Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20/12/2024, 01:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1f660920cd302abbc8e0e6a386be1cf199938db5ad5fea51c75a6376ad6506adN.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
1f660920cd302abbc8e0e6a386be1cf199938db5ad5fea51c75a6376ad6506adN.exe
-
Size
453KB
-
MD5
01192db0f5c37a4d3c38362be137cba0
-
SHA1
239f7f3d2988f1800f2f7f530380922dbbe1d61a
-
SHA256
1f660920cd302abbc8e0e6a386be1cf199938db5ad5fea51c75a6376ad6506ad
-
SHA512
40a4b0f92d6553177b6f934a1c114266c161778bbfa07761caed8c4f84903f9f10b8dcb18b9028c7a53126e1529ee148d301c0c5996c077ac7f5cbaa4300830c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbee:q7Tc2NYHUrAwfMp3CDe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/1552-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-17-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2016-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-18-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2724-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/656-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1176-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1176-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-284-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/788-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-431-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2980-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-622-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1740-685-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-686-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2300-699-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-713-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-728-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1012-838-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2456-899-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2140-906-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2956-920-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2552 htpfbr.exe 2016 nddvb.exe 2724 bpfvd.exe 3056 dnjhrl.exe 2780 rjjlvh.exe 2380 blvbrtp.exe 2620 hjlhh.exe 2740 jllxbv.exe 2576 ptrnf.exe 656 nhnhh.exe 3016 nxtvx.exe 1868 xfrlbnf.exe 2968 bfjdlv.exe 1176 rjfhfft.exe 1884 rlvxn.exe 1752 npvxhrv.exe 2076 bhxnx.exe 2716 vdbrnn.exe 2056 vpvlbjh.exe 528 rnhpl.exe 2224 vtdjh.exe 2392 tdjrhx.exe 1804 fvvrhh.exe 2400 lvbfd.exe 2856 fbtthhh.exe 1688 ltdxft.exe 572 fnlfr.exe 2700 nnxtj.exe 3048 bxbhprt.exe 1344 jvhjvrx.exe 2524 vvfrhh.exe 788 bxdlnl.exe 1516 bnbxrln.exe 1596 nnpjdf.exe 2964 tlrvnv.exe 2760 pdhbbnd.exe 2940 bnbtbl.exe 2776 dpbln.exe 2912 lpvnl.exe 2756 bhfdt.exe 2668 fnvdhpj.exe 2652 hnhjx.exe 2692 lrrlv.exe 2276 vphpjj.exe 2688 jpftfxt.exe 1648 vhlht.exe 1136 vrjhj.exe 3000 tftlv.exe 2852 njjdb.exe 1152 pxxttnn.exe 2980 tvfdpbj.exe 1460 nfhxd.exe 1896 pldtvr.exe 2404 llfxnl.exe 940 jppxb.exe 1484 dpxfxh.exe 1908 lhbrnn.exe 2056 hnplldt.exe 1632 nbjxfxb.exe 1520 ppvhb.exe 688 jjrdj.exe 972 brbttvb.exe 2504 jbhnt.exe 2592 hbdhb.exe -
resource yara_rule behavioral1/memory/1552-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/656-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-899-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2952-945-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnrbhdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdxhlvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhrbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbrth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npvddn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thrnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbrxnvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvlvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndnxvfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drfbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnpvff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txrtjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xttvndd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxtndn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxrntlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhpnvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvnvjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndfnjvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtvdxnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txnrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdxdbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlffv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tblpbjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddxplfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbrnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvtbdrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnvjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdhvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftljdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjrdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbfhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnvtfjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jprxh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1552 wrote to memory of 2552 1552 1f660920cd302abbc8e0e6a386be1cf199938db5ad5fea51c75a6376ad6506adN.exe 31 PID 1552 wrote to memory of 2552 1552 1f660920cd302abbc8e0e6a386be1cf199938db5ad5fea51c75a6376ad6506adN.exe 31 PID 1552 wrote to memory of 2552 1552 1f660920cd302abbc8e0e6a386be1cf199938db5ad5fea51c75a6376ad6506adN.exe 31 PID 1552 wrote to memory of 2552 1552 1f660920cd302abbc8e0e6a386be1cf199938db5ad5fea51c75a6376ad6506adN.exe 31 PID 2552 wrote to memory of 2016 2552 htpfbr.exe 32 PID 2552 wrote to memory of 2016 2552 htpfbr.exe 32 PID 2552 wrote to memory of 2016 2552 htpfbr.exe 32 PID 2552 wrote to memory of 2016 2552 htpfbr.exe 32 PID 2016 wrote to memory of 2724 2016 nddvb.exe 33 PID 2016 wrote to memory of 2724 2016 nddvb.exe 33 PID 2016 wrote to memory of 2724 2016 nddvb.exe 33 PID 2016 wrote to memory of 2724 2016 nddvb.exe 33 PID 2724 wrote to memory of 3056 2724 bpfvd.exe 34 PID 2724 wrote to memory of 3056 2724 bpfvd.exe 34 PID 2724 wrote to memory of 3056 2724 bpfvd.exe 34 PID 2724 wrote to memory of 3056 2724 bpfvd.exe 34 PID 3056 wrote to memory of 2780 3056 dnjhrl.exe 35 PID 3056 wrote to memory of 2780 3056 dnjhrl.exe 35 PID 3056 wrote to memory of 2780 3056 dnjhrl.exe 35 PID 3056 wrote to memory of 2780 3056 dnjhrl.exe 35 PID 2780 wrote to memory of 2380 2780 rjjlvh.exe 36 PID 2780 wrote to memory of 2380 2780 rjjlvh.exe 36 PID 2780 wrote to memory of 2380 2780 rjjlvh.exe 36 PID 2780 wrote to memory of 2380 2780 rjjlvh.exe 36 PID 2380 wrote to memory of 2620 2380 blvbrtp.exe 37 PID 2380 wrote to memory of 2620 2380 blvbrtp.exe 37 PID 2380 wrote to memory of 2620 2380 blvbrtp.exe 37 PID 2380 wrote to memory of 2620 2380 blvbrtp.exe 37 PID 2620 wrote to memory of 2740 2620 hjlhh.exe 38 PID 2620 wrote to memory of 2740 2620 hjlhh.exe 38 PID 2620 wrote to memory of 2740 2620 hjlhh.exe 38 PID 2620 wrote to memory of 2740 2620 hjlhh.exe 38 PID 2740 wrote to memory of 2576 2740 jllxbv.exe 39 PID 2740 wrote to memory of 2576 2740 jllxbv.exe 39 PID 2740 wrote to memory of 2576 2740 jllxbv.exe 39 PID 2740 wrote to memory of 2576 2740 jllxbv.exe 39 PID 2576 wrote to memory of 656 2576 ptrnf.exe 40 PID 2576 wrote to memory of 656 2576 ptrnf.exe 40 PID 2576 wrote to memory of 656 2576 ptrnf.exe 40 PID 2576 wrote to memory of 656 2576 ptrnf.exe 40 PID 656 wrote to memory of 3016 656 nhnhh.exe 41 PID 656 wrote to memory of 3016 656 nhnhh.exe 41 PID 656 wrote to memory of 3016 656 nhnhh.exe 41 PID 656 wrote to memory of 3016 656 nhnhh.exe 41 PID 3016 wrote to memory of 1868 3016 nxtvx.exe 42 PID 3016 wrote to memory of 1868 3016 nxtvx.exe 42 PID 3016 wrote to memory of 1868 3016 nxtvx.exe 42 PID 3016 wrote to memory of 1868 3016 nxtvx.exe 42 PID 1868 wrote to memory of 2968 1868 xfrlbnf.exe 43 PID 1868 wrote to memory of 2968 1868 xfrlbnf.exe 43 PID 1868 wrote to memory of 2968 1868 xfrlbnf.exe 43 PID 1868 wrote to memory of 2968 1868 xfrlbnf.exe 43 PID 2968 wrote to memory of 1176 2968 bfjdlv.exe 44 PID 2968 wrote to memory of 1176 2968 bfjdlv.exe 44 PID 2968 wrote to memory of 1176 2968 bfjdlv.exe 44 PID 2968 wrote to memory of 1176 2968 bfjdlv.exe 44 PID 1176 wrote to memory of 1884 1176 rjfhfft.exe 45 PID 1176 wrote to memory of 1884 1176 rjfhfft.exe 45 PID 1176 wrote to memory of 1884 1176 rjfhfft.exe 45 PID 1176 wrote to memory of 1884 1176 rjfhfft.exe 45 PID 1884 wrote to memory of 1752 1884 rlvxn.exe 46 PID 1884 wrote to memory of 1752 1884 rlvxn.exe 46 PID 1884 wrote to memory of 1752 1884 rlvxn.exe 46 PID 1884 wrote to memory of 1752 1884 rlvxn.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f660920cd302abbc8e0e6a386be1cf199938db5ad5fea51c75a6376ad6506adN.exe"C:\Users\Admin\AppData\Local\Temp\1f660920cd302abbc8e0e6a386be1cf199938db5ad5fea51c75a6376ad6506adN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\htpfbr.exec:\htpfbr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\nddvb.exec:\nddvb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\bpfvd.exec:\bpfvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\dnjhrl.exec:\dnjhrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\rjjlvh.exec:\rjjlvh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\blvbrtp.exec:\blvbrtp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\hjlhh.exec:\hjlhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\jllxbv.exec:\jllxbv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\ptrnf.exec:\ptrnf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\nhnhh.exec:\nhnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\nxtvx.exec:\nxtvx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\xfrlbnf.exec:\xfrlbnf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\bfjdlv.exec:\bfjdlv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\rjfhfft.exec:\rjfhfft.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\rlvxn.exec:\rlvxn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\npvxhrv.exec:\npvxhrv.exe17⤵
- Executes dropped EXE
PID:1752 -
\??\c:\bhxnx.exec:\bhxnx.exe18⤵
- Executes dropped EXE
PID:2076 -
\??\c:\vdbrnn.exec:\vdbrnn.exe19⤵
- Executes dropped EXE
PID:2716 -
\??\c:\vpvlbjh.exec:\vpvlbjh.exe20⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rnhpl.exec:\rnhpl.exe21⤵
- Executes dropped EXE
PID:528 -
\??\c:\vtdjh.exec:\vtdjh.exe22⤵
- Executes dropped EXE
PID:2224 -
\??\c:\tdjrhx.exec:\tdjrhx.exe23⤵
- Executes dropped EXE
PID:2392 -
\??\c:\fvvrhh.exec:\fvvrhh.exe24⤵
- Executes dropped EXE
PID:1804 -
\??\c:\lvbfd.exec:\lvbfd.exe25⤵
- Executes dropped EXE
PID:2400 -
\??\c:\fbtthhh.exec:\fbtthhh.exe26⤵
- Executes dropped EXE
PID:2856 -
\??\c:\ltdxft.exec:\ltdxft.exe27⤵
- Executes dropped EXE
PID:1688 -
\??\c:\fnlfr.exec:\fnlfr.exe28⤵
- Executes dropped EXE
PID:572 -
\??\c:\nnxtj.exec:\nnxtj.exe29⤵
- Executes dropped EXE
PID:2700 -
\??\c:\bxbhprt.exec:\bxbhprt.exe30⤵
- Executes dropped EXE
PID:3048 -
\??\c:\jvhjvrx.exec:\jvhjvrx.exe31⤵
- Executes dropped EXE
PID:1344 -
\??\c:\vvfrhh.exec:\vvfrhh.exe32⤵
- Executes dropped EXE
PID:2524 -
\??\c:\bxdlnl.exec:\bxdlnl.exe33⤵
- Executes dropped EXE
PID:788 -
\??\c:\bnbxrln.exec:\bnbxrln.exe34⤵
- Executes dropped EXE
PID:1516 -
\??\c:\nnpjdf.exec:\nnpjdf.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\tlrvnv.exec:\tlrvnv.exe36⤵
- Executes dropped EXE
PID:2964 -
\??\c:\pdhbbnd.exec:\pdhbbnd.exe37⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bnbtbl.exec:\bnbtbl.exe38⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dpbln.exec:\dpbln.exe39⤵
- Executes dropped EXE
PID:2776 -
\??\c:\lpvnl.exec:\lpvnl.exe40⤵
- Executes dropped EXE
PID:2912 -
\??\c:\bhfdt.exec:\bhfdt.exe41⤵
- Executes dropped EXE
PID:2756 -
\??\c:\fnvdhpj.exec:\fnvdhpj.exe42⤵
- Executes dropped EXE
PID:2668 -
\??\c:\hnhjx.exec:\hnhjx.exe43⤵
- Executes dropped EXE
PID:2652 -
\??\c:\lrrlv.exec:\lrrlv.exe44⤵
- Executes dropped EXE
PID:2692 -
\??\c:\vphpjj.exec:\vphpjj.exe45⤵
- Executes dropped EXE
PID:2276 -
\??\c:\jpftfxt.exec:\jpftfxt.exe46⤵
- Executes dropped EXE
PID:2688 -
\??\c:\vhlht.exec:\vhlht.exe47⤵
- Executes dropped EXE
PID:1648 -
\??\c:\vrjhj.exec:\vrjhj.exe48⤵
- Executes dropped EXE
PID:1136 -
\??\c:\tftlv.exec:\tftlv.exe49⤵
- Executes dropped EXE
PID:3000 -
\??\c:\njjdb.exec:\njjdb.exe50⤵
- Executes dropped EXE
PID:2852 -
\??\c:\pxxttnn.exec:\pxxttnn.exe51⤵
- Executes dropped EXE
PID:1152 -
\??\c:\tvfdpbj.exec:\tvfdpbj.exe52⤵
- Executes dropped EXE
PID:2980 -
\??\c:\nfhxd.exec:\nfhxd.exe53⤵
- Executes dropped EXE
PID:1460 -
\??\c:\pldtvr.exec:\pldtvr.exe54⤵
- Executes dropped EXE
PID:1896 -
\??\c:\llfxnl.exec:\llfxnl.exe55⤵
- Executes dropped EXE
PID:2404 -
\??\c:\jppxb.exec:\jppxb.exe56⤵
- Executes dropped EXE
PID:940 -
\??\c:\dpxfxh.exec:\dpxfxh.exe57⤵
- Executes dropped EXE
PID:1484 -
\??\c:\lhbrnn.exec:\lhbrnn.exe58⤵
- Executes dropped EXE
PID:1908 -
\??\c:\hnplldt.exec:\hnplldt.exe59⤵
- Executes dropped EXE
PID:2056 -
\??\c:\nbjxfxb.exec:\nbjxfxb.exe60⤵
- Executes dropped EXE
PID:1632 -
\??\c:\ppvhb.exec:\ppvhb.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1520 -
\??\c:\jjrdj.exec:\jjrdj.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:688 -
\??\c:\brbttvb.exec:\brbttvb.exe63⤵
- Executes dropped EXE
PID:972 -
\??\c:\jbhnt.exec:\jbhnt.exe64⤵
- Executes dropped EXE
PID:2504 -
\??\c:\hbdhb.exec:\hbdhb.exe65⤵
- Executes dropped EXE
PID:2592 -
\??\c:\jrrdlj.exec:\jrrdlj.exe66⤵PID:2420
-
\??\c:\fdtvl.exec:\fdtvl.exe67⤵PID:2308
-
\??\c:\jfdfn.exec:\jfdfn.exe68⤵PID:1540
-
\??\c:\frrlp.exec:\frrlp.exe69⤵PID:1412
-
\??\c:\vnrfdpt.exec:\vnrfdpt.exe70⤵PID:2704
-
\??\c:\xrdfnjl.exec:\xrdfnjl.exe71⤵PID:2072
-
\??\c:\nxdth.exec:\nxdth.exe72⤵PID:3048
-
\??\c:\djndrrj.exec:\djndrrj.exe73⤵PID:1360
-
\??\c:\pdntnvf.exec:\pdntnvf.exe74⤵PID:568
-
\??\c:\tfltftt.exec:\tfltftt.exe75⤵PID:1996
-
\??\c:\nvvbjj.exec:\nvvbjj.exe76⤵PID:788
-
\??\c:\jrlxfr.exec:\jrlxfr.exe77⤵PID:2208
-
\??\c:\ptptblb.exec:\ptptblb.exe78⤵PID:2552
-
\??\c:\vljjpf.exec:\vljjpf.exe79⤵PID:868
-
\??\c:\tvftjfh.exec:\tvftjfh.exe80⤵PID:2884
-
\??\c:\nvpfp.exec:\nvpfp.exe81⤵PID:2900
-
\??\c:\vlfdp.exec:\vlfdp.exe82⤵PID:3056
-
\??\c:\vjlfff.exec:\vjlfff.exe83⤵PID:2996
-
\??\c:\btvdjbh.exec:\btvdjbh.exe84⤵PID:2780
-
\??\c:\pdnrnl.exec:\pdnrnl.exe85⤵PID:2616
-
\??\c:\rlfxpr.exec:\rlfxpr.exe86⤵PID:2636
-
\??\c:\jpvpx.exec:\jpvpx.exe87⤵PID:2620
-
\??\c:\txnpvh.exec:\txnpvh.exe88⤵PID:2088
-
\??\c:\pnfbb.exec:\pnfbb.exe89⤵PID:2148
-
\??\c:\vdnfxtn.exec:\vdnfxtn.exe90⤵PID:2984
-
\??\c:\hfdvtf.exec:\hfdvtf.exe91⤵PID:2976
-
\??\c:\nbjbtv.exec:\nbjbtv.exe92⤵PID:1740
-
\??\c:\dvlnr.exec:\dvlnr.exe93⤵PID:3016
-
\??\c:\vdbpbth.exec:\vdbpbth.exe94⤵PID:560
-
\??\c:\vtfxnr.exec:\vtfxnr.exe95⤵PID:2300
-
\??\c:\xdxdbhn.exec:\xdxdbhn.exe96⤵
- System Location Discovery: System Language Discovery
PID:924 -
\??\c:\dnrbhdt.exec:\dnrbhdt.exe97⤵
- System Location Discovery: System Language Discovery
PID:2364 -
\??\c:\jnhxpd.exec:\jnhxpd.exe98⤵PID:2384
-
\??\c:\fffjvxt.exec:\fffjvxt.exe99⤵PID:2476
-
\??\c:\rrrfdt.exec:\rrrfdt.exe100⤵PID:2344
-
\??\c:\dlvjnb.exec:\dlvjnb.exe101⤵PID:1100
-
\??\c:\vxhvbr.exec:\vxhvbr.exe102⤵PID:1156
-
\??\c:\jbrtbhp.exec:\jbrtbhp.exe103⤵PID:2252
-
\??\c:\tnnjh.exec:\tnnjh.exe104⤵PID:928
-
\??\c:\fjppj.exec:\fjppj.exe105⤵PID:2392
-
\??\c:\nrhvhlt.exec:\nrhvhlt.exe106⤵PID:1016
-
\??\c:\hdlxflh.exec:\hdlxflh.exe107⤵PID:1772
-
\??\c:\jjhxbvr.exec:\jjhxbvr.exe108⤵PID:1748
-
\??\c:\fnjnd.exec:\fnjnd.exe109⤵PID:2032
-
\??\c:\jjjlh.exec:\jjjlh.exe110⤵PID:1524
-
\??\c:\hlxtd.exec:\hlxtd.exe111⤵PID:2480
-
\??\c:\pdhpdr.exec:\pdhpdr.exe112⤵PID:2040
-
\??\c:\nxxtf.exec:\nxxtf.exe113⤵PID:1412
-
\??\c:\hhhxf.exec:\hhhxf.exe114⤵PID:2704
-
\??\c:\dxfpdp.exec:\dxfpdp.exe115⤵PID:1012
-
\??\c:\hdvpfn.exec:\hdvpfn.exe116⤵PID:2216
-
\??\c:\tplfnp.exec:\tplfnp.exe117⤵PID:872
-
\??\c:\pxrrpr.exec:\pxrrpr.exe118⤵PID:2008
-
\??\c:\pntfprb.exec:\pntfprb.exe119⤵PID:1552
-
\??\c:\pphjfd.exec:\pphjfd.exe120⤵PID:2440
-
\??\c:\rdxhlvb.exec:\rdxhlvb.exe121⤵
- System Location Discovery: System Language Discovery
PID:2200
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-