Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 22:25
Behavioral task
behavioral1
Sample
661f1cef50d83b1541d44241852f4608900ceccf8c4bf7b62a655d98b477d6e9.exe
Resource
win7-20240705-en
6 signatures
150 seconds
General
-
Target
661f1cef50d83b1541d44241852f4608900ceccf8c4bf7b62a655d98b477d6e9.exe
-
Size
443KB
-
MD5
6b0e18cd2ac168883f8181ea6bfe5f1b
-
SHA1
8a3e8acef761c2e6a45aa71f603509a2bb29f036
-
SHA256
661f1cef50d83b1541d44241852f4608900ceccf8c4bf7b62a655d98b477d6e9
-
SHA512
677cc2e2b9a48861052de131d1f210d73c9e039481cd2b147b31e436dfd46b6041b0659ec91acf7621b0149c3c66fa889a12591583c571240ca9234087950de5
-
SSDEEP
12288:M4wFHoSpg4wFHonR/nPF2LnFL4wF04wFK4wFK4wluAS:UrR/nPRS
Malware Config
Signatures
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2772-8-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2836-17-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2812-28-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2888-31-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2888-37-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2748-48-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2612-59-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2612-57-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2596-70-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2596-69-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2492-81-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1544-79-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2492-90-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1904-101-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2224-112-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2948-125-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2900-123-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2948-136-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/3036-146-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2620-157-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2420-165-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/3044-177-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2056-185-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2088-195-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1364-205-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1808-215-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1548-233-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2412-242-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/3012-251-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1752-261-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1240-280-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1256-290-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2832-310-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2684-318-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2712-328-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2792-335-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2920-336-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2920-344-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/696-351-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2628-359-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2604-367-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/828-375-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/764-382-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/1728-391-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2208-405-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2864-413-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2808-421-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/3052-435-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/740-443-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2480-451-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral1/memory/2124-465-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2836 ppdjj.exe 2812 xrrrfxl.exe 2888 bthtbn.exe 2748 9pppd.exe 2612 9xllrrr.exe 2596 5lxflrx.exe 1544 nnttnh.exe 2492 5pjpp.exe 1904 frllxfx.exe 2224 hbtbnn.exe 2900 5vvvj.exe 2948 vddpp.exe 3036 frrfrxx.exe 2620 5nntbb.exe 2420 7hnttb.exe 3044 ffllrlf.exe 2056 nhbbhn.exe 2088 vpdjv.exe 1364 hhnnnh.exe 1808 pjvpp.exe 2164 nnntbn.exe 1548 pjdjp.exe 2412 hbbnht.exe 3012 vvvpv.exe 1752 lxrfrfx.exe 2964 pjddv.exe 1240 3xrxlxl.exe 1256 xxxlffx.exe 1792 vvvdv.exe 2832 1xfrxlx.exe 2684 pvppv.exe 2712 tnhnbh.exe 2792 rrrlfrf.exe 2920 hbbhth.exe 696 jvvpp.exe 2628 xlfxxlf.exe 2604 1dvvd.exe 828 xrffllf.exe 764 7ppdp.exe 1728 dddvp.exe 2492 hhbhbh.exe 2208 vpppv.exe 2864 btnthb.exe 2808 jjvvd.exe 2960 rlfflrl.exe 3052 hhhhth.exe 740 1jvdd.exe 2480 lfxxxlx.exe 2620 vpppd.exe 2124 dpddj.exe 3032 bhntbt.exe 1120 hbhhnn.exe 612 ddpdp.exe 536 9xrxfrf.exe 2508 bnhntt.exe 576 nbhbbn.exe 1808 vpddv.exe 1276 rxfrrfx.exe 1320 hbnbnt.exe 1160 bntthb.exe 1832 ddvdp.exe 3012 rrflxxf.exe 2968 rlflxrf.exe 2632 nnbbbb.exe -
resource yara_rule behavioral1/memory/2772-0-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x000d00000001224d-5.dat upx behavioral1/memory/2836-11-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2772-8-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0008000000016e04-18.dat upx behavioral1/memory/2836-17-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2812-19-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0008000000016e08-26.dat upx behavioral1/memory/2812-28-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2888-31-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2748-39-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0008000000016e0d-38.dat upx behavioral1/memory/2888-37-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0007000000016ee7-46.dat upx behavioral1/memory/2748-48-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2612-51-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2612-59-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0007000000017070-58.dat upx behavioral1/memory/2596-60-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2596-64-0x0000000000490000-0x000000000051C000-memory.dmp upx behavioral1/memory/2596-70-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x000700000001711a-71.dat upx behavioral1/memory/1544-73-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2492-81-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x000900000001722a-80.dat upx behavioral1/memory/1544-79-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2492-89-0x0000000001D80000-0x0000000001E0C000-memory.dmp upx behavioral1/files/0x00090000000172a7-92.dat upx behavioral1/memory/1904-95-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2492-90-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2224-104-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x000500000001951b-103.dat upx behavioral1/memory/1904-101-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x000500000001963f-114.dat upx behavioral1/memory/2224-110-0x0000000000490000-0x000000000051C000-memory.dmp upx behavioral1/memory/2900-116-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2224-112-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2948-125-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0032000000016dd5-124.dat upx behavioral1/memory/2900-123-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2948-132-0x0000000000490000-0x000000000051C000-memory.dmp upx behavioral1/memory/2948-136-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0005000000019947-135.dat upx behavioral1/memory/3036-139-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x000500000001994b-147.dat upx behavioral1/memory/2620-148-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/3036-146-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/3036-145-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x000500000001994f-158.dat upx behavioral1/memory/2620-157-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0005000000019a71-169.dat upx behavioral1/memory/3044-168-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2420-165-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0005000000019c59-178.dat upx behavioral1/memory/3044-177-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2088-187-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0005000000019c5b-188.dat upx behavioral1/memory/2056-185-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2088-195-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/memory/2088-196-0x0000000001DD0000-0x0000000001E5C000-memory.dmp upx behavioral1/files/0x0005000000019c6a-198.dat upx behavioral1/memory/1364-205-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral1/files/0x0005000000019c71-206.dat upx behavioral1/files/0x0005000000019ddc-216.dat upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2836 2772 661f1cef50d83b1541d44241852f4608900ceccf8c4bf7b62a655d98b477d6e9.exe 30 PID 2772 wrote to memory of 2836 2772 661f1cef50d83b1541d44241852f4608900ceccf8c4bf7b62a655d98b477d6e9.exe 30 PID 2772 wrote to memory of 2836 2772 661f1cef50d83b1541d44241852f4608900ceccf8c4bf7b62a655d98b477d6e9.exe 30 PID 2772 wrote to memory of 2836 2772 661f1cef50d83b1541d44241852f4608900ceccf8c4bf7b62a655d98b477d6e9.exe 30 PID 2836 wrote to memory of 2812 2836 ppdjj.exe 31 PID 2836 wrote to memory of 2812 2836 ppdjj.exe 31 PID 2836 wrote to memory of 2812 2836 ppdjj.exe 31 PID 2836 wrote to memory of 2812 2836 ppdjj.exe 31 PID 2812 wrote to memory of 2888 2812 xrrrfxl.exe 32 PID 2812 wrote to memory of 2888 2812 xrrrfxl.exe 32 PID 2812 wrote to memory of 2888 2812 xrrrfxl.exe 32 PID 2812 wrote to memory of 2888 2812 xrrrfxl.exe 32 PID 2888 wrote to memory of 2748 2888 bthtbn.exe 33 PID 2888 wrote to memory of 2748 2888 bthtbn.exe 33 PID 2888 wrote to memory of 2748 2888 bthtbn.exe 33 PID 2888 wrote to memory of 2748 2888 bthtbn.exe 33 PID 2748 wrote to memory of 2612 2748 9pppd.exe 34 PID 2748 wrote to memory of 2612 2748 9pppd.exe 34 PID 2748 wrote to memory of 2612 2748 9pppd.exe 34 PID 2748 wrote to memory of 2612 2748 9pppd.exe 34 PID 2612 wrote to memory of 2596 2612 9xllrrr.exe 35 PID 2612 wrote to memory of 2596 2612 9xllrrr.exe 35 PID 2612 wrote to memory of 2596 2612 9xllrrr.exe 35 PID 2612 wrote to memory of 2596 2612 9xllrrr.exe 35 PID 2596 wrote to memory of 1544 2596 5lxflrx.exe 36 PID 2596 wrote to memory of 1544 2596 5lxflrx.exe 36 PID 2596 wrote to memory of 1544 2596 5lxflrx.exe 36 PID 2596 wrote to memory of 1544 2596 5lxflrx.exe 36 PID 1544 wrote to memory of 2492 1544 nnttnh.exe 37 PID 1544 wrote to memory of 2492 1544 nnttnh.exe 37 PID 1544 wrote to memory of 2492 1544 nnttnh.exe 37 PID 1544 wrote to memory of 2492 1544 nnttnh.exe 37 PID 2492 wrote to memory of 1904 2492 5pjpp.exe 38 PID 2492 wrote to memory of 1904 2492 5pjpp.exe 38 PID 2492 wrote to memory of 1904 2492 5pjpp.exe 38 PID 2492 wrote to memory of 1904 2492 5pjpp.exe 38 PID 1904 wrote to memory of 2224 1904 frllxfx.exe 39 PID 1904 wrote to memory of 2224 1904 frllxfx.exe 39 PID 1904 wrote to memory of 2224 1904 frllxfx.exe 39 PID 1904 wrote to memory of 2224 1904 frllxfx.exe 39 PID 2224 wrote to memory of 2900 2224 hbtbnn.exe 40 PID 2224 wrote to memory of 2900 2224 hbtbnn.exe 40 PID 2224 wrote to memory of 2900 2224 hbtbnn.exe 40 PID 2224 wrote to memory of 2900 2224 hbtbnn.exe 40 PID 2900 wrote to memory of 2948 2900 5vvvj.exe 41 PID 2900 wrote to memory of 2948 2900 5vvvj.exe 41 PID 2900 wrote to memory of 2948 2900 5vvvj.exe 41 PID 2900 wrote to memory of 2948 2900 5vvvj.exe 41 PID 2948 wrote to memory of 3036 2948 vddpp.exe 42 PID 2948 wrote to memory of 3036 2948 vddpp.exe 42 PID 2948 wrote to memory of 3036 2948 vddpp.exe 42 PID 2948 wrote to memory of 3036 2948 vddpp.exe 42 PID 3036 wrote to memory of 2620 3036 frrfrxx.exe 43 PID 3036 wrote to memory of 2620 3036 frrfrxx.exe 43 PID 3036 wrote to memory of 2620 3036 frrfrxx.exe 43 PID 3036 wrote to memory of 2620 3036 frrfrxx.exe 43 PID 2620 wrote to memory of 2420 2620 5nntbb.exe 44 PID 2620 wrote to memory of 2420 2620 5nntbb.exe 44 PID 2620 wrote to memory of 2420 2620 5nntbb.exe 44 PID 2620 wrote to memory of 2420 2620 5nntbb.exe 44 PID 2420 wrote to memory of 3044 2420 7hnttb.exe 45 PID 2420 wrote to memory of 3044 2420 7hnttb.exe 45 PID 2420 wrote to memory of 3044 2420 7hnttb.exe 45 PID 2420 wrote to memory of 3044 2420 7hnttb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\661f1cef50d83b1541d44241852f4608900ceccf8c4bf7b62a655d98b477d6e9.exe"C:\Users\Admin\AppData\Local\Temp\661f1cef50d83b1541d44241852f4608900ceccf8c4bf7b62a655d98b477d6e9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\ppdjj.exec:\ppdjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\xrrrfxl.exec:\xrrrfxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\bthtbn.exec:\bthtbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\9pppd.exec:\9pppd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\9xllrrr.exec:\9xllrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\5lxflrx.exec:\5lxflrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\nnttnh.exec:\nnttnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\5pjpp.exec:\5pjpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\frllxfx.exec:\frllxfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\hbtbnn.exec:\hbtbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\5vvvj.exec:\5vvvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\vddpp.exec:\vddpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\frrfrxx.exec:\frrfrxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\5nntbb.exec:\5nntbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\7hnttb.exec:\7hnttb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\ffllrlf.exec:\ffllrlf.exe17⤵
- Executes dropped EXE
PID:3044 -
\??\c:\nhbbhn.exec:\nhbbhn.exe18⤵
- Executes dropped EXE
PID:2056 -
\??\c:\vpdjv.exec:\vpdjv.exe19⤵
- Executes dropped EXE
PID:2088 -
\??\c:\hhnnnh.exec:\hhnnnh.exe20⤵
- Executes dropped EXE
PID:1364 -
\??\c:\pjvpp.exec:\pjvpp.exe21⤵
- Executes dropped EXE
PID:1808 -
\??\c:\nnntbn.exec:\nnntbn.exe22⤵
- Executes dropped EXE
PID:2164 -
\??\c:\pjdjp.exec:\pjdjp.exe23⤵
- Executes dropped EXE
PID:1548 -
\??\c:\hbbnht.exec:\hbbnht.exe24⤵
- Executes dropped EXE
PID:2412 -
\??\c:\vvvpv.exec:\vvvpv.exe25⤵
- Executes dropped EXE
PID:3012 -
\??\c:\lxrfrfx.exec:\lxrfrfx.exe26⤵
- Executes dropped EXE
PID:1752 -
\??\c:\pjddv.exec:\pjddv.exe27⤵
- Executes dropped EXE
PID:2964 -
\??\c:\3xrxlxl.exec:\3xrxlxl.exe28⤵
- Executes dropped EXE
PID:1240 -
\??\c:\xxxlffx.exec:\xxxlffx.exe29⤵
- Executes dropped EXE
PID:1256 -
\??\c:\vvvdv.exec:\vvvdv.exe30⤵
- Executes dropped EXE
PID:1792 -
\??\c:\1xfrxlx.exec:\1xfrxlx.exe31⤵
- Executes dropped EXE
PID:2832 -
\??\c:\pvppv.exec:\pvppv.exe32⤵
- Executes dropped EXE
PID:2684 -
\??\c:\tnhnbh.exec:\tnhnbh.exe33⤵
- Executes dropped EXE
PID:2712 -
\??\c:\rrrlfrf.exec:\rrrlfrf.exe34⤵
- Executes dropped EXE
PID:2792 -
\??\c:\hbbhth.exec:\hbbhth.exe35⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jvvpp.exec:\jvvpp.exe36⤵
- Executes dropped EXE
PID:696 -
\??\c:\xlfxxlf.exec:\xlfxxlf.exe37⤵
- Executes dropped EXE
PID:2628 -
\??\c:\1dvvd.exec:\1dvvd.exe38⤵
- Executes dropped EXE
PID:2604 -
\??\c:\xrffllf.exec:\xrffllf.exe39⤵
- Executes dropped EXE
PID:828 -
\??\c:\7ppdp.exec:\7ppdp.exe40⤵
- Executes dropped EXE
PID:764 -
\??\c:\dddvp.exec:\dddvp.exe41⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hhbhbh.exec:\hhbhbh.exe42⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vpppv.exec:\vpppv.exe43⤵
- Executes dropped EXE
PID:2208 -
\??\c:\btnthb.exec:\btnthb.exe44⤵
- Executes dropped EXE
PID:2864 -
\??\c:\jjvvd.exec:\jjvvd.exe45⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rlfflrl.exec:\rlfflrl.exe46⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hhhhth.exec:\hhhhth.exe47⤵
- Executes dropped EXE
PID:3052 -
\??\c:\1jvdd.exec:\1jvdd.exe48⤵
- Executes dropped EXE
PID:740 -
\??\c:\lfxxxlx.exec:\lfxxxlx.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2480 -
\??\c:\vpppd.exec:\vpppd.exe50⤵
- Executes dropped EXE
PID:2620 -
\??\c:\dpddj.exec:\dpddj.exe51⤵
- Executes dropped EXE
PID:2124 -
\??\c:\bhntbt.exec:\bhntbt.exe52⤵
- Executes dropped EXE
PID:3032 -
\??\c:\hbhhnn.exec:\hbhhnn.exe53⤵
- Executes dropped EXE
PID:1120 -
\??\c:\ddpdp.exec:\ddpdp.exe54⤵
- Executes dropped EXE
PID:612 -
\??\c:\9xrxfrf.exec:\9xrxfrf.exe55⤵
- Executes dropped EXE
PID:536 -
\??\c:\bnhntt.exec:\bnhntt.exe56⤵
- Executes dropped EXE
PID:2508 -
\??\c:\nbhbbn.exec:\nbhbbn.exe57⤵
- Executes dropped EXE
PID:576 -
\??\c:\vpddv.exec:\vpddv.exe58⤵
- Executes dropped EXE
PID:1808 -
\??\c:\rxfrrfx.exec:\rxfrrfx.exe59⤵
- Executes dropped EXE
PID:1276 -
\??\c:\hbnbnt.exec:\hbnbnt.exe60⤵
- Executes dropped EXE
PID:1320 -
\??\c:\bntthb.exec:\bntthb.exe61⤵
- Executes dropped EXE
PID:1160 -
\??\c:\ddvdp.exec:\ddvdp.exe62⤵
- Executes dropped EXE
PID:1832 -
\??\c:\rrflxxf.exec:\rrflxxf.exe63⤵
- Executes dropped EXE
PID:3012 -
\??\c:\rlflxrf.exec:\rlflxrf.exe64⤵
- Executes dropped EXE
PID:2968 -
\??\c:\nnbbbb.exec:\nnbbbb.exe65⤵
- Executes dropped EXE
PID:2632 -
\??\c:\vpdvd.exec:\vpdvd.exe66⤵PID:2076
-
\??\c:\dppjd.exec:\dppjd.exe67⤵PID:2444
-
\??\c:\rlfflrf.exec:\rlfflrf.exe68⤵PID:1712
-
\??\c:\1hnhbb.exec:\1hnhbb.exe69⤵PID:2656
-
\??\c:\nhtbhh.exec:\nhtbhh.exe70⤵PID:2440
-
\??\c:\jddvd.exec:\jddvd.exe71⤵PID:2708
-
\??\c:\llxlfff.exec:\llxlfff.exe72⤵PID:1604
-
\??\c:\rlflxfr.exec:\rlflxfr.exe73⤵PID:2844
-
\??\c:\tnhnbh.exec:\tnhnbh.exe74⤵PID:2588
-
\??\c:\dvjvd.exec:\dvjvd.exe75⤵PID:1984
-
\??\c:\5xxlffr.exec:\5xxlffr.exe76⤵PID:2724
-
\??\c:\rlxxrrf.exec:\rlxxrrf.exe77⤵PID:2888
-
\??\c:\tnhnbh.exec:\tnhnbh.exe78⤵PID:2564
-
\??\c:\jvjjp.exec:\jvjjp.exe79⤵PID:1764
-
\??\c:\jjvpd.exec:\jjvpd.exe80⤵PID:2236
-
\??\c:\llffrfr.exec:\llffrfr.exe81⤵PID:2324
-
\??\c:\7ttbnb.exec:\7ttbnb.exe82⤵PID:1096
-
\??\c:\7nnbnn.exec:\7nnbnn.exe83⤵
- System Location Discovery: System Language Discovery
PID:2456 -
\??\c:\7vvdj.exec:\7vvdj.exe84⤵PID:780
-
\??\c:\bbthtt.exec:\bbthtt.exe85⤵PID:3004
-
\??\c:\bbnbtt.exec:\bbnbtt.exe86⤵PID:1144
-
\??\c:\9jvjp.exec:\9jvjp.exe87⤵PID:2820
-
\??\c:\rllrxxl.exec:\rllrxxl.exe88⤵PID:2900
-
\??\c:\tnnnbn.exec:\tnnnbn.exe89⤵PID:2788
-
\??\c:\7nthth.exec:\7nthth.exe90⤵PID:2084
-
\??\c:\7pjvd.exec:\7pjvd.exe91⤵PID:1920
-
\??\c:\rlfrxfx.exec:\rlfrxfx.exe92⤵PID:592
-
\??\c:\fxxfllr.exec:\fxxfllr.exe93⤵PID:1420
-
\??\c:\bhbnbn.exec:\bhbnbn.exe94⤵PID:2280
-
\??\c:\nhbntb.exec:\nhbntb.exe95⤵
- System Location Discovery: System Language Discovery
PID:2620 -
\??\c:\vddpv.exec:\vddpv.exe96⤵PID:1760
-
\??\c:\rrlfrxl.exec:\rrlfrxl.exe97⤵PID:1268
-
\??\c:\rlfflrx.exec:\rlfflrx.exe98⤵PID:2256
-
\??\c:\btnnhn.exec:\btnnhn.exe99⤵PID:2364
-
\??\c:\ttbtnn.exec:\ttbtnn.exe100⤵PID:948
-
\??\c:\jvjjd.exec:\jvjjd.exe101⤵PID:1700
-
\??\c:\7rlrxxf.exec:\7rlrxxf.exe102⤵PID:292
-
\??\c:\fxxrfrx.exec:\fxxrfrx.exe103⤵PID:576
-
\??\c:\btnthh.exec:\btnthh.exe104⤵PID:2332
-
\??\c:\jjjvp.exec:\jjjvp.exe105⤵PID:1532
-
\??\c:\vjpjj.exec:\vjpjj.exe106⤵PID:1676
-
\??\c:\lffxxrx.exec:\lffxxrx.exe107⤵PID:1836
-
\??\c:\hhttbb.exec:\hhttbb.exe108⤵PID:1244
-
\??\c:\tnbhnt.exec:\tnbhnt.exe109⤵PID:1524
-
\??\c:\vjppd.exec:\vjppd.exe110⤵PID:1692
-
\??\c:\vvjvv.exec:\vvjvv.exe111⤵PID:2484
-
\??\c:\lflrfff.exec:\lflrfff.exe112⤵PID:1888
-
\??\c:\5hnnnh.exec:\5hnnnh.exe113⤵PID:996
-
\??\c:\hhnnhh.exec:\hhnnhh.exe114⤵PID:2444
-
\??\c:\vvdpd.exec:\vvdpd.exe115⤵PID:1732
-
\??\c:\9fxxlxf.exec:\9fxxlxf.exe116⤵PID:1632
-
\??\c:\9xlrrrx.exec:\9xlrrrx.exe117⤵PID:1540
-
\??\c:\thnthh.exec:\thnthh.exe118⤵PID:1592
-
\??\c:\pjdjv.exec:\pjdjv.exe119⤵PID:1316
-
\??\c:\pjdjp.exec:\pjdjp.exe120⤵PID:2712
-
\??\c:\rrllllr.exec:\rrllllr.exe121⤵PID:2792
-
\??\c:\hhhthn.exec:\hhhthn.exe122⤵PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-