Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26/07/2024, 07:30
Behavioral task
behavioral1
Sample
a08d8bea53938e523b77ba5ee9f00be0N.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
120 seconds
General
-
Target
a08d8bea53938e523b77ba5ee9f00be0N.exe
-
Size
81KB
-
MD5
a08d8bea53938e523b77ba5ee9f00be0
-
SHA1
edb2209c4287f4e1ea6f5545e6c510f1fa25e57c
-
SHA256
b88c7d0e93dddcef3c62c8fdc646e868cd9446f0d57237d988b3ca74795bb582
-
SHA512
bf531cd7ecf455efec734ac252bd26b6c2389174cde9c296b12d6654ca1432ff2fd89a179d9979ba229cc25e8bf163fd7b809680000ec2e721c8f6be48cbab0b
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8yaVskCzYBbKd+XsWgADUOjgRpnzQr:9hOmTsF93UYfwC6GIoutyaVszyKd+XY+
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2760-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-31-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2744-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/332-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1592-546-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-1373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-1366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1204-881-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2780-704-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-666-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-633-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-596-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2072-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1680-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/560-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/332-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2828 7hhtht.exe 2800 jvppv.exe 2744 flfrfll.exe 2116 9rrlfrf.exe 2568 nnnnhn.exe 2108 9jpjv.exe 2000 jjdjd.exe 3044 llflxxl.exe 2180 rrflxrl.exe 1588 rlxfxxf.exe 2728 hnhbbt.exe 1844 tthhtt.exe 484 dvvpv.exe 2916 rxlrxxr.exe 3032 ffrfrxl.exe 2068 lllfrxl.exe 332 7nhnbh.exe 2432 nthbhb.exe 2244 vddjd.exe 2284 rfflrxl.exe 1608 rlffrxr.exe 596 9hthtt.exe 2496 btntht.exe 2516 jjdpj.exe 2500 pppvp.exe 1628 fflxxlf.exe 560 nhthth.exe 1916 hbntbh.exe 328 jddpd.exe 2344 5ppvj.exe 1680 frrrxrf.exe 864 frxflff.exe 2704 9bbnht.exe 1524 nhttbb.exe 2668 hhhtnb.exe 2800 jjvdp.exe 2852 pdvdp.exe 2548 lflrflx.exe 2580 1xflxxf.exe 2072 nnbbnn.exe 2108 3hbbbh.exe 2392 vpvdp.exe 3044 pjvdv.exe 2180 rlxrflx.exe 1936 rfffxfr.exe 1944 bbthbh.exe 2060 nhhtbb.exe 2620 5vdpv.exe 484 5vjvj.exe 2916 lfxlrfx.exe 1872 ffxfrxl.exe 1320 5bnbhn.exe 2068 7bthnt.exe 332 ntbnbt.exe 1540 vpvdv.exe 2924 1vddj.exe 2856 ffrfrxf.exe 1980 rfxxflr.exe 1740 nhhhbt.exe 816 ntbhth.exe 596 bttbbh.exe 2948 3vpvd.exe 1684 9dvjp.exe 2228 5lxrxfl.exe -
resource yara_rule behavioral1/memory/2760-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000120f9-7.dat upx behavioral1/memory/2828-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2800-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000015d93-18.dat upx behavioral1/files/0x0008000000015d9e-27.dat upx behavioral1/memory/2828-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2744-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2116-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015dbf-46.dat upx behavioral1/memory/2568-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2116-45-0x00000000002B0000-0x00000000002D7000-memory.dmp upx behavioral1/files/0x0007000000015e87-54.dat upx behavioral1/files/0x0007000000015f8b-66.dat upx behavioral1/files/0x000900000001613b-86.dat upx behavioral1/memory/2180-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2180-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000161fd-95.dat upx behavioral1/files/0x0006000000016db0-102.dat upx behavioral1/memory/2728-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dc7-112.dat upx behavioral1/files/0x0006000000016ddf-127.dat upx behavioral1/files/0x0006000000016eb4-136.dat upx behavioral1/files/0x0006000000017073-152.dat upx behavioral1/memory/332-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017400-173.dat upx behavioral1/files/0x0006000000017409-189.dat upx behavioral1/files/0x000600000001748d-206.dat upx behavioral1/files/0x00060000000174ab-216.dat upx behavioral1/files/0x000600000001752e-223.dat upx behavioral1/files/0x000900000001866c-233.dat upx behavioral1/memory/1628-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0011000000018676-241.dat upx behavioral1/memory/2668-309-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2852-323-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1936-377-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1592-546-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-659-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1232-748-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2180-1169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2892-1373-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2668-1366-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1404-1251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2968-1208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1924-1201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2404-1194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2944-1113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1784-956-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2036-949-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2440-900-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2300-741-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2780-704-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/860-679-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-666-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2180-634-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2604-633-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2572-596-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2588-577-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1212-527-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/700-514-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2228-489-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/816-464-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2924-440-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1944-378-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2760 wrote to memory of 2828 2760 a08d8bea53938e523b77ba5ee9f00be0N.exe 31 PID 2760 wrote to memory of 2828 2760 a08d8bea53938e523b77ba5ee9f00be0N.exe 31 PID 2760 wrote to memory of 2828 2760 a08d8bea53938e523b77ba5ee9f00be0N.exe 31 PID 2760 wrote to memory of 2828 2760 a08d8bea53938e523b77ba5ee9f00be0N.exe 31 PID 2828 wrote to memory of 2800 2828 7hhtht.exe 66 PID 2828 wrote to memory of 2800 2828 7hhtht.exe 66 PID 2828 wrote to memory of 2800 2828 7hhtht.exe 66 PID 2828 wrote to memory of 2800 2828 7hhtht.exe 66 PID 2800 wrote to memory of 2744 2800 jvppv.exe 109 PID 2800 wrote to memory of 2744 2800 jvppv.exe 109 PID 2800 wrote to memory of 2744 2800 jvppv.exe 109 PID 2800 wrote to memory of 2744 2800 jvppv.exe 109 PID 2744 wrote to memory of 2116 2744 flfrfll.exe 238 PID 2744 wrote to memory of 2116 2744 flfrfll.exe 238 PID 2744 wrote to memory of 2116 2744 flfrfll.exe 238 PID 2744 wrote to memory of 2116 2744 flfrfll.exe 238 PID 2116 wrote to memory of 2568 2116 9rrlfrf.exe 242 PID 2116 wrote to memory of 2568 2116 9rrlfrf.exe 242 PID 2116 wrote to memory of 2568 2116 9rrlfrf.exe 242 PID 2116 wrote to memory of 2568 2116 9rrlfrf.exe 242 PID 2568 wrote to memory of 2108 2568 nnnnhn.exe 36 PID 2568 wrote to memory of 2108 2568 nnnnhn.exe 36 PID 2568 wrote to memory of 2108 2568 nnnnhn.exe 36 PID 2568 wrote to memory of 2108 2568 nnnnhn.exe 36 PID 2108 wrote to memory of 2000 2108 9jpjv.exe 37 PID 2108 wrote to memory of 2000 2108 9jpjv.exe 37 PID 2108 wrote to memory of 2000 2108 9jpjv.exe 37 PID 2108 wrote to memory of 2000 2108 9jpjv.exe 37 PID 2000 wrote to memory of 3044 2000 jjdjd.exe 73 PID 2000 wrote to memory of 3044 2000 jjdjd.exe 73 PID 2000 wrote to memory of 3044 2000 jjdjd.exe 73 PID 2000 wrote to memory of 3044 2000 jjdjd.exe 73 PID 3044 wrote to memory of 2180 3044 llflxxl.exe 39 PID 3044 wrote to memory of 2180 3044 llflxxl.exe 39 PID 3044 wrote to memory of 2180 3044 llflxxl.exe 39 PID 3044 wrote to memory of 2180 3044 llflxxl.exe 39 PID 2180 wrote to memory of 1588 2180 rrflxrl.exe 40 PID 2180 wrote to memory of 1588 2180 rrflxrl.exe 40 PID 2180 wrote to memory of 1588 2180 rrflxrl.exe 40 PID 2180 wrote to memory of 1588 2180 rrflxrl.exe 40 PID 1588 wrote to memory of 2728 1588 rlxfxxf.exe 118 PID 1588 wrote to memory of 2728 1588 rlxfxxf.exe 118 PID 1588 wrote to memory of 2728 1588 rlxfxxf.exe 118 PID 1588 wrote to memory of 2728 1588 rlxfxxf.exe 118 PID 2728 wrote to memory of 1844 2728 hnhbbt.exe 249 PID 2728 wrote to memory of 1844 2728 hnhbbt.exe 249 PID 2728 wrote to memory of 1844 2728 hnhbbt.exe 249 PID 2728 wrote to memory of 1844 2728 hnhbbt.exe 249 PID 1844 wrote to memory of 484 1844 tthhtt.exe 79 PID 1844 wrote to memory of 484 1844 tthhtt.exe 79 PID 1844 wrote to memory of 484 1844 tthhtt.exe 79 PID 1844 wrote to memory of 484 1844 tthhtt.exe 79 PID 484 wrote to memory of 2916 484 dvvpv.exe 44 PID 484 wrote to memory of 2916 484 dvvpv.exe 44 PID 484 wrote to memory of 2916 484 dvvpv.exe 44 PID 484 wrote to memory of 2916 484 dvvpv.exe 44 PID 2916 wrote to memory of 3032 2916 rxlrxxr.exe 45 PID 2916 wrote to memory of 3032 2916 rxlrxxr.exe 45 PID 2916 wrote to memory of 3032 2916 rxlrxxr.exe 45 PID 2916 wrote to memory of 3032 2916 rxlrxxr.exe 45 PID 3032 wrote to memory of 2068 3032 ffrfrxl.exe 46 PID 3032 wrote to memory of 2068 3032 ffrfrxl.exe 46 PID 3032 wrote to memory of 2068 3032 ffrfrxl.exe 46 PID 3032 wrote to memory of 2068 3032 ffrfrxl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\a08d8bea53938e523b77ba5ee9f00be0N.exe"C:\Users\Admin\AppData\Local\Temp\a08d8bea53938e523b77ba5ee9f00be0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\7hhtht.exec:\7hhtht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\jvppv.exec:\jvppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\flfrfll.exec:\flfrfll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\9rrlfrf.exec:\9rrlfrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\nnnnhn.exec:\nnnnhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\9jpjv.exec:\9jpjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\jjdjd.exec:\jjdjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\llflxxl.exec:\llflxxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\rrflxrl.exec:\rrflxrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\rlxfxxf.exec:\rlxfxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\hnhbbt.exec:\hnhbbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\tthhtt.exec:\tthhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\dvvpv.exec:\dvvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\rxlrxxr.exec:\rxlrxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\ffrfrxl.exec:\ffrfrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\lllfrxl.exec:\lllfrxl.exe17⤵
- Executes dropped EXE
PID:2068 -
\??\c:\7nhnbh.exec:\7nhnbh.exe18⤵
- Executes dropped EXE
PID:332 -
\??\c:\nthbhb.exec:\nthbhb.exe19⤵
- Executes dropped EXE
PID:2432 -
\??\c:\vddjd.exec:\vddjd.exe20⤵
- Executes dropped EXE
PID:2244 -
\??\c:\rfflrxl.exec:\rfflrxl.exe21⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rlffrxr.exec:\rlffrxr.exe22⤵
- Executes dropped EXE
PID:1608 -
\??\c:\9hthtt.exec:\9hthtt.exe23⤵
- Executes dropped EXE
PID:596 -
\??\c:\btntht.exec:\btntht.exe24⤵
- Executes dropped EXE
PID:2496 -
\??\c:\jjdpj.exec:\jjdpj.exe25⤵
- Executes dropped EXE
PID:2516 -
\??\c:\pppvp.exec:\pppvp.exe26⤵
- Executes dropped EXE
PID:2500 -
\??\c:\fflxxlf.exec:\fflxxlf.exe27⤵
- Executes dropped EXE
PID:1628 -
\??\c:\nhthth.exec:\nhthth.exe28⤵
- Executes dropped EXE
PID:560 -
\??\c:\hbntbh.exec:\hbntbh.exe29⤵
- Executes dropped EXE
PID:1916 -
\??\c:\jddpd.exec:\jddpd.exe30⤵
- Executes dropped EXE
PID:328 -
\??\c:\5ppvj.exec:\5ppvj.exe31⤵
- Executes dropped EXE
PID:2344 -
\??\c:\frrrxrf.exec:\frrrxrf.exe32⤵
- Executes dropped EXE
PID:1680 -
\??\c:\frxflff.exec:\frxflff.exe33⤵
- Executes dropped EXE
PID:864 -
\??\c:\9bbnht.exec:\9bbnht.exe34⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nhttbb.exec:\nhttbb.exe35⤵
- Executes dropped EXE
PID:1524 -
\??\c:\hhhtnb.exec:\hhhtnb.exe36⤵
- Executes dropped EXE
PID:2668 -
\??\c:\jjvdp.exec:\jjvdp.exe37⤵
- Executes dropped EXE
PID:2800 -
\??\c:\pdvdp.exec:\pdvdp.exe38⤵
- Executes dropped EXE
PID:2852 -
\??\c:\lflrflx.exec:\lflrflx.exe39⤵
- Executes dropped EXE
PID:2548 -
\??\c:\1xflxxf.exec:\1xflxxf.exe40⤵
- Executes dropped EXE
PID:2580 -
\??\c:\nnbbnn.exec:\nnbbnn.exe41⤵
- Executes dropped EXE
PID:2072 -
\??\c:\3hbbbh.exec:\3hbbbh.exe42⤵
- Executes dropped EXE
PID:2108 -
\??\c:\vpvdp.exec:\vpvdp.exe43⤵
- Executes dropped EXE
PID:2392 -
\??\c:\pjvdv.exec:\pjvdv.exe44⤵
- Executes dropped EXE
PID:3044 -
\??\c:\rlxrflx.exec:\rlxrflx.exe45⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rfffxfr.exec:\rfffxfr.exe46⤵
- Executes dropped EXE
PID:1936 -
\??\c:\bbthbh.exec:\bbthbh.exe47⤵
- Executes dropped EXE
PID:1944 -
\??\c:\nhhtbb.exec:\nhhtbb.exe48⤵
- Executes dropped EXE
PID:2060 -
\??\c:\5vdpv.exec:\5vdpv.exe49⤵
- Executes dropped EXE
PID:2620 -
\??\c:\5vjvj.exec:\5vjvj.exe50⤵
- Executes dropped EXE
PID:484 -
\??\c:\lfxlrfx.exec:\lfxlrfx.exe51⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ffxfrxl.exec:\ffxfrxl.exe52⤵
- Executes dropped EXE
PID:1872 -
\??\c:\5bnbhn.exec:\5bnbhn.exe53⤵
- Executes dropped EXE
PID:1320 -
\??\c:\7bthnt.exec:\7bthnt.exe54⤵
- Executes dropped EXE
PID:2068 -
\??\c:\ntbnbt.exec:\ntbnbt.exe55⤵
- Executes dropped EXE
PID:332 -
\??\c:\vpvdv.exec:\vpvdv.exe56⤵
- Executes dropped EXE
PID:1540 -
\??\c:\1vddj.exec:\1vddj.exe57⤵
- Executes dropped EXE
PID:2924 -
\??\c:\ffrfrxf.exec:\ffrfrxf.exe58⤵
- Executes dropped EXE
PID:2856 -
\??\c:\rfxxflr.exec:\rfxxflr.exe59⤵
- Executes dropped EXE
PID:1980 -
\??\c:\nhhhbt.exec:\nhhhbt.exe60⤵
- Executes dropped EXE
PID:1740 -
\??\c:\ntbhth.exec:\ntbhth.exe61⤵
- Executes dropped EXE
PID:816 -
\??\c:\bttbbh.exec:\bttbbh.exe62⤵
- Executes dropped EXE
PID:596 -
\??\c:\3vpvd.exec:\3vpvd.exe63⤵
- Executes dropped EXE
PID:2948 -
\??\c:\9dvjp.exec:\9dvjp.exe64⤵
- Executes dropped EXE
PID:1684 -
\??\c:\5lxrxfl.exec:\5lxrxfl.exe65⤵
- Executes dropped EXE
PID:2228 -
\??\c:\xxlfffr.exec:\xxlfffr.exe66⤵PID:2268
-
\??\c:\nhtbnb.exec:\nhtbnb.exe67⤵PID:276
-
\??\c:\tnttnh.exec:\tnttnh.exe68⤵PID:560
-
\??\c:\dvpdj.exec:\dvpdj.exe69⤵
- System Location Discovery: System Language Discovery
PID:700 -
\??\c:\1pjjv.exec:\1pjjv.exe70⤵PID:2636
-
\??\c:\fxrxflf.exec:\fxrxflf.exe71⤵PID:1212
-
\??\c:\rrrrxxl.exec:\rrrrxxl.exe72⤵PID:2104
-
\??\c:\fxxfrrx.exec:\fxxfrrx.exe73⤵PID:1592
-
\??\c:\tnnnhb.exec:\tnnnhb.exe74⤵PID:2980
-
\??\c:\nnbtnn.exec:\nnbtnn.exe75⤵PID:1528
-
\??\c:\7jdvp.exec:\7jdvp.exe76⤵PID:2836
-
\??\c:\vpvdv.exec:\vpvdv.exe77⤵PID:2416
-
\??\c:\vpjvp.exec:\vpjvp.exe78⤵PID:2884
-
\??\c:\7rllxfl.exec:\7rllxfl.exe79⤵PID:2588
-
\??\c:\fxlrffr.exec:\fxlrffr.exe80⤵PID:2744
-
\??\c:\xllfflr.exec:\xllfflr.exe81⤵PID:2628
-
\??\c:\9ttntb.exec:\9ttntb.exe82⤵PID:2572
-
\??\c:\vdvpv.exec:\vdvpv.exe83⤵PID:992
-
\??\c:\fxlrrxf.exec:\fxlrrxf.exe84⤵PID:2072
-
\??\c:\9xxrflx.exec:\9xxrflx.exe85⤵PID:2792
-
\??\c:\7hhhbh.exec:\7hhhbh.exe86⤵PID:1108
-
\??\c:\nbthtt.exec:\nbthtt.exe87⤵PID:2604
-
\??\c:\nthtnt.exec:\nthtnt.exe88⤵PID:2180
-
\??\c:\3ppjp.exec:\3ppjp.exe89⤵PID:2728
-
\??\c:\jjvpd.exec:\jjvpd.exe90⤵PID:640
-
\??\c:\5llxllx.exec:\5llxllx.exe91⤵PID:1928
-
\??\c:\3xlxxxr.exec:\3xlxxxr.exe92⤵PID:2888
-
\??\c:\fxffrrf.exec:\fxffrrf.exe93⤵PID:1924
-
\??\c:\7bhthn.exec:\7bhthn.exe94⤵PID:3032
-
\??\c:\bnbnhh.exec:\bnbnhh.exe95⤵PID:860
-
\??\c:\7pdvd.exec:\7pdvd.exe96⤵PID:2364
-
\??\c:\1ppdp.exec:\1ppdp.exe97⤵PID:2068
-
\??\c:\ffxrflf.exec:\ffxrflf.exe98⤵PID:2780
-
\??\c:\fxffflr.exec:\fxffflr.exe99⤵PID:3016
-
\??\c:\httttb.exec:\httttb.exe100⤵PID:1604
-
\??\c:\hhnnnn.exec:\hhnnnn.exe101⤵PID:1724
-
\??\c:\1nntht.exec:\1nntht.exe102⤵PID:576
-
\??\c:\ppppp.exec:\ppppp.exe103⤵PID:1688
-
\??\c:\jvjdv.exec:\jvjdv.exe104⤵PID:2528
-
\??\c:\xrlrrrx.exec:\xrlrrrx.exe105⤵PID:2300
-
\??\c:\lfxrrfl.exec:\lfxrrfl.exe106⤵PID:1232
-
\??\c:\rlrrffr.exec:\rlrrffr.exe107⤵PID:1684
-
\??\c:\btbbnt.exec:\btbbnt.exe108⤵PID:2228
-
\??\c:\hhnttn.exec:\hhnttn.exe109⤵PID:2268
-
\??\c:\jjvvp.exec:\jjvvp.exe110⤵PID:276
-
\??\c:\vpjjj.exec:\vpjjj.exe111⤵PID:560
-
\??\c:\1jdpv.exec:\1jdpv.exe112⤵PID:2360
-
\??\c:\xrfflrf.exec:\xrfflrf.exe113⤵PID:2720
-
\??\c:\fxrxrrr.exec:\fxrxrrr.exe114⤵PID:1288
-
\??\c:\tnntbh.exec:\tnntbh.exe115⤵PID:3068
-
\??\c:\5tnbnh.exec:\5tnbnh.exe116⤵PID:2828
-
\??\c:\1bbtnh.exec:\1bbtnh.exe117⤵PID:1544
-
\??\c:\djpdv.exec:\djpdv.exe118⤵PID:2936
-
\??\c:\vvjpp.exec:\vvjpp.exe119⤵PID:352
-
\??\c:\flrlrll.exec:\flrlrll.exe120⤵PID:2908
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe121⤵PID:2944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-