Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/09/2024, 08:47
Behavioral task
behavioral1
Sample
c88d7ac2412af2e37130d392b078a7e0N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
c88d7ac2412af2e37130d392b078a7e0N.exe
-
Size
117KB
-
MD5
c88d7ac2412af2e37130d392b078a7e0
-
SHA1
1c282e256f2595f5b932ebb445c4f6cbffb20da0
-
SHA256
959155171785d6ad64fad12ce912f655c0bd1055443ba368f9cf61f08f7e09df
-
SHA512
854520786b94be6cdbdb5a8ab6a991976763d873092a2479587d534360ed5266e3a1dc53beca4e2ecf75cc6eaa277f047575bcd1f14074afc213e9b831ba4cce
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBHNgQlu8:9cm4FmowdHoS4BtgQo8
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/2344-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1044-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2280-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2348-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1156-45-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2812-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1156-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-82-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2752-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2296-120-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2296-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/484-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/992-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2352-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/752-158-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/752-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-192-0x0000000001B80000-0x0000000001BA7000-memory.dmp family_blackmoon behavioral1/memory/2908-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1132-209-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1132-211-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1168-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1356-247-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2440-260-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2440-264-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2440-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-282-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2344-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1356-284-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1728-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1912-315-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1912-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1912-317-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2792-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-364-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3012-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1496-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1240-431-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2392-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/664-470-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/664-469-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1600-485-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1600-490-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1192-498-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1692-501-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2400-512-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2468-515-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2668-616-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2112-624-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/272-733-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/548-758-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-903-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2492-1011-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2504-1054-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2160-1071-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-1101-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1988-1128-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2988-1210-0x0000000000280000-0x00000000002A7000-memory.dmp family_blackmoon behavioral1/memory/2244-1290-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2244-1310-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1044 llflxlx.exe 2280 bbtnth.exe 2348 xxxrfxl.exe 1156 1hhbnh.exe 2812 jjjpd.exe 2824 1rrxlxr.exe 2672 9rflrxl.exe 2752 ttnhnb.exe 2612 9ddjv.exe 2676 5xxlxfl.exe 3016 5nntnh.exe 2296 pdpjd.exe 484 fxfxxxl.exe 992 tnnbtb.exe 2352 9pvdv.exe 752 fxrxllx.exe 388 9hhtnb.exe 2868 hhnntb.exe 1408 pdvjv.exe 2908 lxfrrlx.exe 2880 9tntbh.exe 1132 htnnbt.exe 1168 vvdpp.exe 2380 7rrrlxr.exe 1700 rlfrrxf.exe 1356 7bthnt.exe 2032 vvjpd.exe 2440 3fffffr.exe 2252 nnbnbh.exe 2344 bnhbth.exe 2212 vdppd.exe 1728 7dddv.exe 2852 rflrffr.exe 1912 bbtnnb.exe 2828 dpjdj.exe 2816 ppddp.exe 2708 frlxfrf.exe 2824 9rrlxlx.exe 2672 hhbhhh.exe 2792 hbhtbh.exe 2560 9vvjp.exe 3012 pjjpp.exe 1964 xrlrxxl.exe 2024 5lfrlxr.exe 352 thbntn.exe 2016 tnhhnn.exe 884 dpdvp.exe 944 9dpjp.exe 1620 rlxxxfr.exe 1624 rrrlxlx.exe 1496 5tnnbb.exe 1240 1nbnth.exe 2624 vpjpv.exe 2760 jdvdv.exe 2196 rlxrlrf.exe 2392 llrffll.exe 2876 nnnttn.exe 664 hbtbhh.exe 2900 jjdpd.exe 844 1frrxfr.exe 1600 lllxxlx.exe 1192 tththh.exe 1692 bbntnt.exe 2400 dvjpv.exe -
resource yara_rule behavioral1/memory/2344-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000122ea-5.dat upx behavioral1/memory/2344-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1044-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d58-17.dat upx behavioral1/memory/2280-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2348-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016da7-26.dat upx behavioral1/memory/2348-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016dd0-36.dat upx behavioral1/files/0x0007000000016de4-46.dat upx behavioral1/memory/2812-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1156-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016de8-56.dat upx behavioral1/files/0x0008000000016eb8-63.dat upx behavioral1/memory/2672-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016edb-74.dat upx behavioral1/files/0x0006000000018f65-83.dat upx behavioral1/memory/2752-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001904c-93.dat upx behavioral1/memory/2612-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190e1-100.dat upx behavioral1/memory/3016-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191d2-112.dat upx behavioral1/memory/3016-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/484-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2296-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191f6-121.dat upx behavioral1/memory/484-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019217-132.dat upx behavioral1/files/0x0005000000019240-140.dat upx behavioral1/memory/992-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019259-150.dat upx behavioral1/memory/2352-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019268-160.dat upx behavioral1/memory/752-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001926c-168.dat upx behavioral1/files/0x0005000000019275-176.dat upx behavioral1/files/0x0005000000019278-184.dat upx behavioral1/files/0x000500000001929a-195.dat upx behavioral1/memory/2908-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019319-202.dat upx behavioral1/files/0x0005000000019365-212.dat upx behavioral1/files/0x0005000000019377-221.dat upx behavioral1/memory/1168-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019387-230.dat upx behavioral1/memory/1700-238-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193a4-239.dat upx behavioral1/files/0x0009000000016d36-248.dat upx behavioral1/memory/1356-247-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00050000000193b3-255.dat upx behavioral1/memory/2440-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193c1-268.dat upx behavioral1/files/0x0005000000019433-275.dat upx behavioral1/files/0x0005000000019446-286.dat upx behavioral1/memory/2344-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019450-295.dat upx behavioral1/memory/1728-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1912-318-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2792-355-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-364-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/3012-369-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1496-424-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrlfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2344 wrote to memory of 1044 2344 c88d7ac2412af2e37130d392b078a7e0N.exe 31 PID 2344 wrote to memory of 1044 2344 c88d7ac2412af2e37130d392b078a7e0N.exe 31 PID 2344 wrote to memory of 1044 2344 c88d7ac2412af2e37130d392b078a7e0N.exe 31 PID 2344 wrote to memory of 1044 2344 c88d7ac2412af2e37130d392b078a7e0N.exe 31 PID 1044 wrote to memory of 2280 1044 llflxlx.exe 32 PID 1044 wrote to memory of 2280 1044 llflxlx.exe 32 PID 1044 wrote to memory of 2280 1044 llflxlx.exe 32 PID 1044 wrote to memory of 2280 1044 llflxlx.exe 32 PID 2280 wrote to memory of 2348 2280 bbtnth.exe 33 PID 2280 wrote to memory of 2348 2280 bbtnth.exe 33 PID 2280 wrote to memory of 2348 2280 bbtnth.exe 33 PID 2280 wrote to memory of 2348 2280 bbtnth.exe 33 PID 2348 wrote to memory of 1156 2348 xxxrfxl.exe 34 PID 2348 wrote to memory of 1156 2348 xxxrfxl.exe 34 PID 2348 wrote to memory of 1156 2348 xxxrfxl.exe 34 PID 2348 wrote to memory of 1156 2348 xxxrfxl.exe 34 PID 1156 wrote to memory of 2812 1156 1hhbnh.exe 35 PID 1156 wrote to memory of 2812 1156 1hhbnh.exe 35 PID 1156 wrote to memory of 2812 1156 1hhbnh.exe 35 PID 1156 wrote to memory of 2812 1156 1hhbnh.exe 35 PID 2812 wrote to memory of 2824 2812 jjjpd.exe 36 PID 2812 wrote to memory of 2824 2812 jjjpd.exe 36 PID 2812 wrote to memory of 2824 2812 jjjpd.exe 36 PID 2812 wrote to memory of 2824 2812 jjjpd.exe 36 PID 2824 wrote to memory of 2672 2824 1rrxlxr.exe 37 PID 2824 wrote to memory of 2672 2824 1rrxlxr.exe 37 PID 2824 wrote to memory of 2672 2824 1rrxlxr.exe 37 PID 2824 wrote to memory of 2672 2824 1rrxlxr.exe 37 PID 2672 wrote to memory of 2752 2672 9rflrxl.exe 38 PID 2672 wrote to memory of 2752 2672 9rflrxl.exe 38 PID 2672 wrote to memory of 2752 2672 9rflrxl.exe 38 PID 2672 wrote to memory of 2752 2672 9rflrxl.exe 38 PID 2752 wrote to memory of 2612 2752 ttnhnb.exe 39 PID 2752 wrote to memory of 2612 2752 ttnhnb.exe 39 PID 2752 wrote to memory of 2612 2752 ttnhnb.exe 39 PID 2752 wrote to memory of 2612 2752 ttnhnb.exe 39 PID 2612 wrote to memory of 2676 2612 9ddjv.exe 40 PID 2612 wrote to memory of 2676 2612 9ddjv.exe 40 PID 2612 wrote to memory of 2676 2612 9ddjv.exe 40 PID 2612 wrote to memory of 2676 2612 9ddjv.exe 40 PID 2676 wrote to memory of 3016 2676 5xxlxfl.exe 41 PID 2676 wrote to memory of 3016 2676 5xxlxfl.exe 41 PID 2676 wrote to memory of 3016 2676 5xxlxfl.exe 41 PID 2676 wrote to memory of 3016 2676 5xxlxfl.exe 41 PID 3016 wrote to memory of 2296 3016 5nntnh.exe 42 PID 3016 wrote to memory of 2296 3016 5nntnh.exe 42 PID 3016 wrote to memory of 2296 3016 5nntnh.exe 42 PID 3016 wrote to memory of 2296 3016 5nntnh.exe 42 PID 2296 wrote to memory of 484 2296 pdpjd.exe 43 PID 2296 wrote to memory of 484 2296 pdpjd.exe 43 PID 2296 wrote to memory of 484 2296 pdpjd.exe 43 PID 2296 wrote to memory of 484 2296 pdpjd.exe 43 PID 484 wrote to memory of 992 484 fxfxxxl.exe 44 PID 484 wrote to memory of 992 484 fxfxxxl.exe 44 PID 484 wrote to memory of 992 484 fxfxxxl.exe 44 PID 484 wrote to memory of 992 484 fxfxxxl.exe 44 PID 992 wrote to memory of 2352 992 tnnbtb.exe 45 PID 992 wrote to memory of 2352 992 tnnbtb.exe 45 PID 992 wrote to memory of 2352 992 tnnbtb.exe 45 PID 992 wrote to memory of 2352 992 tnnbtb.exe 45 PID 2352 wrote to memory of 752 2352 9pvdv.exe 46 PID 2352 wrote to memory of 752 2352 9pvdv.exe 46 PID 2352 wrote to memory of 752 2352 9pvdv.exe 46 PID 2352 wrote to memory of 752 2352 9pvdv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\c88d7ac2412af2e37130d392b078a7e0N.exe"C:\Users\Admin\AppData\Local\Temp\c88d7ac2412af2e37130d392b078a7e0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\llflxlx.exec:\llflxlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\bbtnth.exec:\bbtnth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\xxxrfxl.exec:\xxxrfxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\1hhbnh.exec:\1hhbnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\jjjpd.exec:\jjjpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\1rrxlxr.exec:\1rrxlxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\9rflrxl.exec:\9rflrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\ttnhnb.exec:\ttnhnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\9ddjv.exec:\9ddjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\5xxlxfl.exec:\5xxlxfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\5nntnh.exec:\5nntnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\pdpjd.exec:\pdpjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\fxfxxxl.exec:\fxfxxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\tnnbtb.exec:\tnnbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\9pvdv.exec:\9pvdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\fxrxllx.exec:\fxrxllx.exe17⤵
- Executes dropped EXE
PID:752 -
\??\c:\9hhtnb.exec:\9hhtnb.exe18⤵
- Executes dropped EXE
PID:388 -
\??\c:\hhnntb.exec:\hhnntb.exe19⤵
- Executes dropped EXE
PID:2868 -
\??\c:\pdvjv.exec:\pdvjv.exe20⤵
- Executes dropped EXE
PID:1408 -
\??\c:\lxfrrlx.exec:\lxfrrlx.exe21⤵
- Executes dropped EXE
PID:2908 -
\??\c:\9tntbh.exec:\9tntbh.exe22⤵
- Executes dropped EXE
PID:2880 -
\??\c:\htnnbt.exec:\htnnbt.exe23⤵
- Executes dropped EXE
PID:1132 -
\??\c:\vvdpp.exec:\vvdpp.exe24⤵
- Executes dropped EXE
PID:1168 -
\??\c:\7rrrlxr.exec:\7rrrlxr.exe25⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rlfrrxf.exec:\rlfrrxf.exe26⤵
- Executes dropped EXE
PID:1700 -
\??\c:\7bthnt.exec:\7bthnt.exe27⤵
- Executes dropped EXE
PID:1356 -
\??\c:\vvjpd.exec:\vvjpd.exe28⤵
- Executes dropped EXE
PID:2032 -
\??\c:\3fffffr.exec:\3fffffr.exe29⤵
- Executes dropped EXE
PID:2440 -
\??\c:\nnbnbh.exec:\nnbnbh.exe30⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bnhbth.exec:\bnhbth.exe31⤵
- Executes dropped EXE
PID:2344 -
\??\c:\vdppd.exec:\vdppd.exe32⤵
- Executes dropped EXE
PID:2212 -
\??\c:\7dddv.exec:\7dddv.exe33⤵
- Executes dropped EXE
PID:1728 -
\??\c:\rflrffr.exec:\rflrffr.exe34⤵
- Executes dropped EXE
PID:2852 -
\??\c:\bbtnnb.exec:\bbtnnb.exe35⤵
- Executes dropped EXE
PID:1912 -
\??\c:\dpjdj.exec:\dpjdj.exe36⤵
- Executes dropped EXE
PID:2828 -
\??\c:\ppddp.exec:\ppddp.exe37⤵
- Executes dropped EXE
PID:2816 -
\??\c:\frlxfrf.exec:\frlxfrf.exe38⤵
- Executes dropped EXE
PID:2708 -
\??\c:\9rrlxlx.exec:\9rrlxlx.exe39⤵
- Executes dropped EXE
PID:2824 -
\??\c:\hhbhhh.exec:\hhbhhh.exe40⤵
- Executes dropped EXE
PID:2672 -
\??\c:\hbhtbh.exec:\hbhtbh.exe41⤵
- Executes dropped EXE
PID:2792 -
\??\c:\9vvjp.exec:\9vvjp.exe42⤵
- Executes dropped EXE
PID:2560 -
\??\c:\pjjpp.exec:\pjjpp.exe43⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xrlrxxl.exec:\xrlrxxl.exe44⤵
- Executes dropped EXE
PID:1964 -
\??\c:\5lfrlxr.exec:\5lfrlxr.exe45⤵
- Executes dropped EXE
PID:2024 -
\??\c:\thbntn.exec:\thbntn.exe46⤵
- Executes dropped EXE
PID:352 -
\??\c:\tnhhnn.exec:\tnhhnn.exe47⤵
- Executes dropped EXE
PID:2016 -
\??\c:\dpdvp.exec:\dpdvp.exe48⤵
- Executes dropped EXE
PID:884 -
\??\c:\9dpjp.exec:\9dpjp.exe49⤵
- Executes dropped EXE
PID:944 -
\??\c:\rlxxxfr.exec:\rlxxxfr.exe50⤵
- Executes dropped EXE
PID:1620 -
\??\c:\rrrlxlx.exec:\rrrlxlx.exe51⤵
- Executes dropped EXE
PID:1624 -
\??\c:\5tnnbb.exec:\5tnnbb.exe52⤵
- Executes dropped EXE
PID:1496 -
\??\c:\1nbnth.exec:\1nbnth.exe53⤵
- Executes dropped EXE
PID:1240 -
\??\c:\vpjpv.exec:\vpjpv.exe54⤵
- Executes dropped EXE
PID:2624 -
\??\c:\jdvdv.exec:\jdvdv.exe55⤵
- Executes dropped EXE
PID:2760 -
\??\c:\rlxrlrf.exec:\rlxrlrf.exe56⤵
- Executes dropped EXE
PID:2196 -
\??\c:\llrffll.exec:\llrffll.exe57⤵
- Executes dropped EXE
PID:2392 -
\??\c:\nnnttn.exec:\nnnttn.exe58⤵
- Executes dropped EXE
PID:2876 -
\??\c:\hbtbhh.exec:\hbtbhh.exe59⤵
- Executes dropped EXE
PID:664 -
\??\c:\jjdpd.exec:\jjdpd.exe60⤵
- Executes dropped EXE
PID:2900 -
\??\c:\1frrxfr.exec:\1frrxfr.exe61⤵
- Executes dropped EXE
PID:844 -
\??\c:\lllxxlx.exec:\lllxxlx.exe62⤵
- Executes dropped EXE
PID:1600 -
\??\c:\tththh.exec:\tththh.exe63⤵
- Executes dropped EXE
PID:1192 -
\??\c:\bbntnt.exec:\bbntnt.exe64⤵
- Executes dropped EXE
PID:1692 -
\??\c:\dvjpv.exec:\dvjpv.exe65⤵
- Executes dropped EXE
PID:2400 -
\??\c:\5ddvd.exec:\5ddvd.exe66⤵PID:2468
-
\??\c:\xxlrflx.exec:\xxlrflx.exe67⤵PID:880
-
\??\c:\thnbhh.exec:\thnbhh.exe68⤵PID:3064
-
\??\c:\9hnntb.exec:\9hnntb.exe69⤵PID:1384
-
\??\c:\3vvdj.exec:\3vvdj.exe70⤵PID:2344
-
\??\c:\dvdpp.exec:\dvdpp.exe71⤵PID:1552
-
\??\c:\ffxffrf.exec:\ffxffrf.exe72⤵PID:3056
-
\??\c:\xxrfxfx.exec:\xxrfxfx.exe73⤵PID:3004
-
\??\c:\nhnntb.exec:\nhnntb.exe74⤵PID:2852
-
\??\c:\nnbnnn.exec:\nnbnnn.exe75⤵PID:1708
-
\??\c:\jjddp.exec:\jjddp.exe76⤵PID:3068
-
\??\c:\jjpdj.exec:\jjpdj.exe77⤵PID:2680
-
\??\c:\9rxlrfl.exec:\9rxlrfl.exe78⤵PID:2716
-
\??\c:\rfxrlxx.exec:\rfxrlxx.exe79⤵PID:2152
-
\??\c:\nhtbnn.exec:\nhtbnn.exe80⤵PID:2292
-
\??\c:\hnnnbn.exec:\hnnnbn.exe81⤵PID:2668
-
\??\c:\pddpd.exec:\pddpd.exe82⤵PID:2112
-
\??\c:\9ddjv.exec:\9ddjv.exe83⤵PID:2324
-
\??\c:\rrlflrx.exec:\rrlflrx.exe84⤵PID:744
-
\??\c:\tthhhn.exec:\tthhhn.exe85⤵PID:1864
-
\??\c:\9htntb.exec:\9htntb.exe86⤵PID:2528
-
\??\c:\9vjdp.exec:\9vjdp.exe87⤵PID:772
-
\??\c:\5vdvj.exec:\5vdvj.exe88⤵PID:2288
-
\??\c:\7xrlxfr.exec:\7xrlxfr.exe89⤵PID:944
-
\??\c:\xxxrxlx.exec:\xxxrxlx.exe90⤵PID:536
-
\??\c:\hbtbbb.exec:\hbtbbb.exe91⤵PID:1624
-
\??\c:\vvjvj.exec:\vvjvj.exe92⤵PID:1252
-
\??\c:\vpdjp.exec:\vpdjp.exe93⤵PID:1240
-
\??\c:\7jvpp.exec:\7jvpp.exe94⤵PID:2624
-
\??\c:\lflfxfr.exec:\lflfxfr.exe95⤵PID:2776
-
\??\c:\rxlfffl.exec:\rxlfffl.exe96⤵PID:2896
-
\??\c:\5btnbh.exec:\5btnbh.exe97⤵PID:2596
-
\??\c:\5nnbhn.exec:\5nnbhn.exe98⤵PID:448
-
\??\c:\3pjpd.exec:\3pjpd.exe99⤵PID:272
-
\??\c:\vpdjd.exec:\vpdjd.exe100⤵PID:1916
-
\??\c:\9jdjp.exec:\9jdjp.exe101⤵PID:2652
-
\??\c:\lffrlrx.exec:\lffrlrx.exe102⤵PID:2220
-
\??\c:\ththtt.exec:\ththtt.exe103⤵PID:548
-
\??\c:\hbhhtb.exec:\hbhhtb.exe104⤵PID:604
-
\??\c:\ddvdd.exec:\ddvdd.exe105⤵PID:2532
-
\??\c:\5vdjp.exec:\5vdjp.exe106⤵PID:2936
-
\??\c:\lfxxflx.exec:\lfxxflx.exe107⤵PID:1856
-
\??\c:\9ffflrf.exec:\9ffflrf.exe108⤵PID:880
-
\??\c:\9tbtbt.exec:\9tbtbt.exe109⤵PID:3040
-
\??\c:\hbbntt.exec:\hbbntt.exe110⤵PID:1980
-
\??\c:\jpjdv.exec:\jpjdv.exe111⤵PID:2188
-
\??\c:\dddjd.exec:\dddjd.exe112⤵PID:2172
-
\??\c:\3xfrxfr.exec:\3xfrxfr.exe113⤵PID:3056
-
\??\c:\xrrflff.exec:\xrrflff.exe114⤵PID:2744
-
\??\c:\hthntb.exec:\hthntb.exe115⤵PID:1580
-
\??\c:\5vjjd.exec:\5vjjd.exe116⤵PID:2836
-
\??\c:\pjdpd.exec:\pjdpd.exe117⤵PID:2688
-
\??\c:\9jpvv.exec:\9jpvv.exe118⤵PID:2712
-
\??\c:\ffxflrr.exec:\ffxflrr.exe119⤵PID:2200
-
\??\c:\hbbnth.exec:\hbbnth.exe120⤵PID:2844
-
\??\c:\tnhtnn.exec:\tnhtnn.exe121⤵PID:3024
-
\??\c:\ppjdv.exec:\ppjdv.exe122⤵PID:2792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-