Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 22:22
Static task
static1
Behavioral task
behavioral1
Sample
b98ab1d4238c550c514e0def72b1e6369d50e50fe1409a0a3426424251070d98N.exe
Resource
win7-20241010-en
General
-
Target
b98ab1d4238c550c514e0def72b1e6369d50e50fe1409a0a3426424251070d98N.exe
-
Size
454KB
-
MD5
97fe22811e61d158a12dbde8d518e4e0
-
SHA1
86234426778fc04d0f99f27676022699c3fbae63
-
SHA256
b98ab1d4238c550c514e0def72b1e6369d50e50fe1409a0a3426424251070d98
-
SHA512
50b6c2cfa4d988ca838a7895486d692e11aea47643bffc71747605b7481fe49755866448fdc20dbaa09ae278f3567009680eae32440f7c84013fe966943e0b62
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2324-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1196-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/612-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-246-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1892-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-316-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1760-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-367-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/584-368-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1960-424-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1880-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-444-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3028-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-472-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2756-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-640-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2716-660-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2740-681-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-708-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1128-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-740-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2404 hbvft.exe 2304 hrvpr.exe 1384 vfptdf.exe 2068 tpphhrn.exe 2488 tpxrpx.exe 2788 rllfv.exe 2908 vpbrxlr.exe 2948 jxtxd.exe 1904 ffjffd.exe 2740 hxnrp.exe 2044 rvdxfvv.exe 2736 tbxfv.exe 1196 ntxpjj.exe 1504 vnhvtn.exe 2576 pjdbh.exe 1636 fhpbbl.exe 2016 ppdtntr.exe 836 bfffp.exe 612 xttffx.exe 1696 rxtpjx.exe 2484 jxhlxhn.exe 1876 rfhpxr.exe 3032 dpvvj.exe 1516 bfpnvf.exe 1828 ldddxlt.exe 2088 ttxbhv.exe 1432 bpplxf.exe 1584 djjnrfj.exe 1892 bhvtt.exe 2244 fdrtl.exe 1720 nvtppbf.exe 2524 jbtxht.exe 2080 lnplvf.exe 1760 frrtrbn.exe 2372 hhddjh.exe 2304 drbjhp.exe 3040 nvlnbhh.exe 584 xdddr.exe 2892 pdbdn.exe 2512 fndtf.exe 1264 bjxjpfp.exe 2908 vrjrhn.exe 2848 nrtfv.exe 2688 lvppd.exe 2204 hprbndh.exe 1960 dxplv.exe 1144 ltppbbj.exe 1200 bdjvxvv.exe 1880 dvpjfx.exe 1888 prntdb.exe 1504 rtvrp.exe 2056 rblpvrj.exe 1488 rbpbhr.exe 1988 pvhxnxn.exe 3028 rjvjprd.exe 2280 bxjlbhx.exe 2636 tpvtdjx.exe 112 jphhddd.exe 1380 jjprfh.exe 108 nthtpbf.exe 1700 xhndhr.exe 1788 njbblp.exe 1616 fxrpxdx.exe 1036 rpdntn.exe -
resource yara_rule behavioral1/memory/2324-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-246-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1892-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-316-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1760-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-352-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1264-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-368-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2688-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-416-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1880-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-472-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/820-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-721-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttpbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfhfhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxjlbhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nprxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vptfxlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtdfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lntrdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfrrtxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtbdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxntxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdxxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drrvbtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxnbxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnfrdvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbttdxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrxhdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtxvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjbxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhddb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbflb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbndjjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpjdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxhrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjptxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvfvtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtxxpvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvrvph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdrtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhjxhll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prnndf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlpdlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtnnvhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nljphjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrhxbpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvpltdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnjjprx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbjpdvx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2404 2324 b98ab1d4238c550c514e0def72b1e6369d50e50fe1409a0a3426424251070d98N.exe 30 PID 2324 wrote to memory of 2404 2324 b98ab1d4238c550c514e0def72b1e6369d50e50fe1409a0a3426424251070d98N.exe 30 PID 2324 wrote to memory of 2404 2324 b98ab1d4238c550c514e0def72b1e6369d50e50fe1409a0a3426424251070d98N.exe 30 PID 2324 wrote to memory of 2404 2324 b98ab1d4238c550c514e0def72b1e6369d50e50fe1409a0a3426424251070d98N.exe 30 PID 2404 wrote to memory of 2304 2404 hbvft.exe 31 PID 2404 wrote to memory of 2304 2404 hbvft.exe 31 PID 2404 wrote to memory of 2304 2404 hbvft.exe 31 PID 2404 wrote to memory of 2304 2404 hbvft.exe 31 PID 2304 wrote to memory of 1384 2304 hrvpr.exe 32 PID 2304 wrote to memory of 1384 2304 hrvpr.exe 32 PID 2304 wrote to memory of 1384 2304 hrvpr.exe 32 PID 2304 wrote to memory of 1384 2304 hrvpr.exe 32 PID 1384 wrote to memory of 2068 1384 vfptdf.exe 33 PID 1384 wrote to memory of 2068 1384 vfptdf.exe 33 PID 1384 wrote to memory of 2068 1384 vfptdf.exe 33 PID 1384 wrote to memory of 2068 1384 vfptdf.exe 33 PID 2068 wrote to memory of 2488 2068 tpphhrn.exe 34 PID 2068 wrote to memory of 2488 2068 tpphhrn.exe 34 PID 2068 wrote to memory of 2488 2068 tpphhrn.exe 34 PID 2068 wrote to memory of 2488 2068 tpphhrn.exe 34 PID 2488 wrote to memory of 2788 2488 tpxrpx.exe 35 PID 2488 wrote to memory of 2788 2488 tpxrpx.exe 35 PID 2488 wrote to memory of 2788 2488 tpxrpx.exe 35 PID 2488 wrote to memory of 2788 2488 tpxrpx.exe 35 PID 2788 wrote to memory of 2908 2788 rllfv.exe 36 PID 2788 wrote to memory of 2908 2788 rllfv.exe 36 PID 2788 wrote to memory of 2908 2788 rllfv.exe 36 PID 2788 wrote to memory of 2908 2788 rllfv.exe 36 PID 2908 wrote to memory of 2948 2908 vpbrxlr.exe 37 PID 2908 wrote to memory of 2948 2908 vpbrxlr.exe 37 PID 2908 wrote to memory of 2948 2908 vpbrxlr.exe 37 PID 2908 wrote to memory of 2948 2908 vpbrxlr.exe 37 PID 2948 wrote to memory of 1904 2948 jxtxd.exe 38 PID 2948 wrote to memory of 1904 2948 jxtxd.exe 38 PID 2948 wrote to memory of 1904 2948 jxtxd.exe 38 PID 2948 wrote to memory of 1904 2948 jxtxd.exe 38 PID 1904 wrote to memory of 2740 1904 ffjffd.exe 39 PID 1904 wrote to memory of 2740 1904 ffjffd.exe 39 PID 1904 wrote to memory of 2740 1904 ffjffd.exe 39 PID 1904 wrote to memory of 2740 1904 ffjffd.exe 39 PID 2740 wrote to memory of 2044 2740 hxnrp.exe 40 PID 2740 wrote to memory of 2044 2740 hxnrp.exe 40 PID 2740 wrote to memory of 2044 2740 hxnrp.exe 40 PID 2740 wrote to memory of 2044 2740 hxnrp.exe 40 PID 2044 wrote to memory of 2736 2044 rvdxfvv.exe 41 PID 2044 wrote to memory of 2736 2044 rvdxfvv.exe 41 PID 2044 wrote to memory of 2736 2044 rvdxfvv.exe 41 PID 2044 wrote to memory of 2736 2044 rvdxfvv.exe 41 PID 2736 wrote to memory of 1196 2736 tbxfv.exe 42 PID 2736 wrote to memory of 1196 2736 tbxfv.exe 42 PID 2736 wrote to memory of 1196 2736 tbxfv.exe 42 PID 2736 wrote to memory of 1196 2736 tbxfv.exe 42 PID 1196 wrote to memory of 1504 1196 ntxpjj.exe 43 PID 1196 wrote to memory of 1504 1196 ntxpjj.exe 43 PID 1196 wrote to memory of 1504 1196 ntxpjj.exe 43 PID 1196 wrote to memory of 1504 1196 ntxpjj.exe 43 PID 1504 wrote to memory of 2576 1504 vnhvtn.exe 44 PID 1504 wrote to memory of 2576 1504 vnhvtn.exe 44 PID 1504 wrote to memory of 2576 1504 vnhvtn.exe 44 PID 1504 wrote to memory of 2576 1504 vnhvtn.exe 44 PID 2576 wrote to memory of 1636 2576 pjdbh.exe 45 PID 2576 wrote to memory of 1636 2576 pjdbh.exe 45 PID 2576 wrote to memory of 1636 2576 pjdbh.exe 45 PID 2576 wrote to memory of 1636 2576 pjdbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b98ab1d4238c550c514e0def72b1e6369d50e50fe1409a0a3426424251070d98N.exe"C:\Users\Admin\AppData\Local\Temp\b98ab1d4238c550c514e0def72b1e6369d50e50fe1409a0a3426424251070d98N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\hbvft.exec:\hbvft.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\hrvpr.exec:\hrvpr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\vfptdf.exec:\vfptdf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\tpphhrn.exec:\tpphhrn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\tpxrpx.exec:\tpxrpx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\rllfv.exec:\rllfv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\vpbrxlr.exec:\vpbrxlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\jxtxd.exec:\jxtxd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\ffjffd.exec:\ffjffd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\hxnrp.exec:\hxnrp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\rvdxfvv.exec:\rvdxfvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\tbxfv.exec:\tbxfv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\ntxpjj.exec:\ntxpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\vnhvtn.exec:\vnhvtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\pjdbh.exec:\pjdbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\fhpbbl.exec:\fhpbbl.exe17⤵
- Executes dropped EXE
PID:1636 -
\??\c:\ppdtntr.exec:\ppdtntr.exe18⤵
- Executes dropped EXE
PID:2016 -
\??\c:\bfffp.exec:\bfffp.exe19⤵
- Executes dropped EXE
PID:836 -
\??\c:\xttffx.exec:\xttffx.exe20⤵
- Executes dropped EXE
PID:612 -
\??\c:\rxtpjx.exec:\rxtpjx.exe21⤵
- Executes dropped EXE
PID:1696 -
\??\c:\jxhlxhn.exec:\jxhlxhn.exe22⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rfhpxr.exec:\rfhpxr.exe23⤵
- Executes dropped EXE
PID:1876 -
\??\c:\dpvvj.exec:\dpvvj.exe24⤵
- Executes dropped EXE
PID:3032 -
\??\c:\bfpnvf.exec:\bfpnvf.exe25⤵
- Executes dropped EXE
PID:1516 -
\??\c:\ldddxlt.exec:\ldddxlt.exe26⤵
- Executes dropped EXE
PID:1828 -
\??\c:\ttxbhv.exec:\ttxbhv.exe27⤵
- Executes dropped EXE
PID:2088 -
\??\c:\bpplxf.exec:\bpplxf.exe28⤵
- Executes dropped EXE
PID:1432 -
\??\c:\djjnrfj.exec:\djjnrfj.exe29⤵
- Executes dropped EXE
PID:1584 -
\??\c:\bhvtt.exec:\bhvtt.exe30⤵
- Executes dropped EXE
PID:1892 -
\??\c:\fdrtl.exec:\fdrtl.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2244 -
\??\c:\nvtppbf.exec:\nvtppbf.exe32⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jbtxht.exec:\jbtxht.exe33⤵
- Executes dropped EXE
PID:2524 -
\??\c:\lnplvf.exec:\lnplvf.exe34⤵
- Executes dropped EXE
PID:2080 -
\??\c:\frrtrbn.exec:\frrtrbn.exe35⤵
- Executes dropped EXE
PID:1760 -
\??\c:\hhddjh.exec:\hhddjh.exe36⤵
- Executes dropped EXE
PID:2372 -
\??\c:\drbjhp.exec:\drbjhp.exe37⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nvlnbhh.exec:\nvlnbhh.exe38⤵
- Executes dropped EXE
PID:3040 -
\??\c:\xdddr.exec:\xdddr.exe39⤵
- Executes dropped EXE
PID:584 -
\??\c:\pdbdn.exec:\pdbdn.exe40⤵
- Executes dropped EXE
PID:2892 -
\??\c:\fndtf.exec:\fndtf.exe41⤵
- Executes dropped EXE
PID:2512 -
\??\c:\bjxjpfp.exec:\bjxjpfp.exe42⤵
- Executes dropped EXE
PID:1264 -
\??\c:\vrjrhn.exec:\vrjrhn.exe43⤵
- Executes dropped EXE
PID:2908 -
\??\c:\nrtfv.exec:\nrtfv.exe44⤵
- Executes dropped EXE
PID:2848 -
\??\c:\lvppd.exec:\lvppd.exe45⤵
- Executes dropped EXE
PID:2688 -
\??\c:\hprbndh.exec:\hprbndh.exe46⤵
- Executes dropped EXE
PID:2204 -
\??\c:\dxplv.exec:\dxplv.exe47⤵
- Executes dropped EXE
PID:1960 -
\??\c:\ltppbbj.exec:\ltppbbj.exe48⤵
- Executes dropped EXE
PID:1144 -
\??\c:\bdjvxvv.exec:\bdjvxvv.exe49⤵
- Executes dropped EXE
PID:1200 -
\??\c:\dvpjfx.exec:\dvpjfx.exe50⤵
- Executes dropped EXE
PID:1880 -
\??\c:\prntdb.exec:\prntdb.exe51⤵
- Executes dropped EXE
PID:1888 -
\??\c:\rtvrp.exec:\rtvrp.exe52⤵
- Executes dropped EXE
PID:1504 -
\??\c:\rblpvrj.exec:\rblpvrj.exe53⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rbpbhr.exec:\rbpbhr.exe54⤵
- Executes dropped EXE
PID:1488 -
\??\c:\pvhxnxn.exec:\pvhxnxn.exe55⤵
- Executes dropped EXE
PID:1988 -
\??\c:\rjvjprd.exec:\rjvjprd.exe56⤵
- Executes dropped EXE
PID:3028 -
\??\c:\bxjlbhx.exec:\bxjlbhx.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2280 -
\??\c:\tpvtdjx.exec:\tpvtdjx.exe58⤵
- Executes dropped EXE
PID:2636 -
\??\c:\jphhddd.exec:\jphhddd.exe59⤵
- Executes dropped EXE
PID:112 -
\??\c:\jjprfh.exec:\jjprfh.exe60⤵
- Executes dropped EXE
PID:1380 -
\??\c:\nthtpbf.exec:\nthtpbf.exe61⤵
- Executes dropped EXE
PID:108 -
\??\c:\xhndhr.exec:\xhndhr.exe62⤵
- Executes dropped EXE
PID:1700 -
\??\c:\njbblp.exec:\njbblp.exe63⤵
- Executes dropped EXE
PID:1788 -
\??\c:\fxrpxdx.exec:\fxrpxdx.exe64⤵
- Executes dropped EXE
PID:1616 -
\??\c:\rpdntn.exec:\rpdntn.exe65⤵
- Executes dropped EXE
PID:1036 -
\??\c:\hbdnp.exec:\hbdnp.exe66⤵PID:1732
-
\??\c:\xblhv.exec:\xblhv.exe67⤵PID:1556
-
\??\c:\hvltnhx.exec:\hvltnhx.exe68⤵PID:2564
-
\??\c:\lttlvh.exec:\lttlvh.exe69⤵PID:820
-
\??\c:\tpfprn.exec:\tpfprn.exe70⤵PID:2468
-
\??\c:\jpnrd.exec:\jpnrd.exe71⤵PID:2336
-
\??\c:\xnfvdh.exec:\xnfvdh.exe72⤵PID:2624
-
\??\c:\jhfnpv.exec:\jhfnpv.exe73⤵PID:2308
-
\??\c:\xjnvjpl.exec:\xjnvjpl.exe74⤵PID:1576
-
\??\c:\pvthd.exec:\pvthd.exe75⤵PID:1592
-
\??\c:\fdvbj.exec:\fdvbj.exe76⤵PID:2076
-
\??\c:\fhpxrj.exec:\fhpxrj.exe77⤵PID:2104
-
\??\c:\pvhrv.exec:\pvhrv.exe78⤵PID:2756
-
\??\c:\xlbpn.exec:\xlbpn.exe79⤵PID:1384
-
\??\c:\jtdpn.exec:\jtdpn.exe80⤵PID:1692
-
\??\c:\xtrdf.exec:\xtrdf.exe81⤵PID:2888
-
\??\c:\dnhtvrj.exec:\dnhtvrj.exe82⤵PID:2892
-
\??\c:\htnffxr.exec:\htnffxr.exe83⤵PID:2684
-
\??\c:\pjbvjt.exec:\pjbvjt.exe84⤵PID:1528
-
\??\c:\lhxfxl.exec:\lhxfxl.exe85⤵
- System Location Discovery: System Language Discovery
PID:2716 -
\??\c:\pxvhx.exec:\pxvhx.exe86⤵PID:2676
-
\??\c:\tntdxf.exec:\tntdxf.exe87⤵PID:1904
-
\??\c:\nprxrl.exec:\nprxrl.exe88⤵
- System Location Discovery: System Language Discovery
PID:2740 -
\??\c:\xlnjtl.exec:\xlnjtl.exe89⤵PID:2496
-
\??\c:\ntflnnx.exec:\ntflnnx.exe90⤵PID:2656
-
\??\c:\pblvh.exec:\pblvh.exe91⤵PID:2736
-
\??\c:\vlfvpfb.exec:\vlfvpfb.exe92⤵PID:1196
-
\??\c:\htlxrvx.exec:\htlxrvx.exe93⤵PID:2368
-
\??\c:\hxxjrdx.exec:\hxxjrdx.exe94⤵PID:1128
-
\??\c:\vhtrpr.exec:\vhtrpr.exe95⤵PID:1996
-
\??\c:\nrxpvr.exec:\nrxpvr.exe96⤵PID:1992
-
\??\c:\tbxdnv.exec:\tbxdnv.exe97⤵PID:3012
-
\??\c:\pnphr.exec:\pnphr.exe98⤵PID:2976
-
\??\c:\rphjlh.exec:\rphjlh.exe99⤵PID:2416
-
\??\c:\bnfltbt.exec:\bnfltbt.exe100⤵PID:2100
-
\??\c:\rldvhx.exec:\rldvhx.exe101⤵PID:2636
-
\??\c:\npvvfpx.exec:\npvvfpx.exe102⤵PID:676
-
\??\c:\xhnlv.exec:\xhnlv.exe103⤵PID:776
-
\??\c:\fxpnp.exec:\fxpnp.exe104⤵PID:1352
-
\??\c:\brfln.exec:\brfln.exe105⤵PID:2992
-
\??\c:\tdftrbr.exec:\tdftrbr.exe106⤵PID:2652
-
\??\c:\dfhdnp.exec:\dfhdnp.exe107⤵PID:968
-
\??\c:\fjtbpn.exec:\fjtbpn.exe108⤵PID:964
-
\??\c:\llhvx.exec:\llhvx.exe109⤵PID:1732
-
\??\c:\vhhblj.exec:\vhhblj.exe110⤵PID:1088
-
\??\c:\vlfbnlh.exec:\vlfbnlh.exe111⤵PID:2564
-
\??\c:\xxdhvb.exec:\xxdhvb.exe112⤵PID:264
-
\??\c:\ntpjbb.exec:\ntpjbb.exe113⤵PID:2516
-
\??\c:\rbbllv.exec:\rbbllv.exe114⤵PID:1524
-
\??\c:\dhfddp.exec:\dhfddp.exe115⤵PID:1724
-
\??\c:\hvnrvh.exec:\hvnrvh.exe116⤵PID:2324
-
\??\c:\fndxpt.exec:\fndxpt.exe117⤵PID:2492
-
\??\c:\xdrtd.exec:\xdrtd.exe118⤵PID:2080
-
\??\c:\lbjdhft.exec:\lbjdhft.exe119⤵PID:2584
-
\??\c:\vhxphx.exec:\vhxphx.exe120⤵PID:1708
-
\??\c:\rrphdd.exec:\rrphdd.exe121⤵PID:536
-
\??\c:\plntdhv.exec:\plntdhv.exe122⤵PID:2068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-