Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 08:59
Behavioral task
behavioral1
Sample
b51ce26f60fa71c8c2e10bafd1c55e3b4fcbcc0138f651a85757d186b7632b36N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b51ce26f60fa71c8c2e10bafd1c55e3b4fcbcc0138f651a85757d186b7632b36N.exe
-
Size
91KB
-
MD5
9049dc803102e6a4b77ba58815186d50
-
SHA1
6d9f182ecf75c75ca9a84c091b120d5a99b04d95
-
SHA256
b51ce26f60fa71c8c2e10bafd1c55e3b4fcbcc0138f651a85757d186b7632b36
-
SHA512
9f8ac765460fc41d728337cd57090f91febbb31c0eaffca1d962519774fb8e5c3e94d8bfa9bb78d540d8751b33f57b0d97cf876b8d150fca225932b1dd80e820
-
SSDEEP
1536:cvQBeOGtrYS3srx93UBWfwC6Ggnouy8HglWxR9Yii9J01qCxNiL:chOmTsF93UYfwC6GIout3xR9nx0L
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2892-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2356-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1436-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/620-189-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1660-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1660-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1724-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1288-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2256-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2256-250-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2364-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-300-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2796-297-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2088-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-407-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2960-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1316-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1440-446-0x00000000003D0000-0x00000000003F7000-memory.dmp family_blackmoon behavioral1/memory/904-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-478-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2292-548-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2892-561-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/3052-587-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-607-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-615-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1700-613-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1644-621-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1704-790-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1704-792-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1564-825-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-974-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2128-996-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/108-1058-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2876 dtjvfh.exe 2900 vlvjl.exe 1984 pbxrrx.exe 2868 xdfltt.exe 2668 hvjpvvx.exe 2788 fbfph.exe 2360 lvplhvl.exe 2000 txfpbnr.exe 2392 tddlvbt.exe 1964 dlxrjr.exe 2164 blpffpj.exe 2132 hfjplln.exe 2356 bpprfbv.exe 1940 rnvvf.exe 2260 pfxlx.exe 2220 lhrjf.exe 2028 vlvlnjp.exe 2592 blpldj.exe 1436 tddbx.exe 620 xbdtfj.exe 2096 rfrljr.exe 3012 njjvxh.exe 1660 dtlfp.exe 2596 pnfdll.exe 1724 lpxdfbv.exe 1288 rdbtbb.exe 2256 jvxbnt.exe 1936 ldllrp.exe 1696 ptvlhd.exe 2364 vlfllf.exe 2556 lbjhtvn.exe 2796 hjjrd.exe 1712 tjtxrd.exe 2088 ldhbb.exe 2920 bdjxv.exe 2700 hvbhrtb.exe 2664 xxblhp.exe 2656 httjdp.exe 2732 blvjpn.exe 876 jtxdxdl.exe 1804 btrlln.exe 2116 jbfxbf.exe 2016 lfnvrdh.exe 2528 ntpjr.exe 1504 ltthrvb.exe 2188 bjjnb.exe 2196 xbjxf.exe 2288 fdfdt.exe 2324 dbnrhtx.exe 2264 dtlprnx.exe 2960 prtjhv.exe 548 jplbddv.exe 1316 dbhnvh.exe 1440 lplhxhj.exe 2240 tdxbhr.exe 1784 fflljxd.exe 1788 flnxt.exe 904 bbfhhrl.exe 2648 dlvbhlh.exe 1744 hxvfl.exe 1776 blvdpj.exe 1660 dfhtjpb.exe 2332 jpjjj.exe 2604 jtxxtn.exe -
resource yara_rule behavioral1/memory/2892-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2892-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000012263-5.dat upx behavioral1/memory/2876-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2876-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x002d000000018b59-17.dat upx behavioral1/files/0x0009000000018f85-26.dat upx behavioral1/memory/2900-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1984-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001932a-36.dat upx behavioral1/files/0x00060000000193a0-44.dat upx behavioral1/memory/2868-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2668-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000193b8-54.dat upx behavioral1/memory/2788-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2360-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000193c7-63.dat upx behavioral1/files/0x0007000000019470-73.dat upx behavioral1/memory/2000-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000019480-81.dat upx behavioral1/memory/2392-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2392-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019fd4-91.dat upx behavioral1/memory/2164-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1964-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x002e000000018baf-99.dat upx behavioral1/files/0x0005000000019fdd-109.dat upx behavioral1/memory/2164-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a03c-117.dat upx behavioral1/files/0x000500000001a049-126.dat upx behavioral1/memory/2356-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a0b6-136.dat upx behavioral1/files/0x000500000001a309-146.dat upx behavioral1/files/0x000500000001a3f6-154.dat upx behavioral1/memory/2220-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a3f8-163.dat upx behavioral1/files/0x000500000001a3fd-170.dat upx behavioral1/memory/1436-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a400-181.dat upx behavioral1/files/0x000500000001a404-191.dat upx behavioral1/files/0x000500000001a438-198.dat upx behavioral1/files/0x000500000001a44d-207.dat upx behavioral1/memory/1660-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a44f-216.dat upx behavioral1/memory/2596-218-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1660-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a457-226.dat upx behavioral1/memory/1724-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1288-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a459-236.dat upx behavioral1/memory/1288-243-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001a463-246.dat upx behavioral1/memory/2256-248-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a469-255.dat upx behavioral1/files/0x000500000001a46b-263.dat upx behavioral1/files/0x000500000001a46d-272.dat upx behavioral1/files/0x000500000001a46f-283.dat upx behavioral1/memory/2364-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a471-290.dat upx behavioral1/memory/2796-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2796-297-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2088-313-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2920-314-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbxhtlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppxtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drhdlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnpdxbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhpnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjtdrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfndpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrjhhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjpxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfpthx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjdrjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvjnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdhlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rppxndv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdtrpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfvfbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptdvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bddlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdlfbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhvfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfbbvdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njdnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prdxvhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dphrnvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djnphnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prhndp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxfjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjllbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjhfbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdtxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dflxpbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2892 wrote to memory of 2876 2892 b51ce26f60fa71c8c2e10bafd1c55e3b4fcbcc0138f651a85757d186b7632b36N.exe 30 PID 2892 wrote to memory of 2876 2892 b51ce26f60fa71c8c2e10bafd1c55e3b4fcbcc0138f651a85757d186b7632b36N.exe 30 PID 2892 wrote to memory of 2876 2892 b51ce26f60fa71c8c2e10bafd1c55e3b4fcbcc0138f651a85757d186b7632b36N.exe 30 PID 2892 wrote to memory of 2876 2892 b51ce26f60fa71c8c2e10bafd1c55e3b4fcbcc0138f651a85757d186b7632b36N.exe 30 PID 2876 wrote to memory of 2900 2876 dtjvfh.exe 31 PID 2876 wrote to memory of 2900 2876 dtjvfh.exe 31 PID 2876 wrote to memory of 2900 2876 dtjvfh.exe 31 PID 2876 wrote to memory of 2900 2876 dtjvfh.exe 31 PID 2900 wrote to memory of 1984 2900 vlvjl.exe 32 PID 2900 wrote to memory of 1984 2900 vlvjl.exe 32 PID 2900 wrote to memory of 1984 2900 vlvjl.exe 32 PID 2900 wrote to memory of 1984 2900 vlvjl.exe 32 PID 1984 wrote to memory of 2868 1984 pbxrrx.exe 33 PID 1984 wrote to memory of 2868 1984 pbxrrx.exe 33 PID 1984 wrote to memory of 2868 1984 pbxrrx.exe 33 PID 1984 wrote to memory of 2868 1984 pbxrrx.exe 33 PID 2868 wrote to memory of 2668 2868 xdfltt.exe 34 PID 2868 wrote to memory of 2668 2868 xdfltt.exe 34 PID 2868 wrote to memory of 2668 2868 xdfltt.exe 34 PID 2868 wrote to memory of 2668 2868 xdfltt.exe 34 PID 2668 wrote to memory of 2788 2668 hvjpvvx.exe 35 PID 2668 wrote to memory of 2788 2668 hvjpvvx.exe 35 PID 2668 wrote to memory of 2788 2668 hvjpvvx.exe 35 PID 2668 wrote to memory of 2788 2668 hvjpvvx.exe 35 PID 2788 wrote to memory of 2360 2788 fbfph.exe 36 PID 2788 wrote to memory of 2360 2788 fbfph.exe 36 PID 2788 wrote to memory of 2360 2788 fbfph.exe 36 PID 2788 wrote to memory of 2360 2788 fbfph.exe 36 PID 2360 wrote to memory of 2000 2360 lvplhvl.exe 37 PID 2360 wrote to memory of 2000 2360 lvplhvl.exe 37 PID 2360 wrote to memory of 2000 2360 lvplhvl.exe 37 PID 2360 wrote to memory of 2000 2360 lvplhvl.exe 37 PID 2000 wrote to memory of 2392 2000 txfpbnr.exe 38 PID 2000 wrote to memory of 2392 2000 txfpbnr.exe 38 PID 2000 wrote to memory of 2392 2000 txfpbnr.exe 38 PID 2000 wrote to memory of 2392 2000 txfpbnr.exe 38 PID 2392 wrote to memory of 1964 2392 tddlvbt.exe 39 PID 2392 wrote to memory of 1964 2392 tddlvbt.exe 39 PID 2392 wrote to memory of 1964 2392 tddlvbt.exe 39 PID 2392 wrote to memory of 1964 2392 tddlvbt.exe 39 PID 1964 wrote to memory of 2164 1964 dlxrjr.exe 40 PID 1964 wrote to memory of 2164 1964 dlxrjr.exe 40 PID 1964 wrote to memory of 2164 1964 dlxrjr.exe 40 PID 1964 wrote to memory of 2164 1964 dlxrjr.exe 40 PID 2164 wrote to memory of 2132 2164 blpffpj.exe 41 PID 2164 wrote to memory of 2132 2164 blpffpj.exe 41 PID 2164 wrote to memory of 2132 2164 blpffpj.exe 41 PID 2164 wrote to memory of 2132 2164 blpffpj.exe 41 PID 2132 wrote to memory of 2356 2132 hfjplln.exe 42 PID 2132 wrote to memory of 2356 2132 hfjplln.exe 42 PID 2132 wrote to memory of 2356 2132 hfjplln.exe 42 PID 2132 wrote to memory of 2356 2132 hfjplln.exe 42 PID 2356 wrote to memory of 1940 2356 bpprfbv.exe 43 PID 2356 wrote to memory of 1940 2356 bpprfbv.exe 43 PID 2356 wrote to memory of 1940 2356 bpprfbv.exe 43 PID 2356 wrote to memory of 1940 2356 bpprfbv.exe 43 PID 1940 wrote to memory of 2260 1940 rnvvf.exe 44 PID 1940 wrote to memory of 2260 1940 rnvvf.exe 44 PID 1940 wrote to memory of 2260 1940 rnvvf.exe 44 PID 1940 wrote to memory of 2260 1940 rnvvf.exe 44 PID 2260 wrote to memory of 2220 2260 pfxlx.exe 45 PID 2260 wrote to memory of 2220 2260 pfxlx.exe 45 PID 2260 wrote to memory of 2220 2260 pfxlx.exe 45 PID 2260 wrote to memory of 2220 2260 pfxlx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b51ce26f60fa71c8c2e10bafd1c55e3b4fcbcc0138f651a85757d186b7632b36N.exe"C:\Users\Admin\AppData\Local\Temp\b51ce26f60fa71c8c2e10bafd1c55e3b4fcbcc0138f651a85757d186b7632b36N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\dtjvfh.exec:\dtjvfh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\vlvjl.exec:\vlvjl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\pbxrrx.exec:\pbxrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\xdfltt.exec:\xdfltt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\hvjpvvx.exec:\hvjpvvx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\fbfph.exec:\fbfph.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\lvplhvl.exec:\lvplhvl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\txfpbnr.exec:\txfpbnr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\tddlvbt.exec:\tddlvbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\dlxrjr.exec:\dlxrjr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\blpffpj.exec:\blpffpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\hfjplln.exec:\hfjplln.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\bpprfbv.exec:\bpprfbv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\rnvvf.exec:\rnvvf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\pfxlx.exec:\pfxlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\lhrjf.exec:\lhrjf.exe17⤵
- Executes dropped EXE
PID:2220 -
\??\c:\vlvlnjp.exec:\vlvlnjp.exe18⤵
- Executes dropped EXE
PID:2028 -
\??\c:\blpldj.exec:\blpldj.exe19⤵
- Executes dropped EXE
PID:2592 -
\??\c:\tddbx.exec:\tddbx.exe20⤵
- Executes dropped EXE
PID:1436 -
\??\c:\xbdtfj.exec:\xbdtfj.exe21⤵
- Executes dropped EXE
PID:620 -
\??\c:\rfrljr.exec:\rfrljr.exe22⤵
- Executes dropped EXE
PID:2096 -
\??\c:\njjvxh.exec:\njjvxh.exe23⤵
- Executes dropped EXE
PID:3012 -
\??\c:\dtlfp.exec:\dtlfp.exe24⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pnfdll.exec:\pnfdll.exe25⤵
- Executes dropped EXE
PID:2596 -
\??\c:\lpxdfbv.exec:\lpxdfbv.exe26⤵
- Executes dropped EXE
PID:1724 -
\??\c:\rdbtbb.exec:\rdbtbb.exe27⤵
- Executes dropped EXE
PID:1288 -
\??\c:\jvxbnt.exec:\jvxbnt.exe28⤵
- Executes dropped EXE
PID:2256 -
\??\c:\ldllrp.exec:\ldllrp.exe29⤵
- Executes dropped EXE
PID:1936 -
\??\c:\ptvlhd.exec:\ptvlhd.exe30⤵
- Executes dropped EXE
PID:1696 -
\??\c:\vlfllf.exec:\vlfllf.exe31⤵
- Executes dropped EXE
PID:2364 -
\??\c:\lbjhtvn.exec:\lbjhtvn.exe32⤵
- Executes dropped EXE
PID:2556 -
\??\c:\hjjrd.exec:\hjjrd.exe33⤵
- Executes dropped EXE
PID:2796 -
\??\c:\tjtxrd.exec:\tjtxrd.exe34⤵
- Executes dropped EXE
PID:1712 -
\??\c:\ldhbb.exec:\ldhbb.exe35⤵
- Executes dropped EXE
PID:2088 -
\??\c:\bdjxv.exec:\bdjxv.exe36⤵
- Executes dropped EXE
PID:2920 -
\??\c:\hvbhrtb.exec:\hvbhrtb.exe37⤵
- Executes dropped EXE
PID:2700 -
\??\c:\xxblhp.exec:\xxblhp.exe38⤵
- Executes dropped EXE
PID:2664 -
\??\c:\httjdp.exec:\httjdp.exe39⤵
- Executes dropped EXE
PID:2656 -
\??\c:\blvjpn.exec:\blvjpn.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jtxdxdl.exec:\jtxdxdl.exe41⤵
- Executes dropped EXE
PID:876 -
\??\c:\btrlln.exec:\btrlln.exe42⤵
- Executes dropped EXE
PID:1804 -
\??\c:\jbfxbf.exec:\jbfxbf.exe43⤵
- Executes dropped EXE
PID:2116 -
\??\c:\lfnvrdh.exec:\lfnvrdh.exe44⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ntpjr.exec:\ntpjr.exe45⤵
- Executes dropped EXE
PID:2528 -
\??\c:\ltthrvb.exec:\ltthrvb.exe46⤵
- Executes dropped EXE
PID:1504 -
\??\c:\bjjnb.exec:\bjjnb.exe47⤵
- Executes dropped EXE
PID:2188 -
\??\c:\xbjxf.exec:\xbjxf.exe48⤵
- Executes dropped EXE
PID:2196 -
\??\c:\fdfdt.exec:\fdfdt.exe49⤵
- Executes dropped EXE
PID:2288 -
\??\c:\dbnrhtx.exec:\dbnrhtx.exe50⤵
- Executes dropped EXE
PID:2324 -
\??\c:\dtlprnx.exec:\dtlprnx.exe51⤵
- Executes dropped EXE
PID:2264 -
\??\c:\prtjhv.exec:\prtjhv.exe52⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jplbddv.exec:\jplbddv.exe53⤵
- Executes dropped EXE
PID:548 -
\??\c:\dbhnvh.exec:\dbhnvh.exe54⤵
- Executes dropped EXE
PID:1316 -
\??\c:\lplhxhj.exec:\lplhxhj.exe55⤵
- Executes dropped EXE
PID:1440 -
\??\c:\tdxbhr.exec:\tdxbhr.exe56⤵
- Executes dropped EXE
PID:2240 -
\??\c:\fflljxd.exec:\fflljxd.exe57⤵
- Executes dropped EXE
PID:1784 -
\??\c:\flnxt.exec:\flnxt.exe58⤵
- Executes dropped EXE
PID:1788 -
\??\c:\bbfhhrl.exec:\bbfhhrl.exe59⤵
- Executes dropped EXE
PID:904 -
\??\c:\dlvbhlh.exec:\dlvbhlh.exe60⤵
- Executes dropped EXE
PID:2648 -
\??\c:\hxvfl.exec:\hxvfl.exe61⤵
- Executes dropped EXE
PID:1744 -
\??\c:\blvdpj.exec:\blvdpj.exe62⤵
- Executes dropped EXE
PID:1776 -
\??\c:\dfhtjpb.exec:\dfhtjpb.exe63⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jpjjj.exec:\jpjjj.exe64⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jtxxtn.exec:\jtxxtn.exe65⤵
- Executes dropped EXE
PID:2604 -
\??\c:\vbjbl.exec:\vbjbl.exe66⤵PID:1724
-
\??\c:\vhhhfp.exec:\vhhhfp.exe67⤵PID:2340
-
\??\c:\pphjrvx.exec:\pphjrvx.exe68⤵PID:1980
-
\??\c:\xtxvnjl.exec:\xtxvnjl.exe69⤵PID:2512
-
\??\c:\rhvldj.exec:\rhvldj.exe70⤵PID:1936
-
\??\c:\nddpdrp.exec:\nddpdrp.exe71⤵PID:2292
-
\??\c:\hrdfhr.exec:\hrdfhr.exe72⤵PID:880
-
\??\c:\bnpxd.exec:\bnpxd.exe73⤵PID:2892
-
\??\c:\ldxxlj.exec:\ldxxlj.exe74⤵PID:1988
-
\??\c:\jvftb.exec:\jvftb.exe75⤵PID:1576
-
\??\c:\jjfvplt.exec:\jjfvplt.exe76⤵PID:2944
-
\??\c:\lfxpvdd.exec:\lfxpvdd.exe77⤵PID:3052
-
\??\c:\txvrj.exec:\txvrj.exe78⤵PID:2692
-
\??\c:\tplrr.exec:\tplrr.exe79⤵PID:2720
-
\??\c:\xfxdpx.exec:\xfxdpx.exe80⤵PID:2680
-
\??\c:\nplllpt.exec:\nplllpt.exe81⤵PID:1700
-
\??\c:\xtxdnhl.exec:\xtxdnhl.exe82⤵PID:1644
-
\??\c:\xndxrr.exec:\xndxrr.exe83⤵PID:2588
-
\??\c:\tdjlffr.exec:\tdjlffr.exe84⤵PID:2644
-
\??\c:\vdfln.exec:\vdfln.exe85⤵PID:2564
-
\??\c:\hhprb.exec:\hhprb.exe86⤵PID:952
-
\??\c:\bhlvxrn.exec:\bhlvxrn.exe87⤵PID:2480
-
\??\c:\bvllnl.exec:\bvllnl.exe88⤵PID:2608
-
\??\c:\lltfll.exec:\lltfll.exe89⤵PID:2304
-
\??\c:\pvvfh.exec:\pvvfh.exe90⤵PID:2196
-
\??\c:\nfprlbf.exec:\nfprlbf.exe91⤵PID:2312
-
\??\c:\dbhltr.exec:\dbhltr.exe92⤵PID:2860
-
\??\c:\brvbd.exec:\brvbd.exe93⤵PID:1508
-
\??\c:\jpbld.exec:\jpbld.exe94⤵PID:1104
-
\??\c:\xtbhntx.exec:\xtbhntx.exe95⤵PID:2220
-
\??\c:\jxxlrhv.exec:\jxxlrhv.exe96⤵PID:2284
-
\??\c:\vlbpxr.exec:\vlbpxr.exe97⤵PID:2056
-
\??\c:\pxfjnf.exec:\pxfjnf.exe98⤵PID:1096
-
\??\c:\nbnxlbr.exec:\nbnxlbr.exe99⤵PID:1436
-
\??\c:\fdplxv.exec:\fdplxv.exe100⤵PID:1784
-
\??\c:\httnf.exec:\httnf.exe101⤵PID:3016
-
\??\c:\bflvtp.exec:\bflvtp.exe102⤵PID:2620
-
\??\c:\tvjnl.exec:\tvjnl.exe103⤵
- System Location Discovery: System Language Discovery
PID:3012 -
\??\c:\dlpnn.exec:\dlpnn.exe104⤵PID:1348
-
\??\c:\lrjbp.exec:\lrjbp.exe105⤵PID:1736
-
\??\c:\jtdfh.exec:\jtdfh.exe106⤵PID:1684
-
\??\c:\xnvrp.exec:\xnvrp.exe107⤵PID:1120
-
\??\c:\plthl.exec:\plthl.exe108⤵PID:800
-
\??\c:\xhrjx.exec:\xhrjx.exe109⤵PID:1704
-
\??\c:\fxltbr.exec:\fxltbr.exe110⤵PID:2256
-
\??\c:\hvhxdh.exec:\hvhxdh.exe111⤵PID:1040
-
\??\c:\dvrll.exec:\dvrll.exe112⤵PID:1028
-
\??\c:\vpdlt.exec:\vpdlt.exe113⤵PID:1044
-
\??\c:\lbnftpb.exec:\lbnftpb.exe114⤵PID:1564
-
\??\c:\xrhpdd.exec:\xrhpdd.exe115⤵PID:2904
-
\??\c:\lltdvtv.exec:\lltdvtv.exe116⤵PID:2776
-
\??\c:\fvtxb.exec:\fvtxb.exe117⤵PID:1616
-
\??\c:\pdhpvdf.exec:\pdhpvdf.exe118⤵PID:1712
-
\??\c:\ltjvjtn.exec:\ltjvjtn.exe119⤵PID:2804
-
\??\c:\dphrnvd.exec:\dphrnvd.exe120⤵
- System Location Discovery: System Language Discovery
PID:2836 -
\??\c:\hphpl.exec:\hphpl.exe121⤵PID:2864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-