Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 14:26
Static task
static1
Behavioral task
behavioral1
Sample
203a73351e8256492dfb17a90e9ac5d7eb9003382daf89d8277382f387d0b2b7N.exe
Resource
win7-20241010-en
General
-
Target
203a73351e8256492dfb17a90e9ac5d7eb9003382daf89d8277382f387d0b2b7N.exe
-
Size
453KB
-
MD5
e63f4c3335ed2b30e85943c9d14e59a0
-
SHA1
7614c82578a00b8d2a719268f654cff6a9f2382a
-
SHA256
203a73351e8256492dfb17a90e9ac5d7eb9003382daf89d8277382f387d0b2b7
-
SHA512
031148bf410dc839871db171f261370f31ed087783ac78f9a45574cba1f5f4a82529f8d9663a3a6a4c048f19dfec0571d0b54cd60fc70a4ff091d1ef3a570f5f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbec:q7Tc2NYHUrAwfMp3CDc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2248-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-17-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2872-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-52-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2764-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-180-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1592-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1068-273-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1068-271-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1688-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-466-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2456-474-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2708-481-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2280-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-570-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/2372-629-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-760-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1844-782-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1844-787-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-889-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2320-954-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2840 dpjpdd.exe 2956 vjdddlr.exe 2872 tjddd.exe 3012 dphflp.exe 2672 dhlvtht.exe 2764 rbrltf.exe 2612 hrxlhn.exe 2728 fhxntb.exe 2380 ttrtpnj.exe 1684 prdlnbv.exe 2348 hrdfvr.exe 2692 btdxrb.exe 2788 phvjhpj.exe 2808 ptldjpx.exe 1972 fbljrlt.exe 2932 lrttfl.exe 1976 fjflfvj.exe 2116 dxnxr.exe 2200 hbjrh.exe 396 nrtbx.exe 2520 ltthdtv.exe 1592 xxrfvdh.exe 2532 jrbxh.exe 1848 drflvlf.exe 2644 vfdjvr.exe 1504 nphrb.exe 1192 ptbdjfh.exe 112 tndvrtt.exe 1068 bhrnjjd.exe 1060 xldxn.exe 1688 dhltndv.exe 884 jldth.exe 664 hbbtn.exe 2580 xhfjrrh.exe 2988 dhrnppd.exe 2904 pbrrbxb.exe 2896 nljljh.exe 3008 pphjp.exe 972 rftrrvb.exe 2804 jfprll.exe 2760 vddfpr.exe 2868 vxxdlb.exe 2436 lfpxjr.exe 944 lpthjjx.exe 2172 xbrdd.exe 2080 tblln.exe 984 ldddphx.exe 2092 fdbjt.exe 3028 rvpnnrl.exe 3052 bntjn.exe 2104 xtfxb.exe 2788 bvphxbx.exe 1444 xvxhf.exe 2696 llhxh.exe 1640 drpbjpf.exe 1776 hvhjdj.exe 2456 nfdfdr.exe 2708 hdnfhv.exe 2280 tpvbbnv.exe 2060 dhtldhb.exe 980 djlxdlv.exe 1388 pjvbh.exe 320 hxpxtp.exe 2532 bjflffx.exe -
resource yara_rule behavioral1/memory/2248-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/664-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-839-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-896-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-979-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fndlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlnhph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djhnhhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnvfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnjnxfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjxhjnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhprnlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvbll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nddbfdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrrbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfpxjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfdjvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlnvblt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbvtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbbjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvpnnrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prhvfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjphhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnpprpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbxtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbxxtjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plllnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdddlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jldth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbjtnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbrdln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljddjxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrpphx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btdxrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hndxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trxbllv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrdfvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdfxlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thvhdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xddjjnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpnpvxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrdbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtpxfjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prbvbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxdplb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftrfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjjjj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2840 2248 203a73351e8256492dfb17a90e9ac5d7eb9003382daf89d8277382f387d0b2b7N.exe 30 PID 2248 wrote to memory of 2840 2248 203a73351e8256492dfb17a90e9ac5d7eb9003382daf89d8277382f387d0b2b7N.exe 30 PID 2248 wrote to memory of 2840 2248 203a73351e8256492dfb17a90e9ac5d7eb9003382daf89d8277382f387d0b2b7N.exe 30 PID 2248 wrote to memory of 2840 2248 203a73351e8256492dfb17a90e9ac5d7eb9003382daf89d8277382f387d0b2b7N.exe 30 PID 2840 wrote to memory of 2956 2840 dpjpdd.exe 31 PID 2840 wrote to memory of 2956 2840 dpjpdd.exe 31 PID 2840 wrote to memory of 2956 2840 dpjpdd.exe 31 PID 2840 wrote to memory of 2956 2840 dpjpdd.exe 31 PID 2956 wrote to memory of 2872 2956 vjdddlr.exe 32 PID 2956 wrote to memory of 2872 2956 vjdddlr.exe 32 PID 2956 wrote to memory of 2872 2956 vjdddlr.exe 32 PID 2956 wrote to memory of 2872 2956 vjdddlr.exe 32 PID 2872 wrote to memory of 3012 2872 tjddd.exe 33 PID 2872 wrote to memory of 3012 2872 tjddd.exe 33 PID 2872 wrote to memory of 3012 2872 tjddd.exe 33 PID 2872 wrote to memory of 3012 2872 tjddd.exe 33 PID 3012 wrote to memory of 2672 3012 dphflp.exe 34 PID 3012 wrote to memory of 2672 3012 dphflp.exe 34 PID 3012 wrote to memory of 2672 3012 dphflp.exe 34 PID 3012 wrote to memory of 2672 3012 dphflp.exe 34 PID 2672 wrote to memory of 2764 2672 dhlvtht.exe 35 PID 2672 wrote to memory of 2764 2672 dhlvtht.exe 35 PID 2672 wrote to memory of 2764 2672 dhlvtht.exe 35 PID 2672 wrote to memory of 2764 2672 dhlvtht.exe 35 PID 2764 wrote to memory of 2612 2764 rbrltf.exe 36 PID 2764 wrote to memory of 2612 2764 rbrltf.exe 36 PID 2764 wrote to memory of 2612 2764 rbrltf.exe 36 PID 2764 wrote to memory of 2612 2764 rbrltf.exe 36 PID 2612 wrote to memory of 2728 2612 hrxlhn.exe 37 PID 2612 wrote to memory of 2728 2612 hrxlhn.exe 37 PID 2612 wrote to memory of 2728 2612 hrxlhn.exe 37 PID 2612 wrote to memory of 2728 2612 hrxlhn.exe 37 PID 2728 wrote to memory of 2380 2728 fhxntb.exe 38 PID 2728 wrote to memory of 2380 2728 fhxntb.exe 38 PID 2728 wrote to memory of 2380 2728 fhxntb.exe 38 PID 2728 wrote to memory of 2380 2728 fhxntb.exe 38 PID 2380 wrote to memory of 1684 2380 ttrtpnj.exe 39 PID 2380 wrote to memory of 1684 2380 ttrtpnj.exe 39 PID 2380 wrote to memory of 1684 2380 ttrtpnj.exe 39 PID 2380 wrote to memory of 1684 2380 ttrtpnj.exe 39 PID 1684 wrote to memory of 2348 1684 prdlnbv.exe 40 PID 1684 wrote to memory of 2348 1684 prdlnbv.exe 40 PID 1684 wrote to memory of 2348 1684 prdlnbv.exe 40 PID 1684 wrote to memory of 2348 1684 prdlnbv.exe 40 PID 2348 wrote to memory of 2692 2348 hrdfvr.exe 41 PID 2348 wrote to memory of 2692 2348 hrdfvr.exe 41 PID 2348 wrote to memory of 2692 2348 hrdfvr.exe 41 PID 2348 wrote to memory of 2692 2348 hrdfvr.exe 41 PID 2692 wrote to memory of 2788 2692 btdxrb.exe 42 PID 2692 wrote to memory of 2788 2692 btdxrb.exe 42 PID 2692 wrote to memory of 2788 2692 btdxrb.exe 42 PID 2692 wrote to memory of 2788 2692 btdxrb.exe 42 PID 2788 wrote to memory of 2808 2788 phvjhpj.exe 43 PID 2788 wrote to memory of 2808 2788 phvjhpj.exe 43 PID 2788 wrote to memory of 2808 2788 phvjhpj.exe 43 PID 2788 wrote to memory of 2808 2788 phvjhpj.exe 43 PID 2808 wrote to memory of 1972 2808 ptldjpx.exe 44 PID 2808 wrote to memory of 1972 2808 ptldjpx.exe 44 PID 2808 wrote to memory of 1972 2808 ptldjpx.exe 44 PID 2808 wrote to memory of 1972 2808 ptldjpx.exe 44 PID 1972 wrote to memory of 2932 1972 fbljrlt.exe 45 PID 1972 wrote to memory of 2932 1972 fbljrlt.exe 45 PID 1972 wrote to memory of 2932 1972 fbljrlt.exe 45 PID 1972 wrote to memory of 2932 1972 fbljrlt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\203a73351e8256492dfb17a90e9ac5d7eb9003382daf89d8277382f387d0b2b7N.exe"C:\Users\Admin\AppData\Local\Temp\203a73351e8256492dfb17a90e9ac5d7eb9003382daf89d8277382f387d0b2b7N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\dpjpdd.exec:\dpjpdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\vjdddlr.exec:\vjdddlr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\tjddd.exec:\tjddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\dphflp.exec:\dphflp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\dhlvtht.exec:\dhlvtht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\rbrltf.exec:\rbrltf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\hrxlhn.exec:\hrxlhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\fhxntb.exec:\fhxntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\ttrtpnj.exec:\ttrtpnj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\prdlnbv.exec:\prdlnbv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\hrdfvr.exec:\hrdfvr.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\btdxrb.exec:\btdxrb.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\phvjhpj.exec:\phvjhpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\ptldjpx.exec:\ptldjpx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\fbljrlt.exec:\fbljrlt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\lrttfl.exec:\lrttfl.exe17⤵
- Executes dropped EXE
PID:2932 -
\??\c:\fjflfvj.exec:\fjflfvj.exe18⤵
- Executes dropped EXE
PID:1976 -
\??\c:\dxnxr.exec:\dxnxr.exe19⤵
- Executes dropped EXE
PID:2116 -
\??\c:\hbjrh.exec:\hbjrh.exe20⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nrtbx.exec:\nrtbx.exe21⤵
- Executes dropped EXE
PID:396 -
\??\c:\ltthdtv.exec:\ltthdtv.exe22⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xxrfvdh.exec:\xxrfvdh.exe23⤵
- Executes dropped EXE
PID:1592 -
\??\c:\jrbxh.exec:\jrbxh.exe24⤵
- Executes dropped EXE
PID:2532 -
\??\c:\drflvlf.exec:\drflvlf.exe25⤵
- Executes dropped EXE
PID:1848 -
\??\c:\vfdjvr.exec:\vfdjvr.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2644 -
\??\c:\nphrb.exec:\nphrb.exe27⤵
- Executes dropped EXE
PID:1504 -
\??\c:\ptbdjfh.exec:\ptbdjfh.exe28⤵
- Executes dropped EXE
PID:1192 -
\??\c:\tndvrtt.exec:\tndvrtt.exe29⤵
- Executes dropped EXE
PID:112 -
\??\c:\bhrnjjd.exec:\bhrnjjd.exe30⤵
- Executes dropped EXE
PID:1068 -
\??\c:\xldxn.exec:\xldxn.exe31⤵
- Executes dropped EXE
PID:1060 -
\??\c:\dhltndv.exec:\dhltndv.exe32⤵
- Executes dropped EXE
PID:1688 -
\??\c:\jldth.exec:\jldth.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:884 -
\??\c:\hbbtn.exec:\hbbtn.exe34⤵
- Executes dropped EXE
PID:664 -
\??\c:\xhfjrrh.exec:\xhfjrrh.exe35⤵
- Executes dropped EXE
PID:2580 -
\??\c:\dhrnppd.exec:\dhrnppd.exe36⤵
- Executes dropped EXE
PID:2988 -
\??\c:\pbrrbxb.exec:\pbrrbxb.exe37⤵
- Executes dropped EXE
PID:2904 -
\??\c:\nljljh.exec:\nljljh.exe38⤵
- Executes dropped EXE
PID:2896 -
\??\c:\pphjp.exec:\pphjp.exe39⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rftrrvb.exec:\rftrrvb.exe40⤵
- Executes dropped EXE
PID:972 -
\??\c:\jfprll.exec:\jfprll.exe41⤵
- Executes dropped EXE
PID:2804 -
\??\c:\vddfpr.exec:\vddfpr.exe42⤵
- Executes dropped EXE
PID:2760 -
\??\c:\vxxdlb.exec:\vxxdlb.exe43⤵
- Executes dropped EXE
PID:2868 -
\??\c:\lfpxjr.exec:\lfpxjr.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2436 -
\??\c:\lpthjjx.exec:\lpthjjx.exe45⤵
- Executes dropped EXE
PID:944 -
\??\c:\xbrdd.exec:\xbrdd.exe46⤵
- Executes dropped EXE
PID:2172 -
\??\c:\tblln.exec:\tblln.exe47⤵
- Executes dropped EXE
PID:2080 -
\??\c:\ldddphx.exec:\ldddphx.exe48⤵
- Executes dropped EXE
PID:984 -
\??\c:\fdbjt.exec:\fdbjt.exe49⤵
- Executes dropped EXE
PID:2092 -
\??\c:\rvpnnrl.exec:\rvpnnrl.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3028 -
\??\c:\bntjn.exec:\bntjn.exe51⤵
- Executes dropped EXE
PID:3052 -
\??\c:\xtfxb.exec:\xtfxb.exe52⤵
- Executes dropped EXE
PID:2104 -
\??\c:\bvphxbx.exec:\bvphxbx.exe53⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xvxhf.exec:\xvxhf.exe54⤵
- Executes dropped EXE
PID:1444 -
\??\c:\llhxh.exec:\llhxh.exe55⤵
- Executes dropped EXE
PID:2696 -
\??\c:\drpbjpf.exec:\drpbjpf.exe56⤵
- Executes dropped EXE
PID:1640 -
\??\c:\hvhjdj.exec:\hvhjdj.exe57⤵
- Executes dropped EXE
PID:1776 -
\??\c:\nfdfdr.exec:\nfdfdr.exe58⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hdnfhv.exec:\hdnfhv.exe59⤵
- Executes dropped EXE
PID:2708 -
\??\c:\tpvbbnv.exec:\tpvbbnv.exe60⤵
- Executes dropped EXE
PID:2280 -
\??\c:\dhtldhb.exec:\dhtldhb.exe61⤵
- Executes dropped EXE
PID:2060 -
\??\c:\djlxdlv.exec:\djlxdlv.exe62⤵
- Executes dropped EXE
PID:980 -
\??\c:\pjvbh.exec:\pjvbh.exe63⤵
- Executes dropped EXE
PID:1388 -
\??\c:\hxpxtp.exec:\hxpxtp.exe64⤵
- Executes dropped EXE
PID:320 -
\??\c:\bjflffx.exec:\bjflffx.exe65⤵
- Executes dropped EXE
PID:2532 -
\??\c:\dlbdpt.exec:\dlbdpt.exe66⤵PID:1572
-
\??\c:\bhjvbfn.exec:\bhjvbfn.exe67⤵PID:948
-
\??\c:\xjrjtj.exec:\xjrjtj.exe68⤵PID:1836
-
\??\c:\vhhvr.exec:\vhhvr.exe69⤵PID:1216
-
\??\c:\prhvfh.exec:\prhvfh.exe70⤵
- System Location Discovery: System Language Discovery
PID:1132 -
\??\c:\xbrrldh.exec:\xbrrldh.exe71⤵PID:112
-
\??\c:\hdfxlh.exec:\hdfxlh.exe72⤵
- System Location Discovery: System Language Discovery
PID:2000 -
\??\c:\djvtjv.exec:\djvtjv.exe73⤵PID:1664
-
\??\c:\vdvhttv.exec:\vdvhttv.exe74⤵PID:752
-
\??\c:\hjrpvx.exec:\hjrpvx.exe75⤵PID:1156
-
\??\c:\trddxv.exec:\trddxv.exe76⤵PID:2332
-
\??\c:\xddjbh.exec:\xddjbh.exe77⤵PID:2248
-
\??\c:\nlntxvd.exec:\nlntxvd.exe78⤵PID:2224
-
\??\c:\bxlpf.exec:\bxlpf.exe79⤵PID:1612
-
\??\c:\pdlflt.exec:\pdlflt.exe80⤵PID:2968
-
\??\c:\dvpfh.exec:\dvpfh.exe81⤵PID:2856
-
\??\c:\trjxhlv.exec:\trjxhlv.exe82⤵PID:2372
-
\??\c:\vjpfpxl.exec:\vjpfpxl.exe83⤵PID:3008
-
\??\c:\nbjtnx.exec:\nbjtnx.exe84⤵
- System Location Discovery: System Language Discovery
PID:2556 -
\??\c:\jtpxfjt.exec:\jtpxfjt.exe85⤵
- System Location Discovery: System Language Discovery
PID:2752 -
\??\c:\tdlntpf.exec:\tdlntpf.exe86⤵PID:2760
-
\??\c:\fllbf.exec:\fllbf.exe87⤵PID:2868
-
\??\c:\rfhdhl.exec:\rfhdhl.exe88⤵PID:2256
-
\??\c:\xhnhx.exec:\xhnhx.exe89⤵PID:944
-
\??\c:\rtbnbr.exec:\rtbnbr.exe90⤵PID:1672
-
\??\c:\bfvpln.exec:\bfvpln.exe91⤵PID:2020
-
\??\c:\pnpjp.exec:\pnpjp.exe92⤵PID:2012
-
\??\c:\vflnf.exec:\vflnf.exe93⤵PID:984
-
\??\c:\trdbx.exec:\trdbx.exe94⤵PID:3056
-
\??\c:\drrhllj.exec:\drrhllj.exe95⤵PID:2692
-
\??\c:\rbdddj.exec:\rbdddj.exe96⤵PID:3032
-
\??\c:\rjdfbv.exec:\rjdfbv.exe97⤵PID:2844
-
\??\c:\xvtfhbh.exec:\xvtfhbh.exe98⤵PID:2516
-
\??\c:\nvntlh.exec:\nvntlh.exe99⤵PID:2296
-
\??\c:\xftnnf.exec:\xftnnf.exe100⤵PID:1972
-
\??\c:\fndlh.exec:\fndlh.exe101⤵
- System Location Discovery: System Language Discovery
PID:840 -
\??\c:\hnrbd.exec:\hnrbd.exe102⤵PID:2308
-
\??\c:\ndnxnrp.exec:\ndnxnrp.exe103⤵PID:2500
-
\??\c:\xnjxtd.exec:\xnjxtd.exe104⤵PID:2284
-
\??\c:\jjrpl.exec:\jjrpl.exe105⤵PID:2144
-
\??\c:\rjvtn.exec:\rjvtn.exe106⤵PID:1076
-
\??\c:\jbrnbpx.exec:\jbrnbpx.exe107⤵PID:1844
-
\??\c:\xxrnx.exec:\xxrnx.exe108⤵PID:2428
-
\??\c:\pxrfbvt.exec:\pxrfbvt.exe109⤵PID:1052
-
\??\c:\jhphdr.exec:\jhphdr.exe110⤵PID:1668
-
\??\c:\jvdhdr.exec:\jvdhdr.exe111⤵PID:1748
-
\??\c:\rrvblpx.exec:\rrvblpx.exe112⤵PID:1500
-
\??\c:\bjxhxbt.exec:\bjxhxbt.exe113⤵PID:2100
-
\??\c:\jxlftjn.exec:\jxlftjn.exe114⤵PID:1084
-
\??\c:\phlpdxn.exec:\phlpdxn.exe115⤵PID:2668
-
\??\c:\dvfjd.exec:\dvfjd.exe116⤵PID:2268
-
\??\c:\xltvppx.exec:\xltvppx.exe117⤵PID:1068
-
\??\c:\bllxbr.exec:\bllxbr.exe118⤵PID:2684
-
\??\c:\ddpddvj.exec:\ddpddvj.exe119⤵PID:1740
-
\??\c:\flxltx.exec:\flxltx.exe120⤵PID:1804
-
\??\c:\tbfxpb.exec:\tbfxpb.exe121⤵PID:2032
-
\??\c:\xjhxx.exec:\xjhxx.exe122⤵PID:1616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-