Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 21:37
Behavioral task
behavioral1
Sample
d13189b20b276dc9d6e461b0db49ccf0N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
d13189b20b276dc9d6e461b0db49ccf0N.exe
-
Size
529KB
-
MD5
d13189b20b276dc9d6e461b0db49ccf0
-
SHA1
8000e58cb14eace04e24194228bf333ada707ddf
-
SHA256
22b57fc92c9711a3fb22dad8e2d6e476453f3c5c82a6adf90a814f48b45a02ca
-
SHA512
e19a96fb8cbc0d23531a2bd9dfdebd62b121a9514adc660ff5078a857a4cb081d53141c402af1447c900fe8a2f7815db4dea1261ccb2b295f97012415f033fdc
-
SSDEEP
12288:y4wFHoS3eFp3IDvSbh5nP+UbGTHoSouKs8N0u/D6vIZS:HFp3lzZbGa5soS
Malware Config
Signatures
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/1688-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2460-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-57-0x0000000000350000-0x0000000000377000-memory.dmp family_blackmoon behavioral1/memory/2732-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-79-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2628-78-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2768-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-141-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1980-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1040-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/992-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2332-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2012-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1312-208-0x0000000001C10000-0x0000000001C37000-memory.dmp family_blackmoon behavioral1/memory/1548-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/604-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/604-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-278-0x0000000000330000-0x0000000000357000-memory.dmp family_blackmoon behavioral1/memory/1640-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/536-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1760-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1160-431-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-470-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-506-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2084-515-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2448-565-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-582-0x00000000002E0000-0x0000000000307000-memory.dmp family_blackmoon behavioral1/memory/2152-598-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-623-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/776-1050-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1164-1048-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2280-1125-0x0000000000340000-0x0000000000367000-memory.dmp family_blackmoon behavioral1/memory/832-1192-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2880-1205-0x0000000000340000-0x0000000000367000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1708 bthhth.exe 3064 dvjpp.exe 2992 hbbhbn.exe 2460 djdpd.exe 2808 3xflrll.exe 2732 bbntbb.exe 2904 frffrrx.exe 2628 dvjpp.exe 2768 pjvjp.exe 2644 bbhntb.exe 2256 1dvvj.exe 1432 3httbn.exe 2880 bnhhhh.exe 468 fxfflff.exe 2668 5vdvp.exe 1980 frlrxrr.exe 1040 9tbhbt.exe 344 pjvjp.exe 992 xrfxlff.exe 2332 bnbhbb.exe 2364 vvddj.exe 2012 bnttth.exe 1312 7jjpv.exe 408 hbhnbt.exe 2584 7dppj.exe 1548 9jvdj.exe 1996 3thntn.exe 2020 hbhhbb.exe 1276 7frfxrr.exe 604 dvvjp.exe 1640 5frrfrx.exe 1324 tbttnt.exe 1944 pdjpv.exe 2680 tnbnbt.exe 2484 thnnbb.exe 2000 ddvdj.exe 1920 xrlfrxx.exe 2460 tthhnh.exe 3016 tbtbnt.exe 2608 jjjpp.exe 2780 1flxllf.exe 2924 tbhnhn.exe 2820 9ntbnb.exe 1800 vddjd.exe 2216 7rfrlrr.exe 1464 3bnhnn.exe 536 jppvv.exe 1760 jjvvj.exe 2856 rfrrlll.exe 624 hhnbhn.exe 2920 pdjjv.exe 2668 vjvvp.exe 1160 frxxffl.exe 1948 bnhbhh.exe 1696 thnttn.exe 2952 jddjj.exe 2960 1frrrxl.exe 2068 tnbtbh.exe 1976 5bnnbt.exe 2276 vvdjj.exe 2160 lfxxflx.exe 1028 3nbbbh.exe 2180 htnnhn.exe 1080 pdjdp.exe -
resource yara_rule behavioral1/memory/1688-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120f8-5.dat upx behavioral1/memory/1708-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1708-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015dca-17.dat upx behavioral1/files/0x0007000000015e46-27.dat upx behavioral1/memory/3064-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015e4f-39.dat upx behavioral1/memory/2460-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2992-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2808-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015f55-48.dat upx behavioral1/memory/2460-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015fa3-59.dat upx behavioral1/files/0x0007000000016108-67.dat upx behavioral1/memory/2732-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2904-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2628-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016148-81.dat upx behavioral1/memory/2628-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000162d8-91.dat upx behavioral1/files/0x000600000001904f-100.dat upx behavioral1/memory/2644-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191fe-108.dat upx behavioral1/memory/1432-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019221-117.dat upx behavioral1/files/0x000500000001923a-124.dat upx behavioral1/files/0x0005000000019246-132.dat upx behavioral1/files/0x0005000000019249-142.dat upx behavioral1/memory/1980-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019253-152.dat upx behavioral1/memory/1980-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1040-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019256-164.dat upx behavioral1/files/0x0009000000015da2-173.dat upx behavioral1/memory/992-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001925b-183.dat upx behavioral1/memory/2332-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019272-190.dat upx behavioral1/memory/2012-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000192fe-200.dat upx behavioral1/files/0x0005000000019309-209.dat upx behavioral1/memory/408-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019346-218.dat upx behavioral1/files/0x0005000000019358-226.dat upx behavioral1/files/0x0005000000019368-235.dat upx behavioral1/memory/1548-234-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1996-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019385-244.dat upx behavioral1/files/0x0005000000019394-252.dat upx behavioral1/files/0x00050000000193a2-260.dat upx behavioral1/memory/604-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193c3-270.dat upx behavioral1/memory/1640-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/604-269-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1324-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193cf-282.dat upx behavioral1/files/0x00050000000193e5-289.dat upx behavioral1/memory/1640-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1920-316-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1920-323-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3016-331-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2780-352-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3htbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1688 wrote to memory of 1708 1688 d13189b20b276dc9d6e461b0db49ccf0N.exe 30 PID 1688 wrote to memory of 1708 1688 d13189b20b276dc9d6e461b0db49ccf0N.exe 30 PID 1688 wrote to memory of 1708 1688 d13189b20b276dc9d6e461b0db49ccf0N.exe 30 PID 1688 wrote to memory of 1708 1688 d13189b20b276dc9d6e461b0db49ccf0N.exe 30 PID 1708 wrote to memory of 3064 1708 bthhth.exe 31 PID 1708 wrote to memory of 3064 1708 bthhth.exe 31 PID 1708 wrote to memory of 3064 1708 bthhth.exe 31 PID 1708 wrote to memory of 3064 1708 bthhth.exe 31 PID 3064 wrote to memory of 2992 3064 dvjpp.exe 32 PID 3064 wrote to memory of 2992 3064 dvjpp.exe 32 PID 3064 wrote to memory of 2992 3064 dvjpp.exe 32 PID 3064 wrote to memory of 2992 3064 dvjpp.exe 32 PID 2992 wrote to memory of 2460 2992 hbbhbn.exe 33 PID 2992 wrote to memory of 2460 2992 hbbhbn.exe 33 PID 2992 wrote to memory of 2460 2992 hbbhbn.exe 33 PID 2992 wrote to memory of 2460 2992 hbbhbn.exe 33 PID 2460 wrote to memory of 2808 2460 djdpd.exe 34 PID 2460 wrote to memory of 2808 2460 djdpd.exe 34 PID 2460 wrote to memory of 2808 2460 djdpd.exe 34 PID 2460 wrote to memory of 2808 2460 djdpd.exe 34 PID 2808 wrote to memory of 2732 2808 3xflrll.exe 35 PID 2808 wrote to memory of 2732 2808 3xflrll.exe 35 PID 2808 wrote to memory of 2732 2808 3xflrll.exe 35 PID 2808 wrote to memory of 2732 2808 3xflrll.exe 35 PID 2732 wrote to memory of 2904 2732 bbntbb.exe 36 PID 2732 wrote to memory of 2904 2732 bbntbb.exe 36 PID 2732 wrote to memory of 2904 2732 bbntbb.exe 36 PID 2732 wrote to memory of 2904 2732 bbntbb.exe 36 PID 2904 wrote to memory of 2628 2904 frffrrx.exe 37 PID 2904 wrote to memory of 2628 2904 frffrrx.exe 37 PID 2904 wrote to memory of 2628 2904 frffrrx.exe 37 PID 2904 wrote to memory of 2628 2904 frffrrx.exe 37 PID 2628 wrote to memory of 2768 2628 dvjpp.exe 38 PID 2628 wrote to memory of 2768 2628 dvjpp.exe 38 PID 2628 wrote to memory of 2768 2628 dvjpp.exe 38 PID 2628 wrote to memory of 2768 2628 dvjpp.exe 38 PID 2768 wrote to memory of 2644 2768 pjvjp.exe 39 PID 2768 wrote to memory of 2644 2768 pjvjp.exe 39 PID 2768 wrote to memory of 2644 2768 pjvjp.exe 39 PID 2768 wrote to memory of 2644 2768 pjvjp.exe 39 PID 2644 wrote to memory of 2256 2644 bbhntb.exe 40 PID 2644 wrote to memory of 2256 2644 bbhntb.exe 40 PID 2644 wrote to memory of 2256 2644 bbhntb.exe 40 PID 2644 wrote to memory of 2256 2644 bbhntb.exe 40 PID 2256 wrote to memory of 1432 2256 1dvvj.exe 41 PID 2256 wrote to memory of 1432 2256 1dvvj.exe 41 PID 2256 wrote to memory of 1432 2256 1dvvj.exe 41 PID 2256 wrote to memory of 1432 2256 1dvvj.exe 41 PID 1432 wrote to memory of 2880 1432 3httbn.exe 42 PID 1432 wrote to memory of 2880 1432 3httbn.exe 42 PID 1432 wrote to memory of 2880 1432 3httbn.exe 42 PID 1432 wrote to memory of 2880 1432 3httbn.exe 42 PID 2880 wrote to memory of 468 2880 bnhhhh.exe 43 PID 2880 wrote to memory of 468 2880 bnhhhh.exe 43 PID 2880 wrote to memory of 468 2880 bnhhhh.exe 43 PID 2880 wrote to memory of 468 2880 bnhhhh.exe 43 PID 468 wrote to memory of 2668 468 fxfflff.exe 44 PID 468 wrote to memory of 2668 468 fxfflff.exe 44 PID 468 wrote to memory of 2668 468 fxfflff.exe 44 PID 468 wrote to memory of 2668 468 fxfflff.exe 44 PID 2668 wrote to memory of 1980 2668 5vdvp.exe 45 PID 2668 wrote to memory of 1980 2668 5vdvp.exe 45 PID 2668 wrote to memory of 1980 2668 5vdvp.exe 45 PID 2668 wrote to memory of 1980 2668 5vdvp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d13189b20b276dc9d6e461b0db49ccf0N.exe"C:\Users\Admin\AppData\Local\Temp\d13189b20b276dc9d6e461b0db49ccf0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\bthhth.exec:\bthhth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\dvjpp.exec:\dvjpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\hbbhbn.exec:\hbbhbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\djdpd.exec:\djdpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\3xflrll.exec:\3xflrll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\bbntbb.exec:\bbntbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\frffrrx.exec:\frffrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\dvjpp.exec:\dvjpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\pjvjp.exec:\pjvjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\bbhntb.exec:\bbhntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\1dvvj.exec:\1dvvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\3httbn.exec:\3httbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\bnhhhh.exec:\bnhhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\fxfflff.exec:\fxfflff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\5vdvp.exec:\5vdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\frlrxrr.exec:\frlrxrr.exe17⤵
- Executes dropped EXE
PID:1980 -
\??\c:\9tbhbt.exec:\9tbhbt.exe18⤵
- Executes dropped EXE
PID:1040 -
\??\c:\pjvjp.exec:\pjvjp.exe19⤵
- Executes dropped EXE
PID:344 -
\??\c:\xrfxlff.exec:\xrfxlff.exe20⤵
- Executes dropped EXE
PID:992 -
\??\c:\bnbhbb.exec:\bnbhbb.exe21⤵
- Executes dropped EXE
PID:2332 -
\??\c:\vvddj.exec:\vvddj.exe22⤵
- Executes dropped EXE
PID:2364 -
\??\c:\bnttth.exec:\bnttth.exe23⤵
- Executes dropped EXE
PID:2012 -
\??\c:\7jjpv.exec:\7jjpv.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1312 -
\??\c:\hbhnbt.exec:\hbhnbt.exe25⤵
- Executes dropped EXE
PID:408 -
\??\c:\7dppj.exec:\7dppj.exe26⤵
- Executes dropped EXE
PID:2584 -
\??\c:\9jvdj.exec:\9jvdj.exe27⤵
- Executes dropped EXE
PID:1548 -
\??\c:\3thntn.exec:\3thntn.exe28⤵
- Executes dropped EXE
PID:1996 -
\??\c:\hbhhbb.exec:\hbhhbb.exe29⤵
- Executes dropped EXE
PID:2020 -
\??\c:\7frfxrr.exec:\7frfxrr.exe30⤵
- Executes dropped EXE
PID:1276 -
\??\c:\dvvjp.exec:\dvvjp.exe31⤵
- Executes dropped EXE
PID:604 -
\??\c:\5frrfrx.exec:\5frrfrx.exe32⤵
- Executes dropped EXE
PID:1640 -
\??\c:\tbttnt.exec:\tbttnt.exe33⤵
- Executes dropped EXE
PID:1324 -
\??\c:\pdjpv.exec:\pdjpv.exe34⤵
- Executes dropped EXE
PID:1944 -
\??\c:\tnbnbt.exec:\tnbnbt.exe35⤵
- Executes dropped EXE
PID:2680 -
\??\c:\thnnbb.exec:\thnnbb.exe36⤵
- Executes dropped EXE
PID:2484 -
\??\c:\ddvdj.exec:\ddvdj.exe37⤵
- Executes dropped EXE
PID:2000 -
\??\c:\xrlfrxx.exec:\xrlfrxx.exe38⤵
- Executes dropped EXE
PID:1920 -
\??\c:\tthhnh.exec:\tthhnh.exe39⤵
- Executes dropped EXE
PID:2460 -
\??\c:\tbtbnt.exec:\tbtbnt.exe40⤵
- Executes dropped EXE
PID:3016 -
\??\c:\jjjpp.exec:\jjjpp.exe41⤵
- Executes dropped EXE
PID:2608 -
\??\c:\1flxllf.exec:\1flxllf.exe42⤵
- Executes dropped EXE
PID:2780 -
\??\c:\tbhnhn.exec:\tbhnhn.exe43⤵
- Executes dropped EXE
PID:2924 -
\??\c:\9ntbnb.exec:\9ntbnb.exe44⤵
- Executes dropped EXE
PID:2820 -
\??\c:\vddjd.exec:\vddjd.exe45⤵
- Executes dropped EXE
PID:1800 -
\??\c:\7rfrlrr.exec:\7rfrlrr.exe46⤵
- Executes dropped EXE
PID:2216 -
\??\c:\3bnhnn.exec:\3bnhnn.exe47⤵
- Executes dropped EXE
PID:1464 -
\??\c:\jppvv.exec:\jppvv.exe48⤵
- Executes dropped EXE
PID:536 -
\??\c:\jjvvj.exec:\jjvvj.exe49⤵
- Executes dropped EXE
PID:1760 -
\??\c:\rfrrlll.exec:\rfrrlll.exe50⤵
- Executes dropped EXE
PID:2856 -
\??\c:\hhnbhn.exec:\hhnbhn.exe51⤵
- Executes dropped EXE
PID:624 -
\??\c:\pdjjv.exec:\pdjjv.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2920 -
\??\c:\vjvvp.exec:\vjvvp.exe53⤵
- Executes dropped EXE
PID:2668 -
\??\c:\frxxffl.exec:\frxxffl.exe54⤵
- Executes dropped EXE
PID:1160 -
\??\c:\bnhbhh.exec:\bnhbhh.exe55⤵
- Executes dropped EXE
PID:1948 -
\??\c:\thnttn.exec:\thnttn.exe56⤵
- Executes dropped EXE
PID:1696 -
\??\c:\jddjj.exec:\jddjj.exe57⤵
- Executes dropped EXE
PID:2952 -
\??\c:\1frrrxl.exec:\1frrrxl.exe58⤵
- Executes dropped EXE
PID:2960 -
\??\c:\tnbtbh.exec:\tnbtbh.exe59⤵
- Executes dropped EXE
PID:2068 -
\??\c:\5bnnbt.exec:\5bnnbt.exe60⤵
- Executes dropped EXE
PID:1976 -
\??\c:\vvdjj.exec:\vvdjj.exe61⤵
- Executes dropped EXE
PID:2276 -
\??\c:\lfxxflx.exec:\lfxxflx.exe62⤵
- Executes dropped EXE
PID:2160 -
\??\c:\3nbbbh.exec:\3nbbbh.exe63⤵
- Executes dropped EXE
PID:1028 -
\??\c:\htnnhn.exec:\htnnhn.exe64⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pdjdp.exec:\pdjdp.exe65⤵
- Executes dropped EXE
PID:1080 -
\??\c:\rfrxflr.exec:\rfrxflr.exe66⤵PID:2168
-
\??\c:\7frrrxf.exec:\7frrrxf.exe67⤵PID:2084
-
\??\c:\3hnbhh.exec:\3hnbhh.exe68⤵PID:2996
-
\??\c:\7vpdj.exec:\7vpdj.exe69⤵PID:2020
-
\??\c:\1lrfxxx.exec:\1lrfxxx.exe70⤵PID:2120
-
\??\c:\rxrxlfr.exec:\rxrxlfr.exe71⤵PID:2008
-
\??\c:\bbhnhh.exec:\bbhnhh.exe72⤵PID:2548
-
\??\c:\jdpjp.exec:\jdpjp.exe73⤵PID:1728
-
\??\c:\jdjdd.exec:\jdjdd.exe74⤵PID:1316
-
\??\c:\ffrxllr.exec:\ffrxllr.exe75⤵PID:2448
-
\??\c:\bhbhtt.exec:\bhbhtt.exe76⤵PID:1596
-
\??\c:\vvvvp.exec:\vvvvp.exe77⤵PID:1708
-
\??\c:\vdpvj.exec:\vdpvj.exe78⤵PID:2264
-
\??\c:\rlxlxfl.exec:\rlxlxfl.exe79⤵PID:2280
-
\??\c:\bnhnbh.exec:\bnhnbh.exe80⤵PID:2152
-
\??\c:\9dvjj.exec:\9dvjj.exe81⤵PID:2804
-
\??\c:\9dddj.exec:\9dddj.exe82⤵PID:2808
-
\??\c:\frlfrrx.exec:\frlfrrx.exe83⤵
- System Location Discovery: System Language Discovery
PID:2112 -
\??\c:\btnnbt.exec:\btnnbt.exe84⤵PID:2716
-
\??\c:\5dppv.exec:\5dppv.exe85⤵PID:2628
-
\??\c:\jdvdp.exec:\jdvdp.exe86⤵PID:2824
-
\??\c:\rxrxlfl.exec:\rxrxlfl.exe87⤵PID:2664
-
\??\c:\5bthnb.exec:\5bthnb.exe88⤵PID:2632
-
\??\c:\nnhntt.exec:\nnhntt.exe89⤵PID:2312
-
\??\c:\dvjjd.exec:\dvjjd.exe90⤵PID:1464
-
\??\c:\fxrfrrx.exec:\fxrfrrx.exe91⤵PID:1432
-
\??\c:\hntttn.exec:\hntttn.exe92⤵PID:2864
-
\??\c:\9nnthh.exec:\9nnthh.exe93⤵PID:2944
-
\??\c:\1pjpv.exec:\1pjpv.exe94⤵PID:2916
-
\??\c:\3lfxxrr.exec:\3lfxxrr.exe95⤵PID:772
-
\??\c:\xrlflfl.exec:\xrlflfl.exe96⤵PID:564
-
\??\c:\nbhbbt.exec:\nbhbbt.exe97⤵PID:1252
-
\??\c:\pjjjd.exec:\pjjjd.exe98⤵PID:1732
-
\??\c:\9flfxrr.exec:\9flfxrr.exe99⤵PID:1772
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe100⤵PID:992
-
\??\c:\1tbnnn.exec:\1tbnnn.exe101⤵PID:2300
-
\??\c:\dvjjv.exec:\dvjjv.exe102⤵PID:2832
-
\??\c:\jvdjp.exec:\jvdjp.exe103⤵PID:1540
-
\??\c:\rfrrxxx.exec:\rfrrxxx.exe104⤵PID:1532
-
\??\c:\nbnnht.exec:\nbnnht.exe105⤵PID:1164
-
\??\c:\jdpdp.exec:\jdpdp.exe106⤵PID:2204
-
\??\c:\ppppv.exec:\ppppv.exe107⤵
- System Location Discovery: System Language Discovery
PID:672 -
\??\c:\hbnttt.exec:\hbnttt.exe108⤵PID:2584
-
\??\c:\nhnttb.exec:\nhnttb.exe109⤵PID:1548
-
\??\c:\vpvdp.exec:\vpvdp.exe110⤵PID:3040
-
\??\c:\5rxrrrr.exec:\5rxrrrr.exe111⤵PID:2476
-
\??\c:\5bnttt.exec:\5bnttt.exe112⤵PID:1956
-
\??\c:\7tnhbb.exec:\7tnhbb.exe113⤵PID:2020
-
\??\c:\7vjdj.exec:\7vjdj.exe114⤵PID:2848
-
\??\c:\flxllfl.exec:\flxllfl.exe115⤵PID:2008
-
\??\c:\tbbthb.exec:\tbbthb.exe116⤵PID:1744
-
\??\c:\vvvdp.exec:\vvvdp.exe117⤵PID:1644
-
\??\c:\9jddj.exec:\9jddj.exe118⤵PID:2380
-
\??\c:\lfxflrf.exec:\lfxflrf.exe119⤵PID:1700
-
\??\c:\bbtbtb.exec:\bbtbtb.exe120⤵PID:2032
-
\??\c:\jvjpd.exec:\jvjpd.exe121⤵PID:3064
-
\??\c:\jvddp.exec:\jvddp.exe122⤵PID:2296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-