Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 16:21
Static task
static1
Behavioral task
behavioral1
Sample
45329048c83aaabf853c8536315f5f77f84e419f6d70387e926a7440def8baebN.exe
Resource
win7-20241010-en
General
-
Target
45329048c83aaabf853c8536315f5f77f84e419f6d70387e926a7440def8baebN.exe
-
Size
453KB
-
MD5
559114a8d7608c85d756a0fd74a03300
-
SHA1
d5f65f8285b083aeaf48eda36a14f8c399a029b4
-
SHA256
45329048c83aaabf853c8536315f5f77f84e419f6d70387e926a7440def8baeb
-
SHA512
3260359e28badee6ee74ecb111cd69307912051e6ae4359fdd43632ed9a6c81cd4af2fc1a00512b2560748855108fb09e45557d6da9d5e388602a79dca804e2e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/844-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/700-156-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1216-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-247-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/536-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-267-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/584-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-285-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2700-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-367-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2612-385-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2912-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-434-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2408-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-559-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1912-586-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2800-611-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2728-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-716-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-720-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1688-736-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/236-832-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2684 fjpvvh.exe 2784 bbvtdx.exe 2744 vdlxp.exe 2716 hpfln.exe 2820 xxflh.exe 2644 rrpbpn.exe 2824 rjjvjxh.exe 1364 lnfxx.exe 1672 tdxdf.exe 2948 hnnbfhn.exe 772 njxtjlh.exe 2944 hpxfrb.exe 2396 tjvtfr.exe 1796 vjlfpn.exe 3036 fphtlh.exe 700 hrnjd.exe 524 hbbbld.exe 1216 rbvbp.exe 1412 tlvbtv.exe 2104 xpthxj.exe 2100 xdxbb.exe 2176 jntdjv.exe 2480 nbfjpr.exe 2028 xxthx.exe 2004 thrll.exe 1940 pfnnnp.exe 536 rpjrvt.exe 1604 ptttrxd.exe 1484 ltxplh.exe 584 hhvbtl.exe 1152 hbbndr.exe 2224 rfnxvn.exe 2516 jrfnl.exe 2700 lhvdn.exe 2200 dhldr.exe 1916 pvhltxx.exe 2792 dddpl.exe 2832 xhjblf.exe 2752 jfdntdt.exe 2704 dlpph.exe 2612 lxvxl.exe 2560 hltrv.exe 3068 hjbbd.exe 684 fvxtlh.exe 2168 hbptd.exe 1672 hpdxrbf.exe 2924 hfptfvx.exe 552 ljthn.exe 2912 pfltp.exe 876 hnllr.exe 860 xdxhpfv.exe 2408 hvftfp.exe 1572 bnplh.exe 320 nvhjj.exe 700 nnvdv.exe 2468 xtrtht.exe 1384 xhpnlf.exe 2128 btvnfjv.exe 1360 bltvf.exe 1808 fjfprjx.exe 944 bhdntn.exe 1276 hpfrffl.exe 1712 nhbxb.exe 1852 jbjphlj.exe -
resource yara_rule behavioral1/memory/844-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-720-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/1688-736-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/236-806-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-845-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-858-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tndjhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfndbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnxth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llnrfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvjhjdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdvpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlrlbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpntvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnddnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbhff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brprht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxphhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbnhnxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrpbpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhvbtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnthhnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdtbtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfnnnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhjblf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvxtdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvdfpjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhfjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhfpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxbhhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfhrvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llthxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnvtxdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fphtlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbtfrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltvdpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhbtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdrbjhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbdntnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jnbtvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxjttx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddrvbdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvndd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtxrhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpljfdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhdntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpxptxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjlvph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdprh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fptrbjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrtjxxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlhjtfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lppnjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 844 wrote to memory of 2684 844 45329048c83aaabf853c8536315f5f77f84e419f6d70387e926a7440def8baebN.exe 30 PID 844 wrote to memory of 2684 844 45329048c83aaabf853c8536315f5f77f84e419f6d70387e926a7440def8baebN.exe 30 PID 844 wrote to memory of 2684 844 45329048c83aaabf853c8536315f5f77f84e419f6d70387e926a7440def8baebN.exe 30 PID 844 wrote to memory of 2684 844 45329048c83aaabf853c8536315f5f77f84e419f6d70387e926a7440def8baebN.exe 30 PID 2684 wrote to memory of 2784 2684 fjpvvh.exe 31 PID 2684 wrote to memory of 2784 2684 fjpvvh.exe 31 PID 2684 wrote to memory of 2784 2684 fjpvvh.exe 31 PID 2684 wrote to memory of 2784 2684 fjpvvh.exe 31 PID 2784 wrote to memory of 2744 2784 bbvtdx.exe 32 PID 2784 wrote to memory of 2744 2784 bbvtdx.exe 32 PID 2784 wrote to memory of 2744 2784 bbvtdx.exe 32 PID 2784 wrote to memory of 2744 2784 bbvtdx.exe 32 PID 2744 wrote to memory of 2716 2744 vdlxp.exe 33 PID 2744 wrote to memory of 2716 2744 vdlxp.exe 33 PID 2744 wrote to memory of 2716 2744 vdlxp.exe 33 PID 2744 wrote to memory of 2716 2744 vdlxp.exe 33 PID 2716 wrote to memory of 2820 2716 hpfln.exe 34 PID 2716 wrote to memory of 2820 2716 hpfln.exe 34 PID 2716 wrote to memory of 2820 2716 hpfln.exe 34 PID 2716 wrote to memory of 2820 2716 hpfln.exe 34 PID 2820 wrote to memory of 2644 2820 xxflh.exe 35 PID 2820 wrote to memory of 2644 2820 xxflh.exe 35 PID 2820 wrote to memory of 2644 2820 xxflh.exe 35 PID 2820 wrote to memory of 2644 2820 xxflh.exe 35 PID 2644 wrote to memory of 2824 2644 rrpbpn.exe 36 PID 2644 wrote to memory of 2824 2644 rrpbpn.exe 36 PID 2644 wrote to memory of 2824 2644 rrpbpn.exe 36 PID 2644 wrote to memory of 2824 2644 rrpbpn.exe 36 PID 2824 wrote to memory of 1364 2824 rjjvjxh.exe 37 PID 2824 wrote to memory of 1364 2824 rjjvjxh.exe 37 PID 2824 wrote to memory of 1364 2824 rjjvjxh.exe 37 PID 2824 wrote to memory of 1364 2824 rjjvjxh.exe 37 PID 1364 wrote to memory of 1672 1364 lnfxx.exe 38 PID 1364 wrote to memory of 1672 1364 lnfxx.exe 38 PID 1364 wrote to memory of 1672 1364 lnfxx.exe 38 PID 1364 wrote to memory of 1672 1364 lnfxx.exe 38 PID 1672 wrote to memory of 2948 1672 tdxdf.exe 39 PID 1672 wrote to memory of 2948 1672 tdxdf.exe 39 PID 1672 wrote to memory of 2948 1672 tdxdf.exe 39 PID 1672 wrote to memory of 2948 1672 tdxdf.exe 39 PID 2948 wrote to memory of 772 2948 hnnbfhn.exe 40 PID 2948 wrote to memory of 772 2948 hnnbfhn.exe 40 PID 2948 wrote to memory of 772 2948 hnnbfhn.exe 40 PID 2948 wrote to memory of 772 2948 hnnbfhn.exe 40 PID 772 wrote to memory of 2944 772 njxtjlh.exe 41 PID 772 wrote to memory of 2944 772 njxtjlh.exe 41 PID 772 wrote to memory of 2944 772 njxtjlh.exe 41 PID 772 wrote to memory of 2944 772 njxtjlh.exe 41 PID 2944 wrote to memory of 2396 2944 hpxfrb.exe 42 PID 2944 wrote to memory of 2396 2944 hpxfrb.exe 42 PID 2944 wrote to memory of 2396 2944 hpxfrb.exe 42 PID 2944 wrote to memory of 2396 2944 hpxfrb.exe 42 PID 2396 wrote to memory of 1796 2396 tjvtfr.exe 43 PID 2396 wrote to memory of 1796 2396 tjvtfr.exe 43 PID 2396 wrote to memory of 1796 2396 tjvtfr.exe 43 PID 2396 wrote to memory of 1796 2396 tjvtfr.exe 43 PID 1796 wrote to memory of 3036 1796 vjlfpn.exe 44 PID 1796 wrote to memory of 3036 1796 vjlfpn.exe 44 PID 1796 wrote to memory of 3036 1796 vjlfpn.exe 44 PID 1796 wrote to memory of 3036 1796 vjlfpn.exe 44 PID 3036 wrote to memory of 700 3036 fphtlh.exe 45 PID 3036 wrote to memory of 700 3036 fphtlh.exe 45 PID 3036 wrote to memory of 700 3036 fphtlh.exe 45 PID 3036 wrote to memory of 700 3036 fphtlh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\45329048c83aaabf853c8536315f5f77f84e419f6d70387e926a7440def8baebN.exe"C:\Users\Admin\AppData\Local\Temp\45329048c83aaabf853c8536315f5f77f84e419f6d70387e926a7440def8baebN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\fjpvvh.exec:\fjpvvh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\bbvtdx.exec:\bbvtdx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\vdlxp.exec:\vdlxp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\hpfln.exec:\hpfln.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\xxflh.exec:\xxflh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\rrpbpn.exec:\rrpbpn.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\rjjvjxh.exec:\rjjvjxh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\lnfxx.exec:\lnfxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\tdxdf.exec:\tdxdf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\hnnbfhn.exec:\hnnbfhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\njxtjlh.exec:\njxtjlh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\hpxfrb.exec:\hpxfrb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\tjvtfr.exec:\tjvtfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\vjlfpn.exec:\vjlfpn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\fphtlh.exec:\fphtlh.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\hrnjd.exec:\hrnjd.exe17⤵
- Executes dropped EXE
PID:700 -
\??\c:\hbbbld.exec:\hbbbld.exe18⤵
- Executes dropped EXE
PID:524 -
\??\c:\rbvbp.exec:\rbvbp.exe19⤵
- Executes dropped EXE
PID:1216 -
\??\c:\tlvbtv.exec:\tlvbtv.exe20⤵
- Executes dropped EXE
PID:1412 -
\??\c:\xpthxj.exec:\xpthxj.exe21⤵
- Executes dropped EXE
PID:2104 -
\??\c:\xdxbb.exec:\xdxbb.exe22⤵
- Executes dropped EXE
PID:2100 -
\??\c:\jntdjv.exec:\jntdjv.exe23⤵
- Executes dropped EXE
PID:2176 -
\??\c:\nbfjpr.exec:\nbfjpr.exe24⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xxthx.exec:\xxthx.exe25⤵
- Executes dropped EXE
PID:2028 -
\??\c:\thrll.exec:\thrll.exe26⤵
- Executes dropped EXE
PID:2004 -
\??\c:\pfnnnp.exec:\pfnnnp.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1940 -
\??\c:\rpjrvt.exec:\rpjrvt.exe28⤵
- Executes dropped EXE
PID:536 -
\??\c:\ptttrxd.exec:\ptttrxd.exe29⤵
- Executes dropped EXE
PID:1604 -
\??\c:\ltxplh.exec:\ltxplh.exe30⤵
- Executes dropped EXE
PID:1484 -
\??\c:\hhvbtl.exec:\hhvbtl.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:584 -
\??\c:\hbbndr.exec:\hbbndr.exe32⤵
- Executes dropped EXE
PID:1152 -
\??\c:\rfnxvn.exec:\rfnxvn.exe33⤵
- Executes dropped EXE
PID:2224 -
\??\c:\jrfnl.exec:\jrfnl.exe34⤵
- Executes dropped EXE
PID:2516 -
\??\c:\lhvdn.exec:\lhvdn.exe35⤵
- Executes dropped EXE
PID:2700 -
\??\c:\dhldr.exec:\dhldr.exe36⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pvhltxx.exec:\pvhltxx.exe37⤵
- Executes dropped EXE
PID:1916 -
\??\c:\dddpl.exec:\dddpl.exe38⤵
- Executes dropped EXE
PID:2792 -
\??\c:\xhjblf.exec:\xhjblf.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2832 -
\??\c:\jfdntdt.exec:\jfdntdt.exe40⤵
- Executes dropped EXE
PID:2752 -
\??\c:\dlpph.exec:\dlpph.exe41⤵
- Executes dropped EXE
PID:2704 -
\??\c:\lxvxl.exec:\lxvxl.exe42⤵
- Executes dropped EXE
PID:2612 -
\??\c:\hltrv.exec:\hltrv.exe43⤵
- Executes dropped EXE
PID:2560 -
\??\c:\hjbbd.exec:\hjbbd.exe44⤵
- Executes dropped EXE
PID:3068 -
\??\c:\fvxtlh.exec:\fvxtlh.exe45⤵
- Executes dropped EXE
PID:684 -
\??\c:\hbptd.exec:\hbptd.exe46⤵
- Executes dropped EXE
PID:2168 -
\??\c:\hpdxrbf.exec:\hpdxrbf.exe47⤵
- Executes dropped EXE
PID:1672 -
\??\c:\hfptfvx.exec:\hfptfvx.exe48⤵
- Executes dropped EXE
PID:2924 -
\??\c:\ljthn.exec:\ljthn.exe49⤵
- Executes dropped EXE
PID:552 -
\??\c:\pfltp.exec:\pfltp.exe50⤵
- Executes dropped EXE
PID:2912 -
\??\c:\hnllr.exec:\hnllr.exe51⤵
- Executes dropped EXE
PID:876 -
\??\c:\xdxhpfv.exec:\xdxhpfv.exe52⤵
- Executes dropped EXE
PID:860 -
\??\c:\hvftfp.exec:\hvftfp.exe53⤵
- Executes dropped EXE
PID:2408 -
\??\c:\bnplh.exec:\bnplh.exe54⤵
- Executes dropped EXE
PID:1572 -
\??\c:\nvhjj.exec:\nvhjj.exe55⤵
- Executes dropped EXE
PID:320 -
\??\c:\nnvdv.exec:\nnvdv.exe56⤵
- Executes dropped EXE
PID:700 -
\??\c:\xtrtht.exec:\xtrtht.exe57⤵
- Executes dropped EXE
PID:2468 -
\??\c:\xhpnlf.exec:\xhpnlf.exe58⤵
- Executes dropped EXE
PID:1384 -
\??\c:\btvnfjv.exec:\btvnfjv.exe59⤵
- Executes dropped EXE
PID:2128 -
\??\c:\bltvf.exec:\bltvf.exe60⤵
- Executes dropped EXE
PID:1360 -
\??\c:\fjfprjx.exec:\fjfprjx.exe61⤵
- Executes dropped EXE
PID:1808 -
\??\c:\bhdntn.exec:\bhdntn.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:944 -
\??\c:\hpfrffl.exec:\hpfrffl.exe63⤵
- Executes dropped EXE
PID:1276 -
\??\c:\nhbxb.exec:\nhbxb.exe64⤵
- Executes dropped EXE
PID:1712 -
\??\c:\jbjphlj.exec:\jbjphlj.exe65⤵
- Executes dropped EXE
PID:1852 -
\??\c:\tffdxjl.exec:\tffdxjl.exe66⤵PID:1700
-
\??\c:\fppjd.exec:\fppjd.exe67⤵PID:2076
-
\??\c:\bblxh.exec:\bblxh.exe68⤵PID:1804
-
\??\c:\dphlbvf.exec:\dphlbvf.exe69⤵PID:1716
-
\??\c:\xlfbjt.exec:\xlfbjt.exe70⤵PID:536
-
\??\c:\tppdxvh.exec:\tppdxvh.exe71⤵PID:2064
-
\??\c:\vrvrdf.exec:\vrvrdf.exe72⤵PID:1612
-
\??\c:\dlxpr.exec:\dlxpr.exe73⤵PID:1188
-
\??\c:\npphlh.exec:\npphlh.exe74⤵PID:1556
-
\??\c:\lvtblfn.exec:\lvtblfn.exe75⤵PID:1912
-
\??\c:\vhlhxtx.exec:\vhlhxtx.exe76⤵PID:1512
-
\??\c:\phtfhdx.exec:\phtfhdx.exe77⤵PID:2544
-
\??\c:\llfjn.exec:\llfjn.exe78⤵PID:844
-
\??\c:\tdlhnb.exec:\tdlhnb.exe79⤵PID:2800
-
\??\c:\pvjndv.exec:\pvjndv.exe80⤵PID:948
-
\??\c:\drlrl.exec:\drlrl.exe81⤵PID:2864
-
\??\c:\pbhfpx.exec:\pbhfpx.exe82⤵PID:2856
-
\??\c:\pxvff.exec:\pxvff.exe83⤵PID:2848
-
\??\c:\xnhhpf.exec:\xnhhpf.exe84⤵PID:2728
-
\??\c:\xfrxv.exec:\xfrxv.exe85⤵PID:2828
-
\??\c:\vhdtjf.exec:\vhdtjf.exe86⤵PID:2664
-
\??\c:\vblpxb.exec:\vblpxb.exe87⤵PID:3052
-
\??\c:\nfplfb.exec:\nfplfb.exe88⤵PID:2572
-
\??\c:\jhhlb.exec:\jhhlb.exe89⤵PID:3068
-
\??\c:\nbnnxnn.exec:\nbnnxnn.exe90⤵PID:1364
-
\??\c:\djpbtj.exec:\djpbtj.exe91⤵PID:1988
-
\??\c:\xfthf.exec:\xfthf.exe92⤵PID:2892
-
\??\c:\hphdhpn.exec:\hphdhpn.exe93⤵PID:2936
-
\??\c:\npxrhl.exec:\npxrhl.exe94⤵PID:1764
-
\??\c:\ddppd.exec:\ddppd.exe95⤵PID:2132
-
\??\c:\tbdjnv.exec:\tbdjnv.exe96⤵PID:1380
-
\??\c:\fvfrf.exec:\fvfrf.exe97⤵PID:2184
-
\??\c:\ldvlrb.exec:\ldvlrb.exe98⤵PID:1688
-
\??\c:\lljtnrr.exec:\lljtnrr.exe99⤵PID:812
-
\??\c:\hfvpvb.exec:\hfvpvb.exe100⤵PID:320
-
\??\c:\rhhxp.exec:\rhhxp.exe101⤵PID:700
-
\??\c:\pldrd.exec:\pldrd.exe102⤵PID:2468
-
\??\c:\xhftb.exec:\xhftb.exe103⤵PID:3020
-
\??\c:\hjhprtj.exec:\hjhprtj.exe104⤵PID:2128
-
\??\c:\fbnplfj.exec:\fbnplfj.exe105⤵PID:2440
-
\??\c:\xbvljlf.exec:\xbvljlf.exe106⤵PID:1808
-
\??\c:\hxhlv.exec:\hxhlv.exe107⤵PID:1704
-
\??\c:\nhhnh.exec:\nhhnh.exe108⤵PID:1288
-
\??\c:\xdvdvpb.exec:\xdvdvpb.exe109⤵PID:1136
-
\??\c:\nvrvhbp.exec:\nvrvhbp.exe110⤵PID:236
-
\??\c:\prnllpp.exec:\prnllpp.exe111⤵PID:1700
-
\??\c:\bxfnbjp.exec:\bxfnbjp.exe112⤵PID:1292
-
\??\c:\dhjtpjb.exec:\dhjtpjb.exe113⤵PID:1848
-
\??\c:\rbjnbnx.exec:\rbjnbnx.exe114⤵PID:1404
-
\??\c:\bfbjn.exec:\bfbjn.exe115⤵PID:2040
-
\??\c:\rpnfrd.exec:\rpnfrd.exe116⤵PID:1616
-
\??\c:\bbffblp.exec:\bbffblp.exe117⤵PID:2456
-
\??\c:\lfppr.exec:\lfppr.exe118⤵PID:2504
-
\??\c:\nthfblr.exec:\nthfblr.exe119⤵PID:2060
-
\??\c:\fbxdbnj.exec:\fbxdbnj.exe120⤵PID:880
-
\??\c:\bfdxlvr.exec:\bfdxlvr.exe121⤵PID:2772
-
\??\c:\xbrppjp.exec:\xbrppjp.exe122⤵PID:2000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-