Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 23:09
Static task
static1
Behavioral task
behavioral1
Sample
67b998a04d0a9277eacc0f080e1fd6d5b7a4d2c2d13c8ed2d45994d046789b77.exe
Resource
win7-20241010-en
General
-
Target
67b998a04d0a9277eacc0f080e1fd6d5b7a4d2c2d13c8ed2d45994d046789b77.exe
-
Size
453KB
-
MD5
504d2daf4325e92a95a56e3bdd575423
-
SHA1
b7b497b7c316c1f99d9b8d06c39f52cec83df12d
-
SHA256
67b998a04d0a9277eacc0f080e1fd6d5b7a4d2c2d13c8ed2d45994d046789b77
-
SHA512
9a6d801b15244b7b40b2340c546ab64668e4db3ec5f6be7537198dffd4523c144f9c11b557cba297087ab73c6eda63df71abc43c120ece5756ac855c6d19c85d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/844-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-142-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2212-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/388-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/708-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-301-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/844-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1116-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-476-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/708-504-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1852-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1116-683-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-758-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2324-788-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2024-837-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-921-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1780-941-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2892-953-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2444 vvxpphf.exe 2792 fpnpjjl.exe 2980 tpfnd.exe 2856 dhrrdt.exe 2808 bpntnxj.exe 2596 njpfj.exe 2712 fpfvl.exe 952 bflvhh.exe 2888 fbdxrn.exe 2580 fpxpl.exe 2944 rlbhn.exe 2044 jxfvx.exe 2220 fhbxphj.exe 2144 vrxlrdn.exe 1968 nfrfvdl.exe 2212 dnnvr.exe 1216 lhtvfbt.exe 2404 nrfnh.exe 1760 dldvhj.exe 2092 vjhbltl.exe 388 vxjxh.exe 708 vnhxh.exe 1852 hnfjp.exe 1120 hrljvn.exe 1920 lbbvhf.exe 1508 vttlpvt.exe 1848 jvfjr.exe 3040 rjpfhxx.exe 2528 htldhd.exe 2008 njlrxhd.exe 2012 ljpjhp.exe 1972 pvrrpj.exe 844 bbtbvrp.exe 1588 fdlldp.exe 2740 pjjltf.exe 2992 dpxjlf.exe 2180 frhpvxr.exe 2732 xfrpnt.exe 2728 tlhnjl.exe 2636 tlhnjjd.exe 2612 bltnl.exe 2596 ndnftxb.exe 2824 jjppj.exe 636 dprbt.exe 2892 fbtlfnx.exe 772 lltnrdx.exe 1116 pptdhnn.exe 648 xbtnhxd.exe 1380 htvvnjn.exe 1768 bjnfdbx.exe 3036 hjrdpdr.exe 700 vxxxll.exe 776 hpvvx.exe 2468 jjlhvb.exe 2084 lpxrr.exe 2420 fdvplx.exe 1928 dhvrrtt.exe 2400 pfhbvj.exe 2140 hhbpxp.exe 616 fjnrd.exe 236 rfddfp.exe 708 lxhtnp.exe 1852 pjpll.exe 2208 jlpnf.exe -
resource yara_rule behavioral1/memory/844-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/388-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/708-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-837-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-863-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-896-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-974-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hptrjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flhthd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdvhlld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbrlph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvrhrrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjhjrvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftxtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvvvpbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpftvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlvrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffhrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpbtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nddjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbxtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdblf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbpxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txnfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhdptb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvxpphf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfddfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hndfdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdjvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdhjtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhhvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvphlvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpfnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvtjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlhbtfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltvfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvpnvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvvnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldvxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlnrpxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxxjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvntd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfrfvdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrljvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrpft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvbjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjjbd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 844 wrote to memory of 2444 844 67b998a04d0a9277eacc0f080e1fd6d5b7a4d2c2d13c8ed2d45994d046789b77.exe 30 PID 844 wrote to memory of 2444 844 67b998a04d0a9277eacc0f080e1fd6d5b7a4d2c2d13c8ed2d45994d046789b77.exe 30 PID 844 wrote to memory of 2444 844 67b998a04d0a9277eacc0f080e1fd6d5b7a4d2c2d13c8ed2d45994d046789b77.exe 30 PID 844 wrote to memory of 2444 844 67b998a04d0a9277eacc0f080e1fd6d5b7a4d2c2d13c8ed2d45994d046789b77.exe 30 PID 2444 wrote to memory of 2792 2444 vvxpphf.exe 31 PID 2444 wrote to memory of 2792 2444 vvxpphf.exe 31 PID 2444 wrote to memory of 2792 2444 vvxpphf.exe 31 PID 2444 wrote to memory of 2792 2444 vvxpphf.exe 31 PID 2792 wrote to memory of 2980 2792 fpnpjjl.exe 32 PID 2792 wrote to memory of 2980 2792 fpnpjjl.exe 32 PID 2792 wrote to memory of 2980 2792 fpnpjjl.exe 32 PID 2792 wrote to memory of 2980 2792 fpnpjjl.exe 32 PID 2980 wrote to memory of 2856 2980 tpfnd.exe 33 PID 2980 wrote to memory of 2856 2980 tpfnd.exe 33 PID 2980 wrote to memory of 2856 2980 tpfnd.exe 33 PID 2980 wrote to memory of 2856 2980 tpfnd.exe 33 PID 2856 wrote to memory of 2808 2856 dhrrdt.exe 34 PID 2856 wrote to memory of 2808 2856 dhrrdt.exe 34 PID 2856 wrote to memory of 2808 2856 dhrrdt.exe 34 PID 2856 wrote to memory of 2808 2856 dhrrdt.exe 34 PID 2808 wrote to memory of 2596 2808 bpntnxj.exe 35 PID 2808 wrote to memory of 2596 2808 bpntnxj.exe 35 PID 2808 wrote to memory of 2596 2808 bpntnxj.exe 35 PID 2808 wrote to memory of 2596 2808 bpntnxj.exe 35 PID 2596 wrote to memory of 2712 2596 njpfj.exe 36 PID 2596 wrote to memory of 2712 2596 njpfj.exe 36 PID 2596 wrote to memory of 2712 2596 njpfj.exe 36 PID 2596 wrote to memory of 2712 2596 njpfj.exe 36 PID 2712 wrote to memory of 952 2712 fpfvl.exe 37 PID 2712 wrote to memory of 952 2712 fpfvl.exe 37 PID 2712 wrote to memory of 952 2712 fpfvl.exe 37 PID 2712 wrote to memory of 952 2712 fpfvl.exe 37 PID 952 wrote to memory of 2888 952 bflvhh.exe 38 PID 952 wrote to memory of 2888 952 bflvhh.exe 38 PID 952 wrote to memory of 2888 952 bflvhh.exe 38 PID 952 wrote to memory of 2888 952 bflvhh.exe 38 PID 2888 wrote to memory of 2580 2888 fbdxrn.exe 39 PID 2888 wrote to memory of 2580 2888 fbdxrn.exe 39 PID 2888 wrote to memory of 2580 2888 fbdxrn.exe 39 PID 2888 wrote to memory of 2580 2888 fbdxrn.exe 39 PID 2580 wrote to memory of 2944 2580 fpxpl.exe 40 PID 2580 wrote to memory of 2944 2580 fpxpl.exe 40 PID 2580 wrote to memory of 2944 2580 fpxpl.exe 40 PID 2580 wrote to memory of 2944 2580 fpxpl.exe 40 PID 2944 wrote to memory of 2044 2944 rlbhn.exe 41 PID 2944 wrote to memory of 2044 2944 rlbhn.exe 41 PID 2944 wrote to memory of 2044 2944 rlbhn.exe 41 PID 2944 wrote to memory of 2044 2944 rlbhn.exe 41 PID 2044 wrote to memory of 2220 2044 jxfvx.exe 42 PID 2044 wrote to memory of 2220 2044 jxfvx.exe 42 PID 2044 wrote to memory of 2220 2044 jxfvx.exe 42 PID 2044 wrote to memory of 2220 2044 jxfvx.exe 42 PID 2220 wrote to memory of 2144 2220 fhbxphj.exe 43 PID 2220 wrote to memory of 2144 2220 fhbxphj.exe 43 PID 2220 wrote to memory of 2144 2220 fhbxphj.exe 43 PID 2220 wrote to memory of 2144 2220 fhbxphj.exe 43 PID 2144 wrote to memory of 1968 2144 vrxlrdn.exe 44 PID 2144 wrote to memory of 1968 2144 vrxlrdn.exe 44 PID 2144 wrote to memory of 1968 2144 vrxlrdn.exe 44 PID 2144 wrote to memory of 1968 2144 vrxlrdn.exe 44 PID 1968 wrote to memory of 2212 1968 nfrfvdl.exe 45 PID 1968 wrote to memory of 2212 1968 nfrfvdl.exe 45 PID 1968 wrote to memory of 2212 1968 nfrfvdl.exe 45 PID 1968 wrote to memory of 2212 1968 nfrfvdl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\67b998a04d0a9277eacc0f080e1fd6d5b7a4d2c2d13c8ed2d45994d046789b77.exe"C:\Users\Admin\AppData\Local\Temp\67b998a04d0a9277eacc0f080e1fd6d5b7a4d2c2d13c8ed2d45994d046789b77.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\vvxpphf.exec:\vvxpphf.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\fpnpjjl.exec:\fpnpjjl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\tpfnd.exec:\tpfnd.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\dhrrdt.exec:\dhrrdt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\bpntnxj.exec:\bpntnxj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\njpfj.exec:\njpfj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\fpfvl.exec:\fpfvl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\bflvhh.exec:\bflvhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\fbdxrn.exec:\fbdxrn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\fpxpl.exec:\fpxpl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\rlbhn.exec:\rlbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\jxfvx.exec:\jxfvx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\fhbxphj.exec:\fhbxphj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\vrxlrdn.exec:\vrxlrdn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\nfrfvdl.exec:\nfrfvdl.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\dnnvr.exec:\dnnvr.exe17⤵
- Executes dropped EXE
PID:2212 -
\??\c:\lhtvfbt.exec:\lhtvfbt.exe18⤵
- Executes dropped EXE
PID:1216 -
\??\c:\nrfnh.exec:\nrfnh.exe19⤵
- Executes dropped EXE
PID:2404 -
\??\c:\dldvhj.exec:\dldvhj.exe20⤵
- Executes dropped EXE
PID:1760 -
\??\c:\vjhbltl.exec:\vjhbltl.exe21⤵
- Executes dropped EXE
PID:2092 -
\??\c:\vxjxh.exec:\vxjxh.exe22⤵
- Executes dropped EXE
PID:388 -
\??\c:\vnhxh.exec:\vnhxh.exe23⤵
- Executes dropped EXE
PID:708 -
\??\c:\hnfjp.exec:\hnfjp.exe24⤵
- Executes dropped EXE
PID:1852 -
\??\c:\hrljvn.exec:\hrljvn.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1120 -
\??\c:\lbbvhf.exec:\lbbvhf.exe26⤵
- Executes dropped EXE
PID:1920 -
\??\c:\vttlpvt.exec:\vttlpvt.exe27⤵
- Executes dropped EXE
PID:1508 -
\??\c:\jvfjr.exec:\jvfjr.exe28⤵
- Executes dropped EXE
PID:1848 -
\??\c:\rjpfhxx.exec:\rjpfhxx.exe29⤵
- Executes dropped EXE
PID:3040 -
\??\c:\htldhd.exec:\htldhd.exe30⤵
- Executes dropped EXE
PID:2528 -
\??\c:\njlrxhd.exec:\njlrxhd.exe31⤵
- Executes dropped EXE
PID:2008 -
\??\c:\ljpjhp.exec:\ljpjhp.exe32⤵
- Executes dropped EXE
PID:2012 -
\??\c:\pvrrpj.exec:\pvrrpj.exe33⤵
- Executes dropped EXE
PID:1972 -
\??\c:\bbtbvrp.exec:\bbtbvrp.exe34⤵
- Executes dropped EXE
PID:844 -
\??\c:\fdlldp.exec:\fdlldp.exe35⤵
- Executes dropped EXE
PID:1588 -
\??\c:\pjjltf.exec:\pjjltf.exe36⤵
- Executes dropped EXE
PID:2740 -
\??\c:\dpxjlf.exec:\dpxjlf.exe37⤵
- Executes dropped EXE
PID:2992 -
\??\c:\frhpvxr.exec:\frhpvxr.exe38⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xfrpnt.exec:\xfrpnt.exe39⤵
- Executes dropped EXE
PID:2732 -
\??\c:\tlhnjl.exec:\tlhnjl.exe40⤵
- Executes dropped EXE
PID:2728 -
\??\c:\tlhnjjd.exec:\tlhnjjd.exe41⤵
- Executes dropped EXE
PID:2636 -
\??\c:\bltnl.exec:\bltnl.exe42⤵
- Executes dropped EXE
PID:2612 -
\??\c:\ndnftxb.exec:\ndnftxb.exe43⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jjppj.exec:\jjppj.exe44⤵
- Executes dropped EXE
PID:2824 -
\??\c:\dprbt.exec:\dprbt.exe45⤵
- Executes dropped EXE
PID:636 -
\??\c:\fbtlfnx.exec:\fbtlfnx.exe46⤵
- Executes dropped EXE
PID:2892 -
\??\c:\lltnrdx.exec:\lltnrdx.exe47⤵
- Executes dropped EXE
PID:772 -
\??\c:\pptdhnn.exec:\pptdhnn.exe48⤵
- Executes dropped EXE
PID:1116 -
\??\c:\xbtnhxd.exec:\xbtnhxd.exe49⤵
- Executes dropped EXE
PID:648 -
\??\c:\htvvnjn.exec:\htvvnjn.exe50⤵
- Executes dropped EXE
PID:1380 -
\??\c:\bjnfdbx.exec:\bjnfdbx.exe51⤵
- Executes dropped EXE
PID:1768 -
\??\c:\hjrdpdr.exec:\hjrdpdr.exe52⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vxxxll.exec:\vxxxll.exe53⤵
- Executes dropped EXE
PID:700 -
\??\c:\hpvvx.exec:\hpvvx.exe54⤵
- Executes dropped EXE
PID:776 -
\??\c:\jjlhvb.exec:\jjlhvb.exe55⤵
- Executes dropped EXE
PID:2468 -
\??\c:\lpxrr.exec:\lpxrr.exe56⤵
- Executes dropped EXE
PID:2084 -
\??\c:\fdvplx.exec:\fdvplx.exe57⤵
- Executes dropped EXE
PID:2420 -
\??\c:\dhvrrtt.exec:\dhvrrtt.exe58⤵
- Executes dropped EXE
PID:1928 -
\??\c:\pfhbvj.exec:\pfhbvj.exe59⤵
- Executes dropped EXE
PID:2400 -
\??\c:\hhbpxp.exec:\hhbpxp.exe60⤵
- Executes dropped EXE
PID:2140 -
\??\c:\fjnrd.exec:\fjnrd.exe61⤵
- Executes dropped EXE
PID:616 -
\??\c:\rfddfp.exec:\rfddfp.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:236 -
\??\c:\lxhtnp.exec:\lxhtnp.exe63⤵
- Executes dropped EXE
PID:708 -
\??\c:\pjpll.exec:\pjpll.exe64⤵
- Executes dropped EXE
PID:1852 -
\??\c:\jlpnf.exec:\jlpnf.exe65⤵
- Executes dropped EXE
PID:2208 -
\??\c:\bjlvv.exec:\bjlvv.exe66⤵PID:1940
-
\??\c:\lfftxtj.exec:\lfftxtj.exe67⤵PID:1148
-
\??\c:\bnxrbvh.exec:\bnxrbvh.exe68⤵PID:1624
-
\??\c:\lbhdhr.exec:\lbhdhr.exe69⤵PID:1228
-
\??\c:\hpbtlj.exec:\hpbtlj.exe70⤵PID:2364
-
\??\c:\hntpht.exec:\hntpht.exe71⤵PID:1616
-
\??\c:\tfnvfbb.exec:\tfnvfbb.exe72⤵PID:1152
-
\??\c:\pxrxl.exec:\pxrxl.exe73⤵PID:1676
-
\??\c:\jfhtp.exec:\jfhtp.exe74⤵PID:1696
-
\??\c:\rdhll.exec:\rdhll.exe75⤵PID:2012
-
\??\c:\trrnr.exec:\trrnr.exe76⤵PID:2448
-
\??\c:\vlrjxft.exec:\vlrjxft.exe77⤵PID:1592
-
\??\c:\vvnbf.exec:\vvnbf.exe78⤵PID:2748
-
\??\c:\vbhtlb.exec:\vbhtlb.exe79⤵PID:2816
-
\??\c:\lvlxf.exec:\lvlxf.exe80⤵PID:2724
-
\??\c:\hxdbhn.exec:\hxdbhn.exe81⤵PID:2112
-
\??\c:\dffhtfx.exec:\dffhtfx.exe82⤵PID:2916
-
\??\c:\rdblhrj.exec:\rdblhrj.exe83⤵PID:2852
-
\??\c:\bddbjj.exec:\bddbjj.exe84⤵PID:2728
-
\??\c:\hnrfbf.exec:\hnrfbf.exe85⤵PID:2820
-
\??\c:\pndnhx.exec:\pndnhx.exe86⤵PID:2664
-
\??\c:\vbxfb.exec:\vbxfb.exe87⤵PID:3052
-
\??\c:\tpdvhxn.exec:\tpdvhxn.exe88⤵PID:2940
-
\??\c:\xprtppp.exec:\xprtppp.exe89⤵PID:636
-
\??\c:\dptbpb.exec:\dptbpb.exe90⤵PID:2844
-
\??\c:\vfdbrj.exec:\vfdbrj.exe91⤵PID:1956
-
\??\c:\nvjfjf.exec:\nvjfjf.exe92⤵PID:1116
-
\??\c:\lbxjlr.exec:\lbxjlr.exe93⤵PID:1784
-
\??\c:\htfxjxn.exec:\htfxjxn.exe94⤵PID:1380
-
\??\c:\xpnhdfr.exec:\xpnhdfr.exe95⤵PID:1768
-
\??\c:\pnlbh.exec:\pnlbh.exe96⤵PID:3036
-
\??\c:\jvfxbrd.exec:\jvfxbrd.exe97⤵PID:2304
-
\??\c:\dfdpt.exec:\dfdpt.exe98⤵PID:548
-
\??\c:\xvvrf.exec:\xvvrf.exe99⤵PID:2068
-
\??\c:\xtxjlfn.exec:\xtxjlfn.exe100⤵PID:2084
-
\??\c:\frrpljh.exec:\frrpljh.exe101⤵PID:2420
-
\??\c:\rnbvbr.exec:\rnbvbr.exe102⤵PID:2328
-
\??\c:\rpbntl.exec:\rpbntl.exe103⤵PID:2176
-
\??\c:\pdlpvpn.exec:\pdlpvpn.exe104⤵PID:1636
-
\??\c:\xrprf.exec:\xrprf.exe105⤵PID:1136
-
\??\c:\jrpbv.exec:\jrpbv.exe106⤵PID:2028
-
\??\c:\bhrpp.exec:\bhrpp.exe107⤵PID:2324
-
\??\c:\hpvhp.exec:\hpvhp.exe108⤵PID:1496
-
\??\c:\pxvrnvd.exec:\pxvrnvd.exe109⤵PID:1292
-
\??\c:\hdfndtb.exec:\hdfndtb.exe110⤵PID:1940
-
\??\c:\fhnpxph.exec:\fhnpxph.exe111⤵PID:536
-
\??\c:\xbnprr.exec:\xbnprr.exe112⤵PID:2080
-
\??\c:\jfhxr.exec:\jfhxr.exe113⤵PID:1404
-
\??\c:\bdtfjl.exec:\bdtfjl.exe114⤵PID:2364
-
\??\c:\phnxd.exec:\phnxd.exe115⤵PID:2024
-
\??\c:\vlrvdp.exec:\vlrvdp.exe116⤵PID:1664
-
\??\c:\phrtfjb.exec:\phrtfjb.exe117⤵PID:2504
-
\??\c:\xfjvbrf.exec:\xfjvbrf.exe118⤵PID:892
-
\??\c:\nfvlx.exec:\nfvlx.exe119⤵PID:884
-
\??\c:\tfrxx.exec:\tfrxx.exe120⤵PID:2316
-
\??\c:\dnfftx.exec:\dnfftx.exe121⤵PID:1756
-
\??\c:\dfdnld.exec:\dfdnld.exe122⤵PID:2444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-