Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/10/2024, 23:11
Behavioral task
behavioral1
Sample
d9da6dd3e0afb5607695c7203372ae6a5441d25e6dc451831c93e09a52daf5f8N.exe
Resource
win7-20240708-en
General
-
Target
d9da6dd3e0afb5607695c7203372ae6a5441d25e6dc451831c93e09a52daf5f8N.exe
-
Size
3.7MB
-
MD5
e0b2850054fbaa6aabd4d31722815020
-
SHA1
3c1a5268eb58f7d5166b440c118a4759549dc0f2
-
SHA256
d9da6dd3e0afb5607695c7203372ae6a5441d25e6dc451831c93e09a52daf5f8
-
SHA512
7bed9117f881358e6fa768470bc00dc41f69ab32bcd6dc7723d94340f48b8278963c81508ca1301c2a8bef955660337cd9b1d8d43bc1cbe0cea1600ccebed8a6
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98J:U6XLq/qPPslzKx/dJg1ErmNk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/1700-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/340-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/340-24-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1836-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-85-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2624-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1564-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-104-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1960-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1540-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1432-145-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1432-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-192-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2640-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1456-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/908-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1680-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/688-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1912-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/480-455-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/480-459-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3024-531-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-578-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-597-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1836-605-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-604-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1836-612-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-653-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-665-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2612-685-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1424-688-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/308-773-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/596-774-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-826-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-835-0x00000000002F0000-0x0000000000317000-memory.dmp family_blackmoon behavioral1/memory/680-879-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-897-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/1640-908-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1396-934-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-952-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 2380 fxxxffl.exe 340 ddvvp.exe 1836 ppdjp.exe 2780 dvpdd.exe 2804 ddpdj.exe 2732 1xflrxf.exe 2232 vvjvj.exe 2624 rlxrxfl.exe 1564 jdpvd.exe 1960 nhbbnh.exe 2768 ffxfflr.exe 1540 ffxrlrf.exe 3008 jdvpd.exe 2776 rrrlflx.exe 1432 btnnnb.exe 2940 pjddd.exe 848 dvjvj.exe 3056 tthtnb.exe 3020 fxrlxrf.exe 2640 hnnthn.exe 2316 pdvjj.exe 2160 ppdpj.exe 596 lxxrxxx.exe 1456 fxrxrlr.exe 292 5rrlrfl.exe 1232 btntnh.exe 1632 nntbhb.exe 908 nnnnnb.exe 1680 5hbbnt.exe 2344 xxxfxrf.exe 688 xrrrxrr.exe 1876 rrrlfxr.exe 2068 ntnbhb.exe 2520 flrxxxl.exe 2552 ppppd.exe 1712 1fxlrfl.exe 2532 1lflflr.exe 872 lllxrll.exe 2280 9bbbth.exe 2844 bhnbth.exe 2804 7fxfxlr.exe 2760 frxrrxf.exe 2792 pjjdj.exe 2800 9jvjv.exe 2612 9vpvd.exe 1564 btnntt.exe 2024 nhbtbn.exe 1536 1rrfrfr.exe 2948 xrfxfrl.exe 1912 pjvvj.exe 2932 tntttb.exe 2688 nnttnh.exe 1120 lrlxflx.exe 1508 jjdvp.exe 2440 nnnbnn.exe 2936 ttthtt.exe 480 rlfxxlf.exe 1356 9jvvj.exe 2012 dpjpp.exe 884 nnhnbt.exe 308 fflxrrf.exe 596 jjjdv.exe 1880 vpjpd.exe 2952 ttbnht.exe -
resource yara_rule behavioral1/memory/1700-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c00000001225f-5.dat upx behavioral1/memory/2380-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1700-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015fe0-17.dat upx behavioral1/memory/2380-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/340-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000161fb-29.dat upx behavioral1/memory/1836-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a0000000163b8-40.dat upx behavioral1/memory/2780-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000164b1-48.dat upx behavioral1/memory/2780-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2804-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015d66-57.dat upx behavioral1/files/0x000700000001653a-65.dat upx behavioral1/memory/2232-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001678f-76.dat upx behavioral1/memory/2232-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000169f5-86.dat upx behavioral1/memory/2624-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016be6-95.dat upx behavioral1/memory/1960-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1564-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d5a-105.dat upx behavioral1/memory/1960-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d71-114.dat upx behavioral1/memory/2768-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1540-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016e1d-123.dat upx behavioral1/files/0x0006000000016f45-133.dat upx behavioral1/files/0x0006000000017342-140.dat upx behavioral1/files/0x0006000000017349-150.dat upx behavioral1/memory/1432-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017355-160.dat upx behavioral1/memory/2940-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001739f-167.dat upx behavioral1/files/0x00060000000173a3-175.dat upx behavioral1/files/0x00060000000173ab-183.dat upx behavioral1/files/0x0006000000017420-194.dat upx behavioral1/memory/2640-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017429-201.dat upx behavioral1/files/0x0006000000017447-211.dat upx behavioral1/files/0x0006000000017467-220.dat upx behavioral1/memory/1456-219-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/292-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017520-231.dat upx behavioral1/memory/1456-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000018617-239.dat upx behavioral1/memory/1632-248-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018634-247.dat upx behavioral1/memory/908-256-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018636-257.dat upx behavioral1/files/0x0005000000018741-265.dat upx behavioral1/memory/908-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001907c-275.dat upx behavioral1/memory/1680-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/688-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019080-284.dat upx behavioral1/memory/2344-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001919c-293.dat upx behavioral1/memory/2552-318-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2532-325-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2844-344-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxlxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfffrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrffrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1700 wrote to memory of 2380 1700 d9da6dd3e0afb5607695c7203372ae6a5441d25e6dc451831c93e09a52daf5f8N.exe 30 PID 1700 wrote to memory of 2380 1700 d9da6dd3e0afb5607695c7203372ae6a5441d25e6dc451831c93e09a52daf5f8N.exe 30 PID 1700 wrote to memory of 2380 1700 d9da6dd3e0afb5607695c7203372ae6a5441d25e6dc451831c93e09a52daf5f8N.exe 30 PID 1700 wrote to memory of 2380 1700 d9da6dd3e0afb5607695c7203372ae6a5441d25e6dc451831c93e09a52daf5f8N.exe 30 PID 2380 wrote to memory of 340 2380 fxxxffl.exe 31 PID 2380 wrote to memory of 340 2380 fxxxffl.exe 31 PID 2380 wrote to memory of 340 2380 fxxxffl.exe 31 PID 2380 wrote to memory of 340 2380 fxxxffl.exe 31 PID 340 wrote to memory of 1836 340 ddvvp.exe 32 PID 340 wrote to memory of 1836 340 ddvvp.exe 32 PID 340 wrote to memory of 1836 340 ddvvp.exe 32 PID 340 wrote to memory of 1836 340 ddvvp.exe 32 PID 1836 wrote to memory of 2780 1836 ppdjp.exe 33 PID 1836 wrote to memory of 2780 1836 ppdjp.exe 33 PID 1836 wrote to memory of 2780 1836 ppdjp.exe 33 PID 1836 wrote to memory of 2780 1836 ppdjp.exe 33 PID 2780 wrote to memory of 2804 2780 dvpdd.exe 34 PID 2780 wrote to memory of 2804 2780 dvpdd.exe 34 PID 2780 wrote to memory of 2804 2780 dvpdd.exe 34 PID 2780 wrote to memory of 2804 2780 dvpdd.exe 34 PID 2804 wrote to memory of 2732 2804 ddpdj.exe 35 PID 2804 wrote to memory of 2732 2804 ddpdj.exe 35 PID 2804 wrote to memory of 2732 2804 ddpdj.exe 35 PID 2804 wrote to memory of 2732 2804 ddpdj.exe 35 PID 2732 wrote to memory of 2232 2732 1xflrxf.exe 36 PID 2732 wrote to memory of 2232 2732 1xflrxf.exe 36 PID 2732 wrote to memory of 2232 2732 1xflrxf.exe 36 PID 2732 wrote to memory of 2232 2732 1xflrxf.exe 36 PID 2232 wrote to memory of 2624 2232 vvjvj.exe 37 PID 2232 wrote to memory of 2624 2232 vvjvj.exe 37 PID 2232 wrote to memory of 2624 2232 vvjvj.exe 37 PID 2232 wrote to memory of 2624 2232 vvjvj.exe 37 PID 2624 wrote to memory of 1564 2624 rlxrxfl.exe 76 PID 2624 wrote to memory of 1564 2624 rlxrxfl.exe 76 PID 2624 wrote to memory of 1564 2624 rlxrxfl.exe 76 PID 2624 wrote to memory of 1564 2624 rlxrxfl.exe 76 PID 1564 wrote to memory of 1960 1564 jdpvd.exe 39 PID 1564 wrote to memory of 1960 1564 jdpvd.exe 39 PID 1564 wrote to memory of 1960 1564 jdpvd.exe 39 PID 1564 wrote to memory of 1960 1564 jdpvd.exe 39 PID 1960 wrote to memory of 2768 1960 nhbbnh.exe 40 PID 1960 wrote to memory of 2768 1960 nhbbnh.exe 40 PID 1960 wrote to memory of 2768 1960 nhbbnh.exe 40 PID 1960 wrote to memory of 2768 1960 nhbbnh.exe 40 PID 2768 wrote to memory of 1540 2768 ffxfflr.exe 41 PID 2768 wrote to memory of 1540 2768 ffxfflr.exe 41 PID 2768 wrote to memory of 1540 2768 ffxfflr.exe 41 PID 2768 wrote to memory of 1540 2768 ffxfflr.exe 41 PID 1540 wrote to memory of 3008 1540 ffxrlrf.exe 42 PID 1540 wrote to memory of 3008 1540 ffxrlrf.exe 42 PID 1540 wrote to memory of 3008 1540 ffxrlrf.exe 42 PID 1540 wrote to memory of 3008 1540 ffxrlrf.exe 42 PID 3008 wrote to memory of 2776 3008 jdvpd.exe 43 PID 3008 wrote to memory of 2776 3008 jdvpd.exe 43 PID 3008 wrote to memory of 2776 3008 jdvpd.exe 43 PID 3008 wrote to memory of 2776 3008 jdvpd.exe 43 PID 2776 wrote to memory of 1432 2776 rrrlflx.exe 44 PID 2776 wrote to memory of 1432 2776 rrrlflx.exe 44 PID 2776 wrote to memory of 1432 2776 rrrlflx.exe 44 PID 2776 wrote to memory of 1432 2776 rrrlflx.exe 44 PID 1432 wrote to memory of 2940 1432 btnnnb.exe 45 PID 1432 wrote to memory of 2940 1432 btnnnb.exe 45 PID 1432 wrote to memory of 2940 1432 btnnnb.exe 45 PID 1432 wrote to memory of 2940 1432 btnnnb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9da6dd3e0afb5607695c7203372ae6a5441d25e6dc451831c93e09a52daf5f8N.exe"C:\Users\Admin\AppData\Local\Temp\d9da6dd3e0afb5607695c7203372ae6a5441d25e6dc451831c93e09a52daf5f8N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\fxxxffl.exec:\fxxxffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\ddvvp.exec:\ddvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
\??\c:\ppdjp.exec:\ppdjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\dvpdd.exec:\dvpdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\ddpdj.exec:\ddpdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\1xflrxf.exec:\1xflrxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\vvjvj.exec:\vvjvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\rlxrxfl.exec:\rlxrxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\jdpvd.exec:\jdpvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\nhbbnh.exec:\nhbbnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\ffxfflr.exec:\ffxfflr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\ffxrlrf.exec:\ffxrlrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\jdvpd.exec:\jdvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\rrrlflx.exec:\rrrlflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\btnnnb.exec:\btnnnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\pjddd.exec:\pjddd.exe17⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dvjvj.exec:\dvjvj.exe18⤵
- Executes dropped EXE
PID:848 -
\??\c:\tthtnb.exec:\tthtnb.exe19⤵
- Executes dropped EXE
PID:3056 -
\??\c:\fxrlxrf.exec:\fxrlxrf.exe20⤵
- Executes dropped EXE
PID:3020 -
\??\c:\hnnthn.exec:\hnnthn.exe21⤵
- Executes dropped EXE
PID:2640 -
\??\c:\pdvjj.exec:\pdvjj.exe22⤵
- Executes dropped EXE
PID:2316 -
\??\c:\ppdpj.exec:\ppdpj.exe23⤵
- Executes dropped EXE
PID:2160 -
\??\c:\lxxrxxx.exec:\lxxrxxx.exe24⤵
- Executes dropped EXE
PID:596 -
\??\c:\fxrxrlr.exec:\fxrxrlr.exe25⤵
- Executes dropped EXE
PID:1456 -
\??\c:\5rrlrfl.exec:\5rrlrfl.exe26⤵
- Executes dropped EXE
PID:292 -
\??\c:\btntnh.exec:\btntnh.exe27⤵
- Executes dropped EXE
PID:1232 -
\??\c:\nntbhb.exec:\nntbhb.exe28⤵
- Executes dropped EXE
PID:1632 -
\??\c:\nnnnnb.exec:\nnnnnb.exe29⤵
- Executes dropped EXE
PID:908 -
\??\c:\5hbbnt.exec:\5hbbnt.exe30⤵
- Executes dropped EXE
PID:1680 -
\??\c:\xxxfxrf.exec:\xxxfxrf.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2344 -
\??\c:\xrrrxrr.exec:\xrrrxrr.exe32⤵
- Executes dropped EXE
PID:688 -
\??\c:\rrrlfxr.exec:\rrrlfxr.exe33⤵
- Executes dropped EXE
PID:1876 -
\??\c:\ntnbhb.exec:\ntnbhb.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2068 -
\??\c:\flrxxxl.exec:\flrxxxl.exe35⤵
- Executes dropped EXE
PID:2520 -
\??\c:\ppppd.exec:\ppppd.exe36⤵
- Executes dropped EXE
PID:2552 -
\??\c:\1fxlrfl.exec:\1fxlrfl.exe37⤵
- Executes dropped EXE
PID:1712 -
\??\c:\1lflflr.exec:\1lflflr.exe38⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lllxrll.exec:\lllxrll.exe39⤵
- Executes dropped EXE
PID:872 -
\??\c:\9bbbth.exec:\9bbbth.exe40⤵
- Executes dropped EXE
PID:2280 -
\??\c:\bhnbth.exec:\bhnbth.exe41⤵
- Executes dropped EXE
PID:2844 -
\??\c:\7fxfxlr.exec:\7fxfxlr.exe42⤵
- Executes dropped EXE
PID:2804 -
\??\c:\frxrrxf.exec:\frxrrxf.exe43⤵
- Executes dropped EXE
PID:2760 -
\??\c:\pjjdj.exec:\pjjdj.exe44⤵
- Executes dropped EXE
PID:2792 -
\??\c:\9jvjv.exec:\9jvjv.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2800 -
\??\c:\9vpvd.exec:\9vpvd.exe46⤵
- Executes dropped EXE
PID:2612 -
\??\c:\btnntt.exec:\btnntt.exe47⤵
- Executes dropped EXE
PID:1564 -
\??\c:\nhbtbn.exec:\nhbtbn.exe48⤵
- Executes dropped EXE
PID:2024 -
\??\c:\1rrfrfr.exec:\1rrfrfr.exe49⤵
- Executes dropped EXE
PID:1536 -
\??\c:\xrfxfrl.exec:\xrfxfrl.exe50⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pjvvj.exec:\pjvvj.exe51⤵
- Executes dropped EXE
PID:1912 -
\??\c:\tntttb.exec:\tntttb.exe52⤵
- Executes dropped EXE
PID:2932 -
\??\c:\nnttnh.exec:\nnttnh.exe53⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lrlxflx.exec:\lrlxflx.exe54⤵
- Executes dropped EXE
PID:1120 -
\??\c:\jjdvp.exec:\jjdvp.exe55⤵
- Executes dropped EXE
PID:1508 -
\??\c:\nnnbnn.exec:\nnnbnn.exe56⤵
- Executes dropped EXE
PID:2440 -
\??\c:\ttthtt.exec:\ttthtt.exe57⤵
- Executes dropped EXE
PID:2936 -
\??\c:\rlfxxlf.exec:\rlfxxlf.exe58⤵
- Executes dropped EXE
PID:480 -
\??\c:\9jvvj.exec:\9jvvj.exe59⤵
- Executes dropped EXE
PID:1356 -
\??\c:\dpjpp.exec:\dpjpp.exe60⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nnhnbt.exec:\nnhnbt.exe61⤵
- Executes dropped EXE
PID:884 -
\??\c:\fflxrrf.exec:\fflxrrf.exe62⤵
- Executes dropped EXE
PID:308 -
\??\c:\jjjdv.exec:\jjjdv.exe63⤵
- Executes dropped EXE
PID:596 -
\??\c:\vpjpd.exec:\vpjpd.exe64⤵
- Executes dropped EXE
PID:1880 -
\??\c:\ttbnht.exec:\ttbnht.exe65⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hbnnhn.exec:\hbnnhn.exe66⤵PID:1828
-
\??\c:\xrrfrfl.exec:\xrrfrfl.exe67⤵PID:1232
-
\??\c:\jdpvj.exec:\jdpvj.exe68⤵PID:564
-
\??\c:\btthnt.exec:\btthnt.exe69⤵PID:3024
-
\??\c:\1tnnhb.exec:\1tnnhb.exe70⤵PID:1140
-
\??\c:\rxxfxxl.exec:\rxxfxxl.exe71⤵PID:2416
-
\??\c:\vvpvj.exec:\vvpvj.exe72⤵PID:2164
-
\??\c:\ttnhtb.exec:\ttnhtb.exe73⤵PID:688
-
\??\c:\ttbbtn.exec:\ttbbtn.exe74⤵PID:2052
-
\??\c:\fllxrlx.exec:\fllxrlx.exe75⤵PID:1788
-
\??\c:\vvdvp.exec:\vvdvp.exe76⤵PID:1520
-
\??\c:\5hbtbn.exec:\5hbtbn.exe77⤵PID:2016
-
\??\c:\bbhbnb.exec:\bbhbnb.exe78⤵PID:1628
-
\??\c:\fxxfrxl.exec:\fxxfrxl.exe79⤵PID:1976
-
\??\c:\pjvpd.exec:\pjvpd.exe80⤵PID:2532
-
\??\c:\vvpvp.exec:\vvpvp.exe81⤵PID:1836
-
\??\c:\nhnnhh.exec:\nhnnhh.exe82⤵PID:2368
-
\??\c:\lfrlxll.exec:\lfrlxll.exe83⤵PID:2844
-
\??\c:\ffxrrlf.exec:\ffxrrlf.exe84⤵PID:2732
-
\??\c:\7vpvp.exec:\7vpvp.exe85⤵PID:1208
-
\??\c:\jdddv.exec:\jdddv.exe86⤵PID:1780
-
\??\c:\hbbnbb.exec:\hbbnbb.exe87⤵PID:2600
-
\??\c:\9htbtb.exec:\9htbtb.exe88⤵PID:2800
-
\??\c:\rrflrfx.exec:\rrflrfx.exe89⤵PID:2612
-
\??\c:\5vpvd.exec:\5vpvd.exe90⤵PID:2496
-
\??\c:\vdppj.exec:\vdppj.exe91⤵PID:2768
-
\??\c:\ppjdp.exec:\ppjdp.exe92⤵PID:1968
-
\??\c:\ppjjd.exec:\ppjjd.exe93⤵PID:1424
-
\??\c:\jjvjp.exec:\jjvjp.exe94⤵PID:2924
-
\??\c:\pdvpv.exec:\pdvpv.exe95⤵PID:2072
-
\??\c:\pdddd.exec:\pdddd.exe96⤵PID:344
-
\??\c:\hbbnhh.exec:\hbbnhh.exe97⤵PID:1868
-
\??\c:\ttbhth.exec:\ttbhth.exe98⤵PID:1928
-
\??\c:\rrrfrfr.exec:\rrrfrfr.exe99⤵
- System Location Discovery: System Language Discovery
PID:848 -
\??\c:\fxxxrxx.exec:\fxxxrxx.exe100⤵PID:1340
-
\??\c:\frxrrlf.exec:\frxrrlf.exe101⤵PID:532
-
\??\c:\ddjdp.exec:\ddjdp.exe102⤵PID:2696
-
\??\c:\vdjvp.exec:\vdjvp.exe103⤵PID:2540
-
\??\c:\bthtnh.exec:\bthtnh.exe104⤵PID:2224
-
\??\c:\htntbt.exec:\htntbt.exe105⤵PID:884
-
\??\c:\5xlllxx.exec:\5xlllxx.exe106⤵PID:308
-
\??\c:\rrxrxlx.exec:\rrxrxlx.exe107⤵PID:596
-
\??\c:\vvppd.exec:\vvppd.exe108⤵PID:1176
-
\??\c:\vpjjp.exec:\vpjjp.exe109⤵PID:1932
-
\??\c:\btntbn.exec:\btntbn.exe110⤵PID:1828
-
\??\c:\lffrfrf.exec:\lffrfrf.exe111⤵PID:1548
-
\??\c:\tthhht.exec:\tthhht.exe112⤵PID:1008
-
\??\c:\3xxllxx.exec:\3xxllxx.exe113⤵PID:2284
-
\??\c:\dvpjp.exec:\dvpjp.exe114⤵
- System Location Discovery: System Language Discovery
PID:1140 -
\??\c:\ppvjd.exec:\ppvjd.exe115⤵PID:1820
-
\??\c:\nnbtnb.exec:\nnbtnb.exe116⤵PID:1624
-
\??\c:\7bnbbn.exec:\7bnbbn.exe117⤵PID:2244
-
\??\c:\nbhtth.exec:\nbhtth.exe118⤵PID:2400
-
\??\c:\hnbnbn.exec:\hnbnbn.exe119⤵PID:2396
-
\??\c:\rfflxxf.exec:\rfflxxf.exe120⤵PID:1616
-
\??\c:\nhbbnb.exec:\nhbbnb.exe121⤵PID:2516
-
\??\c:\1xxxfll.exec:\1xxxfll.exe122⤵PID:2536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-