Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 23:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
820520ebcf298ee8fbbf7fe70af95378eceff21ae6bd857b2e272e11bbf7c4e3N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
820520ebcf298ee8fbbf7fe70af95378eceff21ae6bd857b2e272e11bbf7c4e3N.exe
-
Size
453KB
-
MD5
e44b459164d3a0f7498cb2e83b259ac0
-
SHA1
0ba7f546e4eb1597278493dce6eaff8746fa2fb8
-
SHA256
820520ebcf298ee8fbbf7fe70af95378eceff21ae6bd857b2e272e11bbf7c4e3
-
SHA512
5cfa5ce53373e91966fbb1bcf4e914307f09260b1aa0a4f9ecc10be427b9e4eac3de23fa7d94d3f4a3bdb2e508eae288bd1a93cf4f1d4a1c2366dea528630b5e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeC:q7Tc2NYHUrAwfMp3CDC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2200-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-84-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3036-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-151-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1924-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-214-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/744-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-226-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1540-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-269-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1820-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-364-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2764-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-390-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/396-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-536-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1184-550-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1432-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-571-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2384-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-685-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1960-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-788-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-853-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2580-878-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2664-1004-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2944-1010-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2308 lhhdtxh.exe 1756 pbdljnr.exe 2168 txpnpjl.exe 2360 ftxnfv.exe 2808 blfhn.exe 3068 flvdp.exe 2232 dffhr.exe 3036 dhlxnb.exe 2852 hbxhdl.exe 2692 ttbljl.exe 2316 tlpbfx.exe 2660 rdhhlrp.exe 3016 nljndv.exe 1456 jblthrd.exe 2944 vlxvxhh.exe 1096 dfvdxb.exe 1924 rpldp.exe 1992 ffdxjfx.exe 3012 pxpjjv.exe 2416 djftff.exe 1908 rdvjv.exe 2484 hbrpxp.exe 1700 rhtln.exe 3032 tfnrttr.exe 744 vrtvnrh.exe 2328 ffrvhhj.exe 1184 dppft.exe 1540 nbvtrj.exe 1820 vpjdvvp.exe 1768 xffnvp.exe 2520 pjtdp.exe 896 tnhll.exe 2240 fjxnhn.exe 1760 xdbrpp.exe 1576 fhtpbd.exe 1708 lrbbrh.exe 1756 nnthrp.exe 2956 lnhrfj.exe 1692 vrhvb.exe 2880 bprvtr.exe 2804 xrlpbv.exe 3056 hdlplf.exe 2512 jjtnvf.exe 2764 vjfddf.exe 2732 njbtn.exe 2676 jvvlh.exe 1532 rplnp.exe 2496 ddvbnr.exe 1200 prvpn.exe 2656 hprdrbj.exe 3016 jxnvlnv.exe 2780 txvnbjx.exe 1080 fljpfbl.exe 2024 rldfrfb.exe 2000 xprjl.exe 2016 dvjhn.exe 2916 nbdpbb.exe 3020 pjbvnv.exe 2268 ntbdd.exe 2396 dnbxvd.exe 1908 jvlbdhd.exe 2772 ttpdh.exe 396 rhhnbl.exe 1164 bbhlhtp.exe -
resource yara_rule behavioral1/memory/2200-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/744-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-269-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1820-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-447-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3020-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-740-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-820-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-834-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-878-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2044-965-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnjln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnfljh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hptdtdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txvnbjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxrppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlpvxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prplp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbplrnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldrpbhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhpjvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tphhbdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdhbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbvlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfnltf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpblb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpfttj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jblvfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxbvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnfxpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ptnntfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njxrxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjhjjbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvxlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrjxnjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbbrljv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvxdhvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjfph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfhxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdjjfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvprbxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlrnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnfpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvndj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftdjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfjxfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnrfvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnpnn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2200 wrote to memory of 2308 2200 820520ebcf298ee8fbbf7fe70af95378eceff21ae6bd857b2e272e11bbf7c4e3N.exe 30 PID 2200 wrote to memory of 2308 2200 820520ebcf298ee8fbbf7fe70af95378eceff21ae6bd857b2e272e11bbf7c4e3N.exe 30 PID 2200 wrote to memory of 2308 2200 820520ebcf298ee8fbbf7fe70af95378eceff21ae6bd857b2e272e11bbf7c4e3N.exe 30 PID 2200 wrote to memory of 2308 2200 820520ebcf298ee8fbbf7fe70af95378eceff21ae6bd857b2e272e11bbf7c4e3N.exe 30 PID 2308 wrote to memory of 1756 2308 lhhdtxh.exe 31 PID 2308 wrote to memory of 1756 2308 lhhdtxh.exe 31 PID 2308 wrote to memory of 1756 2308 lhhdtxh.exe 31 PID 2308 wrote to memory of 1756 2308 lhhdtxh.exe 31 PID 1756 wrote to memory of 2168 1756 pbdljnr.exe 32 PID 1756 wrote to memory of 2168 1756 pbdljnr.exe 32 PID 1756 wrote to memory of 2168 1756 pbdljnr.exe 32 PID 1756 wrote to memory of 2168 1756 pbdljnr.exe 32 PID 2168 wrote to memory of 2360 2168 txpnpjl.exe 33 PID 2168 wrote to memory of 2360 2168 txpnpjl.exe 33 PID 2168 wrote to memory of 2360 2168 txpnpjl.exe 33 PID 2168 wrote to memory of 2360 2168 txpnpjl.exe 33 PID 2360 wrote to memory of 2808 2360 ftxnfv.exe 34 PID 2360 wrote to memory of 2808 2360 ftxnfv.exe 34 PID 2360 wrote to memory of 2808 2360 ftxnfv.exe 34 PID 2360 wrote to memory of 2808 2360 ftxnfv.exe 34 PID 2808 wrote to memory of 3068 2808 blfhn.exe 35 PID 2808 wrote to memory of 3068 2808 blfhn.exe 35 PID 2808 wrote to memory of 3068 2808 blfhn.exe 35 PID 2808 wrote to memory of 3068 2808 blfhn.exe 35 PID 3068 wrote to memory of 2232 3068 flvdp.exe 36 PID 3068 wrote to memory of 2232 3068 flvdp.exe 36 PID 3068 wrote to memory of 2232 3068 flvdp.exe 36 PID 3068 wrote to memory of 2232 3068 flvdp.exe 36 PID 2232 wrote to memory of 3036 2232 dffhr.exe 37 PID 2232 wrote to memory of 3036 2232 dffhr.exe 37 PID 2232 wrote to memory of 3036 2232 dffhr.exe 37 PID 2232 wrote to memory of 3036 2232 dffhr.exe 37 PID 3036 wrote to memory of 2852 3036 dhlxnb.exe 38 PID 3036 wrote to memory of 2852 3036 dhlxnb.exe 38 PID 3036 wrote to memory of 2852 3036 dhlxnb.exe 38 PID 3036 wrote to memory of 2852 3036 dhlxnb.exe 38 PID 2852 wrote to memory of 2692 2852 hbxhdl.exe 39 PID 2852 wrote to memory of 2692 2852 hbxhdl.exe 39 PID 2852 wrote to memory of 2692 2852 hbxhdl.exe 39 PID 2852 wrote to memory of 2692 2852 hbxhdl.exe 39 PID 2692 wrote to memory of 2316 2692 ttbljl.exe 40 PID 2692 wrote to memory of 2316 2692 ttbljl.exe 40 PID 2692 wrote to memory of 2316 2692 ttbljl.exe 40 PID 2692 wrote to memory of 2316 2692 ttbljl.exe 40 PID 2316 wrote to memory of 2660 2316 tlpbfx.exe 41 PID 2316 wrote to memory of 2660 2316 tlpbfx.exe 41 PID 2316 wrote to memory of 2660 2316 tlpbfx.exe 41 PID 2316 wrote to memory of 2660 2316 tlpbfx.exe 41 PID 2660 wrote to memory of 3016 2660 rdhhlrp.exe 42 PID 2660 wrote to memory of 3016 2660 rdhhlrp.exe 42 PID 2660 wrote to memory of 3016 2660 rdhhlrp.exe 42 PID 2660 wrote to memory of 3016 2660 rdhhlrp.exe 42 PID 3016 wrote to memory of 1456 3016 nljndv.exe 43 PID 3016 wrote to memory of 1456 3016 nljndv.exe 43 PID 3016 wrote to memory of 1456 3016 nljndv.exe 43 PID 3016 wrote to memory of 1456 3016 nljndv.exe 43 PID 1456 wrote to memory of 2944 1456 jblthrd.exe 44 PID 1456 wrote to memory of 2944 1456 jblthrd.exe 44 PID 1456 wrote to memory of 2944 1456 jblthrd.exe 44 PID 1456 wrote to memory of 2944 1456 jblthrd.exe 44 PID 2944 wrote to memory of 1096 2944 vlxvxhh.exe 45 PID 2944 wrote to memory of 1096 2944 vlxvxhh.exe 45 PID 2944 wrote to memory of 1096 2944 vlxvxhh.exe 45 PID 2944 wrote to memory of 1096 2944 vlxvxhh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\820520ebcf298ee8fbbf7fe70af95378eceff21ae6bd857b2e272e11bbf7c4e3N.exe"C:\Users\Admin\AppData\Local\Temp\820520ebcf298ee8fbbf7fe70af95378eceff21ae6bd857b2e272e11bbf7c4e3N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\lhhdtxh.exec:\lhhdtxh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\pbdljnr.exec:\pbdljnr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\txpnpjl.exec:\txpnpjl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\ftxnfv.exec:\ftxnfv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\blfhn.exec:\blfhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\flvdp.exec:\flvdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\dffhr.exec:\dffhr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\dhlxnb.exec:\dhlxnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\hbxhdl.exec:\hbxhdl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\ttbljl.exec:\ttbljl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\tlpbfx.exec:\tlpbfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\rdhhlrp.exec:\rdhhlrp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\nljndv.exec:\nljndv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\jblthrd.exec:\jblthrd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\vlxvxhh.exec:\vlxvxhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\dfvdxb.exec:\dfvdxb.exe17⤵
- Executes dropped EXE
PID:1096 -
\??\c:\rpldp.exec:\rpldp.exe18⤵
- Executes dropped EXE
PID:1924 -
\??\c:\ffdxjfx.exec:\ffdxjfx.exe19⤵
- Executes dropped EXE
PID:1992 -
\??\c:\pxpjjv.exec:\pxpjjv.exe20⤵
- Executes dropped EXE
PID:3012 -
\??\c:\djftff.exec:\djftff.exe21⤵
- Executes dropped EXE
PID:2416 -
\??\c:\rdvjv.exec:\rdvjv.exe22⤵
- Executes dropped EXE
PID:1908 -
\??\c:\hbrpxp.exec:\hbrpxp.exe23⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rhtln.exec:\rhtln.exe24⤵
- Executes dropped EXE
PID:1700 -
\??\c:\tfnrttr.exec:\tfnrttr.exe25⤵
- Executes dropped EXE
PID:3032 -
\??\c:\vrtvnrh.exec:\vrtvnrh.exe26⤵
- Executes dropped EXE
PID:744 -
\??\c:\ffrvhhj.exec:\ffrvhhj.exe27⤵
- Executes dropped EXE
PID:2328 -
\??\c:\dppft.exec:\dppft.exe28⤵
- Executes dropped EXE
PID:1184 -
\??\c:\nbvtrj.exec:\nbvtrj.exe29⤵
- Executes dropped EXE
PID:1540 -
\??\c:\vpjdvvp.exec:\vpjdvvp.exe30⤵
- Executes dropped EXE
PID:1820 -
\??\c:\xffnvp.exec:\xffnvp.exe31⤵
- Executes dropped EXE
PID:1768 -
\??\c:\pjtdp.exec:\pjtdp.exe32⤵
- Executes dropped EXE
PID:2520 -
\??\c:\tnhll.exec:\tnhll.exe33⤵
- Executes dropped EXE
PID:896 -
\??\c:\fjxnhn.exec:\fjxnhn.exe34⤵
- Executes dropped EXE
PID:2240 -
\??\c:\xdbrpp.exec:\xdbrpp.exe35⤵
- Executes dropped EXE
PID:1760 -
\??\c:\fhtpbd.exec:\fhtpbd.exe36⤵
- Executes dropped EXE
PID:1576 -
\??\c:\lrbbrh.exec:\lrbbrh.exe37⤵
- Executes dropped EXE
PID:1708 -
\??\c:\nnthrp.exec:\nnthrp.exe38⤵
- Executes dropped EXE
PID:1756 -
\??\c:\lnhrfj.exec:\lnhrfj.exe39⤵
- Executes dropped EXE
PID:2956 -
\??\c:\vrhvb.exec:\vrhvb.exe40⤵
- Executes dropped EXE
PID:1692 -
\??\c:\bprvtr.exec:\bprvtr.exe41⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xrlpbv.exec:\xrlpbv.exe42⤵
- Executes dropped EXE
PID:2804 -
\??\c:\hdlplf.exec:\hdlplf.exe43⤵
- Executes dropped EXE
PID:3056 -
\??\c:\jjtnvf.exec:\jjtnvf.exe44⤵
- Executes dropped EXE
PID:2512 -
\??\c:\vjfddf.exec:\vjfddf.exe45⤵
- Executes dropped EXE
PID:2764 -
\??\c:\njbtn.exec:\njbtn.exe46⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jvvlh.exec:\jvvlh.exe47⤵
- Executes dropped EXE
PID:2676 -
\??\c:\rplnp.exec:\rplnp.exe48⤵
- Executes dropped EXE
PID:1532 -
\??\c:\ddvbnr.exec:\ddvbnr.exe49⤵
- Executes dropped EXE
PID:2496 -
\??\c:\prvpn.exec:\prvpn.exe50⤵
- Executes dropped EXE
PID:1200 -
\??\c:\hprdrbj.exec:\hprdrbj.exe51⤵
- Executes dropped EXE
PID:2656 -
\??\c:\jxnvlnv.exec:\jxnvlnv.exe52⤵
- Executes dropped EXE
PID:3016 -
\??\c:\txvnbjx.exec:\txvnbjx.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2780 -
\??\c:\fljpfbl.exec:\fljpfbl.exe54⤵
- Executes dropped EXE
PID:1080 -
\??\c:\rldfrfb.exec:\rldfrfb.exe55⤵
- Executes dropped EXE
PID:2024 -
\??\c:\xprjl.exec:\xprjl.exe56⤵
- Executes dropped EXE
PID:2000 -
\??\c:\dvjhn.exec:\dvjhn.exe57⤵
- Executes dropped EXE
PID:2016 -
\??\c:\nbdpbb.exec:\nbdpbb.exe58⤵
- Executes dropped EXE
PID:2916 -
\??\c:\pjbvnv.exec:\pjbvnv.exe59⤵
- Executes dropped EXE
PID:3020 -
\??\c:\ntbdd.exec:\ntbdd.exe60⤵
- Executes dropped EXE
PID:2268 -
\??\c:\dnbxvd.exec:\dnbxvd.exe61⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jvlbdhd.exec:\jvlbdhd.exe62⤵
- Executes dropped EXE
PID:1908 -
\??\c:\ttpdh.exec:\ttpdh.exe63⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rhhnbl.exec:\rhhnbl.exe64⤵
- Executes dropped EXE
PID:396 -
\??\c:\bbhlhtp.exec:\bbhlhtp.exe65⤵
- Executes dropped EXE
PID:1164 -
\??\c:\nrvxfrt.exec:\nrvxfrt.exe66⤵PID:1752
-
\??\c:\fjrbfrp.exec:\fjrbfrp.exe67⤵PID:744
-
\??\c:\hnvljr.exec:\hnvljr.exe68⤵PID:1784
-
\??\c:\bhdvr.exec:\bhdvr.exe69⤵PID:1968
-
\??\c:\dddpt.exec:\dddpt.exe70⤵PID:1184
-
\??\c:\lhlnjn.exec:\lhlnjn.exe71⤵PID:1432
-
\??\c:\jjvfhp.exec:\jjvfhp.exe72⤵PID:2540
-
\??\c:\jvdhbd.exec:\jvdhbd.exe73⤵
- System Location Discovery: System Language Discovery
PID:820 -
\??\c:\txdhn.exec:\txdhn.exe74⤵PID:288
-
\??\c:\lfjvb.exec:\lfjvb.exe75⤵PID:900
-
\??\c:\rtfxv.exec:\rtfxv.exe76⤵PID:2060
-
\??\c:\vxhfn.exec:\vxhfn.exe77⤵PID:2384
-
\??\c:\lvhhll.exec:\lvhhll.exe78⤵PID:2308
-
\??\c:\xjfhpr.exec:\xjfhpr.exe79⤵PID:1600
-
\??\c:\xvddv.exec:\xvddv.exe80⤵PID:2104
-
\??\c:\xfndv.exec:\xfndv.exe81⤵PID:2760
-
\??\c:\vfflpb.exec:\vfflpb.exe82⤵PID:2768
-
\??\c:\vhbtb.exec:\vhbtb.exe83⤵PID:2532
-
\??\c:\hxvnr.exec:\hxvnr.exe84⤵PID:1692
-
\??\c:\tjrhrxx.exec:\tjrhrxx.exe85⤵PID:2888
-
\??\c:\ljjvh.exec:\ljjvh.exe86⤵PID:2784
-
\??\c:\vnhxpdh.exec:\vnhxpdh.exe87⤵PID:3008
-
\??\c:\jxpvrp.exec:\jxpvrp.exe88⤵PID:2712
-
\??\c:\lhpdv.exec:\lhpdv.exe89⤵PID:2764
-
\??\c:\hfxrn.exec:\hfxrn.exe90⤵PID:2732
-
\??\c:\vhxljhj.exec:\vhxljhj.exe91⤵PID:2720
-
\??\c:\lpxbl.exec:\lpxbl.exe92⤵PID:1960
-
\??\c:\dxjjv.exec:\dxjjv.exe93⤵PID:2496
-
\??\c:\nblpjdb.exec:\nblpjdb.exe94⤵PID:1200
-
\??\c:\jtlhpl.exec:\jtlhpl.exe95⤵PID:692
-
\??\c:\pprvhr.exec:\pprvhr.exe96⤵PID:1504
-
\??\c:\htxjrpd.exec:\htxjrpd.exe97⤵PID:2364
-
\??\c:\fjjjvf.exec:\fjjjvf.exe98⤵PID:2064
-
\??\c:\dnfnfjj.exec:\dnfnfjj.exe99⤵PID:2996
-
\??\c:\xvxnhhb.exec:\xvxnhhb.exe100⤵PID:1972
-
\??\c:\ffvppxf.exec:\ffvppxf.exe101⤵PID:1764
-
\??\c:\llptl.exec:\llptl.exe102⤵PID:1992
-
\??\c:\dnvftxb.exec:\dnvftxb.exe103⤵PID:2420
-
\??\c:\jtxrdr.exec:\jtxrdr.exe104⤵PID:2052
-
\??\c:\lpvnr.exec:\lpvnr.exe105⤵PID:1868
-
\??\c:\fvthtt.exec:\fvthtt.exe106⤵PID:1928
-
\??\c:\xrprt.exec:\xrprt.exe107⤵PID:2484
-
\??\c:\vjnnd.exec:\vjnnd.exe108⤵PID:1352
-
\??\c:\bnrpn.exec:\bnrpn.exe109⤵PID:960
-
\??\c:\xhxrvh.exec:\xhxrvh.exe110⤵PID:1284
-
\??\c:\rvvpll.exec:\rvvpll.exe111⤵PID:1036
-
\??\c:\rxdpnp.exec:\rxdpnp.exe112⤵PID:1736
-
\??\c:\hfxbjf.exec:\hfxbjf.exe113⤵PID:1932
-
\??\c:\dxphb.exec:\dxphb.exe114⤵PID:1088
-
\??\c:\txjrbb.exec:\txjrbb.exe115⤵PID:2312
-
\??\c:\xvfvjlr.exec:\xvfvjlr.exe116⤵PID:2320
-
\??\c:\htltptl.exec:\htltptl.exe117⤵PID:1896
-
\??\c:\xfbdjj.exec:\xfbdjj.exe118⤵PID:820
-
\??\c:\pjjjjdn.exec:\pjjjjdn.exe119⤵PID:2444
-
\??\c:\rjnvtx.exec:\rjnvtx.exe120⤵PID:2432
-
\??\c:\bdjlj.exec:\bdjlj.exe121⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-