Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/12/2024, 18:13
Behavioral task
behavioral1
Sample
ffb15e1ab75eb739ab968f5a6fe5c10c5ff32b37679449314342e1becd2cff54.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
120 seconds
General
-
Target
ffb15e1ab75eb739ab968f5a6fe5c10c5ff32b37679449314342e1becd2cff54.exe
-
Size
3.7MB
-
MD5
42bb15c291efb67575c921348bdc442f
-
SHA1
c31d54b949677456e34f1a17161019dffd08546a
-
SHA256
ffb15e1ab75eb739ab968f5a6fe5c10c5ff32b37679449314342e1becd2cff54
-
SHA512
5bd269f0706b783b809e41d2621d871372da67a3f1726770255f47b236d5c2ef407171d1b06dae828cc83e5497718357c8e97eeb2597817806c47146d6d33468
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF985:U6XLq/qPPslzKx/dJg1ErmNy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2648-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1236-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2316-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/836-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1164-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-131-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/304-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1804-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-200-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2980-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1852-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2084-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/864-289-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2028-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2080-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1912-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1272-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2076-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2052-448-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/828-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-557-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1040-576-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-626-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-663-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2204-670-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2140-721-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2152-740-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1996-771-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2492-803-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2864-811-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2068-856-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2140-1016-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1988-1099-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2752-1183-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2752-1203-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1688-1228-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2624-1274-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 2236 ffxxrlf.exe 2780 rlrxlrr.exe 2560 lfxfflr.exe 2800 rxffrrx.exe 1236 dvvvp.exe 2632 7nthnn.exe 2148 hbtthh.exe 836 3tbhnb.exe 2316 rrxxffl.exe 300 nhnnhh.exe 2540 7htbbn.exe 1164 pdpjp.exe 3048 vjdjj.exe 2852 9tnbnb.exe 2136 hhtbbh.exe 2188 tttthh.exe 304 nnnnbt.exe 1804 dpdjd.exe 444 ddppv.exe 1716 rxllfrx.exe 2464 djdjv.exe 2980 3jddj.exe 1368 hbhthh.exe 1852 nthhbh.exe 1696 jjdpd.exe 2084 9lflxlr.exe 1792 rlrxlfx.exe 604 rlflrfx.exe 3068 bbthth.exe 2116 fxrlfrl.exe 2892 dvjjp.exe 864 nhntnh.exe 872 dvjdp.exe 2028 nnthtb.exe 2080 hntnbn.exe 1912 btnbtb.exe 2664 fxllxxl.exe 2688 9lxlfxl.exe 2744 pjjvj.exe 2684 ppjpv.exe 2548 3thhhn.exe 3012 hbthtt.exe 1272 ttnhth.exe 2196 xllrflf.exe 2836 rrxxllx.exe 3008 dvjdj.exe 2280 ttbnbb.exe 2460 bbtnnt.exe 2868 9lfrlxr.exe 2324 jjdvp.exe 2260 hhbntb.exe 2840 ttnbnh.exe 2924 llxxflx.exe 2076 llxlrxf.exe 320 ppdpj.exe 2784 vpvdp.exe 2052 hhbnbh.exe 2156 xxrfxlx.exe 2348 dvpjd.exe 2956 5vjjp.exe 3056 bbbtnt.exe 3028 nhnbth.exe 1972 fxfxxfx.exe 1988 vvjvj.exe -
resource yara_rule behavioral1/memory/2648-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000012282-10.dat upx behavioral1/memory/2648-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2236-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000173f4-18.dat upx behavioral1/files/0x0007000000017472-27.dat upx behavioral1/memory/2560-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000017487-36.dat upx behavioral1/memory/2780-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000174a2-45.dat upx behavioral1/memory/1236-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x003600000001706d-54.dat upx behavioral1/files/0x0007000000017525-65.dat upx behavioral1/memory/2148-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0017000000018663-73.dat upx behavioral1/memory/2632-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000f00000001866e-81.dat upx behavioral1/memory/2316-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/836-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019259-90.dat upx behavioral1/files/0x0005000000019263-100.dat upx behavioral1/memory/2540-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019266-108.dat upx behavioral1/files/0x0005000000019284-119.dat upx behavioral1/memory/3048-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1164-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001928c-127.dat upx behavioral1/files/0x0005000000019353-136.dat upx behavioral1/files/0x0005000000019356-144.dat upx behavioral1/files/0x000500000001936b-152.dat upx behavioral1/memory/304-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001937b-161.dat upx behavioral1/memory/1804-165-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1804-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019397-171.dat upx behavioral1/files/0x00050000000193a5-179.dat upx behavioral1/files/0x0005000000019423-188.dat upx behavioral1/memory/1716-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019426-196.dat upx behavioral1/files/0x0005000000019438-206.dat upx behavioral1/memory/2980-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019442-214.dat upx behavioral1/files/0x000500000001944d-223.dat upx behavioral1/memory/1852-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019458-231.dat upx behavioral1/memory/2084-235-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001945c-241.dat upx behavioral1/memory/2084-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001946b-249.dat upx behavioral1/files/0x000500000001946e-257.dat upx behavioral1/files/0x00050000000194ae-265.dat upx behavioral1/memory/2116-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194c9-274.dat upx behavioral1/files/0x00050000000194df-282.dat upx behavioral1/memory/2028-297-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2028-304-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1912-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2080-311-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1912-319-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2664-326-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2548-345-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1272-364-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2196-371-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2324-402-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfflffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fflrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxflxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2236 2648 ffb15e1ab75eb739ab968f5a6fe5c10c5ff32b37679449314342e1becd2cff54.exe 30 PID 2648 wrote to memory of 2236 2648 ffb15e1ab75eb739ab968f5a6fe5c10c5ff32b37679449314342e1becd2cff54.exe 30 PID 2648 wrote to memory of 2236 2648 ffb15e1ab75eb739ab968f5a6fe5c10c5ff32b37679449314342e1becd2cff54.exe 30 PID 2648 wrote to memory of 2236 2648 ffb15e1ab75eb739ab968f5a6fe5c10c5ff32b37679449314342e1becd2cff54.exe 30 PID 2236 wrote to memory of 2780 2236 ffxxrlf.exe 31 PID 2236 wrote to memory of 2780 2236 ffxxrlf.exe 31 PID 2236 wrote to memory of 2780 2236 ffxxrlf.exe 31 PID 2236 wrote to memory of 2780 2236 ffxxrlf.exe 31 PID 2780 wrote to memory of 2560 2780 rlrxlrr.exe 32 PID 2780 wrote to memory of 2560 2780 rlrxlrr.exe 32 PID 2780 wrote to memory of 2560 2780 rlrxlrr.exe 32 PID 2780 wrote to memory of 2560 2780 rlrxlrr.exe 32 PID 2560 wrote to memory of 2800 2560 lfxfflr.exe 33 PID 2560 wrote to memory of 2800 2560 lfxfflr.exe 33 PID 2560 wrote to memory of 2800 2560 lfxfflr.exe 33 PID 2560 wrote to memory of 2800 2560 lfxfflr.exe 33 PID 2800 wrote to memory of 1236 2800 rxffrrx.exe 34 PID 2800 wrote to memory of 1236 2800 rxffrrx.exe 34 PID 2800 wrote to memory of 1236 2800 rxffrrx.exe 34 PID 2800 wrote to memory of 1236 2800 rxffrrx.exe 34 PID 1236 wrote to memory of 2632 1236 dvvvp.exe 35 PID 1236 wrote to memory of 2632 1236 dvvvp.exe 35 PID 1236 wrote to memory of 2632 1236 dvvvp.exe 35 PID 1236 wrote to memory of 2632 1236 dvvvp.exe 35 PID 2632 wrote to memory of 2148 2632 7nthnn.exe 36 PID 2632 wrote to memory of 2148 2632 7nthnn.exe 36 PID 2632 wrote to memory of 2148 2632 7nthnn.exe 36 PID 2632 wrote to memory of 2148 2632 7nthnn.exe 36 PID 2148 wrote to memory of 836 2148 hbtthh.exe 37 PID 2148 wrote to memory of 836 2148 hbtthh.exe 37 PID 2148 wrote to memory of 836 2148 hbtthh.exe 37 PID 2148 wrote to memory of 836 2148 hbtthh.exe 37 PID 836 wrote to memory of 2316 836 3tbhnb.exe 38 PID 836 wrote to memory of 2316 836 3tbhnb.exe 38 PID 836 wrote to memory of 2316 836 3tbhnb.exe 38 PID 836 wrote to memory of 2316 836 3tbhnb.exe 38 PID 2316 wrote to memory of 300 2316 rrxxffl.exe 39 PID 2316 wrote to memory of 300 2316 rrxxffl.exe 39 PID 2316 wrote to memory of 300 2316 rrxxffl.exe 39 PID 2316 wrote to memory of 300 2316 rrxxffl.exe 39 PID 300 wrote to memory of 2540 300 nhnnhh.exe 40 PID 300 wrote to memory of 2540 300 nhnnhh.exe 40 PID 300 wrote to memory of 2540 300 nhnnhh.exe 40 PID 300 wrote to memory of 2540 300 nhnnhh.exe 40 PID 2540 wrote to memory of 1164 2540 7htbbn.exe 41 PID 2540 wrote to memory of 1164 2540 7htbbn.exe 41 PID 2540 wrote to memory of 1164 2540 7htbbn.exe 41 PID 2540 wrote to memory of 1164 2540 7htbbn.exe 41 PID 1164 wrote to memory of 3048 1164 pdpjp.exe 42 PID 1164 wrote to memory of 3048 1164 pdpjp.exe 42 PID 1164 wrote to memory of 3048 1164 pdpjp.exe 42 PID 1164 wrote to memory of 3048 1164 pdpjp.exe 42 PID 3048 wrote to memory of 2852 3048 vjdjj.exe 43 PID 3048 wrote to memory of 2852 3048 vjdjj.exe 43 PID 3048 wrote to memory of 2852 3048 vjdjj.exe 43 PID 3048 wrote to memory of 2852 3048 vjdjj.exe 43 PID 2852 wrote to memory of 2136 2852 9tnbnb.exe 44 PID 2852 wrote to memory of 2136 2852 9tnbnb.exe 44 PID 2852 wrote to memory of 2136 2852 9tnbnb.exe 44 PID 2852 wrote to memory of 2136 2852 9tnbnb.exe 44 PID 2136 wrote to memory of 2188 2136 hhtbbh.exe 45 PID 2136 wrote to memory of 2188 2136 hhtbbh.exe 45 PID 2136 wrote to memory of 2188 2136 hhtbbh.exe 45 PID 2136 wrote to memory of 2188 2136 hhtbbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffb15e1ab75eb739ab968f5a6fe5c10c5ff32b37679449314342e1becd2cff54.exe"C:\Users\Admin\AppData\Local\Temp\ffb15e1ab75eb739ab968f5a6fe5c10c5ff32b37679449314342e1becd2cff54.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\ffxxrlf.exec:\ffxxrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\rlrxlrr.exec:\rlrxlrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\lfxfflr.exec:\lfxfflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\rxffrrx.exec:\rxffrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\dvvvp.exec:\dvvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\7nthnn.exec:\7nthnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\hbtthh.exec:\hbtthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\3tbhnb.exec:\3tbhnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\rrxxffl.exec:\rrxxffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\nhnnhh.exec:\nhnnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:300 -
\??\c:\7htbbn.exec:\7htbbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\pdpjp.exec:\pdpjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\vjdjj.exec:\vjdjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\9tnbnb.exec:\9tnbnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\hhtbbh.exec:\hhtbbh.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\tttthh.exec:\tttthh.exe17⤵
- Executes dropped EXE
PID:2188 -
\??\c:\nnnnbt.exec:\nnnnbt.exe18⤵
- Executes dropped EXE
PID:304 -
\??\c:\dpdjd.exec:\dpdjd.exe19⤵
- Executes dropped EXE
PID:1804 -
\??\c:\ddppv.exec:\ddppv.exe20⤵
- Executes dropped EXE
PID:444 -
\??\c:\rxllfrx.exec:\rxllfrx.exe21⤵
- Executes dropped EXE
PID:1716 -
\??\c:\djdjv.exec:\djdjv.exe22⤵
- Executes dropped EXE
PID:2464 -
\??\c:\3jddj.exec:\3jddj.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2980 -
\??\c:\hbhthh.exec:\hbhthh.exe24⤵
- Executes dropped EXE
PID:1368 -
\??\c:\nthhbh.exec:\nthhbh.exe25⤵
- Executes dropped EXE
PID:1852 -
\??\c:\jjdpd.exec:\jjdpd.exe26⤵
- Executes dropped EXE
PID:1696 -
\??\c:\9lflxlr.exec:\9lflxlr.exe27⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rlrxlfx.exec:\rlrxlfx.exe28⤵
- Executes dropped EXE
PID:1792 -
\??\c:\rlflrfx.exec:\rlflrfx.exe29⤵
- Executes dropped EXE
PID:604 -
\??\c:\bbthth.exec:\bbthth.exe30⤵
- Executes dropped EXE
PID:3068 -
\??\c:\fxrlfrl.exec:\fxrlfrl.exe31⤵
- Executes dropped EXE
PID:2116 -
\??\c:\dvjjp.exec:\dvjjp.exe32⤵
- Executes dropped EXE
PID:2892 -
\??\c:\nhntnh.exec:\nhntnh.exe33⤵
- Executes dropped EXE
PID:864 -
\??\c:\dvjdp.exec:\dvjdp.exe34⤵
- Executes dropped EXE
PID:872 -
\??\c:\nnthtb.exec:\nnthtb.exe35⤵
- Executes dropped EXE
PID:2028 -
\??\c:\hntnbn.exec:\hntnbn.exe36⤵
- Executes dropped EXE
PID:2080 -
\??\c:\btnbtb.exec:\btnbtb.exe37⤵
- Executes dropped EXE
PID:1912 -
\??\c:\fxllxxl.exec:\fxllxxl.exe38⤵
- Executes dropped EXE
PID:2664 -
\??\c:\9lxlfxl.exec:\9lxlfxl.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pjjvj.exec:\pjjvj.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\ppjpv.exec:\ppjpv.exe41⤵
- Executes dropped EXE
PID:2684 -
\??\c:\3thhhn.exec:\3thhhn.exe42⤵
- Executes dropped EXE
PID:2548 -
\??\c:\hbthtt.exec:\hbthtt.exe43⤵
- Executes dropped EXE
PID:3012 -
\??\c:\ttnhth.exec:\ttnhth.exe44⤵
- Executes dropped EXE
PID:1272 -
\??\c:\xllrflf.exec:\xllrflf.exe45⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rrxxllx.exec:\rrxxllx.exe46⤵
- Executes dropped EXE
PID:2836 -
\??\c:\dvjdj.exec:\dvjdj.exe47⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ttbnbb.exec:\ttbnbb.exe48⤵
- Executes dropped EXE
PID:2280 -
\??\c:\bbtnnt.exec:\bbtnnt.exe49⤵
- Executes dropped EXE
PID:2460 -
\??\c:\9lfrlxr.exec:\9lfrlxr.exe50⤵
- Executes dropped EXE
PID:2868 -
\??\c:\jjdvp.exec:\jjdvp.exe51⤵
- Executes dropped EXE
PID:2324 -
\??\c:\hhbntb.exec:\hhbntb.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2260 -
\??\c:\ttnbnh.exec:\ttnbnh.exe53⤵
- Executes dropped EXE
PID:2840 -
\??\c:\llxxflx.exec:\llxxflx.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2924 -
\??\c:\llxlrxf.exec:\llxlrxf.exe55⤵
- Executes dropped EXE
PID:2076 -
\??\c:\ppdpj.exec:\ppdpj.exe56⤵
- Executes dropped EXE
PID:320 -
\??\c:\vpvdp.exec:\vpvdp.exe57⤵
- Executes dropped EXE
PID:2784 -
\??\c:\hhbnbh.exec:\hhbnbh.exe58⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xxrfxlx.exec:\xxrfxlx.exe59⤵
- Executes dropped EXE
PID:2156 -
\??\c:\dvpjd.exec:\dvpjd.exe60⤵
- Executes dropped EXE
PID:2348 -
\??\c:\5vjjp.exec:\5vjjp.exe61⤵
- Executes dropped EXE
PID:2956 -
\??\c:\bbbtnt.exec:\bbbtnt.exe62⤵
- Executes dropped EXE
PID:3056 -
\??\c:\nhnbth.exec:\nhnbth.exe63⤵
- Executes dropped EXE
PID:3028 -
\??\c:\fxfxxfx.exec:\fxfxxfx.exe64⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vvjvj.exec:\vvjvj.exe65⤵
- Executes dropped EXE
PID:1988 -
\??\c:\tnhtbt.exec:\tnhtbt.exe66⤵PID:828
-
\??\c:\7thtbn.exec:\7thtbn.exe67⤵PID:884
-
\??\c:\llllfrf.exec:\llllfrf.exe68⤵PID:2864
-
\??\c:\vvdjj.exec:\vvdjj.exe69⤵PID:1696
-
\??\c:\jpjjv.exec:\jpjjv.exe70⤵PID:1848
-
\??\c:\nhnthn.exec:\nhnthn.exe71⤵PID:3000
-
\??\c:\lfxlxlf.exec:\lfxlxlf.exe72⤵PID:1948
-
\??\c:\fxrfxfl.exec:\fxrfxfl.exe73⤵PID:2380
-
\??\c:\llrrrxl.exec:\llrrrxl.exe74⤵PID:2100
-
\??\c:\5vdpd.exec:\5vdpd.exe75⤵PID:2220
-
\??\c:\5thtbn.exec:\5thtbn.exe76⤵PID:772
-
\??\c:\bhthnt.exec:\bhthnt.exe77⤵PID:2268
-
\??\c:\bhnhht.exec:\bhnhht.exe78⤵PID:1040
-
\??\c:\3lfrxfl.exec:\3lfrxfl.exe79⤵PID:1608
-
\??\c:\jppjj.exec:\jppjj.exe80⤵PID:1556
-
\??\c:\pvvjd.exec:\pvvjd.exe81⤵PID:2660
-
\??\c:\tttbth.exec:\tttbth.exe82⤵PID:2704
-
\??\c:\1nbntb.exec:\1nbntb.exe83⤵PID:2708
-
\??\c:\xrflxfx.exec:\xrflxfx.exe84⤵PID:2908
-
\??\c:\vppdv.exec:\vppdv.exe85⤵PID:2740
-
\??\c:\dvpvp.exec:\dvpvp.exe86⤵PID:2800
-
\??\c:\bbnbht.exec:\bbnbht.exe87⤵PID:1236
-
\??\c:\1lxllrx.exec:\1lxllrx.exe88⤵PID:2564
-
\??\c:\xlfrxlr.exec:\xlfrxlr.exe89⤵PID:3012
-
\??\c:\pdpvd.exec:\pdpvd.exe90⤵PID:1272
-
\??\c:\bthbnh.exec:\bthbnh.exe91⤵PID:2796
-
\??\c:\dvdjp.exec:\dvdjp.exe92⤵
- System Location Discovery: System Language Discovery
PID:2204 -
\??\c:\ppppv.exec:\ppppv.exe93⤵PID:1768
-
\??\c:\nbnnnt.exec:\nbnnnt.exe94⤵PID:1796
-
\??\c:\lfxxffl.exec:\lfxxffl.exe95⤵PID:640
-
\??\c:\vpjjd.exec:\vpjjd.exe96⤵PID:1456
-
\??\c:\7jddj.exec:\7jddj.exe97⤵PID:992
-
\??\c:\3bnhtb.exec:\3bnhtb.exe98⤵PID:2844
-
\??\c:\hbtbtb.exec:\hbtbtb.exe99⤵PID:1920
-
\??\c:\1lrflxl.exec:\1lrflxl.exe100⤵PID:2140
-
\??\c:\pjvdj.exec:\pjvdj.exe101⤵PID:580
-
\??\c:\dvvdj.exec:\dvvdj.exe102⤵
- System Location Discovery: System Language Discovery
PID:1748 -
\??\c:\bthtbn.exec:\bthtbn.exe103⤵PID:2152
-
\??\c:\1fflrxx.exec:\1fflrxx.exe104⤵
- System Location Discovery: System Language Discovery
PID:1944 -
\??\c:\lxfrffl.exec:\lxfrffl.exe105⤵PID:2904
-
\??\c:\xxlrrrf.exec:\xxlrrrf.exe106⤵PID:444
-
\??\c:\vvpvp.exec:\vvpvp.exe107⤵PID:2948
-
\??\c:\jjdjd.exec:\jjdjd.exe108⤵PID:1996
-
\??\c:\tbttth.exec:\tbttth.exe109⤵PID:2300
-
\??\c:\nthnnh.exec:\nthnnh.exe110⤵PID:2528
-
\??\c:\xflflxr.exec:\xflflxr.exe111⤵PID:2508
-
\??\c:\7jjpv.exec:\7jjpv.exe112⤵PID:896
-
\??\c:\vpddv.exec:\vpddv.exe113⤵PID:2492
-
\??\c:\3bnbhb.exec:\3bnbhb.exe114⤵PID:2864
-
\??\c:\tttnbn.exec:\tttnbn.exe115⤵PID:1672
-
\??\c:\llflrfr.exec:\llflrfr.exe116⤵PID:1524
-
\??\c:\rlrxffx.exec:\rlrxffx.exe117⤵PID:1536
-
\??\c:\jpddp.exec:\jpddp.exe118⤵PID:2376
-
\??\c:\tnnhbt.exec:\tnnhbt.exe119⤵PID:2380
-
\??\c:\btttbh.exec:\btttbh.exe120⤵PID:2636
-
\??\c:\xrlrxfl.exec:\xrlrxfl.exe121⤵PID:296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-