Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 23:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe
-
Size
455KB
-
MD5
283c9364bbff0bd00d26d2f288e1542e
-
SHA1
68e823a497f4682b40a4ab50ff23d7653c7d5783
-
SHA256
878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6
-
SHA512
1cdae995124ae1bbfbdc2b4610ed0032c2f98e96d3410d3917484190337d0b6945facf5b6c10304dc272758b9caa6675e351f181d2385d444532279dedaac56c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/1640-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-26-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2400-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-46-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2768-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1340-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-197-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2420-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/780-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-235-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2412-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-279-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2088-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-322-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2220-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-421-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2700-429-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1036-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-461-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2992-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-542-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1704-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-604-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2772-617-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1716-656-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/840-667-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2844-894-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-901-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2556-1337-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2584-1344-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1640 jdvdj.exe 2400 xxrfxfx.exe 2544 bhhtht.exe 2232 llffxxl.exe 2716 5jvpv.exe 2768 pdddj.exe 2980 tnbhbh.exe 2960 djddp.exe 2784 7tbhnh.exe 2628 pjvdp.exe 2184 lffrffr.exe 1340 hnthhn.exe 2900 rrlrfll.exe 1244 nhhnth.exe 984 llfllrl.exe 2912 tnhhtb.exe 1916 lxxxxlr.exe 2020 nhtbhb.exe 552 dvjvd.exe 2420 fxlflrl.exe 2368 nhbhnn.exe 780 llxlflr.exe 1064 tnhntb.exe 3004 vjvvd.exe 1148 pjdpv.exe 1708 lllrfxf.exe 2412 nbthnh.exe 2016 nnbbhh.exe 2088 flffrrf.exe 1704 nnnbtt.exe 1588 frxflrx.exe 2404 htnttb.exe 2084 5frlxxl.exe 1964 9tnbtb.exe 2220 nhnntb.exe 2816 3ppdv.exe 2836 xrlrrxr.exe 2848 ntntnn.exe 2804 9btttb.exe 2980 pjvdp.exe 2960 ffxxffl.exe 2656 tnhntb.exe 2620 vpvpp.exe 2200 7jppp.exe 2184 flfrrfr.exe 1476 1nbhbb.exe 1252 vpppv.exe 1204 5fxxllr.exe 1244 xllrxxf.exe 2700 5nnntt.exe 1604 pvdvv.exe 1036 pjdpd.exe 1620 fxfxlrf.exe 2020 nhtbnn.exe 2648 ppjpv.exe 2128 7rflrrf.exe 1044 ffrlfff.exe 2592 bnbhhh.exe 2708 9dpvp.exe 2992 5jjvj.exe 404 1rlxlfl.exe 2920 7bttbb.exe 1748 pjjvd.exe 1068 lfrlrxl.exe -
resource yara_rule behavioral1/memory/2536-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/780-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-604-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1184-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-877-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-894-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-920-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-971-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-1093-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-1156-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflrxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2536 wrote to memory of 1640 2536 878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe 30 PID 2536 wrote to memory of 1640 2536 878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe 30 PID 2536 wrote to memory of 1640 2536 878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe 30 PID 2536 wrote to memory of 1640 2536 878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe 30 PID 1640 wrote to memory of 2400 1640 jdvdj.exe 31 PID 1640 wrote to memory of 2400 1640 jdvdj.exe 31 PID 1640 wrote to memory of 2400 1640 jdvdj.exe 31 PID 1640 wrote to memory of 2400 1640 jdvdj.exe 31 PID 2400 wrote to memory of 2544 2400 xxrfxfx.exe 32 PID 2400 wrote to memory of 2544 2400 xxrfxfx.exe 32 PID 2400 wrote to memory of 2544 2400 xxrfxfx.exe 32 PID 2400 wrote to memory of 2544 2400 xxrfxfx.exe 32 PID 2544 wrote to memory of 2232 2544 bhhtht.exe 33 PID 2544 wrote to memory of 2232 2544 bhhtht.exe 33 PID 2544 wrote to memory of 2232 2544 bhhtht.exe 33 PID 2544 wrote to memory of 2232 2544 bhhtht.exe 33 PID 2232 wrote to memory of 2716 2232 llffxxl.exe 34 PID 2232 wrote to memory of 2716 2232 llffxxl.exe 34 PID 2232 wrote to memory of 2716 2232 llffxxl.exe 34 PID 2232 wrote to memory of 2716 2232 llffxxl.exe 34 PID 2716 wrote to memory of 2768 2716 5jvpv.exe 35 PID 2716 wrote to memory of 2768 2716 5jvpv.exe 35 PID 2716 wrote to memory of 2768 2716 5jvpv.exe 35 PID 2716 wrote to memory of 2768 2716 5jvpv.exe 35 PID 2768 wrote to memory of 2980 2768 pdddj.exe 36 PID 2768 wrote to memory of 2980 2768 pdddj.exe 36 PID 2768 wrote to memory of 2980 2768 pdddj.exe 36 PID 2768 wrote to memory of 2980 2768 pdddj.exe 36 PID 2980 wrote to memory of 2960 2980 tnbhbh.exe 37 PID 2980 wrote to memory of 2960 2980 tnbhbh.exe 37 PID 2980 wrote to memory of 2960 2980 tnbhbh.exe 37 PID 2980 wrote to memory of 2960 2980 tnbhbh.exe 37 PID 2960 wrote to memory of 2784 2960 djddp.exe 38 PID 2960 wrote to memory of 2784 2960 djddp.exe 38 PID 2960 wrote to memory of 2784 2960 djddp.exe 38 PID 2960 wrote to memory of 2784 2960 djddp.exe 38 PID 2784 wrote to memory of 2628 2784 7tbhnh.exe 39 PID 2784 wrote to memory of 2628 2784 7tbhnh.exe 39 PID 2784 wrote to memory of 2628 2784 7tbhnh.exe 39 PID 2784 wrote to memory of 2628 2784 7tbhnh.exe 39 PID 2628 wrote to memory of 2184 2628 pjvdp.exe 40 PID 2628 wrote to memory of 2184 2628 pjvdp.exe 40 PID 2628 wrote to memory of 2184 2628 pjvdp.exe 40 PID 2628 wrote to memory of 2184 2628 pjvdp.exe 40 PID 2184 wrote to memory of 1340 2184 lffrffr.exe 41 PID 2184 wrote to memory of 1340 2184 lffrffr.exe 41 PID 2184 wrote to memory of 1340 2184 lffrffr.exe 41 PID 2184 wrote to memory of 1340 2184 lffrffr.exe 41 PID 1340 wrote to memory of 2900 1340 hnthhn.exe 42 PID 1340 wrote to memory of 2900 1340 hnthhn.exe 42 PID 1340 wrote to memory of 2900 1340 hnthhn.exe 42 PID 1340 wrote to memory of 2900 1340 hnthhn.exe 42 PID 2900 wrote to memory of 1244 2900 rrlrfll.exe 43 PID 2900 wrote to memory of 1244 2900 rrlrfll.exe 43 PID 2900 wrote to memory of 1244 2900 rrlrfll.exe 43 PID 2900 wrote to memory of 1244 2900 rrlrfll.exe 43 PID 1244 wrote to memory of 984 1244 nhhnth.exe 44 PID 1244 wrote to memory of 984 1244 nhhnth.exe 44 PID 1244 wrote to memory of 984 1244 nhhnth.exe 44 PID 1244 wrote to memory of 984 1244 nhhnth.exe 44 PID 984 wrote to memory of 2912 984 llfllrl.exe 45 PID 984 wrote to memory of 2912 984 llfllrl.exe 45 PID 984 wrote to memory of 2912 984 llfllrl.exe 45 PID 984 wrote to memory of 2912 984 llfllrl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe"C:\Users\Admin\AppData\Local\Temp\878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\jdvdj.exec:\jdvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\xxrfxfx.exec:\xxrfxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\bhhtht.exec:\bhhtht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\llffxxl.exec:\llffxxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\5jvpv.exec:\5jvpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\pdddj.exec:\pdddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\tnbhbh.exec:\tnbhbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\djddp.exec:\djddp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\7tbhnh.exec:\7tbhnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\pjvdp.exec:\pjvdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\lffrffr.exec:\lffrffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\hnthhn.exec:\hnthhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\rrlrfll.exec:\rrlrfll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\nhhnth.exec:\nhhnth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\llfllrl.exec:\llfllrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\tnhhtb.exec:\tnhhtb.exe17⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lxxxxlr.exec:\lxxxxlr.exe18⤵
- Executes dropped EXE
PID:1916 -
\??\c:\nhtbhb.exec:\nhtbhb.exe19⤵
- Executes dropped EXE
PID:2020 -
\??\c:\dvjvd.exec:\dvjvd.exe20⤵
- Executes dropped EXE
PID:552 -
\??\c:\fxlflrl.exec:\fxlflrl.exe21⤵
- Executes dropped EXE
PID:2420 -
\??\c:\nhbhnn.exec:\nhbhnn.exe22⤵
- Executes dropped EXE
PID:2368 -
\??\c:\llxlflr.exec:\llxlflr.exe23⤵
- Executes dropped EXE
PID:780 -
\??\c:\tnhntb.exec:\tnhntb.exe24⤵
- Executes dropped EXE
PID:1064 -
\??\c:\vjvvd.exec:\vjvvd.exe25⤵
- Executes dropped EXE
PID:3004 -
\??\c:\pjdpv.exec:\pjdpv.exe26⤵
- Executes dropped EXE
PID:1148 -
\??\c:\lllrfxf.exec:\lllrfxf.exe27⤵
- Executes dropped EXE
PID:1708 -
\??\c:\nbthnh.exec:\nbthnh.exe28⤵
- Executes dropped EXE
PID:2412 -
\??\c:\nnbbhh.exec:\nnbbhh.exe29⤵
- Executes dropped EXE
PID:2016 -
\??\c:\flffrrf.exec:\flffrrf.exe30⤵
- Executes dropped EXE
PID:2088 -
\??\c:\nnnbtt.exec:\nnnbtt.exe31⤵
- Executes dropped EXE
PID:1704 -
\??\c:\frxflrx.exec:\frxflrx.exe32⤵
- Executes dropped EXE
PID:1588 -
\??\c:\htnttb.exec:\htnttb.exe33⤵
- Executes dropped EXE
PID:2404 -
\??\c:\5frlxxl.exec:\5frlxxl.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2084 -
\??\c:\9tnbtb.exec:\9tnbtb.exe35⤵
- Executes dropped EXE
PID:1964 -
\??\c:\nhnntb.exec:\nhnntb.exe36⤵
- Executes dropped EXE
PID:2220 -
\??\c:\3ppdv.exec:\3ppdv.exe37⤵
- Executes dropped EXE
PID:2816 -
\??\c:\xrlrrxr.exec:\xrlrrxr.exe38⤵
- Executes dropped EXE
PID:2836 -
\??\c:\ntntnn.exec:\ntntnn.exe39⤵
- Executes dropped EXE
PID:2848 -
\??\c:\9btttb.exec:\9btttb.exe40⤵
- Executes dropped EXE
PID:2804 -
\??\c:\pjvdp.exec:\pjvdp.exe41⤵
- Executes dropped EXE
PID:2980 -
\??\c:\ffxxffl.exec:\ffxxffl.exe42⤵
- Executes dropped EXE
PID:2960 -
\??\c:\tnhntb.exec:\tnhntb.exe43⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vpvpp.exec:\vpvpp.exe44⤵
- Executes dropped EXE
PID:2620 -
\??\c:\7jppp.exec:\7jppp.exe45⤵
- Executes dropped EXE
PID:2200 -
\??\c:\flfrrfr.exec:\flfrrfr.exe46⤵
- Executes dropped EXE
PID:2184 -
\??\c:\1nbhbb.exec:\1nbhbb.exe47⤵
- Executes dropped EXE
PID:1476 -
\??\c:\vpppv.exec:\vpppv.exe48⤵
- Executes dropped EXE
PID:1252 -
\??\c:\5fxxllr.exec:\5fxxllr.exe49⤵
- Executes dropped EXE
PID:1204 -
\??\c:\xllrxxf.exec:\xllrxxf.exe50⤵
- Executes dropped EXE
PID:1244 -
\??\c:\5nnntt.exec:\5nnntt.exe51⤵
- Executes dropped EXE
PID:2700 -
\??\c:\pvdvv.exec:\pvdvv.exe52⤵
- Executes dropped EXE
PID:1604 -
\??\c:\pjdpd.exec:\pjdpd.exe53⤵
- Executes dropped EXE
PID:1036 -
\??\c:\fxfxlrf.exec:\fxfxlrf.exe54⤵
- Executes dropped EXE
PID:1620 -
\??\c:\nhtbnn.exec:\nhtbnn.exe55⤵
- Executes dropped EXE
PID:2020 -
\??\c:\ppjpv.exec:\ppjpv.exe56⤵
- Executes dropped EXE
PID:2648 -
\??\c:\7rflrrf.exec:\7rflrrf.exe57⤵
- Executes dropped EXE
PID:2128 -
\??\c:\ffrlfff.exec:\ffrlfff.exe58⤵
- Executes dropped EXE
PID:1044 -
\??\c:\bnbhhh.exec:\bnbhhh.exe59⤵
- Executes dropped EXE
PID:2592 -
\??\c:\9dpvp.exec:\9dpvp.exe60⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5jjvj.exec:\5jjvj.exe61⤵
- Executes dropped EXE
PID:2992 -
\??\c:\1rlxlfl.exec:\1rlxlfl.exe62⤵
- Executes dropped EXE
PID:404 -
\??\c:\7bttbb.exec:\7bttbb.exe63⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pjjvd.exec:\pjjvd.exe64⤵
- Executes dropped EXE
PID:1748 -
\??\c:\lfrlrxl.exec:\lfrlrxl.exe65⤵
- Executes dropped EXE
PID:1068 -
\??\c:\1rfrxrr.exec:\1rfrxrr.exe66⤵PID:1760
-
\??\c:\btntnn.exec:\btntnn.exe67⤵PID:1928
-
\??\c:\ppjvd.exec:\ppjvd.exe68⤵PID:1944
-
\??\c:\pppvj.exec:\pppvj.exe69⤵PID:2364
-
\??\c:\rfxrffl.exec:\rfxrffl.exe70⤵PID:2408
-
\??\c:\bbnnhb.exec:\bbnnhb.exe71⤵PID:3048
-
\??\c:\1hhtbn.exec:\1hhtbn.exe72⤵PID:1704
-
\??\c:\pjvjp.exec:\pjvjp.exe73⤵PID:1588
-
\??\c:\djvjv.exec:\djvjv.exe74⤵PID:2252
-
\??\c:\lfffrrf.exec:\lfffrrf.exe75⤵PID:2028
-
\??\c:\tnhnhh.exec:\tnhnhh.exe76⤵PID:2084
-
\??\c:\3thntb.exec:\3thntb.exe77⤵PID:2828
-
\??\c:\5vjvd.exec:\5vjvd.exe78⤵PID:2720
-
\??\c:\rllrxxl.exec:\rllrxxl.exe79⤵PID:2824
-
\??\c:\5rlrxfl.exec:\5rlrxfl.exe80⤵PID:2836
-
\??\c:\bnhnnt.exec:\bnhnnt.exe81⤵PID:2772
-
\??\c:\pjvdp.exec:\pjvdp.exe82⤵PID:2864
-
\??\c:\5xfxxxx.exec:\5xfxxxx.exe83⤵PID:316
-
\??\c:\3lrlrlr.exec:\3lrlrlr.exe84⤵PID:2652
-
\??\c:\9bbbhh.exec:\9bbbhh.exe85⤵PID:2684
-
\??\c:\ppvdv.exec:\ppvdv.exe86⤵PID:840
-
\??\c:\dvpvj.exec:\dvpvj.exe87⤵PID:1716
-
\??\c:\xflxrrr.exec:\xflxrrr.exe88⤵PID:2948
-
\??\c:\hbtbtt.exec:\hbtbtt.exe89⤵PID:2888
-
\??\c:\bhbntb.exec:\bhbntb.exe90⤵PID:1184
-
\??\c:\ddpdp.exec:\ddpdp.exe91⤵PID:2360
-
\??\c:\xrfflrf.exec:\xrfflrf.exe92⤵PID:2596
-
\??\c:\hbhhnt.exec:\hbhhnt.exe93⤵PID:2660
-
\??\c:\1nntbn.exec:\1nntbn.exe94⤵PID:1908
-
\??\c:\dvppd.exec:\dvppd.exe95⤵PID:2136
-
\??\c:\rlffrxx.exec:\rlffrxx.exe96⤵PID:3052
-
\??\c:\rfxxrrf.exec:\rfxxrrf.exe97⤵PID:3068
-
\??\c:\5bbbbh.exec:\5bbbbh.exe98⤵PID:2228
-
\??\c:\jvjdj.exec:\jvjdj.exe99⤵PID:2164
-
\??\c:\vpppv.exec:\vpppv.exe100⤵PID:2128
-
\??\c:\ffrxrff.exec:\ffrxrff.exe101⤵PID:2124
-
\??\c:\nbnnnn.exec:\nbnnnn.exe102⤵PID:2588
-
\??\c:\9nbbnb.exec:\9nbbnb.exe103⤵PID:1636
-
\??\c:\7pjjp.exec:\7pjjp.exe104⤵PID:948
-
\??\c:\jjddp.exec:\jjddp.exe105⤵PID:2168
-
\??\c:\xrrfrxl.exec:\xrrfrxl.exe106⤵PID:1304
-
\??\c:\bbbttn.exec:\bbbttn.exe107⤵PID:2792
-
\??\c:\pppdp.exec:\pppdp.exe108⤵PID:2976
-
\??\c:\vpvpp.exec:\vpvpp.exe109⤵PID:1864
-
\??\c:\9frrrrf.exec:\9frrrrf.exe110⤵PID:280
-
\??\c:\nbnnnn.exec:\nbnnnn.exe111⤵PID:1300
-
\??\c:\ntthhn.exec:\ntthhn.exe112⤵PID:876
-
\??\c:\vjdjp.exec:\vjdjp.exe113⤵PID:1684
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe114⤵PID:1556
-
\??\c:\rrlxrxr.exec:\rrlxrxr.exe115⤵PID:2356
-
\??\c:\nnnhbb.exec:\nnnhbb.exe116⤵PID:1680
-
\??\c:\pjvvj.exec:\pjvvj.exe117⤵PID:2544
-
\??\c:\vvjpj.exec:\vvjpj.exe118⤵PID:1964
-
\??\c:\3rlrxff.exec:\3rlrxff.exe119⤵PID:2232
-
\??\c:\tnhbhn.exec:\tnhbhn.exe120⤵PID:2744
-
\??\c:\1pvjp.exec:\1pvjp.exe121⤵PID:2996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-