Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 10:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0cffc491868d2fdf6ed8414241a49270N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
0cffc491868d2fdf6ed8414241a49270N.exe
-
Size
453KB
-
MD5
0cffc491868d2fdf6ed8414241a49270
-
SHA1
0fd14b92094bb0e64cdd5e2922b9bb0aaf6bd593
-
SHA256
f943e3d3e16616c54c22b3418aa51e073374ad0c9ca521e0993c00a3f43f6fbb
-
SHA512
5ba7f6bc219b342d3d87ca15bd51a742c8ef581100722b0cb8ddf95ddae0411ce809d331548fd692f893db1bfeb16ff80882883c3c940ea3b0e3b0897f7c5e5d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbez:q7Tc2NYHUrAwfMp3CDz
Malware Config
Signatures
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2480-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-66-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2844-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-86-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2716-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-101-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2056-106-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2056-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-124-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2788-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-160-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1640-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-166-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2936-181-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2936-179-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2648-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-252-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/1256-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-268-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1964-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-281-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/1596-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/628-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-655-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2904-696-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-703-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/588-801-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-949-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/320-1035-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1028-1046-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2516-1072-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-1111-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1616-1271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2524 llxflll.exe 864 5xrxrxl.exe 572 hbnbnt.exe 2000 dvjjp.exe 2816 3hthbn.exe 2760 1pvdj.exe 2844 ppdpd.exe 2716 httbbn.exe 2544 hbnnbb.exe 2056 1dddd.exe 1520 xrlrlll.exe 2788 dvppd.exe 1252 llffllr.exe 2364 djpdd.exe 2904 1xflxxf.exe 2900 hbbhnn.exe 1640 rrflflx.exe 2936 7rfflfr.exe 2648 hhhnbh.exe 2124 7pjpv.exe 416 nnntnn.exe 1616 dddjp.exe 1308 lxrxffl.exe 1652 7vpdp.exe 896 5lfrflx.exe 1256 flfrxxl.exe 1948 vvvjv.exe 2180 rrlxffl.exe 1964 tthtbb.exe 2360 jjjjd.exe 1596 dvvjp.exe 2328 1rrrxlx.exe 2496 jjdjv.exe 2856 1lfllrr.exe 2696 jdvpv.exe 2748 fxllxfl.exe 2828 7hhntt.exe 2008 tnnhnt.exe 2864 7jddd.exe 2688 xrxrrlf.exe 2872 rlfrxll.exe 2564 tbbbhh.exe 2560 vpddd.exe 2376 pjjjp.exe 1676 rlflrxl.exe 628 bbttbh.exe 2876 nhhnbb.exe 2796 pjjpd.exe 2024 xxxxffl.exe 2860 llxxffr.exe 1552 bbtbht.exe 1612 ppddj.exe 2952 7lxrxff.exe 2776 rlxxfxf.exe 2944 1hbhth.exe 2064 pjvdp.exe 2244 vpdvj.exe 1132 rxrlxxl.exe 448 xxrxlfl.exe 1124 nnnthh.exe 2412 7vvpv.exe 1032 ddjjv.exe 1028 lrlrflf.exe 2012 bbnhbh.exe -
resource yara_rule behavioral1/memory/2524-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-44-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2760-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-101-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2056-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-223-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1256-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1164-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-590-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1576-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-655-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2904-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-801-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-949-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/320-1035-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2956-1059-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-1072-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-1085-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-1124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-1137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-1174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-1271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-1285-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fxfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ntbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttthn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2480 wrote to memory of 2524 2480 0cffc491868d2fdf6ed8414241a49270N.exe 31 PID 2480 wrote to memory of 2524 2480 0cffc491868d2fdf6ed8414241a49270N.exe 31 PID 2480 wrote to memory of 2524 2480 0cffc491868d2fdf6ed8414241a49270N.exe 31 PID 2480 wrote to memory of 2524 2480 0cffc491868d2fdf6ed8414241a49270N.exe 31 PID 2524 wrote to memory of 864 2524 llxflll.exe 32 PID 2524 wrote to memory of 864 2524 llxflll.exe 32 PID 2524 wrote to memory of 864 2524 llxflll.exe 32 PID 2524 wrote to memory of 864 2524 llxflll.exe 32 PID 864 wrote to memory of 572 864 5xrxrxl.exe 33 PID 864 wrote to memory of 572 864 5xrxrxl.exe 33 PID 864 wrote to memory of 572 864 5xrxrxl.exe 33 PID 864 wrote to memory of 572 864 5xrxrxl.exe 33 PID 572 wrote to memory of 2000 572 hbnbnt.exe 34 PID 572 wrote to memory of 2000 572 hbnbnt.exe 34 PID 572 wrote to memory of 2000 572 hbnbnt.exe 34 PID 572 wrote to memory of 2000 572 hbnbnt.exe 34 PID 2000 wrote to memory of 2816 2000 dvjjp.exe 35 PID 2000 wrote to memory of 2816 2000 dvjjp.exe 35 PID 2000 wrote to memory of 2816 2000 dvjjp.exe 35 PID 2000 wrote to memory of 2816 2000 dvjjp.exe 35 PID 2816 wrote to memory of 2760 2816 3hthbn.exe 36 PID 2816 wrote to memory of 2760 2816 3hthbn.exe 36 PID 2816 wrote to memory of 2760 2816 3hthbn.exe 36 PID 2816 wrote to memory of 2760 2816 3hthbn.exe 36 PID 2760 wrote to memory of 2844 2760 1pvdj.exe 37 PID 2760 wrote to memory of 2844 2760 1pvdj.exe 37 PID 2760 wrote to memory of 2844 2760 1pvdj.exe 37 PID 2760 wrote to memory of 2844 2760 1pvdj.exe 37 PID 2844 wrote to memory of 2716 2844 ppdpd.exe 38 PID 2844 wrote to memory of 2716 2844 ppdpd.exe 38 PID 2844 wrote to memory of 2716 2844 ppdpd.exe 38 PID 2844 wrote to memory of 2716 2844 ppdpd.exe 38 PID 2716 wrote to memory of 2544 2716 httbbn.exe 39 PID 2716 wrote to memory of 2544 2716 httbbn.exe 39 PID 2716 wrote to memory of 2544 2716 httbbn.exe 39 PID 2716 wrote to memory of 2544 2716 httbbn.exe 39 PID 2544 wrote to memory of 2056 2544 hbnnbb.exe 40 PID 2544 wrote to memory of 2056 2544 hbnnbb.exe 40 PID 2544 wrote to memory of 2056 2544 hbnnbb.exe 40 PID 2544 wrote to memory of 2056 2544 hbnnbb.exe 40 PID 2056 wrote to memory of 1520 2056 1dddd.exe 41 PID 2056 wrote to memory of 1520 2056 1dddd.exe 41 PID 2056 wrote to memory of 1520 2056 1dddd.exe 41 PID 2056 wrote to memory of 1520 2056 1dddd.exe 41 PID 1520 wrote to memory of 2788 1520 xrlrlll.exe 42 PID 1520 wrote to memory of 2788 1520 xrlrlll.exe 42 PID 1520 wrote to memory of 2788 1520 xrlrlll.exe 42 PID 1520 wrote to memory of 2788 1520 xrlrlll.exe 42 PID 2788 wrote to memory of 1252 2788 dvppd.exe 43 PID 2788 wrote to memory of 1252 2788 dvppd.exe 43 PID 2788 wrote to memory of 1252 2788 dvppd.exe 43 PID 2788 wrote to memory of 1252 2788 dvppd.exe 43 PID 1252 wrote to memory of 2364 1252 llffllr.exe 44 PID 1252 wrote to memory of 2364 1252 llffllr.exe 44 PID 1252 wrote to memory of 2364 1252 llffllr.exe 44 PID 1252 wrote to memory of 2364 1252 llffllr.exe 44 PID 2364 wrote to memory of 2904 2364 djpdd.exe 45 PID 2364 wrote to memory of 2904 2364 djpdd.exe 45 PID 2364 wrote to memory of 2904 2364 djpdd.exe 45 PID 2364 wrote to memory of 2904 2364 djpdd.exe 45 PID 2904 wrote to memory of 2900 2904 1xflxxf.exe 46 PID 2904 wrote to memory of 2900 2904 1xflxxf.exe 46 PID 2904 wrote to memory of 2900 2904 1xflxxf.exe 46 PID 2904 wrote to memory of 2900 2904 1xflxxf.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\0cffc491868d2fdf6ed8414241a49270N.exe"C:\Users\Admin\AppData\Local\Temp\0cffc491868d2fdf6ed8414241a49270N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\llxflll.exec:\llxflll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\5xrxrxl.exec:\5xrxrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\hbnbnt.exec:\hbnbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\dvjjp.exec:\dvjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\3hthbn.exec:\3hthbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\1pvdj.exec:\1pvdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\ppdpd.exec:\ppdpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\httbbn.exec:\httbbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\hbnnbb.exec:\hbnnbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\1dddd.exec:\1dddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\xrlrlll.exec:\xrlrlll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\dvppd.exec:\dvppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\llffllr.exec:\llffllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\djpdd.exec:\djpdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\1xflxxf.exec:\1xflxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\hbbhnn.exec:\hbbhnn.exe17⤵
- Executes dropped EXE
PID:2900 -
\??\c:\rrflflx.exec:\rrflflx.exe18⤵
- Executes dropped EXE
PID:1640 -
\??\c:\7rfflfr.exec:\7rfflfr.exe19⤵
- Executes dropped EXE
PID:2936 -
\??\c:\hhhnbh.exec:\hhhnbh.exe20⤵
- Executes dropped EXE
PID:2648 -
\??\c:\7pjpv.exec:\7pjpv.exe21⤵
- Executes dropped EXE
PID:2124 -
\??\c:\nnntnn.exec:\nnntnn.exe22⤵
- Executes dropped EXE
PID:416 -
\??\c:\dddjp.exec:\dddjp.exe23⤵
- Executes dropped EXE
PID:1616 -
\??\c:\lxrxffl.exec:\lxrxffl.exe24⤵
- Executes dropped EXE
PID:1308 -
\??\c:\7vpdp.exec:\7vpdp.exe25⤵
- Executes dropped EXE
PID:1652 -
\??\c:\5lfrflx.exec:\5lfrflx.exe26⤵
- Executes dropped EXE
PID:896 -
\??\c:\flfrxxl.exec:\flfrxxl.exe27⤵
- Executes dropped EXE
PID:1256 -
\??\c:\vvvjv.exec:\vvvjv.exe28⤵
- Executes dropped EXE
PID:1948 -
\??\c:\rrlxffl.exec:\rrlxffl.exe29⤵
- Executes dropped EXE
PID:2180 -
\??\c:\tthtbb.exec:\tthtbb.exe30⤵
- Executes dropped EXE
PID:1964 -
\??\c:\jjjjd.exec:\jjjjd.exe31⤵
- Executes dropped EXE
PID:2360 -
\??\c:\dvvjp.exec:\dvvjp.exe32⤵
- Executes dropped EXE
PID:1596 -
\??\c:\1rrrxlx.exec:\1rrrxlx.exe33⤵
- Executes dropped EXE
PID:2328 -
\??\c:\jjdjv.exec:\jjdjv.exe34⤵
- Executes dropped EXE
PID:2496 -
\??\c:\1lfllrr.exec:\1lfllrr.exe35⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jdvpv.exec:\jdvpv.exe36⤵
- Executes dropped EXE
PID:2696 -
\??\c:\fxllxfl.exec:\fxllxfl.exe37⤵
- Executes dropped EXE
PID:2748 -
\??\c:\7hhntt.exec:\7hhntt.exe38⤵
- Executes dropped EXE
PID:2828 -
\??\c:\tnnhnt.exec:\tnnhnt.exe39⤵
- Executes dropped EXE
PID:2008 -
\??\c:\7jddd.exec:\7jddd.exe40⤵
- Executes dropped EXE
PID:2864 -
\??\c:\xrxrrlf.exec:\xrxrrlf.exe41⤵
- Executes dropped EXE
PID:2688 -
\??\c:\rlfrxll.exec:\rlfrxll.exe42⤵
- Executes dropped EXE
PID:2872 -
\??\c:\tbbbhh.exec:\tbbbhh.exe43⤵
- Executes dropped EXE
PID:2564 -
\??\c:\vpddd.exec:\vpddd.exe44⤵
- Executes dropped EXE
PID:2560 -
\??\c:\pjjjp.exec:\pjjjp.exe45⤵
- Executes dropped EXE
PID:2376 -
\??\c:\rlflrxl.exec:\rlflrxl.exe46⤵
- Executes dropped EXE
PID:1676 -
\??\c:\bbttbh.exec:\bbttbh.exe47⤵
- Executes dropped EXE
PID:628 -
\??\c:\nhhnbb.exec:\nhhnbb.exe48⤵
- Executes dropped EXE
PID:2876 -
\??\c:\pjjpd.exec:\pjjpd.exe49⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xxxxffl.exec:\xxxxffl.exe50⤵
- Executes dropped EXE
PID:2024 -
\??\c:\llxxffr.exec:\llxxffr.exe51⤵
- Executes dropped EXE
PID:2860 -
\??\c:\bbtbht.exec:\bbtbht.exe52⤵
- Executes dropped EXE
PID:1552 -
\??\c:\ppddj.exec:\ppddj.exe53⤵
- Executes dropped EXE
PID:1612 -
\??\c:\7lxrxff.exec:\7lxrxff.exe54⤵
- Executes dropped EXE
PID:2952 -
\??\c:\rlxxfxf.exec:\rlxxfxf.exe55⤵
- Executes dropped EXE
PID:2776 -
\??\c:\1hbhth.exec:\1hbhth.exe56⤵
- Executes dropped EXE
PID:2944 -
\??\c:\pjvdp.exec:\pjvdp.exe57⤵
- Executes dropped EXE
PID:2064 -
\??\c:\vpdvj.exec:\vpdvj.exe58⤵
- Executes dropped EXE
PID:2244 -
\??\c:\rxrlxxl.exec:\rxrlxxl.exe59⤵
- Executes dropped EXE
PID:1132 -
\??\c:\xxrxlfl.exec:\xxrxlfl.exe60⤵
- Executes dropped EXE
PID:448 -
\??\c:\nnnthh.exec:\nnnthh.exe61⤵
- Executes dropped EXE
PID:1124 -
\??\c:\7vvpv.exec:\7vvpv.exe62⤵
- Executes dropped EXE
PID:2412 -
\??\c:\ddjjv.exec:\ddjjv.exe63⤵
- Executes dropped EXE
PID:1032 -
\??\c:\lrlrflf.exec:\lrlrflf.exe64⤵
- Executes dropped EXE
PID:1028 -
\??\c:\bbnhbh.exec:\bbnhbh.exe65⤵
- Executes dropped EXE
PID:2012 -
\??\c:\1vdpd.exec:\1vdpd.exe66⤵PID:1164
-
\??\c:\5jdjp.exec:\5jdjp.exe67⤵PID:2076
-
\??\c:\5rfrllx.exec:\5rfrllx.exe68⤵PID:2148
-
\??\c:\5hbbhh.exec:\5hbbhh.exe69⤵PID:1864
-
\??\c:\btnntt.exec:\btnntt.exe70⤵PID:2216
-
\??\c:\pjjpv.exec:\pjjpv.exe71⤵PID:2492
-
\??\c:\9lfflfr.exec:\9lfflfr.exe72⤵PID:1524
-
\??\c:\lfrxlrl.exec:\lfrxlrl.exe73⤵PID:540
-
\??\c:\hhtbhh.exec:\hhtbhh.exe74⤵PID:2524
-
\??\c:\jpppp.exec:\jpppp.exe75⤵PID:2040
-
\??\c:\1dppd.exec:\1dppd.exe76⤵PID:1576
-
\??\c:\rrlrlxl.exec:\rrlrlxl.exe77⤵PID:2768
-
\??\c:\ttbnbn.exec:\ttbnbn.exe78⤵PID:2680
-
\??\c:\7bhhhh.exec:\7bhhhh.exe79⤵PID:2448
-
\??\c:\dvvdd.exec:\dvvdd.exe80⤵PID:2372
-
\??\c:\3xxfrrx.exec:\3xxfrrx.exe81⤵PID:2584
-
\??\c:\tbthbb.exec:\tbthbb.exe82⤵PID:2700
-
\??\c:\ntnnbb.exec:\ntnnbb.exe83⤵PID:2668
-
\??\c:\dvjjp.exec:\dvjjp.exe84⤵PID:2716
-
\??\c:\ddvjj.exec:\ddvjj.exe85⤵PID:2568
-
\??\c:\rxlrlrf.exec:\rxlrlrf.exe86⤵PID:2004
-
\??\c:\htbhtt.exec:\htbhtt.exe87⤵PID:652
-
\??\c:\tnbbnn.exec:\tnbbnn.exe88⤵PID:2248
-
\??\c:\jvpvv.exec:\jvpvv.exe89⤵PID:1708
-
\??\c:\3lrxxxl.exec:\3lrxxxl.exe90⤵PID:2608
-
\??\c:\1frxllx.exec:\1frxllx.exe91⤵PID:2452
-
\??\c:\bbthnn.exec:\bbthnn.exe92⤵PID:2880
-
\??\c:\jdppd.exec:\jdppd.exe93⤵PID:316
-
\??\c:\ppjpj.exec:\ppjpj.exe94⤵PID:2904
-
\??\c:\lrlxflx.exec:\lrlxflx.exe95⤵PID:1984
-
\??\c:\hbtbhh.exec:\hbtbhh.exe96⤵PID:564
-
\??\c:\5jvvd.exec:\5jvvd.exe97⤵PID:2952
-
\??\c:\pdppd.exec:\pdppd.exe98⤵PID:1496
-
\??\c:\xfxrxxf.exec:\xfxrxxf.exe99⤵PID:2392
-
\??\c:\bhbhht.exec:\bhbhht.exe100⤵
- System Location Discovery: System Language Discovery
PID:2228 -
\??\c:\nhtbhn.exec:\nhtbhn.exe101⤵PID:1488
-
\??\c:\5jddj.exec:\5jddj.exe102⤵PID:2152
-
\??\c:\7xlflrx.exec:\7xlflrx.exe103⤵PID:1692
-
\??\c:\fflrxlf.exec:\fflrxlf.exe104⤵PID:2296
-
\??\c:\tbbtnt.exec:\tbbtnt.exe105⤵PID:1092
-
\??\c:\pppvd.exec:\pppvd.exe106⤵PID:1032
-
\??\c:\5pppd.exec:\5pppd.exe107⤵PID:1972
-
\??\c:\xfxrflf.exec:\xfxrflf.exe108⤵PID:1748
-
\??\c:\5tbhhh.exec:\5tbhhh.exe109⤵PID:980
-
\??\c:\1bnthh.exec:\1bnthh.exe110⤵PID:1992
-
\??\c:\djdvd.exec:\djdvd.exe111⤵PID:1876
-
\??\c:\fxrxrxf.exec:\fxrxrxf.exe112⤵PID:588
-
\??\c:\hhbthn.exec:\hhbthn.exe113⤵PID:1944
-
\??\c:\3bhhnt.exec:\3bhhnt.exe114⤵PID:2456
-
\??\c:\ppvdd.exec:\ppvdd.exe115⤵PID:1588
-
\??\c:\rfrfllr.exec:\rfrfllr.exe116⤵PID:2324
-
\??\c:\fxflrrx.exec:\fxflrrx.exe117⤵PID:332
-
\??\c:\nhtthh.exec:\nhtthh.exe118⤵PID:2096
-
\??\c:\vppjv.exec:\vppjv.exe119⤵PID:2644
-
\??\c:\pdpvv.exec:\pdpvv.exe120⤵PID:2780
-
\??\c:\7rxflrf.exec:\7rxflrf.exe121⤵PID:2752
-
\??\c:\5hhhnt.exec:\5hhhnt.exe122⤵PID:2684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-