Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/12/2024, 03:13
Behavioral task
behavioral1
Sample
f9d80efc65e8597a99293bdc9fd3288cb38fa56be473d2ebfd3927f4827c54d9N.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
120 seconds
General
-
Target
f9d80efc65e8597a99293bdc9fd3288cb38fa56be473d2ebfd3927f4827c54d9N.exe
-
Size
3.7MB
-
MD5
c52eaf07720402052a26c885c2465ab0
-
SHA1
3c0e8b786246ad42f779a3dc61b6abe9188fa7cd
-
SHA256
f9d80efc65e8597a99293bdc9fd3288cb38fa56be473d2ebfd3927f4827c54d9
-
SHA512
35581c9ca7b320e4a714272e6c62739adc1ea1aeac3ae7e48518820ec87cd9e6d2162b78da3ce639d83ce115428f8b7e8a77161814599019777a06314a6c5689
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF988:U6XLq/qPPslzKx/dJg1ErmNB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2536-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1436-22-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1436-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2244-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1436-60-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2692-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-78-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2764-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/800-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1584-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2132-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/748-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2932-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1316-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1252-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1516-584-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2212-593-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1920-604-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-657-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-661-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1668-679-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-693-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-696-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2064-794-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1688-859-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2424-881-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 2212 dvjjv.exe 1436 nhtnbb.exe 2244 hbthnn.exe 2936 nnbhtb.exe 2884 nnhhtb.exe 2932 vvvvp.exe 2692 3dvjd.exe 2764 dvjvj.exe 2624 jppvd.exe 2900 hbnhhn.exe 1032 7ththh.exe 692 dpvvd.exe 2872 jvjdp.exe 2128 7thhhn.exe 1260 httthh.exe 800 pppjv.exe 1888 1dpvd.exe 2820 btbhtn.exe 2812 1nntnn.exe 2972 tnbhth.exe 2948 vpjpj.exe 408 5bntbn.exe 832 dpddp.exe 2432 5xlrlfx.exe 340 lfflrrr.exe 1608 fxlrfxf.exe 1584 jjddj.exe 112 lllrxxf.exe 2100 rrflffr.exe 2476 flfrffl.exe 1812 pdddj.exe 2132 hbbnbb.exe 1524 5rrxfxf.exe 2172 rfrxffr.exe 1664 lfxxrff.exe 2264 7rxxlff.exe 2500 vpdpp.exe 748 ddvpd.exe 2720 9pvvd.exe 2844 1ddjd.exe 2932 pjpvd.exe 2912 5pdjj.exe 2692 nnnnbb.exe 2656 hhtbnh.exe 2168 nhnbbb.exe 2644 lffrxff.exe 568 5xrxxxr.exe 1504 jdjpv.exe 1560 btnhnt.exe 2652 btnnhh.exe 1644 frlfxxl.exe 1540 1pddv.exe 284 jjjdj.exe 800 9tttnn.exe 1800 nbbnnh.exe 2960 frxffrf.exe 644 vpvvj.exe 2216 5jpvv.exe 2208 thhhtn.exe 2372 rrxfrxf.exe 2948 1xrrrxr.exe 2572 jvpjj.exe 1316 jdpdj.exe 1252 bttbhn.exe -
resource yara_rule behavioral1/memory/2536-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2536-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012116-8.dat upx behavioral1/memory/2212-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d29-18.dat upx behavioral1/memory/2212-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1436-22-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0008000000016d31-29.dat upx behavioral1/memory/1436-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2936-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d3a-40.dat upx behavioral1/memory/2244-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2884-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d06-48.dat upx behavioral1/memory/2884-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d4a-58.dat upx behavioral1/memory/2932-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d5e-68.dat upx behavioral1/files/0x0007000000016d64-75.dat upx behavioral1/memory/2692-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2764-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d6d-88.dat upx behavioral1/memory/2764-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186ee-96.dat upx behavioral1/files/0x00050000000186fd-105.dat upx behavioral1/memory/2900-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018728-114.dat upx behavioral1/files/0x000500000001873d-122.dat upx behavioral1/memory/2872-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018784-130.dat upx behavioral1/files/0x000500000001878f-138.dat upx behavioral1/files/0x00050000000187a5-146.dat upx behavioral1/memory/800-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019023-157.dat upx behavioral1/memory/2820-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001925e-166.dat upx behavioral1/files/0x0005000000019261-174.dat upx behavioral1/memory/2812-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019282-184.dat upx behavioral1/memory/2972-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019334-193.dat upx behavioral1/memory/2948-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/408-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193b4-202.dat upx behavioral1/files/0x00050000000193c2-212.dat upx behavioral1/files/0x00050000000193e1-220.dat upx behavioral1/memory/2432-228-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001941e-229.dat upx behavioral1/memory/340-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019427-238.dat upx behavioral1/files/0x0005000000019431-247.dat upx behavioral1/memory/1608-246-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1584-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019441-256.dat upx behavioral1/files/0x000500000001944f-265.dat upx behavioral1/memory/2476-274-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019461-273.dat upx behavioral1/memory/2476-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001950c-283.dat upx behavioral1/files/0x0005000000019582-291.dat upx behavioral1/memory/2132-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1524-306-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2264-321-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2264-328-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrxxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnthnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrlflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2536 wrote to memory of 2212 2536 f9d80efc65e8597a99293bdc9fd3288cb38fa56be473d2ebfd3927f4827c54d9N.exe 30 PID 2536 wrote to memory of 2212 2536 f9d80efc65e8597a99293bdc9fd3288cb38fa56be473d2ebfd3927f4827c54d9N.exe 30 PID 2536 wrote to memory of 2212 2536 f9d80efc65e8597a99293bdc9fd3288cb38fa56be473d2ebfd3927f4827c54d9N.exe 30 PID 2536 wrote to memory of 2212 2536 f9d80efc65e8597a99293bdc9fd3288cb38fa56be473d2ebfd3927f4827c54d9N.exe 30 PID 2212 wrote to memory of 1436 2212 dvjjv.exe 31 PID 2212 wrote to memory of 1436 2212 dvjjv.exe 31 PID 2212 wrote to memory of 1436 2212 dvjjv.exe 31 PID 2212 wrote to memory of 1436 2212 dvjjv.exe 31 PID 1436 wrote to memory of 2244 1436 nhtnbb.exe 32 PID 1436 wrote to memory of 2244 1436 nhtnbb.exe 32 PID 1436 wrote to memory of 2244 1436 nhtnbb.exe 32 PID 1436 wrote to memory of 2244 1436 nhtnbb.exe 32 PID 2244 wrote to memory of 2936 2244 hbthnn.exe 33 PID 2244 wrote to memory of 2936 2244 hbthnn.exe 33 PID 2244 wrote to memory of 2936 2244 hbthnn.exe 33 PID 2244 wrote to memory of 2936 2244 hbthnn.exe 33 PID 2936 wrote to memory of 2884 2936 nnbhtb.exe 34 PID 2936 wrote to memory of 2884 2936 nnbhtb.exe 34 PID 2936 wrote to memory of 2884 2936 nnbhtb.exe 34 PID 2936 wrote to memory of 2884 2936 nnbhtb.exe 34 PID 2884 wrote to memory of 2932 2884 nnhhtb.exe 35 PID 2884 wrote to memory of 2932 2884 nnhhtb.exe 35 PID 2884 wrote to memory of 2932 2884 nnhhtb.exe 35 PID 2884 wrote to memory of 2932 2884 nnhhtb.exe 35 PID 2932 wrote to memory of 2692 2932 vvvvp.exe 36 PID 2932 wrote to memory of 2692 2932 vvvvp.exe 36 PID 2932 wrote to memory of 2692 2932 vvvvp.exe 36 PID 2932 wrote to memory of 2692 2932 vvvvp.exe 36 PID 2692 wrote to memory of 2764 2692 3dvjd.exe 37 PID 2692 wrote to memory of 2764 2692 3dvjd.exe 37 PID 2692 wrote to memory of 2764 2692 3dvjd.exe 37 PID 2692 wrote to memory of 2764 2692 3dvjd.exe 37 PID 2764 wrote to memory of 2624 2764 dvjvj.exe 38 PID 2764 wrote to memory of 2624 2764 dvjvj.exe 38 PID 2764 wrote to memory of 2624 2764 dvjvj.exe 38 PID 2764 wrote to memory of 2624 2764 dvjvj.exe 38 PID 2624 wrote to memory of 2900 2624 jppvd.exe 39 PID 2624 wrote to memory of 2900 2624 jppvd.exe 39 PID 2624 wrote to memory of 2900 2624 jppvd.exe 39 PID 2624 wrote to memory of 2900 2624 jppvd.exe 39 PID 2900 wrote to memory of 1032 2900 hbnhhn.exe 40 PID 2900 wrote to memory of 1032 2900 hbnhhn.exe 40 PID 2900 wrote to memory of 1032 2900 hbnhhn.exe 40 PID 2900 wrote to memory of 1032 2900 hbnhhn.exe 40 PID 1032 wrote to memory of 692 1032 7ththh.exe 41 PID 1032 wrote to memory of 692 1032 7ththh.exe 41 PID 1032 wrote to memory of 692 1032 7ththh.exe 41 PID 1032 wrote to memory of 692 1032 7ththh.exe 41 PID 692 wrote to memory of 2872 692 dpvvd.exe 42 PID 692 wrote to memory of 2872 692 dpvvd.exe 42 PID 692 wrote to memory of 2872 692 dpvvd.exe 42 PID 692 wrote to memory of 2872 692 dpvvd.exe 42 PID 2872 wrote to memory of 2128 2872 jvjdp.exe 43 PID 2872 wrote to memory of 2128 2872 jvjdp.exe 43 PID 2872 wrote to memory of 2128 2872 jvjdp.exe 43 PID 2872 wrote to memory of 2128 2872 jvjdp.exe 43 PID 2128 wrote to memory of 1260 2128 7thhhn.exe 44 PID 2128 wrote to memory of 1260 2128 7thhhn.exe 44 PID 2128 wrote to memory of 1260 2128 7thhhn.exe 44 PID 2128 wrote to memory of 1260 2128 7thhhn.exe 44 PID 1260 wrote to memory of 800 1260 httthh.exe 45 PID 1260 wrote to memory of 800 1260 httthh.exe 45 PID 1260 wrote to memory of 800 1260 httthh.exe 45 PID 1260 wrote to memory of 800 1260 httthh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9d80efc65e8597a99293bdc9fd3288cb38fa56be473d2ebfd3927f4827c54d9N.exe"C:\Users\Admin\AppData\Local\Temp\f9d80efc65e8597a99293bdc9fd3288cb38fa56be473d2ebfd3927f4827c54d9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\dvjjv.exec:\dvjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\nhtnbb.exec:\nhtnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\hbthnn.exec:\hbthnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\nnbhtb.exec:\nnbhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\nnhhtb.exec:\nnhhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\vvvvp.exec:\vvvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\3dvjd.exec:\3dvjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\dvjvj.exec:\dvjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\jppvd.exec:\jppvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\hbnhhn.exec:\hbnhhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\7ththh.exec:\7ththh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\dpvvd.exec:\dpvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\jvjdp.exec:\jvjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\7thhhn.exec:\7thhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\httthh.exec:\httthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\pppjv.exec:\pppjv.exe17⤵
- Executes dropped EXE
PID:800 -
\??\c:\1dpvd.exec:\1dpvd.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1888 -
\??\c:\btbhtn.exec:\btbhtn.exe19⤵
- Executes dropped EXE
PID:2820 -
\??\c:\1nntnn.exec:\1nntnn.exe20⤵
- Executes dropped EXE
PID:2812 -
\??\c:\tnbhth.exec:\tnbhth.exe21⤵
- Executes dropped EXE
PID:2972 -
\??\c:\vpjpj.exec:\vpjpj.exe22⤵
- Executes dropped EXE
PID:2948 -
\??\c:\5bntbn.exec:\5bntbn.exe23⤵
- Executes dropped EXE
PID:408 -
\??\c:\dpddp.exec:\dpddp.exe24⤵
- Executes dropped EXE
PID:832 -
\??\c:\5xlrlfx.exec:\5xlrlfx.exe25⤵
- Executes dropped EXE
PID:2432 -
\??\c:\lfflrrr.exec:\lfflrrr.exe26⤵
- Executes dropped EXE
PID:340 -
\??\c:\fxlrfxf.exec:\fxlrfxf.exe27⤵
- Executes dropped EXE
PID:1608 -
\??\c:\jjddj.exec:\jjddj.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1584 -
\??\c:\lllrxxf.exec:\lllrxxf.exe29⤵
- Executes dropped EXE
PID:112 -
\??\c:\rrflffr.exec:\rrflffr.exe30⤵
- Executes dropped EXE
PID:2100 -
\??\c:\flfrffl.exec:\flfrffl.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2476 -
\??\c:\pdddj.exec:\pdddj.exe32⤵
- Executes dropped EXE
PID:1812 -
\??\c:\hbbnbb.exec:\hbbnbb.exe33⤵
- Executes dropped EXE
PID:2132 -
\??\c:\5rrxfxf.exec:\5rrxfxf.exe34⤵
- Executes dropped EXE
PID:1524 -
\??\c:\rfrxffr.exec:\rfrxffr.exe35⤵
- Executes dropped EXE
PID:2172 -
\??\c:\lfxxrff.exec:\lfxxrff.exe36⤵
- Executes dropped EXE
PID:1664 -
\??\c:\7rxxlff.exec:\7rxxlff.exe37⤵
- Executes dropped EXE
PID:2264 -
\??\c:\vpdpp.exec:\vpdpp.exe38⤵
- Executes dropped EXE
PID:2500 -
\??\c:\ddvpd.exec:\ddvpd.exe39⤵
- Executes dropped EXE
PID:748 -
\??\c:\9pvvd.exec:\9pvvd.exe40⤵
- Executes dropped EXE
PID:2720 -
\??\c:\1ddjd.exec:\1ddjd.exe41⤵
- Executes dropped EXE
PID:2844 -
\??\c:\pjpvd.exec:\pjpvd.exe42⤵
- Executes dropped EXE
PID:2932 -
\??\c:\5pdjj.exec:\5pdjj.exe43⤵
- Executes dropped EXE
PID:2912 -
\??\c:\nnnnbb.exec:\nnnnbb.exe44⤵
- Executes dropped EXE
PID:2692 -
\??\c:\hhtbnh.exec:\hhtbnh.exe45⤵
- Executes dropped EXE
PID:2656 -
\??\c:\nhnbbb.exec:\nhnbbb.exe46⤵
- Executes dropped EXE
PID:2168 -
\??\c:\lffrxff.exec:\lffrxff.exe47⤵
- Executes dropped EXE
PID:2644 -
\??\c:\5xrxxxr.exec:\5xrxxxr.exe48⤵
- Executes dropped EXE
PID:568 -
\??\c:\jdjpv.exec:\jdjpv.exe49⤵
- Executes dropped EXE
PID:1504 -
\??\c:\btnhnt.exec:\btnhnt.exe50⤵
- Executes dropped EXE
PID:1560 -
\??\c:\btnnhh.exec:\btnnhh.exe51⤵
- Executes dropped EXE
PID:2652 -
\??\c:\frlfxxl.exec:\frlfxxl.exe52⤵
- Executes dropped EXE
PID:1644 -
\??\c:\1pddv.exec:\1pddv.exe53⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jjjdj.exec:\jjjdj.exe54⤵
- Executes dropped EXE
PID:284 -
\??\c:\9tttnn.exec:\9tttnn.exe55⤵
- Executes dropped EXE
PID:800 -
\??\c:\nbbnnh.exec:\nbbnnh.exe56⤵
- Executes dropped EXE
PID:1800 -
\??\c:\frxffrf.exec:\frxffrf.exe57⤵
- Executes dropped EXE
PID:2960 -
\??\c:\vpvvj.exec:\vpvvj.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:644 -
\??\c:\5jpvv.exec:\5jpvv.exe59⤵
- Executes dropped EXE
PID:2216 -
\??\c:\thhhtn.exec:\thhhtn.exe60⤵
- Executes dropped EXE
PID:2208 -
\??\c:\rrxfrxf.exec:\rrxfrxf.exe61⤵
- Executes dropped EXE
PID:2372 -
\??\c:\1xrrrxr.exec:\1xrrrxr.exe62⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jvpjj.exec:\jvpjj.exe63⤵
- Executes dropped EXE
PID:2572 -
\??\c:\jdpdj.exec:\jdpdj.exe64⤵
- Executes dropped EXE
PID:1316 -
\??\c:\bttbhn.exec:\bttbhn.exe65⤵
- Executes dropped EXE
PID:1252 -
\??\c:\hthnnb.exec:\hthnnb.exe66⤵PID:2032
-
\??\c:\1btnbb.exec:\1btnbb.exe67⤵PID:2044
-
\??\c:\frllrff.exec:\frllrff.exe68⤵PID:1464
-
\??\c:\xrxfrrl.exec:\xrxfrrl.exe69⤵PID:1680
-
\??\c:\fflfrxl.exec:\fflfrxl.exe70⤵PID:1468
-
\??\c:\jppvj.exec:\jppvj.exe71⤵PID:112
-
\??\c:\jpjdv.exec:\jpjdv.exe72⤵PID:2312
-
\??\c:\bbtnbn.exec:\bbtnbn.exe73⤵PID:1976
-
\??\c:\bnbhnh.exec:\bnbhnh.exe74⤵PID:1424
-
\??\c:\nhnbbn.exec:\nhnbbn.exe75⤵
- System Location Discovery: System Language Discovery
PID:2672 -
\??\c:\vjjpd.exec:\vjjpd.exe76⤵PID:1516
-
\??\c:\5thntb.exec:\5thntb.exe77⤵PID:2536
-
\??\c:\thbhhh.exec:\thbhhh.exe78⤵PID:2212
-
\??\c:\lxrxxxl.exec:\lxrxxxl.exe79⤵PID:1920
-
\??\c:\jppjd.exec:\jppjd.exe80⤵
- System Location Discovery: System Language Discovery
PID:2292 -
\??\c:\jdpdp.exec:\jdpdp.exe81⤵PID:2548
-
\??\c:\htnnth.exec:\htnnth.exe82⤵PID:2940
-
\??\c:\xrrfxxf.exec:\xrrfxxf.exe83⤵
- System Location Discovery: System Language Discovery
PID:2888 -
\??\c:\9ffrrfx.exec:\9ffrrfx.exe84⤵PID:2720
-
\??\c:\9ddvp.exec:\9ddvp.exe85⤵PID:2628
-
\??\c:\btnttt.exec:\btnttt.exe86⤵PID:2932
-
\??\c:\ttbbnn.exec:\ttbbnn.exe87⤵PID:2592
-
\??\c:\bnnttb.exec:\bnnttb.exe88⤵PID:2764
-
\??\c:\fxxfxfx.exec:\fxxfxfx.exe89⤵PID:2308
-
\??\c:\rlxlxrf.exec:\rlxlxrf.exe90⤵PID:2568
-
\??\c:\ppjvj.exec:\ppjvj.exe91⤵PID:1668
-
\??\c:\jdpvj.exec:\jdpvj.exe92⤵PID:1220
-
\??\c:\nbhnbb.exec:\nbhnbb.exe93⤵PID:2120
-
\??\c:\nhbtnb.exec:\nhbtnb.exe94⤵
- System Location Discovery: System Language Discovery
PID:1560 -
\??\c:\flxffrf.exec:\flxffrf.exe95⤵PID:1876
-
\??\c:\fxxffxr.exec:\fxxffxr.exe96⤵PID:2128
-
\??\c:\vpjvj.exec:\vpjvj.exe97⤵PID:2796
-
\??\c:\9nhtbb.exec:\9nhtbb.exe98⤵PID:1012
-
\??\c:\nbthnb.exec:\nbthnb.exe99⤵PID:1908
-
\??\c:\ffxxrrx.exec:\ffxxrrx.exe100⤵PID:2820
-
\??\c:\rlllfff.exec:\rlllfff.exe101⤵
- System Location Discovery: System Language Discovery
PID:2816 -
\??\c:\3dvdp.exec:\3dvdp.exe102⤵PID:644
-
\??\c:\9djpp.exec:\9djpp.exe103⤵PID:2792
-
\??\c:\9nbhth.exec:\9nbhth.exe104⤵PID:2980
-
\??\c:\rrrfrrr.exec:\rrrfrrr.exe105⤵PID:2372
-
\??\c:\1fxxrrf.exec:\1fxxrrf.exe106⤵PID:2948
-
\??\c:\pjdjv.exec:\pjdjv.exe107⤵PID:2572
-
\??\c:\hbhhtb.exec:\hbhhtb.exe108⤵PID:1316
-
\??\c:\ttnnht.exec:\ttnnht.exe109⤵PID:2064
-
\??\c:\xrlrflx.exec:\xrlrflx.exe110⤵PID:1200
-
\??\c:\9lrxllf.exec:\9lrxllf.exe111⤵PID:1608
-
\??\c:\jdvjv.exec:\jdvjv.exe112⤵PID:3040
-
\??\c:\bbbhbn.exec:\bbbhbn.exe113⤵PID:1052
-
\??\c:\tnnbhn.exec:\tnnbhn.exe114⤵PID:2104
-
\??\c:\llrlffr.exec:\llrlffr.exe115⤵PID:2084
-
\??\c:\jjvpd.exec:\jjvpd.exe116⤵
- System Location Discovery: System Language Discovery
PID:2280 -
\??\c:\pvvpp.exec:\pvvpp.exe117⤵PID:1788
-
\??\c:\nththh.exec:\nththh.exe118⤵PID:1688
-
\??\c:\thtbbh.exec:\thtbbh.exe119⤵PID:2132
-
\??\c:\lfxflrr.exec:\lfxflrr.exe120⤵PID:2304
-
\??\c:\xlxlxfl.exec:\xlxlxfl.exe121⤵PID:2172
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-