Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 00:26
Static task
static1
Behavioral task
behavioral1
Sample
158b0359b582b072c072ad357f1c70581118670de826897a5d5f46041b2094a4.exe
Resource
win7-20241010-en
General
-
Target
158b0359b582b072c072ad357f1c70581118670de826897a5d5f46041b2094a4.exe
-
Size
453KB
-
MD5
1744fd1a4552cca6be0ca192754652a4
-
SHA1
8d55a97e4cb69a2d126c8a5b1f43e43304e39e0a
-
SHA256
158b0359b582b072c072ad357f1c70581118670de826897a5d5f46041b2094a4
-
SHA512
1ad89f3251166a13c3b7af147669886bd35c85e31e1eb6f30a303ab0ece86645d7756a1c9a712529747cc438e62e9da62c02d4a7e2805470525fbfed11bf9bed
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1:q7Tc2NYHUrAwfMp3CD1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2108-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/868-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-75-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3020-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1460-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-148-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2100-166-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1728-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/928-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-299-0x0000000077170000-0x000000007726A000-memory.dmp family_blackmoon behavioral1/memory/1344-298-0x0000000077050000-0x000000007716F000-memory.dmp family_blackmoon behavioral1/memory/1116-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-334-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2748-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-451-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2084-465-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2084-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/640-496-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2448-612-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2448-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-614-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2036-622-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2764-629-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1648-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-677-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/840-759-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1540-817-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2108 bjdvnj.exe 2532 rfnjfdr.exe 1988 dfbhfnj.exe 868 ndhljb.exe 2888 nljpjpt.exe 2628 fhvdx.exe 3020 bfhfbxj.exe 2640 rhdntj.exe 2464 rrrnd.exe 1312 hpfnnbj.exe 2832 pfnrvb.exe 340 dlrlr.exe 2860 xbbvvpn.exe 1152 lfbbptp.exe 1920 xtpjjrd.exe 1460 pnlrh.exe 2100 vnbvlth.exe 840 lnpvj.exe 1728 lvtxxv.exe 2252 jtxrnj.exe 1064 rfdhfxx.exe 928 dhnjrf.exe 1704 ddtlb.exe 2424 nnpbhh.exe 1744 rxpfljb.exe 1788 npxhlt.exe 2044 bljntr.exe 2704 frxdnp.exe 1528 rjfhntv.exe 2500 vxdpdv.exe 2584 xlhxx.exe 1344 fnbxhvv.exe 2236 ldbpttp.exe 1116 pfpnxv.exe 2548 tlxbbn.exe 2456 prrxhdh.exe 2748 thplnf.exe 2936 bjrdf.exe 2888 tfrbn.exe 2164 rttbv.exe 2052 trlvnv.exe 2672 dxbrjx.exe 2664 rvtlp.exe 2080 jdfdfj.exe 1692 fhtbrrp.exe 3000 tltrxd.exe 1136 bxvfxlf.exe 2836 btjdrvf.exe 740 jvljnbx.exe 2820 thptnbx.exe 560 llrrjl.exe 1920 nnpfjh.exe 2384 bbhlb.exe 2808 jbdrtjr.exe 1044 thlrxbp.exe 2084 hjdhxtd.exe 2288 lvbtv.exe 1156 bjpbdr.exe 3060 fxpdrnp.exe 640 vdrbdj.exe 972 rdhdfr.exe 1704 dhrtbpl.exe 612 ptfnpnr.exe 896 rhjll.exe -
resource yara_rule behavioral1/memory/2316-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/928-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/740-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-612-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/2448-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-746-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhvtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvlvtvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvrxjlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vprxpfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhlrndx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhbrdfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfxtdlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blbjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpvlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddhpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtpjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdhflt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dphplvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtrvnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxdfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlrjjnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frntbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjbfxxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjfbpph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdbhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hplhbnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhdvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trlxvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddbhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rblthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xprldjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhthdbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdbfth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txfpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhnbld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbrhfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jplrtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjnhtdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phvxnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2108 2316 158b0359b582b072c072ad357f1c70581118670de826897a5d5f46041b2094a4.exe 30 PID 2316 wrote to memory of 2108 2316 158b0359b582b072c072ad357f1c70581118670de826897a5d5f46041b2094a4.exe 30 PID 2316 wrote to memory of 2108 2316 158b0359b582b072c072ad357f1c70581118670de826897a5d5f46041b2094a4.exe 30 PID 2316 wrote to memory of 2108 2316 158b0359b582b072c072ad357f1c70581118670de826897a5d5f46041b2094a4.exe 30 PID 2108 wrote to memory of 2532 2108 bjdvnj.exe 31 PID 2108 wrote to memory of 2532 2108 bjdvnj.exe 31 PID 2108 wrote to memory of 2532 2108 bjdvnj.exe 31 PID 2108 wrote to memory of 2532 2108 bjdvnj.exe 31 PID 2532 wrote to memory of 1988 2532 rfnjfdr.exe 32 PID 2532 wrote to memory of 1988 2532 rfnjfdr.exe 32 PID 2532 wrote to memory of 1988 2532 rfnjfdr.exe 32 PID 2532 wrote to memory of 1988 2532 rfnjfdr.exe 32 PID 1988 wrote to memory of 868 1988 dfbhfnj.exe 33 PID 1988 wrote to memory of 868 1988 dfbhfnj.exe 33 PID 1988 wrote to memory of 868 1988 dfbhfnj.exe 33 PID 1988 wrote to memory of 868 1988 dfbhfnj.exe 33 PID 868 wrote to memory of 2888 868 ndhljb.exe 34 PID 868 wrote to memory of 2888 868 ndhljb.exe 34 PID 868 wrote to memory of 2888 868 ndhljb.exe 34 PID 868 wrote to memory of 2888 868 ndhljb.exe 34 PID 2888 wrote to memory of 2628 2888 nljpjpt.exe 36 PID 2888 wrote to memory of 2628 2888 nljpjpt.exe 36 PID 2888 wrote to memory of 2628 2888 nljpjpt.exe 36 PID 2888 wrote to memory of 2628 2888 nljpjpt.exe 36 PID 2628 wrote to memory of 3020 2628 fhvdx.exe 37 PID 2628 wrote to memory of 3020 2628 fhvdx.exe 37 PID 2628 wrote to memory of 3020 2628 fhvdx.exe 37 PID 2628 wrote to memory of 3020 2628 fhvdx.exe 37 PID 3020 wrote to memory of 2640 3020 bfhfbxj.exe 38 PID 3020 wrote to memory of 2640 3020 bfhfbxj.exe 38 PID 3020 wrote to memory of 2640 3020 bfhfbxj.exe 38 PID 3020 wrote to memory of 2640 3020 bfhfbxj.exe 38 PID 2640 wrote to memory of 2464 2640 rhdntj.exe 39 PID 2640 wrote to memory of 2464 2640 rhdntj.exe 39 PID 2640 wrote to memory of 2464 2640 rhdntj.exe 39 PID 2640 wrote to memory of 2464 2640 rhdntj.exe 39 PID 2464 wrote to memory of 1312 2464 rrrnd.exe 40 PID 2464 wrote to memory of 1312 2464 rrrnd.exe 40 PID 2464 wrote to memory of 1312 2464 rrrnd.exe 40 PID 2464 wrote to memory of 1312 2464 rrrnd.exe 40 PID 1312 wrote to memory of 2832 1312 hpfnnbj.exe 41 PID 1312 wrote to memory of 2832 1312 hpfnnbj.exe 41 PID 1312 wrote to memory of 2832 1312 hpfnnbj.exe 41 PID 1312 wrote to memory of 2832 1312 hpfnnbj.exe 41 PID 2832 wrote to memory of 340 2832 pfnrvb.exe 42 PID 2832 wrote to memory of 340 2832 pfnrvb.exe 42 PID 2832 wrote to memory of 340 2832 pfnrvb.exe 42 PID 2832 wrote to memory of 340 2832 pfnrvb.exe 42 PID 340 wrote to memory of 2860 340 dlrlr.exe 43 PID 340 wrote to memory of 2860 340 dlrlr.exe 43 PID 340 wrote to memory of 2860 340 dlrlr.exe 43 PID 340 wrote to memory of 2860 340 dlrlr.exe 43 PID 2860 wrote to memory of 1152 2860 xbbvvpn.exe 44 PID 2860 wrote to memory of 1152 2860 xbbvvpn.exe 44 PID 2860 wrote to memory of 1152 2860 xbbvvpn.exe 44 PID 2860 wrote to memory of 1152 2860 xbbvvpn.exe 44 PID 1152 wrote to memory of 1920 1152 lfbbptp.exe 45 PID 1152 wrote to memory of 1920 1152 lfbbptp.exe 45 PID 1152 wrote to memory of 1920 1152 lfbbptp.exe 45 PID 1152 wrote to memory of 1920 1152 lfbbptp.exe 45 PID 1920 wrote to memory of 1460 1920 xtpjjrd.exe 46 PID 1920 wrote to memory of 1460 1920 xtpjjrd.exe 46 PID 1920 wrote to memory of 1460 1920 xtpjjrd.exe 46 PID 1920 wrote to memory of 1460 1920 xtpjjrd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\158b0359b582b072c072ad357f1c70581118670de826897a5d5f46041b2094a4.exe"C:\Users\Admin\AppData\Local\Temp\158b0359b582b072c072ad357f1c70581118670de826897a5d5f46041b2094a4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\bjdvnj.exec:\bjdvnj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\rfnjfdr.exec:\rfnjfdr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\dfbhfnj.exec:\dfbhfnj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\ndhljb.exec:\ndhljb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\nljpjpt.exec:\nljpjpt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\fhvdx.exec:\fhvdx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\bfhfbxj.exec:\bfhfbxj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\rhdntj.exec:\rhdntj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\rrrnd.exec:\rrrnd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\hpfnnbj.exec:\hpfnnbj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\pfnrvb.exec:\pfnrvb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\dlrlr.exec:\dlrlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
\??\c:\xbbvvpn.exec:\xbbvvpn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\lfbbptp.exec:\lfbbptp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\xtpjjrd.exec:\xtpjjrd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\pnlrh.exec:\pnlrh.exe17⤵
- Executes dropped EXE
PID:1460 -
\??\c:\vnbvlth.exec:\vnbvlth.exe18⤵
- Executes dropped EXE
PID:2100 -
\??\c:\lnpvj.exec:\lnpvj.exe19⤵
- Executes dropped EXE
PID:840 -
\??\c:\lvtxxv.exec:\lvtxxv.exe20⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jtxrnj.exec:\jtxrnj.exe21⤵
- Executes dropped EXE
PID:2252 -
\??\c:\rfdhfxx.exec:\rfdhfxx.exe22⤵
- Executes dropped EXE
PID:1064 -
\??\c:\dhnjrf.exec:\dhnjrf.exe23⤵
- Executes dropped EXE
PID:928 -
\??\c:\ddtlb.exec:\ddtlb.exe24⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nnpbhh.exec:\nnpbhh.exe25⤵
- Executes dropped EXE
PID:2424 -
\??\c:\rxpfljb.exec:\rxpfljb.exe26⤵
- Executes dropped EXE
PID:1744 -
\??\c:\npxhlt.exec:\npxhlt.exe27⤵
- Executes dropped EXE
PID:1788 -
\??\c:\bljntr.exec:\bljntr.exe28⤵
- Executes dropped EXE
PID:2044 -
\??\c:\frxdnp.exec:\frxdnp.exe29⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rjfhntv.exec:\rjfhntv.exe30⤵
- Executes dropped EXE
PID:1528 -
\??\c:\vxdpdv.exec:\vxdpdv.exe31⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xlhxx.exec:\xlhxx.exe32⤵
- Executes dropped EXE
PID:2584 -
\??\c:\fnbxhvv.exec:\fnbxhvv.exe33⤵
- Executes dropped EXE
PID:1344 -
\??\c:\hxdtvf.exec:\hxdtvf.exe34⤵PID:1592
-
\??\c:\ldbpttp.exec:\ldbpttp.exe35⤵
- Executes dropped EXE
PID:2236 -
\??\c:\pfpnxv.exec:\pfpnxv.exe36⤵
- Executes dropped EXE
PID:1116 -
\??\c:\tlxbbn.exec:\tlxbbn.exe37⤵
- Executes dropped EXE
PID:2548 -
\??\c:\prrxhdh.exec:\prrxhdh.exe38⤵
- Executes dropped EXE
PID:2456 -
\??\c:\thplnf.exec:\thplnf.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\bjrdf.exec:\bjrdf.exe40⤵
- Executes dropped EXE
PID:2936 -
\??\c:\tfrbn.exec:\tfrbn.exe41⤵
- Executes dropped EXE
PID:2888 -
\??\c:\rttbv.exec:\rttbv.exe42⤵
- Executes dropped EXE
PID:2164 -
\??\c:\trlvnv.exec:\trlvnv.exe43⤵
- Executes dropped EXE
PID:2052 -
\??\c:\dxbrjx.exec:\dxbrjx.exe44⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rvtlp.exec:\rvtlp.exe45⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jdfdfj.exec:\jdfdfj.exe46⤵
- Executes dropped EXE
PID:2080 -
\??\c:\fhtbrrp.exec:\fhtbrrp.exe47⤵
- Executes dropped EXE
PID:1692 -
\??\c:\tltrxd.exec:\tltrxd.exe48⤵
- Executes dropped EXE
PID:3000 -
\??\c:\bxvfxlf.exec:\bxvfxlf.exe49⤵
- Executes dropped EXE
PID:1136 -
\??\c:\btjdrvf.exec:\btjdrvf.exe50⤵
- Executes dropped EXE
PID:2836 -
\??\c:\jvljnbx.exec:\jvljnbx.exe51⤵
- Executes dropped EXE
PID:740 -
\??\c:\thptnbx.exec:\thptnbx.exe52⤵
- Executes dropped EXE
PID:2820 -
\??\c:\llrrjl.exec:\llrrjl.exe53⤵
- Executes dropped EXE
PID:560 -
\??\c:\nnpfjh.exec:\nnpfjh.exe54⤵
- Executes dropped EXE
PID:1920 -
\??\c:\bbhlb.exec:\bbhlb.exe55⤵
- Executes dropped EXE
PID:2384 -
\??\c:\jbdrtjr.exec:\jbdrtjr.exe56⤵
- Executes dropped EXE
PID:2808 -
\??\c:\thlrxbp.exec:\thlrxbp.exe57⤵
- Executes dropped EXE
PID:1044 -
\??\c:\hjdhxtd.exec:\hjdhxtd.exe58⤵
- Executes dropped EXE
PID:2084 -
\??\c:\lvbtv.exec:\lvbtv.exe59⤵
- Executes dropped EXE
PID:2288 -
\??\c:\bjpbdr.exec:\bjpbdr.exe60⤵
- Executes dropped EXE
PID:1156 -
\??\c:\fxpdrnp.exec:\fxpdrnp.exe61⤵
- Executes dropped EXE
PID:3060 -
\??\c:\vdrbdj.exec:\vdrbdj.exe62⤵
- Executes dropped EXE
PID:640 -
\??\c:\rdhdfr.exec:\rdhdfr.exe63⤵
- Executes dropped EXE
PID:972 -
\??\c:\dhrtbpl.exec:\dhrtbpl.exe64⤵
- Executes dropped EXE
PID:1704 -
\??\c:\ptfnpnr.exec:\ptfnpnr.exe65⤵
- Executes dropped EXE
PID:612 -
\??\c:\rhjll.exec:\rhjll.exe66⤵
- Executes dropped EXE
PID:896 -
\??\c:\ttpfdjb.exec:\ttpfdjb.exe67⤵PID:1724
-
\??\c:\hxblnxj.exec:\hxblnxj.exe68⤵PID:1540
-
\??\c:\fjtxpv.exec:\fjtxpv.exe69⤵PID:572
-
\??\c:\dbfbrr.exec:\dbfbrr.exe70⤵PID:2264
-
\??\c:\dhfnhrh.exec:\dhfnhrh.exe71⤵PID:2452
-
\??\c:\dpbdpln.exec:\dpbdpln.exe72⤵PID:1528
-
\??\c:\fbrttl.exec:\fbrttl.exe73⤵PID:2488
-
\??\c:\fhlbf.exec:\fhlbf.exe74⤵PID:2584
-
\??\c:\dfllpnx.exec:\dfllpnx.exe75⤵PID:1364
-
\??\c:\nfbvttx.exec:\nfbvttx.exe76⤵PID:2336
-
\??\c:\njhhvv.exec:\njhhvv.exe77⤵PID:2536
-
\??\c:\dppfdb.exec:\dppfdb.exe78⤵PID:1700
-
\??\c:\xjxrlp.exec:\xjxrlp.exe79⤵PID:2016
-
\??\c:\pphvf.exec:\pphvf.exe80⤵PID:2448
-
\??\c:\fpjphl.exec:\fpjphl.exe81⤵PID:2036
-
\??\c:\xlbjtb.exec:\xlbjtb.exe82⤵PID:2764
-
\??\c:\tvhvvff.exec:\tvhvvff.exe83⤵PID:2928
-
\??\c:\vpdbbnx.exec:\vpdbbnx.exe84⤵PID:3024
-
\??\c:\hhpxdtd.exec:\hhpxdtd.exe85⤵PID:2824
-
\??\c:\tnppbhj.exec:\tnppbhj.exe86⤵PID:1580
-
\??\c:\lnvpfrj.exec:\lnvpfrj.exe87⤵PID:2276
-
\??\c:\rhrrj.exec:\rhrrj.exe88⤵PID:1648
-
\??\c:\tldrl.exec:\tldrl.exe89⤵PID:2844
-
\??\c:\xhrpf.exec:\xhrpf.exe90⤵PID:2708
-
\??\c:\rldptv.exec:\rldptv.exe91⤵PID:2852
-
\??\c:\xbhlpf.exec:\xbhlpf.exe92⤵PID:2508
-
\??\c:\tvfvbht.exec:\tvfvbht.exe93⤵PID:384
-
\??\c:\pnvxlrb.exec:\pnvxlrb.exe94⤵PID:1948
-
\??\c:\bnlfnd.exec:\bnlfnd.exe95⤵PID:1152
-
\??\c:\dlrnlpf.exec:\dlrnlpf.exe96⤵PID:2232
-
\??\c:\vtfbrdd.exec:\vtfbrdd.exe97⤵PID:1900
-
\??\c:\vxfrvn.exec:\vxfrvn.exe98⤵PID:2716
-
\??\c:\tftnrb.exec:\tftnrb.exe99⤵PID:840
-
\??\c:\hhdfvxb.exec:\hhdfvxb.exe100⤵PID:2028
-
\??\c:\tvnnffh.exec:\tvnnffh.exe101⤵PID:1348
-
\??\c:\hdpvfx.exec:\hdpvfx.exe102⤵PID:432
-
\??\c:\xvjdn.exec:\xvjdn.exe103⤵PID:3068
-
\??\c:\nffrbn.exec:\nffrbn.exe104⤵PID:620
-
\??\c:\rrflhh.exec:\rrflhh.exe105⤵PID:1164
-
\??\c:\xdffh.exec:\xdffh.exe106⤵PID:1736
-
\??\c:\rvrxjlr.exec:\rvrxjlr.exe107⤵
- System Location Discovery: System Language Discovery
PID:1704 -
\??\c:\tjnxtxf.exec:\tjnxtxf.exe108⤵PID:612
-
\??\c:\jphthrr.exec:\jphthrr.exe109⤵PID:2032
-
\??\c:\rljrblj.exec:\rljrblj.exe110⤵PID:1724
-
\??\c:\ptjbn.exec:\ptjbn.exe111⤵PID:1540
-
\??\c:\fljfrd.exec:\fljfrd.exe112⤵PID:1828
-
\??\c:\nvpbp.exec:\nvpbp.exe113⤵PID:2700
-
\??\c:\bfdjjdt.exec:\bfdjjdt.exe114⤵PID:568
-
\??\c:\rxnrtr.exec:\rxnrtr.exe115⤵PID:1360
-
\??\c:\xddtbxv.exec:\xddtbxv.exe116⤵PID:2488
-
\??\c:\lpnjrf.exec:\lpnjrf.exe117⤵PID:1600
-
\??\c:\bnbpdxt.exec:\bnbpdxt.exe118⤵PID:1592
-
\??\c:\dfvnj.exec:\dfvnj.exe119⤵PID:3032
-
\??\c:\hflxppt.exec:\hflxppt.exe120⤵PID:2208
-
\??\c:\rtpfrr.exec:\rtpfrr.exe121⤵PID:2712
-
\??\c:\flftvft.exec:\flftvft.exe122⤵PID:2768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-