Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
01/08/2024, 21:32
Behavioral task
behavioral1
Sample
265c56adf4b7ca4194ae622d454b0aa86453d3183794b7be86d85b81f3964837.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
General
-
Target
265c56adf4b7ca4194ae622d454b0aa86453d3183794b7be86d85b81f3964837.exe
-
Size
91KB
-
MD5
9f2a96104054e09ae5d146a6e1a01b0a
-
SHA1
08c80607c4cfedbf39e76c47fb62d313d414787c
-
SHA256
265c56adf4b7ca4194ae622d454b0aa86453d3183794b7be86d85b81f3964837
-
SHA512
f6eaf29b9f4f68c16251800493c27a84a2602fea6b8eedceb620ac4768ce0bb18aa17adf16992006c7a950a4c9f84a118466e28e4f77fd570837121d51b1d1d9
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w801ouAsG9ZoPEudJGdXRKX5etrv:xhOmTsF93UYfwC6GIout03Fv9KdJoQ4z
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2632-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2328-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1328-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-108-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1524-106-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1996-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2012-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1584-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2352-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/772-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1036-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1872-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/888-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/776-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1440-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-361-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1524-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1108-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1580-564-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-696-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2580-1151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-1231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-1318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1788-1331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2240-1399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2108 htbhnn.exe 2328 7pjdd.exe 2244 hbntbh.exe 2656 tntttn.exe 2736 pdpjp.exe 2200 9dppv.exe 2880 lfrflfx.exe 2716 9tnthn.exe 2556 btbnhh.exe 1328 3vjdp.exe 1524 vpdpp.exe 2012 xrfflxf.exe 532 btbbtt.exe 1996 7hbhbb.exe 1584 nbttbb.exe 2872 jvjpp.exe 2352 vdjdd.exe 772 lxxxfxx.exe 2188 bnbhtn.exe 2156 dpvjv.exe 1728 fxllrlr.exe 2224 tnbbhb.exe 1036 djvdp.exe 1932 5jdjj.exe 1868 3llrxxf.exe 1548 lflrffl.exe 480 7tnbht.exe 2140 pjdpd.exe 1156 9pjdp.exe 1872 frfflrx.exe 888 frflxrx.exe 816 hbnbnt.exe 776 7hthnn.exe 1608 ddjdv.exe 2840 fxfffll.exe 1440 5flrxrf.exe 2960 9tbntn.exe 852 5hbnnb.exe 2704 vpjpv.exe 2676 5dvpd.exe 2580 1rfllfl.exe 1052 5lxxfrr.exe 2588 tnttnb.exe 2556 nttnhn.exe 2540 pjpvv.exe 1812 dpddp.exe 1524 frllfll.exe 1480 fxrxffl.exe 2944 tnttbh.exe 1996 nnntth.exe 2616 dpvvp.exe 2892 5vdjp.exe 2268 vpddj.exe 2844 1xlrxxf.exe 2940 rlxlrlr.exe 1684 htnnnn.exe 2128 7tnntb.exe 1952 vpjjj.exe 2156 jdpvp.exe 1968 frxxlrx.exe 2084 xlrxlrf.exe 2196 nbtbhn.exe 1036 pjdpp.exe 1932 pvjpp.exe -
resource yara_rule behavioral1/memory/2632-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000018718-7.dat upx behavioral1/memory/2108-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000018bc7-18.dat upx behavioral1/memory/2328-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018bf2-28.dat upx behavioral1/memory/2244-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2656-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018c16-36.dat upx behavioral1/memory/2736-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000018c3b-45.dat upx behavioral1/memory/2200-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000018c44-54.dat upx behavioral1/memory/2880-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000019209-62.dat upx behavioral1/files/0x000500000001960c-80.dat upx behavioral1/memory/2716-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960a-73.dat upx behavioral1/memory/2880-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960e-88.dat upx behavioral1/memory/2556-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019610-99.dat upx behavioral1/memory/1328-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019612-111.dat upx behavioral1/memory/1524-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019616-136.dat upx behavioral1/memory/1996-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019614-120.dat upx behavioral1/memory/2012-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019615-128.dat upx behavioral1/memory/1584-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019618-146.dat upx behavioral1/files/0x000500000001961a-154.dat upx behavioral1/memory/2352-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2872-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961c-164.dat upx behavioral1/memory/772-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961e-172.dat upx behavioral1/files/0x0005000000019620-179.dat upx behavioral1/files/0x0005000000019622-188.dat upx behavioral1/memory/1728-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2224-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1728-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019624-196.dat upx behavioral1/files/0x0005000000019626-207.dat upx behavioral1/files/0x000500000001966b-214.dat upx behavioral1/memory/1036-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000196aa-224.dat upx behavioral1/files/0x00050000000196ac-233.dat upx behavioral1/files/0x00050000000196b0-240.dat upx behavioral1/files/0x000500000001971d-248.dat upx behavioral1/files/0x0005000000019854-256.dat upx behavioral1/files/0x000500000001985e-265.dat upx behavioral1/files/0x0005000000019929-273.dat upx behavioral1/memory/1872-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/888-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001992d-283.dat upx behavioral1/memory/776-297-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1608-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2840-311-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1440-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2960-325-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2704-338-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-339-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7httnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2632 wrote to memory of 2108 2632 265c56adf4b7ca4194ae622d454b0aa86453d3183794b7be86d85b81f3964837.exe 31 PID 2632 wrote to memory of 2108 2632 265c56adf4b7ca4194ae622d454b0aa86453d3183794b7be86d85b81f3964837.exe 31 PID 2632 wrote to memory of 2108 2632 265c56adf4b7ca4194ae622d454b0aa86453d3183794b7be86d85b81f3964837.exe 31 PID 2632 wrote to memory of 2108 2632 265c56adf4b7ca4194ae622d454b0aa86453d3183794b7be86d85b81f3964837.exe 31 PID 2108 wrote to memory of 2328 2108 htbhnn.exe 32 PID 2108 wrote to memory of 2328 2108 htbhnn.exe 32 PID 2108 wrote to memory of 2328 2108 htbhnn.exe 32 PID 2108 wrote to memory of 2328 2108 htbhnn.exe 32 PID 2328 wrote to memory of 2244 2328 7pjdd.exe 33 PID 2328 wrote to memory of 2244 2328 7pjdd.exe 33 PID 2328 wrote to memory of 2244 2328 7pjdd.exe 33 PID 2328 wrote to memory of 2244 2328 7pjdd.exe 33 PID 2244 wrote to memory of 2656 2244 hbntbh.exe 34 PID 2244 wrote to memory of 2656 2244 hbntbh.exe 34 PID 2244 wrote to memory of 2656 2244 hbntbh.exe 34 PID 2244 wrote to memory of 2656 2244 hbntbh.exe 34 PID 2656 wrote to memory of 2736 2656 tntttn.exe 35 PID 2656 wrote to memory of 2736 2656 tntttn.exe 35 PID 2656 wrote to memory of 2736 2656 tntttn.exe 35 PID 2656 wrote to memory of 2736 2656 tntttn.exe 35 PID 2736 wrote to memory of 2200 2736 pdpjp.exe 36 PID 2736 wrote to memory of 2200 2736 pdpjp.exe 36 PID 2736 wrote to memory of 2200 2736 pdpjp.exe 36 PID 2736 wrote to memory of 2200 2736 pdpjp.exe 36 PID 2200 wrote to memory of 2880 2200 9dppv.exe 37 PID 2200 wrote to memory of 2880 2200 9dppv.exe 37 PID 2200 wrote to memory of 2880 2200 9dppv.exe 37 PID 2200 wrote to memory of 2880 2200 9dppv.exe 37 PID 2880 wrote to memory of 2716 2880 lfrflfx.exe 38 PID 2880 wrote to memory of 2716 2880 lfrflfx.exe 38 PID 2880 wrote to memory of 2716 2880 lfrflfx.exe 38 PID 2880 wrote to memory of 2716 2880 lfrflfx.exe 38 PID 2716 wrote to memory of 2556 2716 9tnthn.exe 39 PID 2716 wrote to memory of 2556 2716 9tnthn.exe 39 PID 2716 wrote to memory of 2556 2716 9tnthn.exe 39 PID 2716 wrote to memory of 2556 2716 9tnthn.exe 39 PID 2556 wrote to memory of 1328 2556 btbnhh.exe 40 PID 2556 wrote to memory of 1328 2556 btbnhh.exe 40 PID 2556 wrote to memory of 1328 2556 btbnhh.exe 40 PID 2556 wrote to memory of 1328 2556 btbnhh.exe 40 PID 1328 wrote to memory of 1524 1328 3vjdp.exe 41 PID 1328 wrote to memory of 1524 1328 3vjdp.exe 41 PID 1328 wrote to memory of 1524 1328 3vjdp.exe 41 PID 1328 wrote to memory of 1524 1328 3vjdp.exe 41 PID 1524 wrote to memory of 2012 1524 vpdpp.exe 42 PID 1524 wrote to memory of 2012 1524 vpdpp.exe 42 PID 1524 wrote to memory of 2012 1524 vpdpp.exe 42 PID 1524 wrote to memory of 2012 1524 vpdpp.exe 42 PID 2012 wrote to memory of 532 2012 xrfflxf.exe 43 PID 2012 wrote to memory of 532 2012 xrfflxf.exe 43 PID 2012 wrote to memory of 532 2012 xrfflxf.exe 43 PID 2012 wrote to memory of 532 2012 xrfflxf.exe 43 PID 532 wrote to memory of 1996 532 btbbtt.exe 44 PID 532 wrote to memory of 1996 532 btbbtt.exe 44 PID 532 wrote to memory of 1996 532 btbbtt.exe 44 PID 532 wrote to memory of 1996 532 btbbtt.exe 44 PID 1996 wrote to memory of 1584 1996 7hbhbb.exe 45 PID 1996 wrote to memory of 1584 1996 7hbhbb.exe 45 PID 1996 wrote to memory of 1584 1996 7hbhbb.exe 45 PID 1996 wrote to memory of 1584 1996 7hbhbb.exe 45 PID 1584 wrote to memory of 2872 1584 nbttbb.exe 46 PID 1584 wrote to memory of 2872 1584 nbttbb.exe 46 PID 1584 wrote to memory of 2872 1584 nbttbb.exe 46 PID 1584 wrote to memory of 2872 1584 nbttbb.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\265c56adf4b7ca4194ae622d454b0aa86453d3183794b7be86d85b81f3964837.exe"C:\Users\Admin\AppData\Local\Temp\265c56adf4b7ca4194ae622d454b0aa86453d3183794b7be86d85b81f3964837.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\htbhnn.exec:\htbhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\7pjdd.exec:\7pjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\hbntbh.exec:\hbntbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\tntttn.exec:\tntttn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\pdpjp.exec:\pdpjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\9dppv.exec:\9dppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\lfrflfx.exec:\lfrflfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\9tnthn.exec:\9tnthn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\btbnhh.exec:\btbnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\3vjdp.exec:\3vjdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\vpdpp.exec:\vpdpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\xrfflxf.exec:\xrfflxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\btbbtt.exec:\btbbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\7hbhbb.exec:\7hbhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\nbttbb.exec:\nbttbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\jvjpp.exec:\jvjpp.exe17⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vdjdd.exec:\vdjdd.exe18⤵
- Executes dropped EXE
PID:2352 -
\??\c:\lxxxfxx.exec:\lxxxfxx.exe19⤵
- Executes dropped EXE
PID:772 -
\??\c:\bnbhtn.exec:\bnbhtn.exe20⤵
- Executes dropped EXE
PID:2188 -
\??\c:\dpvjv.exec:\dpvjv.exe21⤵
- Executes dropped EXE
PID:2156 -
\??\c:\fxllrlr.exec:\fxllrlr.exe22⤵
- Executes dropped EXE
PID:1728 -
\??\c:\tnbbhb.exec:\tnbbhb.exe23⤵
- Executes dropped EXE
PID:2224 -
\??\c:\djvdp.exec:\djvdp.exe24⤵
- Executes dropped EXE
PID:1036 -
\??\c:\5jdjj.exec:\5jdjj.exe25⤵
- Executes dropped EXE
PID:1932 -
\??\c:\3llrxxf.exec:\3llrxxf.exe26⤵
- Executes dropped EXE
PID:1868 -
\??\c:\lflrffl.exec:\lflrffl.exe27⤵
- Executes dropped EXE
PID:1548 -
\??\c:\7tnbht.exec:\7tnbht.exe28⤵
- Executes dropped EXE
PID:480 -
\??\c:\pjdpd.exec:\pjdpd.exe29⤵
- Executes dropped EXE
PID:2140 -
\??\c:\9pjdp.exec:\9pjdp.exe30⤵
- Executes dropped EXE
PID:1156 -
\??\c:\frfflrx.exec:\frfflrx.exe31⤵
- Executes dropped EXE
PID:1872 -
\??\c:\frflxrx.exec:\frflxrx.exe32⤵
- Executes dropped EXE
PID:888 -
\??\c:\hbnbnt.exec:\hbnbnt.exe33⤵
- Executes dropped EXE
PID:816 -
\??\c:\7hthnn.exec:\7hthnn.exe34⤵
- Executes dropped EXE
PID:776 -
\??\c:\ddjdv.exec:\ddjdv.exe35⤵
- Executes dropped EXE
PID:1608 -
\??\c:\fxfffll.exec:\fxfffll.exe36⤵
- Executes dropped EXE
PID:2840 -
\??\c:\5flrxrf.exec:\5flrxrf.exe37⤵
- Executes dropped EXE
PID:1440 -
\??\c:\9tbntn.exec:\9tbntn.exe38⤵
- Executes dropped EXE
PID:2960 -
\??\c:\5hbnnb.exec:\5hbnnb.exe39⤵
- Executes dropped EXE
PID:852 -
\??\c:\vpjpv.exec:\vpjpv.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\5dvpd.exec:\5dvpd.exe41⤵
- Executes dropped EXE
PID:2676 -
\??\c:\1rfllfl.exec:\1rfllfl.exe42⤵
- Executes dropped EXE
PID:2580 -
\??\c:\5lxxfrr.exec:\5lxxfrr.exe43⤵
- Executes dropped EXE
PID:1052 -
\??\c:\tnttnb.exec:\tnttnb.exe44⤵
- Executes dropped EXE
PID:2588 -
\??\c:\nttnhn.exec:\nttnhn.exe45⤵
- Executes dropped EXE
PID:2556 -
\??\c:\pjpvv.exec:\pjpvv.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2540 -
\??\c:\dpddp.exec:\dpddp.exe47⤵
- Executes dropped EXE
PID:1812 -
\??\c:\frllfll.exec:\frllfll.exe48⤵
- Executes dropped EXE
PID:1524 -
\??\c:\fxrxffl.exec:\fxrxffl.exe49⤵
- Executes dropped EXE
PID:1480 -
\??\c:\tnttbh.exec:\tnttbh.exe50⤵
- Executes dropped EXE
PID:2944 -
\??\c:\nnntth.exec:\nnntth.exe51⤵
- Executes dropped EXE
PID:1996 -
\??\c:\dpvvp.exec:\dpvvp.exe52⤵
- Executes dropped EXE
PID:2616 -
\??\c:\5vdjp.exec:\5vdjp.exe53⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vpddj.exec:\vpddj.exe54⤵
- Executes dropped EXE
PID:2268 -
\??\c:\1xlrxxf.exec:\1xlrxxf.exe55⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rlxlrlr.exec:\rlxlrlr.exe56⤵
- Executes dropped EXE
PID:2940 -
\??\c:\htnnnn.exec:\htnnnn.exe57⤵
- Executes dropped EXE
PID:1684 -
\??\c:\7tnntb.exec:\7tnntb.exe58⤵
- Executes dropped EXE
PID:2128 -
\??\c:\vpjjj.exec:\vpjjj.exe59⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jdpvp.exec:\jdpvp.exe60⤵
- Executes dropped EXE
PID:2156 -
\??\c:\frxxlrx.exec:\frxxlrx.exe61⤵
- Executes dropped EXE
PID:1968 -
\??\c:\xlrxlrf.exec:\xlrxlrf.exe62⤵
- Executes dropped EXE
PID:2084 -
\??\c:\nbtbhn.exec:\nbtbhn.exe63⤵
- Executes dropped EXE
PID:2196 -
\??\c:\pjdpp.exec:\pjdpp.exe64⤵
- Executes dropped EXE
PID:1036 -
\??\c:\pvjpp.exec:\pvjpp.exe65⤵
- Executes dropped EXE
PID:1932 -
\??\c:\1fxffll.exec:\1fxffll.exe66⤵PID:1784
-
\??\c:\lxllxxf.exec:\lxllxxf.exe67⤵PID:1108
-
\??\c:\bthhnt.exec:\bthhnt.exe68⤵PID:1000
-
\??\c:\7tbbhh.exec:\7tbbhh.exe69⤵PID:2356
-
\??\c:\pdjjp.exec:\pdjjp.exe70⤵PID:584
-
\??\c:\vpdpp.exec:\vpdpp.exe71⤵PID:1044
-
\??\c:\frflflr.exec:\frflflr.exe72⤵PID:1620
-
\??\c:\1xrrxfx.exec:\1xrrxfx.exe73⤵PID:2472
-
\??\c:\7hthhh.exec:\7hthhh.exe74⤵PID:888
-
\??\c:\htbbth.exec:\htbbth.exe75⤵PID:816
-
\??\c:\jvpvv.exec:\jvpvv.exe76⤵PID:1580
-
\??\c:\dvpjd.exec:\dvpjd.exe77⤵PID:2640
-
\??\c:\lfrfrxx.exec:\lfrfrxx.exe78⤵PID:1992
-
\??\c:\7xrrrrf.exec:\7xrrrrf.exe79⤵PID:2768
-
\??\c:\nbhnbh.exec:\nbhnbh.exe80⤵PID:848
-
\??\c:\nhbnbn.exec:\nhbnbn.exe81⤵PID:2980
-
\??\c:\vvdvd.exec:\vvdvd.exe82⤵PID:2668
-
\??\c:\jjvdj.exec:\jjvdj.exe83⤵PID:2776
-
\??\c:\lxflxxf.exec:\lxflxxf.exe84⤵PID:2808
-
\??\c:\xrrflrx.exec:\xrrflrx.exe85⤵PID:2756
-
\??\c:\tthttb.exec:\tthttb.exe86⤵PID:1956
-
\??\c:\tnbbtt.exec:\tnbbtt.exe87⤵
- System Location Discovery: System Language Discovery
PID:2672 -
\??\c:\vpdvj.exec:\vpdvj.exe88⤵PID:2600
-
\??\c:\dpdvd.exec:\dpdvd.exe89⤵PID:884
-
\??\c:\7lxxfxr.exec:\7lxxfxr.exe90⤵PID:2828
-
\??\c:\rffllff.exec:\rffllff.exe91⤵PID:1056
-
\??\c:\thnbtb.exec:\thnbtb.exe92⤵PID:2896
-
\??\c:\7thhhh.exec:\7thhhh.exe93⤵PID:532
-
\??\c:\5jppv.exec:\5jppv.exe94⤵PID:1584
-
\??\c:\pdvpv.exec:\pdvpv.exe95⤵PID:1828
-
\??\c:\rfllrrr.exec:\rfllrrr.exe96⤵PID:2852
-
\??\c:\fxrrlrr.exec:\fxrrlrr.exe97⤵PID:1980
-
\??\c:\nbnhbt.exec:\nbnhbt.exe98⤵PID:2936
-
\??\c:\tnbnnh.exec:\tnbnnh.exe99⤵PID:2864
-
\??\c:\ppdjp.exec:\ppdjp.exe100⤵PID:1684
-
\??\c:\ppdpj.exec:\ppdpj.exe101⤵PID:3044
-
\??\c:\fxlllff.exec:\fxlllff.exe102⤵PID:2036
-
\??\c:\frfxxff.exec:\frfxxff.exe103⤵
- System Location Discovery: System Language Discovery
PID:2644 -
\??\c:\hbnbnh.exec:\hbnbnh.exe104⤵PID:292
-
\??\c:\nhtbbh.exec:\nhtbbh.exe105⤵PID:2528
-
\??\c:\5jppd.exec:\5jppd.exe106⤵PID:1384
-
\??\c:\dvpdp.exec:\dvpdp.exe107⤵PID:956
-
\??\c:\rlxrxrl.exec:\rlxrxrl.exe108⤵PID:1036
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe109⤵PID:1868
-
\??\c:\hbtnbt.exec:\hbtnbt.exe110⤵PID:1712
-
\??\c:\3tnbhh.exec:\3tnbhh.exe111⤵PID:580
-
\??\c:\jvjdj.exec:\jvjdj.exe112⤵PID:1548
-
\??\c:\jvddd.exec:\jvddd.exe113⤵PID:2132
-
\??\c:\7djvv.exec:\7djvv.exe114⤵PID:1156
-
\??\c:\3xrllrf.exec:\3xrllrf.exe115⤵PID:1872
-
\??\c:\rlflrrx.exec:\rlflrrx.exe116⤵PID:2400
-
\??\c:\tnbnth.exec:\tnbnth.exe117⤵PID:2444
-
\??\c:\3thbhb.exec:\3thbhb.exe118⤵
- System Location Discovery: System Language Discovery
PID:2964 -
\??\c:\pdpdd.exec:\pdpdd.exe119⤵PID:2316
-
\??\c:\vpvjj.exec:\vpvjj.exe120⤵PID:1580
-
\??\c:\frxfxxf.exec:\frxfxxf.exe121⤵PID:2368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-