Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
24/07/2024, 03:47
Behavioral task
behavioral1
Sample
45419a2b1c836cf7420af92256160300N.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
120 seconds
General
-
Target
45419a2b1c836cf7420af92256160300N.exe
-
Size
282KB
-
MD5
45419a2b1c836cf7420af92256160300
-
SHA1
71797c68af9ef388779b1b634f27696c210156f7
-
SHA256
b2db0913cc6b5d83616679cd612134e96dca3468f8438346f39ca4f5e238b05c
-
SHA512
59ba4038060f274dfff261adffb9efdb1a981bc0e2d7a03413ab5487853879e7719dcd9193725187eb3af7b375e7ab5aa0ef5f3a11bf25332c411d4ff0df84cd
-
SSDEEP
3072:LhOmTsF93UYfwC6GIoutVwT0JOfZKldUIbvpynrSPu/+//uGK:Lcm4FmowdHoSVwT+aZKlumArSPBXuGK
Malware Config
Signatures
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2360-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-23-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1936-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/572-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/264-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2332-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1740-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2044-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1780-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-225-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2120-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/568-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2076-515-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/868-548-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-570-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-623-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2284-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2076-518-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1740-639-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2728-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2192-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-709-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2256-800-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1768-938-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/768-6733-0x0000000077880000-0x000000007799F000-memory.dmp family_blackmoon behavioral1/memory/768-15323-0x0000000077880000-0x000000007799F000-memory.dmp family_blackmoon behavioral1/memory/768-18128-0x0000000077780000-0x000000007787A000-memory.dmp family_blackmoon behavioral1/memory/768-18691-0x0000000077880000-0x000000007799F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2532 fxrrxrx.exe 2176 vjjjd.exe 1936 htnttb.exe 2540 vvjvp.exe 1820 7rrxllx.exe 572 pvdvd.exe 2856 lxfxllf.exe 2756 rllxrrf.exe 264 vpjdp.exe 2640 llfflrx.exe 2776 bbtthn.exe 2608 3xlrxfr.exe 1740 hbbnnb.exe 2332 xrfrxfx.exe 2600 hntnnb.exe 2104 vddvd.exe 1972 thbhtb.exe 1816 jpdjp.exe 2044 llfxrff.exe 1752 bbtbbn.exe 1768 dpvpp.exe 2920 1xxrlrr.exe 524 nbhnnn.exe 2016 xflffxr.exe 1780 bbbnbn.exe 2592 jvvdv.exe 2960 xxrllff.exe 1856 pddpj.exe 2120 5lrffxf.exe 2492 9hnbnh.exe 1096 tnbnnh.exe 568 lfxxrrf.exe 1920 lfrxllf.exe 2488 hnnhhb.exe 480 jpvpj.exe 2536 7ppjv.exe 2000 ddvpd.exe 2180 7frfrrx.exe 2192 hhhbbh.exe 2356 bbbhbh.exe 2512 3jdpp.exe 2540 dvvjd.exe 3020 xxxfxxr.exe 2464 rlllxxl.exe 572 7btthh.exe 2716 httbbt.exe 2856 1pddj.exe 2728 5ddjv.exe 2744 rrxrxrf.exe 2648 tbnhhn.exe 2724 htbthb.exe 2616 dpvdp.exe 2664 pjjvd.exe 2688 fllffxf.exe 2252 llfxrlr.exe 2672 bbnhht.exe 2396 djpjj.exe 1800 djjvv.exe 1728 xxlxfll.exe 2352 1llxfrx.exe 2700 hhhthn.exe 1348 hthbht.exe 2792 jpdvv.exe 1736 7ddvd.exe -
resource yara_rule behavioral1/memory/2360-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000012119-5.dat upx behavioral1/memory/2360-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2532-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d8b-15.dat upx behavioral1/memory/2176-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d9e-26.dat upx behavioral1/memory/2176-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1936-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015db5-34.dat upx behavioral1/memory/2540-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015dbf-43.dat upx behavioral1/files/0x0007000000015e21-53.dat upx behavioral1/memory/1820-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/572-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015e87-61.dat upx behavioral1/memory/2856-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015f8b-67.dat upx behavioral1/memory/2756-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d3e-76.dat upx behavioral1/memory/264-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d46-84.dat upx behavioral1/memory/2640-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d5a-92.dat upx behavioral1/files/0x0006000000016d9e-99.dat upx behavioral1/memory/2608-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016db0-108.dat upx behavioral1/files/0x0006000000016dc7-115.dat upx behavioral1/memory/2332-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1740-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ddb-124.dat upx behavioral1/memory/2600-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ddf-131.dat upx behavioral1/files/0x0006000000016eb4-140.dat upx behavioral1/memory/2104-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015d72-147.dat upx behavioral1/memory/2044-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173e4-170.dat upx behavioral1/files/0x0006000000017073-164.dat upx behavioral1/memory/1752-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2920-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017400-179.dat upx behavioral1/files/0x0006000000017406-187.dat upx behavioral1/files/0x0006000000016ed2-155.dat upx behavioral1/files/0x0006000000017409-195.dat upx behavioral1/files/0x000600000001747a-204.dat upx behavioral1/memory/2016-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001748d-211.dat upx behavioral1/memory/1780-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174ab-220.dat upx behavioral1/memory/2592-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2960-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001752e-228.dat upx behavioral1/files/0x000900000001866c-238.dat upx behavioral1/files/0x0011000000018676-245.dat upx behavioral1/memory/2120-244-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186c8-252.dat upx behavioral1/memory/568-261-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018798-260.dat upx behavioral1/memory/2180-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2536-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2540-315-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2664-379-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2396-403-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xfxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ffrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flllrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbtn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2532 2360 45419a2b1c836cf7420af92256160300N.exe 30 PID 2360 wrote to memory of 2532 2360 45419a2b1c836cf7420af92256160300N.exe 30 PID 2360 wrote to memory of 2532 2360 45419a2b1c836cf7420af92256160300N.exe 30 PID 2360 wrote to memory of 2532 2360 45419a2b1c836cf7420af92256160300N.exe 30 PID 2532 wrote to memory of 2176 2532 fxrrxrx.exe 31 PID 2532 wrote to memory of 2176 2532 fxrrxrx.exe 31 PID 2532 wrote to memory of 2176 2532 fxrrxrx.exe 31 PID 2532 wrote to memory of 2176 2532 fxrrxrx.exe 31 PID 2176 wrote to memory of 1936 2176 vjjjd.exe 32 PID 2176 wrote to memory of 1936 2176 vjjjd.exe 32 PID 2176 wrote to memory of 1936 2176 vjjjd.exe 32 PID 2176 wrote to memory of 1936 2176 vjjjd.exe 32 PID 1936 wrote to memory of 2540 1936 htnttb.exe 33 PID 1936 wrote to memory of 2540 1936 htnttb.exe 33 PID 1936 wrote to memory of 2540 1936 htnttb.exe 33 PID 1936 wrote to memory of 2540 1936 htnttb.exe 33 PID 2540 wrote to memory of 1820 2540 vvjvp.exe 34 PID 2540 wrote to memory of 1820 2540 vvjvp.exe 34 PID 2540 wrote to memory of 1820 2540 vvjvp.exe 34 PID 2540 wrote to memory of 1820 2540 vvjvp.exe 34 PID 1820 wrote to memory of 572 1820 7rrxllx.exe 35 PID 1820 wrote to memory of 572 1820 7rrxllx.exe 35 PID 1820 wrote to memory of 572 1820 7rrxllx.exe 35 PID 1820 wrote to memory of 572 1820 7rrxllx.exe 35 PID 572 wrote to memory of 2856 572 pvdvd.exe 36 PID 572 wrote to memory of 2856 572 pvdvd.exe 36 PID 572 wrote to memory of 2856 572 pvdvd.exe 36 PID 572 wrote to memory of 2856 572 pvdvd.exe 36 PID 2856 wrote to memory of 2756 2856 lxfxllf.exe 37 PID 2856 wrote to memory of 2756 2856 lxfxllf.exe 37 PID 2856 wrote to memory of 2756 2856 lxfxllf.exe 37 PID 2856 wrote to memory of 2756 2856 lxfxllf.exe 37 PID 2756 wrote to memory of 264 2756 rllxrrf.exe 38 PID 2756 wrote to memory of 264 2756 rllxrrf.exe 38 PID 2756 wrote to memory of 264 2756 rllxrrf.exe 38 PID 2756 wrote to memory of 264 2756 rllxrrf.exe 38 PID 264 wrote to memory of 2640 264 vpjdp.exe 39 PID 264 wrote to memory of 2640 264 vpjdp.exe 39 PID 264 wrote to memory of 2640 264 vpjdp.exe 39 PID 264 wrote to memory of 2640 264 vpjdp.exe 39 PID 2640 wrote to memory of 2776 2640 llfflrx.exe 40 PID 2640 wrote to memory of 2776 2640 llfflrx.exe 40 PID 2640 wrote to memory of 2776 2640 llfflrx.exe 40 PID 2640 wrote to memory of 2776 2640 llfflrx.exe 40 PID 2776 wrote to memory of 2608 2776 bbtthn.exe 41 PID 2776 wrote to memory of 2608 2776 bbtthn.exe 41 PID 2776 wrote to memory of 2608 2776 bbtthn.exe 41 PID 2776 wrote to memory of 2608 2776 bbtthn.exe 41 PID 2608 wrote to memory of 1740 2608 3xlrxfr.exe 42 PID 2608 wrote to memory of 1740 2608 3xlrxfr.exe 42 PID 2608 wrote to memory of 1740 2608 3xlrxfr.exe 42 PID 2608 wrote to memory of 1740 2608 3xlrxfr.exe 42 PID 1740 wrote to memory of 2332 1740 hbbnnb.exe 43 PID 1740 wrote to memory of 2332 1740 hbbnnb.exe 43 PID 1740 wrote to memory of 2332 1740 hbbnnb.exe 43 PID 1740 wrote to memory of 2332 1740 hbbnnb.exe 43 PID 2332 wrote to memory of 2600 2332 xrfrxfx.exe 44 PID 2332 wrote to memory of 2600 2332 xrfrxfx.exe 44 PID 2332 wrote to memory of 2600 2332 xrfrxfx.exe 44 PID 2332 wrote to memory of 2600 2332 xrfrxfx.exe 44 PID 2600 wrote to memory of 2104 2600 hntnnb.exe 45 PID 2600 wrote to memory of 2104 2600 hntnnb.exe 45 PID 2600 wrote to memory of 2104 2600 hntnnb.exe 45 PID 2600 wrote to memory of 2104 2600 hntnnb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\45419a2b1c836cf7420af92256160300N.exe"C:\Users\Admin\AppData\Local\Temp\45419a2b1c836cf7420af92256160300N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\fxrrxrx.exec:\fxrrxrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\vjjjd.exec:\vjjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\htnttb.exec:\htnttb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\vvjvp.exec:\vvjvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\7rrxllx.exec:\7rrxllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\pvdvd.exec:\pvdvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\lxfxllf.exec:\lxfxllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\rllxrrf.exec:\rllxrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\vpjdp.exec:\vpjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\llfflrx.exec:\llfflrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\bbtthn.exec:\bbtthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\3xlrxfr.exec:\3xlrxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\hbbnnb.exec:\hbbnnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\xrfrxfx.exec:\xrfrxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\hntnnb.exec:\hntnnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\vddvd.exec:\vddvd.exe17⤵
- Executes dropped EXE
PID:2104 -
\??\c:\thbhtb.exec:\thbhtb.exe18⤵
- Executes dropped EXE
PID:1972 -
\??\c:\jpdjp.exec:\jpdjp.exe19⤵
- Executes dropped EXE
PID:1816 -
\??\c:\llfxrff.exec:\llfxrff.exe20⤵
- Executes dropped EXE
PID:2044 -
\??\c:\bbtbbn.exec:\bbtbbn.exe21⤵
- Executes dropped EXE
PID:1752 -
\??\c:\dpvpp.exec:\dpvpp.exe22⤵
- Executes dropped EXE
PID:1768 -
\??\c:\1xxrlrr.exec:\1xxrlrr.exe23⤵
- Executes dropped EXE
PID:2920 -
\??\c:\nbhnnn.exec:\nbhnnn.exe24⤵
- Executes dropped EXE
PID:524 -
\??\c:\xflffxr.exec:\xflffxr.exe25⤵
- Executes dropped EXE
PID:2016 -
\??\c:\bbbnbn.exec:\bbbnbn.exe26⤵
- Executes dropped EXE
PID:1780 -
\??\c:\jvvdv.exec:\jvvdv.exe27⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xxrllff.exec:\xxrllff.exe28⤵
- Executes dropped EXE
PID:2960 -
\??\c:\pddpj.exec:\pddpj.exe29⤵
- Executes dropped EXE
PID:1856 -
\??\c:\5lrffxf.exec:\5lrffxf.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2120 -
\??\c:\9hnbnh.exec:\9hnbnh.exe31⤵
- Executes dropped EXE
PID:2492 -
\??\c:\tnbnnh.exec:\tnbnnh.exe32⤵
- Executes dropped EXE
PID:1096 -
\??\c:\lfxxrrf.exec:\lfxxrrf.exe33⤵
- Executes dropped EXE
PID:568 -
\??\c:\lfrxllf.exec:\lfrxllf.exe34⤵
- Executes dropped EXE
PID:1920 -
\??\c:\hnnhhb.exec:\hnnhhb.exe35⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jpvpj.exec:\jpvpj.exe36⤵
- Executes dropped EXE
PID:480 -
\??\c:\7ppjv.exec:\7ppjv.exe37⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ddvpd.exec:\ddvpd.exe38⤵
- Executes dropped EXE
PID:2000 -
\??\c:\7frfrrx.exec:\7frfrrx.exe39⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hhhbbh.exec:\hhhbbh.exe40⤵
- Executes dropped EXE
PID:2192 -
\??\c:\bbbhbh.exec:\bbbhbh.exe41⤵
- Executes dropped EXE
PID:2356 -
\??\c:\3jdpp.exec:\3jdpp.exe42⤵
- Executes dropped EXE
PID:2512 -
\??\c:\dvvjd.exec:\dvvjd.exe43⤵
- Executes dropped EXE
PID:2540 -
\??\c:\xxxfxxr.exec:\xxxfxxr.exe44⤵
- Executes dropped EXE
PID:3020 -
\??\c:\rlllxxl.exec:\rlllxxl.exe45⤵
- Executes dropped EXE
PID:2464 -
\??\c:\7btthh.exec:\7btthh.exe46⤵
- Executes dropped EXE
PID:572 -
\??\c:\httbbt.exec:\httbbt.exe47⤵
- Executes dropped EXE
PID:2716 -
\??\c:\1pddj.exec:\1pddj.exe48⤵
- Executes dropped EXE
PID:2856 -
\??\c:\5ddjv.exec:\5ddjv.exe49⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rrxrxrf.exec:\rrxrxrf.exe50⤵
- Executes dropped EXE
PID:2744 -
\??\c:\tbnhhn.exec:\tbnhhn.exe51⤵
- Executes dropped EXE
PID:2648 -
\??\c:\htbthb.exec:\htbthb.exe52⤵
- Executes dropped EXE
PID:2724 -
\??\c:\dpvdp.exec:\dpvdp.exe53⤵
- Executes dropped EXE
PID:2616 -
\??\c:\pjjvd.exec:\pjjvd.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2664 -
\??\c:\fllffxf.exec:\fllffxf.exe55⤵
- Executes dropped EXE
PID:2688 -
\??\c:\llfxrlr.exec:\llfxrlr.exe56⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bbnhht.exec:\bbnhht.exe57⤵
- Executes dropped EXE
PID:2672 -
\??\c:\djpjj.exec:\djpjj.exe58⤵
- Executes dropped EXE
PID:2396 -
\??\c:\djjvv.exec:\djjvv.exe59⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xxlxfll.exec:\xxlxfll.exe60⤵
- Executes dropped EXE
PID:1728 -
\??\c:\1llxfrx.exec:\1llxfrx.exe61⤵
- Executes dropped EXE
PID:2352 -
\??\c:\hhhthn.exec:\hhhthn.exe62⤵
- Executes dropped EXE
PID:2700 -
\??\c:\hthbht.exec:\hthbht.exe63⤵
- Executes dropped EXE
PID:1348 -
\??\c:\jpdvv.exec:\jpdvv.exe64⤵
- Executes dropped EXE
PID:2792 -
\??\c:\7ddvd.exec:\7ddvd.exe65⤵
- Executes dropped EXE
PID:1736 -
\??\c:\flrrrff.exec:\flrrrff.exe66⤵PID:2988
-
\??\c:\tbhnnn.exec:\tbhnnn.exe67⤵PID:2876
-
\??\c:\bhttnh.exec:\bhttnh.exe68⤵PID:2272
-
\??\c:\jvjvj.exec:\jvjvj.exe69⤵PID:524
-
\??\c:\pppdv.exec:\pppdv.exe70⤵PID:2016
-
\??\c:\rflxlrr.exec:\rflxlrr.exe71⤵PID:1620
-
\??\c:\bnbtbb.exec:\bnbtbb.exe72⤵PID:2028
-
\??\c:\ntbttn.exec:\ntbttn.exe73⤵PID:1560
-
\??\c:\pjpjd.exec:\pjpjd.exe74⤵PID:1708
-
\??\c:\pppvv.exec:\pppvv.exe75⤵PID:948
-
\??\c:\rfxxlfl.exec:\rfxxlfl.exe76⤵PID:1060
-
\??\c:\llxrlff.exec:\llxrlff.exe77⤵PID:1036
-
\??\c:\bbntnn.exec:\bbntnn.exe78⤵PID:1568
-
\??\c:\pjvdp.exec:\pjvdp.exe79⤵PID:1544
-
\??\c:\1jvpp.exec:\1jvpp.exe80⤵PID:2076
-
\??\c:\xflxrlr.exec:\xflxrlr.exe81⤵PID:2284
-
\??\c:\frxrxxx.exec:\frxrxxx.exe82⤵PID:1928
-
\??\c:\bnhhtt.exec:\bnhhtt.exe83⤵PID:2236
-
\??\c:\tthtbh.exec:\tthtbh.exe84⤵PID:1604
-
\??\c:\ppppp.exec:\ppppp.exe85⤵PID:868
-
\??\c:\jdpvp.exec:\jdpvp.exe86⤵PID:2400
-
\??\c:\ffxrflf.exec:\ffxrflf.exe87⤵PID:2404
-
\??\c:\7thhtb.exec:\7thhtb.exe88⤵PID:2124
-
\??\c:\ttnhtn.exec:\ttnhtn.exe89⤵PID:1936
-
\??\c:\jjvjv.exec:\jjvjv.exe90⤵PID:2568
-
\??\c:\ppjdj.exec:\ppjdj.exe91⤵PID:2924
-
\??\c:\rrrxffr.exec:\rrrxffr.exe92⤵PID:2704
-
\??\c:\rrrlxfr.exec:\rrrlxfr.exe93⤵PID:2188
-
\??\c:\tnhhtt.exec:\tnhhtt.exe94⤵PID:2884
-
\??\c:\pjpdj.exec:\pjpdj.exe95⤵PID:2836
-
\??\c:\7jjpv.exec:\7jjpv.exe96⤵PID:2888
-
\??\c:\fllxlrf.exec:\fllxlrf.exe97⤵PID:2436
-
\??\c:\7hntbn.exec:\7hntbn.exe98⤵PID:2460
-
\??\c:\ttnbnt.exec:\ttnbnt.exe99⤵PID:2636
-
\??\c:\pppdv.exec:\pppdv.exe100⤵PID:2660
-
\??\c:\7lflrfr.exec:\7lflrfr.exe101⤵PID:1960
-
\??\c:\xrrrfrx.exec:\xrrrfrx.exe102⤵PID:1740
-
\??\c:\9hhthn.exec:\9hhthn.exe103⤵PID:2736
-
\??\c:\xfrffxx.exec:\xfrffxx.exe104⤵PID:1672
-
\??\c:\tnnthn.exec:\tnnthn.exe105⤵PID:2396
-
\??\c:\tttnhn.exec:\tttnhn.exe106⤵PID:2036
-
\??\c:\pvpjp.exec:\pvpjp.exe107⤵PID:1712
-
\??\c:\vvjdv.exec:\vvjdv.exe108⤵PID:1788
-
\??\c:\frfxxlf.exec:\frfxxlf.exe109⤵PID:2828
-
\??\c:\nnthth.exec:\nnthth.exe110⤵PID:2912
-
\??\c:\ddppv.exec:\ddppv.exe111⤵PID:316
-
\??\c:\lfflflf.exec:\lfflflf.exe112⤵PID:2712
-
\??\c:\nthnnh.exec:\nthnnh.exe113⤵PID:2948
-
\??\c:\dvvvj.exec:\dvvvj.exe114⤵PID:3016
-
\??\c:\lrxrxxx.exec:\lrxrxxx.exe115⤵PID:2920
-
\??\c:\bbbhtt.exec:\bbbhtt.exe116⤵PID:2872
-
\??\c:\pjjpv.exec:\pjjpv.exe117⤵PID:524
-
\??\c:\hnbttn.exec:\hnbttn.exe118⤵PID:2016
-
\??\c:\vddvv.exec:\vddvv.exe119⤵PID:2208
-
\??\c:\hnbbnn.exec:\hnbbnn.exe120⤵PID:2328
-
\??\c:\hnnbnh.exec:\hnnbnh.exe121⤵PID:1804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-