Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 09:19
Static task
static1
Behavioral task
behavioral1
Sample
17334528d2d250763094288043b9105ef5cbc1799dce6c8c33a6224acbb81a77N.exe
Resource
win7-20241010-en
General
-
Target
17334528d2d250763094288043b9105ef5cbc1799dce6c8c33a6224acbb81a77N.exe
-
Size
453KB
-
MD5
31c8e480d5e31d9e477e6e0581c07430
-
SHA1
32465c66c8c007e7eca08fb1d6e6ba5310bfbd7e
-
SHA256
17334528d2d250763094288043b9105ef5cbc1799dce6c8c33a6224acbb81a77
-
SHA512
cf35cbb4a2d5fe66d51a7e9ea17816a01ac510abef994adf734d17fe2eb334e8338ccac71ac83ad5eaa77d2e06cb884495f36022f27da61c496176213b64022f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet/:q7Tc2NYHUrAwfMp3CDt/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2540-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-32-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2292-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-37-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2476-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-298-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1696-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-314-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1700-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-641-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-649-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2664-656-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-788-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-885-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-899-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2076-995-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2540 lnrrxpv.exe 2544 lbfxh.exe 2292 dnlpbd.exe 2476 hdvld.exe 2884 dxtblf.exe 2228 nfpxrjd.exe 1688 vxtfxj.exe 2896 lhtnhv.exe 2708 dlrtph.exe 2396 vnjvbpn.exe 672 xdvvvp.exe 2920 htbbb.exe 1924 brptx.exe 2620 ntxvhfl.exe 2836 thljl.exe 1296 tjlfxf.exe 1480 tlbvplp.exe 3004 ppbvph.exe 1916 nlbvxv.exe 2088 vhjdnn.exe 1660 hnjnxvl.exe 1824 hjttbn.exe 1796 lljhh.exe 1160 bhrdhxl.exe 1744 fnxxln.exe 1460 hdjdthr.exe 2600 ddhfdh.exe 1468 txxft.exe 580 djbxdv.exe 1768 bnhxrfp.exe 2488 jtpjx.exe 2332 dplxdl.exe 2576 dnrdft.exe 1696 xntjbdf.exe 2568 pblddfh.exe 1700 fllltxh.exe 524 dlbhnl.exe 2740 pvpjp.exe 2856 bdhjn.exe 2756 dnflh.exe 2252 xttfjrf.exe 2892 ljddppv.exe 2688 lxphnjx.exe 2752 nxvpxlh.exe 2684 jfbhr.exe 2156 rxxvjh.exe 1300 xjtvhpf.exe 2952 bjfpbd.exe 2964 xbtpbv.exe 2076 hnxnr.exe 2068 hfbjbb.exe 1364 lrhdx.exe 2836 hxxpt.exe 1672 vrxdv.exe 828 bllnh.exe 2916 pbhjnp.exe 2388 jnptp.exe 2728 pxtblfj.exe 2088 pvbdn.exe 2176 xfnpdxb.exe 2004 rpxvt.exe 1644 jhxxbr.exe 1020 tdhnbr.exe 1184 vthpjd.exe -
resource yara_rule behavioral1/memory/2540-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-282-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2332-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-298-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1696-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-807-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2332-846-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-853-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-885-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjlnlft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhpppr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjtldj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldtfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfvpjxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxdbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhvxvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnjblpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvrjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjlfjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bllhfjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnbrrdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfthxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntxvhfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvbfrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trjtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjdhdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnltjvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlpvbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxpjbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nfprrxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhxtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnfhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfphfnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxtblfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fhrbrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtvjlvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hldnnxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvjjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjrxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvphfrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtndn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxtphb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trtrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdtll.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2064 wrote to memory of 2540 2064 17334528d2d250763094288043b9105ef5cbc1799dce6c8c33a6224acbb81a77N.exe 30 PID 2064 wrote to memory of 2540 2064 17334528d2d250763094288043b9105ef5cbc1799dce6c8c33a6224acbb81a77N.exe 30 PID 2064 wrote to memory of 2540 2064 17334528d2d250763094288043b9105ef5cbc1799dce6c8c33a6224acbb81a77N.exe 30 PID 2064 wrote to memory of 2540 2064 17334528d2d250763094288043b9105ef5cbc1799dce6c8c33a6224acbb81a77N.exe 30 PID 2540 wrote to memory of 2544 2540 lnrrxpv.exe 31 PID 2540 wrote to memory of 2544 2540 lnrrxpv.exe 31 PID 2540 wrote to memory of 2544 2540 lnrrxpv.exe 31 PID 2540 wrote to memory of 2544 2540 lnrrxpv.exe 31 PID 2544 wrote to memory of 2292 2544 lbfxh.exe 33 PID 2544 wrote to memory of 2292 2544 lbfxh.exe 33 PID 2544 wrote to memory of 2292 2544 lbfxh.exe 33 PID 2544 wrote to memory of 2292 2544 lbfxh.exe 33 PID 2292 wrote to memory of 2476 2292 dnlpbd.exe 34 PID 2292 wrote to memory of 2476 2292 dnlpbd.exe 34 PID 2292 wrote to memory of 2476 2292 dnlpbd.exe 34 PID 2292 wrote to memory of 2476 2292 dnlpbd.exe 34 PID 2476 wrote to memory of 2884 2476 hdvld.exe 35 PID 2476 wrote to memory of 2884 2476 hdvld.exe 35 PID 2476 wrote to memory of 2884 2476 hdvld.exe 35 PID 2476 wrote to memory of 2884 2476 hdvld.exe 35 PID 2884 wrote to memory of 2228 2884 dxtblf.exe 36 PID 2884 wrote to memory of 2228 2884 dxtblf.exe 36 PID 2884 wrote to memory of 2228 2884 dxtblf.exe 36 PID 2884 wrote to memory of 2228 2884 dxtblf.exe 36 PID 2228 wrote to memory of 1688 2228 nfpxrjd.exe 37 PID 2228 wrote to memory of 1688 2228 nfpxrjd.exe 37 PID 2228 wrote to memory of 1688 2228 nfpxrjd.exe 37 PID 2228 wrote to memory of 1688 2228 nfpxrjd.exe 37 PID 1688 wrote to memory of 2896 1688 vxtfxj.exe 38 PID 1688 wrote to memory of 2896 1688 vxtfxj.exe 38 PID 1688 wrote to memory of 2896 1688 vxtfxj.exe 38 PID 1688 wrote to memory of 2896 1688 vxtfxj.exe 38 PID 2896 wrote to memory of 2708 2896 lhtnhv.exe 39 PID 2896 wrote to memory of 2708 2896 lhtnhv.exe 39 PID 2896 wrote to memory of 2708 2896 lhtnhv.exe 39 PID 2896 wrote to memory of 2708 2896 lhtnhv.exe 39 PID 2708 wrote to memory of 2396 2708 dlrtph.exe 40 PID 2708 wrote to memory of 2396 2708 dlrtph.exe 40 PID 2708 wrote to memory of 2396 2708 dlrtph.exe 40 PID 2708 wrote to memory of 2396 2708 dlrtph.exe 40 PID 2396 wrote to memory of 672 2396 vnjvbpn.exe 41 PID 2396 wrote to memory of 672 2396 vnjvbpn.exe 41 PID 2396 wrote to memory of 672 2396 vnjvbpn.exe 41 PID 2396 wrote to memory of 672 2396 vnjvbpn.exe 41 PID 672 wrote to memory of 2920 672 xdvvvp.exe 42 PID 672 wrote to memory of 2920 672 xdvvvp.exe 42 PID 672 wrote to memory of 2920 672 xdvvvp.exe 42 PID 672 wrote to memory of 2920 672 xdvvvp.exe 42 PID 2920 wrote to memory of 1924 2920 htbbb.exe 43 PID 2920 wrote to memory of 1924 2920 htbbb.exe 43 PID 2920 wrote to memory of 1924 2920 htbbb.exe 43 PID 2920 wrote to memory of 1924 2920 htbbb.exe 43 PID 1924 wrote to memory of 2620 1924 brptx.exe 44 PID 1924 wrote to memory of 2620 1924 brptx.exe 44 PID 1924 wrote to memory of 2620 1924 brptx.exe 44 PID 1924 wrote to memory of 2620 1924 brptx.exe 44 PID 2620 wrote to memory of 2836 2620 ntxvhfl.exe 45 PID 2620 wrote to memory of 2836 2620 ntxvhfl.exe 45 PID 2620 wrote to memory of 2836 2620 ntxvhfl.exe 45 PID 2620 wrote to memory of 2836 2620 ntxvhfl.exe 45 PID 2836 wrote to memory of 1296 2836 thljl.exe 46 PID 2836 wrote to memory of 1296 2836 thljl.exe 46 PID 2836 wrote to memory of 1296 2836 thljl.exe 46 PID 2836 wrote to memory of 1296 2836 thljl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\17334528d2d250763094288043b9105ef5cbc1799dce6c8c33a6224acbb81a77N.exe"C:\Users\Admin\AppData\Local\Temp\17334528d2d250763094288043b9105ef5cbc1799dce6c8c33a6224acbb81a77N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\lnrrxpv.exec:\lnrrxpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\lbfxh.exec:\lbfxh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\dnlpbd.exec:\dnlpbd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\hdvld.exec:\hdvld.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\dxtblf.exec:\dxtblf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\nfpxrjd.exec:\nfpxrjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\vxtfxj.exec:\vxtfxj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\lhtnhv.exec:\lhtnhv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\dlrtph.exec:\dlrtph.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\vnjvbpn.exec:\vnjvbpn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\xdvvvp.exec:\xdvvvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\htbbb.exec:\htbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\brptx.exec:\brptx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\ntxvhfl.exec:\ntxvhfl.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\thljl.exec:\thljl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\tjlfxf.exec:\tjlfxf.exe17⤵
- Executes dropped EXE
PID:1296 -
\??\c:\tlbvplp.exec:\tlbvplp.exe18⤵
- Executes dropped EXE
PID:1480 -
\??\c:\ppbvph.exec:\ppbvph.exe19⤵
- Executes dropped EXE
PID:3004 -
\??\c:\nlbvxv.exec:\nlbvxv.exe20⤵
- Executes dropped EXE
PID:1916 -
\??\c:\vhjdnn.exec:\vhjdnn.exe21⤵
- Executes dropped EXE
PID:2088 -
\??\c:\hnjnxvl.exec:\hnjnxvl.exe22⤵
- Executes dropped EXE
PID:1660 -
\??\c:\hjttbn.exec:\hjttbn.exe23⤵
- Executes dropped EXE
PID:1824 -
\??\c:\lljhh.exec:\lljhh.exe24⤵
- Executes dropped EXE
PID:1796 -
\??\c:\bhrdhxl.exec:\bhrdhxl.exe25⤵
- Executes dropped EXE
PID:1160 -
\??\c:\fnxxln.exec:\fnxxln.exe26⤵
- Executes dropped EXE
PID:1744 -
\??\c:\hdjdthr.exec:\hdjdthr.exe27⤵
- Executes dropped EXE
PID:1460 -
\??\c:\ddhfdh.exec:\ddhfdh.exe28⤵
- Executes dropped EXE
PID:2600 -
\??\c:\txxft.exec:\txxft.exe29⤵
- Executes dropped EXE
PID:1468 -
\??\c:\djbxdv.exec:\djbxdv.exe30⤵
- Executes dropped EXE
PID:580 -
\??\c:\bnhxrfp.exec:\bnhxrfp.exe31⤵
- Executes dropped EXE
PID:1768 -
\??\c:\jtpjx.exec:\jtpjx.exe32⤵
- Executes dropped EXE
PID:2488 -
\??\c:\dplxdl.exec:\dplxdl.exe33⤵
- Executes dropped EXE
PID:2332 -
\??\c:\dnrdft.exec:\dnrdft.exe34⤵
- Executes dropped EXE
PID:2576 -
\??\c:\xntjbdf.exec:\xntjbdf.exe35⤵
- Executes dropped EXE
PID:1696 -
\??\c:\pblddfh.exec:\pblddfh.exe36⤵
- Executes dropped EXE
PID:2568 -
\??\c:\fllltxh.exec:\fllltxh.exe37⤵
- Executes dropped EXE
PID:1700 -
\??\c:\dlbhnl.exec:\dlbhnl.exe38⤵
- Executes dropped EXE
PID:524 -
\??\c:\pvpjp.exec:\pvpjp.exe39⤵
- Executes dropped EXE
PID:2740 -
\??\c:\bdhjn.exec:\bdhjn.exe40⤵
- Executes dropped EXE
PID:2856 -
\??\c:\dnflh.exec:\dnflh.exe41⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xttfjrf.exec:\xttfjrf.exe42⤵
- Executes dropped EXE
PID:2252 -
\??\c:\ljddppv.exec:\ljddppv.exe43⤵
- Executes dropped EXE
PID:2892 -
\??\c:\lxphnjx.exec:\lxphnjx.exe44⤵
- Executes dropped EXE
PID:2688 -
\??\c:\nxvpxlh.exec:\nxvpxlh.exe45⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jfbhr.exec:\jfbhr.exe46⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rxxvjh.exec:\rxxvjh.exe47⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xjtvhpf.exec:\xjtvhpf.exe48⤵
- Executes dropped EXE
PID:1300 -
\??\c:\bjfpbd.exec:\bjfpbd.exe49⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xbtpbv.exec:\xbtpbv.exe50⤵
- Executes dropped EXE
PID:2964 -
\??\c:\hnxnr.exec:\hnxnr.exe51⤵
- Executes dropped EXE
PID:2076 -
\??\c:\hfbjbb.exec:\hfbjbb.exe52⤵
- Executes dropped EXE
PID:2068 -
\??\c:\lrhdx.exec:\lrhdx.exe53⤵
- Executes dropped EXE
PID:1364 -
\??\c:\hxxpt.exec:\hxxpt.exe54⤵
- Executes dropped EXE
PID:2836 -
\??\c:\vrxdv.exec:\vrxdv.exe55⤵
- Executes dropped EXE
PID:1672 -
\??\c:\bllnh.exec:\bllnh.exe56⤵
- Executes dropped EXE
PID:828 -
\??\c:\pbhjnp.exec:\pbhjnp.exe57⤵
- Executes dropped EXE
PID:2916 -
\??\c:\jnptp.exec:\jnptp.exe58⤵
- Executes dropped EXE
PID:2388 -
\??\c:\pxtblfj.exec:\pxtblfj.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2728 -
\??\c:\pvbdn.exec:\pvbdn.exe60⤵
- Executes dropped EXE
PID:2088 -
\??\c:\xfnpdxb.exec:\xfnpdxb.exe61⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rpxvt.exec:\rpxvt.exe62⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jhxxbr.exec:\jhxxbr.exe63⤵
- Executes dropped EXE
PID:1644 -
\??\c:\tdhnbr.exec:\tdhnbr.exe64⤵
- Executes dropped EXE
PID:1020 -
\??\c:\vthpjd.exec:\vthpjd.exe65⤵
- Executes dropped EXE
PID:1184 -
\??\c:\fvrjx.exec:\fvrjx.exe66⤵
- System Location Discovery: System Language Discovery
PID:2944 -
\??\c:\tlvxltd.exec:\tlvxltd.exe67⤵PID:2404
-
\??\c:\dhvdtfj.exec:\dhvdtfj.exe68⤵PID:2600
-
\??\c:\dbtrx.exec:\dbtrx.exe69⤵PID:768
-
\??\c:\dfpffr.exec:\dfpffr.exe70⤵PID:2420
-
\??\c:\pdrxr.exec:\pdrxr.exe71⤵PID:2452
-
\??\c:\dtxjtjn.exec:\dtxjtjn.exe72⤵PID:2716
-
\??\c:\ddbbhbf.exec:\ddbbhbf.exe73⤵PID:1912
-
\??\c:\lnnprpb.exec:\lnnprpb.exe74⤵PID:2332
-
\??\c:\rhttvpr.exec:\rhttvpr.exe75⤵PID:2320
-
\??\c:\rvbfrh.exec:\rvbfrh.exe76⤵
- System Location Discovery: System Language Discovery
PID:860 -
\??\c:\ptxvnv.exec:\ptxvnv.exe77⤵PID:1696
-
\??\c:\dldfpn.exec:\dldfpn.exe78⤵PID:2056
-
\??\c:\vhfpvt.exec:\vhfpvt.exe79⤵PID:2140
-
\??\c:\ltprvpl.exec:\ltprvpl.exe80⤵PID:1576
-
\??\c:\jbnlddv.exec:\jbnlddv.exe81⤵PID:2880
-
\??\c:\hnnhb.exec:\hnnhb.exe82⤵PID:2788
-
\??\c:\lprpl.exec:\lprpl.exe83⤵PID:2904
-
\??\c:\vnpnptd.exec:\vnpnptd.exe84⤵PID:2928
-
\??\c:\rjdpl.exec:\rjdpl.exe85⤵PID:2804
-
\??\c:\bhdbx.exec:\bhdbx.exe86⤵PID:1688
-
\??\c:\vlnhtd.exec:\vlnhtd.exe87⤵PID:2664
-
\??\c:\nbpxbfj.exec:\nbpxbfj.exe88⤵PID:2704
-
\??\c:\xtpfn.exec:\xtpfn.exe89⤵PID:1104
-
\??\c:\rhpjtr.exec:\rhpjtr.exe90⤵PID:2536
-
\??\c:\bbntdph.exec:\bbntdph.exe91⤵PID:2980
-
\??\c:\rptrx.exec:\rptrx.exe92⤵PID:1016
-
\??\c:\bfxfpxn.exec:\bfxfpxn.exe93⤵PID:536
-
\??\c:\xbnxrn.exec:\xbnxrn.exe94⤵PID:2808
-
\??\c:\xhbdnd.exec:\xhbdnd.exe95⤵PID:1884
-
\??\c:\fljphv.exec:\fljphv.exe96⤵PID:1640
-
\??\c:\vnftdbj.exec:\vnftdbj.exe97⤵PID:1756
-
\??\c:\ntplphb.exec:\ntplphb.exe98⤵PID:1480
-
\??\c:\bjnlhvj.exec:\bjnlhvj.exe99⤵PID:1240
-
\??\c:\xfnxr.exec:\xfnxr.exe100⤵PID:2296
-
\??\c:\bprvld.exec:\bprvld.exe101⤵PID:372
-
\??\c:\ldpjh.exec:\ldpjh.exe102⤵PID:2728
-
\??\c:\xnpxp.exec:\xnpxp.exe103⤵PID:2592
-
\??\c:\nbplhn.exec:\nbplhn.exe104⤵PID:1740
-
\??\c:\fppthf.exec:\fppthf.exe105⤵PID:1752
-
\??\c:\fdbrb.exec:\fdbrb.exe106⤵PID:944
-
\??\c:\tfvvh.exec:\tfvvh.exe107⤵PID:2044
-
\??\c:\pfvpjxb.exec:\pfvpjxb.exe108⤵
- System Location Discovery: System Language Discovery
PID:1184 -
\??\c:\nhpxl.exec:\nhpxl.exe109⤵PID:2944
-
\??\c:\fhtdnh.exec:\fhtdnh.exe110⤵PID:2404
-
\??\c:\hrlpxj.exec:\hrlpxj.exe111⤵PID:3068
-
\??\c:\tplhl.exec:\tplhl.exe112⤵PID:1592
-
\??\c:\bpblr.exec:\bpblr.exe113⤵PID:2420
-
\??\c:\vdbhr.exec:\vdbhr.exe114⤵PID:1936
-
\??\c:\rpbvnh.exec:\rpbvnh.exe115⤵PID:2716
-
\??\c:\jnvhjn.exec:\jnvhjn.exe116⤵PID:2572
-
\??\c:\hjhbd.exec:\hjhbd.exe117⤵PID:2332
-
\??\c:\vndxvd.exec:\vndxvd.exe118⤵PID:2320
-
\??\c:\bdtlxrb.exec:\bdtlxrb.exe119⤵PID:860
-
\??\c:\dthbhdf.exec:\dthbhdf.exe120⤵PID:588
-
\??\c:\jrtfpr.exec:\jrtfpr.exe121⤵PID:2760
-
\??\c:\jvdrtj.exec:\jvdrtj.exe122⤵PID:2772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-