Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 14:36
Behavioral task
behavioral1
Sample
503a2012d743dd9348298cd4a6cc4330N.exe
Resource
win7-20240704-en
6 signatures
120 seconds
General
-
Target
503a2012d743dd9348298cd4a6cc4330N.exe
-
Size
332KB
-
MD5
503a2012d743dd9348298cd4a6cc4330
-
SHA1
823593367b45c33a899a25926994b017606cea07
-
SHA256
9dbaacefe3e8e2cbe6407394fbb10bbfb18115776dfc5625ee96adf9a11a4e63
-
SHA512
14ef643a348ef9b6921e4bcf1c053f4f2b0518a2ec64ac521971f1dce691d83f10a1cc5325f339650d79b3033e577c6d2163cfee729422a3f50060e7c61b923a
-
SSDEEP
6144:9cm4FmowdHoS4BftapTs8Hoo+6MjTVhRDqzL:/4wFHoS4d0G8HoljTVhRDqzL
Malware Config
Signatures
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral1/memory/2028-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1572-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1972-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/792-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/792-149-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2544-158-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2544-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-192-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2584-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1140-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1028-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1868-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-307-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1848-322-0x0000000077B20000-0x0000000077C3F000-memory.dmp family_blackmoon behavioral1/memory/2060-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1688-338-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2220-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-377-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2692-381-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2692-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1336-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1740-477-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/764-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-524-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2580-527-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1516-568-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-599-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1616-663-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1616-682-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2588-701-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2804-709-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2804-708-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-718-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2648-721-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2804-730-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2524-737-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1956-746-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1640-867-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1516-870-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2644-986-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1792-1043-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1648-1053-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2040-1091-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2740-1098-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1964-1130-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1964-1129-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2212-1158-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2396 nnbhtt.exe 2456 nhttbb.exe 2844 tnbntb.exe 1572 ttnhtt.exe 3016 htbbhh.exe 1972 tnhnnt.exe 2096 nhtbbb.exe 2752 vjdjv.exe 2616 dpjvj.exe 2520 vppdj.exe 2276 1xlllll.exe 2496 7xllrrx.exe 2964 tthhhh.exe 2968 vjvvv.exe 792 hbhntn.exe 2544 xxlrxrr.exe 1808 rrlrxrr.exe 2300 ttbttn.exe 2380 tttnhb.exe 1232 ffxrflx.exe 2584 jvpdj.exe 2740 bthbbb.exe 2080 rxfrxxf.exe 2920 9pvdj.exe 2340 nttnbh.exe 2068 frrfxlf.exe 1080 vpvpp.exe 620 rfxxrrr.exe 1876 vjjpp.exe 1140 djvjp.exe 1028 jjdjj.exe 2204 7pjpd.exe 1868 hbttth.exe 1764 pjvpv.exe 1948 tntbhh.exe 1848 5tbtnb.exe 1688 dppdp.exe 2432 bnhhth.exe 804 pjjdd.exe 1616 1nnnbt.exe 2924 dvdvp.exe 2244 btnntn.exe 2220 3lxxxll.exe 2692 3pdpj.exe 2976 dpvvd.exe 2344 httbhn.exe 2336 rlllrrx.exe 2812 jvvdd.exe 2508 jdpvj.exe 2276 nbnnbb.exe 2488 lfrrlxl.exe 2148 jjvdp.exe 2652 5bntnt.exe 2968 rfflxxx.exe 1336 9ppvd.exe 1648 nnhtht.exe 1800 rxrxlxl.exe 1740 xrrlxxf.exe 1692 rffxxxx.exe 764 vvdjj.exe 1660 jjvvv.exe 1304 lrrrxlx.exe 2660 bthntt.exe 2988 pjddj.exe -
resource yara_rule behavioral1/memory/2028-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120ff-5.dat upx behavioral1/memory/2028-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a000000015cf7-18.dat upx behavioral1/memory/2456-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d13-26.dat upx behavioral1/memory/2456-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d34-36.dat upx behavioral1/files/0x0007000000015d56-45.dat upx behavioral1/memory/3016-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1572-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2844-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d62-54.dat upx behavioral1/memory/1972-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2752-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015ce1-73.dat upx behavioral1/files/0x0007000000015d6a-63.dat upx behavioral1/memory/2616-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001657e-82.dat upx behavioral1/memory/2752-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174a8-92.dat upx behavioral1/memory/2520-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017562-100.dat upx behavioral1/memory/2276-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0014000000018655-111.dat upx behavioral1/memory/2496-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000018660-119.dat upx behavioral1/memory/2964-124-0x0000000000230000-0x0000000000257000-memory.dmp upx behavioral1/files/0x0005000000018679-131.dat upx behavioral1/memory/2968-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2964-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2968-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/792-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018784-140.dat upx behavioral1/files/0x0006000000018c0c-148.dat upx behavioral1/files/0x0006000000018c18-159.dat upx behavioral1/memory/2544-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018f45-167.dat upx behavioral1/memory/2300-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001902d-174.dat upx behavioral1/files/0x00060000000190c0-182.dat upx behavioral1/memory/2380-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190d2-193.dat upx behavioral1/files/0x00050000000191c6-204.dat upx behavioral1/memory/2300-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2584-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191f1-211.dat upx behavioral1/files/0x000500000001921e-218.dat upx behavioral1/files/0x0005000000019236-227.dat upx behavioral1/files/0x0005000000019248-236.dat upx behavioral1/files/0x000500000001924b-244.dat upx behavioral1/memory/2068-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2080-247-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019255-255.dat upx behavioral1/files/0x0005000000019258-262.dat upx behavioral1/memory/1140-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019276-272.dat upx behavioral1/files/0x000500000001927e-280.dat upx behavioral1/files/0x0005000000019345-290.dat upx behavioral1/memory/1028-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1868-304-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1764-307-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2060-329-0x0000000000250000-0x0000000000277000-memory.dmp upx behavioral1/memory/2060-332-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlxfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2028 wrote to memory of 2396 2028 503a2012d743dd9348298cd4a6cc4330N.exe 28 PID 2028 wrote to memory of 2396 2028 503a2012d743dd9348298cd4a6cc4330N.exe 28 PID 2028 wrote to memory of 2396 2028 503a2012d743dd9348298cd4a6cc4330N.exe 28 PID 2028 wrote to memory of 2396 2028 503a2012d743dd9348298cd4a6cc4330N.exe 28 PID 2396 wrote to memory of 2456 2396 nnbhtt.exe 29 PID 2396 wrote to memory of 2456 2396 nnbhtt.exe 29 PID 2396 wrote to memory of 2456 2396 nnbhtt.exe 29 PID 2396 wrote to memory of 2456 2396 nnbhtt.exe 29 PID 2456 wrote to memory of 2844 2456 nhttbb.exe 30 PID 2456 wrote to memory of 2844 2456 nhttbb.exe 30 PID 2456 wrote to memory of 2844 2456 nhttbb.exe 30 PID 2456 wrote to memory of 2844 2456 nhttbb.exe 30 PID 2844 wrote to memory of 1572 2844 tnbntb.exe 31 PID 2844 wrote to memory of 1572 2844 tnbntb.exe 31 PID 2844 wrote to memory of 1572 2844 tnbntb.exe 31 PID 2844 wrote to memory of 1572 2844 tnbntb.exe 31 PID 1572 wrote to memory of 3016 1572 ttnhtt.exe 32 PID 1572 wrote to memory of 3016 1572 ttnhtt.exe 32 PID 1572 wrote to memory of 3016 1572 ttnhtt.exe 32 PID 1572 wrote to memory of 3016 1572 ttnhtt.exe 32 PID 3016 wrote to memory of 1972 3016 htbbhh.exe 33 PID 3016 wrote to memory of 1972 3016 htbbhh.exe 33 PID 3016 wrote to memory of 1972 3016 htbbhh.exe 33 PID 3016 wrote to memory of 1972 3016 htbbhh.exe 33 PID 1972 wrote to memory of 2096 1972 tnhnnt.exe 34 PID 1972 wrote to memory of 2096 1972 tnhnnt.exe 34 PID 1972 wrote to memory of 2096 1972 tnhnnt.exe 34 PID 1972 wrote to memory of 2096 1972 tnhnnt.exe 34 PID 2096 wrote to memory of 2752 2096 nhtbbb.exe 35 PID 2096 wrote to memory of 2752 2096 nhtbbb.exe 35 PID 2096 wrote to memory of 2752 2096 nhtbbb.exe 35 PID 2096 wrote to memory of 2752 2096 nhtbbb.exe 35 PID 2752 wrote to memory of 2616 2752 vjdjv.exe 36 PID 2752 wrote to memory of 2616 2752 vjdjv.exe 36 PID 2752 wrote to memory of 2616 2752 vjdjv.exe 36 PID 2752 wrote to memory of 2616 2752 vjdjv.exe 36 PID 2616 wrote to memory of 2520 2616 dpjvj.exe 37 PID 2616 wrote to memory of 2520 2616 dpjvj.exe 37 PID 2616 wrote to memory of 2520 2616 dpjvj.exe 37 PID 2616 wrote to memory of 2520 2616 dpjvj.exe 37 PID 2520 wrote to memory of 2276 2520 vppdj.exe 38 PID 2520 wrote to memory of 2276 2520 vppdj.exe 38 PID 2520 wrote to memory of 2276 2520 vppdj.exe 38 PID 2520 wrote to memory of 2276 2520 vppdj.exe 38 PID 2276 wrote to memory of 2496 2276 1xlllll.exe 39 PID 2276 wrote to memory of 2496 2276 1xlllll.exe 39 PID 2276 wrote to memory of 2496 2276 1xlllll.exe 39 PID 2276 wrote to memory of 2496 2276 1xlllll.exe 39 PID 2496 wrote to memory of 2964 2496 7xllrrx.exe 40 PID 2496 wrote to memory of 2964 2496 7xllrrx.exe 40 PID 2496 wrote to memory of 2964 2496 7xllrrx.exe 40 PID 2496 wrote to memory of 2964 2496 7xllrrx.exe 40 PID 2964 wrote to memory of 2968 2964 tthhhh.exe 41 PID 2964 wrote to memory of 2968 2964 tthhhh.exe 41 PID 2964 wrote to memory of 2968 2964 tthhhh.exe 41 PID 2964 wrote to memory of 2968 2964 tthhhh.exe 41 PID 2968 wrote to memory of 792 2968 vjvvv.exe 42 PID 2968 wrote to memory of 792 2968 vjvvv.exe 42 PID 2968 wrote to memory of 792 2968 vjvvv.exe 42 PID 2968 wrote to memory of 792 2968 vjvvv.exe 42 PID 792 wrote to memory of 2544 792 hbhntn.exe 43 PID 792 wrote to memory of 2544 792 hbhntn.exe 43 PID 792 wrote to memory of 2544 792 hbhntn.exe 43 PID 792 wrote to memory of 2544 792 hbhntn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\503a2012d743dd9348298cd4a6cc4330N.exe"C:\Users\Admin\AppData\Local\Temp\503a2012d743dd9348298cd4a6cc4330N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\nnbhtt.exec:\nnbhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\nhttbb.exec:\nhttbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\tnbntb.exec:\tnbntb.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\ttnhtt.exec:\ttnhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\htbbhh.exec:\htbbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\tnhnnt.exec:\tnhnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\nhtbbb.exec:\nhtbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\vjdjv.exec:\vjdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\dpjvj.exec:\dpjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\vppdj.exec:\vppdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\1xlllll.exec:\1xlllll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\7xllrrx.exec:\7xllrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\tthhhh.exec:\tthhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\vjvvv.exec:\vjvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\hbhntn.exec:\hbhntn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\xxlrxrr.exec:\xxlrxrr.exe17⤵
- Executes dropped EXE
PID:2544 -
\??\c:\rrlrxrr.exec:\rrlrxrr.exe18⤵
- Executes dropped EXE
PID:1808 -
\??\c:\ttbttn.exec:\ttbttn.exe19⤵
- Executes dropped EXE
PID:2300 -
\??\c:\tttnhb.exec:\tttnhb.exe20⤵
- Executes dropped EXE
PID:2380 -
\??\c:\ffxrflx.exec:\ffxrflx.exe21⤵
- Executes dropped EXE
PID:1232 -
\??\c:\jvpdj.exec:\jvpdj.exe22⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bthbbb.exec:\bthbbb.exe23⤵
- Executes dropped EXE
PID:2740 -
\??\c:\rxfrxxf.exec:\rxfrxxf.exe24⤵
- Executes dropped EXE
PID:2080 -
\??\c:\9pvdj.exec:\9pvdj.exe25⤵
- Executes dropped EXE
PID:2920 -
\??\c:\nttnbh.exec:\nttnbh.exe26⤵
- Executes dropped EXE
PID:2340 -
\??\c:\frrfxlf.exec:\frrfxlf.exe27⤵
- Executes dropped EXE
PID:2068 -
\??\c:\vpvpp.exec:\vpvpp.exe28⤵
- Executes dropped EXE
PID:1080 -
\??\c:\rfxxrrr.exec:\rfxxrrr.exe29⤵
- Executes dropped EXE
PID:620 -
\??\c:\vjjpp.exec:\vjjpp.exe30⤵
- Executes dropped EXE
PID:1876 -
\??\c:\djvjp.exec:\djvjp.exe31⤵
- Executes dropped EXE
PID:1140 -
\??\c:\jjdjj.exec:\jjdjj.exe32⤵
- Executes dropped EXE
PID:1028 -
\??\c:\7pjpd.exec:\7pjpd.exe33⤵
- Executes dropped EXE
PID:2204 -
\??\c:\hbttth.exec:\hbttth.exe34⤵
- Executes dropped EXE
PID:1868 -
\??\c:\pjvpv.exec:\pjvpv.exe35⤵
- Executes dropped EXE
PID:1764 -
\??\c:\tntbhh.exec:\tntbhh.exe36⤵
- Executes dropped EXE
PID:1948 -
\??\c:\5tbtnb.exec:\5tbtnb.exe37⤵
- Executes dropped EXE
PID:1848 -
\??\c:\fflllfl.exec:\fflllfl.exe38⤵PID:2060
-
\??\c:\dppdp.exec:\dppdp.exe39⤵
- Executes dropped EXE
PID:1688 -
\??\c:\bnhhth.exec:\bnhhth.exe40⤵
- Executes dropped EXE
PID:2432 -
\??\c:\pjjdd.exec:\pjjdd.exe41⤵
- Executes dropped EXE
PID:804 -
\??\c:\1nnnbt.exec:\1nnnbt.exe42⤵
- Executes dropped EXE
PID:1616 -
\??\c:\dvdvp.exec:\dvdvp.exe43⤵
- Executes dropped EXE
PID:2924 -
\??\c:\btnntn.exec:\btnntn.exe44⤵
- Executes dropped EXE
PID:2244 -
\??\c:\3lxxxll.exec:\3lxxxll.exe45⤵
- Executes dropped EXE
PID:2220 -
\??\c:\3pdpj.exec:\3pdpj.exe46⤵
- Executes dropped EXE
PID:2692 -
\??\c:\dpvvd.exec:\dpvvd.exe47⤵
- Executes dropped EXE
PID:2976 -
\??\c:\httbhn.exec:\httbhn.exe48⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rlllrrx.exec:\rlllrrx.exe49⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jvvdd.exec:\jvvdd.exe50⤵
- Executes dropped EXE
PID:2812 -
\??\c:\jdpvj.exec:\jdpvj.exe51⤵
- Executes dropped EXE
PID:2508 -
\??\c:\nbnnbb.exec:\nbnnbb.exe52⤵
- Executes dropped EXE
PID:2276 -
\??\c:\lfrrlxl.exec:\lfrrlxl.exe53⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jjvdp.exec:\jjvdp.exe54⤵
- Executes dropped EXE
PID:2148 -
\??\c:\5bntnt.exec:\5bntnt.exe55⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rfflxxx.exec:\rfflxxx.exe56⤵
- Executes dropped EXE
PID:2968 -
\??\c:\9ppvd.exec:\9ppvd.exe57⤵
- Executes dropped EXE
PID:1336 -
\??\c:\nnhtht.exec:\nnhtht.exe58⤵
- Executes dropped EXE
PID:1648 -
\??\c:\rxrxlxl.exec:\rxrxlxl.exe59⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xrrlxxf.exec:\xrrlxxf.exe60⤵
- Executes dropped EXE
PID:1740 -
\??\c:\rffxxxx.exec:\rffxxxx.exe61⤵
- Executes dropped EXE
PID:1692 -
\??\c:\vvdjj.exec:\vvdjj.exe62⤵
- Executes dropped EXE
PID:764 -
\??\c:\jjvvv.exec:\jjvvv.exe63⤵
- Executes dropped EXE
PID:1660 -
\??\c:\lrrrxlx.exec:\lrrrxlx.exe64⤵
- Executes dropped EXE
PID:1304 -
\??\c:\bthntt.exec:\bthntt.exe65⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pjddj.exec:\pjddj.exe66⤵
- Executes dropped EXE
PID:2988 -
\??\c:\9nhhtb.exec:\9nhhtb.exe67⤵PID:2024
-
\??\c:\7pvpv.exec:\7pvpv.exe68⤵PID:2580
-
\??\c:\btnthh.exec:\btnthh.exe69⤵PID:2808
-
\??\c:\5xxffrf.exec:\5xxffrf.exe70⤵PID:532
-
\??\c:\ffffxlf.exec:\ffffxlf.exe71⤵PID:2068
-
\??\c:\vpjpv.exec:\vpjpv.exe72⤵PID:1560
-
\??\c:\jjpdj.exec:\jjpdj.exe73⤵PID:1080
-
\??\c:\bhbhnn.exec:\bhbhnn.exe74⤵PID:1516
-
\??\c:\rllxllr.exec:\rllxllr.exe75⤵PID:2212
-
\??\c:\rlxxlfl.exec:\rlxxlfl.exe76⤵PID:564
-
\??\c:\dvjjp.exec:\dvjjp.exe77⤵PID:1140
-
\??\c:\1hntth.exec:\1hntth.exe78⤵PID:2360
-
\??\c:\hbtbnb.exec:\hbtbnb.exe79⤵PID:2204
-
\??\c:\djppp.exec:\djppp.exe80⤵PID:2316
-
\??\c:\xfrffxr.exec:\xfrffxr.exe81⤵PID:888
-
\??\c:\vvjvd.exec:\vvjvd.exe82⤵PID:2440
-
\??\c:\rffxlff.exec:\rffxlff.exe83⤵PID:2028
-
\??\c:\5djjp.exec:\5djjp.exe84⤵PID:2240
-
\??\c:\tbthht.exec:\tbthht.exe85⤵PID:2060
-
\??\c:\vjpvj.exec:\vjpvj.exe86⤵PID:1688
-
\??\c:\hbbbnb.exec:\hbbbnb.exe87⤵PID:2420
-
\??\c:\rlfxlrf.exec:\rlfxlrf.exe88⤵PID:2284
-
\??\c:\jvpvj.exec:\jvpvj.exe89⤵
- System Location Discovery: System Language Discovery
PID:1616 -
\??\c:\llflfrl.exec:\llflfrl.exe90⤵PID:2924
-
\??\c:\vvpdj.exec:\vvpdj.exe91⤵PID:2592
-
\??\c:\llrxlrf.exec:\llrxlrf.exe92⤵PID:1936
-
\??\c:\jvpvv.exec:\jvpvv.exe93⤵PID:2688
-
\??\c:\nhnhhb.exec:\nhnhhb.exe94⤵PID:2976
-
\??\c:\frffrfr.exec:\frffrfr.exe95⤵PID:2588
-
\??\c:\thntht.exec:\thntht.exe96⤵PID:2804
-
\??\c:\pjvvd.exec:\pjvvd.exe97⤵PID:2524
-
\??\c:\rlrlrrr.exec:\rlrlrrr.exe98⤵PID:2648
-
\??\c:\rlflrll.exec:\rlflrll.exe99⤵PID:2484
-
\??\c:\jpddj.exec:\jpddj.exe100⤵PID:1520
-
\??\c:\hhhbbt.exec:\hhhbbt.exe101⤵PID:1508
-
\??\c:\xfrxllr.exec:\xfrxllr.exe102⤵PID:1956
-
\??\c:\pjdpd.exec:\pjdpd.exe103⤵PID:1792
-
\??\c:\hnbnbh.exec:\hnbnbh.exe104⤵PID:1912
-
\??\c:\xfxrfff.exec:\xfxrfff.exe105⤵PID:492
-
\??\c:\thttth.exec:\thttth.exe106⤵PID:1800
-
\??\c:\dpvdj.exec:\dpvdj.exe107⤵PID:1672
-
\??\c:\hbtbhn.exec:\hbtbhn.exe108⤵PID:1496
-
\??\c:\rlfxfxl.exec:\rlfxfxl.exe109⤵PID:1600
-
\??\c:\bhnnbt.exec:\bhnnbt.exe110⤵PID:1660
-
\??\c:\9jvvd.exec:\9jvvd.exe111⤵PID:2572
-
\??\c:\frlllrx.exec:\frlllrx.exe112⤵PID:2584
-
\??\c:\3xllrrx.exec:\3xllrrx.exe113⤵PID:2304
-
\??\c:\btnhnb.exec:\btnhnb.exe114⤵PID:2940
-
\??\c:\3xlxfrr.exec:\3xlxfrr.exe115⤵
- System Location Discovery: System Language Discovery
PID:344 -
\??\c:\7dppp.exec:\7dppp.exe116⤵PID:444
-
\??\c:\ffxrxlr.exec:\ffxrxlr.exe117⤵PID:1056
-
\??\c:\thbhbb.exec:\thbhbb.exe118⤵PID:532
-
\??\c:\3xrrrrr.exec:\3xrrrrr.exe119⤵PID:2824
-
\??\c:\pddpj.exec:\pddpj.exe120⤵PID:1828
-
\??\c:\5hhhhn.exec:\5hhhhn.exe121⤵PID:1640
-
\??\c:\5vvdj.exec:\5vvdj.exe122⤵PID:1516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-