Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 08:47
Static task
static1
Behavioral task
behavioral1
Sample
e368571d0422c1902114f0fa8b37c1f6670ec68c7ea6fefb22e72748c620e269N.exe
Resource
win7-20241010-en
General
-
Target
e368571d0422c1902114f0fa8b37c1f6670ec68c7ea6fefb22e72748c620e269N.exe
-
Size
453KB
-
MD5
59160f133f69f78c6b675451e88d3c20
-
SHA1
bfe6d5a405d1a621b3a4a32b254e12959335a2c5
-
SHA256
e368571d0422c1902114f0fa8b37c1f6670ec68c7ea6fefb22e72748c620e269
-
SHA512
b1f08b8bc68ee7f71f0deaba15d361121474d018f694e96f786484fcf377013c4f806be9609ea2acb326507423c1ed3827dcdf0f5b20cd99cb3152ca84ce7f3c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/840-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-135-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2188-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/396-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-214-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2724-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1168-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-334-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2772-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1176-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/612-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-562-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2384-572-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1716-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-586-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2076-670-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1084-819-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2384-858-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-872-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2840 tlbxvx.exe 2968 rhpthrd.exe 2856 xjhbddv.exe 3012 pbpvnr.exe 3068 jtrhnlh.exe 2972 txtbv.exe 2812 rrvtxf.exe 2172 tfhdltj.exe 2068 fdvfj.exe 2012 lpjdrr.exe 3044 jvntvl.exe 3052 trtjjhx.exe 2188 lbpfxn.exe 2296 rrlxpj.exe 2420 xxvjdrr.exe 840 vxxdn.exe 2308 jvbvpt.exe 2112 xdhlxll.exe 396 tfxrvjf.exe 2124 rpdjlp.exe 1844 nvxpp.exe 1388 jrhrn.exe 2208 tfvpjdt.exe 1184 dppjxlv.exe 2724 ljdbp.exe 2100 dxtlt.exe 1088 rhhdpdv.exe 596 fnfldh.exe 2676 txftxft.exe 1060 pvpxprh.exe 1168 vtjvd.exe 1120 pbjxbf.exe 1604 bdtlphx.exe 2240 rhvfnjp.exe 2896 vbnbr.exe 2352 nnlhjb.exe 3016 rblpprr.exe 1824 jtttrxx.exe 2920 hhrtpj.exe 2772 fnpjbf.exe 2748 llntvlt.exe 2768 nbfpp.exe 2624 vbtxx.exe 2812 bbllhvr.exe 2320 hhrppn.exe 1736 jtblflr.exe 1532 nrnbvpd.exe 2360 rvrdt.exe 2128 hjtdp.exe 2700 trrhxfd.exe 3024 hrtjxh.exe 2696 rlhvxr.exe 2704 hdnjb.exe 1176 bbxvll.exe 612 vjjrrp.exe 2464 pbhbvt.exe 1760 jhnnxxd.exe 1204 lljxx.exe 396 tdhdll.exe 1540 vjpnr.exe 1896 bdbtpj.exe 2428 brtnb.exe 2160 jxdvnlv.exe 792 pltbbbt.exe -
resource yara_rule behavioral1/memory/840-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1168-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-543-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2132-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/972-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-757-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-858-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-885-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-911-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-926-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfrhfjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htdltlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhxjrfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxtdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfxrfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpxprh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lblpphf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpxrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjtvtpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrjjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhfdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxpxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdxnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxnjbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfdhlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xphljl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phpnvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxtlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxhnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvlpnvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blbpvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hptnrlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpdhtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlplbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtptpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrvxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dltlvfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrhnlnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxdxpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjbfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddfbvtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnjtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbtxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trnhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnlhjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txrvxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjfrjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhlvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvrrfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffdbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdptp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 2840 2244 e368571d0422c1902114f0fa8b37c1f6670ec68c7ea6fefb22e72748c620e269N.exe 30 PID 2244 wrote to memory of 2840 2244 e368571d0422c1902114f0fa8b37c1f6670ec68c7ea6fefb22e72748c620e269N.exe 30 PID 2244 wrote to memory of 2840 2244 e368571d0422c1902114f0fa8b37c1f6670ec68c7ea6fefb22e72748c620e269N.exe 30 PID 2244 wrote to memory of 2840 2244 e368571d0422c1902114f0fa8b37c1f6670ec68c7ea6fefb22e72748c620e269N.exe 30 PID 2840 wrote to memory of 2968 2840 tlbxvx.exe 31 PID 2840 wrote to memory of 2968 2840 tlbxvx.exe 31 PID 2840 wrote to memory of 2968 2840 tlbxvx.exe 31 PID 2840 wrote to memory of 2968 2840 tlbxvx.exe 31 PID 2968 wrote to memory of 2856 2968 rhpthrd.exe 32 PID 2968 wrote to memory of 2856 2968 rhpthrd.exe 32 PID 2968 wrote to memory of 2856 2968 rhpthrd.exe 32 PID 2968 wrote to memory of 2856 2968 rhpthrd.exe 32 PID 2856 wrote to memory of 3012 2856 xjhbddv.exe 33 PID 2856 wrote to memory of 3012 2856 xjhbddv.exe 33 PID 2856 wrote to memory of 3012 2856 xjhbddv.exe 33 PID 2856 wrote to memory of 3012 2856 xjhbddv.exe 33 PID 3012 wrote to memory of 3068 3012 pbpvnr.exe 34 PID 3012 wrote to memory of 3068 3012 pbpvnr.exe 34 PID 3012 wrote to memory of 3068 3012 pbpvnr.exe 34 PID 3012 wrote to memory of 3068 3012 pbpvnr.exe 34 PID 3068 wrote to memory of 2972 3068 jtrhnlh.exe 35 PID 3068 wrote to memory of 2972 3068 jtrhnlh.exe 35 PID 3068 wrote to memory of 2972 3068 jtrhnlh.exe 35 PID 3068 wrote to memory of 2972 3068 jtrhnlh.exe 35 PID 2972 wrote to memory of 2812 2972 txtbv.exe 36 PID 2972 wrote to memory of 2812 2972 txtbv.exe 36 PID 2972 wrote to memory of 2812 2972 txtbv.exe 36 PID 2972 wrote to memory of 2812 2972 txtbv.exe 36 PID 2812 wrote to memory of 2172 2812 rrvtxf.exe 37 PID 2812 wrote to memory of 2172 2812 rrvtxf.exe 37 PID 2812 wrote to memory of 2172 2812 rrvtxf.exe 37 PID 2812 wrote to memory of 2172 2812 rrvtxf.exe 37 PID 2172 wrote to memory of 2068 2172 tfhdltj.exe 38 PID 2172 wrote to memory of 2068 2172 tfhdltj.exe 38 PID 2172 wrote to memory of 2068 2172 tfhdltj.exe 38 PID 2172 wrote to memory of 2068 2172 tfhdltj.exe 38 PID 2068 wrote to memory of 2012 2068 fdvfj.exe 39 PID 2068 wrote to memory of 2012 2068 fdvfj.exe 39 PID 2068 wrote to memory of 2012 2068 fdvfj.exe 39 PID 2068 wrote to memory of 2012 2068 fdvfj.exe 39 PID 2012 wrote to memory of 3044 2012 lpjdrr.exe 40 PID 2012 wrote to memory of 3044 2012 lpjdrr.exe 40 PID 2012 wrote to memory of 3044 2012 lpjdrr.exe 40 PID 2012 wrote to memory of 3044 2012 lpjdrr.exe 40 PID 3044 wrote to memory of 3052 3044 jvntvl.exe 41 PID 3044 wrote to memory of 3052 3044 jvntvl.exe 41 PID 3044 wrote to memory of 3052 3044 jvntvl.exe 41 PID 3044 wrote to memory of 3052 3044 jvntvl.exe 41 PID 3052 wrote to memory of 2188 3052 trtjjhx.exe 42 PID 3052 wrote to memory of 2188 3052 trtjjhx.exe 42 PID 3052 wrote to memory of 2188 3052 trtjjhx.exe 42 PID 3052 wrote to memory of 2188 3052 trtjjhx.exe 42 PID 2188 wrote to memory of 2296 2188 lbpfxn.exe 43 PID 2188 wrote to memory of 2296 2188 lbpfxn.exe 43 PID 2188 wrote to memory of 2296 2188 lbpfxn.exe 43 PID 2188 wrote to memory of 2296 2188 lbpfxn.exe 43 PID 2296 wrote to memory of 2420 2296 rrlxpj.exe 44 PID 2296 wrote to memory of 2420 2296 rrlxpj.exe 44 PID 2296 wrote to memory of 2420 2296 rrlxpj.exe 44 PID 2296 wrote to memory of 2420 2296 rrlxpj.exe 44 PID 2420 wrote to memory of 840 2420 xxvjdrr.exe 45 PID 2420 wrote to memory of 840 2420 xxvjdrr.exe 45 PID 2420 wrote to memory of 840 2420 xxvjdrr.exe 45 PID 2420 wrote to memory of 840 2420 xxvjdrr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e368571d0422c1902114f0fa8b37c1f6670ec68c7ea6fefb22e72748c620e269N.exe"C:\Users\Admin\AppData\Local\Temp\e368571d0422c1902114f0fa8b37c1f6670ec68c7ea6fefb22e72748c620e269N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\tlbxvx.exec:\tlbxvx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rhpthrd.exec:\rhpthrd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\xjhbddv.exec:\xjhbddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\pbpvnr.exec:\pbpvnr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\jtrhnlh.exec:\jtrhnlh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\txtbv.exec:\txtbv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\rrvtxf.exec:\rrvtxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\tfhdltj.exec:\tfhdltj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\fdvfj.exec:\fdvfj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\lpjdrr.exec:\lpjdrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\jvntvl.exec:\jvntvl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\trtjjhx.exec:\trtjjhx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\lbpfxn.exec:\lbpfxn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\rrlxpj.exec:\rrlxpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\xxvjdrr.exec:\xxvjdrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\vxxdn.exec:\vxxdn.exe17⤵
- Executes dropped EXE
PID:840 -
\??\c:\jvbvpt.exec:\jvbvpt.exe18⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xdhlxll.exec:\xdhlxll.exe19⤵
- Executes dropped EXE
PID:2112 -
\??\c:\tfxrvjf.exec:\tfxrvjf.exe20⤵
- Executes dropped EXE
PID:396 -
\??\c:\rpdjlp.exec:\rpdjlp.exe21⤵
- Executes dropped EXE
PID:2124 -
\??\c:\nvxpp.exec:\nvxpp.exe22⤵
- Executes dropped EXE
PID:1844 -
\??\c:\jrhrn.exec:\jrhrn.exe23⤵
- Executes dropped EXE
PID:1388 -
\??\c:\tfvpjdt.exec:\tfvpjdt.exe24⤵
- Executes dropped EXE
PID:2208 -
\??\c:\dppjxlv.exec:\dppjxlv.exe25⤵
- Executes dropped EXE
PID:1184 -
\??\c:\ljdbp.exec:\ljdbp.exe26⤵
- Executes dropped EXE
PID:2724 -
\??\c:\dxtlt.exec:\dxtlt.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2100 -
\??\c:\rhhdpdv.exec:\rhhdpdv.exe28⤵
- Executes dropped EXE
PID:1088 -
\??\c:\fnfldh.exec:\fnfldh.exe29⤵
- Executes dropped EXE
PID:596 -
\??\c:\txftxft.exec:\txftxft.exe30⤵
- Executes dropped EXE
PID:2676 -
\??\c:\pvpxprh.exec:\pvpxprh.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1060 -
\??\c:\vtjvd.exec:\vtjvd.exe32⤵
- Executes dropped EXE
PID:1168 -
\??\c:\pbjxbf.exec:\pbjxbf.exe33⤵
- Executes dropped EXE
PID:1120 -
\??\c:\bdtlphx.exec:\bdtlphx.exe34⤵
- Executes dropped EXE
PID:1604 -
\??\c:\rhvfnjp.exec:\rhvfnjp.exe35⤵
- Executes dropped EXE
PID:2240 -
\??\c:\vbnbr.exec:\vbnbr.exe36⤵
- Executes dropped EXE
PID:2896 -
\??\c:\nnlhjb.exec:\nnlhjb.exe37⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rblpprr.exec:\rblpprr.exe38⤵
- Executes dropped EXE
PID:3016 -
\??\c:\jtttrxx.exec:\jtttrxx.exe39⤵
- Executes dropped EXE
PID:1824 -
\??\c:\hhrtpj.exec:\hhrtpj.exe40⤵
- Executes dropped EXE
PID:2920 -
\??\c:\fnpjbf.exec:\fnpjbf.exe41⤵
- Executes dropped EXE
PID:2772 -
\??\c:\llntvlt.exec:\llntvlt.exe42⤵
- Executes dropped EXE
PID:2748 -
\??\c:\nbfpp.exec:\nbfpp.exe43⤵
- Executes dropped EXE
PID:2768 -
\??\c:\vbtxx.exec:\vbtxx.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2624 -
\??\c:\bbllhvr.exec:\bbllhvr.exe45⤵
- Executes dropped EXE
PID:2812 -
\??\c:\hhrppn.exec:\hhrppn.exe46⤵
- Executes dropped EXE
PID:2320 -
\??\c:\jtblflr.exec:\jtblflr.exe47⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nrnbvpd.exec:\nrnbvpd.exe48⤵
- Executes dropped EXE
PID:1532 -
\??\c:\rvrdt.exec:\rvrdt.exe49⤵
- Executes dropped EXE
PID:2360 -
\??\c:\hjtdp.exec:\hjtdp.exe50⤵
- Executes dropped EXE
PID:2128 -
\??\c:\trrhxfd.exec:\trrhxfd.exe51⤵
- Executes dropped EXE
PID:2700 -
\??\c:\hrtjxh.exec:\hrtjxh.exe52⤵
- Executes dropped EXE
PID:3024 -
\??\c:\rlhvxr.exec:\rlhvxr.exe53⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hdnjb.exec:\hdnjb.exe54⤵
- Executes dropped EXE
PID:2704 -
\??\c:\bbxvll.exec:\bbxvll.exe55⤵
- Executes dropped EXE
PID:1176 -
\??\c:\vjjrrp.exec:\vjjrrp.exe56⤵
- Executes dropped EXE
PID:612 -
\??\c:\pbhbvt.exec:\pbhbvt.exe57⤵
- Executes dropped EXE
PID:2464 -
\??\c:\jhnnxxd.exec:\jhnnxxd.exe58⤵
- Executes dropped EXE
PID:1760 -
\??\c:\lljxx.exec:\lljxx.exe59⤵
- Executes dropped EXE
PID:1204 -
\??\c:\tdhdll.exec:\tdhdll.exe60⤵
- Executes dropped EXE
PID:396 -
\??\c:\vjpnr.exec:\vjpnr.exe61⤵
- Executes dropped EXE
PID:1540 -
\??\c:\bdbtpj.exec:\bdbtpj.exe62⤵
- Executes dropped EXE
PID:1896 -
\??\c:\brtnb.exec:\brtnb.exe63⤵
- Executes dropped EXE
PID:2428 -
\??\c:\jxdvnlv.exec:\jxdvnlv.exe64⤵
- Executes dropped EXE
PID:2160 -
\??\c:\pltbbbt.exec:\pltbbbt.exe65⤵
- Executes dropped EXE
PID:792 -
\??\c:\xlrnr.exec:\xlrnr.exe66⤵PID:1500
-
\??\c:\jrhxrht.exec:\jrhxrht.exe67⤵PID:1812
-
\??\c:\xnjjrl.exec:\xnjjrl.exe68⤵PID:1944
-
\??\c:\xvrdnx.exec:\xvrdnx.exe69⤵PID:1464
-
\??\c:\nxnvv.exec:\nxnvv.exe70⤵PID:584
-
\??\c:\tpvhfjj.exec:\tpvhfjj.exe71⤵PID:2132
-
\??\c:\lxpxl.exec:\lxpxl.exe72⤵
- System Location Discovery: System Language Discovery
PID:2440 -
\??\c:\jbxvt.exec:\jbxvt.exe73⤵PID:2384
-
\??\c:\bllrv.exec:\bllrv.exe74⤵PID:1716
-
\??\c:\rrrdj.exec:\rrrdj.exe75⤵PID:1156
-
\??\c:\lxlpf.exec:\lxlpf.exe76⤵PID:1120
-
\??\c:\bbndnh.exec:\bbndnh.exe77⤵PID:1604
-
\??\c:\lnjbjp.exec:\lnjbjp.exe78⤵PID:1612
-
\??\c:\pjjhbbr.exec:\pjjhbbr.exe79⤵PID:972
-
\??\c:\xdvxnf.exec:\xdvxnf.exe80⤵PID:2968
-
\??\c:\phjtv.exec:\phjtv.exe81⤵PID:3016
-
\??\c:\prrtvb.exec:\prrtvb.exe82⤵PID:2908
-
\??\c:\ntldr.exec:\ntldr.exe83⤵PID:2176
-
\??\c:\dnxpd.exec:\dnxpd.exe84⤵PID:2588
-
\??\c:\phxfxpx.exec:\phxfxpx.exe85⤵PID:2792
-
\??\c:\vrvrd.exec:\vrvrd.exe86⤵PID:2648
-
\??\c:\fxbhhj.exec:\fxbhhj.exe87⤵PID:2820
-
\??\c:\xjflj.exec:\xjflj.exe88⤵PID:2076
-
\??\c:\nprpfjx.exec:\nprpfjx.exe89⤵PID:2064
-
\??\c:\xjbhdt.exec:\xjbhdt.exe90⤵PID:2348
-
\??\c:\pvjtt.exec:\pvjtt.exe91⤵
- System Location Discovery: System Language Discovery
PID:2012 -
\??\c:\nxtpn.exec:\nxtpn.exe92⤵PID:3056
-
\??\c:\vxvnl.exec:\vxvnl.exe93⤵PID:2444
-
\??\c:\lprrnlx.exec:\lprrnlx.exe94⤵PID:2808
-
\??\c:\vjfbhrp.exec:\vjfbhrp.exe95⤵PID:2120
-
\??\c:\drdfff.exec:\drdfff.exe96⤵PID:2940
-
\??\c:\rblvhf.exec:\rblvhf.exe97⤵PID:856
-
\??\c:\thptbfh.exec:\thptbfh.exe98⤵PID:1976
-
\??\c:\rfpthlf.exec:\rfpthlf.exe99⤵PID:1776
-
\??\c:\tthtlt.exec:\tthtlt.exe100⤵PID:1536
-
\??\c:\htrld.exec:\htrld.exe101⤵PID:2308
-
\??\c:\bhljfdr.exec:\bhljfdr.exe102⤵PID:2568
-
\??\c:\txrvxp.exec:\txrvxp.exe103⤵
- System Location Discovery: System Language Discovery
PID:2272 -
\??\c:\prnthbf.exec:\prnthbf.exe104⤵PID:2476
-
\??\c:\lhbtl.exec:\lhbtl.exe105⤵PID:1960
-
\??\c:\tftfp.exec:\tftfp.exe106⤵PID:1844
-
\??\c:\fjpjd.exec:\fjpjd.exe107⤵PID:760
-
\??\c:\flfpfp.exec:\flfpfp.exe108⤵PID:1724
-
\??\c:\pvrrlf.exec:\pvrrlf.exe109⤵PID:2644
-
\??\c:\tdfjd.exec:\tdfjd.exe110⤵PID:1184
-
\??\c:\dvnht.exec:\dvnht.exe111⤵PID:776
-
\??\c:\hvbvtnf.exec:\hvbvtnf.exe112⤵PID:1084
-
\??\c:\ptpjjvh.exec:\ptpjjvh.exe113⤵PID:860
-
\??\c:\pdxhp.exec:\pdxhp.exe114⤵PID:1688
-
\??\c:\fhrxtr.exec:\fhrxtr.exe115⤵PID:596
-
\??\c:\ttvfh.exec:\ttvfh.exe116⤵PID:2572
-
\??\c:\bjbnrxj.exec:\bjbnrxj.exe117⤵PID:2440
-
\??\c:\rhxbv.exec:\rhxbv.exe118⤵PID:2384
-
\??\c:\xfxrtpr.exec:\xfxrtpr.exe119⤵PID:3000
-
\??\c:\tpbbn.exec:\tpbbn.exe120⤵PID:1156
-
\??\c:\ppnpt.exec:\ppnpt.exe121⤵PID:1480
-
\??\c:\ttxtvdv.exec:\ttxtvdv.exe122⤵PID:1604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-