Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 02:08
Behavioral task
behavioral1
Sample
a8151ceb88f6c55e65912ecd5c960bd2c93c0d84fec31566cee5f5c7a099ff64N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
a8151ceb88f6c55e65912ecd5c960bd2c93c0d84fec31566cee5f5c7a099ff64N.exe
-
Size
530KB
-
MD5
088025d2f92e45675e957faa6d9053a0
-
SHA1
c177f0a49ea6faf4448b7a474b42b9ba7ea9681f
-
SHA256
a8151ceb88f6c55e65912ecd5c960bd2c93c0d84fec31566cee5f5c7a099ff64
-
SHA512
da4ab3e9872669dfe20720fe3b7353692d33ce88c8f2f64c5d61887259d1bfc08d6aa94ba61b2defbb860d9e7d807b41eacab940e4e80551d7a32f59cf783118
-
SSDEEP
12288:y4wFHoS3eFp3IDvSbh5nP+UbGTHoSouKs8N0u/D6vIZk:HFp3lzZbGa5sok
Malware Config
Signatures
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/484-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/888-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1856-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-81-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2596-94-0x00000000002D0000-0x00000000002F7000-memory.dmp family_blackmoon behavioral1/memory/2712-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-114-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2848-115-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2884-123-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2736-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1660-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-153-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2376-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/856-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1848-218-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1848-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1064-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2488-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1044-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1856-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-368-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2012-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2760-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1528-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-441-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1992-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1140-534-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-603-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-627-0x0000000000380000-0x00000000003A7000-memory.dmp family_blackmoon behavioral1/memory/2616-643-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-655-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2524-710-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1916-725-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/980-779-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1272-799-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/468-829-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1864-855-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 888 1fllxxf.exe 1712 bhnnhb.exe 1856 tnhhnn.exe 2780 dvvjj.exe 2692 frflrxf.exe 568 ttnbtn.exe 2852 ddpdj.exe 2592 9bnttb.exe 2596 jjvdj.exe 2712 1frllxx.exe 2848 vpjpd.exe 2884 nbnnbb.exe 2736 9vdpd.exe 1660 nnhhnn.exe 3016 1pjjp.exe 1784 fxrlxfr.exe 2576 7jddp.exe 2376 xxxxlxr.exe 448 hhtnbn.exe 856 xxrfxfr.exe 684 dvpdj.exe 1848 jdjpv.exe 1048 nhbnth.exe 2088 tnhtbt.exe 1680 tnbhnn.exe 1064 tnbhnn.exe 2988 fxfxfrl.exe 2040 7htbbh.exe 1112 xrxxllx.exe 400 hhtntt.exe 2980 jvjjp.exe 2488 9lrflrx.exe 576 9tbnbb.exe 1044 lfrlrlr.exe 1168 5nbnnb.exe 1856 9bhttn.exe 2828 jjpdv.exe 2944 3flffff.exe 2692 1htbbh.exe 568 ppvvd.exe 2852 lxlxxxr.exe 2540 1nhntb.exe 3044 hhtbtb.exe 2604 vpvdj.exe 2012 ffxxllx.exe 1968 bbbhhb.exe 2628 1pjjp.exe 2900 9dvdd.exe 2892 lxflxff.exe 2760 7bnhbh.exe 1528 9vdjd.exe 1984 3lxlflr.exe 1992 nbtnnh.exe 3064 3nhbnt.exe 2068 dpvdj.exe 696 flfrflf.exe 2044 hthhbt.exe 2240 pppdp.exe 1592 xxrrfxl.exe 1692 tnhnbb.exe 916 1djjj.exe 980 1djdd.exe 1356 rrrfrlx.exe 932 ntnntt.exe -
resource yara_rule behavioral1/memory/484-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a0000000122f6-5.dat upx behavioral1/memory/888-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/484-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001660d-19.dat upx behavioral1/memory/888-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001688f-27.dat upx behavioral1/memory/1712-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1856-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c88-36.dat upx behavioral1/files/0x0007000000016c9f-45.dat upx behavioral1/memory/2780-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2692-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016caa-55.dat upx behavioral1/files/0x0009000000016cef-64.dat upx behavioral1/memory/2852-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2592-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d21-71.dat upx behavioral1/memory/2596-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001707e-86.dat upx behavioral1/memory/2592-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000170da-96.dat upx behavioral1/memory/2712-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017226-105.dat upx behavioral1/files/0x00060000000174f7-116.dat upx behavioral1/files/0x000600000001756f-124.dat upx behavioral1/files/0x0005000000018708-133.dat upx behavioral1/memory/2736-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1660-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001870a-145.dat upx behavioral1/memory/3016-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001871a-154.dat upx behavioral1/files/0x00090000000162e3-163.dat upx behavioral1/files/0x00050000000187a7-171.dat upx behavioral1/files/0x00050000000187ac-181.dat upx behavioral1/memory/2376-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000187c0-190.dat upx behavioral1/files/0x0006000000018b7f-199.dat upx behavioral1/memory/856-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018bb0-208.dat upx behavioral1/files/0x0006000000018be5-219.dat upx behavioral1/memory/1848-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018bf9-227.dat upx behavioral1/files/0x0006000000018c05-237.dat upx behavioral1/files/0x0006000000018c11-248.dat upx behavioral1/memory/1064-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c31-257.dat upx behavioral1/files/0x0006000000018c33-265.dat upx behavioral1/files/0x0006000000019054-273.dat upx behavioral1/files/0x000500000001938c-281.dat upx behavioral1/memory/2980-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001939d-291.dat upx behavioral1/memory/2980-290-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2488-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193da-300.dat upx behavioral1/memory/1168-314-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1044-313-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1856-327-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2692-343-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2540-368-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/2012-388-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1968-390-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1968-398-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2628-399-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 484 wrote to memory of 888 484 a8151ceb88f6c55e65912ecd5c960bd2c93c0d84fec31566cee5f5c7a099ff64N.exe 31 PID 484 wrote to memory of 888 484 a8151ceb88f6c55e65912ecd5c960bd2c93c0d84fec31566cee5f5c7a099ff64N.exe 31 PID 484 wrote to memory of 888 484 a8151ceb88f6c55e65912ecd5c960bd2c93c0d84fec31566cee5f5c7a099ff64N.exe 31 PID 484 wrote to memory of 888 484 a8151ceb88f6c55e65912ecd5c960bd2c93c0d84fec31566cee5f5c7a099ff64N.exe 31 PID 888 wrote to memory of 1712 888 1fllxxf.exe 32 PID 888 wrote to memory of 1712 888 1fllxxf.exe 32 PID 888 wrote to memory of 1712 888 1fllxxf.exe 32 PID 888 wrote to memory of 1712 888 1fllxxf.exe 32 PID 1712 wrote to memory of 1856 1712 bhnnhb.exe 33 PID 1712 wrote to memory of 1856 1712 bhnnhb.exe 33 PID 1712 wrote to memory of 1856 1712 bhnnhb.exe 33 PID 1712 wrote to memory of 1856 1712 bhnnhb.exe 33 PID 1856 wrote to memory of 2780 1856 tnhhnn.exe 34 PID 1856 wrote to memory of 2780 1856 tnhhnn.exe 34 PID 1856 wrote to memory of 2780 1856 tnhhnn.exe 34 PID 1856 wrote to memory of 2780 1856 tnhhnn.exe 34 PID 2780 wrote to memory of 2692 2780 dvvjj.exe 35 PID 2780 wrote to memory of 2692 2780 dvvjj.exe 35 PID 2780 wrote to memory of 2692 2780 dvvjj.exe 35 PID 2780 wrote to memory of 2692 2780 dvvjj.exe 35 PID 2692 wrote to memory of 568 2692 frflrxf.exe 36 PID 2692 wrote to memory of 568 2692 frflrxf.exe 36 PID 2692 wrote to memory of 568 2692 frflrxf.exe 36 PID 2692 wrote to memory of 568 2692 frflrxf.exe 36 PID 568 wrote to memory of 2852 568 ttnbtn.exe 37 PID 568 wrote to memory of 2852 568 ttnbtn.exe 37 PID 568 wrote to memory of 2852 568 ttnbtn.exe 37 PID 568 wrote to memory of 2852 568 ttnbtn.exe 37 PID 2852 wrote to memory of 2592 2852 ddpdj.exe 38 PID 2852 wrote to memory of 2592 2852 ddpdj.exe 38 PID 2852 wrote to memory of 2592 2852 ddpdj.exe 38 PID 2852 wrote to memory of 2592 2852 ddpdj.exe 38 PID 2592 wrote to memory of 2596 2592 9bnttb.exe 39 PID 2592 wrote to memory of 2596 2592 9bnttb.exe 39 PID 2592 wrote to memory of 2596 2592 9bnttb.exe 39 PID 2592 wrote to memory of 2596 2592 9bnttb.exe 39 PID 2596 wrote to memory of 2712 2596 jjvdj.exe 40 PID 2596 wrote to memory of 2712 2596 jjvdj.exe 40 PID 2596 wrote to memory of 2712 2596 jjvdj.exe 40 PID 2596 wrote to memory of 2712 2596 jjvdj.exe 40 PID 2712 wrote to memory of 2848 2712 1frllxx.exe 41 PID 2712 wrote to memory of 2848 2712 1frllxx.exe 41 PID 2712 wrote to memory of 2848 2712 1frllxx.exe 41 PID 2712 wrote to memory of 2848 2712 1frllxx.exe 41 PID 2848 wrote to memory of 2884 2848 vpjpd.exe 42 PID 2848 wrote to memory of 2884 2848 vpjpd.exe 42 PID 2848 wrote to memory of 2884 2848 vpjpd.exe 42 PID 2848 wrote to memory of 2884 2848 vpjpd.exe 42 PID 2884 wrote to memory of 2736 2884 nbnnbb.exe 43 PID 2884 wrote to memory of 2736 2884 nbnnbb.exe 43 PID 2884 wrote to memory of 2736 2884 nbnnbb.exe 43 PID 2884 wrote to memory of 2736 2884 nbnnbb.exe 43 PID 2736 wrote to memory of 1660 2736 9vdpd.exe 44 PID 2736 wrote to memory of 1660 2736 9vdpd.exe 44 PID 2736 wrote to memory of 1660 2736 9vdpd.exe 44 PID 2736 wrote to memory of 1660 2736 9vdpd.exe 44 PID 1660 wrote to memory of 3016 1660 nnhhnn.exe 45 PID 1660 wrote to memory of 3016 1660 nnhhnn.exe 45 PID 1660 wrote to memory of 3016 1660 nnhhnn.exe 45 PID 1660 wrote to memory of 3016 1660 nnhhnn.exe 45 PID 3016 wrote to memory of 1784 3016 1pjjp.exe 46 PID 3016 wrote to memory of 1784 3016 1pjjp.exe 46 PID 3016 wrote to memory of 1784 3016 1pjjp.exe 46 PID 3016 wrote to memory of 1784 3016 1pjjp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8151ceb88f6c55e65912ecd5c960bd2c93c0d84fec31566cee5f5c7a099ff64N.exe"C:\Users\Admin\AppData\Local\Temp\a8151ceb88f6c55e65912ecd5c960bd2c93c0d84fec31566cee5f5c7a099ff64N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\1fllxxf.exec:\1fllxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\bhnnhb.exec:\bhnnhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\tnhhnn.exec:\tnhhnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\dvvjj.exec:\dvvjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\frflrxf.exec:\frflrxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\ttnbtn.exec:\ttnbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\ddpdj.exec:\ddpdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\9bnttb.exec:\9bnttb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\jjvdj.exec:\jjvdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\1frllxx.exec:\1frllxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\vpjpd.exec:\vpjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\nbnnbb.exec:\nbnnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\9vdpd.exec:\9vdpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\nnhhnn.exec:\nnhhnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\1pjjp.exec:\1pjjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\fxrlxfr.exec:\fxrlxfr.exe17⤵
- Executes dropped EXE
PID:1784 -
\??\c:\7jddp.exec:\7jddp.exe18⤵
- Executes dropped EXE
PID:2576 -
\??\c:\xxxxlxr.exec:\xxxxlxr.exe19⤵
- Executes dropped EXE
PID:2376 -
\??\c:\hhtnbn.exec:\hhtnbn.exe20⤵
- Executes dropped EXE
PID:448 -
\??\c:\xxrfxfr.exec:\xxrfxfr.exe21⤵
- Executes dropped EXE
PID:856 -
\??\c:\dvpdj.exec:\dvpdj.exe22⤵
- Executes dropped EXE
PID:684 -
\??\c:\jdjpv.exec:\jdjpv.exe23⤵
- Executes dropped EXE
PID:1848 -
\??\c:\nhbnth.exec:\nhbnth.exe24⤵
- Executes dropped EXE
PID:1048 -
\??\c:\tnhtbt.exec:\tnhtbt.exe25⤵
- Executes dropped EXE
PID:2088 -
\??\c:\tnbhnn.exec:\tnbhnn.exe26⤵
- Executes dropped EXE
PID:1680 -
\??\c:\tnbhnn.exec:\tnbhnn.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1064 -
\??\c:\fxfxfrl.exec:\fxfxfrl.exe28⤵
- Executes dropped EXE
PID:2988 -
\??\c:\7htbbh.exec:\7htbbh.exe29⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xrxxllx.exec:\xrxxllx.exe30⤵
- Executes dropped EXE
PID:1112 -
\??\c:\hhtntt.exec:\hhtntt.exe31⤵
- Executes dropped EXE
PID:400 -
\??\c:\jvjjp.exec:\jvjjp.exe32⤵
- Executes dropped EXE
PID:2980 -
\??\c:\9lrflrx.exec:\9lrflrx.exe33⤵
- Executes dropped EXE
PID:2488 -
\??\c:\9tbnbb.exec:\9tbnbb.exe34⤵
- Executes dropped EXE
PID:576 -
\??\c:\lfrlrlr.exec:\lfrlrlr.exe35⤵
- Executes dropped EXE
PID:1044 -
\??\c:\5nbnnb.exec:\5nbnnb.exe36⤵
- Executes dropped EXE
PID:1168 -
\??\c:\9bhttn.exec:\9bhttn.exe37⤵
- Executes dropped EXE
PID:1856 -
\??\c:\jjpdv.exec:\jjpdv.exe38⤵
- Executes dropped EXE
PID:2828 -
\??\c:\3flffff.exec:\3flffff.exe39⤵
- Executes dropped EXE
PID:2944 -
\??\c:\1htbbh.exec:\1htbbh.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\ppvvd.exec:\ppvvd.exe41⤵
- Executes dropped EXE
PID:568 -
\??\c:\lxlxxxr.exec:\lxlxxxr.exe42⤵
- Executes dropped EXE
PID:2852 -
\??\c:\1nhntb.exec:\1nhntb.exe43⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hhtbtb.exec:\hhtbtb.exe44⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vpvdj.exec:\vpvdj.exe45⤵
- Executes dropped EXE
PID:2604 -
\??\c:\ffxxllx.exec:\ffxxllx.exe46⤵
- Executes dropped EXE
PID:2012 -
\??\c:\bbbhhb.exec:\bbbhhb.exe47⤵
- Executes dropped EXE
PID:1968 -
\??\c:\1pjjp.exec:\1pjjp.exe48⤵
- Executes dropped EXE
PID:2628 -
\??\c:\9dvdd.exec:\9dvdd.exe49⤵
- Executes dropped EXE
PID:2900 -
\??\c:\lxflxff.exec:\lxflxff.exe50⤵
- Executes dropped EXE
PID:2892 -
\??\c:\7bnhbh.exec:\7bnhbh.exe51⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9vdjd.exec:\9vdjd.exe52⤵
- Executes dropped EXE
PID:1528 -
\??\c:\3lxlflr.exec:\3lxlflr.exe53⤵
- Executes dropped EXE
PID:1984 -
\??\c:\nbtnnh.exec:\nbtnnh.exe54⤵
- Executes dropped EXE
PID:1992 -
\??\c:\3nhbnt.exec:\3nhbnt.exe55⤵
- Executes dropped EXE
PID:3064 -
\??\c:\dpvdj.exec:\dpvdj.exe56⤵
- Executes dropped EXE
PID:2068 -
\??\c:\flfrflf.exec:\flfrflf.exe57⤵
- Executes dropped EXE
PID:696 -
\??\c:\hthhbt.exec:\hthhbt.exe58⤵
- Executes dropped EXE
PID:2044 -
\??\c:\pppdp.exec:\pppdp.exe59⤵
- Executes dropped EXE
PID:2240 -
\??\c:\xxrrfxl.exec:\xxrrfxl.exe60⤵
- Executes dropped EXE
PID:1592 -
\??\c:\tnhnbb.exec:\tnhnbb.exe61⤵
- Executes dropped EXE
PID:1692 -
\??\c:\1djjj.exec:\1djjj.exe62⤵
- Executes dropped EXE
PID:916 -
\??\c:\1djdd.exec:\1djdd.exe63⤵
- Executes dropped EXE
PID:980 -
\??\c:\rrrfrlx.exec:\rrrfrlx.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1356 -
\??\c:\ntnntt.exec:\ntnntt.exe65⤵
- Executes dropped EXE
PID:932 -
\??\c:\3djdd.exec:\3djdd.exe66⤵PID:2424
-
\??\c:\5vjdj.exec:\5vjdj.exe67⤵PID:2152
-
\??\c:\fxrrxrx.exec:\fxrrxrx.exe68⤵PID:1140
-
\??\c:\bnbbnb.exec:\bnbbnb.exe69⤵PID:2764
-
\??\c:\5vvpj.exec:\5vvpj.exe70⤵PID:1452
-
\??\c:\xrflrxl.exec:\xrflrxl.exe71⤵PID:2472
-
\??\c:\hbbbbt.exec:\hbbbbt.exe72⤵PID:552
-
\??\c:\tnbhnn.exec:\tnbhnn.exe73⤵PID:628
-
\??\c:\vpjjd.exec:\vpjjd.exe74⤵PID:1624
-
\??\c:\rlllllr.exec:\rlllllr.exe75⤵PID:888
-
\??\c:\hthhnh.exec:\hthhnh.exe76⤵PID:576
-
\??\c:\jpdjj.exec:\jpdjj.exe77⤵PID:2648
-
\??\c:\vjvpv.exec:\vjvpv.exe78⤵PID:1056
-
\??\c:\xlfflff.exec:\xlfflff.exe79⤵PID:2696
-
\??\c:\9bnttn.exec:\9bnttn.exe80⤵PID:2952
-
\??\c:\pjjvj.exec:\pjjvj.exe81⤵PID:2804
-
\??\c:\lfrxrxf.exec:\lfrxrxf.exe82⤵PID:2924
-
\??\c:\hbbhhb.exec:\hbbhhb.exe83⤵PID:2560
-
\??\c:\vjdvj.exec:\vjdvj.exe84⤵PID:2748
-
\??\c:\7lxflrf.exec:\7lxflrf.exe85⤵PID:2616
-
\??\c:\btnbnn.exec:\btnbnn.exe86⤵PID:2052
-
\??\c:\9vppd.exec:\9vppd.exe87⤵PID:1524
-
\??\c:\9rffrrr.exec:\9rffrrr.exe88⤵PID:2000
-
\??\c:\5rxflxf.exec:\5rxflxf.exe89⤵PID:2772
-
\??\c:\bbbhnt.exec:\bbbhnt.exe90⤵PID:2876
-
\??\c:\jdddv.exec:\jdddv.exe91⤵PID:3060
-
\??\c:\fflllxf.exec:\fflllxf.exe92⤵PID:2284
-
\??\c:\bbbhtt.exec:\bbbhtt.exe93⤵PID:1660
-
\??\c:\tnbhtb.exec:\tnbhtb.exe94⤵PID:2760
-
\??\c:\dvpjp.exec:\dvpjp.exe95⤵PID:2524
-
\??\c:\ffxfllr.exec:\ffxfllr.exe96⤵PID:1984
-
\??\c:\tbtnhn.exec:\tbtnhn.exe97⤵PID:1992
-
\??\c:\1nnbnb.exec:\1nnbnb.exe98⤵PID:1916
-
\??\c:\3pdjd.exec:\3pdjd.exe99⤵PID:2636
-
\??\c:\rlfrflr.exec:\rlfrflr.exe100⤵PID:1932
-
\??\c:\tntbhh.exec:\tntbhh.exe101⤵PID:984
-
\??\c:\nnnhnn.exec:\nnnhnn.exe102⤵PID:1100
-
\??\c:\vpvjp.exec:\vpvjp.exe103⤵PID:324
-
\??\c:\rlxflrx.exec:\rlxflrx.exe104⤵PID:1692
-
\??\c:\tnnthn.exec:\tnnthn.exe105⤵PID:916
-
\??\c:\jpjpv.exec:\jpjpv.exe106⤵PID:980
-
\??\c:\dpjjd.exec:\dpjjd.exe107⤵PID:1368
-
\??\c:\ffllllr.exec:\ffllllr.exe108⤵PID:1792
-
\??\c:\5hnnnb.exec:\5hnnnb.exe109⤵PID:1272
-
\??\c:\7pdpp.exec:\7pdpp.exe110⤵PID:468
-
\??\c:\lfllrlr.exec:\lfllrlr.exe111⤵PID:1956
-
\??\c:\nhnnnn.exec:\nhnnnn.exe112⤵PID:2976
-
\??\c:\1vdjv.exec:\1vdjv.exe113⤵PID:912
-
\??\c:\hthntn.exec:\hthntn.exe114⤵PID:1864
-
\??\c:\pjjpd.exec:\pjjpd.exe115⤵PID:2320
-
\??\c:\7lrxfxf.exec:\7lrxfxf.exe116⤵PID:1624
-
\??\c:\hhnbbh.exec:\hhnbbh.exe117⤵PID:888
-
\??\c:\pjvdv.exec:\pjvdv.exe118⤵PID:540
-
\??\c:\jvvdv.exec:\jvvdv.exe119⤵PID:2648
-
\??\c:\xrxfrxx.exec:\xrxfrxx.exe120⤵PID:1056
-
\??\c:\bbthhh.exec:\bbthhh.exe121⤵PID:2696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-