Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 18:50
Static task
static1
Behavioral task
behavioral1
Sample
8f6c38ff8af09b756bcfe6534c627b9d568d0b1b729d47c6965c77162161f2a4.exe
Resource
win7-20241010-en
General
-
Target
8f6c38ff8af09b756bcfe6534c627b9d568d0b1b729d47c6965c77162161f2a4.exe
-
Size
453KB
-
MD5
49fcec3b74248fb90a3bafd624b1ce3e
-
SHA1
9b4995b8f2c37ae3f7d92eb8b02e9b18ae7a5b41
-
SHA256
8f6c38ff8af09b756bcfe6534c627b9d568d0b1b729d47c6965c77162161f2a4
-
SHA512
447555d32fd7af15827a6df5ec67a272b16d3e72936ac0b0f62a9ab81de04f5d8aa51cc287df16b7aaab5254cda7783ba276d95c76fceed6e125e249719da078
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/572-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-174-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2400-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-202-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1280-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-229-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/864-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-311-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1980-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-321-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2756-343-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2788-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1236-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/936-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-503-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1876-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-623-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-688-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/584-695-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2472-745-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3064-816-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/880-887-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2300 dbjvj.exe 2756 frnnj.exe 2904 brfhnft.exe 2772 phdfl.exe 1660 bjndfn.exe 2688 vflfxpx.exe 2716 fxflvbx.exe 2156 jfvlbn.exe 1628 lptbfj.exe 1048 npjvtfl.exe 2420 rhnxxfr.exe 2956 fhpbbn.exe 2724 nhjrrld.exe 3024 rjfjrpx.exe 2976 fdjxpt.exe 1964 prvtt.exe 2544 rhllxjr.exe 2064 bvxxxfx.exe 2400 tdprrv.exe 2088 tplhj.exe 2212 tnnxjb.exe 1280 nnnbvh.exe 1804 ddbfb.exe 280 xdhjrbb.exe 2564 hnllpxr.exe 864 dtrdbp.exe 1484 lpjlfn.exe 1748 hphphpx.exe 2012 vvrtrr.exe 1072 xttjrbh.exe 2092 phdjdbx.exe 108 xpbdrt.exe 880 jxphb.exe 1980 nrhpx.exe 572 bhnjx.exe 2484 ffjtnx.exe 2808 rbhdl.exe 2756 btrhh.exe 2788 pthhvnb.exe 2464 fhxlh.exe 3048 dpnhjn.exe 3052 xprvl.exe 2696 dnhdhtn.exe 2272 jpntpnd.exe 1580 jfvjbdp.exe 1808 vffnd.exe 1236 ppjtpn.exe 2588 jnbfllj.exe 2872 dhrdx.exe 3056 hxdtb.exe 2948 xnjtdxd.exe 2468 pvvrp.exe 936 rbtblp.exe 3004 dxbjb.exe 2368 ntpjn.exe 2084 xvhbppp.exe 1016 trhbv.exe 1768 vlhbn.exe 2176 vntvlpf.exe 2364 dtnrxp.exe 1872 dfrtl.exe 1876 dtphbd.exe 1756 vxjfjbt.exe 948 rvvrpr.exe -
resource yara_rule behavioral1/memory/572-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-383-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1808-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1236-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/936-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-816-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfxftv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tprbjfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhjpxpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vplhhfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njvlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tblvndt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbvpbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdbjhpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbthpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hblbvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfrnxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdrhplf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bphvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfbljd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfprbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdjvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvbrvlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxbvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxdlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnvlnft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brhrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfnbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbltjtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvhdvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnbrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtdbbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lthrnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpntpnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttrdtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jflhjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvfnbxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtxxbpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nppbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpxnvjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnprrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tplhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvjvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnxnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 572 wrote to memory of 2300 572 8f6c38ff8af09b756bcfe6534c627b9d568d0b1b729d47c6965c77162161f2a4.exe 29 PID 572 wrote to memory of 2300 572 8f6c38ff8af09b756bcfe6534c627b9d568d0b1b729d47c6965c77162161f2a4.exe 29 PID 572 wrote to memory of 2300 572 8f6c38ff8af09b756bcfe6534c627b9d568d0b1b729d47c6965c77162161f2a4.exe 29 PID 572 wrote to memory of 2300 572 8f6c38ff8af09b756bcfe6534c627b9d568d0b1b729d47c6965c77162161f2a4.exe 29 PID 2300 wrote to memory of 2756 2300 dbjvj.exe 30 PID 2300 wrote to memory of 2756 2300 dbjvj.exe 30 PID 2300 wrote to memory of 2756 2300 dbjvj.exe 30 PID 2300 wrote to memory of 2756 2300 dbjvj.exe 30 PID 2756 wrote to memory of 2904 2756 frnnj.exe 31 PID 2756 wrote to memory of 2904 2756 frnnj.exe 31 PID 2756 wrote to memory of 2904 2756 frnnj.exe 31 PID 2756 wrote to memory of 2904 2756 frnnj.exe 31 PID 2904 wrote to memory of 2772 2904 brfhnft.exe 32 PID 2904 wrote to memory of 2772 2904 brfhnft.exe 32 PID 2904 wrote to memory of 2772 2904 brfhnft.exe 32 PID 2904 wrote to memory of 2772 2904 brfhnft.exe 32 PID 2772 wrote to memory of 1660 2772 phdfl.exe 33 PID 2772 wrote to memory of 1660 2772 phdfl.exe 33 PID 2772 wrote to memory of 1660 2772 phdfl.exe 33 PID 2772 wrote to memory of 1660 2772 phdfl.exe 33 PID 1660 wrote to memory of 2688 1660 bjndfn.exe 34 PID 1660 wrote to memory of 2688 1660 bjndfn.exe 34 PID 1660 wrote to memory of 2688 1660 bjndfn.exe 34 PID 1660 wrote to memory of 2688 1660 bjndfn.exe 34 PID 2688 wrote to memory of 2716 2688 vflfxpx.exe 35 PID 2688 wrote to memory of 2716 2688 vflfxpx.exe 35 PID 2688 wrote to memory of 2716 2688 vflfxpx.exe 35 PID 2688 wrote to memory of 2716 2688 vflfxpx.exe 35 PID 2716 wrote to memory of 2156 2716 fxflvbx.exe 36 PID 2716 wrote to memory of 2156 2716 fxflvbx.exe 36 PID 2716 wrote to memory of 2156 2716 fxflvbx.exe 36 PID 2716 wrote to memory of 2156 2716 fxflvbx.exe 36 PID 2156 wrote to memory of 1628 2156 jfvlbn.exe 37 PID 2156 wrote to memory of 1628 2156 jfvlbn.exe 37 PID 2156 wrote to memory of 1628 2156 jfvlbn.exe 37 PID 2156 wrote to memory of 1628 2156 jfvlbn.exe 37 PID 1628 wrote to memory of 1048 1628 lptbfj.exe 38 PID 1628 wrote to memory of 1048 1628 lptbfj.exe 38 PID 1628 wrote to memory of 1048 1628 lptbfj.exe 38 PID 1628 wrote to memory of 1048 1628 lptbfj.exe 38 PID 1048 wrote to memory of 2420 1048 npjvtfl.exe 39 PID 1048 wrote to memory of 2420 1048 npjvtfl.exe 39 PID 1048 wrote to memory of 2420 1048 npjvtfl.exe 39 PID 1048 wrote to memory of 2420 1048 npjvtfl.exe 39 PID 2420 wrote to memory of 2956 2420 rhnxxfr.exe 40 PID 2420 wrote to memory of 2956 2420 rhnxxfr.exe 40 PID 2420 wrote to memory of 2956 2420 rhnxxfr.exe 40 PID 2420 wrote to memory of 2956 2420 rhnxxfr.exe 40 PID 2956 wrote to memory of 2724 2956 fhpbbn.exe 41 PID 2956 wrote to memory of 2724 2956 fhpbbn.exe 41 PID 2956 wrote to memory of 2724 2956 fhpbbn.exe 41 PID 2956 wrote to memory of 2724 2956 fhpbbn.exe 41 PID 2724 wrote to memory of 3024 2724 nhjrrld.exe 42 PID 2724 wrote to memory of 3024 2724 nhjrrld.exe 42 PID 2724 wrote to memory of 3024 2724 nhjrrld.exe 42 PID 2724 wrote to memory of 3024 2724 nhjrrld.exe 42 PID 3024 wrote to memory of 2976 3024 rjfjrpx.exe 43 PID 3024 wrote to memory of 2976 3024 rjfjrpx.exe 43 PID 3024 wrote to memory of 2976 3024 rjfjrpx.exe 43 PID 3024 wrote to memory of 2976 3024 rjfjrpx.exe 43 PID 2976 wrote to memory of 1964 2976 fdjxpt.exe 44 PID 2976 wrote to memory of 1964 2976 fdjxpt.exe 44 PID 2976 wrote to memory of 1964 2976 fdjxpt.exe 44 PID 2976 wrote to memory of 1964 2976 fdjxpt.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f6c38ff8af09b756bcfe6534c627b9d568d0b1b729d47c6965c77162161f2a4.exe"C:\Users\Admin\AppData\Local\Temp\8f6c38ff8af09b756bcfe6534c627b9d568d0b1b729d47c6965c77162161f2a4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\dbjvj.exec:\dbjvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\frnnj.exec:\frnnj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\brfhnft.exec:\brfhnft.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\phdfl.exec:\phdfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\bjndfn.exec:\bjndfn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\vflfxpx.exec:\vflfxpx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\fxflvbx.exec:\fxflvbx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\jfvlbn.exec:\jfvlbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\lptbfj.exec:\lptbfj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\npjvtfl.exec:\npjvtfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\rhnxxfr.exec:\rhnxxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\fhpbbn.exec:\fhpbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\nhjrrld.exec:\nhjrrld.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rjfjrpx.exec:\rjfjrpx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\fdjxpt.exec:\fdjxpt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\prvtt.exec:\prvtt.exe17⤵
- Executes dropped EXE
PID:1964 -
\??\c:\rhllxjr.exec:\rhllxjr.exe18⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bvxxxfx.exec:\bvxxxfx.exe19⤵
- Executes dropped EXE
PID:2064 -
\??\c:\tdprrv.exec:\tdprrv.exe20⤵
- Executes dropped EXE
PID:2400 -
\??\c:\tplhj.exec:\tplhj.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2088 -
\??\c:\tnnxjb.exec:\tnnxjb.exe22⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nnnbvh.exec:\nnnbvh.exe23⤵
- Executes dropped EXE
PID:1280 -
\??\c:\ddbfb.exec:\ddbfb.exe24⤵
- Executes dropped EXE
PID:1804 -
\??\c:\xdhjrbb.exec:\xdhjrbb.exe25⤵
- Executes dropped EXE
PID:280 -
\??\c:\hnllpxr.exec:\hnllpxr.exe26⤵
- Executes dropped EXE
PID:2564 -
\??\c:\dtrdbp.exec:\dtrdbp.exe27⤵
- Executes dropped EXE
PID:864 -
\??\c:\lpjlfn.exec:\lpjlfn.exe28⤵
- Executes dropped EXE
PID:1484 -
\??\c:\hphphpx.exec:\hphphpx.exe29⤵
- Executes dropped EXE
PID:1748 -
\??\c:\vvrtrr.exec:\vvrtrr.exe30⤵
- Executes dropped EXE
PID:2012 -
\??\c:\xttjrbh.exec:\xttjrbh.exe31⤵
- Executes dropped EXE
PID:1072 -
\??\c:\phdjdbx.exec:\phdjdbx.exe32⤵
- Executes dropped EXE
PID:2092 -
\??\c:\xpbdrt.exec:\xpbdrt.exe33⤵
- Executes dropped EXE
PID:108 -
\??\c:\jxphb.exec:\jxphb.exe34⤵
- Executes dropped EXE
PID:880 -
\??\c:\nrhpx.exec:\nrhpx.exe35⤵
- Executes dropped EXE
PID:1980 -
\??\c:\bhnjx.exec:\bhnjx.exe36⤵
- Executes dropped EXE
PID:572 -
\??\c:\ffjtnx.exec:\ffjtnx.exe37⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rbhdl.exec:\rbhdl.exe38⤵
- Executes dropped EXE
PID:2808 -
\??\c:\btrhh.exec:\btrhh.exe39⤵
- Executes dropped EXE
PID:2756 -
\??\c:\pthhvnb.exec:\pthhvnb.exe40⤵
- Executes dropped EXE
PID:2788 -
\??\c:\fhxlh.exec:\fhxlh.exe41⤵
- Executes dropped EXE
PID:2464 -
\??\c:\dpnhjn.exec:\dpnhjn.exe42⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xprvl.exec:\xprvl.exe43⤵
- Executes dropped EXE
PID:3052 -
\??\c:\dnhdhtn.exec:\dnhdhtn.exe44⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jpntpnd.exec:\jpntpnd.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2272 -
\??\c:\jfvjbdp.exec:\jfvjbdp.exe46⤵
- Executes dropped EXE
PID:1580 -
\??\c:\vffnd.exec:\vffnd.exe47⤵
- Executes dropped EXE
PID:1808 -
\??\c:\ppjtpn.exec:\ppjtpn.exe48⤵
- Executes dropped EXE
PID:1236 -
\??\c:\jnbfllj.exec:\jnbfllj.exe49⤵
- Executes dropped EXE
PID:2588 -
\??\c:\dhrdx.exec:\dhrdx.exe50⤵
- Executes dropped EXE
PID:2872 -
\??\c:\hxdtb.exec:\hxdtb.exe51⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xnjtdxd.exec:\xnjtdxd.exe52⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pvvrp.exec:\pvvrp.exe53⤵
- Executes dropped EXE
PID:2468 -
\??\c:\rbtblp.exec:\rbtblp.exe54⤵
- Executes dropped EXE
PID:936 -
\??\c:\dxbjb.exec:\dxbjb.exe55⤵
- Executes dropped EXE
PID:3004 -
\??\c:\ntpjn.exec:\ntpjn.exe56⤵
- Executes dropped EXE
PID:2368 -
\??\c:\xvhbppp.exec:\xvhbppp.exe57⤵
- Executes dropped EXE
PID:2084 -
\??\c:\trhbv.exec:\trhbv.exe58⤵
- Executes dropped EXE
PID:1016 -
\??\c:\vlhbn.exec:\vlhbn.exe59⤵
- Executes dropped EXE
PID:1768 -
\??\c:\vntvlpf.exec:\vntvlpf.exe60⤵
- Executes dropped EXE
PID:2176 -
\??\c:\dtnrxp.exec:\dtnrxp.exe61⤵
- Executes dropped EXE
PID:2364 -
\??\c:\dfrtl.exec:\dfrtl.exe62⤵
- Executes dropped EXE
PID:1872 -
\??\c:\dtphbd.exec:\dtphbd.exe63⤵
- Executes dropped EXE
PID:1876 -
\??\c:\vxjfjbt.exec:\vxjfjbt.exe64⤵
- Executes dropped EXE
PID:1756 -
\??\c:\rvvrpr.exec:\rvvrpr.exe65⤵
- Executes dropped EXE
PID:948 -
\??\c:\dfdrxd.exec:\dfdrxd.exe66⤵PID:2496
-
\??\c:\brxhhpv.exec:\brxhhpv.exe67⤵PID:1672
-
\??\c:\rxdnl.exec:\rxdnl.exe68⤵PID:2040
-
\??\c:\dljpvv.exec:\dljpvv.exe69⤵PID:1688
-
\??\c:\xlhnx.exec:\xlhnx.exe70⤵PID:860
-
\??\c:\tljpd.exec:\tljpd.exe71⤵PID:960
-
\??\c:\tdnjxv.exec:\tdnjxv.exe72⤵PID:2000
-
\??\c:\xddjxdb.exec:\xddjxdb.exe73⤵PID:1564
-
\??\c:\fxdxhj.exec:\fxdxhj.exe74⤵PID:2500
-
\??\c:\jbjbrhl.exec:\jbjbrhl.exe75⤵PID:568
-
\??\c:\rvhjnjd.exec:\rvhjnjd.exe76⤵PID:1108
-
\??\c:\lbhrd.exec:\lbhrd.exe77⤵PID:2408
-
\??\c:\vdlfrrt.exec:\vdlfrrt.exe78⤵PID:2148
-
\??\c:\jdhjv.exec:\jdhjv.exe79⤵PID:1596
-
\??\c:\vbjdjhp.exec:\vbjdjhp.exe80⤵PID:2396
-
\??\c:\tjpxfv.exec:\tjpxfv.exe81⤵PID:2484
-
\??\c:\nvjvb.exec:\nvjvb.exe82⤵
- System Location Discovery: System Language Discovery
PID:2792 -
\??\c:\vdftlx.exec:\vdftlx.exe83⤵PID:2900
-
\??\c:\pnldv.exec:\pnldv.exe84⤵PID:2780
-
\??\c:\dldlxp.exec:\dldlxp.exe85⤵PID:3060
-
\??\c:\dvtdjbb.exec:\dvtdjbb.exe86⤵PID:3044
-
\??\c:\tvvbj.exec:\tvvbj.exe87⤵PID:2688
-
\??\c:\fxvfjh.exec:\fxvfjh.exe88⤵PID:2704
-
\??\c:\drdhbxn.exec:\drdhbxn.exe89⤵PID:2648
-
\??\c:\bpvtpbb.exec:\bpvtpbb.exe90⤵PID:1188
-
\??\c:\rnrnlr.exec:\rnrnlr.exe91⤵PID:1708
-
\??\c:\fplnjx.exec:\fplnjx.exe92⤵PID:584
-
\??\c:\vtrjrb.exec:\vtrjrb.exe93⤵PID:1164
-
\??\c:\vbfpxbl.exec:\vbfpxbl.exe94⤵PID:1472
-
\??\c:\pxvnl.exec:\pxvnl.exe95⤵PID:3032
-
\??\c:\jffnlvl.exec:\jffnlvl.exe96⤵PID:2512
-
\??\c:\tdxvp.exec:\tdxvp.exe97⤵PID:2472
-
\??\c:\dlxbxlr.exec:\dlxbxlr.exe98⤵PID:2764
-
\??\c:\lxppnh.exec:\lxppnh.exe99⤵PID:1060
-
\??\c:\rflxd.exec:\rflxd.exe100⤵PID:1076
-
\??\c:\ppvpr.exec:\ppvpr.exe101⤵PID:1988
-
\??\c:\brttx.exec:\brttx.exe102⤵PID:1836
-
\??\c:\jjvrx.exec:\jjvrx.exe103⤵PID:2840
-
\??\c:\rdlpp.exec:\rdlpp.exe104⤵PID:2384
-
\??\c:\rthdn.exec:\rthdn.exe105⤵PID:2208
-
\??\c:\hvjvfj.exec:\hvjvfj.exe106⤵PID:2372
-
\??\c:\plxrxr.exec:\plxrxr.exe107⤵PID:2548
-
\??\c:\vlrdtf.exec:\vlrdtf.exe108⤵PID:1084
-
\??\c:\bnvjfdj.exec:\bnvjfdj.exe109⤵PID:1536
-
\??\c:\njjpnbr.exec:\njjpnbr.exe110⤵PID:2044
-
\??\c:\jdxtfb.exec:\jdxtfb.exe111⤵PID:560
-
\??\c:\pdfjhbb.exec:\pdfjhbb.exe112⤵PID:3064
-
\??\c:\bfdhb.exec:\bfdhb.exe113⤵PID:1800
-
\??\c:\dvrpvr.exec:\dvrpvr.exe114⤵PID:1712
-
\??\c:\dlbnhdf.exec:\dlbnhdf.exe115⤵PID:2524
-
\??\c:\njvrtn.exec:\njvrtn.exe116⤵PID:1748
-
\??\c:\hlttx.exec:\hlttx.exe117⤵PID:2516
-
\??\c:\jrbtfjx.exec:\jrbtfjx.exe118⤵PID:940
-
\??\c:\ttrtd.exec:\ttrtd.exe119⤵PID:2456
-
\??\c:\lvrtb.exec:\lvrtb.exe120⤵PID:2436
-
\??\c:\jtxjl.exec:\jtxjl.exe121⤵PID:1588
-
\??\c:\rfbrr.exec:\rfbrr.exe122⤵PID:880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-