Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 19:39
Behavioral task
behavioral1
Sample
d8bf68c8878f51869ea1c5a78d9af1d0N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
d8bf68c8878f51869ea1c5a78d9af1d0N.exe
-
Size
367KB
-
MD5
d8bf68c8878f51869ea1c5a78d9af1d0
-
SHA1
40fec6897909f897924aa9bb1585a4a912073107
-
SHA256
a8c79012856b2ba2e4d5f8df3ac740890f87119a1c4c8d4448a49ba00ef58c81
-
SHA512
7f1d8aaed10862c1f9dbefe2b7f9ee3bd72d659e2edc3c2bba2fdb07237916161398e591f9012a4095bf3df7c11d1ca661fac490933a5633fbd2d27c50d8e5cc
-
SSDEEP
6144:9cm4FmowdHoSdSyEAxyx/ZrTTr4qIMgE8+:/4wFHoSQuxy3rTXIM18+
Malware Config
Signatures
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2084-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1784-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/600-190-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/692-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/916-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2052-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1048-261-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/3004-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/772-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1972-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-326-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2732-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-360-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2732-358-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2868-366-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/584-409-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/584-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1488-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-437-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2144-451-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1768-457-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1084-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-554-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1760-579-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2096-598-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1028-618-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2376-625-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2704-632-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2716-652-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-695-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-734-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/692-789-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1752-833-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1752-853-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2712-957-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2408 tthnbh.exe 2372 vdjpj.exe 1736 7htntt.exe 1260 xxxlflx.exe 2800 bbntbb.exe 2756 dddpj.exe 2760 nnhtht.exe 2624 nhtnbh.exe 2148 1rrxxll.exe 2652 tnhnbb.exe 2648 pvpdd.exe 1784 btnthn.exe 1488 5dvvd.exe 2112 lxrrxfr.exe 2880 9bnthn.exe 2000 5dvdj.exe 1768 nnnntb.exe 1936 jjdvj.exe 580 jdvdp.exe 600 hbtbnn.exe 2580 lfrxfxf.exe 1140 7thnth.exe 692 btnbbn.exe 1600 5lfrflx.exe 776 vppvj.exe 2052 rrlxxlr.exe 916 3tbnbb.exe 1048 5dpvp.exe 3004 fxrfrrf.exe 2312 7ttbnn.exe 772 djvvj.exe 2680 rlfrxxf.exe 2548 nhnnbb.exe 2412 5pdvj.exe 1972 lfxfflf.exe 2436 1nhbbn.exe 344 1ddjj.exe 1832 5dppv.exe 2748 1rllrff.exe 2808 rlrrflx.exe 2732 thnhnh.exe 2868 jdvpv.exe 1812 ppjvj.exe 2908 rlflrxf.exe 2676 nnhtnb.exe 2204 5hbtnb.exe 2332 vpddj.exe 584 frlxlxf.exe 1628 rlxflrx.exe 1488 hhnhbb.exe 2688 jpdpp.exe 2920 rlxrrrx.exe 2008 rflrfrl.exe 2144 nntbnt.exe 1768 bhnhtn.exe 1936 vvpvj.exe 264 rrffrxf.exe 1248 thbhhn.exe 1808 thbhth.exe 2248 ppvjp.exe 1084 1flfrxl.exe 2304 lfxfrxf.exe 1764 bthtbb.exe 304 9dddj.exe -
resource yara_rule behavioral1/memory/2084-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001211a-5.dat upx behavioral1/memory/2084-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2408-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000173da-18.dat upx behavioral1/memory/2408-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000173f1-26.dat upx behavioral1/memory/2372-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1736-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000173f4-36.dat upx behavioral1/files/0x0007000000017472-44.dat upx behavioral1/memory/2800-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000017487-54.dat upx behavioral1/files/0x00070000000174a2-66.dat upx behavioral1/memory/2756-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2624-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017525-72.dat upx behavioral1/files/0x0016000000018663-82.dat upx behavioral1/memory/2148-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019263-91.dat upx behavioral1/files/0x0005000000019266-100.dat upx behavioral1/memory/2652-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2648-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019284-109.dat upx behavioral1/memory/1784-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001928c-118.dat upx behavioral1/files/0x0005000000019353-127.dat upx behavioral1/files/0x0005000000019356-137.dat upx behavioral1/memory/2112-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001936b-146.dat upx behavioral1/files/0x000500000001937b-156.dat upx behavioral1/files/0x0005000000019397-164.dat upx behavioral1/files/0x0009000000016ea4-172.dat upx behavioral1/memory/580-180-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00050000000193a5-181.dat upx behavioral1/files/0x0005000000019423-192.dat upx behavioral1/files/0x0005000000019426-200.dat upx behavioral1/files/0x0005000000019438-207.dat upx behavioral1/files/0x0005000000019442-216.dat upx behavioral1/memory/692-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001944d-225.dat upx behavioral1/memory/1600-224-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019458-233.dat upx behavioral1/files/0x000500000001945c-242.dat upx behavioral1/memory/916-246-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2052-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001946b-252.dat upx behavioral1/files/0x000500000001946e-262.dat upx behavioral1/memory/3004-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ae-271.dat upx behavioral1/files/0x00050000000194c9-283.dat upx behavioral1/memory/772-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2312-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194df-292.dat upx behavioral1/memory/2548-301-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2680-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1972-318-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2732-352-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2908-375-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/584-410-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1488-423-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2920-438-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1936-459-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1808-479-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfffrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frlrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrlxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2408 2084 d8bf68c8878f51869ea1c5a78d9af1d0N.exe 30 PID 2084 wrote to memory of 2408 2084 d8bf68c8878f51869ea1c5a78d9af1d0N.exe 30 PID 2084 wrote to memory of 2408 2084 d8bf68c8878f51869ea1c5a78d9af1d0N.exe 30 PID 2084 wrote to memory of 2408 2084 d8bf68c8878f51869ea1c5a78d9af1d0N.exe 30 PID 2408 wrote to memory of 2372 2408 tthnbh.exe 31 PID 2408 wrote to memory of 2372 2408 tthnbh.exe 31 PID 2408 wrote to memory of 2372 2408 tthnbh.exe 31 PID 2408 wrote to memory of 2372 2408 tthnbh.exe 31 PID 2372 wrote to memory of 1736 2372 vdjpj.exe 32 PID 2372 wrote to memory of 1736 2372 vdjpj.exe 32 PID 2372 wrote to memory of 1736 2372 vdjpj.exe 32 PID 2372 wrote to memory of 1736 2372 vdjpj.exe 32 PID 1736 wrote to memory of 1260 1736 7htntt.exe 33 PID 1736 wrote to memory of 1260 1736 7htntt.exe 33 PID 1736 wrote to memory of 1260 1736 7htntt.exe 33 PID 1736 wrote to memory of 1260 1736 7htntt.exe 33 PID 1260 wrote to memory of 2800 1260 xxxlflx.exe 34 PID 1260 wrote to memory of 2800 1260 xxxlflx.exe 34 PID 1260 wrote to memory of 2800 1260 xxxlflx.exe 34 PID 1260 wrote to memory of 2800 1260 xxxlflx.exe 34 PID 2800 wrote to memory of 2756 2800 bbntbb.exe 35 PID 2800 wrote to memory of 2756 2800 bbntbb.exe 35 PID 2800 wrote to memory of 2756 2800 bbntbb.exe 35 PID 2800 wrote to memory of 2756 2800 bbntbb.exe 35 PID 2756 wrote to memory of 2760 2756 dddpj.exe 36 PID 2756 wrote to memory of 2760 2756 dddpj.exe 36 PID 2756 wrote to memory of 2760 2756 dddpj.exe 36 PID 2756 wrote to memory of 2760 2756 dddpj.exe 36 PID 2760 wrote to memory of 2624 2760 nnhtht.exe 37 PID 2760 wrote to memory of 2624 2760 nnhtht.exe 37 PID 2760 wrote to memory of 2624 2760 nnhtht.exe 37 PID 2760 wrote to memory of 2624 2760 nnhtht.exe 37 PID 2624 wrote to memory of 2148 2624 nhtnbh.exe 38 PID 2624 wrote to memory of 2148 2624 nhtnbh.exe 38 PID 2624 wrote to memory of 2148 2624 nhtnbh.exe 38 PID 2624 wrote to memory of 2148 2624 nhtnbh.exe 38 PID 2148 wrote to memory of 2652 2148 1rrxxll.exe 39 PID 2148 wrote to memory of 2652 2148 1rrxxll.exe 39 PID 2148 wrote to memory of 2652 2148 1rrxxll.exe 39 PID 2148 wrote to memory of 2652 2148 1rrxxll.exe 39 PID 2652 wrote to memory of 2648 2652 tnhnbb.exe 40 PID 2652 wrote to memory of 2648 2652 tnhnbb.exe 40 PID 2652 wrote to memory of 2648 2652 tnhnbb.exe 40 PID 2652 wrote to memory of 2648 2652 tnhnbb.exe 40 PID 2648 wrote to memory of 1784 2648 pvpdd.exe 41 PID 2648 wrote to memory of 1784 2648 pvpdd.exe 41 PID 2648 wrote to memory of 1784 2648 pvpdd.exe 41 PID 2648 wrote to memory of 1784 2648 pvpdd.exe 41 PID 1784 wrote to memory of 1488 1784 btnthn.exe 42 PID 1784 wrote to memory of 1488 1784 btnthn.exe 42 PID 1784 wrote to memory of 1488 1784 btnthn.exe 42 PID 1784 wrote to memory of 1488 1784 btnthn.exe 42 PID 1488 wrote to memory of 2112 1488 5dvvd.exe 43 PID 1488 wrote to memory of 2112 1488 5dvvd.exe 43 PID 1488 wrote to memory of 2112 1488 5dvvd.exe 43 PID 1488 wrote to memory of 2112 1488 5dvvd.exe 43 PID 2112 wrote to memory of 2880 2112 lxrrxfr.exe 44 PID 2112 wrote to memory of 2880 2112 lxrrxfr.exe 44 PID 2112 wrote to memory of 2880 2112 lxrrxfr.exe 44 PID 2112 wrote to memory of 2880 2112 lxrrxfr.exe 44 PID 2880 wrote to memory of 2000 2880 9bnthn.exe 45 PID 2880 wrote to memory of 2000 2880 9bnthn.exe 45 PID 2880 wrote to memory of 2000 2880 9bnthn.exe 45 PID 2880 wrote to memory of 2000 2880 9bnthn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8bf68c8878f51869ea1c5a78d9af1d0N.exe"C:\Users\Admin\AppData\Local\Temp\d8bf68c8878f51869ea1c5a78d9af1d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\tthnbh.exec:\tthnbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\vdjpj.exec:\vdjpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\7htntt.exec:\7htntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\xxxlflx.exec:\xxxlflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\bbntbb.exec:\bbntbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\dddpj.exec:\dddpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\nnhtht.exec:\nnhtht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\nhtnbh.exec:\nhtnbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\1rrxxll.exec:\1rrxxll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\tnhnbb.exec:\tnhnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\pvpdd.exec:\pvpdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\btnthn.exec:\btnthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\5dvvd.exec:\5dvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\lxrrxfr.exec:\lxrrxfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\9bnthn.exec:\9bnthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\5dvdj.exec:\5dvdj.exe17⤵
- Executes dropped EXE
PID:2000 -
\??\c:\nnnntb.exec:\nnnntb.exe18⤵
- Executes dropped EXE
PID:1768 -
\??\c:\jjdvj.exec:\jjdvj.exe19⤵
- Executes dropped EXE
PID:1936 -
\??\c:\jdvdp.exec:\jdvdp.exe20⤵
- Executes dropped EXE
PID:580 -
\??\c:\hbtbnn.exec:\hbtbnn.exe21⤵
- Executes dropped EXE
PID:600 -
\??\c:\lfrxfxf.exec:\lfrxfxf.exe22⤵
- Executes dropped EXE
PID:2580 -
\??\c:\7thnth.exec:\7thnth.exe23⤵
- Executes dropped EXE
PID:1140 -
\??\c:\btnbbn.exec:\btnbbn.exe24⤵
- Executes dropped EXE
PID:692 -
\??\c:\5lfrflx.exec:\5lfrflx.exe25⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vppvj.exec:\vppvj.exe26⤵
- Executes dropped EXE
PID:776 -
\??\c:\rrlxxlr.exec:\rrlxxlr.exe27⤵
- Executes dropped EXE
PID:2052 -
\??\c:\3tbnbb.exec:\3tbnbb.exe28⤵
- Executes dropped EXE
PID:916 -
\??\c:\5dpvp.exec:\5dpvp.exe29⤵
- Executes dropped EXE
PID:1048 -
\??\c:\fxrfrrf.exec:\fxrfrrf.exe30⤵
- Executes dropped EXE
PID:3004 -
\??\c:\7ttbnn.exec:\7ttbnn.exe31⤵
- Executes dropped EXE
PID:2312 -
\??\c:\djvvj.exec:\djvvj.exe32⤵
- Executes dropped EXE
PID:772 -
\??\c:\rlfrxxf.exec:\rlfrxxf.exe33⤵
- Executes dropped EXE
PID:2680 -
\??\c:\nhnnbb.exec:\nhnnbb.exe34⤵
- Executes dropped EXE
PID:2548 -
\??\c:\5pdvj.exec:\5pdvj.exe35⤵
- Executes dropped EXE
PID:2412 -
\??\c:\lfxfflf.exec:\lfxfflf.exe36⤵
- Executes dropped EXE
PID:1972 -
\??\c:\1nhbbn.exec:\1nhbbn.exe37⤵
- Executes dropped EXE
PID:2436 -
\??\c:\1ddjj.exec:\1ddjj.exe38⤵
- Executes dropped EXE
PID:344 -
\??\c:\5dppv.exec:\5dppv.exe39⤵
- Executes dropped EXE
PID:1832 -
\??\c:\1rllrff.exec:\1rllrff.exe40⤵
- Executes dropped EXE
PID:2748 -
\??\c:\rlrrflx.exec:\rlrrflx.exe41⤵
- Executes dropped EXE
PID:2808 -
\??\c:\thnhnh.exec:\thnhnh.exe42⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jdvpv.exec:\jdvpv.exe43⤵
- Executes dropped EXE
PID:2868 -
\??\c:\ppjvj.exec:\ppjvj.exe44⤵
- Executes dropped EXE
PID:1812 -
\??\c:\rlflrxf.exec:\rlflrxf.exe45⤵
- Executes dropped EXE
PID:2908 -
\??\c:\nnhtnb.exec:\nnhtnb.exe46⤵
- Executes dropped EXE
PID:2676 -
\??\c:\5hbtnb.exec:\5hbtnb.exe47⤵
- Executes dropped EXE
PID:2204 -
\??\c:\vpddj.exec:\vpddj.exe48⤵
- Executes dropped EXE
PID:2332 -
\??\c:\frlxlxf.exec:\frlxlxf.exe49⤵
- Executes dropped EXE
PID:584 -
\??\c:\rlxflrx.exec:\rlxflrx.exe50⤵
- Executes dropped EXE
PID:1628 -
\??\c:\hhnhbb.exec:\hhnhbb.exe51⤵
- Executes dropped EXE
PID:1488 -
\??\c:\jpdpp.exec:\jpdpp.exe52⤵
- Executes dropped EXE
PID:2688 -
\??\c:\rlxrrrx.exec:\rlxrrrx.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2920 -
\??\c:\rflrfrl.exec:\rflrfrl.exe54⤵
- Executes dropped EXE
PID:2008 -
\??\c:\nntbnt.exec:\nntbnt.exe55⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bhnhtn.exec:\bhnhtn.exe56⤵
- Executes dropped EXE
PID:1768 -
\??\c:\vvpvj.exec:\vvpvj.exe57⤵
- Executes dropped EXE
PID:1936 -
\??\c:\rrffrxf.exec:\rrffrxf.exe58⤵
- Executes dropped EXE
PID:264 -
\??\c:\thbhhn.exec:\thbhhn.exe59⤵
- Executes dropped EXE
PID:1248 -
\??\c:\thbhth.exec:\thbhth.exe60⤵
- Executes dropped EXE
PID:1808 -
\??\c:\ppvjp.exec:\ppvjp.exe61⤵
- Executes dropped EXE
PID:2248 -
\??\c:\1flfrxl.exec:\1flfrxl.exe62⤵
- Executes dropped EXE
PID:1084 -
\??\c:\lfxfrxf.exec:\lfxfrxf.exe63⤵
- Executes dropped EXE
PID:2304 -
\??\c:\bthtbb.exec:\bthtbb.exe64⤵
- Executes dropped EXE
PID:1764 -
\??\c:\9dddj.exec:\9dddj.exe65⤵
- Executes dropped EXE
PID:304 -
\??\c:\ddvvd.exec:\ddvvd.exe66⤵PID:1324
-
\??\c:\xfrlfrr.exec:\xfrlfrr.exe67⤵PID:1564
-
\??\c:\bhhtnb.exec:\bhhtnb.exe68⤵PID:700
-
\??\c:\3nhtht.exec:\3nhtht.exe69⤵
- System Location Discovery: System Language Discovery
PID:2280 -
\??\c:\ppjdp.exec:\ppjdp.exe70⤵PID:2268
-
\??\c:\flfrxlr.exec:\flfrxlr.exe71⤵PID:3048
-
\??\c:\xxfrlxr.exec:\xxfrlxr.exe72⤵PID:2068
-
\??\c:\1tthnt.exec:\1tthnt.exe73⤵PID:844
-
\??\c:\jdpvj.exec:\jdpvj.exe74⤵PID:1640
-
\??\c:\1vppv.exec:\1vppv.exe75⤵PID:1760
-
\??\c:\lllrllx.exec:\lllrllx.exe76⤵PID:2680
-
\??\c:\hbntbt.exec:\hbntbt.exe77⤵PID:2548
-
\??\c:\3thnbn.exec:\3thnbn.exe78⤵PID:2096
-
\??\c:\3ppvj.exec:\3ppvj.exe79⤵PID:1588
-
\??\c:\rfffllx.exec:\rfffllx.exe80⤵PID:1656
-
\??\c:\rrflrfr.exec:\rrflrfr.exe81⤵PID:1028
-
\??\c:\nhttht.exec:\nhttht.exe82⤵PID:2376
-
\??\c:\djppv.exec:\djppv.exe83⤵PID:2704
-
\??\c:\pjddj.exec:\pjddj.exe84⤵PID:2796
-
\??\c:\lffxfrl.exec:\lffxfrl.exe85⤵PID:2636
-
\??\c:\tnhtbh.exec:\tnhtbh.exe86⤵PID:2716
-
\??\c:\jpjpv.exec:\jpjpv.exe87⤵PID:2628
-
\??\c:\vpppd.exec:\vpppd.exe88⤵PID:2816
-
\??\c:\fxlllrx.exec:\fxlllrx.exe89⤵PID:2148
-
\??\c:\9hbbnt.exec:\9hbbnt.exe90⤵PID:1944
-
\??\c:\hbtbnt.exec:\hbtbnt.exe91⤵PID:2204
-
\??\c:\1jppd.exec:\1jppd.exe92⤵PID:680
-
\??\c:\1rrfrfr.exec:\1rrfrfr.exe93⤵PID:2988
-
\??\c:\3flrlff.exec:\3flrlff.exe94⤵PID:2012
-
\??\c:\hbtbhh.exec:\hbtbhh.exe95⤵PID:2896
-
\??\c:\ddpdj.exec:\ddpdj.exe96⤵PID:2688
-
\??\c:\vvpvj.exec:\vvpvj.exe97⤵PID:2920
-
\??\c:\9xrrflr.exec:\9xrrflr.exe98⤵PID:2000
-
\??\c:\3hnnnt.exec:\3hnnnt.exe99⤵PID:2660
-
\??\c:\dvpdj.exec:\dvpdj.exe100⤵PID:816
-
\??\c:\pvdjj.exec:\pvdjj.exe101⤵PID:532
-
\??\c:\fflxrxr.exec:\fflxrxr.exe102⤵PID:1660
-
\??\c:\7xfrlrf.exec:\7xfrlrf.exe103⤵PID:272
-
\??\c:\tnbnbb.exec:\tnbnbb.exe104⤵PID:616
-
\??\c:\3jvdd.exec:\3jvdd.exe105⤵PID:920
-
\??\c:\fllrfrl.exec:\fllrfrl.exe106⤵PID:3028
-
\??\c:\rrlxlxr.exec:\rrlxlxr.exe107⤵PID:692
-
\??\c:\7nhnnt.exec:\7nhnnt.exe108⤵PID:340
-
\??\c:\tnhnbb.exec:\tnhnbb.exe109⤵PID:1336
-
\??\c:\jjdjv.exec:\jjdjv.exe110⤵PID:852
-
\??\c:\lrrxffr.exec:\lrrxffr.exe111⤵PID:2188
-
\??\c:\frrfflx.exec:\frrfflx.exe112⤵PID:2344
-
\??\c:\1nbbhh.exec:\1nbbhh.exe113⤵PID:1048
-
\??\c:\jjdpv.exec:\jjdpv.exe114⤵PID:1752
-
\??\c:\ppvpv.exec:\ppvpv.exe115⤵PID:1872
-
\??\c:\lrrxffx.exec:\lrrxffx.exe116⤵PID:2068
-
\??\c:\7bhhnt.exec:\7bhhnt.exe117⤵PID:2484
-
\??\c:\pppvv.exec:\pppvv.exe118⤵PID:1640
-
\??\c:\dvpdj.exec:\dvpdj.exe119⤵PID:1760
-
\??\c:\fxxxlxl.exec:\fxxxlxl.exe120⤵PID:1644
-
\??\c:\fxxxlrx.exec:\fxxxlrx.exe121⤵PID:1820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-