Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/10/2024, 13:26
Static task
static1
Behavioral task
behavioral1
Sample
7d00ffa54690f4174f1ebdb4fac792c4e32b3cfb1ab2ab0ddb01eb7e0d9bd36eN.exe
Resource
win7-20240903-en
General
-
Target
7d00ffa54690f4174f1ebdb4fac792c4e32b3cfb1ab2ab0ddb01eb7e0d9bd36eN.exe
-
Size
333KB
-
MD5
5e91f6bce69652115c4f7547d9437a60
-
SHA1
bedb645e6348ed24ac2bc99cf89a5c84014b7fe9
-
SHA256
7d00ffa54690f4174f1ebdb4fac792c4e32b3cfb1ab2ab0ddb01eb7e0d9bd36e
-
SHA512
2beedb7ebb7d6b6338a8fdae4aa32d28591b9b076045bc6121fdb5436457b4e92a6b58e67574f7457111103d509eacc2b73c2fdac3a988e24694d5b7f5b64c03
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhp:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTZ
Malware Config
Signatures
-
Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/2008-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-128-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2876-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-279-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1084-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-191-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3012-156-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1928-109-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2652-99-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2436-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-552-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2864-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-622-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1760-666-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3048-674-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3048-672-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/748-719-0x0000000001B50000-0x0000000001B7A000-memory.dmp family_blackmoon behavioral1/memory/748-718-0x0000000001B50000-0x0000000001B7A000-memory.dmp family_blackmoon behavioral1/memory/2168-745-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-767-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2212-765-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1004-820-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1004-818-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1148-833-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2340-877-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/748-988-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2772-1098-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2868-1178-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2940-1191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-1198-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/536-1337-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2488-1357-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1628 hbtbhh.exe 1664 vpdjj.exe 1148 xrxxlfr.exe 2248 thttbh.exe 2064 pdjjp.exe 2872 xlfxxxx.exe 2904 tnbthh.exe 2900 9dppj.exe 2804 3vppv.exe 2652 3xllrrx.exe 1928 btnntb.exe 2972 3vppp.exe 1760 jdvvv.exe 2876 thntbb.exe 1920 pdpjj.exe 3012 7xrxflr.exe 2704 nhhhtb.exe 2036 3djjv.exe 1368 5jpjp.exe 584 3rxxxrr.exe 1444 rlxllfl.exe 2088 tnhntt.exe 1124 1bnttb.exe 1084 7pdjp.exe 1968 3hbtbb.exe 2212 thnthh.exe 2288 ppdjv.exe 2400 jdvvj.exe 1836 rlfrflr.exe 1804 7btthh.exe 2296 9pddd.exe 1984 fxrllfl.exe 1544 5dvdj.exe 1148 vpvpd.exe 2508 lfxfrff.exe 1460 1ttbhn.exe 2928 thbhtt.exe 2792 pjvvv.exe 2872 7jddj.exe 2996 fxlxflr.exe 2900 rflrxxf.exe 2648 tnbhtb.exe 2700 3tttbb.exe 2652 jdpvd.exe 1224 pdvvd.exe 668 7fflxfl.exe 2940 9xxlrxf.exe 1404 htbbnh.exe 1568 bnnbbn.exe 2724 pjdjp.exe 1920 5jvvd.exe 2500 xrrlfrf.exe 1840 fxlrrrx.exe 1360 hbntht.exe 2020 1ntbtt.exe 1368 nbtbtb.exe 1188 jjddp.exe 1764 dvjjp.exe 2432 frlrlrr.exe 944 lfrxxrx.exe 1124 tttthh.exe 2024 nbhbhh.exe 2428 5vvpv.exe 2304 3pjdp.exe -
resource yara_rule behavioral1/memory/2008-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-200-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2436-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-672-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2236-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-745-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-759-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-812-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-818-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2848-864-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-877-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-1079-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-1191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-1371-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ttbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2008 wrote to memory of 1628 2008 7d00ffa54690f4174f1ebdb4fac792c4e32b3cfb1ab2ab0ddb01eb7e0d9bd36eN.exe 30 PID 2008 wrote to memory of 1628 2008 7d00ffa54690f4174f1ebdb4fac792c4e32b3cfb1ab2ab0ddb01eb7e0d9bd36eN.exe 30 PID 2008 wrote to memory of 1628 2008 7d00ffa54690f4174f1ebdb4fac792c4e32b3cfb1ab2ab0ddb01eb7e0d9bd36eN.exe 30 PID 2008 wrote to memory of 1628 2008 7d00ffa54690f4174f1ebdb4fac792c4e32b3cfb1ab2ab0ddb01eb7e0d9bd36eN.exe 30 PID 1628 wrote to memory of 1664 1628 hbtbhh.exe 31 PID 1628 wrote to memory of 1664 1628 hbtbhh.exe 31 PID 1628 wrote to memory of 1664 1628 hbtbhh.exe 31 PID 1628 wrote to memory of 1664 1628 hbtbhh.exe 31 PID 1664 wrote to memory of 1148 1664 vpdjj.exe 63 PID 1664 wrote to memory of 1148 1664 vpdjj.exe 63 PID 1664 wrote to memory of 1148 1664 vpdjj.exe 63 PID 1664 wrote to memory of 1148 1664 vpdjj.exe 63 PID 1148 wrote to memory of 2248 1148 xrxxlfr.exe 33 PID 1148 wrote to memory of 2248 1148 xrxxlfr.exe 33 PID 1148 wrote to memory of 2248 1148 xrxxlfr.exe 33 PID 1148 wrote to memory of 2248 1148 xrxxlfr.exe 33 PID 2248 wrote to memory of 2064 2248 thttbh.exe 34 PID 2248 wrote to memory of 2064 2248 thttbh.exe 34 PID 2248 wrote to memory of 2064 2248 thttbh.exe 34 PID 2248 wrote to memory of 2064 2248 thttbh.exe 34 PID 2064 wrote to memory of 2872 2064 pdjjp.exe 68 PID 2064 wrote to memory of 2872 2064 pdjjp.exe 68 PID 2064 wrote to memory of 2872 2064 pdjjp.exe 68 PID 2064 wrote to memory of 2872 2064 pdjjp.exe 68 PID 2872 wrote to memory of 2904 2872 xlfxxxx.exe 36 PID 2872 wrote to memory of 2904 2872 xlfxxxx.exe 36 PID 2872 wrote to memory of 2904 2872 xlfxxxx.exe 36 PID 2872 wrote to memory of 2904 2872 xlfxxxx.exe 36 PID 2904 wrote to memory of 2900 2904 tnbthh.exe 70 PID 2904 wrote to memory of 2900 2904 tnbthh.exe 70 PID 2904 wrote to memory of 2900 2904 tnbthh.exe 70 PID 2904 wrote to memory of 2900 2904 tnbthh.exe 70 PID 2900 wrote to memory of 2804 2900 9dppj.exe 38 PID 2900 wrote to memory of 2804 2900 9dppj.exe 38 PID 2900 wrote to memory of 2804 2900 9dppj.exe 38 PID 2900 wrote to memory of 2804 2900 9dppj.exe 38 PID 2804 wrote to memory of 2652 2804 3vppv.exe 39 PID 2804 wrote to memory of 2652 2804 3vppv.exe 39 PID 2804 wrote to memory of 2652 2804 3vppv.exe 39 PID 2804 wrote to memory of 2652 2804 3vppv.exe 39 PID 2652 wrote to memory of 1928 2652 3xllrrx.exe 40 PID 2652 wrote to memory of 1928 2652 3xllrrx.exe 40 PID 2652 wrote to memory of 1928 2652 3xllrrx.exe 40 PID 2652 wrote to memory of 1928 2652 3xllrrx.exe 40 PID 1928 wrote to memory of 2972 1928 btnntb.exe 41 PID 1928 wrote to memory of 2972 1928 btnntb.exe 41 PID 1928 wrote to memory of 2972 1928 btnntb.exe 41 PID 1928 wrote to memory of 2972 1928 btnntb.exe 41 PID 2972 wrote to memory of 1760 2972 3vppp.exe 42 PID 2972 wrote to memory of 1760 2972 3vppp.exe 42 PID 2972 wrote to memory of 1760 2972 3vppp.exe 42 PID 2972 wrote to memory of 1760 2972 3vppp.exe 42 PID 1760 wrote to memory of 2876 1760 jdvvv.exe 43 PID 1760 wrote to memory of 2876 1760 jdvvv.exe 43 PID 1760 wrote to memory of 2876 1760 jdvvv.exe 43 PID 1760 wrote to memory of 2876 1760 jdvvv.exe 43 PID 2876 wrote to memory of 1920 2876 thntbb.exe 44 PID 2876 wrote to memory of 1920 2876 thntbb.exe 44 PID 2876 wrote to memory of 1920 2876 thntbb.exe 44 PID 2876 wrote to memory of 1920 2876 thntbb.exe 44 PID 1920 wrote to memory of 3012 1920 pdpjj.exe 45 PID 1920 wrote to memory of 3012 1920 pdpjj.exe 45 PID 1920 wrote to memory of 3012 1920 pdpjj.exe 45 PID 1920 wrote to memory of 3012 1920 pdpjj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d00ffa54690f4174f1ebdb4fac792c4e32b3cfb1ab2ab0ddb01eb7e0d9bd36eN.exe"C:\Users\Admin\AppData\Local\Temp\7d00ffa54690f4174f1ebdb4fac792c4e32b3cfb1ab2ab0ddb01eb7e0d9bd36eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\hbtbhh.exec:\hbtbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\vpdjj.exec:\vpdjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\xrxxlfr.exec:\xrxxlfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\thttbh.exec:\thttbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\pdjjp.exec:\pdjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\xlfxxxx.exec:\xlfxxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\tnbthh.exec:\tnbthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\9dppj.exec:\9dppj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\3vppv.exec:\3vppv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\3xllrrx.exec:\3xllrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\btnntb.exec:\btnntb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\3vppp.exec:\3vppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\jdvvv.exec:\jdvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\thntbb.exec:\thntbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\pdpjj.exec:\pdpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\7xrxflr.exec:\7xrxflr.exe17⤵
- Executes dropped EXE
PID:3012 -
\??\c:\nhhhtb.exec:\nhhhtb.exe18⤵
- Executes dropped EXE
PID:2704 -
\??\c:\3djjv.exec:\3djjv.exe19⤵
- Executes dropped EXE
PID:2036 -
\??\c:\5jpjp.exec:\5jpjp.exe20⤵
- Executes dropped EXE
PID:1368 -
\??\c:\3rxxxrr.exec:\3rxxxrr.exe21⤵
- Executes dropped EXE
PID:584 -
\??\c:\rlxllfl.exec:\rlxllfl.exe22⤵
- Executes dropped EXE
PID:1444 -
\??\c:\tnhntt.exec:\tnhntt.exe23⤵
- Executes dropped EXE
PID:2088 -
\??\c:\1bnttb.exec:\1bnttb.exe24⤵
- Executes dropped EXE
PID:1124 -
\??\c:\7pdjp.exec:\7pdjp.exe25⤵
- Executes dropped EXE
PID:1084 -
\??\c:\3hbtbb.exec:\3hbtbb.exe26⤵
- Executes dropped EXE
PID:1968 -
\??\c:\thnthh.exec:\thnthh.exe27⤵
- Executes dropped EXE
PID:2212 -
\??\c:\ppdjv.exec:\ppdjv.exe28⤵
- Executes dropped EXE
PID:2288 -
\??\c:\jdvvj.exec:\jdvvj.exe29⤵
- Executes dropped EXE
PID:2400 -
\??\c:\rlfrflr.exec:\rlfrflr.exe30⤵
- Executes dropped EXE
PID:1836 -
\??\c:\7btthh.exec:\7btthh.exe31⤵
- Executes dropped EXE
PID:1804 -
\??\c:\9pddd.exec:\9pddd.exe32⤵
- Executes dropped EXE
PID:2296 -
\??\c:\fxrllfl.exec:\fxrllfl.exe33⤵
- Executes dropped EXE
PID:1984 -
\??\c:\5dvdj.exec:\5dvdj.exe34⤵
- Executes dropped EXE
PID:1544 -
\??\c:\vpvpd.exec:\vpvpd.exe35⤵
- Executes dropped EXE
PID:1148 -
\??\c:\lfxfrff.exec:\lfxfrff.exe36⤵
- Executes dropped EXE
PID:2508 -
\??\c:\1ttbhn.exec:\1ttbhn.exe37⤵
- Executes dropped EXE
PID:1460 -
\??\c:\thbhtt.exec:\thbhtt.exe38⤵
- Executes dropped EXE
PID:2928 -
\??\c:\pjvvv.exec:\pjvvv.exe39⤵
- Executes dropped EXE
PID:2792 -
\??\c:\7jddj.exec:\7jddj.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\fxlxflr.exec:\fxlxflr.exe41⤵
- Executes dropped EXE
PID:2996 -
\??\c:\rflrxxf.exec:\rflrxxf.exe42⤵
- Executes dropped EXE
PID:2900 -
\??\c:\tnbhtb.exec:\tnbhtb.exe43⤵
- Executes dropped EXE
PID:2648 -
\??\c:\3tttbb.exec:\3tttbb.exe44⤵
- Executes dropped EXE
PID:2700 -
\??\c:\jdpvd.exec:\jdpvd.exe45⤵
- Executes dropped EXE
PID:2652 -
\??\c:\pdvvd.exec:\pdvvd.exe46⤵
- Executes dropped EXE
PID:1224 -
\??\c:\7fflxfl.exec:\7fflxfl.exe47⤵
- Executes dropped EXE
PID:668 -
\??\c:\9xxlrxf.exec:\9xxlrxf.exe48⤵
- Executes dropped EXE
PID:2940 -
\??\c:\htbbnh.exec:\htbbnh.exe49⤵
- Executes dropped EXE
PID:1404 -
\??\c:\bnnbbn.exec:\bnnbbn.exe50⤵
- Executes dropped EXE
PID:1568 -
\??\c:\pjdjp.exec:\pjdjp.exe51⤵
- Executes dropped EXE
PID:2724 -
\??\c:\5jvvd.exec:\5jvvd.exe52⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xrrlfrf.exec:\xrrlfrf.exe53⤵
- Executes dropped EXE
PID:2500 -
\??\c:\fxlrrrx.exec:\fxlrrrx.exe54⤵
- Executes dropped EXE
PID:1840 -
\??\c:\hbntht.exec:\hbntht.exe55⤵
- Executes dropped EXE
PID:1360 -
\??\c:\1ntbtt.exec:\1ntbtt.exe56⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nbtbtb.exec:\nbtbtb.exe57⤵
- Executes dropped EXE
PID:1368 -
\??\c:\jjddp.exec:\jjddp.exe58⤵
- Executes dropped EXE
PID:1188 -
\??\c:\dvjjp.exec:\dvjjp.exe59⤵
- Executes dropped EXE
PID:1764 -
\??\c:\frlrlrr.exec:\frlrlrr.exe60⤵
- Executes dropped EXE
PID:2432 -
\??\c:\lfrxxrx.exec:\lfrxxrx.exe61⤵
- Executes dropped EXE
PID:944 -
\??\c:\tttthh.exec:\tttthh.exe62⤵
- Executes dropped EXE
PID:1124 -
\??\c:\nbhbhh.exec:\nbhbhh.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2024 -
\??\c:\5vvpv.exec:\5vvpv.exe64⤵
- Executes dropped EXE
PID:2428 -
\??\c:\3pjdp.exec:\3pjdp.exe65⤵
- Executes dropped EXE
PID:2304 -
\??\c:\frfflfx.exec:\frfflfx.exe66⤵PID:2376
-
\??\c:\rfrxxrx.exec:\rfrxxrx.exe67⤵PID:2288
-
\??\c:\lfrxlfr.exec:\lfrxlfr.exe68⤵PID:844
-
\??\c:\hbntbh.exec:\hbntbh.exe69⤵PID:896
-
\??\c:\7pppv.exec:\7pppv.exe70⤵PID:1976
-
\??\c:\dpjpv.exec:\dpjpv.exe71⤵PID:2380
-
\??\c:\pjjjv.exec:\pjjjv.exe72⤵PID:2436
-
\??\c:\bthhnn.exec:\bthhnn.exe73⤵PID:1004
-
\??\c:\jdppp.exec:\jdppp.exe74⤵PID:2720
-
\??\c:\9rrrllr.exec:\9rrrllr.exe75⤵PID:1544
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe76⤵PID:1144
-
\??\c:\9hhthn.exec:\9hhthn.exe77⤵PID:2552
-
\??\c:\nhtttt.exec:\nhtttt.exe78⤵PID:2372
-
\??\c:\vpvvv.exec:\vpvvv.exe79⤵PID:2864
-
\??\c:\3xxxlrx.exec:\3xxxlrx.exe80⤵PID:2820
-
\??\c:\1nbbbt.exec:\1nbbbt.exe81⤵PID:2920
-
\??\c:\tnnnbb.exec:\tnnnbb.exe82⤵PID:2904
-
\??\c:\9frlrrx.exec:\9frlrrx.exe83⤵PID:2692
-
\??\c:\1rflxfr.exec:\1rflxfr.exe84⤵PID:2796
-
\??\c:\jdpvv.exec:\jdpvv.exe85⤵PID:2536
-
\??\c:\pdjpd.exec:\pdjpd.exe86⤵PID:2644
-
\??\c:\nnnnhn.exec:\nnnnhn.exe87⤵PID:2652
-
\??\c:\5btbbb.exec:\5btbbb.exe88⤵PID:1908
-
\??\c:\jdpvd.exec:\jdpvd.exe89⤵PID:1560
-
\??\c:\3lxxxfl.exec:\3lxxxfl.exe90⤵PID:2852
-
\??\c:\xlxrxxf.exec:\xlxrxxf.exe91⤵PID:1760
-
\??\c:\bthhnn.exec:\bthhnn.exe92⤵PID:3048
-
\??\c:\ppjpv.exec:\ppjpv.exe93⤵PID:2724
-
\??\c:\1pvvd.exec:\1pvvd.exe94⤵PID:1920
-
\??\c:\3llrfff.exec:\3llrfff.exe95⤵PID:2500
-
\??\c:\hhbnbt.exec:\hhbnbt.exe96⤵PID:2948
-
\??\c:\bbttbb.exec:\bbttbb.exe97⤵
- System Location Discovery: System Language Discovery
PID:1668 -
\??\c:\1dvdv.exec:\1dvdv.exe98⤵PID:484
-
\??\c:\xxxlxlx.exec:\xxxlxlx.exe99⤵PID:748
-
\??\c:\3xrxxxf.exec:\3xrxxxf.exe100⤵PID:1444
-
\??\c:\nnhnnh.exec:\nnhnnh.exe101⤵PID:1576
-
\??\c:\jdvdd.exec:\jdvdd.exe102⤵PID:2236
-
\??\c:\pjdjv.exec:\pjdjv.exe103⤵PID:2168
-
\??\c:\9xrlrrr.exec:\9xrlrrr.exe104⤵PID:348
-
\??\c:\9tbhnt.exec:\9tbhnt.exe105⤵PID:1192
-
\??\c:\5pvvp.exec:\5pvvp.exe106⤵PID:2212
-
\??\c:\rlfflrl.exec:\rlfflrl.exe107⤵PID:1448
-
\??\c:\xrrfrxx.exec:\xrrfrxx.exe108⤵PID:632
-
\??\c:\bnbbnn.exec:\bnbbnn.exe109⤵PID:448
-
\??\c:\ttthnn.exec:\ttthnn.exe110⤵PID:2600
-
\??\c:\5dvdj.exec:\5dvdj.exe111⤵PID:1800
-
\??\c:\5rxrxxx.exec:\5rxrxxx.exe112⤵PID:536
-
\??\c:\nhbhbn.exec:\nhbhbn.exe113⤵PID:1572
-
\??\c:\vjvdd.exec:\vjvdd.exe114⤵PID:1004
-
\??\c:\3vppv.exec:\3vppv.exe115⤵PID:1536
-
\??\c:\fxrxxrx.exec:\fxrxxrx.exe116⤵PID:1148
-
\??\c:\3tthnn.exec:\3tthnn.exe117⤵PID:2508
-
\??\c:\htntbh.exec:\htntbh.exe118⤵PID:2512
-
\??\c:\vjddd.exec:\vjddd.exe119⤵PID:2440
-
\??\c:\ffrrffr.exec:\ffrrffr.exe120⤵PID:2928
-
\??\c:\hhnnbn.exec:\hhnnbn.exe121⤵PID:1628
-
\??\c:\7pvdp.exec:\7pvdp.exe122⤵PID:2848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-