Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 23:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
814d978bde9b22a623eb91b1062d62f0173bd0fcdf439c9dcef44a6e51407f4c.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
814d978bde9b22a623eb91b1062d62f0173bd0fcdf439c9dcef44a6e51407f4c.exe
-
Size
454KB
-
MD5
98a36b6efbadfb162c9385dd15051be9
-
SHA1
946f0af36c66a31e3c22bfe16a90c57a667eb0e1
-
SHA256
814d978bde9b22a623eb91b1062d62f0173bd0fcdf439c9dcef44a6e51407f4c
-
SHA512
f43b3c058475550871e80983f675d30fba1e39980a035727d19c9dc8fae34de311040cca6b95ad4ab368f0dcbed29dfaa9d0ad23ff511682702929f3f86f3989
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbef:q7Tc2NYHUrAwfMp3CDf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2496-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/672-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-182-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2520-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-205-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1544-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-224-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1908-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-406-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2996-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/528-508-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/936-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-550-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/324-577-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2176-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-703-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-716-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/612-803-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2204 nhpbh.exe 2788 flbbvx.exe 2908 hdxrl.exe 2904 xjhhxn.exe 1712 nrpbh.exe 2256 hllth.exe 1072 hxxnxx.exe 1988 pthhtj.exe 1308 vxtnrx.exe 2112 rpprfbf.exe 2440 fjvfp.exe 1572 bbrdx.exe 1260 prtvdhr.exe 2964 pdprffp.exe 2416 rhtlhbx.exe 1088 jdntpfp.exe 672 rnhjppr.exe 1900 jdpxlf.exe 2168 jbhrn.exe 2520 ftjtvpn.exe 2476 pvvxl.exe 676 nxbln.exe 1544 pptptr.exe 1908 hdffln.exe 1812 nbjxbnd.exe 2092 jhppnrn.exe 1780 frpnnp.exe 916 lnpxp.exe 1676 lpbthhh.exe 2032 btrbljj.exe 2308 pfbfx.exe 1316 xfhbh.exe 2496 rjjxbld.exe 1568 dtftrd.exe 2864 hdrdtxt.exe 2900 hhnxnd.exe 2788 pfvrl.exe 2724 nppfptx.exe 3044 hhpftp.exe 2700 pnptdd.exe 2252 rpvfln.exe 1716 hnhdlpd.exe 1036 nfxrxlj.exe 1072 hnxfn.exe 2024 nhdrn.exe 2820 lbxdp.exe 1076 txjhfvp.exe 760 hhhjpd.exe 2696 bdxplpf.exe 2996 lnhbltb.exe 2704 nphfj.exe 1260 fhxrnlr.exe 3020 nljth.exe 1948 xtlln.exe 1388 hdhhxn.exe 1904 fbxddv.exe 672 fdxlff.exe 1924 thxtb.exe 2348 phnxvft.exe 2132 fdjtvpf.exe 2560 hdvtdfp.exe 528 tnxnhr.exe 956 trdjp.exe 936 fvdfnxj.exe -
resource yara_rule behavioral1/memory/2496-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/936-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/936-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/992-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-802-0x00000000003C0000-0x00000000003EA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltvrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdprffp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htjlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ndtfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjhllj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thfvpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrhfvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rphxnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnddfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvhtrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trhjvbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltlhxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvxnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbvnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxhdhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrbxhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxdnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjhprdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prfrvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pptptr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhtjjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlphnlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnldbbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2496 wrote to memory of 2204 2496 814d978bde9b22a623eb91b1062d62f0173bd0fcdf439c9dcef44a6e51407f4c.exe 30 PID 2496 wrote to memory of 2204 2496 814d978bde9b22a623eb91b1062d62f0173bd0fcdf439c9dcef44a6e51407f4c.exe 30 PID 2496 wrote to memory of 2204 2496 814d978bde9b22a623eb91b1062d62f0173bd0fcdf439c9dcef44a6e51407f4c.exe 30 PID 2496 wrote to memory of 2204 2496 814d978bde9b22a623eb91b1062d62f0173bd0fcdf439c9dcef44a6e51407f4c.exe 30 PID 2204 wrote to memory of 2788 2204 nhpbh.exe 31 PID 2204 wrote to memory of 2788 2204 nhpbh.exe 31 PID 2204 wrote to memory of 2788 2204 nhpbh.exe 31 PID 2204 wrote to memory of 2788 2204 nhpbh.exe 31 PID 2788 wrote to memory of 2908 2788 flbbvx.exe 32 PID 2788 wrote to memory of 2908 2788 flbbvx.exe 32 PID 2788 wrote to memory of 2908 2788 flbbvx.exe 32 PID 2788 wrote to memory of 2908 2788 flbbvx.exe 32 PID 2908 wrote to memory of 2904 2908 hdxrl.exe 33 PID 2908 wrote to memory of 2904 2908 hdxrl.exe 33 PID 2908 wrote to memory of 2904 2908 hdxrl.exe 33 PID 2908 wrote to memory of 2904 2908 hdxrl.exe 33 PID 2904 wrote to memory of 1712 2904 xjhhxn.exe 34 PID 2904 wrote to memory of 1712 2904 xjhhxn.exe 34 PID 2904 wrote to memory of 1712 2904 xjhhxn.exe 34 PID 2904 wrote to memory of 1712 2904 xjhhxn.exe 34 PID 1712 wrote to memory of 2256 1712 nrpbh.exe 35 PID 1712 wrote to memory of 2256 1712 nrpbh.exe 35 PID 1712 wrote to memory of 2256 1712 nrpbh.exe 35 PID 1712 wrote to memory of 2256 1712 nrpbh.exe 35 PID 2256 wrote to memory of 1072 2256 hllth.exe 36 PID 2256 wrote to memory of 1072 2256 hllth.exe 36 PID 2256 wrote to memory of 1072 2256 hllth.exe 36 PID 2256 wrote to memory of 1072 2256 hllth.exe 36 PID 1072 wrote to memory of 1988 1072 hxxnxx.exe 37 PID 1072 wrote to memory of 1988 1072 hxxnxx.exe 37 PID 1072 wrote to memory of 1988 1072 hxxnxx.exe 37 PID 1072 wrote to memory of 1988 1072 hxxnxx.exe 37 PID 1988 wrote to memory of 1308 1988 pthhtj.exe 38 PID 1988 wrote to memory of 1308 1988 pthhtj.exe 38 PID 1988 wrote to memory of 1308 1988 pthhtj.exe 38 PID 1988 wrote to memory of 1308 1988 pthhtj.exe 38 PID 1308 wrote to memory of 2112 1308 vxtnrx.exe 39 PID 1308 wrote to memory of 2112 1308 vxtnrx.exe 39 PID 1308 wrote to memory of 2112 1308 vxtnrx.exe 39 PID 1308 wrote to memory of 2112 1308 vxtnrx.exe 39 PID 2112 wrote to memory of 2440 2112 rpprfbf.exe 40 PID 2112 wrote to memory of 2440 2112 rpprfbf.exe 40 PID 2112 wrote to memory of 2440 2112 rpprfbf.exe 40 PID 2112 wrote to memory of 2440 2112 rpprfbf.exe 40 PID 2440 wrote to memory of 1572 2440 fjvfp.exe 41 PID 2440 wrote to memory of 1572 2440 fjvfp.exe 41 PID 2440 wrote to memory of 1572 2440 fjvfp.exe 41 PID 2440 wrote to memory of 1572 2440 fjvfp.exe 41 PID 1572 wrote to memory of 1260 1572 bbrdx.exe 42 PID 1572 wrote to memory of 1260 1572 bbrdx.exe 42 PID 1572 wrote to memory of 1260 1572 bbrdx.exe 42 PID 1572 wrote to memory of 1260 1572 bbrdx.exe 42 PID 1260 wrote to memory of 2964 1260 prtvdhr.exe 43 PID 1260 wrote to memory of 2964 1260 prtvdhr.exe 43 PID 1260 wrote to memory of 2964 1260 prtvdhr.exe 43 PID 1260 wrote to memory of 2964 1260 prtvdhr.exe 43 PID 2964 wrote to memory of 2416 2964 pdprffp.exe 44 PID 2964 wrote to memory of 2416 2964 pdprffp.exe 44 PID 2964 wrote to memory of 2416 2964 pdprffp.exe 44 PID 2964 wrote to memory of 2416 2964 pdprffp.exe 44 PID 2416 wrote to memory of 1088 2416 rhtlhbx.exe 45 PID 2416 wrote to memory of 1088 2416 rhtlhbx.exe 45 PID 2416 wrote to memory of 1088 2416 rhtlhbx.exe 45 PID 2416 wrote to memory of 1088 2416 rhtlhbx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\814d978bde9b22a623eb91b1062d62f0173bd0fcdf439c9dcef44a6e51407f4c.exe"C:\Users\Admin\AppData\Local\Temp\814d978bde9b22a623eb91b1062d62f0173bd0fcdf439c9dcef44a6e51407f4c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\nhpbh.exec:\nhpbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\flbbvx.exec:\flbbvx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\hdxrl.exec:\hdxrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\xjhhxn.exec:\xjhhxn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\nrpbh.exec:\nrpbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\hllth.exec:\hllth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\hxxnxx.exec:\hxxnxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\pthhtj.exec:\pthhtj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\vxtnrx.exec:\vxtnrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\rpprfbf.exec:\rpprfbf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\fjvfp.exec:\fjvfp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\bbrdx.exec:\bbrdx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\prtvdhr.exec:\prtvdhr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\pdprffp.exec:\pdprffp.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\rhtlhbx.exec:\rhtlhbx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\jdntpfp.exec:\jdntpfp.exe17⤵
- Executes dropped EXE
PID:1088 -
\??\c:\rnhjppr.exec:\rnhjppr.exe18⤵
- Executes dropped EXE
PID:672 -
\??\c:\jdpxlf.exec:\jdpxlf.exe19⤵
- Executes dropped EXE
PID:1900 -
\??\c:\jbhrn.exec:\jbhrn.exe20⤵
- Executes dropped EXE
PID:2168 -
\??\c:\ftjtvpn.exec:\ftjtvpn.exe21⤵
- Executes dropped EXE
PID:2520 -
\??\c:\pvvxl.exec:\pvvxl.exe22⤵
- Executes dropped EXE
PID:2476 -
\??\c:\nxbln.exec:\nxbln.exe23⤵
- Executes dropped EXE
PID:676 -
\??\c:\pptptr.exec:\pptptr.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1544 -
\??\c:\hdffln.exec:\hdffln.exe25⤵
- Executes dropped EXE
PID:1908 -
\??\c:\nbjxbnd.exec:\nbjxbnd.exe26⤵
- Executes dropped EXE
PID:1812 -
\??\c:\jhppnrn.exec:\jhppnrn.exe27⤵
- Executes dropped EXE
PID:2092 -
\??\c:\frpnnp.exec:\frpnnp.exe28⤵
- Executes dropped EXE
PID:1780 -
\??\c:\lnpxp.exec:\lnpxp.exe29⤵
- Executes dropped EXE
PID:916 -
\??\c:\lpbthhh.exec:\lpbthhh.exe30⤵
- Executes dropped EXE
PID:1676 -
\??\c:\btrbljj.exec:\btrbljj.exe31⤵
- Executes dropped EXE
PID:2032 -
\??\c:\pfbfx.exec:\pfbfx.exe32⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xfhbh.exec:\xfhbh.exe33⤵
- Executes dropped EXE
PID:1316 -
\??\c:\rjjxbld.exec:\rjjxbld.exe34⤵
- Executes dropped EXE
PID:2496 -
\??\c:\dtftrd.exec:\dtftrd.exe35⤵
- Executes dropped EXE
PID:1568 -
\??\c:\hdrdtxt.exec:\hdrdtxt.exe36⤵
- Executes dropped EXE
PID:2864 -
\??\c:\hhnxnd.exec:\hhnxnd.exe37⤵
- Executes dropped EXE
PID:2900 -
\??\c:\pfvrl.exec:\pfvrl.exe38⤵
- Executes dropped EXE
PID:2788 -
\??\c:\nppfptx.exec:\nppfptx.exe39⤵
- Executes dropped EXE
PID:2724 -
\??\c:\hhpftp.exec:\hhpftp.exe40⤵
- Executes dropped EXE
PID:3044 -
\??\c:\pnptdd.exec:\pnptdd.exe41⤵
- Executes dropped EXE
PID:2700 -
\??\c:\rpvfln.exec:\rpvfln.exe42⤵
- Executes dropped EXE
PID:2252 -
\??\c:\hnhdlpd.exec:\hnhdlpd.exe43⤵
- Executes dropped EXE
PID:1716 -
\??\c:\nfxrxlj.exec:\nfxrxlj.exe44⤵
- Executes dropped EXE
PID:1036 -
\??\c:\hnxfn.exec:\hnxfn.exe45⤵
- Executes dropped EXE
PID:1072 -
\??\c:\nhdrn.exec:\nhdrn.exe46⤵
- Executes dropped EXE
PID:2024 -
\??\c:\lbxdp.exec:\lbxdp.exe47⤵
- Executes dropped EXE
PID:2820 -
\??\c:\txjhfvp.exec:\txjhfvp.exe48⤵
- Executes dropped EXE
PID:1076 -
\??\c:\hhhjpd.exec:\hhhjpd.exe49⤵
- Executes dropped EXE
PID:760 -
\??\c:\bdxplpf.exec:\bdxplpf.exe50⤵
- Executes dropped EXE
PID:2696 -
\??\c:\lnhbltb.exec:\lnhbltb.exe51⤵
- Executes dropped EXE
PID:2996 -
\??\c:\nphfj.exec:\nphfj.exe52⤵
- Executes dropped EXE
PID:2704 -
\??\c:\fhxrnlr.exec:\fhxrnlr.exe53⤵
- Executes dropped EXE
PID:1260 -
\??\c:\nljth.exec:\nljth.exe54⤵
- Executes dropped EXE
PID:3020 -
\??\c:\xtlln.exec:\xtlln.exe55⤵
- Executes dropped EXE
PID:1948 -
\??\c:\hdhhxn.exec:\hdhhxn.exe56⤵
- Executes dropped EXE
PID:1388 -
\??\c:\fbxddv.exec:\fbxddv.exe57⤵
- Executes dropped EXE
PID:1904 -
\??\c:\fdxlff.exec:\fdxlff.exe58⤵
- Executes dropped EXE
PID:672 -
\??\c:\thxtb.exec:\thxtb.exe59⤵
- Executes dropped EXE
PID:1924 -
\??\c:\phnxvft.exec:\phnxvft.exe60⤵
- Executes dropped EXE
PID:2348 -
\??\c:\fdjtvpf.exec:\fdjtvpf.exe61⤵
- Executes dropped EXE
PID:2132 -
\??\c:\hdvtdfp.exec:\hdvtdfp.exe62⤵
- Executes dropped EXE
PID:2560 -
\??\c:\tnxnhr.exec:\tnxnhr.exe63⤵
- Executes dropped EXE
PID:528 -
\??\c:\trdjp.exec:\trdjp.exe64⤵
- Executes dropped EXE
PID:956 -
\??\c:\fvdfnxj.exec:\fvdfnxj.exe65⤵
- Executes dropped EXE
PID:936 -
\??\c:\tdffht.exec:\tdffht.exe66⤵PID:2028
-
\??\c:\dlnvt.exec:\dlnvt.exe67⤵PID:1660
-
\??\c:\ldblv.exec:\ldblv.exe68⤵PID:1536
-
\??\c:\ppxtll.exec:\ppxtll.exe69⤵PID:1852
-
\??\c:\dlldtpx.exec:\dlldtpx.exe70⤵PID:324
-
\??\c:\rjtddr.exec:\rjtddr.exe71⤵PID:2548
-
\??\c:\phxhj.exec:\phxhj.exe72⤵PID:2300
-
\??\c:\hpxxnrd.exec:\hpxxnrd.exe73⤵PID:1548
-
\??\c:\npdnpt.exec:\npdnpt.exe74⤵PID:2368
-
\??\c:\xvvfldx.exec:\xvvfldx.exe75⤵PID:1848
-
\??\c:\bflbd.exec:\bflbd.exe76⤵PID:992
-
\??\c:\ftnfp.exec:\ftnfp.exe77⤵PID:2776
-
\??\c:\vtlxvjt.exec:\vtlxvjt.exe78⤵PID:2852
-
\??\c:\pflbdff.exec:\pflbdff.exe79⤵PID:1568
-
\??\c:\hffvhf.exec:\hffvhf.exe80⤵PID:2896
-
\??\c:\tdplld.exec:\tdplld.exe81⤵PID:2900
-
\??\c:\prfdxhl.exec:\prfdxhl.exe82⤵PID:2788
-
\??\c:\ffrlnv.exec:\ffrlnv.exe83⤵PID:2744
-
\??\c:\bfdlbd.exec:\bfdlbd.exe84⤵PID:2684
-
\??\c:\lbjtth.exec:\lbjtth.exe85⤵PID:2108
-
\??\c:\nlbxvpb.exec:\nlbxvpb.exe86⤵PID:2616
-
\??\c:\drnxxp.exec:\drnxxp.exe87⤵PID:1180
-
\??\c:\pttpnvd.exec:\pttpnvd.exe88⤵PID:2176
-
\??\c:\dvvvxf.exec:\dvvvxf.exe89⤵PID:1988
-
\??\c:\jbvlr.exec:\jbvlr.exe90⤵PID:2080
-
\??\c:\fbhnbbp.exec:\fbhnbbp.exe91⤵PID:1928
-
\??\c:\rxbfpdv.exec:\rxbfpdv.exe92⤵PID:3000
-
\??\c:\vdlhhb.exec:\vdlhhb.exe93⤵PID:1492
-
\??\c:\drnrlpf.exec:\drnrlpf.exe94⤵PID:1760
-
\??\c:\jjdxn.exec:\jjdxn.exe95⤵PID:2816
-
\??\c:\ppfhl.exec:\ppfhl.exe96⤵PID:2880
-
\??\c:\hljbv.exec:\hljbv.exe97⤵PID:1460
-
\??\c:\vrfptb.exec:\vrfptb.exe98⤵PID:2284
-
\??\c:\rpbjd.exec:\rpbjd.exe99⤵PID:844
-
\??\c:\nppxftb.exec:\nppxftb.exe100⤵PID:764
-
\??\c:\tbptxl.exec:\tbptxl.exe101⤵PID:2172
-
\??\c:\jhrrjd.exec:\jhrrjd.exe102⤵PID:1748
-
\??\c:\vlhfvnj.exec:\vlhfvnj.exe103⤵PID:2004
-
\??\c:\pjvhtrt.exec:\pjvhtrt.exe104⤵
- System Location Discovery: System Language Discovery
PID:2504 -
\??\c:\hlfrfv.exec:\hlfrfv.exe105⤵PID:1840
-
\??\c:\hvxtbd.exec:\hvxtbd.exe106⤵PID:2500
-
\??\c:\frhnbfh.exec:\frhnbfh.exe107⤵PID:932
-
\??\c:\lrbbf.exec:\lrbbf.exe108⤵PID:612
-
\??\c:\fvdjfp.exec:\fvdjfp.exe109⤵PID:1628
-
\??\c:\hxnrldb.exec:\hxnrldb.exe110⤵PID:2536
-
\??\c:\xbxpr.exec:\xbxpr.exe111⤵PID:856
-
\??\c:\bhdnbth.exec:\bhdnbth.exe112⤵PID:1764
-
\??\c:\bfxtxdd.exec:\bfxtxdd.exe113⤵PID:1812
-
\??\c:\fnrlpdv.exec:\fnrlpdv.exe114⤵PID:2716
-
\??\c:\lnjflbj.exec:\lnjflbj.exe115⤵PID:1304
-
\??\c:\ttbphp.exec:\ttbphp.exe116⤵PID:2548
-
\??\c:\dnxvnjn.exec:\dnxvnjn.exe117⤵PID:2104
-
\??\c:\xlphnlh.exec:\xlphnlh.exe118⤵
- System Location Discovery: System Language Discovery
PID:1548 -
\??\c:\vhrvn.exec:\vhrvn.exe119⤵PID:2368
-
\??\c:\vbjpbrn.exec:\vbjpbrn.exe120⤵PID:1848
-
\??\c:\xdtlx.exec:\xdtlx.exe121⤵PID:1688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-