Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 13:51
Behavioral task
behavioral1
Sample
e6c6f9a029b8860176db9731b177a7c6eaa1a1c32665dc77098a64ceef9f5c97N.exe
Resource
win7-20240903-en
General
-
Target
e6c6f9a029b8860176db9731b177a7c6eaa1a1c32665dc77098a64ceef9f5c97N.exe
-
Size
331KB
-
MD5
3e8cd6771fcc45660c67d16bf81ddb80
-
SHA1
94a61af86e74411a44a18858419947d05f21fd38
-
SHA256
e6c6f9a029b8860176db9731b177a7c6eaa1a1c32665dc77098a64ceef9f5c97
-
SHA512
240c0ba376755867eb54de0ad0770e960941d4624262c8f141c035fad09eed61c2cb73c5a425d8113c70be9d5cb23fa669992d4195fb47db94a5c6d51aa5b7c3
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeC:R4wFHoSHYHUrAwfMp3CDC
Malware Config
Signatures
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/2328-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2240-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1472-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1492-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1564-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1652-106-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1652-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1360-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1780-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2176-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2160-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1028-188-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1028-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1860-204-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1704-212-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2388-234-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2388-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-240-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/1976-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-279-0x0000000076DA0000-0x0000000076EBF000-memory.dmp family_blackmoon behavioral1/memory/2056-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-293-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2188-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-299-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2088-312-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2700-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-358-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1768-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1476-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/548-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/884-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/448-452-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2304-498-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2468-516-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-551-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2832-598-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2608-615-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1336-628-0x0000000001B60000-0x0000000001B87000-memory.dmp family_blackmoon behavioral1/memory/1840-639-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2044-700-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2148-712-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1564-889-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1676-923-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2056-12407-0x0000000076DA0000-0x0000000076EBF000-memory.dmp family_blackmoon behavioral1/memory/2056-19855-0x0000000076CA0000-0x0000000076D9A000-memory.dmp family_blackmoon behavioral1/memory/2056-19854-0x0000000076DA0000-0x0000000076EBF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2240 rrfrxfr.exe 1472 bthtnt.exe 2276 djdjd.exe 2752 tnhhnb.exe 2696 xrfrxfr.exe 2832 1tnthn.exe 2560 5vjjv.exe 1492 frrllxf.exe 2552 nhbnht.exe 3016 7rxxffr.exe 1564 3nbtnb.exe 1652 5ppvj.exe 2600 lfrrxfr.exe 1676 pdjjp.exe 1360 fxrlxrf.exe 1780 nhhtbn.exe 2292 3jvdj.exe 2856 nhhhbt.exe 2176 tnhnbh.exe 2244 3rllrfl.exe 2160 rffrlrf.exe 1028 dpdvd.exe 1672 xrfxllf.exe 1860 3ntntt.exe 1704 ffxxffl.exe 840 xrflrxl.exe 960 dvpvj.exe 2388 hbhhnn.exe 1976 bthhhn.exe 2480 dvdjv.exe 2432 ttnnnn.exe 2164 vpddj.exe 892 tttntn.exe 2944 vpjjv.exe 2056 dvdjv.exe 2960 ddpdj.exe 2188 xrfflrx.exe 1472 btnthn.exe 2088 vpdjv.exe 2700 1jvdj.exe 2816 lfxlrrf.exe 2252 hbhhhn.exe 2212 5jdpj.exe 2680 vjdjv.exe 2708 5lxxllx.exe 2584 bbntbh.exe 2620 djdvj.exe 3060 pjpvd.exe 1768 llrxxfr.exe 1476 hhthnn.exe 1644 nbtbhh.exe 300 dvdvj.exe 320 rfxfrrr.exe 1676 lrllxlx.exe 548 tththn.exe 884 dvvdj.exe 484 9xflllr.exe 2872 ttbbtb.exe 2112 3nbbnn.exe 2128 vvpvd.exe 2196 1lxfflr.exe 2364 1xxflxf.exe 1132 tnbbhh.exe 448 1dppv.exe -
resource yara_rule behavioral1/memory/2328-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2328-3-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000a000000015685-6.dat upx behavioral1/memory/2240-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d0a-15.dat upx behavioral1/memory/1472-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d31-23.dat upx behavioral1/files/0x0007000000015d48-32.dat upx behavioral1/memory/2276-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2752-39-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2752-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d60-41.dat upx behavioral1/memory/2696-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015d88-51.dat upx behavioral1/memory/2696-50-0x00000000002B0000-0x00000000002D7000-memory.dmp upx behavioral1/files/0x0007000000016399-58.dat upx behavioral1/files/0x00060000000164de-65.dat upx behavioral1/files/0x000600000001660e-73.dat upx behavioral1/memory/1492-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016689-82.dat upx behavioral1/files/0x0006000000016890-90.dat upx behavioral1/memory/3016-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1564-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016b86-99.dat upx behavioral1/memory/1652-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c89-107.dat upx behavioral1/files/0x0006000000016ca0-115.dat upx behavioral1/files/0x0006000000016cab-122.dat upx behavioral1/memory/1360-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cf0-130.dat upx behavioral1/files/0x0006000000016d22-138.dat upx behavioral1/memory/1780-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d4c-146.dat upx behavioral1/memory/2856-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d68-156.dat upx behavioral1/memory/2176-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015ccf-163.dat upx behavioral1/files/0x0006000000016d6f-171.dat upx behavioral1/memory/2160-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d73-180.dat upx behavioral1/memory/2160-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dd5-189.dat upx behavioral1/memory/1028-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dd9-198.dat upx behavioral1/files/0x0006000000016de9-205.dat upx behavioral1/files/0x0006000000016df5-213.dat upx behavioral1/files/0x0006000000016df8-220.dat upx behavioral1/files/0x0006000000016edc-227.dat upx behavioral1/files/0x0006000000016f02-235.dat upx behavioral1/memory/2388-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001707f-245.dat upx behavioral1/memory/1976-244-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/960-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2480-253-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174b4-254.dat upx behavioral1/memory/2432-261-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174f8-262.dat upx behavioral1/memory/2056-279-0x0000000076DA0000-0x0000000076EBF000-memory.dmp upx behavioral1/memory/2056-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2452-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2188-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2700-313-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2680-340-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2584-352-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2240 2328 e6c6f9a029b8860176db9731b177a7c6eaa1a1c32665dc77098a64ceef9f5c97N.exe 31 PID 2328 wrote to memory of 2240 2328 e6c6f9a029b8860176db9731b177a7c6eaa1a1c32665dc77098a64ceef9f5c97N.exe 31 PID 2328 wrote to memory of 2240 2328 e6c6f9a029b8860176db9731b177a7c6eaa1a1c32665dc77098a64ceef9f5c97N.exe 31 PID 2328 wrote to memory of 2240 2328 e6c6f9a029b8860176db9731b177a7c6eaa1a1c32665dc77098a64ceef9f5c97N.exe 31 PID 2240 wrote to memory of 1472 2240 rrfrxfr.exe 32 PID 2240 wrote to memory of 1472 2240 rrfrxfr.exe 32 PID 2240 wrote to memory of 1472 2240 rrfrxfr.exe 32 PID 2240 wrote to memory of 1472 2240 rrfrxfr.exe 32 PID 1472 wrote to memory of 2276 1472 bthtnt.exe 33 PID 1472 wrote to memory of 2276 1472 bthtnt.exe 33 PID 1472 wrote to memory of 2276 1472 bthtnt.exe 33 PID 1472 wrote to memory of 2276 1472 bthtnt.exe 33 PID 2276 wrote to memory of 2752 2276 djdjd.exe 34 PID 2276 wrote to memory of 2752 2276 djdjd.exe 34 PID 2276 wrote to memory of 2752 2276 djdjd.exe 34 PID 2276 wrote to memory of 2752 2276 djdjd.exe 34 PID 2752 wrote to memory of 2696 2752 tnhhnb.exe 35 PID 2752 wrote to memory of 2696 2752 tnhhnb.exe 35 PID 2752 wrote to memory of 2696 2752 tnhhnb.exe 35 PID 2752 wrote to memory of 2696 2752 tnhhnb.exe 35 PID 2696 wrote to memory of 2832 2696 xrfrxfr.exe 36 PID 2696 wrote to memory of 2832 2696 xrfrxfr.exe 36 PID 2696 wrote to memory of 2832 2696 xrfrxfr.exe 36 PID 2696 wrote to memory of 2832 2696 xrfrxfr.exe 36 PID 2832 wrote to memory of 2560 2832 1tnthn.exe 37 PID 2832 wrote to memory of 2560 2832 1tnthn.exe 37 PID 2832 wrote to memory of 2560 2832 1tnthn.exe 37 PID 2832 wrote to memory of 2560 2832 1tnthn.exe 37 PID 2560 wrote to memory of 1492 2560 5vjjv.exe 38 PID 2560 wrote to memory of 1492 2560 5vjjv.exe 38 PID 2560 wrote to memory of 1492 2560 5vjjv.exe 38 PID 2560 wrote to memory of 1492 2560 5vjjv.exe 38 PID 1492 wrote to memory of 2552 1492 frrllxf.exe 39 PID 1492 wrote to memory of 2552 1492 frrllxf.exe 39 PID 1492 wrote to memory of 2552 1492 frrllxf.exe 39 PID 1492 wrote to memory of 2552 1492 frrllxf.exe 39 PID 2552 wrote to memory of 3016 2552 nhbnht.exe 40 PID 2552 wrote to memory of 3016 2552 nhbnht.exe 40 PID 2552 wrote to memory of 3016 2552 nhbnht.exe 40 PID 2552 wrote to memory of 3016 2552 nhbnht.exe 40 PID 3016 wrote to memory of 1564 3016 7rxxffr.exe 41 PID 3016 wrote to memory of 1564 3016 7rxxffr.exe 41 PID 3016 wrote to memory of 1564 3016 7rxxffr.exe 41 PID 3016 wrote to memory of 1564 3016 7rxxffr.exe 41 PID 1564 wrote to memory of 1652 1564 3nbtnb.exe 42 PID 1564 wrote to memory of 1652 1564 3nbtnb.exe 42 PID 1564 wrote to memory of 1652 1564 3nbtnb.exe 42 PID 1564 wrote to memory of 1652 1564 3nbtnb.exe 42 PID 1652 wrote to memory of 2600 1652 5ppvj.exe 43 PID 1652 wrote to memory of 2600 1652 5ppvj.exe 43 PID 1652 wrote to memory of 2600 1652 5ppvj.exe 43 PID 1652 wrote to memory of 2600 1652 5ppvj.exe 43 PID 2600 wrote to memory of 1676 2600 lfrrxfr.exe 44 PID 2600 wrote to memory of 1676 2600 lfrrxfr.exe 44 PID 2600 wrote to memory of 1676 2600 lfrrxfr.exe 44 PID 2600 wrote to memory of 1676 2600 lfrrxfr.exe 44 PID 1676 wrote to memory of 1360 1676 pdjjp.exe 45 PID 1676 wrote to memory of 1360 1676 pdjjp.exe 45 PID 1676 wrote to memory of 1360 1676 pdjjp.exe 45 PID 1676 wrote to memory of 1360 1676 pdjjp.exe 45 PID 1360 wrote to memory of 1780 1360 fxrlxrf.exe 46 PID 1360 wrote to memory of 1780 1360 fxrlxrf.exe 46 PID 1360 wrote to memory of 1780 1360 fxrlxrf.exe 46 PID 1360 wrote to memory of 1780 1360 fxrlxrf.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6c6f9a029b8860176db9731b177a7c6eaa1a1c32665dc77098a64ceef9f5c97N.exe"C:\Users\Admin\AppData\Local\Temp\e6c6f9a029b8860176db9731b177a7c6eaa1a1c32665dc77098a64ceef9f5c97N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\rrfrxfr.exec:\rrfrxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\bthtnt.exec:\bthtnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\djdjd.exec:\djdjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\tnhhnb.exec:\tnhhnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\xrfrxfr.exec:\xrfrxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\1tnthn.exec:\1tnthn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\5vjjv.exec:\5vjjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\frrllxf.exec:\frrllxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\nhbnht.exec:\nhbnht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\7rxxffr.exec:\7rxxffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\3nbtnb.exec:\3nbtnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\5ppvj.exec:\5ppvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\lfrrxfr.exec:\lfrrxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\pdjjp.exec:\pdjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\fxrlxrf.exec:\fxrlxrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\nhhtbn.exec:\nhhtbn.exe17⤵
- Executes dropped EXE
PID:1780 -
\??\c:\3jvdj.exec:\3jvdj.exe18⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nhhhbt.exec:\nhhhbt.exe19⤵
- Executes dropped EXE
PID:2856 -
\??\c:\tnhnbh.exec:\tnhnbh.exe20⤵
- Executes dropped EXE
PID:2176 -
\??\c:\3rllrfl.exec:\3rllrfl.exe21⤵
- Executes dropped EXE
PID:2244 -
\??\c:\rffrlrf.exec:\rffrlrf.exe22⤵
- Executes dropped EXE
PID:2160 -
\??\c:\dpdvd.exec:\dpdvd.exe23⤵
- Executes dropped EXE
PID:1028 -
\??\c:\xrfxllf.exec:\xrfxllf.exe24⤵
- Executes dropped EXE
PID:1672 -
\??\c:\3ntntt.exec:\3ntntt.exe25⤵
- Executes dropped EXE
PID:1860 -
\??\c:\ffxxffl.exec:\ffxxffl.exe26⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xrflrxl.exec:\xrflrxl.exe27⤵
- Executes dropped EXE
PID:840 -
\??\c:\dvpvj.exec:\dvpvj.exe28⤵
- Executes dropped EXE
PID:960 -
\??\c:\hbhhnn.exec:\hbhhnn.exe29⤵
- Executes dropped EXE
PID:2388 -
\??\c:\bthhhn.exec:\bthhhn.exe30⤵
- Executes dropped EXE
PID:1976 -
\??\c:\dvdjv.exec:\dvdjv.exe31⤵
- Executes dropped EXE
PID:2480 -
\??\c:\ttnnnn.exec:\ttnnnn.exe32⤵
- Executes dropped EXE
PID:2432 -
\??\c:\vpddj.exec:\vpddj.exe33⤵
- Executes dropped EXE
PID:2164 -
\??\c:\tttntn.exec:\tttntn.exe34⤵
- Executes dropped EXE
PID:892 -
\??\c:\vpjjv.exec:\vpjjv.exe35⤵
- Executes dropped EXE
PID:2944 -
\??\c:\dvdjv.exec:\dvdjv.exe36⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rlrrflx.exec:\rlrrflx.exe37⤵PID:2452
-
\??\c:\ddpdj.exec:\ddpdj.exe38⤵
- Executes dropped EXE
PID:2960 -
\??\c:\xrfflrx.exec:\xrfflrx.exe39⤵
- Executes dropped EXE
PID:2188 -
\??\c:\btnthn.exec:\btnthn.exe40⤵
- Executes dropped EXE
PID:1472 -
\??\c:\vpdjv.exec:\vpdjv.exe41⤵
- Executes dropped EXE
PID:2088 -
\??\c:\1jvdj.exec:\1jvdj.exe42⤵
- Executes dropped EXE
PID:2700 -
\??\c:\lfxlrrf.exec:\lfxlrrf.exe43⤵
- Executes dropped EXE
PID:2816 -
\??\c:\hbhhhn.exec:\hbhhhn.exe44⤵
- Executes dropped EXE
PID:2252 -
\??\c:\5jdpj.exec:\5jdpj.exe45⤵
- Executes dropped EXE
PID:2212 -
\??\c:\vjdjv.exec:\vjdjv.exe46⤵
- Executes dropped EXE
PID:2680 -
\??\c:\5lxxllx.exec:\5lxxllx.exe47⤵
- Executes dropped EXE
PID:2708 -
\??\c:\bbntbh.exec:\bbntbh.exe48⤵
- Executes dropped EXE
PID:2584 -
\??\c:\djdvj.exec:\djdvj.exe49⤵
- Executes dropped EXE
PID:2620 -
\??\c:\pjpvd.exec:\pjpvd.exe50⤵
- Executes dropped EXE
PID:3060 -
\??\c:\llrxxfr.exec:\llrxxfr.exe51⤵
- Executes dropped EXE
PID:1768 -
\??\c:\hhthnn.exec:\hhthnn.exe52⤵
- Executes dropped EXE
PID:1476 -
\??\c:\nbtbhh.exec:\nbtbhh.exe53⤵
- Executes dropped EXE
PID:1644 -
\??\c:\dvdvj.exec:\dvdvj.exe54⤵
- Executes dropped EXE
PID:300 -
\??\c:\rfxfrrr.exec:\rfxfrrr.exe55⤵
- Executes dropped EXE
PID:320 -
\??\c:\lrllxlx.exec:\lrllxlx.exe56⤵
- Executes dropped EXE
PID:1676 -
\??\c:\tththn.exec:\tththn.exe57⤵
- Executes dropped EXE
PID:548 -
\??\c:\dvvdj.exec:\dvvdj.exe58⤵
- Executes dropped EXE
PID:884 -
\??\c:\9xflllr.exec:\9xflllr.exe59⤵
- Executes dropped EXE
PID:484 -
\??\c:\ttbbtb.exec:\ttbbtb.exe60⤵
- Executes dropped EXE
PID:2872 -
\??\c:\3nbbnn.exec:\3nbbnn.exe61⤵
- Executes dropped EXE
PID:2112 -
\??\c:\vvpvd.exec:\vvpvd.exe62⤵
- Executes dropped EXE
PID:2128 -
\??\c:\1lxfflr.exec:\1lxfflr.exe63⤵
- Executes dropped EXE
PID:2196 -
\??\c:\1xxflxf.exec:\1xxflxf.exe64⤵
- Executes dropped EXE
PID:2364 -
\??\c:\tnbbhh.exec:\tnbbhh.exe65⤵
- Executes dropped EXE
PID:1132 -
\??\c:\1dppv.exec:\1dppv.exe66⤵
- Executes dropped EXE
PID:448 -
\??\c:\ppvdj.exec:\ppvdj.exe67⤵PID:964
-
\??\c:\fxrfrxf.exec:\fxrfrxf.exe68⤵PID:764
-
\??\c:\bbhbbh.exec:\bbhbbh.exe69⤵PID:1936
-
\??\c:\pjvjp.exec:\pjvjp.exe70⤵PID:1308
-
\??\c:\rfxlxlx.exec:\rfxlxlx.exe71⤵PID:2000
-
\??\c:\rrlrflf.exec:\rrlrflf.exe72⤵PID:1732
-
\??\c:\9htntt.exec:\9htntt.exe73⤵PID:616
-
\??\c:\pjvdj.exec:\pjvdj.exe74⤵PID:2304
-
\??\c:\xrxflxf.exec:\xrxflxf.exe75⤵PID:2092
-
\??\c:\1lrxlrr.exec:\1lrxlrr.exe76⤵PID:560
-
\??\c:\tththn.exec:\tththn.exe77⤵PID:2468
-
\??\c:\7pvvd.exec:\7pvvd.exe78⤵PID:2220
-
\??\c:\xxrxflr.exec:\xxrxflr.exe79⤵PID:2144
-
\??\c:\flffllx.exec:\flffllx.exe80⤵PID:1996
-
\??\c:\thbtbh.exec:\thbtbh.exe81⤵PID:1920
-
\??\c:\dvvpv.exec:\dvvpv.exe82⤵PID:1964
-
\??\c:\llxflxf.exec:\llxflxf.exe83⤵PID:2024
-
\??\c:\xrlfllx.exec:\xrlfllx.exe84⤵
- System Location Discovery: System Language Discovery
PID:2452 -
\??\c:\hnhthn.exec:\hnhthn.exe85⤵PID:1484
-
\??\c:\ppdjj.exec:\ppdjj.exe86⤵PID:2188
-
\??\c:\5xxxxfr.exec:\5xxxxfr.exe87⤵PID:1472
-
\??\c:\3rlxlrf.exec:\3rlxlrf.exe88⤵PID:2804
-
\??\c:\httnbt.exec:\httnbt.exe89⤵PID:2788
-
\??\c:\3jvvv.exec:\3jvvv.exe90⤵PID:2668
-
\??\c:\jjvdp.exec:\jjvdp.exe91⤵PID:2812
-
\??\c:\xflxrff.exec:\xflxrff.exe92⤵PID:2832
-
\??\c:\nhbbnn.exec:\nhbbnn.exe93⤵PID:2592
-
\??\c:\5pddd.exec:\5pddd.exe94⤵PID:2548
-
\??\c:\3pddp.exec:\3pddp.exe95⤵PID:2608
-
\??\c:\fxrrxfr.exec:\fxrrxfr.exe96⤵PID:2380
-
\??\c:\7tnttt.exec:\7tnttt.exe97⤵PID:2664
-
\??\c:\htnhnh.exec:\htnhnh.exe98⤵PID:1336
-
\??\c:\vpjvj.exec:\vpjvj.exe99⤵PID:2004
-
\??\c:\9fxxffl.exec:\9fxxffl.exe100⤵PID:1840
-
\??\c:\nhbnbt.exec:\nhbnbt.exe101⤵PID:1652
-
\??\c:\nbnttt.exec:\nbnttt.exe102⤵PID:1400
-
\??\c:\vpvdd.exec:\vpvdd.exe103⤵PID:1784
-
\??\c:\xrllllx.exec:\xrllllx.exe104⤵PID:1676
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe105⤵PID:1664
-
\??\c:\btntbn.exec:\btntbn.exe106⤵PID:552
-
\??\c:\jdjdp.exec:\jdjdp.exe107⤵PID:1268
-
\??\c:\xxrflff.exec:\xxrflff.exe108⤵PID:2860
-
\??\c:\rxrlfrl.exec:\rxrlfrl.exe109⤵PID:2392
-
\??\c:\hbbbht.exec:\hbbbht.exe110⤵PID:2180
-
\??\c:\pjdjv.exec:\pjdjv.exe111⤵PID:2044
-
\??\c:\5pdvd.exec:\5pdvd.exe112⤵PID:2060
-
\??\c:\9rflxrx.exec:\9rflxrx.exe113⤵PID:2148
-
\??\c:\lrlxlrf.exec:\lrlxlrf.exe114⤵PID:1028
-
\??\c:\tnthnn.exec:\tnthnn.exe115⤵PID:1672
-
\??\c:\jjvvv.exec:\jjvvv.exe116⤵PID:1924
-
\??\c:\7xllllx.exec:\7xllllx.exe117⤵PID:1584
-
\??\c:\rrlrllr.exec:\rrlrllr.exe118⤵PID:864
-
\??\c:\hhhbtb.exec:\hhhbtb.exe119⤵PID:752
-
\??\c:\pjvdp.exec:\pjvdp.exe120⤵PID:568
-
\??\c:\5jdpv.exec:\5jdpv.exe121⤵PID:960
-
\??\c:\3xxfrfr.exec:\3xxfrfr.exe122⤵PID:1808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-