Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 10:45
Behavioral task
behavioral1
Sample
d4dc49068ac36bfdcf50bd11681edae0N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
d4dc49068ac36bfdcf50bd11681edae0N.exe
-
Size
223KB
-
MD5
d4dc49068ac36bfdcf50bd11681edae0
-
SHA1
5783b2c1a945b22f6894553342bc3b3128db9827
-
SHA256
1e130498c2ffc945e36d9a9a0b00f76a9c059509ffc7e82a7acf83eb6545dc47
-
SHA512
973f1162c7c4244cf44cbb59bf1fac35023113f0ca642aa2b27b89c90be01d9cd331a8060ba67984895c81258c89fefba9d9b8c816c5454f9c0a59ec250d3842
-
SSDEEP
6144:ocm4FmowdHoSGg+O7lmFAszBd+za/p1g+y/9g0tPbXxk542u:u4wFHoSGg+amF1zBR/pS+y/9g4jXxk9u
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2204-10-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2148-21-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2108-19-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2200-37-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2816-47-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2768-50-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2772-66-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2636-74-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2832-85-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2660-102-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2360-114-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2424-124-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2872-133-0x0000000000220000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2872-132-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2428-143-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1448-153-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2296-170-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1232-181-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1492-190-0x00000000003A0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/1492-189-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/624-217-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1008-235-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1756-244-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2076-262-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1752-288-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2260-312-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2260-331-0x0000000000220000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1340-389-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2424-410-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2368-425-0x0000000000220000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1492-471-0x0000000000220000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1604-506-0x00000000001B0000-0x00000000001E7000-memory.dmp family_blackmoon behavioral1/memory/1680-521-0x00000000001B0000-0x00000000001E7000-memory.dmp family_blackmoon behavioral1/memory/1936-535-0x00000000005D0000-0x0000000000607000-memory.dmp family_blackmoon behavioral1/memory/2012-563-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2528-570-0x0000000000220000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/864-591-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2612-659-0x0000000000250000-0x0000000000287000-memory.dmp family_blackmoon behavioral1/memory/3036-673-0x0000000000220000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1268-687-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/2096-733-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral1/memory/1980-770-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2108 jdpvd.exe 2148 nhtthn.exe 2200 btnbhh.exe 2816 7dvjv.exe 2768 bthntt.exe 2772 jdppd.exe 2636 rfrfflx.exe 2832 7thttn.exe 2668 lfxfrfx.exe 2660 fxllrrx.exe 2360 bttbbh.exe 2424 ppjjv.exe 2872 7bhbnt.exe 2428 ppvdv.exe 1448 xfrxrlx.exe 1984 llflxfr.exe 2296 5pjpd.exe 1232 3xrfffr.exe 1492 9tnbht.exe 592 jjddv.exe 2004 llxfxxl.exe 624 hbnbnn.exe 1700 3jddp.exe 1008 3xxfrrf.exe 1756 3nnbnb.exe 1800 7vjpd.exe 2076 jjdvj.exe 1688 1nhthn.exe 896 frlflll.exe 1752 xrffllx.exe 2184 jvjpd.exe 3068 fxrfrfr.exe 2260 djvdp.exe 1592 rllfflr.exe 2740 lxrlllr.exe 2200 thhbht.exe 2816 5jpvp.exe 1456 vjdjp.exe 2920 3hnttn.exe 1576 tnhttb.exe 2712 dpvpj.exe 2624 5jjvp.exe 2688 rxrlrrr.exe 2444 bbtbbb.exe 1340 tnbnnh.exe 1624 dvjdj.exe 1072 fxfffxf.exe 2424 5hntnt.exe 2164 ddvvd.exe 2368 ppdpv.exe 3020 fxflffr.exe 1992 bnhhnt.exe 2472 pjvvj.exe 536 9pjpj.exe 572 fxlxfrx.exe 716 flllllx.exe 1492 bnhhbb.exe 2972 dvvdp.exe 1604 fxrxfll.exe 844 btnnnn.exe 624 bttnnt.exe 1048 dvdpd.exe 1876 5lxxxfl.exe 1680 1rflrfl.exe -
resource yara_rule behavioral1/memory/2204-0-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2204-10-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x00080000000120fb-9.dat upx behavioral1/memory/2148-21-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0008000000016cc4-20.dat upx behavioral1/memory/2108-19-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0009000000016ccd-28.dat upx behavioral1/memory/2200-37-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0008000000016cd7-36.dat upx behavioral1/files/0x0007000000016ce8-46.dat upx behavioral1/memory/2816-47-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2768-50-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2816-44-0x0000000000260000-0x0000000000297000-memory.dmp upx behavioral1/files/0x0007000000016cf0-57.dat upx behavioral1/files/0x0007000000016d04-65.dat upx behavioral1/memory/2772-66-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x00050000000193e6-75.dat upx behavioral1/memory/2636-74-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2832-85-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x00050000000193f0-84.dat upx behavioral1/files/0x000500000001945c-94.dat upx behavioral1/files/0x000500000001948d-103.dat upx behavioral1/memory/2660-102-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x00050000000194e2-113.dat upx behavioral1/memory/2360-114-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2424-124-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x000500000001958b-123.dat upx behavioral1/files/0x00050000000195c2-134.dat upx behavioral1/memory/2872-132-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x00050000000195c4-144.dat upx behavioral1/memory/2428-143-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x00050000000195c6-152.dat upx behavioral1/memory/1984-154-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/1448-153-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x00050000000195c7-162.dat upx behavioral1/memory/2296-170-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x00050000000195c8-171.dat upx behavioral1/files/0x00050000000195ca-180.dat upx behavioral1/memory/1232-181-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x00050000000195cc-191.dat upx behavioral1/memory/1492-189-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x00050000000195ce-200.dat upx behavioral1/files/0x0009000000016ca5-208.dat upx behavioral1/files/0x00050000000195d0-216.dat upx behavioral1/memory/624-217-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x00050000000195e0-226.dat upx behavioral1/files/0x0005000000019624-234.dat upx behavioral1/memory/1008-235-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0005000000019665-243.dat upx behavioral1/memory/1756-244-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x00050000000196a0-253.dat upx behavioral1/memory/2076-262-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/files/0x0005000000019931-263.dat upx behavioral1/files/0x0005000000019bec-272.dat upx behavioral1/files/0x0005000000019bf0-279.dat upx behavioral1/files/0x0005000000019bf2-289.dat upx behavioral1/memory/1752-288-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2184-293-0x0000000000220000-0x0000000000257000-memory.dmp upx behavioral1/files/0x0005000000019c0b-298.dat upx behavioral1/memory/2260-312-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2260-331-0x0000000000220000-0x0000000000257000-memory.dmp upx behavioral1/memory/2624-369-0x00000000001B0000-0x00000000001E7000-memory.dmp upx behavioral1/memory/1340-389-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral1/memory/2424-410-0x0000000000400000-0x0000000000437000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2108 2204 d4dc49068ac36bfdcf50bd11681edae0N.exe 30 PID 2204 wrote to memory of 2108 2204 d4dc49068ac36bfdcf50bd11681edae0N.exe 30 PID 2204 wrote to memory of 2108 2204 d4dc49068ac36bfdcf50bd11681edae0N.exe 30 PID 2204 wrote to memory of 2108 2204 d4dc49068ac36bfdcf50bd11681edae0N.exe 30 PID 2108 wrote to memory of 2148 2108 jdpvd.exe 31 PID 2108 wrote to memory of 2148 2108 jdpvd.exe 31 PID 2108 wrote to memory of 2148 2108 jdpvd.exe 31 PID 2108 wrote to memory of 2148 2108 jdpvd.exe 31 PID 2148 wrote to memory of 2200 2148 nhtthn.exe 32 PID 2148 wrote to memory of 2200 2148 nhtthn.exe 32 PID 2148 wrote to memory of 2200 2148 nhtthn.exe 32 PID 2148 wrote to memory of 2200 2148 nhtthn.exe 32 PID 2200 wrote to memory of 2816 2200 btnbhh.exe 33 PID 2200 wrote to memory of 2816 2200 btnbhh.exe 33 PID 2200 wrote to memory of 2816 2200 btnbhh.exe 33 PID 2200 wrote to memory of 2816 2200 btnbhh.exe 33 PID 2816 wrote to memory of 2768 2816 7dvjv.exe 34 PID 2816 wrote to memory of 2768 2816 7dvjv.exe 34 PID 2816 wrote to memory of 2768 2816 7dvjv.exe 34 PID 2816 wrote to memory of 2768 2816 7dvjv.exe 34 PID 2768 wrote to memory of 2772 2768 bthntt.exe 35 PID 2768 wrote to memory of 2772 2768 bthntt.exe 35 PID 2768 wrote to memory of 2772 2768 bthntt.exe 35 PID 2768 wrote to memory of 2772 2768 bthntt.exe 35 PID 2772 wrote to memory of 2636 2772 jdppd.exe 36 PID 2772 wrote to memory of 2636 2772 jdppd.exe 36 PID 2772 wrote to memory of 2636 2772 jdppd.exe 36 PID 2772 wrote to memory of 2636 2772 jdppd.exe 36 PID 2636 wrote to memory of 2832 2636 rfrfflx.exe 37 PID 2636 wrote to memory of 2832 2636 rfrfflx.exe 37 PID 2636 wrote to memory of 2832 2636 rfrfflx.exe 37 PID 2636 wrote to memory of 2832 2636 rfrfflx.exe 37 PID 2832 wrote to memory of 2668 2832 7thttn.exe 38 PID 2832 wrote to memory of 2668 2832 7thttn.exe 38 PID 2832 wrote to memory of 2668 2832 7thttn.exe 38 PID 2832 wrote to memory of 2668 2832 7thttn.exe 38 PID 2668 wrote to memory of 2660 2668 lfxfrfx.exe 39 PID 2668 wrote to memory of 2660 2668 lfxfrfx.exe 39 PID 2668 wrote to memory of 2660 2668 lfxfrfx.exe 39 PID 2668 wrote to memory of 2660 2668 lfxfrfx.exe 39 PID 2660 wrote to memory of 2360 2660 fxllrrx.exe 40 PID 2660 wrote to memory of 2360 2660 fxllrrx.exe 40 PID 2660 wrote to memory of 2360 2660 fxllrrx.exe 40 PID 2660 wrote to memory of 2360 2660 fxllrrx.exe 40 PID 2360 wrote to memory of 2424 2360 bttbbh.exe 41 PID 2360 wrote to memory of 2424 2360 bttbbh.exe 41 PID 2360 wrote to memory of 2424 2360 bttbbh.exe 41 PID 2360 wrote to memory of 2424 2360 bttbbh.exe 41 PID 2424 wrote to memory of 2872 2424 ppjjv.exe 42 PID 2424 wrote to memory of 2872 2424 ppjjv.exe 42 PID 2424 wrote to memory of 2872 2424 ppjjv.exe 42 PID 2424 wrote to memory of 2872 2424 ppjjv.exe 42 PID 2872 wrote to memory of 2428 2872 7bhbnt.exe 43 PID 2872 wrote to memory of 2428 2872 7bhbnt.exe 43 PID 2872 wrote to memory of 2428 2872 7bhbnt.exe 43 PID 2872 wrote to memory of 2428 2872 7bhbnt.exe 43 PID 2428 wrote to memory of 1448 2428 ppvdv.exe 44 PID 2428 wrote to memory of 1448 2428 ppvdv.exe 44 PID 2428 wrote to memory of 1448 2428 ppvdv.exe 44 PID 2428 wrote to memory of 1448 2428 ppvdv.exe 44 PID 1448 wrote to memory of 1984 1448 xfrxrlx.exe 45 PID 1448 wrote to memory of 1984 1448 xfrxrlx.exe 45 PID 1448 wrote to memory of 1984 1448 xfrxrlx.exe 45 PID 1448 wrote to memory of 1984 1448 xfrxrlx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4dc49068ac36bfdcf50bd11681edae0N.exe"C:\Users\Admin\AppData\Local\Temp\d4dc49068ac36bfdcf50bd11681edae0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\jdpvd.exec:\jdpvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\nhtthn.exec:\nhtthn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\btnbhh.exec:\btnbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\7dvjv.exec:\7dvjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\bthntt.exec:\bthntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\jdppd.exec:\jdppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\rfrfflx.exec:\rfrfflx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\7thttn.exec:\7thttn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\lfxfrfx.exec:\lfxfrfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\fxllrrx.exec:\fxllrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\bttbbh.exec:\bttbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\ppjjv.exec:\ppjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\7bhbnt.exec:\7bhbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\ppvdv.exec:\ppvdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\xfrxrlx.exec:\xfrxrlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\llflxfr.exec:\llflxfr.exe17⤵
- Executes dropped EXE
PID:1984 -
\??\c:\5pjpd.exec:\5pjpd.exe18⤵
- Executes dropped EXE
PID:2296 -
\??\c:\3xrfffr.exec:\3xrfffr.exe19⤵
- Executes dropped EXE
PID:1232 -
\??\c:\9tnbht.exec:\9tnbht.exe20⤵
- Executes dropped EXE
PID:1492 -
\??\c:\jjddv.exec:\jjddv.exe21⤵
- Executes dropped EXE
PID:592 -
\??\c:\llxfxxl.exec:\llxfxxl.exe22⤵
- Executes dropped EXE
PID:2004 -
\??\c:\hbnbnn.exec:\hbnbnn.exe23⤵
- Executes dropped EXE
PID:624 -
\??\c:\3jddp.exec:\3jddp.exe24⤵
- Executes dropped EXE
PID:1700 -
\??\c:\3xxfrrf.exec:\3xxfrrf.exe25⤵
- Executes dropped EXE
PID:1008 -
\??\c:\3nnbnb.exec:\3nnbnb.exe26⤵
- Executes dropped EXE
PID:1756 -
\??\c:\7vjpd.exec:\7vjpd.exe27⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jjdvj.exec:\jjdvj.exe28⤵
- Executes dropped EXE
PID:2076 -
\??\c:\1nhthn.exec:\1nhthn.exe29⤵
- Executes dropped EXE
PID:1688 -
\??\c:\frlflll.exec:\frlflll.exe30⤵
- Executes dropped EXE
PID:896 -
\??\c:\xrffllx.exec:\xrffllx.exe31⤵
- Executes dropped EXE
PID:1752 -
\??\c:\jvjpd.exec:\jvjpd.exe32⤵
- Executes dropped EXE
PID:2184 -
\??\c:\fxrfrfr.exec:\fxrfrfr.exe33⤵
- Executes dropped EXE
PID:3068 -
\??\c:\djvdp.exec:\djvdp.exe34⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rllfflr.exec:\rllfflr.exe35⤵
- Executes dropped EXE
PID:1592 -
\??\c:\lxrlllr.exec:\lxrlllr.exe36⤵
- Executes dropped EXE
PID:2740 -
\??\c:\thhbht.exec:\thhbht.exe37⤵
- Executes dropped EXE
PID:2200 -
\??\c:\5jpvp.exec:\5jpvp.exe38⤵
- Executes dropped EXE
PID:2816 -
\??\c:\vjdjp.exec:\vjdjp.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1456 -
\??\c:\3hnttn.exec:\3hnttn.exe40⤵
- Executes dropped EXE
PID:2920 -
\??\c:\tnhttb.exec:\tnhttb.exe41⤵
- Executes dropped EXE
PID:1576 -
\??\c:\dpvpj.exec:\dpvpj.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\5jjvp.exec:\5jjvp.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rxrlrrr.exec:\rxrlrrr.exe44⤵
- Executes dropped EXE
PID:2688 -
\??\c:\bbtbbb.exec:\bbtbbb.exe45⤵
- Executes dropped EXE
PID:2444 -
\??\c:\tnbnnh.exec:\tnbnnh.exe46⤵
- Executes dropped EXE
PID:1340 -
\??\c:\dvjdj.exec:\dvjdj.exe47⤵
- Executes dropped EXE
PID:1624 -
\??\c:\fxfffxf.exec:\fxfffxf.exe48⤵
- Executes dropped EXE
PID:1072 -
\??\c:\5hntnt.exec:\5hntnt.exe49⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ddvvd.exec:\ddvvd.exe50⤵
- Executes dropped EXE
PID:2164 -
\??\c:\ppdpv.exec:\ppdpv.exe51⤵
- Executes dropped EXE
PID:2368 -
\??\c:\fxflffr.exec:\fxflffr.exe52⤵
- Executes dropped EXE
PID:3020 -
\??\c:\bnhhnt.exec:\bnhhnt.exe53⤵
- Executes dropped EXE
PID:1992 -
\??\c:\pjvvj.exec:\pjvvj.exe54⤵
- Executes dropped EXE
PID:2472 -
\??\c:\9pjpj.exec:\9pjpj.exe55⤵
- Executes dropped EXE
PID:536 -
\??\c:\fxlxfrx.exec:\fxlxfrx.exe56⤵
- Executes dropped EXE
PID:572 -
\??\c:\flllllx.exec:\flllllx.exe57⤵
- Executes dropped EXE
PID:716 -
\??\c:\bnhhbb.exec:\bnhhbb.exe58⤵
- Executes dropped EXE
PID:1492 -
\??\c:\dvvdp.exec:\dvvdp.exe59⤵
- Executes dropped EXE
PID:2972 -
\??\c:\fxrxfll.exec:\fxrxfll.exe60⤵
- Executes dropped EXE
PID:1604 -
\??\c:\btnnnn.exec:\btnnnn.exe61⤵
- Executes dropped EXE
PID:844 -
\??\c:\bttnnt.exec:\bttnnt.exe62⤵
- Executes dropped EXE
PID:624 -
\??\c:\dvdpd.exec:\dvdpd.exe63⤵
- Executes dropped EXE
PID:1048 -
\??\c:\5lxxxfl.exec:\5lxxxfl.exe64⤵
- Executes dropped EXE
PID:1876 -
\??\c:\1rflrfl.exec:\1rflrfl.exe65⤵
- Executes dropped EXE
PID:1680 -
\??\c:\hhthtb.exec:\hhthtb.exe66⤵PID:2316
-
\??\c:\jvpvj.exec:\jvpvj.exe67⤵PID:1936
-
\??\c:\xfrrrlf.exec:\xfrrrlf.exe68⤵PID:2996
-
\??\c:\frlxflr.exec:\frlxflr.exe69⤵PID:340
-
\??\c:\hbhhnn.exec:\hbhhnn.exe70⤵PID:900
-
\??\c:\jdppv.exec:\jdppv.exe71⤵PID:2012
-
\??\c:\rxfrlxr.exec:\rxfrlxr.exe72⤵PID:2528
-
\??\c:\rfflrxl.exec:\rfflrxl.exe73⤵PID:2080
-
\??\c:\tbnnhb.exec:\tbnnhb.exe74⤵PID:2228
-
\??\c:\hbbhbb.exec:\hbbhbb.exe75⤵PID:864
-
\??\c:\pjppp.exec:\pjppp.exe76⤵PID:1396
-
\??\c:\fxllxfl.exec:\fxllxfl.exe77⤵PID:2840
-
\??\c:\3nbhtt.exec:\3nbhtt.exe78⤵PID:2616
-
\??\c:\pppvv.exec:\pppvv.exe79⤵PID:2804
-
\??\c:\pvpdd.exec:\pvpdd.exe80⤵PID:2632
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe81⤵PID:2784
-
\??\c:\nhnbnt.exec:\nhnbnt.exe82⤵PID:2612
-
\??\c:\hbbhnn.exec:\hbbhnn.exe83⤵PID:2724
-
\??\c:\jdpjp.exec:\jdpjp.exe84⤵PID:2676
-
\??\c:\rlfxxfl.exec:\rlfxxfl.exe85⤵PID:3052
-
\??\c:\9rfxffl.exec:\9rfxffl.exe86⤵PID:2856
-
\??\c:\5tnnhh.exec:\5tnnhh.exe87⤵PID:3036
-
\??\c:\vjvjv.exec:\vjvjv.exe88⤵PID:2680
-
\??\c:\jvddd.exec:\jvddd.exe89⤵PID:1268
-
\??\c:\lxlxflf.exec:\lxlxflf.exe90⤵PID:1524
-
\??\c:\fxxrrlr.exec:\fxxrrlr.exe91⤵PID:1960
-
\??\c:\hbbnnt.exec:\hbbnnt.exe92⤵PID:1920
-
\??\c:\jvdvd.exec:\jvdvd.exe93⤵PID:2708
-
\??\c:\5vpjd.exec:\5vpjd.exe94⤵PID:2448
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe95⤵PID:828
-
\??\c:\rlrflll.exec:\rlrflll.exe96⤵PID:2096
-
\??\c:\hbnbnn.exec:\hbnbnn.exe97⤵PID:1704
-
\??\c:\hbnttt.exec:\hbnttt.exe98⤵PID:2788
-
\??\c:\9pjjd.exec:\9pjjd.exe99⤵PID:1492
-
\??\c:\rlxffll.exec:\rlxffll.exe100⤵PID:236
-
\??\c:\rlxflrx.exec:\rlxflrx.exe101⤵PID:2432
-
\??\c:\nbnnbb.exec:\nbnnbb.exe102⤵PID:1980
-
\??\c:\thbhnn.exec:\thbhnn.exe103⤵PID:2276
-
\??\c:\jvddd.exec:\jvddd.exe104⤵PID:1628
-
\??\c:\pjvjj.exec:\pjvjj.exe105⤵PID:1536
-
\??\c:\rfrxxfl.exec:\rfrxxfl.exe106⤵PID:2152
-
\??\c:\hbtbht.exec:\hbtbht.exe107⤵
- System Location Discovery: System Language Discovery
PID:2156 -
\??\c:\5thnnn.exec:\5thnnn.exe108⤵PID:1212
-
\??\c:\5jdjd.exec:\5jdjd.exe109⤵PID:2452
-
\??\c:\pjvpp.exec:\pjvpp.exe110⤵PID:888
-
\??\c:\9fxrffr.exec:\9fxrffr.exe111⤵PID:896
-
\??\c:\bbnbbh.exec:\bbnbbh.exe112⤵PID:1708
-
\??\c:\7nttbb.exec:\7nttbb.exe113⤵PID:2204
-
\??\c:\nbbhnh.exec:\nbbhnh.exe114⤵PID:2800
-
\??\c:\dpddd.exec:\dpddd.exe115⤵PID:3068
-
\??\c:\rxfxfff.exec:\rxfxfff.exe116⤵PID:2148
-
\??\c:\ffrrrrr.exec:\ffrrrrr.exe117⤵PID:2760
-
\??\c:\9tbbtb.exec:\9tbbtb.exe118⤵PID:2736
-
\??\c:\pjdpj.exec:\pjdpj.exe119⤵PID:2852
-
\??\c:\3jddj.exec:\3jddj.exe120⤵PID:2644
-
\??\c:\xrflrxf.exec:\xrflrxf.exe121⤵PID:2128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-