Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 23:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe
-
Size
455KB
-
MD5
283c9364bbff0bd00d26d2f288e1542e
-
SHA1
68e823a497f4682b40a4ab50ff23d7653c7d5783
-
SHA256
878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6
-
SHA512
1cdae995124ae1bbfbdc2b4610ed0032c2f98e96d3410d3917484190337d0b6945facf5b6c10304dc272758b9caa6675e351f181d2385d444532279dedaac56c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2432-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/108-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-36-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2444-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-38-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2640-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-51-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2812-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1100-104-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1100-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-123-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2752-124-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2004-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-173-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1528-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1452-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-279-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/876-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-339-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2820-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-386-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1720-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-494-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2360-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-596-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2112-749-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-831-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2176-1191-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2412-1250-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2040-1326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1088 xllrlff.exe 108 pppvp.exe 2444 dpvpd.exe 2640 fflxfxx.exe 2812 pvvdv.exe 2852 rxrrffr.exe 2720 nnhbtb.exe 2644 rrrlrxl.exe 2544 rrfrfrx.exe 1100 rrrfxll.exe 1476 lxllrrx.exe 2752 flrffrl.exe 1152 jjjpd.exe 2004 thtnbb.exe 2592 1fffrlf.exe 3020 nhhthb.exe 1392 vjdpp.exe 1528 hnbntn.exe 1452 lffllxx.exe 1244 7tntht.exe 1936 9jdvj.exe 1084 bbhbnb.exe 1304 jvvdp.exe 1400 hnbbnt.exe 1708 pjdpd.exe 1920 tthnnh.exe 1664 xxlrrxf.exe 2084 vddpj.exe 2272 rrlxrxl.exe 876 nttttt.exe 1892 vvvpj.exe 1580 pjjpd.exe 1560 xrlrlxl.exe 2448 bthbbh.exe 2908 jjdjp.exe 2364 xrfrlrl.exe 2804 btthnh.exe 2684 dpjjp.exe 2860 jjppd.exe 2836 rrlrlfr.exe 1628 nnbhbh.exe 2820 vvddv.exe 2560 xlxrrlx.exe 2544 fffrlff.exe 3012 7nhnbb.exe 1720 pjdpv.exe 2756 xxxlfrl.exe 1672 tbtnbn.exe 2276 nnhtnt.exe 1236 vvdjv.exe 1120 9xffrxf.exe 1504 5thnhh.exe 1816 5bbbth.exe 2036 pvppp.exe 1872 9xrfflf.exe 956 1nhbnb.exe 1644 jjdvj.exe 548 pvdpj.exe 1980 rxxrfxr.exe 2360 btnbnt.exe 1896 hhhnht.exe 1776 9vvdv.exe 1520 lxflrxx.exe 2040 hnhnnb.exe -
resource yara_rule behavioral1/memory/2432-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-279-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/876-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-414-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1816-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-768-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-856-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-944-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-1083-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2624-1124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-1265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-1326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-1333-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1llllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2432 wrote to memory of 1088 2432 878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe 31 PID 2432 wrote to memory of 1088 2432 878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe 31 PID 2432 wrote to memory of 1088 2432 878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe 31 PID 2432 wrote to memory of 1088 2432 878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe 31 PID 1088 wrote to memory of 108 1088 xllrlff.exe 32 PID 1088 wrote to memory of 108 1088 xllrlff.exe 32 PID 1088 wrote to memory of 108 1088 xllrlff.exe 32 PID 1088 wrote to memory of 108 1088 xllrlff.exe 32 PID 108 wrote to memory of 2444 108 pppvp.exe 33 PID 108 wrote to memory of 2444 108 pppvp.exe 33 PID 108 wrote to memory of 2444 108 pppvp.exe 33 PID 108 wrote to memory of 2444 108 pppvp.exe 33 PID 2444 wrote to memory of 2640 2444 dpvpd.exe 34 PID 2444 wrote to memory of 2640 2444 dpvpd.exe 34 PID 2444 wrote to memory of 2640 2444 dpvpd.exe 34 PID 2444 wrote to memory of 2640 2444 dpvpd.exe 34 PID 2640 wrote to memory of 2812 2640 fflxfxx.exe 35 PID 2640 wrote to memory of 2812 2640 fflxfxx.exe 35 PID 2640 wrote to memory of 2812 2640 fflxfxx.exe 35 PID 2640 wrote to memory of 2812 2640 fflxfxx.exe 35 PID 2812 wrote to memory of 2852 2812 pvvdv.exe 36 PID 2812 wrote to memory of 2852 2812 pvvdv.exe 36 PID 2812 wrote to memory of 2852 2812 pvvdv.exe 36 PID 2812 wrote to memory of 2852 2812 pvvdv.exe 36 PID 2852 wrote to memory of 2720 2852 rxrrffr.exe 37 PID 2852 wrote to memory of 2720 2852 rxrrffr.exe 37 PID 2852 wrote to memory of 2720 2852 rxrrffr.exe 37 PID 2852 wrote to memory of 2720 2852 rxrrffr.exe 37 PID 2720 wrote to memory of 2644 2720 nnhbtb.exe 38 PID 2720 wrote to memory of 2644 2720 nnhbtb.exe 38 PID 2720 wrote to memory of 2644 2720 nnhbtb.exe 38 PID 2720 wrote to memory of 2644 2720 nnhbtb.exe 38 PID 2644 wrote to memory of 2544 2644 rrrlrxl.exe 39 PID 2644 wrote to memory of 2544 2644 rrrlrxl.exe 39 PID 2644 wrote to memory of 2544 2644 rrrlrxl.exe 39 PID 2644 wrote to memory of 2544 2644 rrrlrxl.exe 39 PID 2544 wrote to memory of 1100 2544 rrfrfrx.exe 40 PID 2544 wrote to memory of 1100 2544 rrfrfrx.exe 40 PID 2544 wrote to memory of 1100 2544 rrfrfrx.exe 40 PID 2544 wrote to memory of 1100 2544 rrfrfrx.exe 40 PID 1100 wrote to memory of 1476 1100 rrrfxll.exe 41 PID 1100 wrote to memory of 1476 1100 rrrfxll.exe 41 PID 1100 wrote to memory of 1476 1100 rrrfxll.exe 41 PID 1100 wrote to memory of 1476 1100 rrrfxll.exe 41 PID 1476 wrote to memory of 2752 1476 lxllrrx.exe 42 PID 1476 wrote to memory of 2752 1476 lxllrrx.exe 42 PID 1476 wrote to memory of 2752 1476 lxllrrx.exe 42 PID 1476 wrote to memory of 2752 1476 lxllrrx.exe 42 PID 2752 wrote to memory of 1152 2752 flrffrl.exe 43 PID 2752 wrote to memory of 1152 2752 flrffrl.exe 43 PID 2752 wrote to memory of 1152 2752 flrffrl.exe 43 PID 2752 wrote to memory of 1152 2752 flrffrl.exe 43 PID 1152 wrote to memory of 2004 1152 jjjpd.exe 44 PID 1152 wrote to memory of 2004 1152 jjjpd.exe 44 PID 1152 wrote to memory of 2004 1152 jjjpd.exe 44 PID 1152 wrote to memory of 2004 1152 jjjpd.exe 44 PID 2004 wrote to memory of 2592 2004 thtnbb.exe 45 PID 2004 wrote to memory of 2592 2004 thtnbb.exe 45 PID 2004 wrote to memory of 2592 2004 thtnbb.exe 45 PID 2004 wrote to memory of 2592 2004 thtnbb.exe 45 PID 2592 wrote to memory of 3020 2592 1fffrlf.exe 46 PID 2592 wrote to memory of 3020 2592 1fffrlf.exe 46 PID 2592 wrote to memory of 3020 2592 1fffrlf.exe 46 PID 2592 wrote to memory of 3020 2592 1fffrlf.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe"C:\Users\Admin\AppData\Local\Temp\878ffa1f58d1fb860a6fb3070569e229c684c430555c2c41679926737a7090b6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\xllrlff.exec:\xllrlff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\pppvp.exec:\pppvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:108 -
\??\c:\dpvpd.exec:\dpvpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\fflxfxx.exec:\fflxfxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\pvvdv.exec:\pvvdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\rxrrffr.exec:\rxrrffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\nnhbtb.exec:\nnhbtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\rrrlrxl.exec:\rrrlrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\rrfrfrx.exec:\rrfrfrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\rrrfxll.exec:\rrrfxll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\lxllrrx.exec:\lxllrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\flrffrl.exec:\flrffrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\jjjpd.exec:\jjjpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\thtnbb.exec:\thtnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\1fffrlf.exec:\1fffrlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\nhhthb.exec:\nhhthb.exe17⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vjdpp.exec:\vjdpp.exe18⤵
- Executes dropped EXE
PID:1392 -
\??\c:\hnbntn.exec:\hnbntn.exe19⤵
- Executes dropped EXE
PID:1528 -
\??\c:\lffllxx.exec:\lffllxx.exe20⤵
- Executes dropped EXE
PID:1452 -
\??\c:\7tntht.exec:\7tntht.exe21⤵
- Executes dropped EXE
PID:1244 -
\??\c:\9jdvj.exec:\9jdvj.exe22⤵
- Executes dropped EXE
PID:1936 -
\??\c:\bbhbnb.exec:\bbhbnb.exe23⤵
- Executes dropped EXE
PID:1084 -
\??\c:\jvvdp.exec:\jvvdp.exe24⤵
- Executes dropped EXE
PID:1304 -
\??\c:\hnbbnt.exec:\hnbbnt.exe25⤵
- Executes dropped EXE
PID:1400 -
\??\c:\pjdpd.exec:\pjdpd.exe26⤵
- Executes dropped EXE
PID:1708 -
\??\c:\tthnnh.exec:\tthnnh.exe27⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xxlrrxf.exec:\xxlrrxf.exe28⤵
- Executes dropped EXE
PID:1664 -
\??\c:\vddpj.exec:\vddpj.exe29⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rrlxrxl.exec:\rrlxrxl.exe30⤵
- Executes dropped EXE
PID:2272 -
\??\c:\nttttt.exec:\nttttt.exe31⤵
- Executes dropped EXE
PID:876 -
\??\c:\vvvpj.exec:\vvvpj.exe32⤵
- Executes dropped EXE
PID:1892 -
\??\c:\pjjpd.exec:\pjjpd.exe33⤵
- Executes dropped EXE
PID:1580 -
\??\c:\xrlrlxl.exec:\xrlrlxl.exe34⤵
- Executes dropped EXE
PID:1560 -
\??\c:\bthbbh.exec:\bthbbh.exe35⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jjdjp.exec:\jjdjp.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2908 -
\??\c:\xrfrlrl.exec:\xrfrlrl.exe37⤵
- Executes dropped EXE
PID:2364 -
\??\c:\btthnh.exec:\btthnh.exe38⤵
- Executes dropped EXE
PID:2804 -
\??\c:\dpjjp.exec:\dpjjp.exe39⤵
- Executes dropped EXE
PID:2684 -
\??\c:\jjppd.exec:\jjppd.exe40⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rrlrlfr.exec:\rrlrlfr.exe41⤵
- Executes dropped EXE
PID:2836 -
\??\c:\nnbhbh.exec:\nnbhbh.exe42⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vvddv.exec:\vvddv.exe43⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xlxrrlx.exec:\xlxrrlx.exe44⤵
- Executes dropped EXE
PID:2560 -
\??\c:\fffrlff.exec:\fffrlff.exe45⤵
- Executes dropped EXE
PID:2544 -
\??\c:\7nhnbb.exec:\7nhnbb.exe46⤵
- Executes dropped EXE
PID:3012 -
\??\c:\pjdpv.exec:\pjdpv.exe47⤵
- Executes dropped EXE
PID:1720 -
\??\c:\xxxlfrl.exec:\xxxlfrl.exe48⤵
- Executes dropped EXE
PID:2756 -
\??\c:\tbtnbn.exec:\tbtnbn.exe49⤵
- Executes dropped EXE
PID:1672 -
\??\c:\nnhtnt.exec:\nnhtnt.exe50⤵
- Executes dropped EXE
PID:2276 -
\??\c:\vvdjv.exec:\vvdjv.exe51⤵
- Executes dropped EXE
PID:1236 -
\??\c:\9xffrxf.exec:\9xffrxf.exe52⤵
- Executes dropped EXE
PID:1120 -
\??\c:\5thnhh.exec:\5thnhh.exe53⤵
- Executes dropped EXE
PID:1504 -
\??\c:\5bbbth.exec:\5bbbth.exe54⤵
- Executes dropped EXE
PID:1816 -
\??\c:\pvppp.exec:\pvppp.exe55⤵
- Executes dropped EXE
PID:2036 -
\??\c:\9xrfflf.exec:\9xrfflf.exe56⤵
- Executes dropped EXE
PID:1872 -
\??\c:\1nhbnb.exec:\1nhbnb.exe57⤵
- Executes dropped EXE
PID:956 -
\??\c:\jjdvj.exec:\jjdvj.exe58⤵
- Executes dropped EXE
PID:1644 -
\??\c:\pvdpj.exec:\pvdpj.exe59⤵
- Executes dropped EXE
PID:548 -
\??\c:\rxxrfxr.exec:\rxxrfxr.exe60⤵
- Executes dropped EXE
PID:1980 -
\??\c:\btnbnt.exec:\btnbnt.exe61⤵
- Executes dropped EXE
PID:2360 -
\??\c:\hhhnht.exec:\hhhnht.exe62⤵
- Executes dropped EXE
PID:1896 -
\??\c:\9vvdv.exec:\9vvdv.exe63⤵
- Executes dropped EXE
PID:1776 -
\??\c:\lxflrxx.exec:\lxflrxx.exe64⤵
- Executes dropped EXE
PID:1520 -
\??\c:\hnhnnb.exec:\hnhnnb.exe65⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vvvpv.exec:\vvvpv.exe66⤵PID:696
-
\??\c:\jdvvj.exec:\jdvvj.exe67⤵PID:1612
-
\??\c:\rrrllff.exec:\rrrllff.exe68⤵PID:1884
-
\??\c:\3tbbth.exec:\3tbbth.exe69⤵PID:1000
-
\??\c:\dvppp.exec:\dvppp.exe70⤵PID:1436
-
\??\c:\dvvjd.exec:\dvvjd.exe71⤵PID:1972
-
\??\c:\3ffrrxl.exec:\3ffrrxl.exe72⤵PID:2864
-
\??\c:\5hhtht.exec:\5hhtht.exe73⤵PID:1292
-
\??\c:\9ppvv.exec:\9ppvv.exe74⤵PID:2012
-
\??\c:\vddvp.exec:\vddvp.exe75⤵PID:480
-
\??\c:\xxxllxr.exec:\xxxllxr.exe76⤵PID:1712
-
\??\c:\nntnnt.exec:\nntnnt.exe77⤵PID:2260
-
\??\c:\jvvjd.exec:\jvvjd.exe78⤵PID:2444
-
\??\c:\dpppd.exec:\dpppd.exe79⤵PID:2816
-
\??\c:\5llfrff.exec:\5llfrff.exe80⤵PID:2792
-
\??\c:\5htbnt.exec:\5htbnt.exe81⤵PID:2684
-
\??\c:\jjddd.exec:\jjddd.exe82⤵PID:2860
-
\??\c:\jpvdv.exec:\jpvdv.exe83⤵PID:2832
-
\??\c:\5frxlxl.exec:\5frxlxl.exe84⤵PID:1628
-
\??\c:\hhnbtn.exec:\hhnbtn.exe85⤵PID:2820
-
\??\c:\ddjvp.exec:\ddjvp.exe86⤵PID:2560
-
\??\c:\lrxrrfx.exec:\lrxrrfx.exe87⤵PID:2548
-
\??\c:\fxlxfrl.exec:\fxlxfrl.exe88⤵PID:900
-
\??\c:\thnbth.exec:\thnbth.exe89⤵PID:3012
-
\??\c:\dddpj.exec:\dddpj.exe90⤵PID:1720
-
\??\c:\3lfrxlx.exec:\3lfrxlx.exe91⤵PID:1928
-
\??\c:\fflxxlr.exec:\fflxxlr.exe92⤵PID:1692
-
\??\c:\hhhthn.exec:\hhhthn.exe93⤵PID:1768
-
\??\c:\pdjdv.exec:\pdjdv.exe94⤵PID:1676
-
\??\c:\5flflxl.exec:\5flflxl.exe95⤵PID:1856
-
\??\c:\llrllff.exec:\llrllff.exe96⤵PID:1204
-
\??\c:\hhttth.exec:\hhttth.exe97⤵PID:2212
-
\??\c:\jpvdj.exec:\jpvdj.exe98⤵PID:1816
-
\??\c:\vvjdv.exec:\vvjdv.exe99⤵PID:2036
-
\??\c:\xfrlfrr.exec:\xfrlfrr.exe100⤵PID:2116
-
\??\c:\nnbtth.exec:\nnbtth.exe101⤵PID:2356
-
\??\c:\tnhhbh.exec:\tnhhbh.exe102⤵PID:2112
-
\??\c:\ppvjv.exec:\ppvjv.exe103⤵PID:896
-
\??\c:\3hthnh.exec:\3hthnh.exe104⤵PID:1908
-
\??\c:\ntnttn.exec:\ntnttn.exe105⤵PID:2400
-
\??\c:\jjvdj.exec:\jjvdj.exe106⤵PID:1304
-
\??\c:\llrxrxf.exec:\llrxrxf.exe107⤵PID:624
-
\??\c:\rrrffrl.exec:\rrrffrl.exe108⤵PID:2892
-
\??\c:\hbhtnt.exec:\hbhtnt.exe109⤵PID:2300
-
\??\c:\jddpj.exec:\jddpj.exe110⤵PID:696
-
\??\c:\jjjpd.exec:\jjjpd.exe111⤵PID:1664
-
\??\c:\9fxxrxr.exec:\9fxxrxr.exe112⤵PID:1264
-
\??\c:\1tthbn.exec:\1tthbn.exe113⤵PID:1968
-
\??\c:\tnntnb.exec:\tnntnb.exe114⤵PID:1984
-
\??\c:\vdddp.exec:\vdddp.exe115⤵PID:1488
-
\??\c:\fffrxrl.exec:\fffrxrl.exe116⤵PID:2960
-
\??\c:\bbbnnb.exec:\bbbnnb.exe117⤵PID:804
-
\??\c:\tbnbnt.exec:\tbnbnt.exe118⤵PID:2280
-
\??\c:\vpvdv.exec:\vpvdv.exe119⤵PID:2340
-
\??\c:\rxfrfrl.exec:\rxfrfrl.exe120⤵PID:2448
-
\??\c:\lflxflf.exec:\lflxflf.exe121⤵PID:2636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-