Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02/09/2024, 09:45
Behavioral task
behavioral1
Sample
d73f8d0c7d2b9f3179515b442942e910N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
d73f8d0c7d2b9f3179515b442942e910N.exe
-
Size
332KB
-
MD5
d73f8d0c7d2b9f3179515b442942e910
-
SHA1
f1865f2e55ae79f7bf122dab2aa0d9de93d4b124
-
SHA256
800d2fbaac0599cf1b931feb33e7194f2f1d142e6cfe32664b2f4a1a0e1c6628
-
SHA512
363914e5c637ae97c9bde604ffc7400563f66bc4a256d971787297fabbe4e1f6c6c2c304ff6ad7022496d66acccde632b4d2b691be182e9e0c2efb2636b28785
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeU:R4wFHoSHYHUrAwfMp3CDU
Malware Config
Signatures
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2252-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1056-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2412-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/468-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2132-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-184-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1708-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1020-274-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2056-280-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3044-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2144-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1596-304-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2720-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-333-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2736-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-352-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1524-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/588-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-447-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1932-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1408-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-515-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1972-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-532-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2056-554-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-570-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2524-618-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1724-686-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2844-723-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-822-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2324 pfdfvrr.exe 2608 jtfxhx.exe 2644 ndrvlth.exe 2716 rjxphpx.exe 2796 xdhpnrv.exe 2676 fbjfd.exe 2540 lbppvxl.exe 2688 hhnbv.exe 2588 fxddxln.exe 1056 pbxlvv.exe 2772 jxjnv.exe 2412 tdhjv.exe 468 xlvfpv.exe 1100 plxrf.exe 2832 vrtxfj.exe 1612 rxfjh.exe 2132 ftrlbjn.exe 2224 lxpjtbh.exe 2460 pnnhx.exe 2068 fvnhpr.exe 2396 dbtvd.exe 1708 fdfxfpt.exe 2844 jvpxpp.exe 1620 hrjvvnp.exe 1048 hnftxjh.exe 1492 jdrdpjj.exe 1580 npxtxh.exe 1536 vrdjx.exe 952 nflxvh.exe 872 ftnfjjx.exe 2260 hbnpx.exe 2180 pdrdnl.exe 2124 bxplbn.exe 1020 bhhjdvd.exe 2056 tthdx.exe 3044 lrxrthj.exe 2284 fjxvt.exe 2144 htdhhl.exe 1596 bdrfjdv.exe 2720 rbrbv.exe 2712 vfltvr.exe 2780 lnnbfv.exe 2668 vfpjxn.exe 2700 xjtpp.exe 2632 rrlthp.exe 2856 jbfdj.exe 2736 bhdpxl.exe 2564 rbxpbr.exe 2544 rlfftb.exe 2588 jrtvn.exe 2028 hnphnh.exe 876 lrxvv.exe 1524 nftdt.exe 2748 njnbrx.exe 468 vdpxtln.exe 2584 bpphxt.exe 1096 njhjjtp.exe 588 nhrtntb.exe 1612 dhbdv.exe 2152 lxpfvx.exe 2192 tvlnvtp.exe 544 nbhph.exe 2268 ltvlrff.exe 2708 fptrlfl.exe -
resource yara_rule behavioral1/memory/2252-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2252-6-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2252-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d90-8.dat upx behavioral1/files/0x0007000000018b03-16.dat upx behavioral1/files/0x0006000000018b3e-23.dat upx behavioral1/memory/2644-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2608-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2644-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018b4d-32.dat upx behavioral1/files/0x0007000000018b54-40.dat upx behavioral1/memory/2796-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018b58-49.dat upx behavioral1/memory/2796-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018f3e-58.dat upx behavioral1/memory/2676-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fc1-68.dat upx behavioral1/memory/2540-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2688-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fc2-75.dat upx behavioral1/files/0x0004000000017801-82.dat upx behavioral1/memory/1056-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fcb-90.dat upx behavioral1/files/0x0005000000018fcd-97.dat upx behavioral1/memory/2772-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fe2-106.dat upx behavioral1/memory/2412-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/468-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018fe4-114.dat upx behavioral1/files/0x0005000000019078-122.dat upx behavioral1/memory/1100-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2832-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0004000000019206-131.dat upx behavioral1/memory/1612-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00040000000192a8-140.dat upx behavioral1/memory/2132-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00040000000192ad-148.dat upx behavioral1/files/0x0004000000019380-155.dat upx behavioral1/files/0x0004000000019438-162.dat upx behavioral1/files/0x0004000000019461-168.dat upx behavioral1/files/0x0004000000019485-177.dat upx behavioral1/files/0x00040000000194ec-185.dat upx behavioral1/memory/2844-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1708-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019571-195.dat upx behavioral1/memory/2844-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019575-204.dat upx behavioral1/files/0x000500000001962f-210.dat upx behavioral1/files/0x000500000001966c-217.dat upx behavioral1/files/0x00050000000196af-224.dat upx behavioral1/memory/1536-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019f50-234.dat upx behavioral1/files/0x000500000001a056-241.dat upx behavioral1/files/0x000500000001a1e8-248.dat upx behavioral1/memory/2260-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a1ee-256.dat upx behavioral1/memory/2124-268-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3044-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2144-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2720-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2736-346-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2736-352-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1524-386-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/468-393-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhxrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvjphxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtxjll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljlhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frdbnjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvtlbfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bptnnxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxhtrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvjhfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvhnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddnrln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnvnndh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrdjnpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrjlhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdxnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvjbbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxrpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhrrlbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thxdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hndxfrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrhvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfdnltr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrlrjnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnxrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvtnpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrjvvnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhrlrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrdjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpnxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhvtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlptdhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtxbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvhrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldvxbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpfdnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltnfrtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnxjbbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txpjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpxtlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnjnfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxblhj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2324 2252 d73f8d0c7d2b9f3179515b442942e910N.exe 31 PID 2252 wrote to memory of 2324 2252 d73f8d0c7d2b9f3179515b442942e910N.exe 31 PID 2252 wrote to memory of 2324 2252 d73f8d0c7d2b9f3179515b442942e910N.exe 31 PID 2252 wrote to memory of 2324 2252 d73f8d0c7d2b9f3179515b442942e910N.exe 31 PID 2324 wrote to memory of 2608 2324 pfdfvrr.exe 32 PID 2324 wrote to memory of 2608 2324 pfdfvrr.exe 32 PID 2324 wrote to memory of 2608 2324 pfdfvrr.exe 32 PID 2324 wrote to memory of 2608 2324 pfdfvrr.exe 32 PID 2608 wrote to memory of 2644 2608 jtfxhx.exe 33 PID 2608 wrote to memory of 2644 2608 jtfxhx.exe 33 PID 2608 wrote to memory of 2644 2608 jtfxhx.exe 33 PID 2608 wrote to memory of 2644 2608 jtfxhx.exe 33 PID 2644 wrote to memory of 2716 2644 ndrvlth.exe 34 PID 2644 wrote to memory of 2716 2644 ndrvlth.exe 34 PID 2644 wrote to memory of 2716 2644 ndrvlth.exe 34 PID 2644 wrote to memory of 2716 2644 ndrvlth.exe 34 PID 2716 wrote to memory of 2796 2716 rjxphpx.exe 35 PID 2716 wrote to memory of 2796 2716 rjxphpx.exe 35 PID 2716 wrote to memory of 2796 2716 rjxphpx.exe 35 PID 2716 wrote to memory of 2796 2716 rjxphpx.exe 35 PID 2796 wrote to memory of 2676 2796 xdhpnrv.exe 36 PID 2796 wrote to memory of 2676 2796 xdhpnrv.exe 36 PID 2796 wrote to memory of 2676 2796 xdhpnrv.exe 36 PID 2796 wrote to memory of 2676 2796 xdhpnrv.exe 36 PID 2676 wrote to memory of 2540 2676 fbjfd.exe 37 PID 2676 wrote to memory of 2540 2676 fbjfd.exe 37 PID 2676 wrote to memory of 2540 2676 fbjfd.exe 37 PID 2676 wrote to memory of 2540 2676 fbjfd.exe 37 PID 2540 wrote to memory of 2688 2540 lbppvxl.exe 38 PID 2540 wrote to memory of 2688 2540 lbppvxl.exe 38 PID 2540 wrote to memory of 2688 2540 lbppvxl.exe 38 PID 2540 wrote to memory of 2688 2540 lbppvxl.exe 38 PID 2688 wrote to memory of 2588 2688 hhnbv.exe 39 PID 2688 wrote to memory of 2588 2688 hhnbv.exe 39 PID 2688 wrote to memory of 2588 2688 hhnbv.exe 39 PID 2688 wrote to memory of 2588 2688 hhnbv.exe 39 PID 2588 wrote to memory of 1056 2588 fxddxln.exe 40 PID 2588 wrote to memory of 1056 2588 fxddxln.exe 40 PID 2588 wrote to memory of 1056 2588 fxddxln.exe 40 PID 2588 wrote to memory of 1056 2588 fxddxln.exe 40 PID 1056 wrote to memory of 2772 1056 pbxlvv.exe 41 PID 1056 wrote to memory of 2772 1056 pbxlvv.exe 41 PID 1056 wrote to memory of 2772 1056 pbxlvv.exe 41 PID 1056 wrote to memory of 2772 1056 pbxlvv.exe 41 PID 2772 wrote to memory of 2412 2772 jxjnv.exe 42 PID 2772 wrote to memory of 2412 2772 jxjnv.exe 42 PID 2772 wrote to memory of 2412 2772 jxjnv.exe 42 PID 2772 wrote to memory of 2412 2772 jxjnv.exe 42 PID 2412 wrote to memory of 468 2412 tdhjv.exe 43 PID 2412 wrote to memory of 468 2412 tdhjv.exe 43 PID 2412 wrote to memory of 468 2412 tdhjv.exe 43 PID 2412 wrote to memory of 468 2412 tdhjv.exe 43 PID 468 wrote to memory of 1100 468 xlvfpv.exe 44 PID 468 wrote to memory of 1100 468 xlvfpv.exe 44 PID 468 wrote to memory of 1100 468 xlvfpv.exe 44 PID 468 wrote to memory of 1100 468 xlvfpv.exe 44 PID 1100 wrote to memory of 2832 1100 plxrf.exe 45 PID 1100 wrote to memory of 2832 1100 plxrf.exe 45 PID 1100 wrote to memory of 2832 1100 plxrf.exe 45 PID 1100 wrote to memory of 2832 1100 plxrf.exe 45 PID 2832 wrote to memory of 1612 2832 vrtxfj.exe 46 PID 2832 wrote to memory of 1612 2832 vrtxfj.exe 46 PID 2832 wrote to memory of 1612 2832 vrtxfj.exe 46 PID 2832 wrote to memory of 1612 2832 vrtxfj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\d73f8d0c7d2b9f3179515b442942e910N.exe"C:\Users\Admin\AppData\Local\Temp\d73f8d0c7d2b9f3179515b442942e910N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\pfdfvrr.exec:\pfdfvrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\jtfxhx.exec:\jtfxhx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\ndrvlth.exec:\ndrvlth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\rjxphpx.exec:\rjxphpx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\xdhpnrv.exec:\xdhpnrv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\fbjfd.exec:\fbjfd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\lbppvxl.exec:\lbppvxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\hhnbv.exec:\hhnbv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\fxddxln.exec:\fxddxln.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\pbxlvv.exec:\pbxlvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\jxjnv.exec:\jxjnv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\tdhjv.exec:\tdhjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\xlvfpv.exec:\xlvfpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\plxrf.exec:\plxrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\vrtxfj.exec:\vrtxfj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\rxfjh.exec:\rxfjh.exe17⤵
- Executes dropped EXE
PID:1612 -
\??\c:\ftrlbjn.exec:\ftrlbjn.exe18⤵
- Executes dropped EXE
PID:2132 -
\??\c:\lxpjtbh.exec:\lxpjtbh.exe19⤵
- Executes dropped EXE
PID:2224 -
\??\c:\pnnhx.exec:\pnnhx.exe20⤵
- Executes dropped EXE
PID:2460 -
\??\c:\fvnhpr.exec:\fvnhpr.exe21⤵
- Executes dropped EXE
PID:2068 -
\??\c:\dbtvd.exec:\dbtvd.exe22⤵
- Executes dropped EXE
PID:2396 -
\??\c:\fdfxfpt.exec:\fdfxfpt.exe23⤵
- Executes dropped EXE
PID:1708 -
\??\c:\jvpxpp.exec:\jvpxpp.exe24⤵
- Executes dropped EXE
PID:2844 -
\??\c:\hrjvvnp.exec:\hrjvvnp.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1620 -
\??\c:\hnftxjh.exec:\hnftxjh.exe26⤵
- Executes dropped EXE
PID:1048 -
\??\c:\jdrdpjj.exec:\jdrdpjj.exe27⤵
- Executes dropped EXE
PID:1492 -
\??\c:\npxtxh.exec:\npxtxh.exe28⤵
- Executes dropped EXE
PID:1580 -
\??\c:\vrdjx.exec:\vrdjx.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1536 -
\??\c:\nflxvh.exec:\nflxvh.exe30⤵
- Executes dropped EXE
PID:952 -
\??\c:\ftnfjjx.exec:\ftnfjjx.exe31⤵
- Executes dropped EXE
PID:872 -
\??\c:\hbnpx.exec:\hbnpx.exe32⤵
- Executes dropped EXE
PID:2260 -
\??\c:\pdrdnl.exec:\pdrdnl.exe33⤵
- Executes dropped EXE
PID:2180 -
\??\c:\bxplbn.exec:\bxplbn.exe34⤵
- Executes dropped EXE
PID:2124 -
\??\c:\bhhjdvd.exec:\bhhjdvd.exe35⤵
- Executes dropped EXE
PID:1020 -
\??\c:\tthdx.exec:\tthdx.exe36⤵
- Executes dropped EXE
PID:2056 -
\??\c:\lrxrthj.exec:\lrxrthj.exe37⤵
- Executes dropped EXE
PID:3044 -
\??\c:\fjxvt.exec:\fjxvt.exe38⤵
- Executes dropped EXE
PID:2284 -
\??\c:\htdhhl.exec:\htdhhl.exe39⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bdrfjdv.exec:\bdrfjdv.exe40⤵
- Executes dropped EXE
PID:1596 -
\??\c:\rbrbv.exec:\rbrbv.exe41⤵
- Executes dropped EXE
PID:2720 -
\??\c:\vfltvr.exec:\vfltvr.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\lnnbfv.exec:\lnnbfv.exe43⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vfpjxn.exec:\vfpjxn.exe44⤵
- Executes dropped EXE
PID:2668 -
\??\c:\xjtpp.exec:\xjtpp.exe45⤵
- Executes dropped EXE
PID:2700 -
\??\c:\rrlthp.exec:\rrlthp.exe46⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jbfdj.exec:\jbfdj.exe47⤵
- Executes dropped EXE
PID:2856 -
\??\c:\bhdpxl.exec:\bhdpxl.exe48⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rbxpbr.exec:\rbxpbr.exe49⤵
- Executes dropped EXE
PID:2564 -
\??\c:\rlfftb.exec:\rlfftb.exe50⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jrtvn.exec:\jrtvn.exe51⤵
- Executes dropped EXE
PID:2588 -
\??\c:\hnphnh.exec:\hnphnh.exe52⤵
- Executes dropped EXE
PID:2028 -
\??\c:\lrxvv.exec:\lrxvv.exe53⤵
- Executes dropped EXE
PID:876 -
\??\c:\nftdt.exec:\nftdt.exe54⤵
- Executes dropped EXE
PID:1524 -
\??\c:\njnbrx.exec:\njnbrx.exe55⤵
- Executes dropped EXE
PID:2748 -
\??\c:\vdpxtln.exec:\vdpxtln.exe56⤵
- Executes dropped EXE
PID:468 -
\??\c:\bpphxt.exec:\bpphxt.exe57⤵
- Executes dropped EXE
PID:2584 -
\??\c:\njhjjtp.exec:\njhjjtp.exe58⤵
- Executes dropped EXE
PID:1096 -
\??\c:\nhrtntb.exec:\nhrtntb.exe59⤵
- Executes dropped EXE
PID:588 -
\??\c:\dhbdv.exec:\dhbdv.exe60⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lxpfvx.exec:\lxpfvx.exe61⤵
- Executes dropped EXE
PID:2152 -
\??\c:\tvlnvtp.exec:\tvlnvtp.exe62⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nbhph.exec:\nbhph.exe63⤵
- Executes dropped EXE
PID:544 -
\??\c:\ltvlrff.exec:\ltvlrff.exe64⤵
- Executes dropped EXE
PID:2268 -
\??\c:\fptrlfl.exec:\fptrlfl.exe65⤵
- Executes dropped EXE
PID:2708 -
\??\c:\hpxtpp.exec:\hpxtpp.exe66⤵PID:2976
-
\??\c:\tpjbd.exec:\tpjbd.exe67⤵PID:2232
-
\??\c:\lbfrv.exec:\lbfrv.exe68⤵PID:2848
-
\??\c:\lvrvhnx.exec:\lvrvhnx.exe69⤵PID:1796
-
\??\c:\djpttr.exec:\djpttr.exe70⤵PID:1112
-
\??\c:\tnthf.exec:\tnthf.exe71⤵PID:1932
-
\??\c:\txrfd.exec:\txrfd.exe72⤵PID:1928
-
\??\c:\fnnhhv.exec:\fnnhhv.exe73⤵PID:2392
-
\??\c:\fhftf.exec:\fhftf.exe74⤵PID:1408
-
\??\c:\tpxtlf.exec:\tpxtlf.exe75⤵
- System Location Discovery: System Language Discovery
PID:272 -
\??\c:\bbpdjfn.exec:\bbpdjfn.exe76⤵PID:1972
-
\??\c:\brfbph.exec:\brfbph.exe77⤵PID:2380
-
\??\c:\jxtvph.exec:\jxtvph.exe78⤵PID:3004
-
\??\c:\rlfhr.exec:\rlfhr.exe79⤵PID:2236
-
\??\c:\lxhpfxd.exec:\lxhpfxd.exe80⤵PID:1592
-
\??\c:\xlrjr.exec:\xlrjr.exe81⤵
- System Location Discovery: System Language Discovery
PID:1636 -
\??\c:\xpdthl.exec:\xpdthl.exe82⤵PID:2436
-
\??\c:\blfxxj.exec:\blfxxj.exe83⤵PID:2056
-
\??\c:\jjrjjr.exec:\jjrjjr.exe84⤵PID:1964
-
\??\c:\hpblv.exec:\hpblv.exe85⤵PID:2252
-
\??\c:\jltdndv.exec:\jltdndv.exe86⤵PID:1608
-
\??\c:\npxxv.exec:\npxxv.exe87⤵PID:2656
-
\??\c:\hrhhff.exec:\hrhhff.exe88⤵PID:2608
-
\??\c:\jxdjlf.exec:\jxdjlf.exe89⤵PID:2664
-
\??\c:\dvhltl.exec:\dvhltl.exe90⤵PID:2624
-
\??\c:\rhrphxx.exec:\rhrphxx.exe91⤵PID:2364
-
\??\c:\pvbvtj.exec:\pvbvtj.exe92⤵PID:2548
-
\??\c:\tffbh.exec:\tffbh.exe93⤵PID:2860
-
\??\c:\pvlnl.exec:\pvlnl.exe94⤵PID:2540
-
\??\c:\bfpld.exec:\bfpld.exe95⤵PID:2524
-
\??\c:\fbbpn.exec:\fbbpn.exe96⤵PID:2736
-
\??\c:\hlxndh.exec:\hlxndh.exe97⤵PID:2996
-
\??\c:\xhddn.exec:\xhddn.exe98⤵PID:2556
-
\??\c:\brnlhv.exec:\brnlhv.exe99⤵PID:2776
-
\??\c:\hntrf.exec:\hntrf.exe100⤵PID:2992
-
\??\c:\hvbdrvv.exec:\hvbdrvv.exe101⤵PID:680
-
\??\c:\fvrjlpl.exec:\fvrjlpl.exe102⤵PID:2824
-
\??\c:\lpdbn.exec:\lpdbn.exe103⤵PID:2296
-
\??\c:\nflnt.exec:\nflnt.exe104⤵PID:1984
-
\??\c:\fftvd.exec:\fftvd.exe105⤵PID:1724
-
\??\c:\lnvxfx.exec:\lnvxfx.exe106⤵PID:1076
-
\??\c:\lpjxvnf.exec:\lpjxvnf.exe107⤵PID:752
-
\??\c:\xxxpn.exec:\xxxpn.exe108⤵PID:2080
-
\??\c:\bnllj.exec:\bnllj.exe109⤵PID:1372
-
\??\c:\vtbdtt.exec:\vtbdtt.exe110⤵PID:2072
-
\??\c:\ptvhd.exec:\ptvhd.exe111⤵PID:2224
-
\??\c:\hdhttpb.exec:\hdhttpb.exe112⤵PID:2908
-
\??\c:\pppvvn.exec:\pppvvn.exe113⤵PID:800
-
\??\c:\plxhtrt.exec:\plxhtrt.exe114⤵PID:2616
-
\??\c:\ltthp.exec:\ltthp.exe115⤵PID:1148
-
\??\c:\vtjvtt.exec:\vtjvtt.exe116⤵PID:2844
-
\??\c:\tpbntj.exec:\tpbntj.exe117⤵PID:684
-
\??\c:\jnvnndh.exec:\jnvnndh.exe118⤵
- System Location Discovery: System Language Discovery
PID:668 -
\??\c:\njnftrx.exec:\njnftrx.exe119⤵PID:1048
-
\??\c:\nttht.exec:\nttht.exe120⤵PID:664
-
\??\c:\rfxdh.exec:\rfxdh.exe121⤵
- System Location Discovery: System Language Discovery
PID:2128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-