Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 08:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a031bda797585007dca504eb84a7ebb1584c3feab508e2738a38a6ca101de08aN.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
a031bda797585007dca504eb84a7ebb1584c3feab508e2738a38a6ca101de08aN.exe
-
Size
452KB
-
MD5
895f492a7be5d60b7fa587754c729230
-
SHA1
b952b9ad67b6f9cf78d7337d5b7c536a1489c2d2
-
SHA256
a031bda797585007dca504eb84a7ebb1584c3feab508e2738a38a6ca101de08a
-
SHA512
8f61473e083d1f206c71e85eb87ed962be0458de73acfd637a5e8108c280d132daf8b71fd22da59443c16b10c16c20ec14f88d97c4970edef0f61d696338526c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeA:q7Tc2NYHUrAwfMp3CDA
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2120-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1360-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-249-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1268-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-269-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1344-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-278-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1760-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-467-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2460-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-639-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2044-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-827-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-860-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-886-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2772-893-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-918-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2700-988-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2656 dpvvv.exe 2708 llxlrll.exe 2916 rfrxxrr.exe 2696 nbnhnn.exe 2680 7jpvp.exe 2536 5tbntb.exe 2736 5vvpp.exe 2328 frrrrrr.exe 2008 pdjdd.exe 2116 xrfrrlf.exe 1360 tnbntb.exe 1220 dvddj.exe 1780 nhnhnt.exe 2256 ppvvj.exe 1092 frrlfxf.exe 2812 thtntt.exe 1648 pjddd.exe 2380 xrxrfrx.exe 2152 jjppp.exe 2188 vjpdd.exe 1984 hbhtbb.exe 1316 5djjp.exe 1196 nhnbhh.exe 2948 vjvpv.exe 1528 xrxrrrr.exe 1560 nhnhhb.exe 1268 jvjpv.exe 2444 rlrxffr.exe 1344 bthnhb.exe 2428 1rxrllx.exe 1760 httbtn.exe 1996 xrxfffl.exe 2452 hhhnnh.exe 1584 djdvd.exe 2744 5ffrlfx.exe 2756 lrxxxxl.exe 2552 hbntbb.exe 2884 dvjpp.exe 2748 1rxrrrl.exe 2732 tnnnnt.exe 2680 5bbbtt.exe 3044 vjppj.exe 2440 xrxxxfr.exe 1620 btbnbb.exe 1816 pdpjp.exe 2112 xrrrlff.exe 2136 frxxfxx.exe 2040 thtntb.exe 1748 vjvvd.exe 316 pjvdj.exe 1624 rlxxfrx.exe 576 1ntbnh.exe 1936 vjjdv.exe 2760 3djjj.exe 532 3lffflr.exe 3064 nbntbt.exe 2348 vjvdd.exe 2344 pdjpp.exe 2356 rllllrx.exe 2080 htbbbb.exe 608 jdpjv.exe 1872 xlrrrrx.exe 888 9lxrrlr.exe 2404 bhhtnn.exe -
resource yara_rule behavioral1/memory/2120-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-467-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/608-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-767-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-807-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-827-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-855-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-861-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-893-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-900-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-988-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxlrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2656 2120 a031bda797585007dca504eb84a7ebb1584c3feab508e2738a38a6ca101de08aN.exe 30 PID 2120 wrote to memory of 2656 2120 a031bda797585007dca504eb84a7ebb1584c3feab508e2738a38a6ca101de08aN.exe 30 PID 2120 wrote to memory of 2656 2120 a031bda797585007dca504eb84a7ebb1584c3feab508e2738a38a6ca101de08aN.exe 30 PID 2120 wrote to memory of 2656 2120 a031bda797585007dca504eb84a7ebb1584c3feab508e2738a38a6ca101de08aN.exe 30 PID 2656 wrote to memory of 2708 2656 dpvvv.exe 31 PID 2656 wrote to memory of 2708 2656 dpvvv.exe 31 PID 2656 wrote to memory of 2708 2656 dpvvv.exe 31 PID 2656 wrote to memory of 2708 2656 dpvvv.exe 31 PID 2708 wrote to memory of 2916 2708 llxlrll.exe 32 PID 2708 wrote to memory of 2916 2708 llxlrll.exe 32 PID 2708 wrote to memory of 2916 2708 llxlrll.exe 32 PID 2708 wrote to memory of 2916 2708 llxlrll.exe 32 PID 2916 wrote to memory of 2696 2916 rfrxxrr.exe 33 PID 2916 wrote to memory of 2696 2916 rfrxxrr.exe 33 PID 2916 wrote to memory of 2696 2916 rfrxxrr.exe 33 PID 2916 wrote to memory of 2696 2916 rfrxxrr.exe 33 PID 2696 wrote to memory of 2680 2696 nbnhnn.exe 34 PID 2696 wrote to memory of 2680 2696 nbnhnn.exe 34 PID 2696 wrote to memory of 2680 2696 nbnhnn.exe 34 PID 2696 wrote to memory of 2680 2696 nbnhnn.exe 34 PID 2680 wrote to memory of 2536 2680 7jpvp.exe 35 PID 2680 wrote to memory of 2536 2680 7jpvp.exe 35 PID 2680 wrote to memory of 2536 2680 7jpvp.exe 35 PID 2680 wrote to memory of 2536 2680 7jpvp.exe 35 PID 2536 wrote to memory of 2736 2536 5tbntb.exe 36 PID 2536 wrote to memory of 2736 2536 5tbntb.exe 36 PID 2536 wrote to memory of 2736 2536 5tbntb.exe 36 PID 2536 wrote to memory of 2736 2536 5tbntb.exe 36 PID 2736 wrote to memory of 2328 2736 5vvpp.exe 37 PID 2736 wrote to memory of 2328 2736 5vvpp.exe 37 PID 2736 wrote to memory of 2328 2736 5vvpp.exe 37 PID 2736 wrote to memory of 2328 2736 5vvpp.exe 37 PID 2328 wrote to memory of 2008 2328 frrrrrr.exe 38 PID 2328 wrote to memory of 2008 2328 frrrrrr.exe 38 PID 2328 wrote to memory of 2008 2328 frrrrrr.exe 38 PID 2328 wrote to memory of 2008 2328 frrrrrr.exe 38 PID 2008 wrote to memory of 2116 2008 pdjdd.exe 39 PID 2008 wrote to memory of 2116 2008 pdjdd.exe 39 PID 2008 wrote to memory of 2116 2008 pdjdd.exe 39 PID 2008 wrote to memory of 2116 2008 pdjdd.exe 39 PID 2116 wrote to memory of 1360 2116 xrfrrlf.exe 40 PID 2116 wrote to memory of 1360 2116 xrfrrlf.exe 40 PID 2116 wrote to memory of 1360 2116 xrfrrlf.exe 40 PID 2116 wrote to memory of 1360 2116 xrfrrlf.exe 40 PID 1360 wrote to memory of 1220 1360 tnbntb.exe 41 PID 1360 wrote to memory of 1220 1360 tnbntb.exe 41 PID 1360 wrote to memory of 1220 1360 tnbntb.exe 41 PID 1360 wrote to memory of 1220 1360 tnbntb.exe 41 PID 1220 wrote to memory of 1780 1220 dvddj.exe 42 PID 1220 wrote to memory of 1780 1220 dvddj.exe 42 PID 1220 wrote to memory of 1780 1220 dvddj.exe 42 PID 1220 wrote to memory of 1780 1220 dvddj.exe 42 PID 1780 wrote to memory of 2256 1780 nhnhnt.exe 43 PID 1780 wrote to memory of 2256 1780 nhnhnt.exe 43 PID 1780 wrote to memory of 2256 1780 nhnhnt.exe 43 PID 1780 wrote to memory of 2256 1780 nhnhnt.exe 43 PID 2256 wrote to memory of 1092 2256 ppvvj.exe 44 PID 2256 wrote to memory of 1092 2256 ppvvj.exe 44 PID 2256 wrote to memory of 1092 2256 ppvvj.exe 44 PID 2256 wrote to memory of 1092 2256 ppvvj.exe 44 PID 1092 wrote to memory of 2812 1092 frrlfxf.exe 45 PID 1092 wrote to memory of 2812 1092 frrlfxf.exe 45 PID 1092 wrote to memory of 2812 1092 frrlfxf.exe 45 PID 1092 wrote to memory of 2812 1092 frrlfxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a031bda797585007dca504eb84a7ebb1584c3feab508e2738a38a6ca101de08aN.exe"C:\Users\Admin\AppData\Local\Temp\a031bda797585007dca504eb84a7ebb1584c3feab508e2738a38a6ca101de08aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\dpvvv.exec:\dpvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\llxlrll.exec:\llxlrll.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\rfrxxrr.exec:\rfrxxrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\nbnhnn.exec:\nbnhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\7jpvp.exec:\7jpvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\5tbntb.exec:\5tbntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\5vvpp.exec:\5vvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\frrrrrr.exec:\frrrrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\pdjdd.exec:\pdjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\xrfrrlf.exec:\xrfrrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\tnbntb.exec:\tnbntb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\dvddj.exec:\dvddj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\nhnhnt.exec:\nhnhnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\ppvvj.exec:\ppvvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\frrlfxf.exec:\frrlfxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\thtntt.exec:\thtntt.exe17⤵
- Executes dropped EXE
PID:2812 -
\??\c:\pjddd.exec:\pjddd.exe18⤵
- Executes dropped EXE
PID:1648 -
\??\c:\xrxrfrx.exec:\xrxrfrx.exe19⤵
- Executes dropped EXE
PID:2380 -
\??\c:\jjppp.exec:\jjppp.exe20⤵
- Executes dropped EXE
PID:2152 -
\??\c:\vjpdd.exec:\vjpdd.exe21⤵
- Executes dropped EXE
PID:2188 -
\??\c:\hbhtbb.exec:\hbhtbb.exe22⤵
- Executes dropped EXE
PID:1984 -
\??\c:\5djjp.exec:\5djjp.exe23⤵
- Executes dropped EXE
PID:1316 -
\??\c:\nhnbhh.exec:\nhnbhh.exe24⤵
- Executes dropped EXE
PID:1196 -
\??\c:\vjvpv.exec:\vjvpv.exe25⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe26⤵
- Executes dropped EXE
PID:1528 -
\??\c:\nhnhhb.exec:\nhnhhb.exe27⤵
- Executes dropped EXE
PID:1560 -
\??\c:\jvjpv.exec:\jvjpv.exe28⤵
- Executes dropped EXE
PID:1268 -
\??\c:\rlrxffr.exec:\rlrxffr.exe29⤵
- Executes dropped EXE
PID:2444 -
\??\c:\bthnhb.exec:\bthnhb.exe30⤵
- Executes dropped EXE
PID:1344 -
\??\c:\1rxrllx.exec:\1rxrllx.exe31⤵
- Executes dropped EXE
PID:2428 -
\??\c:\httbtn.exec:\httbtn.exe32⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xrxfffl.exec:\xrxfffl.exe33⤵
- Executes dropped EXE
PID:1996 -
\??\c:\hhhnnh.exec:\hhhnnh.exe34⤵
- Executes dropped EXE
PID:2452 -
\??\c:\djdvd.exec:\djdvd.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\5ffrlfx.exec:\5ffrlfx.exe36⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lrxxxxl.exec:\lrxxxxl.exe37⤵
- Executes dropped EXE
PID:2756 -
\??\c:\hbntbb.exec:\hbntbb.exe38⤵
- Executes dropped EXE
PID:2552 -
\??\c:\dvjpp.exec:\dvjpp.exe39⤵
- Executes dropped EXE
PID:2884 -
\??\c:\1rxrrrl.exec:\1rxrrrl.exe40⤵
- Executes dropped EXE
PID:2748 -
\??\c:\tnnnnt.exec:\tnnnnt.exe41⤵
- Executes dropped EXE
PID:2732 -
\??\c:\5bbbtt.exec:\5bbbtt.exe42⤵
- Executes dropped EXE
PID:2680 -
\??\c:\vjppj.exec:\vjppj.exe43⤵
- Executes dropped EXE
PID:3044 -
\??\c:\xrxxxfr.exec:\xrxxxfr.exe44⤵
- Executes dropped EXE
PID:2440 -
\??\c:\btbnbb.exec:\btbnbb.exe45⤵
- Executes dropped EXE
PID:1620 -
\??\c:\pdpjp.exec:\pdpjp.exe46⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xrrrlff.exec:\xrrrlff.exe47⤵
- Executes dropped EXE
PID:2112 -
\??\c:\frxxfxx.exec:\frxxfxx.exe48⤵
- Executes dropped EXE
PID:2136 -
\??\c:\thtntb.exec:\thtntb.exe49⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vjvvd.exec:\vjvvd.exe50⤵
- Executes dropped EXE
PID:1748 -
\??\c:\pjvdj.exec:\pjvdj.exe51⤵
- Executes dropped EXE
PID:316 -
\??\c:\rlxxfrx.exec:\rlxxfrx.exe52⤵
- Executes dropped EXE
PID:1624 -
\??\c:\1ntbnh.exec:\1ntbnh.exe53⤵
- Executes dropped EXE
PID:576 -
\??\c:\vjjdv.exec:\vjjdv.exe54⤵
- Executes dropped EXE
PID:1936 -
\??\c:\3djjj.exec:\3djjj.exe55⤵
- Executes dropped EXE
PID:2760 -
\??\c:\3lffflr.exec:\3lffflr.exe56⤵
- Executes dropped EXE
PID:532 -
\??\c:\nbntbt.exec:\nbntbt.exe57⤵
- Executes dropped EXE
PID:3064 -
\??\c:\vjvdd.exec:\vjvdd.exe58⤵
- Executes dropped EXE
PID:2348 -
\??\c:\pdjpp.exec:\pdjpp.exe59⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rllllrx.exec:\rllllrx.exe60⤵
- Executes dropped EXE
PID:2356 -
\??\c:\htbbbb.exec:\htbbbb.exe61⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jdpjv.exec:\jdpjv.exe62⤵
- Executes dropped EXE
PID:608 -
\??\c:\xlrrrrx.exec:\xlrrrrx.exe63⤵
- Executes dropped EXE
PID:1872 -
\??\c:\9lxrrlr.exec:\9lxrrlr.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:888 -
\??\c:\bhhtnn.exec:\bhhtnn.exe65⤵
- Executes dropped EXE
PID:2404 -
\??\c:\vpjpv.exec:\vpjpv.exe66⤵
- System Location Discovery: System Language Discovery
PID:1844 -
\??\c:\jvvvv.exec:\jvvvv.exe67⤵PID:1524
-
\??\c:\xxfxfff.exec:\xxfxfff.exe68⤵PID:1792
-
\??\c:\1nnbtn.exec:\1nnbtn.exe69⤵PID:1744
-
\??\c:\3dppv.exec:\3dppv.exe70⤵PID:1040
-
\??\c:\5xlflff.exec:\5xlflff.exe71⤵PID:2464
-
\??\c:\fxflrrx.exec:\fxflrrx.exe72⤵PID:1308
-
\??\c:\7thbbb.exec:\7thbbb.exe73⤵PID:1344
-
\??\c:\pjppv.exec:\pjppv.exe74⤵PID:2108
-
\??\c:\pjppv.exec:\pjppv.exe75⤵PID:1764
-
\??\c:\xffxxrr.exec:\xffxxrr.exe76⤵PID:1968
-
\??\c:\xrfflxf.exec:\xrfflxf.exe77⤵PID:2460
-
\??\c:\nntthb.exec:\nntthb.exe78⤵PID:1688
-
\??\c:\jvjvv.exec:\jvjvv.exe79⤵PID:2740
-
\??\c:\xlfxfxf.exec:\xlfxfxf.exe80⤵PID:1960
-
\??\c:\1rrrllf.exec:\1rrrllf.exe81⤵PID:2052
-
\??\c:\7nbbtn.exec:\7nbbtn.exe82⤵PID:2756
-
\??\c:\1jpjv.exec:\1jpjv.exe83⤵PID:2916
-
\??\c:\7jpjd.exec:\7jpjd.exe84⤵PID:2884
-
\??\c:\1xfxrrl.exec:\1xfxrrl.exe85⤵PID:2516
-
\??\c:\1tbbhh.exec:\1tbbhh.exe86⤵PID:2588
-
\??\c:\hhbnbb.exec:\hhbnbb.exe87⤵PID:2536
-
\??\c:\pvddv.exec:\pvddv.exe88⤵PID:2736
-
\??\c:\xrflrrf.exec:\xrflrrf.exe89⤵PID:2044
-
\??\c:\7frxxxx.exec:\7frxxxx.exe90⤵PID:2084
-
\??\c:\hbnnhn.exec:\hbnnhn.exe91⤵PID:276
-
\??\c:\pdppv.exec:\pdppv.exe92⤵PID:1596
-
\??\c:\7dvvv.exec:\7dvvv.exe93⤵PID:1604
-
\??\c:\lxrxllx.exec:\lxrxllx.exe94⤵PID:1504
-
\??\c:\btnnbb.exec:\btnnbb.exe95⤵PID:1724
-
\??\c:\btbtbt.exec:\btbtbt.exe96⤵PID:1624
-
\??\c:\vjvvd.exec:\vjvvd.exe97⤵PID:2000
-
\??\c:\3lrflxr.exec:\3lrflxr.exe98⤵PID:1936
-
\??\c:\7lfffff.exec:\7lfffff.exe99⤵PID:2760
-
\??\c:\tntttn.exec:\tntttn.exe100⤵PID:1600
-
\??\c:\pjvjp.exec:\pjvjp.exe101⤵PID:2092
-
\??\c:\5djjj.exec:\5djjj.exe102⤵PID:1864
-
\??\c:\3lfflrf.exec:\3lfflrf.exe103⤵PID:2192
-
\??\c:\xxrlfff.exec:\xxrlfff.exe104⤵PID:2356
-
\??\c:\7thhhh.exec:\7thhhh.exe105⤵PID:952
-
\??\c:\vpdjp.exec:\vpdjp.exe106⤵PID:608
-
\??\c:\vpdjj.exec:\vpdjj.exe107⤵PID:1872
-
\??\c:\fxllrrx.exec:\fxllrrx.exe108⤵PID:1312
-
\??\c:\btttbt.exec:\btttbt.exe109⤵PID:2948
-
\??\c:\bnbthb.exec:\bnbthb.exe110⤵PID:1528
-
\??\c:\7dppj.exec:\7dppj.exe111⤵PID:1036
-
\??\c:\rfrxffr.exec:\rfrxffr.exe112⤵PID:1424
-
\??\c:\3xfxfll.exec:\3xfxfll.exe113⤵PID:2276
-
\??\c:\nbnnnn.exec:\nbnnnn.exe114⤵PID:2260
-
\??\c:\9jdjv.exec:\9jdjv.exe115⤵PID:2956
-
\??\c:\fxlrflx.exec:\fxlrflx.exe116⤵PID:1476
-
\??\c:\rxxflrx.exec:\rxxflrx.exe117⤵PID:1948
-
\??\c:\7thhnn.exec:\7thhnn.exe118⤵PID:1552
-
\??\c:\dpdvv.exec:\dpdvv.exe119⤵PID:2652
-
\??\c:\9jvvd.exec:\9jvvd.exe120⤵PID:2460
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe121⤵PID:2640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-