:\trdnv.exec:\trdnv.exe47⤵
- Executes dropped EXE
PID:2500 -
\??\c:\lxdfx.exec:\lxdfx.exe48⤵
- Executes dropped EXE
PID:2312 -
\??\c:\djrvll.exec:\djrvll.exe49⤵
- Executes dropped EXE
PID:2948 -
\??\c:\fjvhp.exec:\fjvhp.exe50⤵
- Executes dropped EXE
PID:2316 -
\??\c:\ndjnxh.exec:\ndjnxh.exe51⤵
- Executes dropped EXE
PID:1304 -
\??\c:\hlnptlt.exec:\hlnptlt.exe52⤵
- Executes dropped EXE
PID:864 -
\??\c:\dbtpjvj.exec:\dbtpjvj.exe53⤵
- Executes dropped EXE
PID:572 -
\??\c:\jnntj.exec:\jnntj.exe54⤵
- Executes dropped EXE
PID:2152 -
\??\c:\plhlb.exec:\plhlb.exe55⤵
- Executes dropped EXE
PID:2020 -
\??\c:\fxtjr.exec:\fxtjr.exe56⤵
- Executes dropped EXE
PID:752 -
\??\c:\trfdr.exec:\trfdr.exe57⤵
- Executes dropped EXE
PID:2160 -
\??\c:\vlvbrfj.exec:\vlvbrfj.exe58⤵
- Executes dropped EXE
PID:2348 -
\??\c:\hvpntxj.exec:\hvpntxj.exe59⤵
- Executes dropped EXE
PID:2364 -
\??\c:\dnttbh.exec:\dnttbh.exe60⤵
- Executes dropped EXE
PID:2396 -
\??\c:\rxfpjvj.exec:\rxfpjvj.exe61⤵
- Executes dropped EXE
PID:2244 -
\??\c:\rjjnhll.exec:\rjjnhll.exe62⤵
- Executes dropped EXE
PID:768 -
\??\c:\pfljlt.exec:\pfljlt.exe63⤵
- Executes dropped EXE
PID:1844 -
\??\c:\xpnrf.exec:\xpnrf.exe64⤵
- Executes dropped EXE
PID:1088 -
\??\c:\xxnhvv.exec:\xxnhvv.exe65⤵
- Executes dropped EXE
PID:1980 -
\??\c:\ffbpprx.exec:\ffbpprx.exe66⤵PID:1336
-
\??\c:\ndllt.exec:\ndllt.exe67⤵PID:1756
-
\??\c:\tdfhdh.exec:\tdfhdh.exe68⤵PID:1492
-
\??\c:\xtbxjpn.exec:\xtbxjpn.exe69⤵PID:1984
-
\??\c:\ljdfj.exec:\ljdfj.exe70⤵PID:360
-
\??\c:\ftlltx.exec:\ftlltx.exe71⤵PID:1636
-
\??\c:\nxvlnl.exec:\nxvlnl.exe72⤵PID:2540
-
\??\c:\flrfv.exec:\flrfv.exe73⤵PID:1020
-
\??\c:\vpdlxjx.exec:\vpdlxjx.exe74⤵PID:884
-
\??\c:\jrrdjvd.exec:\jrrdjvd.exe75⤵PID:1732
-
\??\c:\rdjtjxd.exec:\rdjtjxd.exe76⤵PID:1940
-
\??\c:\vfvlnf.exec:\vfvlnf.exe77⤵PID:2836
-
\??\c:\blrdrxj.exec:\blrdrxj.exe78⤵PID:2448
-
\??\c:\ffjrf.exec:\ffjrf.exe79⤵PID:2744
-
\??\c:\hhjhv.exec:\hhjhv.exe80⤵PID:1540
-
\??\c:\dvjhlld.exec:\dvjhlld.exe81⤵PID:2628
-
\??\c:\rxfxjr.exec:\rxfxjr.exe82⤵PID:1784
-
\??\c:\xhvnln.exec:\xhvnln.exe83⤵PID:2932
-
\??\c:\tdtdv.exec:\tdtdv.exe84⤵PID:2876
-
\??\c:\nbjdrxl.exec:\nbjdrxl.exe85⤵PID:2784
-
\??\c:\hddhl.exec:\hddhl.exe86⤵PID:2652
-
\??\c:\jbxtdvn.exec:\jbxtdvn.exe87⤵PID:2072
-
\??\c:\hlldb.exec:\hlldb.exe88⤵PID:604
-
\??\c:\lhphj.exec:\lhphj.exe89⤵PID:796
-
\??\c:\dxttjd.exec:\dxttjd.exe90⤵PID:2204
-
\??\c:\hrtljxb.exec:\hrtljxb.exe91⤵PID:2424
-
\??\c:\vtjfrb.exec:\vtjfrb.exe92⤵PID:2680
-
\??\c:\xljtpff.exec:\xljtpff.exe93⤵PID:2508
-
\??\c:\bllrhdr.exec:\bllrhdr.exe94⤵PID:2104
-
\??\c:\vplxd.exec:\vplxd.exe95⤵PID:2912
-
\??\c:\xnlvfbv.exec:\xnlvfbv.exe96⤵PID:568
-
\??\c:\lxdnfp.exec:\lxdnfp.exe97⤵PID:2928
-
\??\c:\jrpbn.exec:\jrpbn.exe98⤵PID:296
-
\??\c:\blvnh.exec:\blvnh.exe99⤵PID:1608
-
\??\c:\tbphbdr.exec:\tbphbdr.exe100⤵PID:1744
-
\??\c:\nrxnpjx.exec:\nrxnpjx.exe101⤵PID:1912
-
\??\c:\tnbpfdv.exec:\tnbpfdv.exe102⤵PID:1796
-
\??\c:\fnjxxjv.exec:\fnjxxjv.exe103⤵PID:2288
-
\??\c:\lfpfp.exec:\lfpfp.exe104⤵PID:2452
-
\??\c:\bltjtrj.exec:\bltjtrj.exe105⤵PID:1580
-
\??\c:\vnjlp.exec:\vnjlp.exe106⤵PID:1768
-
\??\c:\hvxtb.exec:\hvxtb.exe107⤵PID:1572
-
\??\c:\rrrdnv.exec:\rrrdnv.exe108⤵PID:984
-
\??\c:\pfxhf.exec:\pfxhf.exe109⤵PID:600
-
\??\c:\jtlvfn.exec:\jtlvfn.exe110⤵PID:1464
-
\??\c:\hrfbbxh.exec:\hrfbbxh.exe111⤵PID:1588
-
\??\c:\pbxlj.exec:\pbxlj.exe112⤵PID:1688
-
\??\c:\ttvblj.exec:\ttvblj.exe113⤵
- System Location Discovery: System Language Discovery
PID:2132 -
\??\c:\htpvjnv.exec:\htpvjnv.exe114⤵PID:360
-
\??\c:\vhddxt.exec:\vhddxt.exe115⤵PID:2536
-
\??\c:\dtxdfb.exec:\dtxdfb.exe116⤵PID:1144
-
\??\c:\tjjlr.exec:\tjjlr.exe117⤵PID:304
-
\??\c:\vprlp.exec:\vprlp.exe118⤵PID:2528
-
\??\c:\bvfhx.exec:\bvfhx.exe119⤵PID:1808
-
\??\c:\rpnjdrl.exec:\rpnjdrl.exe120⤵PID:1288
-
\??\c:\jljbv.exec:\jljbv.exe121⤵PID:2760
-
\??\c:\fxnvhtl.exec:\fxnvhtl.exe122⤵PID:2764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-