Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 02:04
Behavioral task
behavioral1
Sample
772af59656addde01066d232796a32d476a17e29f430bf428b5c0f09b0286f73N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
772af59656addde01066d232796a32d476a17e29f430bf428b5c0f09b0286f73N.exe
-
Size
498KB
-
MD5
da7efd76c098212fa79968d67bff6440
-
SHA1
29cd0e12901cef8c1ac24ff41564f8b801e4ad8d
-
SHA256
772af59656addde01066d232796a32d476a17e29f430bf428b5c0f09b0286f73
-
SHA512
09f6286761b7a0a1ca585f2766a2c37cd2aadd3e97ff21af0a9ea28afe9ce68c09bf679d180d91fb209adcfc1d0add565e12cfbb4c5b48ae660474a667201167
-
SSDEEP
12288:S4wFHoSyoS3ebeFmFVvlrmwcT4wpteFmFTxe:0KFmFVtrRcFEFmFo
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral1/memory/2912-7-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/3012-18-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2228-27-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1708-37-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1912-47-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2416-58-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2416-55-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2152-72-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2216-305-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1588-346-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2396-361-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2496-415-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2624-436-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2744-476-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/924-482-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2644-504-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1452-511-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/908-518-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2936-497-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/924-483-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1432-469-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1596-456-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1056-449-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1776-429-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2144-422-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2532-408-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2800-401-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2660-394-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1804-381-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2684-374-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2396-360-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2396-354-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2400-353-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2312-339-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2088-319-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2836-326-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/3024-312-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/572-296-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1732-287-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2872-278-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/684-254-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1320-251-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/684-261-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2932-234-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2744-225-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1340-199-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/836-208-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1596-190-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1056-181-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/1916-171-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2452-162-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/664-153-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2236-144-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2508-135-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2416-127-0x0000000000320000-0x00000000003A4000-memory.dmp family_blackmoon behavioral1/memory/2648-124-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2648-117-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2824-114-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2720-105-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2636-95-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2152-78-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2288-68-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral1/memory/2672-2817-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3012 3xrxllr.exe 2228 3bbnht.exe 1708 7ppjv.exe 1912 5llfrrx.exe 2416 ntbtbb.exe 2288 3pvpp.exe 2152 fxlxlfr.exe 2672 nnhtbh.exe 2636 pdpvd.exe 2720 llxrfrf.exe 2824 jjjpd.exe 2648 fffxffr.exe 2508 jjdpp.exe 2236 rrrflrf.exe 664 tbthhn.exe 2452 vdvjd.exe 1916 hbnbnt.exe 1056 3hbntt.exe 1596 dvdpp.exe 1340 rlxflxf.exe 836 nnthth.exe 784 jddjv.exe 2744 3vvpd.exe 2932 xlxllrr.exe 1112 5hbhnb.exe 1320 9frrflx.exe 684 9vvvv.exe 1960 llfrllr.exe 2872 bhbnbn.exe 1732 ddpdp.exe 572 nnhbhb.exe 2216 vpddv.exe 3024 fxrxllf.exe 2088 pdpdp.exe 2836 llflflf.exe 2280 nntbnh.exe 2312 5btttt.exe 1588 pjvdj.exe 2400 9lflxxf.exe 2396 ntthnb.exe 2964 dvppv.exe 2684 lxxllll.exe 1804 rrlrflr.exe 2636 tnbntb.exe 2660 9vpdj.exe 2800 lllxffx.exe 2532 ttnhhb.exe 2496 hnhtht.exe 2144 9vpvv.exe 1776 rrlfrxr.exe 2624 3tnbtb.exe 1568 5tnntb.exe 1056 vvjvv.exe 1596 fflrflf.exe 288 bthnhh.exe 1432 jdjjp.exe 2744 xlfxllr.exe 924 nbtbbb.exe 2784 nbhnbt.exe 2936 9vpvv.exe 2644 xxlxffl.exe 1452 nhthnh.exe 908 vppjp.exe 584 1vvjp.exe -
resource yara_rule behavioral1/memory/2912-0-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2912-7-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x000700000001211a-9.dat upx behavioral1/memory/3012-12-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0008000000015d76-20.dat upx behavioral1/memory/3012-18-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2228-27-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1708-29-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0008000000015d87-28.dat upx behavioral1/files/0x0007000000015d9a-38.dat upx behavioral1/memory/1708-37-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1912-39-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1708-36-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0007000000015da7-48.dat upx behavioral1/memory/1912-47-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0007000000015db1-61.dat upx behavioral1/memory/2288-60-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2416-58-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2416-56-0x0000000000320000-0x00000000003A4000-memory.dmp upx behavioral1/memory/2152-72-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2672-86-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0006000000016cd1-88.dat upx behavioral1/files/0x0006000000016cfc-96.dat upx behavioral1/memory/2720-98-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0006000000016d46-137.dat upx behavioral1/files/0x0006000000016d96-146.dat upx behavioral1/files/0x0009000000015d36-155.dat upx behavioral1/memory/1056-174-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0006000000016ea4-201.dat upx behavioral1/files/0x00060000000173f1-236.dat upx behavioral1/files/0x00060000000174a2-280.dat upx behavioral1/files/0x0006000000017525-289.dat upx behavioral1/memory/2216-305-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1588-346-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2396-361-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2496-415-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2624-436-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2744-476-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2644-504-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1452-511-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1688-596-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/908-518-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2936-497-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/924-483-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2936-490-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1432-469-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1596-456-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1056-449-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1776-429-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2144-422-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2532-408-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2800-401-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2660-394-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/1804-381-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2684-374-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2396-354-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2400-353-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2312-339-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2088-319-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2836-326-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/2216-304-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/memory/3024-312-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral1/files/0x0014000000018663-298.dat upx behavioral1/memory/572-296-0x0000000000400000-0x0000000000484000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllflfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlflffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 3012 2912 772af59656addde01066d232796a32d476a17e29f430bf428b5c0f09b0286f73N.exe 28 PID 2912 wrote to memory of 3012 2912 772af59656addde01066d232796a32d476a17e29f430bf428b5c0f09b0286f73N.exe 28 PID 2912 wrote to memory of 3012 2912 772af59656addde01066d232796a32d476a17e29f430bf428b5c0f09b0286f73N.exe 28 PID 2912 wrote to memory of 3012 2912 772af59656addde01066d232796a32d476a17e29f430bf428b5c0f09b0286f73N.exe 28 PID 3012 wrote to memory of 2228 3012 3xrxllr.exe 29 PID 3012 wrote to memory of 2228 3012 3xrxllr.exe 29 PID 3012 wrote to memory of 2228 3012 3xrxllr.exe 29 PID 3012 wrote to memory of 2228 3012 3xrxllr.exe 29 PID 2228 wrote to memory of 1708 2228 3bbnht.exe 30 PID 2228 wrote to memory of 1708 2228 3bbnht.exe 30 PID 2228 wrote to memory of 1708 2228 3bbnht.exe 30 PID 2228 wrote to memory of 1708 2228 3bbnht.exe 30 PID 1708 wrote to memory of 1912 1708 7ppjv.exe 31 PID 1708 wrote to memory of 1912 1708 7ppjv.exe 31 PID 1708 wrote to memory of 1912 1708 7ppjv.exe 31 PID 1708 wrote to memory of 1912 1708 7ppjv.exe 31 PID 1912 wrote to memory of 2416 1912 5llfrrx.exe 32 PID 1912 wrote to memory of 2416 1912 5llfrrx.exe 32 PID 1912 wrote to memory of 2416 1912 5llfrrx.exe 32 PID 1912 wrote to memory of 2416 1912 5llfrrx.exe 32 PID 2416 wrote to memory of 2288 2416 ntbtbb.exe 33 PID 2416 wrote to memory of 2288 2416 ntbtbb.exe 33 PID 2416 wrote to memory of 2288 2416 ntbtbb.exe 33 PID 2416 wrote to memory of 2288 2416 ntbtbb.exe 33 PID 2288 wrote to memory of 2152 2288 3pvpp.exe 34 PID 2288 wrote to memory of 2152 2288 3pvpp.exe 34 PID 2288 wrote to memory of 2152 2288 3pvpp.exe 34 PID 2288 wrote to memory of 2152 2288 3pvpp.exe 34 PID 2152 wrote to memory of 2672 2152 fxlxlfr.exe 35 PID 2152 wrote to memory of 2672 2152 fxlxlfr.exe 35 PID 2152 wrote to memory of 2672 2152 fxlxlfr.exe 35 PID 2152 wrote to memory of 2672 2152 fxlxlfr.exe 35 PID 2672 wrote to memory of 2636 2672 nnhtbh.exe 71 PID 2672 wrote to memory of 2636 2672 nnhtbh.exe 71 PID 2672 wrote to memory of 2636 2672 nnhtbh.exe 71 PID 2672 wrote to memory of 2636 2672 nnhtbh.exe 71 PID 2636 wrote to memory of 2720 2636 pdpvd.exe 37 PID 2636 wrote to memory of 2720 2636 pdpvd.exe 37 PID 2636 wrote to memory of 2720 2636 pdpvd.exe 37 PID 2636 wrote to memory of 2720 2636 pdpvd.exe 37 PID 2720 wrote to memory of 2824 2720 llxrfrf.exe 38 PID 2720 wrote to memory of 2824 2720 llxrfrf.exe 38 PID 2720 wrote to memory of 2824 2720 llxrfrf.exe 38 PID 2720 wrote to memory of 2824 2720 llxrfrf.exe 38 PID 2824 wrote to memory of 2648 2824 jjjpd.exe 39 PID 2824 wrote to memory of 2648 2824 jjjpd.exe 39 PID 2824 wrote to memory of 2648 2824 jjjpd.exe 39 PID 2824 wrote to memory of 2648 2824 jjjpd.exe 39 PID 2648 wrote to memory of 2508 2648 fffxffr.exe 40 PID 2648 wrote to memory of 2508 2648 fffxffr.exe 40 PID 2648 wrote to memory of 2508 2648 fffxffr.exe 40 PID 2648 wrote to memory of 2508 2648 fffxffr.exe 40 PID 2508 wrote to memory of 2236 2508 jjdpp.exe 41 PID 2508 wrote to memory of 2236 2508 jjdpp.exe 41 PID 2508 wrote to memory of 2236 2508 jjdpp.exe 41 PID 2508 wrote to memory of 2236 2508 jjdpp.exe 41 PID 2236 wrote to memory of 664 2236 rrrflrf.exe 42 PID 2236 wrote to memory of 664 2236 rrrflrf.exe 42 PID 2236 wrote to memory of 664 2236 rrrflrf.exe 42 PID 2236 wrote to memory of 664 2236 rrrflrf.exe 42 PID 664 wrote to memory of 2452 664 tbthhn.exe 43 PID 664 wrote to memory of 2452 664 tbthhn.exe 43 PID 664 wrote to memory of 2452 664 tbthhn.exe 43 PID 664 wrote to memory of 2452 664 tbthhn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\772af59656addde01066d232796a32d476a17e29f430bf428b5c0f09b0286f73N.exe"C:\Users\Admin\AppData\Local\Temp\772af59656addde01066d232796a32d476a17e29f430bf428b5c0f09b0286f73N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\3xrxllr.exec:\3xrxllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\3bbnht.exec:\3bbnht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\7ppjv.exec:\7ppjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\5llfrrx.exec:\5llfrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\ntbtbb.exec:\ntbtbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\3pvpp.exec:\3pvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\fxlxlfr.exec:\fxlxlfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\nnhtbh.exec:\nnhtbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\pdpvd.exec:\pdpvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\llxrfrf.exec:\llxrfrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\jjjpd.exec:\jjjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\fffxffr.exec:\fffxffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\jjdpp.exec:\jjdpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\rrrflrf.exec:\rrrflrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\tbthhn.exec:\tbthhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\vdvjd.exec:\vdvjd.exe17⤵
- Executes dropped EXE
PID:2452 -
\??\c:\hbnbnt.exec:\hbnbnt.exe18⤵
- Executes dropped EXE
PID:1916 -
\??\c:\3hbntt.exec:\3hbntt.exe19⤵
- Executes dropped EXE
PID:1056 -
\??\c:\dvdpp.exec:\dvdpp.exe20⤵
- Executes dropped EXE
PID:1596 -
\??\c:\rlxflxf.exec:\rlxflxf.exe21⤵
- Executes dropped EXE
PID:1340 -
\??\c:\nnthth.exec:\nnthth.exe22⤵
- Executes dropped EXE
PID:836 -
\??\c:\jddjv.exec:\jddjv.exe23⤵
- Executes dropped EXE
PID:784 -
\??\c:\3vvpd.exec:\3vvpd.exe24⤵
- Executes dropped EXE
PID:2744 -
\??\c:\xlxllrr.exec:\xlxllrr.exe25⤵
- Executes dropped EXE
PID:2932 -
\??\c:\5hbhnb.exec:\5hbhnb.exe26⤵
- Executes dropped EXE
PID:1112 -
\??\c:\9frrflx.exec:\9frrflx.exe27⤵
- Executes dropped EXE
PID:1320 -
\??\c:\9vvvv.exec:\9vvvv.exe28⤵
- Executes dropped EXE
PID:684 -
\??\c:\llfrllr.exec:\llfrllr.exe29⤵
- Executes dropped EXE
PID:1960 -
\??\c:\bhbnbn.exec:\bhbnbn.exe30⤵
- Executes dropped EXE
PID:2872 -
\??\c:\ddpdp.exec:\ddpdp.exe31⤵
- Executes dropped EXE
PID:1732 -
\??\c:\nnhbhb.exec:\nnhbhb.exe32⤵
- Executes dropped EXE
PID:572 -
\??\c:\vpddv.exec:\vpddv.exe33⤵
- Executes dropped EXE
PID:2216 -
\??\c:\fxrxllf.exec:\fxrxllf.exe34⤵
- Executes dropped EXE
PID:3024 -
\??\c:\pdpdp.exec:\pdpdp.exe35⤵
- Executes dropped EXE
PID:2088 -
\??\c:\llflflf.exec:\llflflf.exe36⤵
- Executes dropped EXE
PID:2836 -
\??\c:\nntbnh.exec:\nntbnh.exe37⤵
- Executes dropped EXE
PID:2280 -
\??\c:\5btttt.exec:\5btttt.exe38⤵
- Executes dropped EXE
PID:2312 -
\??\c:\pjvdj.exec:\pjvdj.exe39⤵
- Executes dropped EXE
PID:1588 -
\??\c:\9lflxxf.exec:\9lflxxf.exe40⤵
- Executes dropped EXE
PID:2400 -
\??\c:\ntthnb.exec:\ntthnb.exe41⤵
- Executes dropped EXE
PID:2396 -
\??\c:\dvppv.exec:\dvppv.exe42⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lxxllll.exec:\lxxllll.exe43⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rrlrflr.exec:\rrlrflr.exe44⤵
- Executes dropped EXE
PID:1804 -
\??\c:\tnbntb.exec:\tnbntb.exe45⤵
- Executes dropped EXE
PID:2636 -
\??\c:\9vpdj.exec:\9vpdj.exe46⤵
- Executes dropped EXE
PID:2660 -
\??\c:\lllxffx.exec:\lllxffx.exe47⤵
- Executes dropped EXE
PID:2800 -
\??\c:\ttnhhb.exec:\ttnhhb.exe48⤵
- Executes dropped EXE
PID:2532 -
\??\c:\hnhtht.exec:\hnhtht.exe49⤵
- Executes dropped EXE
PID:2496 -
\??\c:\9vpvv.exec:\9vpvv.exe50⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rrlfrxr.exec:\rrlfrxr.exe51⤵
- Executes dropped EXE
PID:1776 -
\??\c:\3tnbtb.exec:\3tnbtb.exe52⤵
- Executes dropped EXE
PID:2624 -
\??\c:\5tnntb.exec:\5tnntb.exe53⤵
- Executes dropped EXE
PID:1568 -
\??\c:\vvjvv.exec:\vvjvv.exe54⤵
- Executes dropped EXE
PID:1056 -
\??\c:\fflrflf.exec:\fflrflf.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1596 -
\??\c:\bthnhh.exec:\bthnhh.exe56⤵
- Executes dropped EXE
PID:288 -
\??\c:\jdjjp.exec:\jdjjp.exe57⤵
- Executes dropped EXE
PID:1432 -
\??\c:\xlfxllr.exec:\xlfxllr.exe58⤵
- Executes dropped EXE
PID:2744 -
\??\c:\nbtbbb.exec:\nbtbbb.exe59⤵
- Executes dropped EXE
PID:924 -
\??\c:\nbhnbt.exec:\nbhnbt.exe60⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9vpvv.exec:\9vpvv.exe61⤵
- Executes dropped EXE
PID:2936 -
\??\c:\xxlxffl.exec:\xxlxffl.exe62⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nhthnh.exec:\nhthnh.exe63⤵
- Executes dropped EXE
PID:1452 -
\??\c:\vppjp.exec:\vppjp.exe64⤵
- Executes dropped EXE
PID:908 -
\??\c:\1vvjp.exec:\1vvjp.exe65⤵
- Executes dropped EXE
PID:584 -
\??\c:\rlxlrxl.exec:\rlxlrxl.exe66⤵PID:1028
-
\??\c:\btbhnt.exec:\btbhnt.exe67⤵PID:2320
-
\??\c:\tbhnhn.exec:\tbhnhn.exe68⤵PID:948
-
\??\c:\pjddp.exec:\pjddp.exe69⤵PID:1604
-
\??\c:\flfxrxl.exec:\flfxrxl.exe70⤵PID:2168
-
\??\c:\tthhtb.exec:\tthhtb.exe71⤵PID:1192
-
\??\c:\bbntbb.exec:\bbntbb.exe72⤵PID:2136
-
\??\c:\vvjjp.exec:\vvjjp.exe73⤵PID:2264
-
\??\c:\7xllrlx.exec:\7xllrlx.exe74⤵PID:2764
-
\??\c:\5nntbh.exec:\5nntbh.exe75⤵PID:2412
-
\??\c:\thttbb.exec:\thttbb.exe76⤵PID:1996
-
\??\c:\1pjjp.exec:\1pjjp.exe77⤵PID:1688
-
\??\c:\nhhhnt.exec:\nhhhnt.exe78⤵PID:1952
-
\??\c:\ddpvj.exec:\ddpvj.exe79⤵PID:1276
-
\??\c:\btnthh.exec:\btnthh.exe80⤵PID:1292
-
\??\c:\ddvjd.exec:\ddvjd.exe81⤵PID:2408
-
\??\c:\5rlfrlr.exec:\5rlfrlr.exe82⤵PID:2752
-
\??\c:\tnhttb.exec:\tnhttb.exe83⤵PID:2064
-
\??\c:\ddvjv.exec:\ddvjv.exe84⤵PID:2604
-
\??\c:\3jdpd.exec:\3jdpd.exe85⤵PID:2532
-
\??\c:\hnbnnt.exec:\hnbnnt.exe86⤵PID:2724
-
\??\c:\hhtbhn.exec:\hhtbhn.exe87⤵PID:2500
-
\??\c:\jjdvd.exec:\jjdvd.exe88⤵PID:1800
-
\??\c:\ffrrlxl.exec:\ffrrlxl.exe89⤵PID:2544
-
\??\c:\9hthhh.exec:\9hthhh.exe90⤵PID:972
-
\??\c:\vpvvd.exec:\vpvvd.exe91⤵PID:2556
-
\??\c:\xfrlffl.exec:\xfrlffl.exe92⤵PID:1520
-
\??\c:\bbtbnh.exec:\bbtbnh.exe93⤵PID:664
-
\??\c:\nthtnn.exec:\nthtnn.exe94⤵PID:1664
-
\??\c:\3rrxffl.exec:\3rrxffl.exe95⤵PID:2512
-
\??\c:\tbhtth.exec:\tbhtth.exe96⤵PID:1668
-
\??\c:\jjjvd.exec:\jjjvd.exe97⤵PID:2744
-
\??\c:\rfrffrf.exec:\rfrffrf.exe98⤵PID:264
-
\??\c:\tbnbnt.exec:\tbnbnt.exe99⤵PID:1844
-
\??\c:\bnhtnb.exec:\bnhtnb.exe100⤵PID:1316
-
\??\c:\9ffrfrl.exec:\9ffrfrl.exe101⤵PID:1636
-
\??\c:\7fxfrxl.exec:\7fxfrxl.exe102⤵PID:2540
-
\??\c:\jjdjp.exec:\jjdjp.exe103⤵PID:1112
-
\??\c:\dvpvd.exec:\dvpvd.exe104⤵PID:2748
-
\??\c:\lfxxllx.exec:\lfxxllx.exe105⤵PID:584
-
\??\c:\ntnnbn.exec:\ntnnbn.exe106⤵PID:680
-
\??\c:\ntthbt.exec:\ntthbt.exe107⤵PID:2184
-
\??\c:\ppddp.exec:\ppddp.exe108⤵PID:748
-
\??\c:\xffllfr.exec:\xffllfr.exe109⤵PID:2424
-
\??\c:\dvvdd.exec:\dvvdd.exe110⤵PID:1976
-
\??\c:\xxrxlrr.exec:\xxrxlrr.exe111⤵PID:3020
-
\??\c:\nhbbhh.exec:\nhbbhh.exe112⤵PID:1904
-
\??\c:\jpjjd.exec:\jpjjd.exe113⤵PID:2864
-
\??\c:\xrlrrlr.exec:\xrlrrlr.exe114⤵PID:1932
-
\??\c:\lfrflrl.exec:\lfrflrl.exe115⤵PID:2160
-
\??\c:\9hnnhn.exec:\9hnnhn.exe116⤵PID:2280
-
\??\c:\pjvdp.exec:\pjvdp.exe117⤵PID:2312
-
\??\c:\fllxrrr.exec:\fllxrrr.exe118⤵PID:2412
-
\??\c:\nhbhtb.exec:\nhbhtb.exe119⤵PID:2252
-
\??\c:\pjdjv.exec:\pjdjv.exe120⤵PID:2276
-
\??\c:\ddpvp.exec:\ddpvp.exe121⤵PID:2964
-
\??\c:\1rllfxx.exec:\1rllfxx.exe122⤵PID:1984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-