Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/11/2024, 22:10
Behavioral task
behavioral1
Sample
30238636680235647405104d7d771295b462bab8383ab70c596fdc036d707747.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
General
-
Target
30238636680235647405104d7d771295b462bab8383ab70c596fdc036d707747.exe
-
Size
1.9MB
-
MD5
739a4cc33f07c69c7a37b5848967ce9b
-
SHA1
a2aab686705709fa39475da23b327a4c919867d9
-
SHA256
30238636680235647405104d7d771295b462bab8383ab70c596fdc036d707747
-
SHA512
886d831ef51a8c5709fc818080f6262f71a1fd9ad954704d49812fd7485af6fe7719c2a676203fb2b04385f0d26627edd7ff25449bf40e8e39e55d8d2a39a564
-
SSDEEP
24576:gC8d36kLBXlnB8j7v5Ta+hLLQ20JmXSeWwa1oWJQjk0svTS/PPsbb1hwR4j:gCOfN6X5tLLQTg20ITS/PPs/1kk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2364-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-27-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2220-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-53-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2644-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-88-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2696-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-99-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1936-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1128-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/968-208-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2404-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1552-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2324-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1184-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-513-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-533-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1800-558-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2888-595-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1316-615-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2796-667-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/444-719-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1044-775-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/764-795-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1836-809-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-808-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-822-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2808-718-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/816-441-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1500-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/692-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-79-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2812-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-67-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2752-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-57-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2780-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 2544 bbtnbt.exe 2988 rrrlrlf.exe 2220 vvvpp.exe 2780 nbbhnb.exe 2752 ttbtbn.exe 2812 fxxlfrl.exe 2644 hhtthb.exe 2360 llxrxrr.exe 2696 pdppv.exe 1936 9bbtbt.exe 1128 7vvpv.exe 3068 fxfxxxx.exe 1536 xrlrrrr.exe 1512 pjjdp.exe 2016 jjpvd.exe 2068 ntbttn.exe 2248 hhthbh.exe 756 fxrrffl.exe 2604 5jdjp.exe 692 btbbbt.exe 968 xxxrflx.exe 1252 vvpdp.exe 1084 pvvvp.exe 2404 bhntnt.exe 1552 flrxxfx.exe 2380 pdddd.exe 2384 rxfrlxx.exe 984 pvvjd.exe 2232 tttthh.exe 1500 flxfrrr.exe 2276 ttnhnh.exe 1636 rxrxfll.exe 2984 jdpjj.exe 2352 dvppp.exe 2056 tbtbnh.exe 2188 5xfffxx.exe 2732 vddpp.exe 2312 bntbtb.exe 2724 ntbbhb.exe 2980 xxrflrr.exe 2644 3tnbbn.exe 2516 pppdv.exe 2728 nnntnh.exe 2788 xfrxxfl.exe 1936 jvdpd.exe 2940 tnhnbb.exe 2052 thnntn.exe 3044 lrrxlxr.exe 1536 thhtbb.exe 2820 ffrflff.exe 524 djpjp.exe 1944 ttbbnt.exe 816 rrfrflx.exe 2324 hbhtbh.exe 444 1ffllff.exe 2684 bnbbbn.exe 2420 lrffrrx.exe 1724 dppdv.exe 1184 hnbtbh.exe 1964 rlrfrxl.exe 1084 ddpdp.exe 2404 nnbtbb.exe 2712 xrlfllf.exe 2844 1vvpv.exe -
resource yara_rule behavioral1/memory/2364-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000015ceb-5.dat upx behavioral1/memory/2364-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015da1-19.dat upx behavioral1/memory/2988-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015f4c-30.dat upx behavioral1/memory/2220-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015fba-41.dat upx behavioral1/files/0x0007000000016033-49.dat upx behavioral1/files/0x000a000000016136-61.dat upx behavioral1/memory/2644-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001878d-81.dat upx behavioral1/memory/2696-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000015d68-101.dat upx behavioral1/files/0x00060000000190c9-110.dat upx behavioral1/memory/1936-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3068-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1128-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191f3-121.dat upx behavioral1/memory/1536-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191fd-130.dat upx behavioral1/files/0x0005000000019217-140.dat upx behavioral1/files/0x0005000000019220-148.dat upx behavioral1/memory/2016-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019238-156.dat upx behavioral1/files/0x0005000000019240-167.dat upx behavioral1/memory/2248-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2068-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001925d-176.dat upx behavioral1/memory/2248-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019263-184.dat upx behavioral1/memory/2604-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019278-193.dat upx behavioral1/files/0x0005000000019280-200.dat upx behavioral1/files/0x000500000001938b-210.dat upx behavioral1/memory/968-208-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019399-219.dat upx behavioral1/files/0x00050000000193b7-226.dat upx behavioral1/files/0x00050000000193c1-236.dat upx behavioral1/memory/2404-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193c8-247.dat upx behavioral1/memory/2380-246-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1552-244-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193d4-256.dat upx behavioral1/memory/2384-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/984-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193ec-265.dat upx behavioral1/files/0x0005000000019417-273.dat upx behavioral1/files/0x000500000001941a-281.dat upx behavioral1/files/0x0005000000019436-290.dat upx behavioral1/files/0x0005000000019441-297.dat upx behavioral1/memory/2724-341-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2644-354-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2728-370-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1936-384-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2788-383-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/816-434-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2324-442-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/444-449-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2420-462-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1184-481-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2404-494-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2844-513-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1508-520-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2544 2364 30238636680235647405104d7d771295b462bab8383ab70c596fdc036d707747.exe 102 PID 2364 wrote to memory of 2544 2364 30238636680235647405104d7d771295b462bab8383ab70c596fdc036d707747.exe 102 PID 2364 wrote to memory of 2544 2364 30238636680235647405104d7d771295b462bab8383ab70c596fdc036d707747.exe 102 PID 2364 wrote to memory of 2544 2364 30238636680235647405104d7d771295b462bab8383ab70c596fdc036d707747.exe 102 PID 2544 wrote to memory of 2988 2544 bbtnbt.exe 32 PID 2544 wrote to memory of 2988 2544 bbtnbt.exe 32 PID 2544 wrote to memory of 2988 2544 bbtnbt.exe 32 PID 2544 wrote to memory of 2988 2544 bbtnbt.exe 32 PID 2988 wrote to memory of 2220 2988 rrrlrlf.exe 33 PID 2988 wrote to memory of 2220 2988 rrrlrlf.exe 33 PID 2988 wrote to memory of 2220 2988 rrrlrlf.exe 33 PID 2988 wrote to memory of 2220 2988 rrrlrlf.exe 33 PID 2220 wrote to memory of 2780 2220 vvvpp.exe 34 PID 2220 wrote to memory of 2780 2220 vvvpp.exe 34 PID 2220 wrote to memory of 2780 2220 vvvpp.exe 34 PID 2220 wrote to memory of 2780 2220 vvvpp.exe 34 PID 2780 wrote to memory of 2752 2780 nbbhnb.exe 35 PID 2780 wrote to memory of 2752 2780 nbbhnb.exe 35 PID 2780 wrote to memory of 2752 2780 nbbhnb.exe 35 PID 2780 wrote to memory of 2752 2780 nbbhnb.exe 35 PID 2752 wrote to memory of 2812 2752 ttbtbn.exe 192 PID 2752 wrote to memory of 2812 2752 ttbtbn.exe 192 PID 2752 wrote to memory of 2812 2752 ttbtbn.exe 192 PID 2752 wrote to memory of 2812 2752 ttbtbn.exe 192 PID 2812 wrote to memory of 2644 2812 fxxlfrl.exe 71 PID 2812 wrote to memory of 2644 2812 fxxlfrl.exe 71 PID 2812 wrote to memory of 2644 2812 fxxlfrl.exe 71 PID 2812 wrote to memory of 2644 2812 fxxlfrl.exe 71 PID 2644 wrote to memory of 2360 2644 hhtthb.exe 38 PID 2644 wrote to memory of 2360 2644 hhtthb.exe 38 PID 2644 wrote to memory of 2360 2644 hhtthb.exe 38 PID 2644 wrote to memory of 2360 2644 hhtthb.exe 38 PID 2360 wrote to memory of 2696 2360 llxrxrr.exe 39 PID 2360 wrote to memory of 2696 2360 llxrxrr.exe 39 PID 2360 wrote to memory of 2696 2360 llxrxrr.exe 39 PID 2360 wrote to memory of 2696 2360 llxrxrr.exe 39 PID 2696 wrote to memory of 1936 2696 pdppv.exe 75 PID 2696 wrote to memory of 1936 2696 pdppv.exe 75 PID 2696 wrote to memory of 1936 2696 pdppv.exe 75 PID 2696 wrote to memory of 1936 2696 pdppv.exe 75 PID 1936 wrote to memory of 1128 1936 9bbtbt.exe 41 PID 1936 wrote to memory of 1128 1936 9bbtbt.exe 41 PID 1936 wrote to memory of 1128 1936 9bbtbt.exe 41 PID 1936 wrote to memory of 1128 1936 9bbtbt.exe 41 PID 1128 wrote to memory of 3068 1128 7vvpv.exe 42 PID 1128 wrote to memory of 3068 1128 7vvpv.exe 42 PID 1128 wrote to memory of 3068 1128 7vvpv.exe 42 PID 1128 wrote to memory of 3068 1128 7vvpv.exe 42 PID 3068 wrote to memory of 1536 3068 fxfxxxx.exe 43 PID 3068 wrote to memory of 1536 3068 fxfxxxx.exe 43 PID 3068 wrote to memory of 1536 3068 fxfxxxx.exe 43 PID 3068 wrote to memory of 1536 3068 fxfxxxx.exe 43 PID 1536 wrote to memory of 1512 1536 xrlrrrr.exe 44 PID 1536 wrote to memory of 1512 1536 xrlrrrr.exe 44 PID 1536 wrote to memory of 1512 1536 xrlrrrr.exe 44 PID 1536 wrote to memory of 1512 1536 xrlrrrr.exe 44 PID 1512 wrote to memory of 2016 1512 pjjdp.exe 122 PID 1512 wrote to memory of 2016 1512 pjjdp.exe 122 PID 1512 wrote to memory of 2016 1512 pjjdp.exe 122 PID 1512 wrote to memory of 2016 1512 pjjdp.exe 122 PID 2016 wrote to memory of 2068 2016 jjpvd.exe 125 PID 2016 wrote to memory of 2068 2016 jjpvd.exe 125 PID 2016 wrote to memory of 2068 2016 jjpvd.exe 125 PID 2016 wrote to memory of 2068 2016 jjpvd.exe 125
Processes
-
C:\Users\Admin\AppData\Local\Temp\30238636680235647405104d7d771295b462bab8383ab70c596fdc036d707747.exe"C:\Users\Admin\AppData\Local\Temp\30238636680235647405104d7d771295b462bab8383ab70c596fdc036d707747.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\bbtnbt.exec:\bbtnbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\rrrlrlf.exec:\rrrlrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\vvvpp.exec:\vvvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\nbbhnb.exec:\nbbhnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\ttbtbn.exec:\ttbtbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\fxxlfrl.exec:\fxxlfrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\hhtthb.exec:\hhtthb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\llxrxrr.exec:\llxrxrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\pdppv.exec:\pdppv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\9bbtbt.exec:\9bbtbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\7vvpv.exec:\7vvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\xrlrrrr.exec:\xrlrrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\pjjdp.exec:\pjjdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\jjpvd.exec:\jjpvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\ntbttn.exec:\ntbttn.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2068 -
\??\c:\hhthbh.exec:\hhthbh.exe18⤵
- Executes dropped EXE
PID:2248 -
\??\c:\fxrrffl.exec:\fxrrffl.exe19⤵
- Executes dropped EXE
PID:756 -
\??\c:\5jdjp.exec:\5jdjp.exe20⤵
- Executes dropped EXE
PID:2604 -
\??\c:\btbbbt.exec:\btbbbt.exe21⤵
- Executes dropped EXE
PID:692 -
\??\c:\xxxrflx.exec:\xxxrflx.exe22⤵
- Executes dropped EXE
PID:968 -
\??\c:\vvpdp.exec:\vvpdp.exe23⤵
- Executes dropped EXE
PID:1252 -
\??\c:\pvvvp.exec:\pvvvp.exe24⤵
- Executes dropped EXE
PID:1084 -
\??\c:\bhntnt.exec:\bhntnt.exe25⤵
- Executes dropped EXE
PID:2404 -
\??\c:\flrxxfx.exec:\flrxxfx.exe26⤵
- Executes dropped EXE
PID:1552 -
\??\c:\pdddd.exec:\pdddd.exe27⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rxfrlxx.exec:\rxfrlxx.exe28⤵
- Executes dropped EXE
PID:2384 -
\??\c:\pvvjd.exec:\pvvjd.exe29⤵
- Executes dropped EXE
PID:984 -
\??\c:\tttthh.exec:\tttthh.exe30⤵
- Executes dropped EXE
PID:2232 -
\??\c:\flxfrrr.exec:\flxfrrr.exe31⤵
- Executes dropped EXE
PID:1500 -
\??\c:\ttnhnh.exec:\ttnhnh.exe32⤵
- Executes dropped EXE
PID:2276 -
\??\c:\rxrxfll.exec:\rxrxfll.exe33⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jdpjj.exec:\jdpjj.exe34⤵
- Executes dropped EXE
PID:2984 -
\??\c:\dvppp.exec:\dvppp.exe35⤵
- Executes dropped EXE
PID:2352 -
\??\c:\tbtbnh.exec:\tbtbnh.exe36⤵
- Executes dropped EXE
PID:2056 -
\??\c:\5xfffxx.exec:\5xfffxx.exe37⤵
- Executes dropped EXE
PID:2188 -
\??\c:\vddpp.exec:\vddpp.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2732 -
\??\c:\bntbtb.exec:\bntbtb.exe39⤵
- Executes dropped EXE
PID:2312 -
\??\c:\ntbbhb.exec:\ntbbhb.exe40⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xxrflrr.exec:\xxrflrr.exe41⤵
- Executes dropped EXE
PID:2980 -
\??\c:\3tnbbn.exec:\3tnbbn.exe42⤵
- Executes dropped EXE
PID:2644 -
\??\c:\pppdv.exec:\pppdv.exe43⤵
- Executes dropped EXE
PID:2516 -
\??\c:\nnntnh.exec:\nnntnh.exe44⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xfrxxfl.exec:\xfrxxfl.exe45⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jvdpd.exec:\jvdpd.exe46⤵
- Executes dropped EXE
PID:1936 -
\??\c:\tnhnbb.exec:\tnhnbb.exe47⤵
- Executes dropped EXE
PID:2940 -
\??\c:\thnntn.exec:\thnntn.exe48⤵
- Executes dropped EXE
PID:2052 -
\??\c:\lrrxlxr.exec:\lrrxlxr.exe49⤵
- Executes dropped EXE
PID:3044 -
\??\c:\thhtbb.exec:\thhtbb.exe50⤵
- Executes dropped EXE
PID:1536 -
\??\c:\ffrflff.exec:\ffrflff.exe51⤵
- Executes dropped EXE
PID:2820 -
\??\c:\djpjp.exec:\djpjp.exe52⤵
- Executes dropped EXE
PID:524 -
\??\c:\ttbbnt.exec:\ttbbnt.exe53⤵
- Executes dropped EXE
PID:1944 -
\??\c:\rrfrflx.exec:\rrfrflx.exe54⤵
- Executes dropped EXE
PID:816 -
\??\c:\hbhtbh.exec:\hbhtbh.exe55⤵
- Executes dropped EXE
PID:2324 -
\??\c:\1ffllff.exec:\1ffllff.exe56⤵
- Executes dropped EXE
PID:444 -
\??\c:\bnbbbn.exec:\bnbbbn.exe57⤵
- Executes dropped EXE
PID:2684 -
\??\c:\lrffrrx.exec:\lrffrrx.exe58⤵
- Executes dropped EXE
PID:2420 -
\??\c:\dppdv.exec:\dppdv.exe59⤵
- Executes dropped EXE
PID:1724 -
\??\c:\hnbtbh.exec:\hnbtbh.exe60⤵
- Executes dropped EXE
PID:1184 -
\??\c:\rlrfrxl.exec:\rlrfrxl.exe61⤵
- Executes dropped EXE
PID:1964 -
\??\c:\ddpdp.exec:\ddpdp.exe62⤵
- Executes dropped EXE
PID:1084 -
\??\c:\nnbtbb.exec:\nnbtbb.exe63⤵
- Executes dropped EXE
PID:2404 -
\??\c:\xrlfllf.exec:\xrlfllf.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2712 -
\??\c:\1vvpv.exec:\1vvpv.exe65⤵
- Executes dropped EXE
PID:2844 -
\??\c:\ttnbhb.exec:\ttnbhb.exe66⤵PID:1508
-
\??\c:\rfxlfxf.exec:\rfxlfxf.exe67⤵PID:2224
-
\??\c:\ddpjj.exec:\ddpjj.exe68⤵PID:2272
-
\??\c:\llllrrf.exec:\llllrrf.exe69⤵PID:308
-
\??\c:\9pjjp.exec:\9pjjp.exe70⤵PID:888
-
\??\c:\tbbnbh.exec:\tbbnbh.exe71⤵PID:268
-
\??\c:\9llxlrf.exec:\9llxlrf.exe72⤵PID:1800
-
\??\c:\vjddv.exec:\vjddv.exe73⤵PID:2544
-
\??\c:\nbbntt.exec:\nbbntt.exe74⤵PID:2480
-
\??\c:\rxrflrl.exec:\rxrflrl.exe75⤵PID:2352
-
\??\c:\nnnhnn.exec:\nnnhnn.exe76⤵PID:2768
-
\??\c:\xxxlffr.exec:\xxxlffr.exe77⤵PID:2220
-
\??\c:\fxlflll.exec:\fxlflll.exe78⤵PID:2888
-
\??\c:\vvpdv.exec:\vvpdv.exe79⤵PID:1808
-
\??\c:\fxxlfrl.exec:\fxxlfrl.exe80⤵PID:2792
-
\??\c:\ddjdv.exec:\ddjdv.exe81⤵PID:1316
-
\??\c:\xffxxxl.exec:\xffxxxl.exe82⤵PID:932
-
\??\c:\vvjpp.exec:\vvjpp.exe83⤵PID:1052
-
\??\c:\xfxrrrr.exec:\xfxrrrr.exe84⤵
- System Location Discovery: System Language Discovery
PID:1472 -
\??\c:\9dvpd.exec:\9dvpd.exe85⤵PID:1880
-
\??\c:\hhbhbh.exec:\hhbhbh.exe86⤵PID:2832
-
\??\c:\7pjvp.exec:\7pjvp.exe87⤵PID:844
-
\??\c:\ttbhnn.exec:\ttbhnn.exe88⤵PID:2196
-
\??\c:\frxxffl.exec:\frxxffl.exe89⤵PID:2692
-
\??\c:\hbnhtt.exec:\hbnhtt.exe90⤵PID:2796
-
\??\c:\flrlfxx.exec:\flrlfxx.exe91⤵PID:3048
-
\??\c:\nttbnb.exec:\nttbnb.exe92⤵PID:1512
-
\??\c:\lrlflfr.exec:\lrlflfr.exe93⤵PID:2016
-
\??\c:\bhntbn.exec:\bhntbn.exe94⤵PID:2416
-
\??\c:\xrfxlxf.exec:\xrfxlxf.exe95⤵PID:1944
-
\??\c:\bhbtth.exec:\bhbtth.exe96⤵PID:2068
-
\??\c:\5fflrlx.exec:\5fflrlx.exe97⤵PID:2808
-
\??\c:\btntnh.exec:\btntnh.exe98⤵PID:444
-
\??\c:\xlxxffl.exec:\xlxxffl.exe99⤵PID:1684
-
\??\c:\jjvvd.exec:\jjvvd.exe100⤵PID:1028
-
\??\c:\ntbbhn.exec:\ntbbhn.exe101⤵PID:1724
-
\??\c:\djdjv.exec:\djdjv.exe102⤵PID:1236
-
\??\c:\7ntttb.exec:\7ntttb.exe103⤵PID:1252
-
\??\c:\vvvdv.exec:\vvvdv.exe104⤵PID:3020
-
\??\c:\bhbnhh.exec:\bhbnhh.exe105⤵PID:916
-
\??\c:\xxxfflr.exec:\xxxfflr.exe106⤵PID:1044
-
\??\c:\dvvvv.exec:\dvvvv.exe107⤵PID:2368
-
\??\c:\bnhhhb.exec:\bnhhhb.exe108⤵PID:1816
-
\??\c:\lllflfl.exec:\lllflfl.exe109⤵PID:764
-
\??\c:\hbtttt.exec:\hbtttt.exe110⤵PID:2568
-
\??\c:\lxrrrrr.exec:\lxrrrrr.exe111⤵PID:1100
-
\??\c:\jvvvd.exec:\jvvvd.exe112⤵PID:1836
-
\??\c:\xlrlllr.exec:\xlrlllr.exe113⤵PID:1764
-
\??\c:\jjdjv.exec:\jjdjv.exe114⤵PID:1636
-
\??\c:\rllxflx.exec:\rllxflx.exe115⤵PID:2192
-
\??\c:\vddpj.exec:\vddpj.exe116⤵PID:2764
-
\??\c:\rrfrfrf.exec:\rrfrfrf.exe117⤵PID:2428
-
\??\c:\ddvvj.exec:\ddvvj.exe118⤵PID:1768
-
\??\c:\htnhnh.exec:\htnhnh.exe119⤵PID:2628
-
\??\c:\djvjd.exec:\djvjd.exe120⤵PID:2220
-
\??\c:\nhhhtt.exec:\nhhhtt.exe121⤵
- System Location Discovery: System Language Discovery
PID:2312
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-