Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/09/2024, 19:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dd2a36405c46bdd1e74d23d2a1970f70N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
dd2a36405c46bdd1e74d23d2a1970f70N.exe
-
Size
410KB
-
MD5
dd2a36405c46bdd1e74d23d2a1970f70
-
SHA1
80c37ad51d47a86938e0fd5a1b3b73a6d5996000
-
SHA256
c45bcb0e936e57cda0ea9fa6eb04448e45ef673a84cf9e3149dc7968eada5bfc
-
SHA512
f7cdacd79d460f64cc4148fe1d872cda67761b91ccf8dec9e16fa7057802b80e168f20501ddf65e32a099d33d703f3a60b3be9e4aa43c318aeaff764deddf601
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAsACF486jJSp1BwciI:Pcm7ImGddXtWrXD486jJq1Bwcn
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/276-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1416-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1048-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1048-37-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1048-35-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2096-48-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2096-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1780-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1668-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1916-145-0x0000000000320000-0x0000000000349000-memory.dmp family_blackmoon behavioral1/memory/1916-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/912-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/892-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1412-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1416-320-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-354-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-368-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-383-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2616-384-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-391-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1468-400-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2612-399-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-426-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/332-429-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1480-550-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-571-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1344-584-0x0000000000320000-0x0000000000349000-memory.dmp family_blackmoon behavioral1/memory/2300-590-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2692-625-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-702-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-722-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-729-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1416 lfrflrl.exe 2080 7pjpd.exe 1048 ttnthh.exe 2096 tntbbh.exe 2756 llfflrf.exe 2796 7nbttt.exe 2700 rlffxxl.exe 2564 nbnnbb.exe 1628 dvdjp.exe 2612 bbnnbb.exe 1780 7jjjp.exe 1668 pjppv.exe 2716 bntnnn.exe 1916 pdjvv.exe 912 bthhnt.exe 1412 pdpjp.exe 892 xlxxfll.exe 2088 3tnntb.exe 2132 lfrrrrx.exe 2904 9xfxxxx.exe 696 9jpdp.exe 2376 rfllrrr.exe 920 9hhhnt.exe 2932 1jvvv.exe 1704 5nnntt.exe 2380 pdppp.exe 3068 nhtbhn.exe 2212 9btntt.exe 1752 7jvvv.exe 1044 rfrxrlr.exe 276 pdppv.exe 2328 1pvjd.exe 1416 nhhntb.exe 2080 pdpjp.exe 2648 fxlxrrf.exe 2688 hnbttn.exe 2804 tnbhnt.exe 2780 9vjvd.exe 2236 xxffllx.exe 2720 5xfflll.exe 2676 bntthh.exe 2564 9dpjd.exe 2616 djdpp.exe 2612 1lfxlll.exe 1468 1hthnn.exe 2600 bthbhb.exe 2076 jvjjj.exe 2716 frrrfxf.exe 332 frrrrrf.exe 2844 1bhtbh.exe 1688 pjvvd.exe 1956 xxffxxf.exe 2884 xlxlllr.exe 2900 htttnh.exe 2868 9jjjp.exe 1896 jdjjj.exe 960 5lfxrlr.exe 340 bnbttt.exe 356 7hbnbt.exe 2580 5ppdd.exe 1788 xlxfflr.exe 1800 fxfffxx.exe 2396 nhnntt.exe 2160 pdjjj.exe -
resource yara_rule behavioral1/memory/276-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1416-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-35-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2096-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1780-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1668-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1916-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/912-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/892-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1412-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1416-320-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-327-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-354-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-368-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-375-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-384-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-391-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/1468-400-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2612-399-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-426-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-473-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/356-493-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1480-543-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1480-550-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2104-551-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/884-558-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1044-572-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-571-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-606-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-626-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-625-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2596-645-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-652-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-702-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-711-0x0000000000320000-0x0000000000349000-memory.dmp upx behavioral1/memory/2856-722-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 276 wrote to memory of 1416 276 dd2a36405c46bdd1e74d23d2a1970f70N.exe 31 PID 276 wrote to memory of 1416 276 dd2a36405c46bdd1e74d23d2a1970f70N.exe 31 PID 276 wrote to memory of 1416 276 dd2a36405c46bdd1e74d23d2a1970f70N.exe 31 PID 276 wrote to memory of 1416 276 dd2a36405c46bdd1e74d23d2a1970f70N.exe 31 PID 1416 wrote to memory of 2080 1416 lfrflrl.exe 32 PID 1416 wrote to memory of 2080 1416 lfrflrl.exe 32 PID 1416 wrote to memory of 2080 1416 lfrflrl.exe 32 PID 1416 wrote to memory of 2080 1416 lfrflrl.exe 32 PID 2080 wrote to memory of 1048 2080 7pjpd.exe 33 PID 2080 wrote to memory of 1048 2080 7pjpd.exe 33 PID 2080 wrote to memory of 1048 2080 7pjpd.exe 33 PID 2080 wrote to memory of 1048 2080 7pjpd.exe 33 PID 1048 wrote to memory of 2096 1048 ttnthh.exe 34 PID 1048 wrote to memory of 2096 1048 ttnthh.exe 34 PID 1048 wrote to memory of 2096 1048 ttnthh.exe 34 PID 1048 wrote to memory of 2096 1048 ttnthh.exe 34 PID 2096 wrote to memory of 2756 2096 tntbbh.exe 35 PID 2096 wrote to memory of 2756 2096 tntbbh.exe 35 PID 2096 wrote to memory of 2756 2096 tntbbh.exe 35 PID 2096 wrote to memory of 2756 2096 tntbbh.exe 35 PID 2756 wrote to memory of 2796 2756 llfflrf.exe 36 PID 2756 wrote to memory of 2796 2756 llfflrf.exe 36 PID 2756 wrote to memory of 2796 2756 llfflrf.exe 36 PID 2756 wrote to memory of 2796 2756 llfflrf.exe 36 PID 2796 wrote to memory of 2700 2796 7nbttt.exe 37 PID 2796 wrote to memory of 2700 2796 7nbttt.exe 37 PID 2796 wrote to memory of 2700 2796 7nbttt.exe 37 PID 2796 wrote to memory of 2700 2796 7nbttt.exe 37 PID 2700 wrote to memory of 2564 2700 rlffxxl.exe 38 PID 2700 wrote to memory of 2564 2700 rlffxxl.exe 38 PID 2700 wrote to memory of 2564 2700 rlffxxl.exe 38 PID 2700 wrote to memory of 2564 2700 rlffxxl.exe 38 PID 2564 wrote to memory of 1628 2564 nbnnbb.exe 39 PID 2564 wrote to memory of 1628 2564 nbnnbb.exe 39 PID 2564 wrote to memory of 1628 2564 nbnnbb.exe 39 PID 2564 wrote to memory of 1628 2564 nbnnbb.exe 39 PID 1628 wrote to memory of 2612 1628 dvdjp.exe 40 PID 1628 wrote to memory of 2612 1628 dvdjp.exe 40 PID 1628 wrote to memory of 2612 1628 dvdjp.exe 40 PID 1628 wrote to memory of 2612 1628 dvdjp.exe 40 PID 2612 wrote to memory of 1780 2612 bbnnbb.exe 41 PID 2612 wrote to memory of 1780 2612 bbnnbb.exe 41 PID 2612 wrote to memory of 1780 2612 bbnnbb.exe 41 PID 2612 wrote to memory of 1780 2612 bbnnbb.exe 41 PID 1780 wrote to memory of 1668 1780 7jjjp.exe 42 PID 1780 wrote to memory of 1668 1780 7jjjp.exe 42 PID 1780 wrote to memory of 1668 1780 7jjjp.exe 42 PID 1780 wrote to memory of 1668 1780 7jjjp.exe 42 PID 1668 wrote to memory of 2716 1668 pjppv.exe 43 PID 1668 wrote to memory of 2716 1668 pjppv.exe 43 PID 1668 wrote to memory of 2716 1668 pjppv.exe 43 PID 1668 wrote to memory of 2716 1668 pjppv.exe 43 PID 2716 wrote to memory of 1916 2716 bntnnn.exe 44 PID 2716 wrote to memory of 1916 2716 bntnnn.exe 44 PID 2716 wrote to memory of 1916 2716 bntnnn.exe 44 PID 2716 wrote to memory of 1916 2716 bntnnn.exe 44 PID 1916 wrote to memory of 912 1916 pdjvv.exe 45 PID 1916 wrote to memory of 912 1916 pdjvv.exe 45 PID 1916 wrote to memory of 912 1916 pdjvv.exe 45 PID 1916 wrote to memory of 912 1916 pdjvv.exe 45 PID 912 wrote to memory of 1412 912 bthhnt.exe 46 PID 912 wrote to memory of 1412 912 bthhnt.exe 46 PID 912 wrote to memory of 1412 912 bthhnt.exe 46 PID 912 wrote to memory of 1412 912 bthhnt.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd2a36405c46bdd1e74d23d2a1970f70N.exe"C:\Users\Admin\AppData\Local\Temp\dd2a36405c46bdd1e74d23d2a1970f70N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:276 -
\??\c:\lfrflrl.exec:\lfrflrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\7pjpd.exec:\7pjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\ttnthh.exec:\ttnthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\tntbbh.exec:\tntbbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\llfflrf.exec:\llfflrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\7nbttt.exec:\7nbttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\rlffxxl.exec:\rlffxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\nbnnbb.exec:\nbnnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\dvdjp.exec:\dvdjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\bbnnbb.exec:\bbnnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\7jjjp.exec:\7jjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\pjppv.exec:\pjppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\bntnnn.exec:\bntnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\pdjvv.exec:\pdjvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\bthhnt.exec:\bthhnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\pdpjp.exec:\pdpjp.exe17⤵
- Executes dropped EXE
PID:1412 -
\??\c:\xlxxfll.exec:\xlxxfll.exe18⤵
- Executes dropped EXE
PID:892 -
\??\c:\3tnntb.exec:\3tnntb.exe19⤵
- Executes dropped EXE
PID:2088 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe20⤵
- Executes dropped EXE
PID:2132 -
\??\c:\9xfxxxx.exec:\9xfxxxx.exe21⤵
- Executes dropped EXE
PID:2904 -
\??\c:\9jpdp.exec:\9jpdp.exe22⤵
- Executes dropped EXE
PID:696 -
\??\c:\rfllrrr.exec:\rfllrrr.exe23⤵
- Executes dropped EXE
PID:2376 -
\??\c:\9hhhnt.exec:\9hhhnt.exe24⤵
- Executes dropped EXE
PID:920 -
\??\c:\1jvvv.exec:\1jvvv.exe25⤵
- Executes dropped EXE
PID:2932 -
\??\c:\5nnntt.exec:\5nnntt.exe26⤵
- Executes dropped EXE
PID:1704 -
\??\c:\pdppp.exec:\pdppp.exe27⤵
- Executes dropped EXE
PID:2380 -
\??\c:\nhtbhn.exec:\nhtbhn.exe28⤵
- Executes dropped EXE
PID:3068 -
\??\c:\9btntt.exec:\9btntt.exe29⤵
- Executes dropped EXE
PID:2212 -
\??\c:\7jvvv.exec:\7jvvv.exe30⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rfrxrlr.exec:\rfrxrlr.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1044 -
\??\c:\pdppv.exec:\pdppv.exe32⤵
- Executes dropped EXE
PID:276 -
\??\c:\1pvjd.exec:\1pvjd.exe33⤵
- Executes dropped EXE
PID:2328 -
\??\c:\nhhntb.exec:\nhhntb.exe34⤵
- Executes dropped EXE
PID:1416 -
\??\c:\pdpjp.exec:\pdpjp.exe35⤵
- Executes dropped EXE
PID:2080 -
\??\c:\fxlxrrf.exec:\fxlxrrf.exe36⤵
- Executes dropped EXE
PID:2648 -
\??\c:\hnbttn.exec:\hnbttn.exe37⤵
- Executes dropped EXE
PID:2688 -
\??\c:\tnbhnt.exec:\tnbhnt.exe38⤵
- Executes dropped EXE
PID:2804 -
\??\c:\9vjvd.exec:\9vjvd.exe39⤵
- Executes dropped EXE
PID:2780 -
\??\c:\xxffllx.exec:\xxffllx.exe40⤵
- Executes dropped EXE
PID:2236 -
\??\c:\5xfflll.exec:\5xfflll.exe41⤵
- Executes dropped EXE
PID:2720 -
\??\c:\bntthh.exec:\bntthh.exe42⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9dpjd.exec:\9dpjd.exe43⤵
- Executes dropped EXE
PID:2564 -
\??\c:\djdpp.exec:\djdpp.exe44⤵
- Executes dropped EXE
PID:2616 -
\??\c:\1lfxlll.exec:\1lfxlll.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\1hthnn.exec:\1hthnn.exe46⤵
- Executes dropped EXE
PID:1468 -
\??\c:\bthbhb.exec:\bthbhb.exe47⤵
- Executes dropped EXE
PID:2600 -
\??\c:\jvjjj.exec:\jvjjj.exe48⤵
- Executes dropped EXE
PID:2076 -
\??\c:\frrrfxf.exec:\frrrfxf.exe49⤵
- Executes dropped EXE
PID:2716 -
\??\c:\frrrrrf.exec:\frrrrrf.exe50⤵
- Executes dropped EXE
PID:332 -
\??\c:\1bhtbh.exec:\1bhtbh.exe51⤵
- Executes dropped EXE
PID:2844 -
\??\c:\pjvvd.exec:\pjvvd.exe52⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xxffxxf.exec:\xxffxxf.exe53⤵
- Executes dropped EXE
PID:1956 -
\??\c:\xlxlllr.exec:\xlxlllr.exe54⤵
- Executes dropped EXE
PID:2884 -
\??\c:\htttnh.exec:\htttnh.exe55⤵
- Executes dropped EXE
PID:2900 -
\??\c:\9jjjp.exec:\9jjjp.exe56⤵
- Executes dropped EXE
PID:2868 -
\??\c:\jdjjj.exec:\jdjjj.exe57⤵
- Executes dropped EXE
PID:1896 -
\??\c:\5lfxrlr.exec:\5lfxrlr.exe58⤵
- Executes dropped EXE
PID:960 -
\??\c:\bnbttt.exec:\bnbttt.exe59⤵
- Executes dropped EXE
PID:340 -
\??\c:\7hbnbt.exec:\7hbnbt.exe60⤵
- Executes dropped EXE
PID:356 -
\??\c:\5ppdd.exec:\5ppdd.exe61⤵
- Executes dropped EXE
PID:2580 -
\??\c:\xlxfflr.exec:\xlxfflr.exe62⤵
- Executes dropped EXE
PID:1788 -
\??\c:\fxfffxx.exec:\fxfffxx.exe63⤵
- Executes dropped EXE
PID:1800 -
\??\c:\nhnntt.exec:\nhnntt.exe64⤵
- Executes dropped EXE
PID:2396 -
\??\c:\pdjjj.exec:\pdjjj.exe65⤵
- Executes dropped EXE
PID:2160 -
\??\c:\3jdpv.exec:\3jdpv.exe66⤵PID:2956
-
\??\c:\7fxflrf.exec:\7fxflrf.exe67⤵PID:2500
-
\??\c:\nbnthh.exec:\nbnthh.exe68⤵PID:1480
-
\??\c:\tbnnnn.exec:\tbnnnn.exe69⤵PID:2104
-
\??\c:\dvpvj.exec:\dvpvj.exe70⤵PID:884
-
\??\c:\1rfxxrf.exec:\1rfxxrf.exe71⤵PID:2316
-
\??\c:\nbhhtb.exec:\nbhhtb.exe72⤵PID:1044
-
\??\c:\7tnnnt.exec:\7tnnnt.exe73⤵PID:1344
-
\??\c:\dvpdd.exec:\dvpdd.exe74⤵PID:2300
-
\??\c:\xrflxfr.exec:\xrflxfr.exe75⤵PID:1632
-
\??\c:\3nttbh.exec:\3nttbh.exe76⤵PID:1908
-
\??\c:\ththhb.exec:\ththhb.exe77⤵PID:2184
-
\??\c:\jdjjv.exec:\jdjjv.exe78⤵PID:1840
-
\??\c:\dpjpp.exec:\dpjpp.exe79⤵PID:2692
-
\??\c:\3xffflr.exec:\3xffflr.exe80⤵PID:2664
-
\??\c:\5nnhbt.exec:\5nnhbt.exe81⤵PID:2196
-
\??\c:\ttbbbb.exec:\ttbbbb.exe82⤵PID:2820
-
\??\c:\pdvdd.exec:\pdvdd.exe83⤵PID:2596
-
\??\c:\rlxxffl.exec:\rlxxffl.exe84⤵PID:2552
-
\??\c:\xrfflxx.exec:\xrfflxx.exe85⤵PID:3004
-
\??\c:\bnhhhh.exec:\bnhhhh.exe86⤵PID:2616
-
\??\c:\bnntnn.exec:\bnntnn.exe87⤵PID:2808
-
\??\c:\9djjp.exec:\9djjp.exe88⤵PID:3008
-
\??\c:\xlxfxrr.exec:\xlxfxrr.exe89⤵PID:484
-
\??\c:\xxxlfrf.exec:\xxxlfrf.exe90⤵PID:320
-
\??\c:\hbtttt.exec:\hbtttt.exe91⤵PID:1932
-
\??\c:\ppjpd.exec:\ppjpd.exe92⤵PID:1620
-
\??\c:\jvjjv.exec:\jvjjv.exe93⤵PID:2608
-
\??\c:\xfllflr.exec:\xfllflr.exe94⤵PID:2856
-
\??\c:\tbtnnh.exec:\tbtnnh.exe95⤵PID:2000
-
\??\c:\bthttb.exec:\bthttb.exe96⤵PID:1580
-
\??\c:\vjpvv.exec:\vjpvv.exe97⤵PID:2876
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe98⤵PID:1248
-
\??\c:\ntbbbt.exec:\ntbbbt.exe99⤵PID:112
-
\??\c:\thtthh.exec:\thtthh.exe100⤵PID:1152
-
\??\c:\dpppv.exec:\dpppv.exe101⤵PID:696
-
\??\c:\5frrrrf.exec:\5frrrrf.exe102⤵PID:1456
-
\??\c:\llllrxr.exec:\llllrxr.exe103⤵PID:616
-
\??\c:\7tnnnt.exec:\7tnnnt.exe104⤵PID:2432
-
\??\c:\bhtbtt.exec:\bhtbtt.exe105⤵PID:2932
-
\??\c:\9vpdp.exec:\9vpdp.exe106⤵PID:1052
-
\??\c:\1lrlllf.exec:\1lrlllf.exe107⤵PID:2460
-
\??\c:\tthhtt.exec:\tthhtt.exe108⤵PID:2100
-
\??\c:\9nnhbt.exec:\9nnhbt.exe109⤵PID:988
-
\??\c:\dpjjp.exec:\dpjjp.exe110⤵PID:3056
-
\??\c:\7jpdd.exec:\7jpdd.exe111⤵PID:896
-
\??\c:\3rfllll.exec:\3rfllll.exe112⤵PID:2056
-
\??\c:\hbtbnn.exec:\hbtbnn.exe113⤵PID:3044
-
\??\c:\bthttt.exec:\bthttt.exe114⤵PID:2316
-
\??\c:\9jvpp.exec:\9jvpp.exe115⤵PID:1652
-
\??\c:\5xfrfxf.exec:\5xfrfxf.exe116⤵PID:2324
-
\??\c:\rfrrrxx.exec:\rfrrrxx.exe117⤵PID:1732
-
\??\c:\tbnhnb.exec:\tbnhnb.exe118⤵PID:2012
-
\??\c:\pjvvj.exec:\pjvvj.exe119⤵PID:2264
-
\??\c:\frrfxlf.exec:\frrfxlf.exe120⤵PID:2744
-
\??\c:\1lfffxx.exec:\1lfffxx.exe121⤵PID:2696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-