Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
b025947833ea07e51b37b20cb909f8bea25c680a09cebe89fcc69bb8ea34c9efN.exe
Resource
win7-20241010-en
General
-
Target
b025947833ea07e51b37b20cb909f8bea25c680a09cebe89fcc69bb8ea34c9efN.exe
-
Size
453KB
-
MD5
4857419cbae4840067ea9949bdeee290
-
SHA1
a78a1070e6d923b451daecdc8b1558c463f1930d
-
SHA256
b025947833ea07e51b37b20cb909f8bea25c680a09cebe89fcc69bb8ea34c9ef
-
SHA512
4a4dc9bf7b2e77e5eff606e6c96dae02191e288409bd9613f955abe8ddbe9af5757ca71e6c79ed4c5292c9d26cd8547baa851ffcca8fd2df115368fee0d87cb4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeY:q7Tc2NYHUrAwfMp3CDY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/804-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-50-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2784-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-102-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2844-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1460-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-229-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1824-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-265-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1232-271-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2368-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/804-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-357-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2676-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/656-686-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2976-694-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-803-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1596-878-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2340 hvbvd.exe 2008 ndfdfb.exe 2432 tpntd.exe 2880 rhpvffp.exe 2924 fnfvhxn.exe 3012 vxpfvlj.exe 2784 vrhpv.exe 2632 fvhfrfl.exe 2124 bfxjxbf.exe 2088 pfxtfl.exe 2844 njrbd.exe 2976 ttbbbd.exe 2828 tbhlllv.exe 1712 pdfnlpv.exe 2980 vjrnbfn.exe 1460 vpltdp.exe 2396 thrbr.exe 2988 tlnvvbp.exe 2084 hpxhbrl.exe 2096 pdvnx.exe 1156 jhlnnpx.exe 928 xhljjf.exe 1804 jttlfbr.exe 1824 vjlvdp.exe 612 vdbvhl.exe 1060 xpnpp.exe 1524 nfdldpb.exe 3064 btlhvv.exe 1232 fdxpb.exe 2368 fhlnxhl.exe 2216 vtvvntv.exe 1952 jnvfj.exe 804 fbblhh.exe 1516 hpndh.exe 2340 dxjdr.exe 2200 dvdthvn.exe 2760 jhrldrd.exe 2940 rhndh.exe 2880 djnvf.exe 2956 drtvvhj.exe 2648 ntbffvn.exe 2676 hdfjfbn.exe 2784 tljrtlp.exe 2632 pfhpv.exe 2324 nrrlfl.exe 2576 xhtxdnh.exe 2952 xxdjtv.exe 2984 tvrhhf.exe 1868 rpvjlhr.exe 2968 tjvvv.exe 1152 rntxv.exe 1712 lrdhvt.exe 1884 tdhddvh.exe 1888 jbftf.exe 2404 dpbjth.exe 2572 ddlnx.exe 1484 hnpfbnl.exe 2344 jpljnth.exe 528 rlvtpv.exe 1520 dhjlf.exe 3052 jnlxlnj.exe 640 bxpbtbd.exe 928 drxfhvl.exe 1716 ldntjdj.exe -
resource yara_rule behavioral1/memory/804-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/804-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/804-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-857-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rljlvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvrpdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njjfdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhnnrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btvllj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhvtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbxvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvhvdhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbdnld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtbff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trnhxnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbrbrfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dltjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntdhff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rltrhtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdxntxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnnxnxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjhjrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rndplbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnrrnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpxrtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbbrljb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhjrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvrndtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxjjbhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhjxfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phxfjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnftp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flflhnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddhrtfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdvnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxhjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnvrjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbbvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpdrfxb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 804 wrote to memory of 2340 804 b025947833ea07e51b37b20cb909f8bea25c680a09cebe89fcc69bb8ea34c9efN.exe 31 PID 804 wrote to memory of 2340 804 b025947833ea07e51b37b20cb909f8bea25c680a09cebe89fcc69bb8ea34c9efN.exe 31 PID 804 wrote to memory of 2340 804 b025947833ea07e51b37b20cb909f8bea25c680a09cebe89fcc69bb8ea34c9efN.exe 31 PID 804 wrote to memory of 2340 804 b025947833ea07e51b37b20cb909f8bea25c680a09cebe89fcc69bb8ea34c9efN.exe 31 PID 2340 wrote to memory of 2008 2340 hvbvd.exe 32 PID 2340 wrote to memory of 2008 2340 hvbvd.exe 32 PID 2340 wrote to memory of 2008 2340 hvbvd.exe 32 PID 2340 wrote to memory of 2008 2340 hvbvd.exe 32 PID 2008 wrote to memory of 2432 2008 ndfdfb.exe 33 PID 2008 wrote to memory of 2432 2008 ndfdfb.exe 33 PID 2008 wrote to memory of 2432 2008 ndfdfb.exe 33 PID 2008 wrote to memory of 2432 2008 ndfdfb.exe 33 PID 2432 wrote to memory of 2880 2432 tpntd.exe 34 PID 2432 wrote to memory of 2880 2432 tpntd.exe 34 PID 2432 wrote to memory of 2880 2432 tpntd.exe 34 PID 2432 wrote to memory of 2880 2432 tpntd.exe 34 PID 2880 wrote to memory of 2924 2880 rhpvffp.exe 35 PID 2880 wrote to memory of 2924 2880 rhpvffp.exe 35 PID 2880 wrote to memory of 2924 2880 rhpvffp.exe 35 PID 2880 wrote to memory of 2924 2880 rhpvffp.exe 35 PID 2924 wrote to memory of 3012 2924 fnfvhxn.exe 36 PID 2924 wrote to memory of 3012 2924 fnfvhxn.exe 36 PID 2924 wrote to memory of 3012 2924 fnfvhxn.exe 36 PID 2924 wrote to memory of 3012 2924 fnfvhxn.exe 36 PID 3012 wrote to memory of 2784 3012 vxpfvlj.exe 37 PID 3012 wrote to memory of 2784 3012 vxpfvlj.exe 37 PID 3012 wrote to memory of 2784 3012 vxpfvlj.exe 37 PID 3012 wrote to memory of 2784 3012 vxpfvlj.exe 37 PID 2784 wrote to memory of 2632 2784 vrhpv.exe 38 PID 2784 wrote to memory of 2632 2784 vrhpv.exe 38 PID 2784 wrote to memory of 2632 2784 vrhpv.exe 38 PID 2784 wrote to memory of 2632 2784 vrhpv.exe 38 PID 2632 wrote to memory of 2124 2632 fvhfrfl.exe 39 PID 2632 wrote to memory of 2124 2632 fvhfrfl.exe 39 PID 2632 wrote to memory of 2124 2632 fvhfrfl.exe 39 PID 2632 wrote to memory of 2124 2632 fvhfrfl.exe 39 PID 2124 wrote to memory of 2088 2124 bfxjxbf.exe 40 PID 2124 wrote to memory of 2088 2124 bfxjxbf.exe 40 PID 2124 wrote to memory of 2088 2124 bfxjxbf.exe 40 PID 2124 wrote to memory of 2088 2124 bfxjxbf.exe 40 PID 2088 wrote to memory of 2844 2088 pfxtfl.exe 41 PID 2088 wrote to memory of 2844 2088 pfxtfl.exe 41 PID 2088 wrote to memory of 2844 2088 pfxtfl.exe 41 PID 2088 wrote to memory of 2844 2088 pfxtfl.exe 41 PID 2844 wrote to memory of 2976 2844 njrbd.exe 42 PID 2844 wrote to memory of 2976 2844 njrbd.exe 42 PID 2844 wrote to memory of 2976 2844 njrbd.exe 42 PID 2844 wrote to memory of 2976 2844 njrbd.exe 42 PID 2976 wrote to memory of 2828 2976 ttbbbd.exe 43 PID 2976 wrote to memory of 2828 2976 ttbbbd.exe 43 PID 2976 wrote to memory of 2828 2976 ttbbbd.exe 43 PID 2976 wrote to memory of 2828 2976 ttbbbd.exe 43 PID 2828 wrote to memory of 1712 2828 tbhlllv.exe 44 PID 2828 wrote to memory of 1712 2828 tbhlllv.exe 44 PID 2828 wrote to memory of 1712 2828 tbhlllv.exe 44 PID 2828 wrote to memory of 1712 2828 tbhlllv.exe 44 PID 1712 wrote to memory of 2980 1712 pdfnlpv.exe 45 PID 1712 wrote to memory of 2980 1712 pdfnlpv.exe 45 PID 1712 wrote to memory of 2980 1712 pdfnlpv.exe 45 PID 1712 wrote to memory of 2980 1712 pdfnlpv.exe 45 PID 2980 wrote to memory of 1460 2980 vjrnbfn.exe 46 PID 2980 wrote to memory of 1460 2980 vjrnbfn.exe 46 PID 2980 wrote to memory of 1460 2980 vjrnbfn.exe 46 PID 2980 wrote to memory of 1460 2980 vjrnbfn.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b025947833ea07e51b37b20cb909f8bea25c680a09cebe89fcc69bb8ea34c9efN.exe"C:\Users\Admin\AppData\Local\Temp\b025947833ea07e51b37b20cb909f8bea25c680a09cebe89fcc69bb8ea34c9efN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\hvbvd.exec:\hvbvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\ndfdfb.exec:\ndfdfb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\tpntd.exec:\tpntd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\rhpvffp.exec:\rhpvffp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\fnfvhxn.exec:\fnfvhxn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\vxpfvlj.exec:\vxpfvlj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\vrhpv.exec:\vrhpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\fvhfrfl.exec:\fvhfrfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\bfxjxbf.exec:\bfxjxbf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\pfxtfl.exec:\pfxtfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\njrbd.exec:\njrbd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\ttbbbd.exec:\ttbbbd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\tbhlllv.exec:\tbhlllv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\pdfnlpv.exec:\pdfnlpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\vjrnbfn.exec:\vjrnbfn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\vpltdp.exec:\vpltdp.exe17⤵
- Executes dropped EXE
PID:1460 -
\??\c:\thrbr.exec:\thrbr.exe18⤵
- Executes dropped EXE
PID:2396 -
\??\c:\tlnvvbp.exec:\tlnvvbp.exe19⤵
- Executes dropped EXE
PID:2988 -
\??\c:\hpxhbrl.exec:\hpxhbrl.exe20⤵
- Executes dropped EXE
PID:2084 -
\??\c:\pdvnx.exec:\pdvnx.exe21⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jhlnnpx.exec:\jhlnnpx.exe22⤵
- Executes dropped EXE
PID:1156 -
\??\c:\xhljjf.exec:\xhljjf.exe23⤵
- Executes dropped EXE
PID:928 -
\??\c:\jttlfbr.exec:\jttlfbr.exe24⤵
- Executes dropped EXE
PID:1804 -
\??\c:\vjlvdp.exec:\vjlvdp.exe25⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vdbvhl.exec:\vdbvhl.exe26⤵
- Executes dropped EXE
PID:612 -
\??\c:\xpnpp.exec:\xpnpp.exe27⤵
- Executes dropped EXE
PID:1060 -
\??\c:\nfdldpb.exec:\nfdldpb.exe28⤵
- Executes dropped EXE
PID:1524 -
\??\c:\btlhvv.exec:\btlhvv.exe29⤵
- Executes dropped EXE
PID:3064 -
\??\c:\fdxpb.exec:\fdxpb.exe30⤵
- Executes dropped EXE
PID:1232 -
\??\c:\fhlnxhl.exec:\fhlnxhl.exe31⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vtvvntv.exec:\vtvvntv.exe32⤵
- Executes dropped EXE
PID:2216 -
\??\c:\jnvfj.exec:\jnvfj.exe33⤵
- Executes dropped EXE
PID:1952 -
\??\c:\fbblhh.exec:\fbblhh.exe34⤵
- Executes dropped EXE
PID:804 -
\??\c:\hpndh.exec:\hpndh.exe35⤵
- Executes dropped EXE
PID:1516 -
\??\c:\dxjdr.exec:\dxjdr.exe36⤵
- Executes dropped EXE
PID:2340 -
\??\c:\dvdthvn.exec:\dvdthvn.exe37⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jhrldrd.exec:\jhrldrd.exe38⤵
- Executes dropped EXE
PID:2760 -
\??\c:\rhndh.exec:\rhndh.exe39⤵
- Executes dropped EXE
PID:2940 -
\??\c:\djnvf.exec:\djnvf.exe40⤵
- Executes dropped EXE
PID:2880 -
\??\c:\drtvvhj.exec:\drtvvhj.exe41⤵
- Executes dropped EXE
PID:2956 -
\??\c:\ntbffvn.exec:\ntbffvn.exe42⤵
- Executes dropped EXE
PID:2648 -
\??\c:\hdfjfbn.exec:\hdfjfbn.exe43⤵
- Executes dropped EXE
PID:2676 -
\??\c:\tljrtlp.exec:\tljrtlp.exe44⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pfhpv.exec:\pfhpv.exe45⤵
- Executes dropped EXE
PID:2632 -
\??\c:\nrrlfl.exec:\nrrlfl.exe46⤵
- Executes dropped EXE
PID:2324 -
\??\c:\xhtxdnh.exec:\xhtxdnh.exe47⤵
- Executes dropped EXE
PID:2576 -
\??\c:\xxdjtv.exec:\xxdjtv.exe48⤵
- Executes dropped EXE
PID:2952 -
\??\c:\tvrhhf.exec:\tvrhhf.exe49⤵
- Executes dropped EXE
PID:2984 -
\??\c:\rpvjlhr.exec:\rpvjlhr.exe50⤵
- Executes dropped EXE
PID:1868 -
\??\c:\tjvvv.exec:\tjvvv.exe51⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rntxv.exec:\rntxv.exe52⤵
- Executes dropped EXE
PID:1152 -
\??\c:\lrdhvt.exec:\lrdhvt.exe53⤵
- Executes dropped EXE
PID:1712 -
\??\c:\tdhddvh.exec:\tdhddvh.exe54⤵
- Executes dropped EXE
PID:1884 -
\??\c:\jbftf.exec:\jbftf.exe55⤵
- Executes dropped EXE
PID:1888 -
\??\c:\dpbjth.exec:\dpbjth.exe56⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ddlnx.exec:\ddlnx.exe57⤵
- Executes dropped EXE
PID:2572 -
\??\c:\hnpfbnl.exec:\hnpfbnl.exe58⤵
- Executes dropped EXE
PID:1484 -
\??\c:\jpljnth.exec:\jpljnth.exe59⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rlvtpv.exec:\rlvtpv.exe60⤵
- Executes dropped EXE
PID:528 -
\??\c:\dhjlf.exec:\dhjlf.exe61⤵
- Executes dropped EXE
PID:1520 -
\??\c:\jnlxlnj.exec:\jnlxlnj.exe62⤵
- Executes dropped EXE
PID:3052 -
\??\c:\bxpbtbd.exec:\bxpbtbd.exe63⤵
- Executes dropped EXE
PID:640 -
\??\c:\drxfhvl.exec:\drxfhvl.exe64⤵
- Executes dropped EXE
PID:928 -
\??\c:\ldntjdj.exec:\ldntjdj.exe65⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rdxntxj.exec:\rdxntxj.exe66⤵
- System Location Discovery: System Language Discovery
PID:1724 -
\??\c:\dvvlrvr.exec:\dvvlrvr.exe67⤵PID:1748
-
\??\c:\djjnbfh.exec:\djjnbfh.exe68⤵PID:1588
-
\??\c:\nxlfnj.exec:\nxlfnj.exe69⤵PID:2480
-
\??\c:\nrvptj.exec:\nrvptj.exe70⤵PID:2372
-
\??\c:\ljhxb.exec:\ljhxb.exe71⤵PID:2500
-
\??\c:\xvjddh.exec:\xvjddh.exe72⤵PID:2700
-
\??\c:\hjdndf.exec:\hjdndf.exe73⤵PID:2368
-
\??\c:\pllhv.exec:\pllhv.exe74⤵PID:880
-
\??\c:\pfpppxf.exec:\pfpppxf.exe75⤵PID:1188
-
\??\c:\dplvdp.exec:\dplvdp.exe76⤵PID:2552
-
\??\c:\pnvtxxr.exec:\pnvtxxr.exe77⤵PID:804
-
\??\c:\bpxrtx.exec:\bpxrtx.exe78⤵
- System Location Discovery: System Language Discovery
PID:1516 -
\??\c:\pprfxtd.exec:\pprfxtd.exe79⤵PID:1988
-
\??\c:\njjfdt.exec:\njjfdt.exe80⤵
- System Location Discovery: System Language Discovery
PID:2200 -
\??\c:\nrvvvj.exec:\nrvvvj.exe81⤵PID:2892
-
\??\c:\pjvpnv.exec:\pjvpnv.exe82⤵PID:2936
-
\??\c:\xrrrjnb.exec:\xrrrjnb.exe83⤵PID:2996
-
\??\c:\hdbtdh.exec:\hdbtdh.exe84⤵PID:2140
-
\??\c:\vbrfptt.exec:\vbrfptt.exe85⤵PID:2788
-
\??\c:\lxbpv.exec:\lxbpv.exe86⤵PID:2620
-
\??\c:\vlflnnp.exec:\vlflnnp.exe87⤵PID:2696
-
\??\c:\pxxxlr.exec:\pxxxlr.exe88⤵PID:2664
-
\??\c:\lnxrj.exec:\lnxrj.exe89⤵PID:2632
-
\??\c:\rtprxdp.exec:\rtprxdp.exe90⤵PID:2324
-
\??\c:\bjhtj.exec:\bjhtj.exe91⤵PID:656
-
\??\c:\fjrtlr.exec:\fjrtlr.exe92⤵PID:832
-
\??\c:\ndnbvh.exec:\ndnbvh.exe93⤵PID:2976
-
\??\c:\xhvfr.exec:\xhvfr.exe94⤵PID:2508
-
\??\c:\prfndpl.exec:\prfndpl.exe95⤵PID:560
-
\??\c:\dfjfflf.exec:\dfjfflf.exe96⤵PID:1464
-
\??\c:\bbvnx.exec:\bbvnx.exe97⤵PID:1920
-
\??\c:\nvphxxd.exec:\nvphxxd.exe98⤵PID:2232
-
\??\c:\vhhxt.exec:\vhhxt.exe99⤵PID:1068
-
\??\c:\vpprr.exec:\vpprr.exe100⤵PID:1628
-
\??\c:\ltxbtff.exec:\ltxbtff.exe101⤵PID:2544
-
\??\c:\vjnjxp.exec:\vjnjxp.exe102⤵PID:2084
-
\??\c:\dprtb.exec:\dprtb.exe103⤵PID:2096
-
\??\c:\fblrp.exec:\fblrp.exe104⤵PID:1348
-
\??\c:\xthbl.exec:\xthbl.exe105⤵PID:1052
-
\??\c:\tdxxjd.exec:\tdxxjd.exe106⤵PID:1704
-
\??\c:\vhjvdx.exec:\vhjvdx.exe107⤵PID:640
-
\??\c:\jnnrv.exec:\jnnrv.exe108⤵PID:928
-
\??\c:\tbvpbfh.exec:\tbvpbfh.exe109⤵PID:1824
-
\??\c:\dffbvp.exec:\dffbvp.exe110⤵PID:824
-
\??\c:\nppdnh.exec:\nppdnh.exe111⤵PID:1748
-
\??\c:\dnhvx.exec:\dnhvx.exe112⤵PID:2040
-
\??\c:\tjjtpnf.exec:\tjjtpnf.exe113⤵PID:2092
-
\??\c:\tlrhr.exec:\tlrhr.exe114⤵PID:2180
-
\??\c:\xbbrljb.exec:\xbbrljb.exe115⤵
- System Location Discovery: System Language Discovery
PID:1820 -
\??\c:\nhlxbnb.exec:\nhlxbnb.exe116⤵PID:672
-
\??\c:\vtxrdj.exec:\vtxrdj.exe117⤵PID:1012
-
\??\c:\hxplh.exec:\hxplh.exe118⤵PID:2216
-
\??\c:\hlttvtn.exec:\hlttvtn.exe119⤵PID:2548
-
\??\c:\lnxrdh.exec:\lnxrdh.exe120⤵PID:1596
-
\??\c:\dxjjbhd.exec:\dxjjbhd.exe121⤵
- System Location Discovery: System Language Discovery
PID:2016 -
\??\c:\ftnhf.exec:\ftnhf.exe122⤵PID:1620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-