Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
59s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27/07/2024, 03:36
Behavioral task
behavioral1
Sample
c6de709f436a31781460b481f89ff98b474b035e83c590f7b7631ac4a8daf313.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
150 seconds
General
-
Target
c6de709f436a31781460b481f89ff98b474b035e83c590f7b7631ac4a8daf313.exe
-
Size
403KB
-
MD5
2d02bbbbee4eca264222060e56c3c259
-
SHA1
68723c3714360dd47f35aea222acc909562b1369
-
SHA256
c6de709f436a31781460b481f89ff98b474b035e83c590f7b7631ac4a8daf313
-
SHA512
1ec90efebf4a0d7f5c6fce19b19b28dbd0598bb265e2f6edf3c19751d3c8ca851603bf2c5ad9cee51ca0f42438743c23b3b0f4ca24fe4ae9e6b4761132a10b83
-
SSDEEP
6144:Jcm4FmowdHoSEubDcAkOCOu0EajNVBZr6y2WXxLO1UqW9E3N:T4wFHoSEubD2P3N
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2716-11-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2676-29-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2672-26-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2640-40-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2640-50-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2836-44-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2604-58-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1944-72-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1644-77-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2388-89-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2388-88-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2776-107-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2776-106-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1412-126-0x00000000003C0000-0x00000000003E8000-memory.dmp family_blackmoon behavioral1/memory/2588-127-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1412-134-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2944-147-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2908-175-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/288-202-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1836-206-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/1836-211-0x00000000001B0000-0x00000000001D8000-memory.dmp family_blackmoon behavioral1/memory/1836-210-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1760-231-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1760-234-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/992-248-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2480-268-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1436-296-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1196-313-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1520-320-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2788-330-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2712-337-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2836-351-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2836-357-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2580-367-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2624-389-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1904-422-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2772-431-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1908-449-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1728-468-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2756-475-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2756-473-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2256-489-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1724-498-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2212-536-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2716 hhnnnh.exe 2676 xrllrrf.exe 2836 bttntb.exe 2640 fflflfx.exe 2604 bhhtnt.exe 1944 thntbh.exe 1644 hthbtt.exe 2388 ffllxlr.exe 1064 hnttnh.exe 2776 thnhbn.exe 2072 ttnthh.exe 1412 lrrrrrx.exe 2588 lrlfrlf.exe 2944 xlffllr.exe 1020 bntnht.exe 2904 tnnhtt.exe 2908 djvpv.exe 2256 ttthtb.exe 1912 rxfrxxf.exe 288 btbtbb.exe 1836 tbbnht.exe 1284 nbbtnn.exe 1760 jvdvd.exe 992 dppvj.exe 1700 rrlrflr.exe 2444 ntthhh.exe 2480 rxrxrrl.exe 1604 nthttn.exe 2932 ppjjd.exe 1436 ddjvp.exe 276 vpvpp.exe 1196 7hhnhh.exe 1520 lrxxrfr.exe 2788 lrxlflr.exe 2712 jvdpd.exe 2560 xxlrrfl.exe 2864 rfxllrl.exe 2836 pdpvd.exe 2580 thhhnt.exe 592 bhbnbt.exe 2564 flxlrxl.exe 2624 9jdjd.exe 2372 3bnhtn.exe 2184 dppjv.exe 1064 dpjvj.exe 1236 frxrxxl.exe 1904 pjpvp.exe 776 hhhbbt.exe 2772 rrxrrlf.exe 2296 bnnnhn.exe 1908 vjpjd.exe 2856 jpppp.exe 1728 thbnht.exe 2756 xfrlrll.exe 2504 bhthbt.exe 2256 djpjp.exe 1724 bhtbbn.exe 2356 lxxrffx.exe 1860 djvvv.exe 2576 dpvpj.exe 944 nnnhhn.exe 2212 djvdp.exe 1240 7rrfxll.exe 1632 hnbbbn.exe -
resource yara_rule behavioral1/memory/2672-0-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0008000000012115-8.dat upx behavioral1/memory/2716-11-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2672-6-0x0000000000430000-0x0000000000458000-memory.dmp upx behavioral1/files/0x0008000000016ccd-18.dat upx behavioral1/files/0x0007000000016ceb-27.dat upx behavioral1/memory/2676-29-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2672-26-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0008000000016d20-36.dat upx behavioral1/memory/2836-38-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2640-40-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0007000000016d39-49.dat upx behavioral1/memory/2836-44-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0035000000016b27-59.dat upx behavioral1/memory/2604-58-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1944-69-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/files/0x0007000000016d41-70.dat upx behavioral1/memory/1944-72-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0007000000016d49-78.dat upx behavioral1/memory/1644-77-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0009000000016d5d-86.dat upx behavioral1/memory/2388-88-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0009000000016d62-97.dat upx behavioral1/memory/2776-98-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x00050000000186e9-105.dat upx behavioral1/files/0x00050000000186f7-116.dat upx behavioral1/memory/2588-127-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0005000000018722-125.dat upx behavioral1/files/0x0005000000018736-137.dat upx behavioral1/memory/1412-134-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x000500000001877f-148.dat upx behavioral1/memory/2944-147-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x000500000001878c-154.dat upx behavioral1/files/0x000500000001879f-164.dat upx behavioral1/memory/2908-167-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2908-175-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0006000000018bfc-177.dat upx behavioral1/files/0x000500000001923b-184.dat upx behavioral1/files/0x000500000001923d-191.dat upx behavioral1/memory/288-193-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/288-202-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x000500000001925c-200.dat upx behavioral1/memory/1836-206-0x00000000001B0000-0x00000000001D8000-memory.dmp upx behavioral1/files/0x0005000000019260-212.dat upx behavioral1/memory/1836-210-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0005000000019279-222.dat upx behavioral1/files/0x000500000001927c-229.dat upx behavioral1/memory/1760-234-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0005000000019330-239.dat upx behavioral1/files/0x000500000001934a-249.dat upx behavioral1/memory/992-248-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0005000000019398-259.dat upx behavioral1/memory/2480-258-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x00050000000193aa-269.dat upx behavioral1/memory/2480-268-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x00050000000193ae-277.dat upx behavioral1/files/0x00050000000193bc-284.dat upx behavioral1/files/0x000500000001943b-294.dat upx behavioral1/memory/1436-296-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/files/0x0005000000019449-303.dat upx behavioral1/memory/1196-313-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2788-330-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2788-328-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2712-337-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxllxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfflrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ththnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxfxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bthht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1llxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llxrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2716 2672 c6de709f436a31781460b481f89ff98b474b035e83c590f7b7631ac4a8daf313.exe 30 PID 2672 wrote to memory of 2716 2672 c6de709f436a31781460b481f89ff98b474b035e83c590f7b7631ac4a8daf313.exe 30 PID 2672 wrote to memory of 2716 2672 c6de709f436a31781460b481f89ff98b474b035e83c590f7b7631ac4a8daf313.exe 30 PID 2672 wrote to memory of 2716 2672 c6de709f436a31781460b481f89ff98b474b035e83c590f7b7631ac4a8daf313.exe 30 PID 2716 wrote to memory of 2676 2716 hhnnnh.exe 31 PID 2716 wrote to memory of 2676 2716 hhnnnh.exe 31 PID 2716 wrote to memory of 2676 2716 hhnnnh.exe 31 PID 2716 wrote to memory of 2676 2716 hhnnnh.exe 31 PID 2676 wrote to memory of 2836 2676 xrllrrf.exe 32 PID 2676 wrote to memory of 2836 2676 xrllrrf.exe 32 PID 2676 wrote to memory of 2836 2676 xrllrrf.exe 32 PID 2676 wrote to memory of 2836 2676 xrllrrf.exe 32 PID 2836 wrote to memory of 2640 2836 bttntb.exe 33 PID 2836 wrote to memory of 2640 2836 bttntb.exe 33 PID 2836 wrote to memory of 2640 2836 bttntb.exe 33 PID 2836 wrote to memory of 2640 2836 bttntb.exe 33 PID 2640 wrote to memory of 2604 2640 fflflfx.exe 34 PID 2640 wrote to memory of 2604 2640 fflflfx.exe 34 PID 2640 wrote to memory of 2604 2640 fflflfx.exe 34 PID 2640 wrote to memory of 2604 2640 fflflfx.exe 34 PID 2604 wrote to memory of 1944 2604 bhhtnt.exe 35 PID 2604 wrote to memory of 1944 2604 bhhtnt.exe 35 PID 2604 wrote to memory of 1944 2604 bhhtnt.exe 35 PID 2604 wrote to memory of 1944 2604 bhhtnt.exe 35 PID 1944 wrote to memory of 1644 1944 thntbh.exe 36 PID 1944 wrote to memory of 1644 1944 thntbh.exe 36 PID 1944 wrote to memory of 1644 1944 thntbh.exe 36 PID 1944 wrote to memory of 1644 1944 thntbh.exe 36 PID 1644 wrote to memory of 2388 1644 hthbtt.exe 37 PID 1644 wrote to memory of 2388 1644 hthbtt.exe 37 PID 1644 wrote to memory of 2388 1644 hthbtt.exe 37 PID 1644 wrote to memory of 2388 1644 hthbtt.exe 37 PID 2388 wrote to memory of 1064 2388 ffllxlr.exe 74 PID 2388 wrote to memory of 1064 2388 ffllxlr.exe 74 PID 2388 wrote to memory of 1064 2388 ffllxlr.exe 74 PID 2388 wrote to memory of 1064 2388 ffllxlr.exe 74 PID 1064 wrote to memory of 2776 1064 hnttnh.exe 39 PID 1064 wrote to memory of 2776 1064 hnttnh.exe 39 PID 1064 wrote to memory of 2776 1064 hnttnh.exe 39 PID 1064 wrote to memory of 2776 1064 hnttnh.exe 39 PID 2776 wrote to memory of 2072 2776 thnhbn.exe 40 PID 2776 wrote to memory of 2072 2776 thnhbn.exe 40 PID 2776 wrote to memory of 2072 2776 thnhbn.exe 40 PID 2776 wrote to memory of 2072 2776 thnhbn.exe 40 PID 2072 wrote to memory of 1412 2072 ttnthh.exe 41 PID 2072 wrote to memory of 1412 2072 ttnthh.exe 41 PID 2072 wrote to memory of 1412 2072 ttnthh.exe 41 PID 2072 wrote to memory of 1412 2072 ttnthh.exe 41 PID 1412 wrote to memory of 2588 1412 lrrrrrx.exe 42 PID 1412 wrote to memory of 2588 1412 lrrrrrx.exe 42 PID 1412 wrote to memory of 2588 1412 lrrrrrx.exe 42 PID 1412 wrote to memory of 2588 1412 lrrrrrx.exe 42 PID 2588 wrote to memory of 2944 2588 lrlfrlf.exe 43 PID 2588 wrote to memory of 2944 2588 lrlfrlf.exe 43 PID 2588 wrote to memory of 2944 2588 lrlfrlf.exe 43 PID 2588 wrote to memory of 2944 2588 lrlfrlf.exe 43 PID 2944 wrote to memory of 1020 2944 xlffllr.exe 44 PID 2944 wrote to memory of 1020 2944 xlffllr.exe 44 PID 2944 wrote to memory of 1020 2944 xlffllr.exe 44 PID 2944 wrote to memory of 1020 2944 xlffllr.exe 44 PID 1020 wrote to memory of 2904 1020 bntnht.exe 45 PID 1020 wrote to memory of 2904 1020 bntnht.exe 45 PID 1020 wrote to memory of 2904 1020 bntnht.exe 45 PID 1020 wrote to memory of 2904 1020 bntnht.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6de709f436a31781460b481f89ff98b474b035e83c590f7b7631ac4a8daf313.exe"C:\Users\Admin\AppData\Local\Temp\c6de709f436a31781460b481f89ff98b474b035e83c590f7b7631ac4a8daf313.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\hhnnnh.exec:\hhnnnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\xrllrrf.exec:\xrllrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\bttntb.exec:\bttntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\fflflfx.exec:\fflflfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\bhhtnt.exec:\bhhtnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\thntbh.exec:\thntbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\hthbtt.exec:\hthbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\ffllxlr.exec:\ffllxlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\hnttnh.exec:\hnttnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\thnhbn.exec:\thnhbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\ttnthh.exec:\ttnthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\lrrrrrx.exec:\lrrrrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\lrlfrlf.exec:\lrlfrlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\xlffllr.exec:\xlffllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\bntnht.exec:\bntnht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\tnnhtt.exec:\tnnhtt.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2904 -
\??\c:\djvpv.exec:\djvpv.exe18⤵
- Executes dropped EXE
PID:2908 -
\??\c:\ttthtb.exec:\ttthtb.exe19⤵
- Executes dropped EXE
PID:2256 -
\??\c:\rxfrxxf.exec:\rxfrxxf.exe20⤵
- Executes dropped EXE
PID:1912 -
\??\c:\btbtbb.exec:\btbtbb.exe21⤵
- Executes dropped EXE
PID:288 -
\??\c:\tbbnht.exec:\tbbnht.exe22⤵
- Executes dropped EXE
PID:1836 -
\??\c:\nbbtnn.exec:\nbbtnn.exe23⤵
- Executes dropped EXE
PID:1284 -
\??\c:\jvdvd.exec:\jvdvd.exe24⤵
- Executes dropped EXE
PID:1760 -
\??\c:\dppvj.exec:\dppvj.exe25⤵
- Executes dropped EXE
PID:992 -
\??\c:\rrlrflr.exec:\rrlrflr.exe26⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ntthhh.exec:\ntthhh.exe27⤵
- Executes dropped EXE
PID:2444 -
\??\c:\rxrxrrl.exec:\rxrxrrl.exe28⤵
- Executes dropped EXE
PID:2480 -
\??\c:\nthttn.exec:\nthttn.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1604 -
\??\c:\ppjjd.exec:\ppjjd.exe30⤵
- Executes dropped EXE
PID:2932 -
\??\c:\ddjvp.exec:\ddjvp.exe31⤵
- Executes dropped EXE
PID:1436 -
\??\c:\vpvpp.exec:\vpvpp.exe32⤵
- Executes dropped EXE
PID:276 -
\??\c:\7hhnhh.exec:\7hhnhh.exe33⤵
- Executes dropped EXE
PID:1196 -
\??\c:\lrxxrfr.exec:\lrxxrfr.exe34⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lrxlflr.exec:\lrxlflr.exe35⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jvdpd.exec:\jvdpd.exe36⤵
- Executes dropped EXE
PID:2712 -
\??\c:\xxlrrfl.exec:\xxlrrfl.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2560 -
\??\c:\rfxllrl.exec:\rfxllrl.exe38⤵
- Executes dropped EXE
PID:2864 -
\??\c:\pdpvd.exec:\pdpvd.exe39⤵
- Executes dropped EXE
PID:2836 -
\??\c:\thhhnt.exec:\thhhnt.exe40⤵
- Executes dropped EXE
PID:2580 -
\??\c:\bhbnbt.exec:\bhbnbt.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:592 -
\??\c:\flxlrxl.exec:\flxlrxl.exe42⤵
- Executes dropped EXE
PID:2564 -
\??\c:\9jdjd.exec:\9jdjd.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3bnhtn.exec:\3bnhtn.exe44⤵
- Executes dropped EXE
PID:2372 -
\??\c:\dppjv.exec:\dppjv.exe45⤵
- Executes dropped EXE
PID:2184 -
\??\c:\dpjvj.exec:\dpjvj.exe46⤵
- Executes dropped EXE
PID:1064 -
\??\c:\frxrxxl.exec:\frxrxxl.exe47⤵
- Executes dropped EXE
PID:1236 -
\??\c:\pjpvp.exec:\pjpvp.exe48⤵
- Executes dropped EXE
PID:1904 -
\??\c:\hhhbbt.exec:\hhhbbt.exe49⤵
- Executes dropped EXE
PID:776 -
\??\c:\rrxrrlf.exec:\rrxrrlf.exe50⤵
- Executes dropped EXE
PID:2772 -
\??\c:\bnnnhn.exec:\bnnnhn.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2296 -
\??\c:\vjpjd.exec:\vjpjd.exe52⤵
- Executes dropped EXE
PID:1908 -
\??\c:\jpppp.exec:\jpppp.exe53⤵
- Executes dropped EXE
PID:2856 -
\??\c:\thbnht.exec:\thbnht.exe54⤵
- Executes dropped EXE
PID:1728 -
\??\c:\xfrlrll.exec:\xfrlrll.exe55⤵
- Executes dropped EXE
PID:2756 -
\??\c:\bhthbt.exec:\bhthbt.exe56⤵
- Executes dropped EXE
PID:2504 -
\??\c:\djpjp.exec:\djpjp.exe57⤵
- Executes dropped EXE
PID:2256 -
\??\c:\bhtbbn.exec:\bhtbbn.exe58⤵
- Executes dropped EXE
PID:1724 -
\??\c:\lxxrffx.exec:\lxxrffx.exe59⤵
- Executes dropped EXE
PID:2356 -
\??\c:\djvvv.exec:\djvvv.exe60⤵
- Executes dropped EXE
PID:1860 -
\??\c:\dpvpj.exec:\dpvpj.exe61⤵
- Executes dropped EXE
PID:2576 -
\??\c:\nnnhhn.exec:\nnnhhn.exe62⤵
- Executes dropped EXE
PID:944 -
\??\c:\djvdp.exec:\djvdp.exe63⤵
- Executes dropped EXE
PID:2212 -
\??\c:\7rrfxll.exec:\7rrfxll.exe64⤵
- Executes dropped EXE
PID:1240 -
\??\c:\hnbbbn.exec:\hnbbbn.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1632 -
\??\c:\bhbhhh.exec:\bhbhhh.exe66⤵PID:1708
-
\??\c:\lfrlrff.exec:\lfrlrff.exe67⤵PID:2304
-
\??\c:\ntbhnh.exec:\ntbhnh.exe68⤵PID:1496
-
\??\c:\rfxflrx.exec:\rfxflrx.exe69⤵PID:1360
-
\??\c:\vdpvj.exec:\vdpvj.exe70⤵PID:2284
-
\??\c:\nbnhtt.exec:\nbnhtt.exe71⤵PID:1000
-
\??\c:\ddvdd.exec:\ddvdd.exe72⤵PID:1736
-
\??\c:\rfrrlll.exec:\rfrrlll.exe73⤵PID:276
-
\??\c:\jdppd.exec:\jdppd.exe74⤵PID:2448
-
\??\c:\dpdpj.exec:\dpdpj.exe75⤵PID:2720
-
\??\c:\nhttbn.exec:\nhttbn.exe76⤵PID:2888
-
\??\c:\xflxrfx.exec:\xflxrfx.exe77⤵PID:2800
-
\??\c:\lrrxrfx.exec:\lrrxrfx.exe78⤵PID:2860
-
\??\c:\vjdpp.exec:\vjdpp.exe79⤵PID:2544
-
\??\c:\ntthbb.exec:\ntthbb.exe80⤵
- System Location Discovery: System Language Discovery
PID:2972 -
\??\c:\nhhtnh.exec:\nhhtnh.exe81⤵PID:1900
-
\??\c:\frlrxfl.exec:\frlrxfl.exe82⤵PID:832
-
\??\c:\nhtnbn.exec:\nhtnbn.exe83⤵PID:1100
-
\??\c:\thnnbn.exec:\thnnbn.exe84⤵PID:2380
-
\??\c:\jvdvv.exec:\jvdvv.exe85⤵PID:1744
-
\??\c:\1nhhbh.exec:\1nhhbh.exe86⤵PID:2112
-
\??\c:\flxxlxl.exec:\flxxlxl.exe87⤵PID:2736
-
\??\c:\jpvjj.exec:\jpvjj.exe88⤵PID:1896
-
\??\c:\nbbbnh.exec:\nbbbnh.exe89⤵PID:2056
-
\??\c:\pjjjv.exec:\pjjjv.exe90⤵PID:1892
-
\??\c:\bthhnt.exec:\bthhnt.exe91⤵PID:776
-
\??\c:\nnnnhn.exec:\nnnnhn.exe92⤵PID:1784
-
\??\c:\ddvdv.exec:\ddvdv.exe93⤵PID:2960
-
\??\c:\3htbbn.exec:\3htbbn.exe94⤵PID:1216
-
\??\c:\xxrxflx.exec:\xxrxflx.exe95⤵PID:340
-
\??\c:\jjdvp.exec:\jjdvp.exe96⤵PID:2192
-
\??\c:\hhnbhn.exec:\hhnbhn.exe97⤵PID:2292
-
\??\c:\xfrffrr.exec:\xfrffrr.exe98⤵PID:2344
-
\??\c:\djpvj.exec:\djpvj.exe99⤵PID:1080
-
\??\c:\tnthht.exec:\tnthht.exe100⤵PID:1724
-
\??\c:\frfffxx.exec:\frfffxx.exe101⤵PID:1184
-
\??\c:\dpvdv.exec:\dpvdv.exe102⤵PID:1836
-
\??\c:\htbbnb.exec:\htbbnb.exe103⤵PID:1284
-
\??\c:\hhtnnt.exec:\hhtnnt.exe104⤵PID:556
-
\??\c:\jjppj.exec:\jjppj.exe105⤵PID:944
-
\??\c:\ttbhth.exec:\ttbhth.exe106⤵PID:2160
-
\??\c:\9xrlxxr.exec:\9xrlxxr.exe107⤵PID:1864
-
\??\c:\ddjjp.exec:\ddjjp.exe108⤵PID:1880
-
\??\c:\hnbhnh.exec:\hnbhnh.exe109⤵PID:2216
-
\??\c:\flxfrrf.exec:\flxfrrf.exe110⤵
- System Location Discovery: System Language Discovery
PID:3008 -
\??\c:\5jjvj.exec:\5jjvj.exe111⤵PID:2288
-
\??\c:\nnbttb.exec:\nnbttb.exe112⤵PID:2932
-
\??\c:\ntbbnt.exec:\ntbbnt.exe113⤵PID:996
-
\??\c:\lffrrrx.exec:\lffrrrx.exe114⤵PID:888
-
\??\c:\ntnhhb.exec:\ntnhhb.exe115⤵
- System Location Discovery: System Language Discovery
PID:1420 -
\??\c:\flfxfrl.exec:\flfxfrl.exe116⤵
- System Location Discovery: System Language Discovery
PID:2156 -
\??\c:\dvvvj.exec:\dvvvj.exe117⤵PID:2636
-
\??\c:\ttttnn.exec:\ttttnn.exe118⤵PID:2384
-
\??\c:\lfrxrxx.exec:\lfrxrxx.exe119⤵PID:2820
-
\??\c:\vvjpp.exec:\vvjpp.exe120⤵PID:2732
-
\??\c:\vjjdd.exec:\vjjdd.exe121⤵PID:2860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-