Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 23:15
Behavioral task
behavioral1
Sample
720abe70e3ec8ae83a769e5367c8aec23eb5cbfba58d67c450dc57e1b6b93eb1N.exe
Resource
win7-20240708-en
General
-
Target
720abe70e3ec8ae83a769e5367c8aec23eb5cbfba58d67c450dc57e1b6b93eb1N.exe
-
Size
201KB
-
MD5
05563d6a115ab574dd39807b7d3c9ba0
-
SHA1
c3fdf1fa0c4541db85708e4f2d999bd1f211a4b2
-
SHA256
720abe70e3ec8ae83a769e5367c8aec23eb5cbfba58d67c450dc57e1b6b93eb1
-
SHA512
d1b5e0c75b3f2521f28fe539d1976d9e076f98a66fe279a8df918926fc278895e3a412d2c5435de464e49126358fd6061703c56bdd6c5e8fa8e3e256086e5be6
-
SSDEEP
3072:ZhOmTsF93UYfwC6GIoutFza6BhOmTsUm82xpi8rY9AABa1JePQKN1hJCDN:Zcm4FmowdHoSha6Bcm4JddW7Y6XJCDN
Malware Config
Signatures
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/2516-29-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2736-40-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2516-28-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2624-18-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/388-9-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/388-6-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2828-53-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/596-49-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/596-48-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2828-59-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2676-65-0x00000000005D0000-0x000000000060F000-memory.dmp family_blackmoon behavioral1/memory/2676-71-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2888-79-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2564-93-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2716-91-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2564-101-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2596-106-0x0000000000440000-0x000000000047F000-memory.dmp family_blackmoon behavioral1/memory/2596-113-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/992-117-0x0000000000220000-0x000000000025F000-memory.dmp family_blackmoon behavioral1/memory/992-121-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/992-123-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1072-134-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2604-146-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2840-143-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2604-154-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1448-160-0x0000000000220000-0x000000000025F000-memory.dmp family_blackmoon behavioral1/memory/2604-156-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1448-167-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2840-177-0x00000000003C0000-0x00000000003FF000-memory.dmp family_blackmoon behavioral1/memory/1136-176-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2400-189-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2720-187-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2400-199-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2088-208-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1144-221-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/840-231-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1560-241-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/892-252-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/3020-263-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/624-278-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1012-287-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2472-298-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1724-309-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2440-318-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2488-328-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2796-339-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2156-353-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2812-351-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2156-360-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2660-369-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2756-439-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1648-456-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1768-465-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2424-483-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/2248-493-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/840-528-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon behavioral1/memory/1572-538-0x0000000000400000-0x000000000043F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2624 pjjvp.exe 2516 fxllxfl.exe 2736 7rllllx.exe 596 bbthbh.exe 2828 nbhhnn.exe 2676 nnhtnt.exe 2888 5nbnnh.exe 2716 5vvjd.exe 2564 ffxlxfr.exe 2596 1nhhtb.exe 992 1dvvv.exe 1072 hbbttn.exe 2840 jjjpd.exe 2604 lfxflxx.exe 1448 vpdvv.exe 1136 pjppv.exe 2720 bnhnhn.exe 2400 nhhttb.exe 2088 xrlflxf.exe 1144 bbthtb.exe 840 nnhhnh.exe 1560 jdddj.exe 892 rxfffrr.exe 3020 1pdjp.exe 624 nbhbhb.exe 1012 3dpvd.exe 2472 frlrlfl.exe 1724 bhnthb.exe 2440 7lxxfxf.exe 2488 1nbbbb.exe 2796 dpvvv.exe 2812 7rfflff.exe 2156 nhbhnb.exe 2660 5hbnbt.exe 2888 frrlxrr.exe 2544 bnbbbt.exe 292 vpddd.exe 3056 jjjdv.exe 1032 fxxxffl.exe 2852 9xrxflr.exe 2064 bnttnt.exe 2776 pdvpp.exe 2756 pjvjv.exe 2868 dpdjj.exe 1648 lxxxrxx.exe 1768 htnbnn.exe 2892 nbbhtt.exe 2424 vpdjv.exe 2248 vdpdv.exe 1036 xlrxffx.exe 3044 xlfxffl.exe 1360 1tbthb.exe 840 tnnnnh.exe 1572 7jppp.exe 2992 vvvjd.exe 1060 lrlrffl.exe 1316 3tbttn.exe 3016 nbhhbb.exe 2200 jvpjj.exe 2320 pdppp.exe 1620 7rrlrlr.exe 2280 5xxfrrx.exe 2780 nhtnbb.exe 2136 btnbtb.exe -
resource yara_rule behavioral1/memory/388-0-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/files/0x000b00000001225f-5.dat upx behavioral1/memory/2624-12-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2516-29-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2736-33-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2736-40-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/files/0x0007000000019080-39.dat upx behavioral1/memory/2736-38-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/files/0x000700000001907c-31.dat upx behavioral1/memory/2516-24-0x00000000002A0000-0x00000000002DF000-memory.dmp upx behavioral1/files/0x0007000000018741-21.dat upx behavioral1/memory/2516-20-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2624-18-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/388-9-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/596-41-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2828-53-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/files/0x000600000001919c-51.dat upx behavioral1/memory/596-49-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2676-61-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/files/0x00060000000191ad-60.dat upx behavioral1/memory/2828-59-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2676-65-0x00000000005D0000-0x000000000060F000-memory.dmp upx behavioral1/files/0x000700000001938e-72.dat upx behavioral1/memory/2676-71-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2716-81-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/files/0x0005000000019cd5-80.dat upx behavioral1/memory/2888-79-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2716-85-0x0000000000220000-0x000000000025F000-memory.dmp upx behavioral1/files/0x0005000000019cfc-90.dat upx behavioral1/memory/2564-93-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2716-91-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2596-102-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2564-101-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/files/0x0005000000019d5c-100.dat upx behavioral1/memory/2596-106-0x0000000000440000-0x000000000047F000-memory.dmp upx behavioral1/files/0x0005000000019d69-111.dat upx behavioral1/memory/2596-113-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/992-112-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/992-117-0x0000000000220000-0x000000000025F000-memory.dmp upx behavioral1/memory/992-121-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/1072-124-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/992-123-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/files/0x0005000000019f57-122.dat upx behavioral1/memory/1072-132-0x0000000000220000-0x000000000025F000-memory.dmp upx behavioral1/memory/1072-134-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2840-135-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/files/0x0005000000019f71-133.dat upx behavioral1/memory/2604-146-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/files/0x000500000001a020-145.dat upx behavioral1/memory/2840-143-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2604-150-0x0000000000440000-0x000000000047F000-memory.dmp upx behavioral1/memory/2604-154-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/files/0x000500000001a033-157.dat upx behavioral1/memory/2604-156-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/1448-167-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/files/0x000500000001a05a-166.dat upx behavioral1/memory/1136-174-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/files/0x000500000001a2b9-179.dat upx behavioral1/memory/2720-180-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/1136-176-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/1136-175-0x0000000000220000-0x000000000025F000-memory.dmp upx behavioral1/files/0x000500000001a2fc-188.dat upx behavioral1/memory/2400-189-0x0000000000400000-0x000000000043F000-memory.dmp upx behavioral1/memory/2720-187-0x0000000000400000-0x000000000043F000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 388 wrote to memory of 2624 388 720abe70e3ec8ae83a769e5367c8aec23eb5cbfba58d67c450dc57e1b6b93eb1N.exe 31 PID 388 wrote to memory of 2624 388 720abe70e3ec8ae83a769e5367c8aec23eb5cbfba58d67c450dc57e1b6b93eb1N.exe 31 PID 388 wrote to memory of 2624 388 720abe70e3ec8ae83a769e5367c8aec23eb5cbfba58d67c450dc57e1b6b93eb1N.exe 31 PID 388 wrote to memory of 2624 388 720abe70e3ec8ae83a769e5367c8aec23eb5cbfba58d67c450dc57e1b6b93eb1N.exe 31 PID 2624 wrote to memory of 2516 2624 pjjvp.exe 32 PID 2624 wrote to memory of 2516 2624 pjjvp.exe 32 PID 2624 wrote to memory of 2516 2624 pjjvp.exe 32 PID 2624 wrote to memory of 2516 2624 pjjvp.exe 32 PID 2516 wrote to memory of 2736 2516 fxllxfl.exe 33 PID 2516 wrote to memory of 2736 2516 fxllxfl.exe 33 PID 2516 wrote to memory of 2736 2516 fxllxfl.exe 33 PID 2516 wrote to memory of 2736 2516 fxllxfl.exe 33 PID 2736 wrote to memory of 596 2736 7rllllx.exe 34 PID 2736 wrote to memory of 596 2736 7rllllx.exe 34 PID 2736 wrote to memory of 596 2736 7rllllx.exe 34 PID 2736 wrote to memory of 596 2736 7rllllx.exe 34 PID 596 wrote to memory of 2828 596 bbthbh.exe 35 PID 596 wrote to memory of 2828 596 bbthbh.exe 35 PID 596 wrote to memory of 2828 596 bbthbh.exe 35 PID 596 wrote to memory of 2828 596 bbthbh.exe 35 PID 2828 wrote to memory of 2676 2828 nbhhnn.exe 36 PID 2828 wrote to memory of 2676 2828 nbhhnn.exe 36 PID 2828 wrote to memory of 2676 2828 nbhhnn.exe 36 PID 2828 wrote to memory of 2676 2828 nbhhnn.exe 36 PID 2676 wrote to memory of 2888 2676 nnhtnt.exe 37 PID 2676 wrote to memory of 2888 2676 nnhtnt.exe 37 PID 2676 wrote to memory of 2888 2676 nnhtnt.exe 37 PID 2676 wrote to memory of 2888 2676 nnhtnt.exe 37 PID 2888 wrote to memory of 2716 2888 5nbnnh.exe 38 PID 2888 wrote to memory of 2716 2888 5nbnnh.exe 38 PID 2888 wrote to memory of 2716 2888 5nbnnh.exe 38 PID 2888 wrote to memory of 2716 2888 5nbnnh.exe 38 PID 2716 wrote to memory of 2564 2716 5vvjd.exe 39 PID 2716 wrote to memory of 2564 2716 5vvjd.exe 39 PID 2716 wrote to memory of 2564 2716 5vvjd.exe 39 PID 2716 wrote to memory of 2564 2716 5vvjd.exe 39 PID 2564 wrote to memory of 2596 2564 ffxlxfr.exe 40 PID 2564 wrote to memory of 2596 2564 ffxlxfr.exe 40 PID 2564 wrote to memory of 2596 2564 ffxlxfr.exe 40 PID 2564 wrote to memory of 2596 2564 ffxlxfr.exe 40 PID 2596 wrote to memory of 992 2596 1nhhtb.exe 41 PID 2596 wrote to memory of 992 2596 1nhhtb.exe 41 PID 2596 wrote to memory of 992 2596 1nhhtb.exe 41 PID 2596 wrote to memory of 992 2596 1nhhtb.exe 41 PID 992 wrote to memory of 1072 992 1dvvv.exe 42 PID 992 wrote to memory of 1072 992 1dvvv.exe 42 PID 992 wrote to memory of 1072 992 1dvvv.exe 42 PID 992 wrote to memory of 1072 992 1dvvv.exe 42 PID 1072 wrote to memory of 2840 1072 hbbttn.exe 43 PID 1072 wrote to memory of 2840 1072 hbbttn.exe 43 PID 1072 wrote to memory of 2840 1072 hbbttn.exe 43 PID 1072 wrote to memory of 2840 1072 hbbttn.exe 43 PID 2840 wrote to memory of 2604 2840 jjjpd.exe 44 PID 2840 wrote to memory of 2604 2840 jjjpd.exe 44 PID 2840 wrote to memory of 2604 2840 jjjpd.exe 44 PID 2840 wrote to memory of 2604 2840 jjjpd.exe 44 PID 2604 wrote to memory of 1448 2604 lfxflxx.exe 45 PID 2604 wrote to memory of 1448 2604 lfxflxx.exe 45 PID 2604 wrote to memory of 1448 2604 lfxflxx.exe 45 PID 2604 wrote to memory of 1448 2604 lfxflxx.exe 45 PID 1448 wrote to memory of 1136 1448 vpdvv.exe 46 PID 1448 wrote to memory of 1136 1448 vpdvv.exe 46 PID 1448 wrote to memory of 1136 1448 vpdvv.exe 46 PID 1448 wrote to memory of 1136 1448 vpdvv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\720abe70e3ec8ae83a769e5367c8aec23eb5cbfba58d67c450dc57e1b6b93eb1N.exe"C:\Users\Admin\AppData\Local\Temp\720abe70e3ec8ae83a769e5367c8aec23eb5cbfba58d67c450dc57e1b6b93eb1N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\pjjvp.exec:\pjjvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\fxllxfl.exec:\fxllxfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\7rllllx.exec:\7rllllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\bbthbh.exec:\bbthbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
\??\c:\nbhhnn.exec:\nbhhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\nnhtnt.exec:\nnhtnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\5nbnnh.exec:\5nbnnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\5vvjd.exec:\5vvjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\ffxlxfr.exec:\ffxlxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\1nhhtb.exec:\1nhhtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\1dvvv.exec:\1dvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\hbbttn.exec:\hbbttn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\jjjpd.exec:\jjjpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\lfxflxx.exec:\lfxflxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\vpdvv.exec:\vpdvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\pjppv.exec:\pjppv.exe17⤵
- Executes dropped EXE
PID:1136 -
\??\c:\bnhnhn.exec:\bnhnhn.exe18⤵
- Executes dropped EXE
PID:2720 -
\??\c:\nhhttb.exec:\nhhttb.exe19⤵
- Executes dropped EXE
PID:2400 -
\??\c:\xrlflxf.exec:\xrlflxf.exe20⤵
- Executes dropped EXE
PID:2088 -
\??\c:\bbthtb.exec:\bbthtb.exe21⤵
- Executes dropped EXE
PID:1144 -
\??\c:\nnhhnh.exec:\nnhhnh.exe22⤵
- Executes dropped EXE
PID:840 -
\??\c:\jdddj.exec:\jdddj.exe23⤵
- Executes dropped EXE
PID:1560 -
\??\c:\rxfffrr.exec:\rxfffrr.exe24⤵
- Executes dropped EXE
PID:892 -
\??\c:\1pdjp.exec:\1pdjp.exe25⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nbhbhb.exec:\nbhbhb.exe26⤵
- Executes dropped EXE
PID:624 -
\??\c:\3dpvd.exec:\3dpvd.exe27⤵
- Executes dropped EXE
PID:1012 -
\??\c:\frlrlfl.exec:\frlrlfl.exe28⤵
- Executes dropped EXE
PID:2472 -
\??\c:\bhnthb.exec:\bhnthb.exe29⤵
- Executes dropped EXE
PID:1724 -
\??\c:\7lxxfxf.exec:\7lxxfxf.exe30⤵
- Executes dropped EXE
PID:2440 -
\??\c:\1nbbbb.exec:\1nbbbb.exe31⤵
- Executes dropped EXE
PID:2488 -
\??\c:\dpvvv.exec:\dpvvv.exe32⤵
- Executes dropped EXE
PID:2796 -
\??\c:\7rfflff.exec:\7rfflff.exe33⤵
- Executes dropped EXE
PID:2812 -
\??\c:\nhbhnb.exec:\nhbhnb.exe34⤵
- Executes dropped EXE
PID:2156 -
\??\c:\5hbnbt.exec:\5hbnbt.exe35⤵
- Executes dropped EXE
PID:2660 -
\??\c:\frrlxrr.exec:\frrlxrr.exe36⤵
- Executes dropped EXE
PID:2888 -
\??\c:\bnbbbt.exec:\bnbbbt.exe37⤵
- Executes dropped EXE
PID:2544 -
\??\c:\vpddd.exec:\vpddd.exe38⤵
- Executes dropped EXE
PID:292 -
\??\c:\jjjdv.exec:\jjjdv.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3056 -
\??\c:\fxxxffl.exec:\fxxxffl.exe40⤵
- Executes dropped EXE
PID:1032 -
\??\c:\9xrxflr.exec:\9xrxflr.exe41⤵
- Executes dropped EXE
PID:2852 -
\??\c:\bnttnt.exec:\bnttnt.exe42⤵
- Executes dropped EXE
PID:2064 -
\??\c:\pdvpp.exec:\pdvpp.exe43⤵
- Executes dropped EXE
PID:2776 -
\??\c:\pjvjv.exec:\pjvjv.exe44⤵
- Executes dropped EXE
PID:2756 -
\??\c:\dpdjj.exec:\dpdjj.exe45⤵
- Executes dropped EXE
PID:2868 -
\??\c:\lxxxrxx.exec:\lxxxrxx.exe46⤵
- Executes dropped EXE
PID:1648 -
\??\c:\htnbnn.exec:\htnbnn.exe47⤵
- Executes dropped EXE
PID:1768 -
\??\c:\nbbhtt.exec:\nbbhtt.exe48⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vpdjv.exec:\vpdjv.exe49⤵
- Executes dropped EXE
PID:2424 -
\??\c:\vdpdv.exec:\vdpdv.exe50⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xlrxffx.exec:\xlrxffx.exe51⤵
- Executes dropped EXE
PID:1036 -
\??\c:\xlfxffl.exec:\xlfxffl.exe52⤵
- Executes dropped EXE
PID:3044 -
\??\c:\1tbthb.exec:\1tbthb.exe53⤵
- Executes dropped EXE
PID:1360 -
\??\c:\tnnnnh.exec:\tnnnnh.exe54⤵
- Executes dropped EXE
PID:840 -
\??\c:\7jppp.exec:\7jppp.exe55⤵
- Executes dropped EXE
PID:1572 -
\??\c:\vvvjd.exec:\vvvjd.exe56⤵
- Executes dropped EXE
PID:2992 -
\??\c:\lrlrffl.exec:\lrlrffl.exe57⤵
- Executes dropped EXE
PID:1060 -
\??\c:\3tbttn.exec:\3tbttn.exe58⤵
- Executes dropped EXE
PID:1316 -
\??\c:\nbhhbb.exec:\nbhhbb.exe59⤵
- Executes dropped EXE
PID:3016 -
\??\c:\jvpjj.exec:\jvpjj.exe60⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pdppp.exec:\pdppp.exe61⤵
- Executes dropped EXE
PID:2320 -
\??\c:\7rrlrlr.exec:\7rrlrlr.exe62⤵
- Executes dropped EXE
PID:1620 -
\??\c:\5xxfrrx.exec:\5xxfrrx.exe63⤵
- Executes dropped EXE
PID:2280 -
\??\c:\nhtnbb.exec:\nhtnbb.exe64⤵
- Executes dropped EXE
PID:2780 -
\??\c:\btnbtb.exec:\btnbtb.exe65⤵
- Executes dropped EXE
PID:2136 -
\??\c:\pddpp.exec:\pddpp.exe66⤵PID:2808
-
\??\c:\pdddp.exec:\pdddp.exe67⤵PID:596
-
\??\c:\fxlrxff.exec:\fxlrxff.exe68⤵PID:2752
-
\??\c:\nbnthh.exec:\nbnthh.exe69⤵PID:2676
-
\??\c:\bthhnb.exec:\bthhnb.exe70⤵PID:1668
-
\??\c:\jvjvd.exec:\jvjvd.exe71⤵PID:2560
-
\??\c:\pddpd.exec:\pddpd.exe72⤵PID:2576
-
\??\c:\lrrrxrr.exec:\lrrrxrr.exe73⤵PID:3064
-
\??\c:\rflrrrr.exec:\rflrrrr.exe74⤵PID:1780
-
\??\c:\nhnbnh.exec:\nhnbnh.exe75⤵PID:2644
-
\??\c:\nbbhtn.exec:\nbbhtn.exe76⤵PID:2852
-
\??\c:\jvjdd.exec:\jvjdd.exe77⤵PID:2368
-
\??\c:\ppjpj.exec:\ppjpj.exe78⤵PID:2776
-
\??\c:\rfrffxx.exec:\rfrffxx.exe79⤵PID:2840
-
\??\c:\5fxxfff.exec:\5fxxfff.exe80⤵
- System Location Discovery: System Language Discovery
PID:2912 -
\??\c:\5bbtbn.exec:\5bbtbn.exe81⤵PID:2020
-
\??\c:\7nhbhb.exec:\7nhbhb.exe82⤵PID:2920
-
\??\c:\1dpvv.exec:\1dpvv.exe83⤵PID:2720
-
\??\c:\frfrxfr.exec:\frfrxfr.exe84⤵PID:2640
-
\??\c:\1rffrrr.exec:\1rffrrr.exe85⤵PID:3040
-
\??\c:\5bttbh.exec:\5bttbh.exe86⤵PID:2088
-
\??\c:\thhbtn.exec:\thhbtn.exe87⤵PID:1088
-
\??\c:\1jpjd.exec:\1jpjd.exe88⤵PID:2180
-
\??\c:\dddvj.exec:\dddvj.exe89⤵PID:1860
-
\??\c:\lfxfrxf.exec:\lfxfrxf.exe90⤵PID:1864
-
\??\c:\1nhnht.exec:\1nhnht.exe91⤵PID:2212
-
\??\c:\hbntbb.exec:\hbntbb.exe92⤵PID:3024
-
\??\c:\ddvdp.exec:\ddvdp.exe93⤵PID:2060
-
\??\c:\jvjvj.exec:\jvjvj.exe94⤵PID:2188
-
\??\c:\xrflfxx.exec:\xrflfxx.exe95⤵PID:316
-
\??\c:\9xfxxrx.exec:\9xfxxrx.exe96⤵PID:2284
-
\??\c:\7htbhn.exec:\7htbhn.exe97⤵PID:784
-
\??\c:\dvjpd.exec:\dvjpd.exe98⤵PID:2900
-
\??\c:\1pvdj.exec:\1pvdj.exe99⤵PID:2144
-
\??\c:\xlfllxr.exec:\xlfllxr.exe100⤵PID:2252
-
\??\c:\3xrxffr.exec:\3xrxffr.exe101⤵PID:2648
-
\??\c:\hhthnb.exec:\hhthnb.exe102⤵PID:2668
-
\??\c:\9nnntn.exec:\9nnntn.exe103⤵PID:2844
-
\??\c:\vvdpv.exec:\vvdpv.exe104⤵PID:2572
-
\??\c:\vjppv.exec:\vjppv.exe105⤵PID:2744
-
\??\c:\frflllf.exec:\frflllf.exe106⤵PID:2564
-
\??\c:\3rfflrx.exec:\3rfflrx.exe107⤵PID:2712
-
\??\c:\hbhhnh.exec:\hbhhnh.exe108⤵PID:3048
-
\??\c:\9thnnh.exec:\9thnnh.exe109⤵PID:1708
-
\??\c:\pjvjv.exec:\pjvjv.exe110⤵PID:2848
-
\??\c:\jvjjj.exec:\jvjjj.exe111⤵PID:876
-
\??\c:\rlxfffl.exec:\rlxfffl.exe112⤵PID:2532
-
\??\c:\nnbhtb.exec:\nnbhtb.exe113⤵PID:2872
-
\??\c:\nhbhhb.exec:\nhbhhb.exe114⤵PID:2840
-
\??\c:\pjvjv.exec:\pjvjv.exe115⤵PID:1644
-
\??\c:\7vppp.exec:\7vppp.exe116⤵PID:2020
-
\??\c:\lllxrlx.exec:\lllxrlx.exe117⤵PID:2224
-
\??\c:\9bbbnb.exec:\9bbbnb.exe118⤵PID:2720
-
\??\c:\tnbbnt.exec:\tnbbnt.exe119⤵PID:2640
-
\??\c:\dvvjv.exec:\dvvjv.exe120⤵PID:1812
-
\??\c:\dvjpd.exec:\dvjpd.exe121⤵PID:1936
-
\??\c:\llxxllx.exec:\llxxllx.exe122⤵PID:1088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-