Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 23:16
Static task
static1
Behavioral task
behavioral1
Sample
820bebf588d0fe8a91e325c5e3de13eecb050d1513337349e0b97d23267a0857.exe
Resource
win7-20240903-en
General
-
Target
820bebf588d0fe8a91e325c5e3de13eecb050d1513337349e0b97d23267a0857.exe
-
Size
454KB
-
MD5
cc0c065724488972a1c8f1f2e000515b
-
SHA1
4bd38c74608cc853bbe577e0e1f0a55f7669cd6a
-
SHA256
820bebf588d0fe8a91e325c5e3de13eecb050d1513337349e0b97d23267a0857
-
SHA512
74bb2aa94c3d20617ae03a709362ccee1bb1f7a36359c599bbeb66ecbdc07eef806a1b43a080eae6302219e4bd747734e3b49bda17bbb51193ef5e525919e5b0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeS:q7Tc2NYHUrAwfMp3CDS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral1/memory/2440-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-52-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2920-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-92-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2624-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1464-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1464-129-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2828-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-182-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2372-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/856-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-229-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1712-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-293-0x0000000076CF0000-0x0000000076E0F000-memory.dmp family_blackmoon behavioral1/memory/1548-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-294-0x0000000076BF0000-0x0000000076CEA000-memory.dmp family_blackmoon behavioral1/memory/2280-305-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2400-328-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2500-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-447-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1088-504-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1528-521-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1900-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-529-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2208-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-613-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2724-620-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2928-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-707-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2836-713-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1864-727-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/284-825-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2924-909-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1876-1062-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1588-1121-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1628-1139-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2776-1189-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2684-1209-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2688-1249-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/768-1269-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1516-1306-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2168 ffxflrf.exe 1944 ddvpj.exe 2592 lfxfrxr.exe 2960 7jvvd.exe 1896 5xllrrl.exe 2920 tnhhnt.exe 2968 lflrxxl.exe 2656 btnthh.exe 2788 dddpd.exe 2640 9rlxflx.exe 2324 jdjpv.exe 2624 bnthhh.exe 1464 tnhhtb.exe 1484 jdvvp.exe 1988 nhntbb.exe 2828 llxflxf.exe 2832 tnhnbb.exe 2516 tnbbnn.exe 2372 fffrfrl.exe 2360 lllxflx.exe 2248 rxlxlfr.exe 2504 7tntth.exe 856 vpdvd.exe 1816 vpdvd.exe 1712 xrrfxxl.exe 1876 tbbbhh.exe 1680 rfrrxxf.exe 1468 hhntbb.exe 1524 dddjv.exe 2032 llffrrf.exe 1616 bbntbh.exe 1692 vddpd.exe 1960 7frfrlf.exe 2280 vvpdv.exe 1700 frxxflr.exe 1812 ppjdd.exe 2400 ddvpp.exe 2500 lfrlllr.exe 580 9nbbhb.exe 1896 9jdjd.exe 2924 pjjvj.exe 2804 lfxlxrl.exe 2968 flllrrf.exe 2660 hbtbhn.exe 2420 9dpvd.exe 2640 ppdjp.exe 2296 rlffrxl.exe 2672 nhbbbn.exe 680 tnnhhh.exe 1180 ddvvd.exe 3020 llllxfl.exe 2472 rrxlxfr.exe 1992 tnbnhh.exe 2824 pjvdj.exe 3016 3pjjj.exe 2988 lfrlrlr.exe 2016 nhhntn.exe 2068 hbbhtt.exe 2408 jjdvj.exe 2096 rrxxffr.exe 340 flfxrfl.exe 1460 nhnhbh.exe 1532 pppdv.exe 1068 3llrxxl.exe -
resource yara_rule behavioral1/memory/2168-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-145-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2360-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-293-0x0000000076CF0000-0x0000000076E0F000-memory.dmp upx behavioral1/memory/1548-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-475-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/1900-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-902-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-953-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-1069-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/804-1107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-1161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-1196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-1242-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxlrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thntth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2168 2440 820bebf588d0fe8a91e325c5e3de13eecb050d1513337349e0b97d23267a0857.exe 30 PID 2440 wrote to memory of 2168 2440 820bebf588d0fe8a91e325c5e3de13eecb050d1513337349e0b97d23267a0857.exe 30 PID 2440 wrote to memory of 2168 2440 820bebf588d0fe8a91e325c5e3de13eecb050d1513337349e0b97d23267a0857.exe 30 PID 2440 wrote to memory of 2168 2440 820bebf588d0fe8a91e325c5e3de13eecb050d1513337349e0b97d23267a0857.exe 30 PID 2168 wrote to memory of 1944 2168 ffxflrf.exe 31 PID 2168 wrote to memory of 1944 2168 ffxflrf.exe 31 PID 2168 wrote to memory of 1944 2168 ffxflrf.exe 31 PID 2168 wrote to memory of 1944 2168 ffxflrf.exe 31 PID 1944 wrote to memory of 2592 1944 ddvpj.exe 32 PID 1944 wrote to memory of 2592 1944 ddvpj.exe 32 PID 1944 wrote to memory of 2592 1944 ddvpj.exe 32 PID 1944 wrote to memory of 2592 1944 ddvpj.exe 32 PID 2592 wrote to memory of 2960 2592 lfxfrxr.exe 33 PID 2592 wrote to memory of 2960 2592 lfxfrxr.exe 33 PID 2592 wrote to memory of 2960 2592 lfxfrxr.exe 33 PID 2592 wrote to memory of 2960 2592 lfxfrxr.exe 33 PID 2960 wrote to memory of 1896 2960 7jvvd.exe 34 PID 2960 wrote to memory of 1896 2960 7jvvd.exe 34 PID 2960 wrote to memory of 1896 2960 7jvvd.exe 34 PID 2960 wrote to memory of 1896 2960 7jvvd.exe 34 PID 1896 wrote to memory of 2920 1896 5xllrrl.exe 35 PID 1896 wrote to memory of 2920 1896 5xllrrl.exe 35 PID 1896 wrote to memory of 2920 1896 5xllrrl.exe 35 PID 1896 wrote to memory of 2920 1896 5xllrrl.exe 35 PID 2920 wrote to memory of 2968 2920 tnhhnt.exe 36 PID 2920 wrote to memory of 2968 2920 tnhhnt.exe 36 PID 2920 wrote to memory of 2968 2920 tnhhnt.exe 36 PID 2920 wrote to memory of 2968 2920 tnhhnt.exe 36 PID 2968 wrote to memory of 2656 2968 lflrxxl.exe 37 PID 2968 wrote to memory of 2656 2968 lflrxxl.exe 37 PID 2968 wrote to memory of 2656 2968 lflrxxl.exe 37 PID 2968 wrote to memory of 2656 2968 lflrxxl.exe 37 PID 2656 wrote to memory of 2788 2656 btnthh.exe 38 PID 2656 wrote to memory of 2788 2656 btnthh.exe 38 PID 2656 wrote to memory of 2788 2656 btnthh.exe 38 PID 2656 wrote to memory of 2788 2656 btnthh.exe 38 PID 2788 wrote to memory of 2640 2788 dddpd.exe 39 PID 2788 wrote to memory of 2640 2788 dddpd.exe 39 PID 2788 wrote to memory of 2640 2788 dddpd.exe 39 PID 2788 wrote to memory of 2640 2788 dddpd.exe 39 PID 2640 wrote to memory of 2324 2640 9rlxflx.exe 40 PID 2640 wrote to memory of 2324 2640 9rlxflx.exe 40 PID 2640 wrote to memory of 2324 2640 9rlxflx.exe 40 PID 2640 wrote to memory of 2324 2640 9rlxflx.exe 40 PID 2324 wrote to memory of 2624 2324 jdjpv.exe 41 PID 2324 wrote to memory of 2624 2324 jdjpv.exe 41 PID 2324 wrote to memory of 2624 2324 jdjpv.exe 41 PID 2324 wrote to memory of 2624 2324 jdjpv.exe 41 PID 2624 wrote to memory of 1464 2624 bnthhh.exe 42 PID 2624 wrote to memory of 1464 2624 bnthhh.exe 42 PID 2624 wrote to memory of 1464 2624 bnthhh.exe 42 PID 2624 wrote to memory of 1464 2624 bnthhh.exe 42 PID 1464 wrote to memory of 1484 1464 tnhhtb.exe 43 PID 1464 wrote to memory of 1484 1464 tnhhtb.exe 43 PID 1464 wrote to memory of 1484 1464 tnhhtb.exe 43 PID 1464 wrote to memory of 1484 1464 tnhhtb.exe 43 PID 1484 wrote to memory of 1988 1484 jdvvp.exe 44 PID 1484 wrote to memory of 1988 1484 jdvvp.exe 44 PID 1484 wrote to memory of 1988 1484 jdvvp.exe 44 PID 1484 wrote to memory of 1988 1484 jdvvp.exe 44 PID 1988 wrote to memory of 2828 1988 nhntbb.exe 45 PID 1988 wrote to memory of 2828 1988 nhntbb.exe 45 PID 1988 wrote to memory of 2828 1988 nhntbb.exe 45 PID 1988 wrote to memory of 2828 1988 nhntbb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\820bebf588d0fe8a91e325c5e3de13eecb050d1513337349e0b97d23267a0857.exe"C:\Users\Admin\AppData\Local\Temp\820bebf588d0fe8a91e325c5e3de13eecb050d1513337349e0b97d23267a0857.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\ffxflrf.exec:\ffxflrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\ddvpj.exec:\ddvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\lfxfrxr.exec:\lfxfrxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\7jvvd.exec:\7jvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\5xllrrl.exec:\5xllrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\tnhhnt.exec:\tnhhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\lflrxxl.exec:\lflrxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\btnthh.exec:\btnthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\dddpd.exec:\dddpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\9rlxflx.exec:\9rlxflx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\jdjpv.exec:\jdjpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\bnthhh.exec:\bnthhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\tnhhtb.exec:\tnhhtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\jdvvp.exec:\jdvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\nhntbb.exec:\nhntbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\llxflxf.exec:\llxflxf.exe17⤵
- Executes dropped EXE
PID:2828 -
\??\c:\tnhnbb.exec:\tnhnbb.exe18⤵
- Executes dropped EXE
PID:2832 -
\??\c:\tnbbnn.exec:\tnbbnn.exe19⤵
- Executes dropped EXE
PID:2516 -
\??\c:\fffrfrl.exec:\fffrfrl.exe20⤵
- Executes dropped EXE
PID:2372 -
\??\c:\lllxflx.exec:\lllxflx.exe21⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rxlxlfr.exec:\rxlxlfr.exe22⤵
- Executes dropped EXE
PID:2248 -
\??\c:\7tntth.exec:\7tntth.exe23⤵
- Executes dropped EXE
PID:2504 -
\??\c:\vpdvd.exec:\vpdvd.exe24⤵
- Executes dropped EXE
PID:856 -
\??\c:\vpdvd.exec:\vpdvd.exe25⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xrrfxxl.exec:\xrrfxxl.exe26⤵
- Executes dropped EXE
PID:1712 -
\??\c:\tbbbhh.exec:\tbbbhh.exe27⤵
- Executes dropped EXE
PID:1876 -
\??\c:\rfrrxxf.exec:\rfrrxxf.exe28⤵
- Executes dropped EXE
PID:1680 -
\??\c:\hhntbb.exec:\hhntbb.exe29⤵
- Executes dropped EXE
PID:1468 -
\??\c:\dddjv.exec:\dddjv.exe30⤵
- Executes dropped EXE
PID:1524 -
\??\c:\llffrrf.exec:\llffrrf.exe31⤵
- Executes dropped EXE
PID:2032 -
\??\c:\bbntbh.exec:\bbntbh.exe32⤵
- Executes dropped EXE
PID:1616 -
\??\c:\vddpd.exec:\vddpd.exe33⤵
- Executes dropped EXE
PID:1692 -
\??\c:\7frfrlf.exec:\7frfrlf.exe34⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jdvvj.exec:\jdvvj.exe35⤵PID:1548
-
\??\c:\vvpdv.exec:\vvpdv.exe36⤵
- Executes dropped EXE
PID:2280 -
\??\c:\frxxflr.exec:\frxxflr.exe37⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ppjdd.exec:\ppjdd.exe38⤵
- Executes dropped EXE
PID:1812 -
\??\c:\ddvpp.exec:\ddvpp.exe39⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lfrlllr.exec:\lfrlllr.exe40⤵
- Executes dropped EXE
PID:2500 -
\??\c:\9nbbhb.exec:\9nbbhb.exe41⤵
- Executes dropped EXE
PID:580 -
\??\c:\9jdjd.exec:\9jdjd.exe42⤵
- Executes dropped EXE
PID:1896 -
\??\c:\pjjvj.exec:\pjjvj.exe43⤵
- Executes dropped EXE
PID:2924 -
\??\c:\lfxlxrl.exec:\lfxlxrl.exe44⤵
- Executes dropped EXE
PID:2804 -
\??\c:\flllrrf.exec:\flllrrf.exe45⤵
- Executes dropped EXE
PID:2968 -
\??\c:\hbtbhn.exec:\hbtbhn.exe46⤵
- Executes dropped EXE
PID:2660 -
\??\c:\9dpvd.exec:\9dpvd.exe47⤵
- Executes dropped EXE
PID:2420 -
\??\c:\ppdjp.exec:\ppdjp.exe48⤵
- Executes dropped EXE
PID:2640 -
\??\c:\rlffrxl.exec:\rlffrxl.exe49⤵
- Executes dropped EXE
PID:2296 -
\??\c:\nhbbbn.exec:\nhbbbn.exe50⤵
- Executes dropped EXE
PID:2672 -
\??\c:\tnnhhh.exec:\tnnhhh.exe51⤵
- Executes dropped EXE
PID:680 -
\??\c:\ddvvd.exec:\ddvvd.exe52⤵
- Executes dropped EXE
PID:1180 -
\??\c:\llllxfl.exec:\llllxfl.exe53⤵
- Executes dropped EXE
PID:3020 -
\??\c:\rrxlxfr.exec:\rrxlxfr.exe54⤵
- Executes dropped EXE
PID:2472 -
\??\c:\tnbnhh.exec:\tnbnhh.exe55⤵
- Executes dropped EXE
PID:1992 -
\??\c:\pjvdj.exec:\pjvdj.exe56⤵
- Executes dropped EXE
PID:2824 -
\??\c:\3pjjj.exec:\3pjjj.exe57⤵
- Executes dropped EXE
PID:3016 -
\??\c:\lfrlrlr.exec:\lfrlrlr.exe58⤵
- Executes dropped EXE
PID:2988 -
\??\c:\nhhntn.exec:\nhhntn.exe59⤵
- Executes dropped EXE
PID:2016 -
\??\c:\hbbhtt.exec:\hbbhtt.exe60⤵
- Executes dropped EXE
PID:2068 -
\??\c:\jjdvj.exec:\jjdvj.exe61⤵
- Executes dropped EXE
PID:2408 -
\??\c:\rrxxffr.exec:\rrxxffr.exe62⤵
- Executes dropped EXE
PID:2096 -
\??\c:\flfxrfl.exec:\flfxrfl.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:340 -
\??\c:\nhnhbh.exec:\nhnhbh.exe64⤵
- Executes dropped EXE
PID:1460 -
\??\c:\pppdv.exec:\pppdv.exe65⤵
- Executes dropped EXE
PID:1532 -
\??\c:\3llrxxl.exec:\3llrxxl.exe66⤵
- Executes dropped EXE
PID:1068 -
\??\c:\llffrrx.exec:\llffrrx.exe67⤵PID:1088
-
\??\c:\nhtbbh.exec:\nhtbbh.exe68⤵PID:1556
-
\??\c:\vpdjv.exec:\vpdjv.exe69⤵PID:1536
-
\??\c:\ddvdp.exec:\ddvdp.exe70⤵PID:1528
-
\??\c:\xxrrxfl.exec:\xxrrxfl.exe71⤵PID:1900
-
\??\c:\9htbnh.exec:\9htbnh.exe72⤵PID:1032
-
\??\c:\9pdpj.exec:\9pdpj.exe73⤵PID:2964
-
\??\c:\vpjjp.exec:\vpjjp.exe74⤵PID:2456
-
\??\c:\7xxlrrx.exec:\7xxlrrx.exe75⤵PID:564
-
\??\c:\tbthnb.exec:\tbthnb.exe76⤵PID:880
-
\??\c:\tbthnt.exec:\tbthnt.exe77⤵PID:644
-
\??\c:\vvvjd.exec:\vvvjd.exe78⤵PID:2208
-
\??\c:\7pvdv.exec:\7pvdv.exe79⤵PID:1548
-
\??\c:\fxrfrxx.exec:\fxrfrxx.exe80⤵PID:2168
-
\??\c:\1bhnhb.exec:\1bhnhb.exe81⤵PID:2120
-
\??\c:\nhtbnn.exec:\nhtbnn.exe82⤵PID:2568
-
\??\c:\vpdjp.exec:\vpdjp.exe83⤵PID:2012
-
\??\c:\llllxfr.exec:\llllxfr.exe84⤵PID:2780
-
\??\c:\rrxxxxf.exec:\rrxxxxf.exe85⤵PID:2724
-
\??\c:\3hbntb.exec:\3hbntb.exe86⤵PID:2772
-
\??\c:\vpvvv.exec:\vpvvv.exe87⤵PID:3036
-
\??\c:\9vddj.exec:\9vddj.exe88⤵PID:2628
-
\??\c:\rlxxfxl.exec:\rlxxfxl.exe89⤵PID:2876
-
\??\c:\3nntbn.exec:\3nntbn.exe90⤵PID:2928
-
\??\c:\btthht.exec:\btthht.exe91⤵PID:2788
-
\??\c:\vjvvd.exec:\vjvvd.exe92⤵PID:2932
-
\??\c:\rfrxfxf.exec:\rfrxfxf.exe93⤵PID:1716
-
\??\c:\htbbhb.exec:\htbbhb.exe94⤵PID:1092
-
\??\c:\nhbhnb.exec:\nhbhnb.exe95⤵PID:1508
-
\??\c:\jdpjv.exec:\jdpjv.exe96⤵PID:3008
-
\??\c:\1fxfrxl.exec:\1fxfrxl.exe97⤵PID:2852
-
\??\c:\lrlxfrf.exec:\lrlxfrf.exe98⤵PID:2848
-
\??\c:\1hntbb.exec:\1hntbb.exe99⤵PID:2720
-
\??\c:\3dddj.exec:\3dddj.exe100⤵PID:2836
-
\??\c:\xxlrflf.exec:\xxlrflf.exe101⤵PID:2844
-
\??\c:\3rlxrrr.exec:\3rlxrrr.exe102⤵PID:2488
-
\??\c:\7htnnt.exec:\7htnnt.exe103⤵PID:1864
-
\??\c:\pddjj.exec:\pddjj.exe104⤵PID:2180
-
\??\c:\5ppdv.exec:\5ppdv.exe105⤵PID:2140
-
\??\c:\llxxflr.exec:\llxxflr.exe106⤵PID:2248
-
\??\c:\3tbbht.exec:\3tbbht.exe107⤵PID:292
-
\??\c:\btntbn.exec:\btntbn.exe108⤵PID:2600
-
\??\c:\ppjvd.exec:\ppjvd.exe109⤵PID:2424
-
\??\c:\frllrxl.exec:\frllrxl.exe110⤵PID:956
-
\??\c:\xrflxfr.exec:\xrflxfr.exe111⤵PID:1816
-
\??\c:\nhbbhh.exec:\nhbbhh.exe112⤵PID:1612
-
\??\c:\jdppv.exec:\jdppv.exe113⤵PID:912
-
\??\c:\vjvvj.exec:\vjvvj.exe114⤵PID:952
-
\??\c:\1rrrrxl.exec:\1rrrrxl.exe115⤵PID:1528
-
\??\c:\hhhntb.exec:\hhhntb.exe116⤵PID:1904
-
\??\c:\dpvvd.exec:\dpvvd.exe117⤵PID:1032
-
\??\c:\vvdvd.exec:\vvdvd.exe118⤵PID:284
-
\??\c:\lfflffr.exec:\lfflffr.exe119⤵PID:2528
-
\??\c:\btbhtt.exec:\btbhtt.exe120⤵PID:804
-
\??\c:\7pvjv.exec:\7pvjv.exe121⤵PID:2548
-
\??\c:\vdppd.exec:\vdppd.exe122⤵PID:2236
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-