Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 04:49
Behavioral task
behavioral1
Sample
77ac26e278ceb0b8adad7d14d9d0c590N.exe
Resource
win7-20240704-en
6 signatures
120 seconds
General
-
Target
77ac26e278ceb0b8adad7d14d9d0c590N.exe
-
Size
371KB
-
MD5
77ac26e278ceb0b8adad7d14d9d0c590
-
SHA1
21bec9557e25c47db9c23490064859f3e3ddb02f
-
SHA256
e3ce0fba8b108b248009c675cf57c681866c6b95021070e97f5e24e207f580e5
-
SHA512
baa9d562c11863064ab4a8a4fe5ecea4362b188c839a4ebbf2fcf7097595b5cd28ebab9ff86c60b70f6faecb62ec33a57c3b1652830bac793c62fc95ad29f9dc
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpSwp9OD0Ibss:y4wFHoS3eFaKHpNKbbss
Malware Config
Signatures
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/2388-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-80-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2120-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/832-111-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2140-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1456-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2032-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2052-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1492-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2296-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1144-223-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1792-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2376-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1112-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-422-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2132-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-454-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2492-452-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2856-475-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1756-554-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-608-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-607-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2804-606-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/980-669-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/484-731-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/468-769-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1748-790-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-911-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1708-913-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2428-973-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2748-1114-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2804-1142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/652-1295-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/652-1314-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/984-1329-0x00000000002D0000-0x00000000002F7000-memory.dmp family_blackmoon behavioral1/memory/324-1342-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1980-1356-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1732-1369-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1980-1376-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2872-1407-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2400 3pjjv.exe 1728 jdjjj.exe 2276 tnhtbb.exe 2828 dvpjv.exe 2744 nhtnbb.exe 2788 lfllrlf.exe 2120 hbbbtb.exe 2600 fxrrffr.exe 3048 5nhbtb.exe 1716 9dppv.exe 832 fxxlrlr.exe 2908 hbhhtb.exe 2140 vdjvd.exe 2588 hbtbnt.exe 1456 pvpdj.exe 1640 nhtnht.exe 2032 vjjjp.exe 2052 jdpdj.exe 1576 9hthnt.exe 1492 fxrxlrx.exe 1688 ntnthh.exe 2296 vpddj.exe 1144 5lxxxfl.exe 2992 vvpdp.exe 1616 djpdd.exe 1792 llffllr.exe 2376 tnbhnn.exe 2988 nthbnn.exe 2448 xrflxfl.exe 892 vpvdj.exe 2148 rlxxxxl.exe 2544 3tnhnn.exe 2400 ddvdj.exe 2280 9fxrxrr.exe 2888 3hnttb.exe 2848 pvjjd.exe 2752 jjdvd.exe 2800 ffrlrxl.exe 2976 rflflrf.exe 2636 5tbbbh.exe 2776 ddjpv.exe 2596 jjvpd.exe 2600 rfxfllx.exe 2676 nhbhtb.exe 3048 7tnnnn.exe 2100 vvvpd.exe 1112 frffxxf.exe 2868 9ffxlrf.exe 2012 bbbhhb.exe 1664 ppdjp.exe 2588 vjjdj.exe 1832 frlxfrr.exe 2912 7flflrf.exe 2004 tnhhtt.exe 2132 vpdjv.exe 2492 ddvdj.exe 576 llxlfll.exe 1416 7nnnnn.exe 1528 jdpvj.exe 2856 5fffllx.exe 652 ffxfrxl.exe 1620 5bnnnt.exe 1840 9bhhnb.exe 692 jjdpv.exe -
resource yara_rule behavioral1/memory/2388-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000012273-6.dat upx behavioral1/memory/2388-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015d22-19.dat upx behavioral1/memory/1728-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2400-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2276-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d39-28.dat upx behavioral1/memory/1728-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d71-37.dat upx behavioral1/memory/2828-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2828-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d79-48.dat upx behavioral1/memory/2744-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d81-57.dat upx behavioral1/files/0x0009000000015eb1-68.dat upx behavioral1/memory/2788-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015f19-81.dat upx behavioral1/memory/2120-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3048-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ccd-90.dat upx behavioral1/memory/2600-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ceb-100.dat upx behavioral1/files/0x0006000000016d20-107.dat upx behavioral1/files/0x0006000000016d30-117.dat upx behavioral1/files/0x0006000000016d39-124.dat upx behavioral1/files/0x0006000000016d41-131.dat upx behavioral1/memory/2140-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d49-143.dat upx behavioral1/memory/2588-141-0x00000000002A0000-0x00000000002C7000-memory.dmp upx behavioral1/files/0x0006000000016d5d-150.dat upx behavioral1/memory/1456-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2032-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d62-161.dat upx behavioral1/files/0x0009000000015cf4-178.dat upx behavioral1/memory/2052-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d66-170.dat upx behavioral1/memory/1492-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d6d-186.dat upx behavioral1/memory/1688-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d89-196.dat upx behavioral1/memory/1492-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dde-204.dat upx behavioral1/files/0x0006000000016de1-214.dat upx behavioral1/memory/2296-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1144-221-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000016de9-225.dat upx behavioral1/files/0x0006000000016ec4-231.dat upx behavioral1/memory/1792-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017041-241.dat upx behavioral1/memory/2376-251-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017487-250.dat upx behavioral1/files/0x00060000000174ca-266.dat upx behavioral1/files/0x0006000000017491-259.dat upx behavioral1/files/0x0009000000018671-276.dat upx behavioral1/memory/2448-274-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001867d-283.dat upx behavioral1/files/0x00050000000186de-291.dat upx behavioral1/memory/2148-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2400-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2848-325-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2596-357-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2100-388-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1112-395-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rllrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrllfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 2400 2388 77ac26e278ceb0b8adad7d14d9d0c590N.exe 30 PID 2388 wrote to memory of 2400 2388 77ac26e278ceb0b8adad7d14d9d0c590N.exe 30 PID 2388 wrote to memory of 2400 2388 77ac26e278ceb0b8adad7d14d9d0c590N.exe 30 PID 2388 wrote to memory of 2400 2388 77ac26e278ceb0b8adad7d14d9d0c590N.exe 30 PID 2400 wrote to memory of 1728 2400 3pjjv.exe 31 PID 2400 wrote to memory of 1728 2400 3pjjv.exe 31 PID 2400 wrote to memory of 1728 2400 3pjjv.exe 31 PID 2400 wrote to memory of 1728 2400 3pjjv.exe 31 PID 1728 wrote to memory of 2276 1728 jdjjj.exe 32 PID 1728 wrote to memory of 2276 1728 jdjjj.exe 32 PID 1728 wrote to memory of 2276 1728 jdjjj.exe 32 PID 1728 wrote to memory of 2276 1728 jdjjj.exe 32 PID 2276 wrote to memory of 2828 2276 tnhtbb.exe 33 PID 2276 wrote to memory of 2828 2276 tnhtbb.exe 33 PID 2276 wrote to memory of 2828 2276 tnhtbb.exe 33 PID 2276 wrote to memory of 2828 2276 tnhtbb.exe 33 PID 2828 wrote to memory of 2744 2828 dvpjv.exe 34 PID 2828 wrote to memory of 2744 2828 dvpjv.exe 34 PID 2828 wrote to memory of 2744 2828 dvpjv.exe 34 PID 2828 wrote to memory of 2744 2828 dvpjv.exe 34 PID 2744 wrote to memory of 2788 2744 nhtnbb.exe 35 PID 2744 wrote to memory of 2788 2744 nhtnbb.exe 35 PID 2744 wrote to memory of 2788 2744 nhtnbb.exe 35 PID 2744 wrote to memory of 2788 2744 nhtnbb.exe 35 PID 2788 wrote to memory of 2120 2788 lfllrlf.exe 36 PID 2788 wrote to memory of 2120 2788 lfllrlf.exe 36 PID 2788 wrote to memory of 2120 2788 lfllrlf.exe 36 PID 2788 wrote to memory of 2120 2788 lfllrlf.exe 36 PID 2120 wrote to memory of 2600 2120 hbbbtb.exe 37 PID 2120 wrote to memory of 2600 2120 hbbbtb.exe 37 PID 2120 wrote to memory of 2600 2120 hbbbtb.exe 37 PID 2120 wrote to memory of 2600 2120 hbbbtb.exe 37 PID 2600 wrote to memory of 3048 2600 fxrrffr.exe 38 PID 2600 wrote to memory of 3048 2600 fxrrffr.exe 38 PID 2600 wrote to memory of 3048 2600 fxrrffr.exe 38 PID 2600 wrote to memory of 3048 2600 fxrrffr.exe 38 PID 3048 wrote to memory of 1716 3048 5nhbtb.exe 39 PID 3048 wrote to memory of 1716 3048 5nhbtb.exe 39 PID 3048 wrote to memory of 1716 3048 5nhbtb.exe 39 PID 3048 wrote to memory of 1716 3048 5nhbtb.exe 39 PID 1716 wrote to memory of 832 1716 9dppv.exe 40 PID 1716 wrote to memory of 832 1716 9dppv.exe 40 PID 1716 wrote to memory of 832 1716 9dppv.exe 40 PID 1716 wrote to memory of 832 1716 9dppv.exe 40 PID 832 wrote to memory of 2908 832 fxxlrlr.exe 41 PID 832 wrote to memory of 2908 832 fxxlrlr.exe 41 PID 832 wrote to memory of 2908 832 fxxlrlr.exe 41 PID 832 wrote to memory of 2908 832 fxxlrlr.exe 41 PID 2908 wrote to memory of 2140 2908 hbhhtb.exe 42 PID 2908 wrote to memory of 2140 2908 hbhhtb.exe 42 PID 2908 wrote to memory of 2140 2908 hbhhtb.exe 42 PID 2908 wrote to memory of 2140 2908 hbhhtb.exe 42 PID 2140 wrote to memory of 2588 2140 vdjvd.exe 43 PID 2140 wrote to memory of 2588 2140 vdjvd.exe 43 PID 2140 wrote to memory of 2588 2140 vdjvd.exe 43 PID 2140 wrote to memory of 2588 2140 vdjvd.exe 43 PID 2588 wrote to memory of 1456 2588 hbtbnt.exe 44 PID 2588 wrote to memory of 1456 2588 hbtbnt.exe 44 PID 2588 wrote to memory of 1456 2588 hbtbnt.exe 44 PID 2588 wrote to memory of 1456 2588 hbtbnt.exe 44 PID 1456 wrote to memory of 1640 1456 pvpdj.exe 45 PID 1456 wrote to memory of 1640 1456 pvpdj.exe 45 PID 1456 wrote to memory of 1640 1456 pvpdj.exe 45 PID 1456 wrote to memory of 1640 1456 pvpdj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\77ac26e278ceb0b8adad7d14d9d0c590N.exe"C:\Users\Admin\AppData\Local\Temp\77ac26e278ceb0b8adad7d14d9d0c590N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\3pjjv.exec:\3pjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\jdjjj.exec:\jdjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\tnhtbb.exec:\tnhtbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\dvpjv.exec:\dvpjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\nhtnbb.exec:\nhtnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\lfllrlf.exec:\lfllrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\hbbbtb.exec:\hbbbtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\fxrrffr.exec:\fxrrffr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\5nhbtb.exec:\5nhbtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\9dppv.exec:\9dppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\fxxlrlr.exec:\fxxlrlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\hbhhtb.exec:\hbhhtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\vdjvd.exec:\vdjvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\hbtbnt.exec:\hbtbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\pvpdj.exec:\pvpdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\nhtnht.exec:\nhtnht.exe17⤵
- Executes dropped EXE
PID:1640 -
\??\c:\vjjjp.exec:\vjjjp.exe18⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jdpdj.exec:\jdpdj.exe19⤵
- Executes dropped EXE
PID:2052 -
\??\c:\9hthnt.exec:\9hthnt.exe20⤵
- Executes dropped EXE
PID:1576 -
\??\c:\fxrxlrx.exec:\fxrxlrx.exe21⤵
- Executes dropped EXE
PID:1492 -
\??\c:\ntnthh.exec:\ntnthh.exe22⤵
- Executes dropped EXE
PID:1688 -
\??\c:\vpddj.exec:\vpddj.exe23⤵
- Executes dropped EXE
PID:2296 -
\??\c:\5lxxxfl.exec:\5lxxxfl.exe24⤵
- Executes dropped EXE
PID:1144 -
\??\c:\vvpdp.exec:\vvpdp.exe25⤵
- Executes dropped EXE
PID:2992 -
\??\c:\djpdd.exec:\djpdd.exe26⤵
- Executes dropped EXE
PID:1616 -
\??\c:\llffllr.exec:\llffllr.exe27⤵
- Executes dropped EXE
PID:1792 -
\??\c:\tnbhnn.exec:\tnbhnn.exe28⤵
- Executes dropped EXE
PID:2376 -
\??\c:\nthbnn.exec:\nthbnn.exe29⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xrflxfl.exec:\xrflxfl.exe30⤵
- Executes dropped EXE
PID:2448 -
\??\c:\vpvdj.exec:\vpvdj.exe31⤵
- Executes dropped EXE
PID:892 -
\??\c:\rlxxxxl.exec:\rlxxxxl.exe32⤵
- Executes dropped EXE
PID:2148 -
\??\c:\3tnhnn.exec:\3tnhnn.exe33⤵
- Executes dropped EXE
PID:2544 -
\??\c:\ddvdj.exec:\ddvdj.exe34⤵
- Executes dropped EXE
PID:2400 -
\??\c:\9fxrxrr.exec:\9fxrxrr.exe35⤵
- Executes dropped EXE
PID:2280 -
\??\c:\3hnttb.exec:\3hnttb.exe36⤵
- Executes dropped EXE
PID:2888 -
\??\c:\pvjjd.exec:\pvjjd.exe37⤵
- Executes dropped EXE
PID:2848 -
\??\c:\jjdvd.exec:\jjdvd.exe38⤵
- Executes dropped EXE
PID:2752 -
\??\c:\ffrlrxl.exec:\ffrlrxl.exe39⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rflflrf.exec:\rflflrf.exe40⤵
- Executes dropped EXE
PID:2976 -
\??\c:\5tbbbh.exec:\5tbbbh.exe41⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ddjpv.exec:\ddjpv.exe42⤵
- Executes dropped EXE
PID:2776 -
\??\c:\jjvpd.exec:\jjvpd.exe43⤵
- Executes dropped EXE
PID:2596 -
\??\c:\rfxfllx.exec:\rfxfllx.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\nhbhtb.exec:\nhbhtb.exe45⤵
- Executes dropped EXE
PID:2676 -
\??\c:\7tnnnn.exec:\7tnnnn.exe46⤵
- Executes dropped EXE
PID:3048 -
\??\c:\vvvpd.exec:\vvvpd.exe47⤵
- Executes dropped EXE
PID:2100 -
\??\c:\frffxxf.exec:\frffxxf.exe48⤵
- Executes dropped EXE
PID:1112 -
\??\c:\9ffxlrf.exec:\9ffxlrf.exe49⤵
- Executes dropped EXE
PID:2868 -
\??\c:\bbbhhb.exec:\bbbhhb.exe50⤵
- Executes dropped EXE
PID:2012 -
\??\c:\ppdjp.exec:\ppdjp.exe51⤵
- Executes dropped EXE
PID:1664 -
\??\c:\vjjdj.exec:\vjjdj.exe52⤵
- Executes dropped EXE
PID:2588 -
\??\c:\frlxfrr.exec:\frlxfrr.exe53⤵
- Executes dropped EXE
PID:1832 -
\??\c:\7flflrf.exec:\7flflrf.exe54⤵
- Executes dropped EXE
PID:2912 -
\??\c:\tnhhtt.exec:\tnhhtt.exe55⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vpdjv.exec:\vpdjv.exe56⤵
- Executes dropped EXE
PID:2132 -
\??\c:\ddvdj.exec:\ddvdj.exe57⤵
- Executes dropped EXE
PID:2492 -
\??\c:\llxlfll.exec:\llxlfll.exe58⤵
- Executes dropped EXE
PID:576 -
\??\c:\7nnnnn.exec:\7nnnnn.exe59⤵
- Executes dropped EXE
PID:1416 -
\??\c:\jdpvj.exec:\jdpvj.exe60⤵
- Executes dropped EXE
PID:1528 -
\??\c:\5fffllx.exec:\5fffllx.exe61⤵
- Executes dropped EXE
PID:2856 -
\??\c:\ffxfrxl.exec:\ffxfrxl.exe62⤵
- Executes dropped EXE
PID:652 -
\??\c:\5bnnnt.exec:\5bnnnt.exe63⤵
- Executes dropped EXE
PID:1620 -
\??\c:\9bhhnb.exec:\9bhhnb.exe64⤵
- Executes dropped EXE
PID:1840 -
\??\c:\jjdpv.exec:\jjdpv.exe65⤵
- Executes dropped EXE
PID:692 -
\??\c:\frxrrxl.exec:\frxrrxl.exe66⤵PID:984
-
\??\c:\rlflxxr.exec:\rlflxxr.exe67⤵PID:2164
-
\??\c:\hbntbh.exec:\hbntbh.exe68⤵PID:2372
-
\??\c:\nnhtbh.exec:\nnhtbh.exe69⤵PID:2420
-
\??\c:\vvvjd.exec:\vvvjd.exe70⤵PID:2988
-
\??\c:\llffrlr.exec:\llffrlr.exe71⤵PID:1696
-
\??\c:\5bttbh.exec:\5bttbh.exe72⤵PID:868
-
\??\c:\hbthnb.exec:\hbthnb.exe73⤵PID:1756
-
\??\c:\5ddjv.exec:\5ddjv.exe74⤵PID:2388
-
\??\c:\5xrrxrx.exec:\5xrrxrx.exe75⤵PID:2188
-
\??\c:\lfrxffl.exec:\lfrxffl.exe76⤵PID:3040
-
\??\c:\hhhnbb.exec:\hhhnbb.exe77⤵PID:2176
-
\??\c:\nhbtbt.exec:\nhbtbt.exe78⤵PID:2712
-
\??\c:\vvjdv.exec:\vvjdv.exe79⤵PID:2840
-
\??\c:\rfllllr.exec:\rfllllr.exe80⤵PID:2240
-
\??\c:\9rlflrr.exec:\9rlflrr.exe81⤵PID:2804
-
\??\c:\hthhtt.exec:\hthhtt.exe82⤵PID:2744
-
\??\c:\3jdpd.exec:\3jdpd.exe83⤵PID:2976
-
\??\c:\rlxlflf.exec:\rlxlflf.exe84⤵PID:2648
-
\??\c:\llxrffl.exec:\llxrffl.exe85⤵PID:1532
-
\??\c:\1hbhhn.exec:\1hbhhn.exe86⤵PID:2180
-
\??\c:\pjvdj.exec:\pjvdj.exe87⤵PID:3052
-
\??\c:\jjddp.exec:\jjddp.exe88⤵PID:2676
-
\??\c:\9rxfrxl.exec:\9rxfrxl.exe89⤵PID:2168
-
\??\c:\3lfrffr.exec:\3lfrffr.exe90⤵PID:1804
-
\??\c:\btnhnh.exec:\btnhnh.exe91⤵PID:980
-
\??\c:\pdjjj.exec:\pdjjj.exe92⤵PID:2932
-
\??\c:\5pddd.exec:\5pddd.exe93⤵PID:2700
-
\??\c:\xllrfxl.exec:\xllrfxl.exe94⤵PID:2896
-
\??\c:\hbnhnn.exec:\hbnhnn.exe95⤵PID:2688
-
\??\c:\htntht.exec:\htntht.exe96⤵PID:1456
-
\??\c:\jvdjv.exec:\jvdjv.exe97⤵PID:1164
-
\??\c:\3rllrxx.exec:\3rllrxx.exe98⤵
- System Location Discovery: System Language Discovery
PID:1072 -
\??\c:\7xfrfxl.exec:\7xfrfxl.exe99⤵PID:2288
-
\??\c:\hhthtb.exec:\hhthtb.exe100⤵PID:2108
-
\??\c:\9vpdj.exec:\9vpdj.exe101⤵PID:484
-
\??\c:\5jdvj.exec:\5jdvj.exe102⤵PID:1644
-
\??\c:\xrflrlr.exec:\xrflrlr.exe103⤵PID:764
-
\??\c:\3nbhnn.exec:\3nbhnn.exe104⤵PID:2404
-
\??\c:\tnhntb.exec:\tnhntb.exe105⤵PID:2296
-
\??\c:\9jdpv.exec:\9jdpv.exe106⤵PID:2096
-
\??\c:\rfflrxf.exec:\rfflrxf.exe107⤵PID:468
-
\??\c:\xrllrxl.exec:\xrllrxl.exe108⤵
- System Location Discovery: System Language Discovery
PID:1376 -
\??\c:\3tthnn.exec:\3tthnn.exe109⤵PID:1788
-
\??\c:\pvjvp.exec:\pvjvp.exe110⤵PID:1748
-
\??\c:\xrfflrf.exec:\xrfflrf.exe111⤵PID:2256
-
\??\c:\rrrrrrl.exec:\rrrrrrl.exe112⤵PID:1520
-
\??\c:\hthntn.exec:\hthntn.exe113⤵PID:1752
-
\??\c:\dpjdj.exec:\dpjdj.exe114⤵PID:1268
-
\??\c:\pdpvj.exec:\pdpvj.exe115⤵PID:1836
-
\??\c:\1rfffll.exec:\1rfffll.exe116⤵PID:2392
-
\??\c:\5nntnt.exec:\5nntnt.exe117⤵PID:2148
-
\??\c:\7hbnht.exec:\7hbnht.exe118⤵PID:1600
-
\??\c:\jdjvp.exec:\jdjvp.exe119⤵PID:1604
-
\??\c:\llxlffl.exec:\llxlffl.exe120⤵PID:2324
-
\??\c:\fxxfrxr.exec:\fxxfrxr.exe121⤵PID:2248
-
\??\c:\nthhtb.exec:\nthhtb.exe122⤵PID:2820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-