Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/12/2024, 08:54
Behavioral task
behavioral1
Sample
a75bab9050b09c902d27634f7805665e465e2ac5164d79fcabe1394df02f66d3N.exe
Resource
win7-20240903-en
General
-
Target
a75bab9050b09c902d27634f7805665e465e2ac5164d79fcabe1394df02f66d3N.exe
-
Size
3.7MB
-
MD5
dcdf374c742ee28f5c69f7cfcb5dfc00
-
SHA1
3bac11ce2e9d3dcb66acd4e13f402e5a1b78e12e
-
SHA256
a75bab9050b09c902d27634f7805665e465e2ac5164d79fcabe1394df02f66d3
-
SHA512
8d07773a3c7c76e228f2a0ca460fd069b4e0ef343e91905ec151e96e97c46963ee7f4572d4369fdf62602d684315dd9b582600f3344077b20c1eb17f79021bf3
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98Z:U6XLq/qPPslzKx/dJg1ErmNy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/1580-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2948-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/624-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1212-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1196-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1560-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1504-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/860-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2280-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2060-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1740-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-458-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1876-490-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1224-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-552-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1548-585-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-612-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1744-634-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/616-658-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-750-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1800-769-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1172-782-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1120-905-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-942-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1208-963-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2792-1020-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1620-1043-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1876-1063-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/988-1076-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1928-1101-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2872-1176-0x0000000000260000-0x0000000000287000-memory.dmp family_blackmoon behavioral1/memory/2844-1258-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2844-1282-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 2696 5frrffr.exe 2904 68006.exe 2596 48622.exe 2952 lxfrxlx.exe 2584 hhbbhb.exe 3040 268066.exe 3056 jdjvd.exe 2800 02424.exe 2948 4444440.exe 2228 jdddp.exe 1632 1rlllll.exe 2552 2626880.exe 624 3dppd.exe 1416 ttnnnt.exe 2660 lrllxxl.exe 568 62080.exe 1700 0246624.exe 1940 a8624.exe 2396 1dpvd.exe 1212 xfxflfl.exe 1196 46062.exe 652 lxrxxxx.exe 1560 dvdvj.exe 860 3vpvv.exe 1504 28064.exe 1964 frfxrrx.exe 1688 5nhbhb.exe 2260 1xxflll.exe 2504 fxrrflr.exe 3004 jjppv.exe 2280 5lrxfff.exe 396 8200006.exe 2052 7rflrfl.exe 2380 jdvdj.exe 2060 lxfflrx.exe 2880 48248.exe 2884 k60662.exe 2904 a4628.exe 2756 8402406.exe 2608 260628.exe 1740 bbtbhb.exe 3048 9dvdd.exe 2708 vpdjv.exe 2808 1bhhhh.exe 2760 4268606.exe 1760 lfrlrxf.exe 1764 9rfrflr.exe 2420 3lfrfff.exe 1084 0446228.exe 844 fxrrffl.exe 2844 nhhnbh.exe 1872 i862442.exe 2264 8642806.exe 2008 g0846.exe 1488 o866228.exe 2072 xflxfxl.exe 2324 2628406.exe 2284 4202440.exe 1280 m8624.exe 964 7hnhnn.exe 636 w64462.exe 1804 1flllrr.exe 1500 pdvjj.exe 1876 tnbbnn.exe -
resource yara_rule behavioral1/memory/1580-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2696-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c00000001226b-8.dat upx behavioral1/memory/1580-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016df5-18.dat upx behavioral1/memory/2696-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2904-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016edc-28.dat upx behavioral1/memory/2952-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016f02-37.dat upx behavioral1/memory/2596-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2952-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0035000000016dd5-47.dat upx behavioral1/memory/2584-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001707f-57.dat upx behavioral1/files/0x00070000000174b4-65.dat upx behavioral1/files/0x00070000000174f8-73.dat upx behavioral1/memory/2948-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017570-81.dat upx behavioral1/memory/2228-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000175f1-90.dat upx behavioral1/files/0x00070000000175f7-99.dat upx behavioral1/files/0x0005000000019274-107.dat upx behavioral1/memory/2552-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001927a-116.dat upx behavioral1/memory/624-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019299-125.dat upx behavioral1/memory/2660-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000192a1-133.dat upx behavioral1/files/0x0005000000019354-142.dat upx behavioral1/files/0x0005000000019358-149.dat upx behavioral1/memory/1700-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001938e-159.dat upx behavioral1/files/0x000500000001939f-167.dat upx behavioral1/memory/1212-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193d0-184.dat upx behavioral1/memory/1196-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2396-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193cc-176.dat upx behavioral1/files/0x00050000000193dc-194.dat upx behavioral1/files/0x00050000000193f9-202.dat upx behavioral1/memory/1560-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019426-211.dat upx behavioral1/files/0x0005000000019428-219.dat upx behavioral1/memory/1504-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/860-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ad-229.dat upx behavioral1/files/0x00050000000194c3-236.dat upx behavioral1/files/0x00050000000194d5-245.dat upx behavioral1/files/0x00050000000194e1-252.dat upx behavioral1/memory/2504-254-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019502-261.dat upx behavioral1/memory/3004-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019508-271.dat upx behavioral1/files/0x0005000000019510-279.dat upx behavioral1/memory/2280-277-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2060-304-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2880-311-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2884-318-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2904-319-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-326-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-333-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1740-346-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3048-347-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0646844.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04684.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 642848.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82880.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 844460.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m0424.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k26842.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2684624.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68668.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 086288.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 600284.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64062.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w64462.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2080848.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28268.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s0846.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m0624.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q06844.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 460028.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m8064.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6428440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0484662.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 868800.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u464684.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i062446.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6204804.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u024002.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q66888.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w64684.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64240.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8688040.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnht.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1580 wrote to memory of 2696 1580 a75bab9050b09c902d27634f7805665e465e2ac5164d79fcabe1394df02f66d3N.exe 30 PID 1580 wrote to memory of 2696 1580 a75bab9050b09c902d27634f7805665e465e2ac5164d79fcabe1394df02f66d3N.exe 30 PID 1580 wrote to memory of 2696 1580 a75bab9050b09c902d27634f7805665e465e2ac5164d79fcabe1394df02f66d3N.exe 30 PID 1580 wrote to memory of 2696 1580 a75bab9050b09c902d27634f7805665e465e2ac5164d79fcabe1394df02f66d3N.exe 30 PID 2696 wrote to memory of 2904 2696 5frrffr.exe 31 PID 2696 wrote to memory of 2904 2696 5frrffr.exe 31 PID 2696 wrote to memory of 2904 2696 5frrffr.exe 31 PID 2696 wrote to memory of 2904 2696 5frrffr.exe 31 PID 2904 wrote to memory of 2596 2904 68006.exe 32 PID 2904 wrote to memory of 2596 2904 68006.exe 32 PID 2904 wrote to memory of 2596 2904 68006.exe 32 PID 2904 wrote to memory of 2596 2904 68006.exe 32 PID 2596 wrote to memory of 2952 2596 48622.exe 33 PID 2596 wrote to memory of 2952 2596 48622.exe 33 PID 2596 wrote to memory of 2952 2596 48622.exe 33 PID 2596 wrote to memory of 2952 2596 48622.exe 33 PID 2952 wrote to memory of 2584 2952 lxfrxlx.exe 34 PID 2952 wrote to memory of 2584 2952 lxfrxlx.exe 34 PID 2952 wrote to memory of 2584 2952 lxfrxlx.exe 34 PID 2952 wrote to memory of 2584 2952 lxfrxlx.exe 34 PID 2584 wrote to memory of 3040 2584 hhbbhb.exe 35 PID 2584 wrote to memory of 3040 2584 hhbbhb.exe 35 PID 2584 wrote to memory of 3040 2584 hhbbhb.exe 35 PID 2584 wrote to memory of 3040 2584 hhbbhb.exe 35 PID 3040 wrote to memory of 3056 3040 268066.exe 36 PID 3040 wrote to memory of 3056 3040 268066.exe 36 PID 3040 wrote to memory of 3056 3040 268066.exe 36 PID 3040 wrote to memory of 3056 3040 268066.exe 36 PID 3056 wrote to memory of 2800 3056 jdjvd.exe 37 PID 3056 wrote to memory of 2800 3056 jdjvd.exe 37 PID 3056 wrote to memory of 2800 3056 jdjvd.exe 37 PID 3056 wrote to memory of 2800 3056 jdjvd.exe 37 PID 2800 wrote to memory of 2948 2800 02424.exe 38 PID 2800 wrote to memory of 2948 2800 02424.exe 38 PID 2800 wrote to memory of 2948 2800 02424.exe 38 PID 2800 wrote to memory of 2948 2800 02424.exe 38 PID 2948 wrote to memory of 2228 2948 4444440.exe 39 PID 2948 wrote to memory of 2228 2948 4444440.exe 39 PID 2948 wrote to memory of 2228 2948 4444440.exe 39 PID 2948 wrote to memory of 2228 2948 4444440.exe 39 PID 2228 wrote to memory of 1632 2228 jdddp.exe 40 PID 2228 wrote to memory of 1632 2228 jdddp.exe 40 PID 2228 wrote to memory of 1632 2228 jdddp.exe 40 PID 2228 wrote to memory of 1632 2228 jdddp.exe 40 PID 1632 wrote to memory of 2552 1632 1rlllll.exe 41 PID 1632 wrote to memory of 2552 1632 1rlllll.exe 41 PID 1632 wrote to memory of 2552 1632 1rlllll.exe 41 PID 1632 wrote to memory of 2552 1632 1rlllll.exe 41 PID 2552 wrote to memory of 624 2552 2626880.exe 42 PID 2552 wrote to memory of 624 2552 2626880.exe 42 PID 2552 wrote to memory of 624 2552 2626880.exe 42 PID 2552 wrote to memory of 624 2552 2626880.exe 42 PID 624 wrote to memory of 1416 624 3dppd.exe 43 PID 624 wrote to memory of 1416 624 3dppd.exe 43 PID 624 wrote to memory of 1416 624 3dppd.exe 43 PID 624 wrote to memory of 1416 624 3dppd.exe 43 PID 1416 wrote to memory of 2660 1416 ttnnnt.exe 44 PID 1416 wrote to memory of 2660 1416 ttnnnt.exe 44 PID 1416 wrote to memory of 2660 1416 ttnnnt.exe 44 PID 1416 wrote to memory of 2660 1416 ttnnnt.exe 44 PID 2660 wrote to memory of 568 2660 lrllxxl.exe 45 PID 2660 wrote to memory of 568 2660 lrllxxl.exe 45 PID 2660 wrote to memory of 568 2660 lrllxxl.exe 45 PID 2660 wrote to memory of 568 2660 lrllxxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a75bab9050b09c902d27634f7805665e465e2ac5164d79fcabe1394df02f66d3N.exe"C:\Users\Admin\AppData\Local\Temp\a75bab9050b09c902d27634f7805665e465e2ac5164d79fcabe1394df02f66d3N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\5frrffr.exec:\5frrffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\68006.exec:\68006.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\48622.exec:\48622.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\lxfrxlx.exec:\lxfrxlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\hhbbhb.exec:\hhbbhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\268066.exec:\268066.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\jdjvd.exec:\jdjvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\02424.exec:\02424.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\4444440.exec:\4444440.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\jdddp.exec:\jdddp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\1rlllll.exec:\1rlllll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\2626880.exec:\2626880.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\3dppd.exec:\3dppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\ttnnnt.exec:\ttnnnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\lrllxxl.exec:\lrllxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\62080.exec:\62080.exe17⤵
- Executes dropped EXE
PID:568 -
\??\c:\0246624.exec:\0246624.exe18⤵
- Executes dropped EXE
PID:1700 -
\??\c:\a8624.exec:\a8624.exe19⤵
- Executes dropped EXE
PID:1940 -
\??\c:\1dpvd.exec:\1dpvd.exe20⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xfxflfl.exec:\xfxflfl.exe21⤵
- Executes dropped EXE
PID:1212 -
\??\c:\46062.exec:\46062.exe22⤵
- Executes dropped EXE
PID:1196 -
\??\c:\lxrxxxx.exec:\lxrxxxx.exe23⤵
- Executes dropped EXE
PID:652 -
\??\c:\dvdvj.exec:\dvdvj.exe24⤵
- Executes dropped EXE
PID:1560 -
\??\c:\3vpvv.exec:\3vpvv.exe25⤵
- Executes dropped EXE
PID:860 -
\??\c:\28064.exec:\28064.exe26⤵
- Executes dropped EXE
PID:1504 -
\??\c:\frfxrrx.exec:\frfxrrx.exe27⤵
- Executes dropped EXE
PID:1964 -
\??\c:\5nhbhb.exec:\5nhbhb.exe28⤵
- Executes dropped EXE
PID:1688 -
\??\c:\1xxflll.exec:\1xxflll.exe29⤵
- Executes dropped EXE
PID:2260 -
\??\c:\fxrrflr.exec:\fxrrflr.exe30⤵
- Executes dropped EXE
PID:2504 -
\??\c:\jjppv.exec:\jjppv.exe31⤵
- Executes dropped EXE
PID:3004 -
\??\c:\5lrxfff.exec:\5lrxfff.exe32⤵
- Executes dropped EXE
PID:2280 -
\??\c:\8200006.exec:\8200006.exe33⤵
- Executes dropped EXE
PID:396 -
\??\c:\7rflrfl.exec:\7rflrfl.exe34⤵
- Executes dropped EXE
PID:2052 -
\??\c:\jdvdj.exec:\jdvdj.exe35⤵
- Executes dropped EXE
PID:2380 -
\??\c:\lxfflrx.exec:\lxfflrx.exe36⤵
- Executes dropped EXE
PID:2060 -
\??\c:\48248.exec:\48248.exe37⤵
- Executes dropped EXE
PID:2880 -
\??\c:\k60662.exec:\k60662.exe38⤵
- Executes dropped EXE
PID:2884 -
\??\c:\a4628.exec:\a4628.exe39⤵
- Executes dropped EXE
PID:2904 -
\??\c:\8402406.exec:\8402406.exe40⤵
- Executes dropped EXE
PID:2756 -
\??\c:\260628.exec:\260628.exe41⤵
- Executes dropped EXE
PID:2608 -
\??\c:\bbtbhb.exec:\bbtbhb.exe42⤵
- Executes dropped EXE
PID:1740 -
\??\c:\9dvdd.exec:\9dvdd.exe43⤵
- Executes dropped EXE
PID:3048 -
\??\c:\vpdjv.exec:\vpdjv.exe44⤵
- Executes dropped EXE
PID:2708 -
\??\c:\1bhhhh.exec:\1bhhhh.exe45⤵
- Executes dropped EXE
PID:2808 -
\??\c:\4268606.exec:\4268606.exe46⤵
- Executes dropped EXE
PID:2760 -
\??\c:\lfrlrxf.exec:\lfrlrxf.exe47⤵
- Executes dropped EXE
PID:1760 -
\??\c:\9rfrflr.exec:\9rfrflr.exe48⤵
- Executes dropped EXE
PID:1764 -
\??\c:\3lfrfff.exec:\3lfrfff.exe49⤵
- Executes dropped EXE
PID:2420 -
\??\c:\0446228.exec:\0446228.exe50⤵
- Executes dropped EXE
PID:1084 -
\??\c:\fxrrffl.exec:\fxrrffl.exe51⤵
- Executes dropped EXE
PID:844 -
\??\c:\nhhnbh.exec:\nhhnbh.exe52⤵
- Executes dropped EXE
PID:2844 -
\??\c:\i862442.exec:\i862442.exe53⤵
- Executes dropped EXE
PID:1872 -
\??\c:\8642806.exec:\8642806.exe54⤵
- Executes dropped EXE
PID:2264 -
\??\c:\g0846.exec:\g0846.exe55⤵
- Executes dropped EXE
PID:2008 -
\??\c:\o866228.exec:\o866228.exe56⤵
- Executes dropped EXE
PID:1488 -
\??\c:\xflxfxl.exec:\xflxfxl.exe57⤵
- Executes dropped EXE
PID:2072 -
\??\c:\2628406.exec:\2628406.exe58⤵
- Executes dropped EXE
PID:2324 -
\??\c:\4202440.exec:\4202440.exe59⤵
- Executes dropped EXE
PID:2284 -
\??\c:\m8624.exec:\m8624.exe60⤵
- Executes dropped EXE
PID:1280 -
\??\c:\7hnhnn.exec:\7hnhnn.exe61⤵
- Executes dropped EXE
PID:964 -
\??\c:\w64462.exec:\w64462.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:636 -
\??\c:\1flllrr.exec:\1flllrr.exe63⤵
- Executes dropped EXE
PID:1804 -
\??\c:\pdvjj.exec:\pdvjj.exe64⤵
- Executes dropped EXE
PID:1500 -
\??\c:\tnbbnn.exec:\tnbbnn.exe65⤵
- Executes dropped EXE
PID:1876 -
\??\c:\fxrfrrr.exec:\fxrfrrr.exe66⤵PID:1884
-
\??\c:\w66222.exec:\w66222.exe67⤵PID:988
-
\??\c:\8606222.exec:\8606222.exe68⤵PID:1672
-
\??\c:\4480668.exec:\4480668.exe69⤵PID:1224
-
\??\c:\xxxfrrf.exec:\xxxfrrf.exe70⤵
- System Location Discovery: System Language Discovery
PID:1688 -
\??\c:\5thnbh.exec:\5thnbh.exe71⤵PID:996
-
\??\c:\428426.exec:\428426.exe72⤵PID:1680
-
\??\c:\3ttbnn.exec:\3ttbnn.exe73⤵PID:1424
-
\??\c:\0806228.exec:\0806228.exe74⤵PID:3016
-
\??\c:\i062446.exec:\i062446.exe75⤵
- System Location Discovery: System Language Discovery
PID:2340 -
\??\c:\ddvpd.exec:\ddvpd.exe76⤵
- System Location Discovery: System Language Discovery
PID:3020 -
\??\c:\hnbhtn.exec:\hnbhtn.exe77⤵PID:1848
-
\??\c:\s0846.exec:\s0846.exe78⤵
- System Location Discovery: System Language Discovery
PID:2052 -
\??\c:\3lxfrlr.exec:\3lxfrlr.exe79⤵PID:2380
-
\??\c:\424066.exec:\424066.exe80⤵PID:1548
-
\??\c:\i428002.exec:\i428002.exe81⤵PID:2880
-
\??\c:\086288.exec:\086288.exe82⤵
- System Location Discovery: System Language Discovery
PID:2856 -
\??\c:\20280.exec:\20280.exe83⤵PID:2772
-
\??\c:\w40648.exec:\w40648.exe84⤵PID:2604
-
\??\c:\bttthh.exec:\bttthh.exe85⤵PID:2720
-
\??\c:\84280.exec:\84280.exe86⤵PID:1880
-
\??\c:\7lfflxf.exec:\7lfflxf.exe87⤵PID:1744
-
\??\c:\g8662.exec:\g8662.exe88⤵PID:2912
-
\??\c:\486244.exec:\486244.exe89⤵PID:2940
-
\??\c:\m4242.exec:\m4242.exe90⤵PID:616
-
\??\c:\w42622.exec:\w42622.exe91⤵PID:2172
-
\??\c:\ffflllx.exec:\ffflllx.exe92⤵PID:1692
-
\??\c:\08228.exec:\08228.exe93⤵PID:1244
-
\??\c:\3hbbnh.exec:\3hbbnh.exe94⤵PID:2160
-
\??\c:\w82422.exec:\w82422.exe95⤵PID:852
-
\??\c:\260028.exec:\260028.exe96⤵PID:1640
-
\??\c:\ffxlfrx.exec:\ffxlfrx.exe97⤵PID:596
-
\??\c:\9pdjv.exec:\9pdjv.exe98⤵PID:2224
-
\??\c:\a0662.exec:\a0662.exe99⤵PID:2416
-
\??\c:\m0624.exec:\m0624.exe100⤵
- System Location Discovery: System Language Discovery
PID:884 -
\??\c:\rfllxrf.exec:\rfllxrf.exe101⤵PID:1488
-
\??\c:\6428440.exec:\6428440.exe102⤵
- System Location Discovery: System Language Discovery
PID:2496 -
\??\c:\82680.exec:\82680.exe103⤵PID:2056
-
\??\c:\hnhtbh.exec:\hnhtbh.exe104⤵PID:2136
-
\??\c:\3pddj.exec:\3pddj.exe105⤵PID:1436
-
\??\c:\64080.exec:\64080.exe106⤵PID:2544
-
\??\c:\dvvpd.exec:\dvvpd.exe107⤵PID:2548
-
\??\c:\0468884.exec:\0468884.exe108⤵PID:1560
-
\??\c:\vvvpd.exec:\vvvpd.exe109⤵PID:1800
-
\??\c:\vpdpv.exec:\vpdpv.exe110⤵PID:876
-
\??\c:\9jddp.exec:\9jddp.exe111⤵PID:1172
-
\??\c:\26402.exec:\26402.exe112⤵PID:112
-
\??\c:\20806.exec:\20806.exe113⤵PID:1444
-
\??\c:\0666640.exec:\0666640.exe114⤵PID:1324
-
\??\c:\tnnbnn.exec:\tnnbnn.exe115⤵PID:2260
-
\??\c:\7tbbbh.exec:\7tbbbh.exe116⤵PID:2148
-
\??\c:\0484666.exec:\0484666.exe117⤵PID:2384
-
\??\c:\bhhtnt.exec:\bhhtnt.exe118⤵PID:1988
-
\??\c:\4862808.exec:\4862808.exe119⤵PID:3016
-
\??\c:\jdjpd.exec:\jdjpd.exe120⤵PID:396
-
\??\c:\3btntb.exec:\3btntb.exe121⤵PID:2436
-
\??\c:\04244.exec:\04244.exe122⤵PID:1888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-