Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22/12/2024, 21:10
Static task
static1
Behavioral task
behavioral1
Sample
31951927f5f50f45a015eafa2698debb5e617f96de29e1e003caff00e33c1df3.exe
Resource
win7-20241010-en
General
-
Target
31951927f5f50f45a015eafa2698debb5e617f96de29e1e003caff00e33c1df3.exe
-
Size
453KB
-
MD5
0e030f66bab6e47c11fb8503aec4bf28
-
SHA1
60caab9ea3d38603b9463c15d446ea9e6e0c9e9e
-
SHA256
31951927f5f50f45a015eafa2698debb5e617f96de29e1e003caff00e33c1df3
-
SHA512
17c4c510f53c3765cc699ec110d752a03f98172046062f7acb601db5bad4c711a22cfc42ea7f599594096b8b4801d9515f6db1874cd559a2db9ec4c91d982252
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeC:q7Tc2NYHUrAwfMp3CDC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2308-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/516-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-64-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2920-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-84-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1532-104-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1832-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/676-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-320-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1596-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-333-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2092-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-340-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/536-344-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2532-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-363-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2644-416-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1484-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/612-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-707-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-746-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-753-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/908-822-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2604-902-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2848-933-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-991-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/692-998-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2308 dttnt.exe 1104 brbnjvh.exe 2108 bbttpvf.exe 2956 tlrdbhr.exe 516 vxxlnpn.exe 2920 rnbftbh.exe 3052 trhntrp.exe 2816 rtpxv.exe 2792 dpfrvj.exe 1532 pxvdn.exe 1832 ldplxfv.exe 2972 vfhdb.exe 1880 xhdnjfh.exe 2780 blddtbv.exe 1772 hnxrdrj.exe 1924 vxjflh.exe 1984 vbxhx.exe 2960 jlltvrx.exe 2636 hfnhx.exe 1908 hnrntrh.exe 676 djljdj.exe 1796 xdvbj.exe 3032 jrxbln.exe 744 bhvtjtd.exe 968 nxbhpdh.exe 2860 jtvvlpj.exe 1932 rxdfr.exe 2640 vjxfdtd.exe 2540 bdxrdtn.exe 2432 rpbvxp.exe 288 ppjpf.exe 3048 pjrnn.exe 2384 rdldx.exe 1104 rtjdh.exe 536 lpfhvl.exe 1596 hjpjvv.exe 2360 hnhbtbf.exe 2092 nrxphnn.exe 2872 xpjfl.exe 2876 jphptr.exe 2532 tjjhxjh.exe 2824 nnrppf.exe 3000 pbntdrd.exe 2732 hldtxx.exe 2792 rpxlb.exe 524 vxbtrbb.exe 1960 xdvbt.exe 1832 jvdbb.exe 2644 nffrbpn.exe 1328 rdxdpd.exe 2364 pnhhfpv.exe 1956 fnvdbl.exe 2008 xbpdt.exe 1484 dlrrn.exe 1924 npvrpr.exe 1988 llpvjv.exe 612 ppnll.exe 2248 dtxffl.exe 2236 bxxrflr.exe 1344 xftprx.exe 396 xjpnf.exe 1816 ltjldnr.exe 960 xbtxxfr.exe 1324 xhhbv.exe -
resource yara_rule behavioral1/memory/2308-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/516-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-44-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2920-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-640-0x00000000001C0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/2972-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-933-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-984-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-991-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2636-1023-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffvtdrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhvtjtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nblvlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxrxjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttpjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpxlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrvtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrhdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rldvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txpnffv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjjdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbjjvfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftrjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djptpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npbbdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrvtjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttpvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrxbln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdvbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfxdvpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdrpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfjtlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpbdrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjxvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbbjrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxhxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbfpxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvftjbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhbtbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hldtxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbrlpd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2308 2240 31951927f5f50f45a015eafa2698debb5e617f96de29e1e003caff00e33c1df3.exe 30 PID 2240 wrote to memory of 2308 2240 31951927f5f50f45a015eafa2698debb5e617f96de29e1e003caff00e33c1df3.exe 30 PID 2240 wrote to memory of 2308 2240 31951927f5f50f45a015eafa2698debb5e617f96de29e1e003caff00e33c1df3.exe 30 PID 2240 wrote to memory of 2308 2240 31951927f5f50f45a015eafa2698debb5e617f96de29e1e003caff00e33c1df3.exe 30 PID 2308 wrote to memory of 1104 2308 dttnt.exe 31 PID 2308 wrote to memory of 1104 2308 dttnt.exe 31 PID 2308 wrote to memory of 1104 2308 dttnt.exe 31 PID 2308 wrote to memory of 1104 2308 dttnt.exe 31 PID 1104 wrote to memory of 2108 1104 brbnjvh.exe 32 PID 1104 wrote to memory of 2108 1104 brbnjvh.exe 32 PID 1104 wrote to memory of 2108 1104 brbnjvh.exe 32 PID 1104 wrote to memory of 2108 1104 brbnjvh.exe 32 PID 2108 wrote to memory of 2956 2108 bbttpvf.exe 33 PID 2108 wrote to memory of 2956 2108 bbttpvf.exe 33 PID 2108 wrote to memory of 2956 2108 bbttpvf.exe 33 PID 2108 wrote to memory of 2956 2108 bbttpvf.exe 33 PID 2956 wrote to memory of 516 2956 tlrdbhr.exe 34 PID 2956 wrote to memory of 516 2956 tlrdbhr.exe 34 PID 2956 wrote to memory of 516 2956 tlrdbhr.exe 34 PID 2956 wrote to memory of 516 2956 tlrdbhr.exe 34 PID 516 wrote to memory of 2920 516 vxxlnpn.exe 35 PID 516 wrote to memory of 2920 516 vxxlnpn.exe 35 PID 516 wrote to memory of 2920 516 vxxlnpn.exe 35 PID 516 wrote to memory of 2920 516 vxxlnpn.exe 35 PID 2920 wrote to memory of 3052 2920 rnbftbh.exe 36 PID 2920 wrote to memory of 3052 2920 rnbftbh.exe 36 PID 2920 wrote to memory of 3052 2920 rnbftbh.exe 36 PID 2920 wrote to memory of 3052 2920 rnbftbh.exe 36 PID 3052 wrote to memory of 2816 3052 trhntrp.exe 37 PID 3052 wrote to memory of 2816 3052 trhntrp.exe 37 PID 3052 wrote to memory of 2816 3052 trhntrp.exe 37 PID 3052 wrote to memory of 2816 3052 trhntrp.exe 37 PID 2816 wrote to memory of 2792 2816 rtpxv.exe 38 PID 2816 wrote to memory of 2792 2816 rtpxv.exe 38 PID 2816 wrote to memory of 2792 2816 rtpxv.exe 38 PID 2816 wrote to memory of 2792 2816 rtpxv.exe 38 PID 2792 wrote to memory of 1532 2792 dpfrvj.exe 39 PID 2792 wrote to memory of 1532 2792 dpfrvj.exe 39 PID 2792 wrote to memory of 1532 2792 dpfrvj.exe 39 PID 2792 wrote to memory of 1532 2792 dpfrvj.exe 39 PID 1532 wrote to memory of 1832 1532 pxvdn.exe 40 PID 1532 wrote to memory of 1832 1532 pxvdn.exe 40 PID 1532 wrote to memory of 1832 1532 pxvdn.exe 40 PID 1532 wrote to memory of 1832 1532 pxvdn.exe 40 PID 1832 wrote to memory of 2972 1832 ldplxfv.exe 41 PID 1832 wrote to memory of 2972 1832 ldplxfv.exe 41 PID 1832 wrote to memory of 2972 1832 ldplxfv.exe 41 PID 1832 wrote to memory of 2972 1832 ldplxfv.exe 41 PID 2972 wrote to memory of 1880 2972 vfhdb.exe 42 PID 2972 wrote to memory of 1880 2972 vfhdb.exe 42 PID 2972 wrote to memory of 1880 2972 vfhdb.exe 42 PID 2972 wrote to memory of 1880 2972 vfhdb.exe 42 PID 1880 wrote to memory of 2780 1880 xhdnjfh.exe 43 PID 1880 wrote to memory of 2780 1880 xhdnjfh.exe 43 PID 1880 wrote to memory of 2780 1880 xhdnjfh.exe 43 PID 1880 wrote to memory of 2780 1880 xhdnjfh.exe 43 PID 2780 wrote to memory of 1772 2780 blddtbv.exe 44 PID 2780 wrote to memory of 1772 2780 blddtbv.exe 44 PID 2780 wrote to memory of 1772 2780 blddtbv.exe 44 PID 2780 wrote to memory of 1772 2780 blddtbv.exe 44 PID 1772 wrote to memory of 1924 1772 hnxrdrj.exe 45 PID 1772 wrote to memory of 1924 1772 hnxrdrj.exe 45 PID 1772 wrote to memory of 1924 1772 hnxrdrj.exe 45 PID 1772 wrote to memory of 1924 1772 hnxrdrj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\31951927f5f50f45a015eafa2698debb5e617f96de29e1e003caff00e33c1df3.exe"C:\Users\Admin\AppData\Local\Temp\31951927f5f50f45a015eafa2698debb5e617f96de29e1e003caff00e33c1df3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\dttnt.exec:\dttnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\brbnjvh.exec:\brbnjvh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\bbttpvf.exec:\bbttpvf.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\tlrdbhr.exec:\tlrdbhr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\vxxlnpn.exec:\vxxlnpn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\rnbftbh.exec:\rnbftbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\trhntrp.exec:\trhntrp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\rtpxv.exec:\rtpxv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\dpfrvj.exec:\dpfrvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\pxvdn.exec:\pxvdn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\ldplxfv.exec:\ldplxfv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\vfhdb.exec:\vfhdb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\xhdnjfh.exec:\xhdnjfh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\blddtbv.exec:\blddtbv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\hnxrdrj.exec:\hnxrdrj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\vxjflh.exec:\vxjflh.exe17⤵
- Executes dropped EXE
PID:1924 -
\??\c:\vbxhx.exec:\vbxhx.exe18⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jlltvrx.exec:\jlltvrx.exe19⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hfnhx.exec:\hfnhx.exe20⤵
- Executes dropped EXE
PID:2636 -
\??\c:\hnrntrh.exec:\hnrntrh.exe21⤵
- Executes dropped EXE
PID:1908 -
\??\c:\djljdj.exec:\djljdj.exe22⤵
- Executes dropped EXE
PID:676 -
\??\c:\xdvbj.exec:\xdvbj.exe23⤵
- Executes dropped EXE
PID:1796 -
\??\c:\jrxbln.exec:\jrxbln.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3032 -
\??\c:\bhvtjtd.exec:\bhvtjtd.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:744 -
\??\c:\nxbhpdh.exec:\nxbhpdh.exe26⤵
- Executes dropped EXE
PID:968 -
\??\c:\jtvvlpj.exec:\jtvvlpj.exe27⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rxdfr.exec:\rxdfr.exe28⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vjxfdtd.exec:\vjxfdtd.exe29⤵
- Executes dropped EXE
PID:2640 -
\??\c:\bdxrdtn.exec:\bdxrdtn.exe30⤵
- Executes dropped EXE
PID:2540 -
\??\c:\rpbvxp.exec:\rpbvxp.exe31⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ppjpf.exec:\ppjpf.exe32⤵
- Executes dropped EXE
PID:288 -
\??\c:\pjrnn.exec:\pjrnn.exe33⤵
- Executes dropped EXE
PID:3048 -
\??\c:\rdldx.exec:\rdldx.exe34⤵
- Executes dropped EXE
PID:2384 -
\??\c:\rtjdh.exec:\rtjdh.exe35⤵
- Executes dropped EXE
PID:1104 -
\??\c:\lpfhvl.exec:\lpfhvl.exe36⤵
- Executes dropped EXE
PID:536 -
\??\c:\hjpjvv.exec:\hjpjvv.exe37⤵
- Executes dropped EXE
PID:1596 -
\??\c:\hnhbtbf.exec:\hnhbtbf.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2360 -
\??\c:\nrxphnn.exec:\nrxphnn.exe39⤵
- Executes dropped EXE
PID:2092 -
\??\c:\xpjfl.exec:\xpjfl.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jphptr.exec:\jphptr.exe41⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tjjhxjh.exec:\tjjhxjh.exe42⤵
- Executes dropped EXE
PID:2532 -
\??\c:\nnrppf.exec:\nnrppf.exe43⤵
- Executes dropped EXE
PID:2824 -
\??\c:\pbntdrd.exec:\pbntdrd.exe44⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hldtxx.exec:\hldtxx.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2732 -
\??\c:\rpxlb.exec:\rpxlb.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2792 -
\??\c:\vxbtrbb.exec:\vxbtrbb.exe47⤵
- Executes dropped EXE
PID:524 -
\??\c:\xdvbt.exec:\xdvbt.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1960 -
\??\c:\jvdbb.exec:\jvdbb.exe49⤵
- Executes dropped EXE
PID:1832 -
\??\c:\nffrbpn.exec:\nffrbpn.exe50⤵
- Executes dropped EXE
PID:2644 -
\??\c:\rdxdpd.exec:\rdxdpd.exe51⤵
- Executes dropped EXE
PID:1328 -
\??\c:\pnhhfpv.exec:\pnhhfpv.exe52⤵
- Executes dropped EXE
PID:2364 -
\??\c:\fnvdbl.exec:\fnvdbl.exe53⤵
- Executes dropped EXE
PID:1956 -
\??\c:\xbpdt.exec:\xbpdt.exe54⤵
- Executes dropped EXE
PID:2008 -
\??\c:\dlrrn.exec:\dlrrn.exe55⤵
- Executes dropped EXE
PID:1484 -
\??\c:\npvrpr.exec:\npvrpr.exe56⤵
- Executes dropped EXE
PID:1924 -
\??\c:\llpvjv.exec:\llpvjv.exe57⤵
- Executes dropped EXE
PID:1988 -
\??\c:\ppnll.exec:\ppnll.exe58⤵
- Executes dropped EXE
PID:612 -
\??\c:\dtxffl.exec:\dtxffl.exe59⤵
- Executes dropped EXE
PID:2248 -
\??\c:\bxxrflr.exec:\bxxrflr.exe60⤵
- Executes dropped EXE
PID:2236 -
\??\c:\xftprx.exec:\xftprx.exe61⤵
- Executes dropped EXE
PID:1344 -
\??\c:\xjpnf.exec:\xjpnf.exe62⤵
- Executes dropped EXE
PID:396 -
\??\c:\ltjldnr.exec:\ltjldnr.exe63⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xbtxxfr.exec:\xbtxxfr.exe64⤵
- Executes dropped EXE
PID:960 -
\??\c:\xhhbv.exec:\xhhbv.exe65⤵
- Executes dropped EXE
PID:1324 -
\??\c:\nxdvlfd.exec:\nxdvlfd.exe66⤵PID:1784
-
\??\c:\fxnpjxb.exec:\fxnpjxb.exe67⤵PID:1828
-
\??\c:\ptxvp.exec:\ptxvp.exe68⤵PID:1192
-
\??\c:\jhhfx.exec:\jhhfx.exe69⤵PID:1424
-
\??\c:\fprhxnb.exec:\fprhxnb.exe70⤵PID:1648
-
\??\c:\lhjnfbb.exec:\lhjnfbb.exe71⤵PID:2272
-
\??\c:\xdjhhp.exec:\xdjhhp.exe72⤵PID:1584
-
\??\c:\bvddp.exec:\bvddp.exe73⤵PID:2520
-
\??\c:\fvtvltn.exec:\fvtvltn.exe74⤵PID:1016
-
\??\c:\hvfbv.exec:\hvfbv.exe75⤵PID:2456
-
\??\c:\vljbhf.exec:\vljbhf.exe76⤵PID:1756
-
\??\c:\ndltt.exec:\ndltt.exe77⤵PID:1708
-
\??\c:\vvtfnl.exec:\vvtfnl.exe78⤵PID:2104
-
\??\c:\nlpvfjb.exec:\nlpvfjb.exe79⤵PID:2648
-
\??\c:\xxdtxb.exec:\xxdtxb.exe80⤵PID:368
-
\??\c:\tjpdlrh.exec:\tjpdlrh.exe81⤵PID:2632
-
\??\c:\rthpd.exec:\rthpd.exe82⤵PID:2904
-
\??\c:\jxfhjjv.exec:\jxfhjjv.exe83⤵PID:3068
-
\??\c:\xlrrrl.exec:\xlrrrl.exe84⤵PID:2924
-
\??\c:\vhdrnpf.exec:\vhdrnpf.exe85⤵PID:2804
-
\??\c:\dppbplf.exec:\dppbplf.exe86⤵PID:2932
-
\??\c:\xltfxrj.exec:\xltfxrj.exe87⤵PID:1904
-
\??\c:\hprvrn.exec:\hprvrn.exe88⤵PID:2688
-
\??\c:\phhdxt.exec:\phhdxt.exe89⤵PID:2708
-
\??\c:\jlnrft.exec:\jlnrft.exe90⤵PID:2044
-
\??\c:\rhjnnn.exec:\rhjnnn.exe91⤵PID:1144
-
\??\c:\tldtx.exec:\tldtx.exe92⤵PID:2980
-
\??\c:\rddtbl.exec:\rddtbl.exe93⤵PID:2972
-
\??\c:\lpttrrb.exec:\lpttrrb.exe94⤵PID:1656
-
\??\c:\hphtjh.exec:\hphtjh.exe95⤵PID:1208
-
\??\c:\pbxxhvp.exec:\pbxxhvp.exe96⤵PID:2576
-
\??\c:\thfnlnx.exec:\thfnlnx.exe97⤵PID:1636
-
\??\c:\rfhbnv.exec:\rfhbnv.exe98⤵PID:2000
-
\??\c:\rttbbd.exec:\rttbbd.exe99⤵PID:2976
-
\??\c:\nrvtt.exec:\nrvtt.exe100⤵
- System Location Discovery: System Language Discovery
PID:2940 -
\??\c:\trxxxft.exec:\trxxxft.exe101⤵PID:2052
-
\??\c:\ndxvvtr.exec:\ndxvvtr.exe102⤵PID:1868
-
\??\c:\jllpxh.exec:\jllpxh.exe103⤵PID:2464
-
\??\c:\lljhjd.exec:\lljhjd.exe104⤵PID:880
-
\??\c:\jxpjvt.exec:\jxpjvt.exe105⤵PID:776
-
\??\c:\ptprdtf.exec:\ptprdtf.exe106⤵PID:1164
-
\??\c:\xvhtdph.exec:\xvhtdph.exe107⤵PID:2992
-
\??\c:\dthnhd.exec:\dthnhd.exe108⤵PID:988
-
\??\c:\ltrfbtx.exec:\ltrfbtx.exe109⤵PID:964
-
\??\c:\dnnlnth.exec:\dnnlnth.exe110⤵PID:1028
-
\??\c:\ddrxnr.exec:\ddrxnr.exe111⤵PID:2860
-
\??\c:\bnldlrr.exec:\bnldlrr.exe112⤵PID:908
-
\??\c:\tfbnnr.exec:\tfbnnr.exe113⤵PID:1820
-
\??\c:\njnfnb.exec:\njnfnb.exe114⤵PID:2400
-
\??\c:\fvldj.exec:\fvldj.exe115⤵PID:264
-
\??\c:\fvbfb.exec:\fvbfb.exe116⤵PID:2480
-
\??\c:\tptnxjf.exec:\tptnxjf.exe117⤵PID:2520
-
\??\c:\nhrdx.exec:\nhrdx.exe118⤵PID:572
-
\??\c:\jjbfxt.exec:\jjbfxt.exe119⤵PID:2456
-
\??\c:\nrvhr.exec:\nrvhr.exe120⤵PID:2140
-
\??\c:\rrpbpp.exec:\rrpbpp.exe121⤵PID:1576
-
\??\c:\btjtv.exec:\btjtv.exe122⤵PID:2604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-