Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 23:17
Behavioral task
behavioral1
Sample
84ad9fda14d613cfd665b5fe37ad915b8db34e888ab8ccdc877a95da97c3cbbb.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
84ad9fda14d613cfd665b5fe37ad915b8db34e888ab8ccdc877a95da97c3cbbb.exe
-
Size
332KB
-
MD5
3576c8b5fe7b135f7b3c50292490eabb
-
SHA1
b7421cc3b458e70e701b77c2a1190cc1f7b6a6d4
-
SHA256
84ad9fda14d613cfd665b5fe37ad915b8db34e888ab8ccdc877a95da97c3cbbb
-
SHA512
f413172ae22520b2818a1ec704704ca76a64f3305904dc539cb48db9c6eb86bbb54a1d9e147fc9b4346cbb9e53c67443f84572462a9c6c8f4c391c186fc3f4ff
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7t0:94wFHoStJdSjylh2b77BoTMA9gX59sTM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2084-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1228-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1128-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-32-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1408-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2072-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/856-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2320-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/752-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1528-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-212-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/304-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1812-270-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1812-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2424-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-352-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2704-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-367-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2644-365-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2164-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-379-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2980-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/856-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1440-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1676-476-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2184-795-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2240-6591-0x00000000770D0000-0x00000000771EF000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2384 hhhttb.exe 1228 dpvpd.exe 2880 rlflfxf.exe 1128 btnnth.exe 1408 jdvdp.exe 2072 bnhntb.exe 2232 nhtbnn.exe 2708 9lfllrf.exe 2636 btnbnt.exe 2772 3pjvp.exe 2796 9xrrrxf.exe 2744 thttbh.exe 2496 pjppp.exe 2612 1lrrlrl.exe 2924 nbthhh.exe 856 1xxfffl.exe 2320 rfxrxxf.exe 2420 dvjvd.exe 752 7pvjj.exe 1352 9nnnbb.exe 372 thtnhh.exe 1528 pdpvj.exe 1624 5lxlrfl.exe 1584 nbnntt.exe 2940 5djpd.exe 304 5lxxxfx.exe 1508 7btthh.exe 1564 dvjpv.exe 1928 5rxxffr.exe 740 bnhnbn.exe 912 5jdjv.exe 3012 lrlrrrx.exe 1812 xlxxrlr.exe 1912 3nnnbb.exe 1504 5vjjv.exe 2868 fxrrflx.exe 2872 rfrrflr.exe 1604 9htthh.exe 2384 dvjjv.exe 2900 vpppd.exe 2100 frrrxlr.exe 1952 nhtbhn.exe 2780 tnntbb.exe 1956 pjdjv.exe 2424 vdvpj.exe 2620 1fxxrrf.exe 2712 fxffllr.exe 2704 bhbnth.exe 2644 nnbnht.exe 2164 7pvpp.exe 2456 1xrrfrx.exe 2520 3xlllfr.exe 2604 hbthnn.exe 2544 3dppd.exe 2952 vvpvj.exe 2980 ffrlxff.exe 2180 tbbhtn.exe 856 nbnhnh.exe 2276 jjjjp.exe 1440 9jjjp.exe 2464 rfrrrrf.exe 752 7hbhnt.exe 1992 9nhhht.exe 2828 jdpjd.exe -
resource yara_rule behavioral1/memory/2084-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000012029-5.dat upx behavioral1/memory/2384-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2084-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d0d-17.dat upx behavioral1/memory/1228-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015d2e-25.dat upx behavioral1/memory/1128-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d50-36.dat upx behavioral1/memory/2880-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d5c-43.dat upx behavioral1/memory/1408-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d64-50.dat upx behavioral1/memory/2072-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015d6d-60.dat upx behavioral1/memory/2072-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2232-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016858-68.dat upx behavioral1/memory/2708-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186de-76.dat upx behavioral1/files/0x00050000000186ee-84.dat upx behavioral1/memory/2772-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001875d-93.dat upx behavioral1/files/0x0005000000018761-100.dat upx behavioral1/memory/2744-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018bcd-108.dat upx behavioral1/files/0x0006000000018d63-115.dat upx behavioral1/memory/2612-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2496-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018d68-124.dat upx behavioral1/files/0x0006000000019030-131.dat upx behavioral1/memory/856-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/856-139-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000600000001903d-141.dat upx behavioral1/memory/856-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2320-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001920f-148.dat upx behavioral1/files/0x0005000000019228-156.dat upx behavioral1/files/0x0005000000019234-167.dat upx behavioral1/memory/752-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019241-173.dat upx behavioral1/files/0x0009000000015cdb-182.dat upx behavioral1/files/0x000500000001925c-189.dat upx behavioral1/memory/1528-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019273-198.dat upx behavioral1/files/0x00050000000192f0-205.dat upx behavioral1/files/0x000500000001932a-213.dat upx behavioral1/memory/304-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001933e-221.dat upx behavioral1/files/0x0005000000019346-228.dat upx behavioral1/files/0x0005000000019384-235.dat upx behavioral1/memory/1928-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193a2-243.dat upx behavioral1/files/0x00050000000193af-250.dat upx behavioral1/files/0x00050000000193c9-257.dat upx behavioral1/memory/3012-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1812-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2868-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2868-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2872-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-313-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2100-319-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1956-330-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlxxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2384 2084 84ad9fda14d613cfd665b5fe37ad915b8db34e888ab8ccdc877a95da97c3cbbb.exe 28 PID 2084 wrote to memory of 2384 2084 84ad9fda14d613cfd665b5fe37ad915b8db34e888ab8ccdc877a95da97c3cbbb.exe 28 PID 2084 wrote to memory of 2384 2084 84ad9fda14d613cfd665b5fe37ad915b8db34e888ab8ccdc877a95da97c3cbbb.exe 28 PID 2084 wrote to memory of 2384 2084 84ad9fda14d613cfd665b5fe37ad915b8db34e888ab8ccdc877a95da97c3cbbb.exe 28 PID 2384 wrote to memory of 1228 2384 hhhttb.exe 29 PID 2384 wrote to memory of 1228 2384 hhhttb.exe 29 PID 2384 wrote to memory of 1228 2384 hhhttb.exe 29 PID 2384 wrote to memory of 1228 2384 hhhttb.exe 29 PID 1228 wrote to memory of 2880 1228 dpvpd.exe 30 PID 1228 wrote to memory of 2880 1228 dpvpd.exe 30 PID 1228 wrote to memory of 2880 1228 dpvpd.exe 30 PID 1228 wrote to memory of 2880 1228 dpvpd.exe 30 PID 2880 wrote to memory of 1128 2880 rlflfxf.exe 31 PID 2880 wrote to memory of 1128 2880 rlflfxf.exe 31 PID 2880 wrote to memory of 1128 2880 rlflfxf.exe 31 PID 2880 wrote to memory of 1128 2880 rlflfxf.exe 31 PID 1128 wrote to memory of 1408 1128 btnnth.exe 32 PID 1128 wrote to memory of 1408 1128 btnnth.exe 32 PID 1128 wrote to memory of 1408 1128 btnnth.exe 32 PID 1128 wrote to memory of 1408 1128 btnnth.exe 32 PID 1408 wrote to memory of 2072 1408 jdvdp.exe 33 PID 1408 wrote to memory of 2072 1408 jdvdp.exe 33 PID 1408 wrote to memory of 2072 1408 jdvdp.exe 33 PID 1408 wrote to memory of 2072 1408 jdvdp.exe 33 PID 2072 wrote to memory of 2232 2072 bnhntb.exe 34 PID 2072 wrote to memory of 2232 2072 bnhntb.exe 34 PID 2072 wrote to memory of 2232 2072 bnhntb.exe 34 PID 2072 wrote to memory of 2232 2072 bnhntb.exe 34 PID 2232 wrote to memory of 2708 2232 nhtbnn.exe 35 PID 2232 wrote to memory of 2708 2232 nhtbnn.exe 35 PID 2232 wrote to memory of 2708 2232 nhtbnn.exe 35 PID 2232 wrote to memory of 2708 2232 nhtbnn.exe 35 PID 2708 wrote to memory of 2636 2708 9lfllrf.exe 36 PID 2708 wrote to memory of 2636 2708 9lfllrf.exe 36 PID 2708 wrote to memory of 2636 2708 9lfllrf.exe 36 PID 2708 wrote to memory of 2636 2708 9lfllrf.exe 36 PID 2636 wrote to memory of 2772 2636 btnbnt.exe 37 PID 2636 wrote to memory of 2772 2636 btnbnt.exe 37 PID 2636 wrote to memory of 2772 2636 btnbnt.exe 37 PID 2636 wrote to memory of 2772 2636 btnbnt.exe 37 PID 2772 wrote to memory of 2796 2772 3pjvp.exe 38 PID 2772 wrote to memory of 2796 2772 3pjvp.exe 38 PID 2772 wrote to memory of 2796 2772 3pjvp.exe 38 PID 2772 wrote to memory of 2796 2772 3pjvp.exe 38 PID 2796 wrote to memory of 2744 2796 9xrrrxf.exe 39 PID 2796 wrote to memory of 2744 2796 9xrrrxf.exe 39 PID 2796 wrote to memory of 2744 2796 9xrrrxf.exe 39 PID 2796 wrote to memory of 2744 2796 9xrrrxf.exe 39 PID 2744 wrote to memory of 2496 2744 thttbh.exe 40 PID 2744 wrote to memory of 2496 2744 thttbh.exe 40 PID 2744 wrote to memory of 2496 2744 thttbh.exe 40 PID 2744 wrote to memory of 2496 2744 thttbh.exe 40 PID 2496 wrote to memory of 2612 2496 pjppp.exe 41 PID 2496 wrote to memory of 2612 2496 pjppp.exe 41 PID 2496 wrote to memory of 2612 2496 pjppp.exe 41 PID 2496 wrote to memory of 2612 2496 pjppp.exe 41 PID 2612 wrote to memory of 2924 2612 1lrrlrl.exe 42 PID 2612 wrote to memory of 2924 2612 1lrrlrl.exe 42 PID 2612 wrote to memory of 2924 2612 1lrrlrl.exe 42 PID 2612 wrote to memory of 2924 2612 1lrrlrl.exe 42 PID 2924 wrote to memory of 856 2924 nbthhh.exe 43 PID 2924 wrote to memory of 856 2924 nbthhh.exe 43 PID 2924 wrote to memory of 856 2924 nbthhh.exe 43 PID 2924 wrote to memory of 856 2924 nbthhh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\84ad9fda14d613cfd665b5fe37ad915b8db34e888ab8ccdc877a95da97c3cbbb.exe"C:\Users\Admin\AppData\Local\Temp\84ad9fda14d613cfd665b5fe37ad915b8db34e888ab8ccdc877a95da97c3cbbb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\hhhttb.exec:\hhhttb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\dpvpd.exec:\dpvpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\rlflfxf.exec:\rlflfxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\btnnth.exec:\btnnth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\jdvdp.exec:\jdvdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\bnhntb.exec:\bnhntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\nhtbnn.exec:\nhtbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\9lfllrf.exec:\9lfllrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\btnbnt.exec:\btnbnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\3pjvp.exec:\3pjvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\9xrrrxf.exec:\9xrrrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\thttbh.exec:\thttbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\pjppp.exec:\pjppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\1lrrlrl.exec:\1lrrlrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\nbthhh.exec:\nbthhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\1xxfffl.exec:\1xxfffl.exe17⤵
- Executes dropped EXE
PID:856 -
\??\c:\rfxrxxf.exec:\rfxrxxf.exe18⤵
- Executes dropped EXE
PID:2320 -
\??\c:\dvjvd.exec:\dvjvd.exe19⤵
- Executes dropped EXE
PID:2420 -
\??\c:\7pvjj.exec:\7pvjj.exe20⤵
- Executes dropped EXE
PID:752 -
\??\c:\9nnnbb.exec:\9nnnbb.exe21⤵
- Executes dropped EXE
PID:1352 -
\??\c:\thtnhh.exec:\thtnhh.exe22⤵
- Executes dropped EXE
PID:372 -
\??\c:\pdpvj.exec:\pdpvj.exe23⤵
- Executes dropped EXE
PID:1528 -
\??\c:\5lxlrfl.exec:\5lxlrfl.exe24⤵
- Executes dropped EXE
PID:1624 -
\??\c:\nbnntt.exec:\nbnntt.exe25⤵
- Executes dropped EXE
PID:1584 -
\??\c:\5djpd.exec:\5djpd.exe26⤵
- Executes dropped EXE
PID:2940 -
\??\c:\5lxxxfx.exec:\5lxxxfx.exe27⤵
- Executes dropped EXE
PID:304 -
\??\c:\7btthh.exec:\7btthh.exe28⤵
- Executes dropped EXE
PID:1508 -
\??\c:\dvjpv.exec:\dvjpv.exe29⤵
- Executes dropped EXE
PID:1564 -
\??\c:\5rxxffr.exec:\5rxxffr.exe30⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bnhnbn.exec:\bnhnbn.exe31⤵
- Executes dropped EXE
PID:740 -
\??\c:\5jdjv.exec:\5jdjv.exe32⤵
- Executes dropped EXE
PID:912 -
\??\c:\lrlrrrx.exec:\lrlrrrx.exe33⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xlxxrlr.exec:\xlxxrlr.exe34⤵
- Executes dropped EXE
PID:1812 -
\??\c:\3nnnbb.exec:\3nnnbb.exe35⤵
- Executes dropped EXE
PID:1912 -
\??\c:\5vjjv.exec:\5vjjv.exe36⤵
- Executes dropped EXE
PID:1504 -
\??\c:\fxrrflx.exec:\fxrrflx.exe37⤵
- Executes dropped EXE
PID:2868 -
\??\c:\rfrrflr.exec:\rfrrflr.exe38⤵
- Executes dropped EXE
PID:2872 -
\??\c:\9htthh.exec:\9htthh.exe39⤵
- Executes dropped EXE
PID:1604 -
\??\c:\dvjjv.exec:\dvjjv.exe40⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vpppd.exec:\vpppd.exe41⤵
- Executes dropped EXE
PID:2900 -
\??\c:\frrrxlr.exec:\frrrxlr.exe42⤵
- Executes dropped EXE
PID:2100 -
\??\c:\nhtbhn.exec:\nhtbhn.exe43⤵
- Executes dropped EXE
PID:1952 -
\??\c:\tnntbb.exec:\tnntbb.exe44⤵
- Executes dropped EXE
PID:2780 -
\??\c:\pjdjv.exec:\pjdjv.exe45⤵
- Executes dropped EXE
PID:1956 -
\??\c:\vdvpj.exec:\vdvpj.exe46⤵
- Executes dropped EXE
PID:2424 -
\??\c:\1fxxrrf.exec:\1fxxrrf.exe47⤵
- Executes dropped EXE
PID:2620 -
\??\c:\fxffllr.exec:\fxffllr.exe48⤵
- Executes dropped EXE
PID:2712 -
\??\c:\bhbnth.exec:\bhbnth.exe49⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nnbnht.exec:\nnbnht.exe50⤵
- Executes dropped EXE
PID:2644 -
\??\c:\7pvpp.exec:\7pvpp.exe51⤵
- Executes dropped EXE
PID:2164 -
\??\c:\1xrrfrx.exec:\1xrrfrx.exe52⤵
- Executes dropped EXE
PID:2456 -
\??\c:\3xlllfr.exec:\3xlllfr.exe53⤵
- Executes dropped EXE
PID:2520 -
\??\c:\hbthnn.exec:\hbthnn.exe54⤵
- Executes dropped EXE
PID:2604 -
\??\c:\3dppd.exec:\3dppd.exe55⤵
- Executes dropped EXE
PID:2544 -
\??\c:\vvpvj.exec:\vvpvj.exe56⤵
- Executes dropped EXE
PID:2952 -
\??\c:\ffrlxff.exec:\ffrlxff.exe57⤵
- Executes dropped EXE
PID:2980 -
\??\c:\tbbhtn.exec:\tbbhtn.exe58⤵
- Executes dropped EXE
PID:2180 -
\??\c:\nbnhnh.exec:\nbnhnh.exe59⤵
- Executes dropped EXE
PID:856 -
\??\c:\jjjjp.exec:\jjjjp.exe60⤵
- Executes dropped EXE
PID:2276 -
\??\c:\9jjjp.exec:\9jjjp.exe61⤵
- Executes dropped EXE
PID:1440 -
\??\c:\rfrrrrf.exec:\rfrrrrf.exe62⤵
- Executes dropped EXE
PID:2464 -
\??\c:\7hbhnt.exec:\7hbhnt.exe63⤵
- Executes dropped EXE
PID:752 -
\??\c:\9nhhht.exec:\9nhhht.exe64⤵
- Executes dropped EXE
PID:1992 -
\??\c:\jdpjd.exec:\jdpjd.exe65⤵
- Executes dropped EXE
PID:2828 -
\??\c:\djvvd.exec:\djvvd.exe66⤵PID:2248
-
\??\c:\lfllllr.exec:\lfllllr.exe67⤵PID:1528
-
\??\c:\7nhtbt.exec:\7nhtbt.exe68⤵PID:864
-
\??\c:\nbhbbt.exec:\nbhbbt.exe69⤵PID:1676
-
\??\c:\9vpvd.exec:\9vpvd.exe70⤵
- System Location Discovery: System Language Discovery
PID:2256 -
\??\c:\pdpvv.exec:\pdpvv.exe71⤵PID:1336
-
\??\c:\fxllrrx.exec:\fxllrrx.exe72⤵PID:948
-
\??\c:\3thntt.exec:\3thntt.exe73⤵PID:1304
-
\??\c:\3thhhb.exec:\3thhhb.exe74⤵PID:1672
-
\??\c:\7dvdp.exec:\7dvdp.exe75⤵PID:1076
-
\??\c:\rlrrxxl.exec:\rlrrxxl.exe76⤵PID:1648
-
\??\c:\rlxfxrf.exec:\rlxfxrf.exe77⤵PID:2148
-
\??\c:\tbhhbb.exec:\tbhhbb.exe78⤵PID:2220
-
\??\c:\nhthbb.exec:\nhthbb.exe79⤵PID:3020
-
\??\c:\3jpjj.exec:\3jpjj.exe80⤵PID:2344
-
\??\c:\xrrrrlr.exec:\xrrrrlr.exe81⤵PID:2188
-
\??\c:\1rrffxx.exec:\1rrffxx.exe82⤵PID:1996
-
\??\c:\7hbbhn.exec:\7hbbhn.exe83⤵PID:888
-
\??\c:\vpddj.exec:\vpddj.exe84⤵PID:2080
-
\??\c:\xxxxflx.exec:\xxxxflx.exe85⤵PID:1720
-
\??\c:\fxllllx.exec:\fxllllx.exe86⤵PID:2872
-
\??\c:\btbhnt.exec:\btbhnt.exe87⤵PID:1696
-
\??\c:\ddvdj.exec:\ddvdj.exe88⤵PID:2928
-
\??\c:\ddjdd.exec:\ddjdd.exe89⤵PID:2884
-
\??\c:\xxrxfff.exec:\xxrxfff.exe90⤵PID:2100
-
\??\c:\lffflrf.exec:\lffflrf.exe91⤵PID:1952
-
\??\c:\thhnnh.exec:\thhnnh.exe92⤵PID:1248
-
\??\c:\jvvpj.exec:\jvvpj.exe93⤵PID:1956
-
\??\c:\ddjpv.exec:\ddjpv.exe94⤵PID:2584
-
\??\c:\rllllll.exec:\rllllll.exe95⤵PID:2168
-
\??\c:\9thhtb.exec:\9thhtb.exe96⤵PID:2692
-
\??\c:\tbbbbn.exec:\tbbbbn.exe97⤵PID:2704
-
\??\c:\pjpjp.exec:\pjpjp.exe98⤵PID:2500
-
\??\c:\vpjvp.exec:\vpjvp.exe99⤵PID:2772
-
\??\c:\frxrrrf.exec:\frxrrrf.exe100⤵PID:2764
-
\??\c:\nhttbb.exec:\nhttbb.exe101⤵PID:2540
-
\??\c:\hbtbnn.exec:\hbtbnn.exe102⤵PID:2492
-
\??\c:\ppvvj.exec:\ppvvj.exe103⤵
- System Location Discovery: System Language Discovery
PID:2488 -
\??\c:\dvdvd.exec:\dvdvd.exe104⤵PID:2612
-
\??\c:\5rflfll.exec:\5rflfll.exe105⤵PID:2260
-
\??\c:\bbbhnt.exec:\bbbhnt.exe106⤵PID:2252
-
\??\c:\nhtbhb.exec:\nhtbhb.exe107⤵PID:1740
-
\??\c:\7jvdp.exec:\7jvdp.exe108⤵PID:664
-
\??\c:\rfxrxlr.exec:\rfxrxlr.exe109⤵PID:1760
-
\??\c:\lrfffxx.exec:\lrfffxx.exe110⤵PID:2420
-
\??\c:\hbhntb.exec:\hbhntb.exe111⤵PID:1784
-
\??\c:\nbtbbn.exec:\nbtbbn.exe112⤵PID:1260
-
\??\c:\pvpvp.exec:\pvpvp.exe113⤵PID:1500
-
\??\c:\llfllrx.exec:\llfllrx.exe114⤵PID:1992
-
\??\c:\lrffrrx.exec:\lrffrrx.exe115⤵PID:2828
-
\??\c:\btthtn.exec:\btthtn.exe116⤵PID:2248
-
\??\c:\jdppv.exec:\jdppv.exe117⤵PID:1612
-
\??\c:\vpddd.exec:\vpddd.exe118⤵PID:2816
-
\??\c:\rlxfffr.exec:\rlxfffr.exe119⤵PID:1892
-
\??\c:\3rrfrll.exec:\3rrfrll.exe120⤵PID:1584
-
\??\c:\3tnttt.exec:\3tnttt.exe121⤵PID:1336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-