Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 10:48
Behavioral task
behavioral1
Sample
d0256c99b310ee7c25447ef1eb73ac10N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
d0256c99b310ee7c25447ef1eb73ac10N.exe
-
Size
329KB
-
MD5
d0256c99b310ee7c25447ef1eb73ac10
-
SHA1
aa20d67155b117e94249f1c874da91cb4720dd74
-
SHA256
db1027406930420f5e94ecf2d0fc1bc2f467681638605ab694d8ed65ea04918e
-
SHA512
a9d54a6c775e98f032286f1b35e38fc4f2509d5e3455eaa3c88c43cd467646188c4dca8b7aab187b8e83636228505e32b2069a07de35dbcfb1b7dd9bf8b9de99
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tQ:94wFHoStJdSjylh2b77BoTMA9gX59sTo
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2280-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-52-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2552-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-62-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1336-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/276-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-87-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2956-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/276-104-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1004-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1368-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-140-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2916-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1044-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2332-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2388-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1348-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/996-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2204-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-361-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3012-379-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/776-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-454-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/2148-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/264-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1196-504-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1912-548-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2340-550-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1352-14925-0x0000000077410000-0x000000007752F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1924 fxrfrlf.exe 2784 rlrrxfl.exe 2864 pjjvv.exe 2176 fllrlrr.exe 1704 pvpvj.exe 2552 frfxrfx.exe 1336 tnntht.exe 276 xxxxlfr.exe 2956 hnbtnn.exe 1140 7jjvd.exe 1004 rxlxrrf.exe 2380 ppjpd.exe 1368 llffxxl.exe 2740 3hthth.exe 2368 dpjdv.exe 1864 bbtnbn.exe 1688 7nhbbn.exe 2916 llxxlxx.exe 1044 1nhhhn.exe 2332 djjvp.exe 2196 9tnbnh.exe 2252 vvpjj.exe 2388 ffrxffl.exe 1348 vpjvj.exe 996 vpjpv.exe 1996 llrfrxf.exe 2064 vvppj.exe 1904 lllxlxr.exe 2204 1bnntb.exe 1636 frffxxx.exe 2004 1hhhbt.exe 1780 pdpvd.exe 2464 fflrlrl.exe 2656 7bnttt.exe 1588 nbnnnt.exe 2760 5jvpd.exe 2772 fxfrxrl.exe 2560 tnbbhh.exe 2712 tnhhhb.exe 2928 vvdvv.exe 2688 1fxrffl.exe 2548 nnbhth.exe 2584 pjdvj.exe 2556 dpppp.exe 1212 9llfxxf.exe 2964 9nbbbt.exe 2908 pdpjp.exe 1308 pdjjj.exe 1096 rlxfxxr.exe 3012 hbtbnt.exe 1708 pvdpj.exe 1488 lflrxxl.exe 700 lxllrlr.exe 1368 3bhhbb.exe 2156 pdjjp.exe 2460 3jpvp.exe 2316 3llrxlr.exe 1600 btbttn.exe 2824 jvvpp.exe 352 jvjjj.exe 776 rxxlxlr.exe 2148 bnbbhh.exe 2108 jdpjj.exe 2092 1pddj.exe -
resource yara_rule behavioral1/memory/2280-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120f9-5.dat upx behavioral1/memory/2280-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1924-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2784-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d71-18.dat upx behavioral1/memory/1924-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016e1d-27.dat upx behavioral1/memory/2864-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017342-35.dat upx behavioral1/memory/2176-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000017355-45.dat upx behavioral1/memory/1704-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001739f-53.dat upx behavioral1/memory/2552-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2552-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000173a3-63.dat upx behavioral1/files/0x00070000000191d1-73.dat upx behavioral1/memory/1336-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/276-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195c8-80.dat upx behavioral1/files/0x00050000000195ca-88.dat upx behavioral1/memory/2956-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195cc-97.dat upx behavioral1/files/0x00050000000195ce-109.dat upx behavioral1/memory/2380-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1004-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195d0-117.dat upx behavioral1/memory/2380-116-0x00000000002C0000-0x00000000002E7000-memory.dmp upx behavioral1/files/0x00050000000195e0-124.dat upx behavioral1/memory/1368-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2740-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019624-133.dat upx behavioral1/files/0x0005000000019665-141.dat upx behavioral1/files/0x00050000000196a0-149.dat upx behavioral1/files/0x0005000000019931-157.dat upx behavioral1/memory/2916-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bec-165.dat upx behavioral1/files/0x0032000000016d04-172.dat upx behavioral1/memory/1044-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2332-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf0-182.dat upx behavioral1/memory/2332-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019bf2-191.dat upx behavioral1/files/0x0005000000019c0b-199.dat upx behavioral1/files/0x0005000000019cd5-207.dat upx behavioral1/memory/2388-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1348-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019cfc-219.dat upx behavioral1/memory/996-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d5c-226.dat upx behavioral1/memory/1996-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019d69-234.dat upx behavioral1/files/0x0005000000019f57-242.dat upx behavioral1/memory/2064-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019f71-250.dat upx behavioral1/files/0x000500000001a020-258.dat upx behavioral1/memory/2204-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a033-266.dat upx behavioral1/memory/2004-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a05a-274.dat upx behavioral1/memory/2656-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1588-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1588-299-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 1924 2280 d0256c99b310ee7c25447ef1eb73ac10N.exe 30 PID 2280 wrote to memory of 1924 2280 d0256c99b310ee7c25447ef1eb73ac10N.exe 30 PID 2280 wrote to memory of 1924 2280 d0256c99b310ee7c25447ef1eb73ac10N.exe 30 PID 2280 wrote to memory of 1924 2280 d0256c99b310ee7c25447ef1eb73ac10N.exe 30 PID 1924 wrote to memory of 2784 1924 fxrfrlf.exe 31 PID 1924 wrote to memory of 2784 1924 fxrfrlf.exe 31 PID 1924 wrote to memory of 2784 1924 fxrfrlf.exe 31 PID 1924 wrote to memory of 2784 1924 fxrfrlf.exe 31 PID 2784 wrote to memory of 2864 2784 rlrrxfl.exe 32 PID 2784 wrote to memory of 2864 2784 rlrrxfl.exe 32 PID 2784 wrote to memory of 2864 2784 rlrrxfl.exe 32 PID 2784 wrote to memory of 2864 2784 rlrrxfl.exe 32 PID 2864 wrote to memory of 2176 2864 pjjvv.exe 33 PID 2864 wrote to memory of 2176 2864 pjjvv.exe 33 PID 2864 wrote to memory of 2176 2864 pjjvv.exe 33 PID 2864 wrote to memory of 2176 2864 pjjvv.exe 33 PID 2176 wrote to memory of 1704 2176 fllrlrr.exe 34 PID 2176 wrote to memory of 1704 2176 fllrlrr.exe 34 PID 2176 wrote to memory of 1704 2176 fllrlrr.exe 34 PID 2176 wrote to memory of 1704 2176 fllrlrr.exe 34 PID 1704 wrote to memory of 2552 1704 pvpvj.exe 35 PID 1704 wrote to memory of 2552 1704 pvpvj.exe 35 PID 1704 wrote to memory of 2552 1704 pvpvj.exe 35 PID 1704 wrote to memory of 2552 1704 pvpvj.exe 35 PID 2552 wrote to memory of 1336 2552 frfxrfx.exe 36 PID 2552 wrote to memory of 1336 2552 frfxrfx.exe 36 PID 2552 wrote to memory of 1336 2552 frfxrfx.exe 36 PID 2552 wrote to memory of 1336 2552 frfxrfx.exe 36 PID 1336 wrote to memory of 276 1336 tnntht.exe 37 PID 1336 wrote to memory of 276 1336 tnntht.exe 37 PID 1336 wrote to memory of 276 1336 tnntht.exe 37 PID 1336 wrote to memory of 276 1336 tnntht.exe 37 PID 276 wrote to memory of 2956 276 xxxxlfr.exe 38 PID 276 wrote to memory of 2956 276 xxxxlfr.exe 38 PID 276 wrote to memory of 2956 276 xxxxlfr.exe 38 PID 276 wrote to memory of 2956 276 xxxxlfr.exe 38 PID 2956 wrote to memory of 1140 2956 hnbtnn.exe 39 PID 2956 wrote to memory of 1140 2956 hnbtnn.exe 39 PID 2956 wrote to memory of 1140 2956 hnbtnn.exe 39 PID 2956 wrote to memory of 1140 2956 hnbtnn.exe 39 PID 1140 wrote to memory of 1004 1140 7jjvd.exe 40 PID 1140 wrote to memory of 1004 1140 7jjvd.exe 40 PID 1140 wrote to memory of 1004 1140 7jjvd.exe 40 PID 1140 wrote to memory of 1004 1140 7jjvd.exe 40 PID 1004 wrote to memory of 2380 1004 rxlxrrf.exe 41 PID 1004 wrote to memory of 2380 1004 rxlxrrf.exe 41 PID 1004 wrote to memory of 2380 1004 rxlxrrf.exe 41 PID 1004 wrote to memory of 2380 1004 rxlxrrf.exe 41 PID 2380 wrote to memory of 1368 2380 ppjpd.exe 42 PID 2380 wrote to memory of 1368 2380 ppjpd.exe 42 PID 2380 wrote to memory of 1368 2380 ppjpd.exe 42 PID 2380 wrote to memory of 1368 2380 ppjpd.exe 42 PID 1368 wrote to memory of 2740 1368 llffxxl.exe 43 PID 1368 wrote to memory of 2740 1368 llffxxl.exe 43 PID 1368 wrote to memory of 2740 1368 llffxxl.exe 43 PID 1368 wrote to memory of 2740 1368 llffxxl.exe 43 PID 2740 wrote to memory of 2368 2740 3hthth.exe 44 PID 2740 wrote to memory of 2368 2740 3hthth.exe 44 PID 2740 wrote to memory of 2368 2740 3hthth.exe 44 PID 2740 wrote to memory of 2368 2740 3hthth.exe 44 PID 2368 wrote to memory of 1864 2368 dpjdv.exe 45 PID 2368 wrote to memory of 1864 2368 dpjdv.exe 45 PID 2368 wrote to memory of 1864 2368 dpjdv.exe 45 PID 2368 wrote to memory of 1864 2368 dpjdv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0256c99b310ee7c25447ef1eb73ac10N.exe"C:\Users\Admin\AppData\Local\Temp\d0256c99b310ee7c25447ef1eb73ac10N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\fxrfrlf.exec:\fxrfrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\rlrrxfl.exec:\rlrrxfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\pjjvv.exec:\pjjvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\fllrlrr.exec:\fllrlrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\pvpvj.exec:\pvpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\frfxrfx.exec:\frfxrfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\tnntht.exec:\tnntht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\xxxxlfr.exec:\xxxxlfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:276 -
\??\c:\hnbtnn.exec:\hnbtnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\7jjvd.exec:\7jjvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\rxlxrrf.exec:\rxlxrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\ppjpd.exec:\ppjpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\llffxxl.exec:\llffxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\3hthth.exec:\3hthth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\dpjdv.exec:\dpjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\bbtnbn.exec:\bbtnbn.exe17⤵
- Executes dropped EXE
PID:1864 -
\??\c:\7nhbbn.exec:\7nhbbn.exe18⤵
- Executes dropped EXE
PID:1688 -
\??\c:\llxxlxx.exec:\llxxlxx.exe19⤵
- Executes dropped EXE
PID:2916 -
\??\c:\1nhhhn.exec:\1nhhhn.exe20⤵
- Executes dropped EXE
PID:1044 -
\??\c:\djjvp.exec:\djjvp.exe21⤵
- Executes dropped EXE
PID:2332 -
\??\c:\9tnbnh.exec:\9tnbnh.exe22⤵
- Executes dropped EXE
PID:2196 -
\??\c:\vvpjj.exec:\vvpjj.exe23⤵
- Executes dropped EXE
PID:2252 -
\??\c:\ffrxffl.exec:\ffrxffl.exe24⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vpjvj.exec:\vpjvj.exe25⤵
- Executes dropped EXE
PID:1348 -
\??\c:\vpjpv.exec:\vpjpv.exe26⤵
- Executes dropped EXE
PID:996 -
\??\c:\llrfrxf.exec:\llrfrxf.exe27⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vvppj.exec:\vvppj.exe28⤵
- Executes dropped EXE
PID:2064 -
\??\c:\lllxlxr.exec:\lllxlxr.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1904 -
\??\c:\1bnntb.exec:\1bnntb.exe30⤵
- Executes dropped EXE
PID:2204 -
\??\c:\frffxxx.exec:\frffxxx.exe31⤵
- Executes dropped EXE
PID:1636 -
\??\c:\1hhhbt.exec:\1hhhbt.exe32⤵
- Executes dropped EXE
PID:2004 -
\??\c:\pdpvd.exec:\pdpvd.exe33⤵
- Executes dropped EXE
PID:1780 -
\??\c:\fflrlrl.exec:\fflrlrl.exe34⤵
- Executes dropped EXE
PID:2464 -
\??\c:\7bnttt.exec:\7bnttt.exe35⤵
- Executes dropped EXE
PID:2656 -
\??\c:\nbnnnt.exec:\nbnnnt.exe36⤵
- Executes dropped EXE
PID:1588 -
\??\c:\5jvpd.exec:\5jvpd.exe37⤵
- Executes dropped EXE
PID:2760 -
\??\c:\fxfrxrl.exec:\fxfrxrl.exe38⤵
- Executes dropped EXE
PID:2772 -
\??\c:\tnbbhh.exec:\tnbbhh.exe39⤵
- Executes dropped EXE
PID:2560 -
\??\c:\tnhhhb.exec:\tnhhhb.exe40⤵
- Executes dropped EXE
PID:2712 -
\??\c:\vvdvv.exec:\vvdvv.exe41⤵
- Executes dropped EXE
PID:2928 -
\??\c:\1fxrffl.exec:\1fxrffl.exe42⤵
- Executes dropped EXE
PID:2688 -
\??\c:\nnbhth.exec:\nnbhth.exe43⤵
- Executes dropped EXE
PID:2548 -
\??\c:\pjdvj.exec:\pjdvj.exe44⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dpppp.exec:\dpppp.exe45⤵
- Executes dropped EXE
PID:2556 -
\??\c:\9llfxxf.exec:\9llfxxf.exe46⤵
- Executes dropped EXE
PID:1212 -
\??\c:\9nbbbt.exec:\9nbbbt.exe47⤵
- Executes dropped EXE
PID:2964 -
\??\c:\pdpjp.exec:\pdpjp.exe48⤵
- Executes dropped EXE
PID:2908 -
\??\c:\pdjjj.exec:\pdjjj.exe49⤵
- Executes dropped EXE
PID:1308 -
\??\c:\rlxfxxr.exec:\rlxfxxr.exe50⤵
- Executes dropped EXE
PID:1096 -
\??\c:\hbtbnt.exec:\hbtbnt.exe51⤵
- Executes dropped EXE
PID:3012 -
\??\c:\pvdpj.exec:\pvdpj.exe52⤵
- Executes dropped EXE
PID:1708 -
\??\c:\lflrxxl.exec:\lflrxxl.exe53⤵
- Executes dropped EXE
PID:1488 -
\??\c:\lxllrlr.exec:\lxllrlr.exe54⤵
- Executes dropped EXE
PID:700 -
\??\c:\3bhhbb.exec:\3bhhbb.exe55⤵
- Executes dropped EXE
PID:1368 -
\??\c:\pdjjp.exec:\pdjjp.exe56⤵
- Executes dropped EXE
PID:2156 -
\??\c:\3jpvp.exec:\3jpvp.exe57⤵
- Executes dropped EXE
PID:2460 -
\??\c:\3llrxlr.exec:\3llrxlr.exe58⤵
- Executes dropped EXE
PID:2316 -
\??\c:\btbttn.exec:\btbttn.exe59⤵
- Executes dropped EXE
PID:1600 -
\??\c:\jvvpp.exec:\jvvpp.exe60⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jvjjj.exec:\jvjjj.exe61⤵
- Executes dropped EXE
PID:352 -
\??\c:\rxxlxlr.exec:\rxxlxlr.exe62⤵
- Executes dropped EXE
PID:776 -
\??\c:\bnbbhh.exec:\bnbbhh.exe63⤵
- Executes dropped EXE
PID:2148 -
\??\c:\jdpjj.exec:\jdpjj.exe64⤵
- Executes dropped EXE
PID:2108 -
\??\c:\1pddj.exec:\1pddj.exe65⤵
- Executes dropped EXE
PID:2092 -
\??\c:\9lxlxxf.exec:\9lxlxxf.exe66⤵PID:264
-
\??\c:\ntthht.exec:\ntthht.exe67⤵PID:1492
-
\??\c:\1nbnnt.exec:\1nbnnt.exe68⤵PID:2180
-
\??\c:\5vjvd.exec:\5vjvd.exe69⤵PID:2428
-
\??\c:\fxrxllx.exec:\fxrxllx.exe70⤵PID:1108
-
\??\c:\thntbb.exec:\thntbb.exe71⤵PID:1244
-
\??\c:\3bnntb.exec:\3bnntb.exe72⤵PID:1604
-
\??\c:\pppdj.exec:\pppdj.exe73⤵PID:1196
-
\??\c:\5dvdd.exec:\5dvdd.exe74⤵PID:1316
-
\??\c:\rrllxxf.exec:\rrllxxf.exe75⤵PID:1936
-
\??\c:\bbbnht.exec:\bbbnht.exe76⤵PID:2044
-
\??\c:\dvjpd.exec:\dvjpd.exe77⤵PID:2980
-
\??\c:\vdvjj.exec:\vdvjj.exe78⤵PID:1516
-
\??\c:\lxrllfr.exec:\lxrllfr.exe79⤵PID:2004
-
\??\c:\btbhtb.exec:\btbhtb.exe80⤵PID:1912
-
\??\c:\tnhnnh.exec:\tnhnnh.exe81⤵PID:2340
-
\??\c:\djddj.exec:\djddj.exe82⤵PID:1612
-
\??\c:\7xfxlrx.exec:\7xfxlrx.exe83⤵PID:2748
-
\??\c:\hthhhh.exec:\hthhhh.exe84⤵PID:2704
-
\??\c:\nnhtbn.exec:\nnhtbn.exe85⤵PID:2692
-
\??\c:\pvjpd.exec:\pvjpd.exe86⤵PID:2392
-
\??\c:\3fxllxl.exec:\3fxllxl.exe87⤵PID:2588
-
\??\c:\xrlrfrx.exec:\xrlrfrx.exe88⤵PID:2176
-
\??\c:\nhnthh.exec:\nhnthh.exe89⤵PID:2608
-
\??\c:\vpdjp.exec:\vpdjp.exe90⤵PID:2616
-
\??\c:\frxffrf.exec:\frxffrf.exe91⤵PID:2232
-
\??\c:\xrflxxf.exec:\xrflxxf.exe92⤵PID:1964
-
\??\c:\btthtb.exec:\btthtb.exe93⤵PID:552
-
\??\c:\djddd.exec:\djddd.exe94⤵PID:2944
-
\??\c:\rflfrrr.exec:\rflfrrr.exe95⤵PID:2956
-
\??\c:\tntnnt.exec:\tntnnt.exe96⤵PID:1308
-
\??\c:\5httbh.exec:\5httbh.exe97⤵PID:1096
-
\??\c:\jpppv.exec:\jpppv.exe98⤵PID:2912
-
\??\c:\1fxlfrf.exec:\1fxlfrf.exe99⤵PID:2348
-
\??\c:\rfrrxrl.exec:\rfrrxrl.exe100⤵PID:2880
-
\??\c:\hthhhh.exec:\hthhhh.exe101⤵PID:2936
-
\??\c:\dvvjv.exec:\dvvjv.exe102⤵PID:2420
-
\??\c:\7rfffff.exec:\7rfffff.exe103⤵PID:2884
-
\??\c:\ffrfxlr.exec:\ffrfxlr.exe104⤵PID:1864
-
\??\c:\tbhthn.exec:\tbhthn.exe105⤵PID:2816
-
\??\c:\ppjvd.exec:\ppjvd.exe106⤵PID:796
-
\??\c:\rxxlrrf.exec:\rxxlrrf.exe107⤵PID:1760
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe108⤵PID:1044
-
\??\c:\btbbnt.exec:\btbbnt.exe109⤵PID:2504
-
\??\c:\pvdpd.exec:\pvdpd.exe110⤵PID:2108
-
\??\c:\xllxxrr.exec:\xllxxrr.exe111⤵PID:2196
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe112⤵PID:2120
-
\??\c:\9thhnt.exec:\9thhnt.exe113⤵PID:960
-
\??\c:\hbhntn.exec:\hbhntn.exe114⤵PID:1364
-
\??\c:\jdvjp.exec:\jdvjp.exe115⤵PID:1560
-
\??\c:\pjdjd.exec:\pjdjd.exe116⤵PID:1940
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe117⤵PID:2256
-
\??\c:\hbttbb.exec:\hbttbb.exe118⤵PID:2512
-
\??\c:\hhbhtb.exec:\hhbhtb.exe119⤵PID:764
-
\??\c:\dpjjp.exec:\dpjjp.exe120⤵PID:2492
-
\??\c:\ffffrrl.exec:\ffffrrl.exe121⤵PID:1496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-