Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 13:08
Static task
static1
Behavioral task
behavioral1
Sample
baf23d7ef9a539733a9e14c70d4c659c859442591312f55f88c8b901c6ade7a1.exe
Resource
win7-20241010-en
General
-
Target
baf23d7ef9a539733a9e14c70d4c659c859442591312f55f88c8b901c6ade7a1.exe
-
Size
454KB
-
MD5
d7aab856e4bd64936a1088a688dcfed6
-
SHA1
6a09edc8f6675ef7d5e1b82b58cda6d7e99c2165
-
SHA256
baf23d7ef9a539733a9e14c70d4c659c859442591312f55f88c8b901c6ade7a1
-
SHA512
99171a60807dd13d63065dd0e488cc2da5b92f8e17a2e8822189f1654a89983b596042683dc452b0ab9ec8642a34effb0a776e1d84edec277d5f54875de8b4df
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeZ:q7Tc2NYHUrAwfMp3CDZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/3008-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-22-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2868-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-66-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1640-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/968-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/992-241-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/992-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-265-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1092-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-305-0x00000000779F0000-0x0000000077B0F000-memory.dmp family_blackmoon behavioral1/memory/2436-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-495-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2152-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-588-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2544-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-666-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-687-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2156-767-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-825-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-892-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3008 hnhppv.exe 2868 thjdvvd.exe 2976 thdndjv.exe 2428 xxrnpvb.exe 2748 jphvxb.exe 2728 hvhxpxp.exe 2592 ldjnj.exe 1640 djxfhn.exe 1660 nxjxdh.exe 968 bppvlh.exe 2764 nlpxn.exe 2172 rbblxj.exe 2612 nprnvn.exe 2360 nddpnd.exe 2636 prvtv.exe 2344 tvnxldd.exe 1032 lbfbxf.exe 2204 bhxvlh.exe 2676 jtxpr.exe 2120 ffdnx.exe 1536 ttpttpl.exe 2480 drfjfl.exe 1796 prvvvvb.exe 1792 ttvrt.exe 2256 dbtjlrh.exe 992 hnlhb.exe 1732 hndbnt.exe 2628 ptpdh.exe 1092 jfrlp.exe 1040 xtxff.exe 1700 bnlfxfd.exe 1512 ljnvtxj.exe 1720 vdnhn.exe 2952 xlljfrb.exe 1604 jdldxf.exe 2868 jnnhvft.exe 2860 rbxrp.exe 3000 rlndp.exe 2940 hbftj.exe 2912 tpppp.exe 2756 fhblrt.exe 2560 bjbjhf.exe 2704 ftflb.exe 2572 jrthlvx.exe 2408 ndndjvb.exe 884 pxjlp.exe 2828 dprtl.exe 1264 drhbdd.exe 3060 trvjl.exe 2604 npvxj.exe 3048 rldvffr.exe 1832 xrxjxd.exe 2212 jnjph.exe 888 tpptpd.exe 1788 dfxjlf.exe 2124 nttrrfv.exe 2908 bbxtp.exe 2208 ldbpvrb.exe 2272 phnxlr.exe 2404 rnxfjb.exe 2076 ltvxj.exe 1056 rhnphnl.exe 2680 pnhnlp.exe 2152 xddjdf.exe -
resource yara_rule behavioral1/memory/3008-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/968-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/968-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/992-241-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/992-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-256-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1092-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-746-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2156-767-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-825-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-840-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-892-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlbtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prdrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrfxhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvhptl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbftbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffvjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntltpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfhbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxdpxtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxbrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdphxpr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ljlnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltfdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpnxnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhlvhhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxjlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdlhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rblrhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdxjbrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlxjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dldjpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdvdlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fptnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxnbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhfjhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtlhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbdjhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjndtf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxfvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrdfjxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdljdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjvtxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhblbhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbxrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxxltxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvpbnfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvlfdn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1820 wrote to memory of 3008 1820 baf23d7ef9a539733a9e14c70d4c659c859442591312f55f88c8b901c6ade7a1.exe 29 PID 1820 wrote to memory of 3008 1820 baf23d7ef9a539733a9e14c70d4c659c859442591312f55f88c8b901c6ade7a1.exe 29 PID 1820 wrote to memory of 3008 1820 baf23d7ef9a539733a9e14c70d4c659c859442591312f55f88c8b901c6ade7a1.exe 29 PID 1820 wrote to memory of 3008 1820 baf23d7ef9a539733a9e14c70d4c659c859442591312f55f88c8b901c6ade7a1.exe 29 PID 3008 wrote to memory of 2868 3008 hnhppv.exe 30 PID 3008 wrote to memory of 2868 3008 hnhppv.exe 30 PID 3008 wrote to memory of 2868 3008 hnhppv.exe 30 PID 3008 wrote to memory of 2868 3008 hnhppv.exe 30 PID 2868 wrote to memory of 2976 2868 thjdvvd.exe 31 PID 2868 wrote to memory of 2976 2868 thjdvvd.exe 31 PID 2868 wrote to memory of 2976 2868 thjdvvd.exe 31 PID 2868 wrote to memory of 2976 2868 thjdvvd.exe 31 PID 2976 wrote to memory of 2428 2976 thdndjv.exe 32 PID 2976 wrote to memory of 2428 2976 thdndjv.exe 32 PID 2976 wrote to memory of 2428 2976 thdndjv.exe 32 PID 2976 wrote to memory of 2428 2976 thdndjv.exe 32 PID 2428 wrote to memory of 2748 2428 xxrnpvb.exe 33 PID 2428 wrote to memory of 2748 2428 xxrnpvb.exe 33 PID 2428 wrote to memory of 2748 2428 xxrnpvb.exe 33 PID 2428 wrote to memory of 2748 2428 xxrnpvb.exe 33 PID 2748 wrote to memory of 2728 2748 jphvxb.exe 34 PID 2748 wrote to memory of 2728 2748 jphvxb.exe 34 PID 2748 wrote to memory of 2728 2748 jphvxb.exe 34 PID 2748 wrote to memory of 2728 2748 jphvxb.exe 34 PID 2728 wrote to memory of 2592 2728 hvhxpxp.exe 35 PID 2728 wrote to memory of 2592 2728 hvhxpxp.exe 35 PID 2728 wrote to memory of 2592 2728 hvhxpxp.exe 35 PID 2728 wrote to memory of 2592 2728 hvhxpxp.exe 35 PID 2592 wrote to memory of 1640 2592 ldjnj.exe 36 PID 2592 wrote to memory of 1640 2592 ldjnj.exe 36 PID 2592 wrote to memory of 1640 2592 ldjnj.exe 36 PID 2592 wrote to memory of 1640 2592 ldjnj.exe 36 PID 1640 wrote to memory of 1660 1640 djxfhn.exe 37 PID 1640 wrote to memory of 1660 1640 djxfhn.exe 37 PID 1640 wrote to memory of 1660 1640 djxfhn.exe 37 PID 1640 wrote to memory of 1660 1640 djxfhn.exe 37 PID 1660 wrote to memory of 968 1660 nxjxdh.exe 38 PID 1660 wrote to memory of 968 1660 nxjxdh.exe 38 PID 1660 wrote to memory of 968 1660 nxjxdh.exe 38 PID 1660 wrote to memory of 968 1660 nxjxdh.exe 38 PID 968 wrote to memory of 2764 968 bppvlh.exe 39 PID 968 wrote to memory of 2764 968 bppvlh.exe 39 PID 968 wrote to memory of 2764 968 bppvlh.exe 39 PID 968 wrote to memory of 2764 968 bppvlh.exe 39 PID 2764 wrote to memory of 2172 2764 nlpxn.exe 40 PID 2764 wrote to memory of 2172 2764 nlpxn.exe 40 PID 2764 wrote to memory of 2172 2764 nlpxn.exe 40 PID 2764 wrote to memory of 2172 2764 nlpxn.exe 40 PID 2172 wrote to memory of 2612 2172 rbblxj.exe 41 PID 2172 wrote to memory of 2612 2172 rbblxj.exe 41 PID 2172 wrote to memory of 2612 2172 rbblxj.exe 41 PID 2172 wrote to memory of 2612 2172 rbblxj.exe 41 PID 2612 wrote to memory of 2360 2612 nprnvn.exe 42 PID 2612 wrote to memory of 2360 2612 nprnvn.exe 42 PID 2612 wrote to memory of 2360 2612 nprnvn.exe 42 PID 2612 wrote to memory of 2360 2612 nprnvn.exe 42 PID 2360 wrote to memory of 2636 2360 nddpnd.exe 43 PID 2360 wrote to memory of 2636 2360 nddpnd.exe 43 PID 2360 wrote to memory of 2636 2360 nddpnd.exe 43 PID 2360 wrote to memory of 2636 2360 nddpnd.exe 43 PID 2636 wrote to memory of 2344 2636 prvtv.exe 44 PID 2636 wrote to memory of 2344 2636 prvtv.exe 44 PID 2636 wrote to memory of 2344 2636 prvtv.exe 44 PID 2636 wrote to memory of 2344 2636 prvtv.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\baf23d7ef9a539733a9e14c70d4c659c859442591312f55f88c8b901c6ade7a1.exe"C:\Users\Admin\AppData\Local\Temp\baf23d7ef9a539733a9e14c70d4c659c859442591312f55f88c8b901c6ade7a1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\hnhppv.exec:\hnhppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\thjdvvd.exec:\thjdvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\thdndjv.exec:\thdndjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\xxrnpvb.exec:\xxrnpvb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\jphvxb.exec:\jphvxb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\hvhxpxp.exec:\hvhxpxp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\ldjnj.exec:\ldjnj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\djxfhn.exec:\djxfhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\nxjxdh.exec:\nxjxdh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\bppvlh.exec:\bppvlh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\nlpxn.exec:\nlpxn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\rbblxj.exec:\rbblxj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\nprnvn.exec:\nprnvn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\nddpnd.exec:\nddpnd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\prvtv.exec:\prvtv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\tvnxldd.exec:\tvnxldd.exe17⤵
- Executes dropped EXE
PID:2344 -
\??\c:\lbfbxf.exec:\lbfbxf.exe18⤵
- Executes dropped EXE
PID:1032 -
\??\c:\bhxvlh.exec:\bhxvlh.exe19⤵
- Executes dropped EXE
PID:2204 -
\??\c:\jtxpr.exec:\jtxpr.exe20⤵
- Executes dropped EXE
PID:2676 -
\??\c:\ffdnx.exec:\ffdnx.exe21⤵
- Executes dropped EXE
PID:2120 -
\??\c:\ttpttpl.exec:\ttpttpl.exe22⤵
- Executes dropped EXE
PID:1536 -
\??\c:\drfjfl.exec:\drfjfl.exe23⤵
- Executes dropped EXE
PID:2480 -
\??\c:\prvvvvb.exec:\prvvvvb.exe24⤵
- Executes dropped EXE
PID:1796 -
\??\c:\ttvrt.exec:\ttvrt.exe25⤵
- Executes dropped EXE
PID:1792 -
\??\c:\dbtjlrh.exec:\dbtjlrh.exe26⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hnlhb.exec:\hnlhb.exe27⤵
- Executes dropped EXE
PID:992 -
\??\c:\hndbnt.exec:\hndbnt.exe28⤵
- Executes dropped EXE
PID:1732 -
\??\c:\ptpdh.exec:\ptpdh.exe29⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jfrlp.exec:\jfrlp.exe30⤵
- Executes dropped EXE
PID:1092 -
\??\c:\xtxff.exec:\xtxff.exe31⤵
- Executes dropped EXE
PID:1040 -
\??\c:\bnlfxfd.exec:\bnlfxfd.exe32⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ljnvtxj.exec:\ljnvtxj.exe33⤵
- Executes dropped EXE
PID:1512 -
\??\c:\vdnhn.exec:\vdnhn.exe34⤵
- Executes dropped EXE
PID:1720 -
\??\c:\rhnpn.exec:\rhnpn.exe35⤵PID:2436
-
\??\c:\xlljfrb.exec:\xlljfrb.exe36⤵
- Executes dropped EXE
PID:2952 -
\??\c:\jdldxf.exec:\jdldxf.exe37⤵
- Executes dropped EXE
PID:1604 -
\??\c:\jnnhvft.exec:\jnnhvft.exe38⤵
- Executes dropped EXE
PID:2868 -
\??\c:\rbxrp.exec:\rbxrp.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2860 -
\??\c:\rlndp.exec:\rlndp.exe40⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hbftj.exec:\hbftj.exe41⤵
- Executes dropped EXE
PID:2940 -
\??\c:\tpppp.exec:\tpppp.exe42⤵
- Executes dropped EXE
PID:2912 -
\??\c:\fhblrt.exec:\fhblrt.exe43⤵
- Executes dropped EXE
PID:2756 -
\??\c:\bjbjhf.exec:\bjbjhf.exe44⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ftflb.exec:\ftflb.exe45⤵
- Executes dropped EXE
PID:2704 -
\??\c:\jrthlvx.exec:\jrthlvx.exe46⤵
- Executes dropped EXE
PID:2572 -
\??\c:\ndndjvb.exec:\ndndjvb.exe47⤵
- Executes dropped EXE
PID:2408 -
\??\c:\pxjlp.exec:\pxjlp.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:884 -
\??\c:\dprtl.exec:\dprtl.exe49⤵
- Executes dropped EXE
PID:2828 -
\??\c:\drhbdd.exec:\drhbdd.exe50⤵
- Executes dropped EXE
PID:1264 -
\??\c:\trvjl.exec:\trvjl.exe51⤵
- Executes dropped EXE
PID:3060 -
\??\c:\npvxj.exec:\npvxj.exe52⤵
- Executes dropped EXE
PID:2604 -
\??\c:\rldvffr.exec:\rldvffr.exe53⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xrxjxd.exec:\xrxjxd.exe54⤵
- Executes dropped EXE
PID:1832 -
\??\c:\jnjph.exec:\jnjph.exe55⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tpptpd.exec:\tpptpd.exe56⤵
- Executes dropped EXE
PID:888 -
\??\c:\dfxjlf.exec:\dfxjlf.exe57⤵
- Executes dropped EXE
PID:1788 -
\??\c:\nttrrfv.exec:\nttrrfv.exe58⤵
- Executes dropped EXE
PID:2124 -
\??\c:\bbxtp.exec:\bbxtp.exe59⤵
- Executes dropped EXE
PID:2908 -
\??\c:\ldbpvrb.exec:\ldbpvrb.exe60⤵
- Executes dropped EXE
PID:2208 -
\??\c:\phnxlr.exec:\phnxlr.exe61⤵
- Executes dropped EXE
PID:2272 -
\??\c:\rnxfjb.exec:\rnxfjb.exe62⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ltvxj.exec:\ltvxj.exe63⤵
- Executes dropped EXE
PID:2076 -
\??\c:\rhnphnl.exec:\rhnphnl.exe64⤵
- Executes dropped EXE
PID:1056 -
\??\c:\pnhnlp.exec:\pnhnlp.exe65⤵
- Executes dropped EXE
PID:2680 -
\??\c:\xddjdf.exec:\xddjdf.exe66⤵
- Executes dropped EXE
PID:2152 -
\??\c:\bnrrlpd.exec:\bnrrlpd.exe67⤵PID:1792
-
\??\c:\fxdjlnp.exec:\fxdjlnp.exe68⤵PID:2324
-
\??\c:\xxxrx.exec:\xxxrx.exe69⤵PID:992
-
\??\c:\vhdlfl.exec:\vhdlfl.exe70⤵PID:1008
-
\??\c:\fjfnf.exec:\fjfnf.exe71⤵PID:1044
-
\??\c:\lxnfxv.exec:\lxnfxv.exe72⤵PID:2652
-
\??\c:\plpvfh.exec:\plpvfh.exe73⤵PID:320
-
\??\c:\fbnfhnx.exec:\fbnfhnx.exe74⤵PID:1984
-
\??\c:\thvfv.exec:\thvfv.exe75⤵PID:2148
-
\??\c:\htpdj.exec:\htpdj.exe76⤵PID:1516
-
\??\c:\llfbp.exec:\llfbp.exe77⤵PID:2264
-
\??\c:\hpplf.exec:\hpplf.exe78⤵PID:2488
-
\??\c:\fdjlbjl.exec:\fdjlbjl.exe79⤵PID:2072
-
\??\c:\ljpdfpj.exec:\ljpdfpj.exe80⤵PID:1612
-
\??\c:\vhhxh.exec:\vhhxh.exe81⤵PID:2964
-
\??\c:\hnldv.exec:\hnldv.exe82⤵PID:2876
-
\??\c:\lrfnnpf.exec:\lrfnnpf.exe83⤵PID:2992
-
\??\c:\ppfnpr.exec:\ppfnpr.exe84⤵PID:2984
-
\??\c:\nfxxdv.exec:\nfxxdv.exe85⤵PID:2424
-
\??\c:\ljbfn.exec:\ljbfn.exe86⤵PID:2920
-
\??\c:\pnhbr.exec:\pnhbr.exe87⤵PID:2728
-
\??\c:\bbpdnhn.exec:\bbpdnhn.exe88⤵PID:2544
-
\??\c:\rhtntbn.exec:\rhtntbn.exe89⤵PID:2284
-
\??\c:\jjxbbpn.exec:\jjxbbpn.exe90⤵PID:2708
-
\??\c:\xxjhfxd.exec:\xxjhfxd.exe91⤵PID:2220
-
\??\c:\rhrdlvn.exec:\rhrdlvn.exe92⤵PID:2236
-
\??\c:\vlvxdnr.exec:\vlvxdnr.exe93⤵PID:2576
-
\??\c:\lltdv.exec:\lltdv.exe94⤵PID:2084
-
\??\c:\pddxbhd.exec:\pddxbhd.exe95⤵PID:2600
-
\??\c:\xjnlh.exec:\xjnlh.exe96⤵PID:2612
-
\??\c:\frxxlt.exec:\frxxlt.exe97⤵PID:3044
-
\??\c:\dlbxplt.exec:\dlbxplt.exe98⤵PID:2384
-
\??\c:\jhxlnjd.exec:\jhxlnjd.exe99⤵PID:3036
-
\??\c:\nhnbptn.exec:\nhnbptn.exe100⤵PID:1824
-
\??\c:\lnftfl.exec:\lnftfl.exe101⤵PID:1616
-
\??\c:\bhbjnj.exec:\bhbjnj.exe102⤵PID:1588
-
\??\c:\rtpvfx.exec:\rtpvfx.exe103⤵PID:2908
-
\??\c:\phljv.exec:\phljv.exe104⤵PID:2156
-
\??\c:\nnrndnf.exec:\nnrndnf.exe105⤵PID:316
-
\??\c:\lfvnhnv.exec:\lfvnhnv.exe106⤵PID:2120
-
\??\c:\rtxhpr.exec:\rtxhpr.exe107⤵PID:940
-
\??\c:\tbdxjlf.exec:\tbdxjlf.exe108⤵PID:1560
-
\??\c:\lrvpv.exec:\lrvpv.exe109⤵PID:1028
-
\??\c:\vvpfnhd.exec:\vvpfnhd.exe110⤵PID:2152
-
\??\c:\xhvjdbp.exec:\xhvjdbp.exe111⤵PID:1548
-
\??\c:\dljxb.exec:\dljxb.exe112⤵PID:1532
-
\??\c:\tbdxxrh.exec:\tbdxxrh.exe113⤵PID:592
-
\??\c:\lpfvppl.exec:\lpfvppl.exe114⤵PID:820
-
\??\c:\txdnj.exec:\txdnj.exe115⤵PID:1252
-
\??\c:\fxfjr.exec:\fxfjr.exe116⤵PID:1104
-
\??\c:\nvvhtj.exec:\nvvhtj.exe117⤵PID:1488
-
\??\c:\btrpjbr.exec:\btrpjbr.exe118⤵PID:2712
-
\??\c:\tvjbnl.exec:\tvjbnl.exe119⤵PID:872
-
\??\c:\nvhxf.exec:\nvhxf.exe120⤵PID:2456
-
\??\c:\jlvhfj.exec:\jlvhfj.exe121⤵PID:2836
-
\??\c:\phthhxv.exec:\phthhxv.exe122⤵PID:2944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-