Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 23:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8df35ff77b0576f60cedd33f9fd8a99fc9a67b0833b370e7ce33a5153b0fac59.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
8df35ff77b0576f60cedd33f9fd8a99fc9a67b0833b370e7ce33a5153b0fac59.exe
-
Size
453KB
-
MD5
659958e45c42e6d06f6dedee6a6b8699
-
SHA1
0dc1de2cfa35bab7a5819f56b5884d7384d349bc
-
SHA256
8df35ff77b0576f60cedd33f9fd8a99fc9a67b0833b370e7ce33a5153b0fac59
-
SHA512
1dea4011a70ca4721c0d4683ed10236befb3cf1dffbc898d742f1b5f98553c28e60e376675e742dc2d8d97e50ebcc7479e896bd9f81291468e2e8ced2f859ddc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJ:q7Tc2NYHUrAwfMp3CDJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/236-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-55-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2052-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/948-131-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2248-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/408-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/408-200-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1120-230-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1120-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-220-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1476-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-259-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2172-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-280-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1520-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-360-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2052-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-362-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2956-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-466-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/792-518-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3032-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-628-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1612-751-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2328-758-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2328-759-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/236-851-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-995-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-1040-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2076-1109-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/3068-1191-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1640 lrlrllx.exe 320 djvdj.exe 2276 fxfrflf.exe 2812 vvjpv.exe 2736 rfffrfl.exe 2052 ddpdp.exe 2988 1frlrrf.exe 2668 3thbbt.exe 2688 lfxlxfx.exe 2448 ppdjp.exe 2932 5xrxllx.exe 1956 5ttbbn.exe 948 9llxrxl.exe 2976 jpvjd.exe 772 fxfxffl.exe 1036 7tttbb.exe 2248 dvvdp.exe 2564 ppdjv.exe 1728 1pddd.exe 2796 7btbhn.exe 408 7jvdj.exe 2504 hhhthn.exe 1792 5pjpv.exe 1120 9ddjv.exe 1608 9nhntb.exe 1476 7xlllrf.exe 2584 hhbhnn.exe 2172 btbbbb.exe 524 flrfflf.exe 2524 hbntbh.exe 316 1tnntt.exe 2308 xlxxffr.exe 1520 tnbhtn.exe 2068 5ddpd.exe 2536 ffrrxfr.exe 2136 lxrxxxf.exe 2756 5hnhhh.exe 2836 1vjjp.exe 3068 ddpvj.exe 2840 7lrrfxl.exe 2052 5nbbhn.exe 2784 bthhhh.exe 2628 jjpvj.exe 1484 9xrrxlr.exe 2896 nttnnn.exe 2688 nhbhtb.exe 1148 5dvjj.exe 3004 lfrrrrx.exe 2956 tntbbh.exe 1004 nhttbh.exe 2908 7dpjp.exe 3052 3rrfffl.exe 1936 3xrxlxf.exe 2116 7bhhhh.exe 2108 vpjpd.exe 2248 3pjjv.exe 1708 llfxlrx.exe 2328 hbnnth.exe 2400 vdpvp.exe 2208 jjvdj.exe 2332 fxlrxfx.exe 1312 9hnnbb.exe 1284 nhhhtt.exe 2184 vdvdd.exe -
resource yara_rule behavioral1/memory/236-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-362-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2628-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-466-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2328-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/388-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-708-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-850-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/236-851-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-864-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-956-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1344-995-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-1020-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-1027-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-1077-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-1096-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-1128-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 236 wrote to memory of 1640 236 8df35ff77b0576f60cedd33f9fd8a99fc9a67b0833b370e7ce33a5153b0fac59.exe 30 PID 236 wrote to memory of 1640 236 8df35ff77b0576f60cedd33f9fd8a99fc9a67b0833b370e7ce33a5153b0fac59.exe 30 PID 236 wrote to memory of 1640 236 8df35ff77b0576f60cedd33f9fd8a99fc9a67b0833b370e7ce33a5153b0fac59.exe 30 PID 236 wrote to memory of 1640 236 8df35ff77b0576f60cedd33f9fd8a99fc9a67b0833b370e7ce33a5153b0fac59.exe 30 PID 1640 wrote to memory of 320 1640 lrlrllx.exe 31 PID 1640 wrote to memory of 320 1640 lrlrllx.exe 31 PID 1640 wrote to memory of 320 1640 lrlrllx.exe 31 PID 1640 wrote to memory of 320 1640 lrlrllx.exe 31 PID 320 wrote to memory of 2276 320 djvdj.exe 32 PID 320 wrote to memory of 2276 320 djvdj.exe 32 PID 320 wrote to memory of 2276 320 djvdj.exe 32 PID 320 wrote to memory of 2276 320 djvdj.exe 32 PID 2276 wrote to memory of 2812 2276 fxfrflf.exe 33 PID 2276 wrote to memory of 2812 2276 fxfrflf.exe 33 PID 2276 wrote to memory of 2812 2276 fxfrflf.exe 33 PID 2276 wrote to memory of 2812 2276 fxfrflf.exe 33 PID 2812 wrote to memory of 2736 2812 vvjpv.exe 34 PID 2812 wrote to memory of 2736 2812 vvjpv.exe 34 PID 2812 wrote to memory of 2736 2812 vvjpv.exe 34 PID 2812 wrote to memory of 2736 2812 vvjpv.exe 34 PID 2736 wrote to memory of 2052 2736 rfffrfl.exe 35 PID 2736 wrote to memory of 2052 2736 rfffrfl.exe 35 PID 2736 wrote to memory of 2052 2736 rfffrfl.exe 35 PID 2736 wrote to memory of 2052 2736 rfffrfl.exe 35 PID 2052 wrote to memory of 2988 2052 ddpdp.exe 36 PID 2052 wrote to memory of 2988 2052 ddpdp.exe 36 PID 2052 wrote to memory of 2988 2052 ddpdp.exe 36 PID 2052 wrote to memory of 2988 2052 ddpdp.exe 36 PID 2988 wrote to memory of 2668 2988 1frlrrf.exe 37 PID 2988 wrote to memory of 2668 2988 1frlrrf.exe 37 PID 2988 wrote to memory of 2668 2988 1frlrrf.exe 37 PID 2988 wrote to memory of 2668 2988 1frlrrf.exe 37 PID 2668 wrote to memory of 2688 2668 3thbbt.exe 38 PID 2668 wrote to memory of 2688 2668 3thbbt.exe 38 PID 2668 wrote to memory of 2688 2668 3thbbt.exe 38 PID 2668 wrote to memory of 2688 2668 3thbbt.exe 38 PID 2688 wrote to memory of 2448 2688 lfxlxfx.exe 39 PID 2688 wrote to memory of 2448 2688 lfxlxfx.exe 39 PID 2688 wrote to memory of 2448 2688 lfxlxfx.exe 39 PID 2688 wrote to memory of 2448 2688 lfxlxfx.exe 39 PID 2448 wrote to memory of 2932 2448 ppdjp.exe 40 PID 2448 wrote to memory of 2932 2448 ppdjp.exe 40 PID 2448 wrote to memory of 2932 2448 ppdjp.exe 40 PID 2448 wrote to memory of 2932 2448 ppdjp.exe 40 PID 2932 wrote to memory of 1956 2932 5xrxllx.exe 41 PID 2932 wrote to memory of 1956 2932 5xrxllx.exe 41 PID 2932 wrote to memory of 1956 2932 5xrxllx.exe 41 PID 2932 wrote to memory of 1956 2932 5xrxllx.exe 41 PID 1956 wrote to memory of 948 1956 5ttbbn.exe 42 PID 1956 wrote to memory of 948 1956 5ttbbn.exe 42 PID 1956 wrote to memory of 948 1956 5ttbbn.exe 42 PID 1956 wrote to memory of 948 1956 5ttbbn.exe 42 PID 948 wrote to memory of 2976 948 9llxrxl.exe 43 PID 948 wrote to memory of 2976 948 9llxrxl.exe 43 PID 948 wrote to memory of 2976 948 9llxrxl.exe 43 PID 948 wrote to memory of 2976 948 9llxrxl.exe 43 PID 2976 wrote to memory of 772 2976 jpvjd.exe 44 PID 2976 wrote to memory of 772 2976 jpvjd.exe 44 PID 2976 wrote to memory of 772 2976 jpvjd.exe 44 PID 2976 wrote to memory of 772 2976 jpvjd.exe 44 PID 772 wrote to memory of 1036 772 fxfxffl.exe 45 PID 772 wrote to memory of 1036 772 fxfxffl.exe 45 PID 772 wrote to memory of 1036 772 fxfxffl.exe 45 PID 772 wrote to memory of 1036 772 fxfxffl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8df35ff77b0576f60cedd33f9fd8a99fc9a67b0833b370e7ce33a5153b0fac59.exe"C:\Users\Admin\AppData\Local\Temp\8df35ff77b0576f60cedd33f9fd8a99fc9a67b0833b370e7ce33a5153b0fac59.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:236 -
\??\c:\lrlrllx.exec:\lrlrllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\djvdj.exec:\djvdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\fxfrflf.exec:\fxfrflf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\vvjpv.exec:\vvjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\rfffrfl.exec:\rfffrfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\ddpdp.exec:\ddpdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\1frlrrf.exec:\1frlrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\3thbbt.exec:\3thbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\lfxlxfx.exec:\lfxlxfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\ppdjp.exec:\ppdjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\5xrxllx.exec:\5xrxllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\5ttbbn.exec:\5ttbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\9llxrxl.exec:\9llxrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\jpvjd.exec:\jpvjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\fxfxffl.exec:\fxfxffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\7tttbb.exec:\7tttbb.exe17⤵
- Executes dropped EXE
PID:1036 -
\??\c:\dvvdp.exec:\dvvdp.exe18⤵
- Executes dropped EXE
PID:2248 -
\??\c:\ppdjv.exec:\ppdjv.exe19⤵
- Executes dropped EXE
PID:2564 -
\??\c:\1pddd.exec:\1pddd.exe20⤵
- Executes dropped EXE
PID:1728 -
\??\c:\7btbhn.exec:\7btbhn.exe21⤵
- Executes dropped EXE
PID:2796 -
\??\c:\7jvdj.exec:\7jvdj.exe22⤵
- Executes dropped EXE
PID:408 -
\??\c:\hhhthn.exec:\hhhthn.exe23⤵
- Executes dropped EXE
PID:2504 -
\??\c:\5pjpv.exec:\5pjpv.exe24⤵
- Executes dropped EXE
PID:1792 -
\??\c:\9ddjv.exec:\9ddjv.exe25⤵
- Executes dropped EXE
PID:1120 -
\??\c:\9nhntb.exec:\9nhntb.exe26⤵
- Executes dropped EXE
PID:1608 -
\??\c:\7xlllrf.exec:\7xlllrf.exe27⤵
- Executes dropped EXE
PID:1476 -
\??\c:\hhbhnn.exec:\hhbhnn.exe28⤵
- Executes dropped EXE
PID:2584 -
\??\c:\btbbbb.exec:\btbbbb.exe29⤵
- Executes dropped EXE
PID:2172 -
\??\c:\flrfflf.exec:\flrfflf.exe30⤵
- Executes dropped EXE
PID:524 -
\??\c:\hbntbh.exec:\hbntbh.exe31⤵
- Executes dropped EXE
PID:2524 -
\??\c:\1tnntt.exec:\1tnntt.exe32⤵
- Executes dropped EXE
PID:316 -
\??\c:\xlxxffr.exec:\xlxxffr.exe33⤵
- Executes dropped EXE
PID:2308 -
\??\c:\tnbhtn.exec:\tnbhtn.exe34⤵
- Executes dropped EXE
PID:1520 -
\??\c:\5ddpd.exec:\5ddpd.exe35⤵
- Executes dropped EXE
PID:2068 -
\??\c:\ffrrxfr.exec:\ffrrxfr.exe36⤵
- Executes dropped EXE
PID:2536 -
\??\c:\lxrxxxf.exec:\lxrxxxf.exe37⤵
- Executes dropped EXE
PID:2136 -
\??\c:\5hnhhh.exec:\5hnhhh.exe38⤵
- Executes dropped EXE
PID:2756 -
\??\c:\1vjjp.exec:\1vjjp.exe39⤵
- Executes dropped EXE
PID:2836 -
\??\c:\ddpvj.exec:\ddpvj.exe40⤵
- Executes dropped EXE
PID:3068 -
\??\c:\7lrrfxl.exec:\7lrrfxl.exe41⤵
- Executes dropped EXE
PID:2840 -
\??\c:\5nbbhn.exec:\5nbbhn.exe42⤵
- Executes dropped EXE
PID:2052 -
\??\c:\bthhhh.exec:\bthhhh.exe43⤵
- Executes dropped EXE
PID:2784 -
\??\c:\jjpvj.exec:\jjpvj.exe44⤵
- Executes dropped EXE
PID:2628 -
\??\c:\9xrrxlr.exec:\9xrrxlr.exe45⤵
- Executes dropped EXE
PID:1484 -
\??\c:\nttnnn.exec:\nttnnn.exe46⤵
- Executes dropped EXE
PID:2896 -
\??\c:\nhbhtb.exec:\nhbhtb.exe47⤵
- Executes dropped EXE
PID:2688 -
\??\c:\5dvjj.exec:\5dvjj.exe48⤵
- Executes dropped EXE
PID:1148 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe49⤵
- Executes dropped EXE
PID:3004 -
\??\c:\tntbbh.exec:\tntbbh.exe50⤵
- Executes dropped EXE
PID:2956 -
\??\c:\nhttbh.exec:\nhttbh.exe51⤵
- Executes dropped EXE
PID:1004 -
\??\c:\7dpjp.exec:\7dpjp.exe52⤵
- Executes dropped EXE
PID:2908 -
\??\c:\3rrfffl.exec:\3rrfffl.exe53⤵
- Executes dropped EXE
PID:3052 -
\??\c:\3xrxlxf.exec:\3xrxlxf.exe54⤵
- Executes dropped EXE
PID:1936 -
\??\c:\7bhhhh.exec:\7bhhhh.exe55⤵
- Executes dropped EXE
PID:2116 -
\??\c:\vpjpd.exec:\vpjpd.exe56⤵
- Executes dropped EXE
PID:2108 -
\??\c:\3pjjv.exec:\3pjjv.exe57⤵
- Executes dropped EXE
PID:2248 -
\??\c:\llfxlrx.exec:\llfxlrx.exe58⤵
- Executes dropped EXE
PID:1708 -
\??\c:\hbnnth.exec:\hbnnth.exe59⤵
- Executes dropped EXE
PID:2328 -
\??\c:\vdpvp.exec:\vdpvp.exe60⤵
- Executes dropped EXE
PID:2400 -
\??\c:\jjvdj.exec:\jjvdj.exe61⤵
- Executes dropped EXE
PID:2208 -
\??\c:\fxlrxfx.exec:\fxlrxfx.exe62⤵
- Executes dropped EXE
PID:2332 -
\??\c:\9hnnbb.exec:\9hnnbb.exe63⤵
- Executes dropped EXE
PID:1312 -
\??\c:\nhhhtt.exec:\nhhhtt.exe64⤵
- Executes dropped EXE
PID:1284 -
\??\c:\vdvdd.exec:\vdvdd.exe65⤵
- Executes dropped EXE
PID:2184 -
\??\c:\frlrxfl.exec:\frlrxfl.exe66⤵PID:792
-
\??\c:\thtttt.exec:\thtttt.exe67⤵PID:388
-
\??\c:\btnnbh.exec:\btnnbh.exe68⤵PID:552
-
\??\c:\dvjdd.exec:\dvjdd.exe69⤵PID:3032
-
\??\c:\fxllfff.exec:\fxllfff.exe70⤵PID:328
-
\??\c:\3xrlrrx.exec:\3xrlrrx.exe71⤵PID:2144
-
\??\c:\nhnthh.exec:\nhnthh.exe72⤵PID:2368
-
\??\c:\vpvpp.exec:\vpvpp.exe73⤵PID:1432
-
\??\c:\xlllrrf.exec:\xlllrrf.exe74⤵PID:884
-
\??\c:\1rlxxfl.exec:\1rlxxfl.exe75⤵PID:1428
-
\??\c:\bthnbb.exec:\bthnbb.exe76⤵PID:1524
-
\??\c:\jjvdj.exec:\jjvdj.exe77⤵PID:1520
-
\??\c:\9jdvd.exec:\9jdvd.exe78⤵PID:2792
-
\??\c:\xxlxrrf.exec:\xxlxrrf.exe79⤵PID:2752
-
\??\c:\btnnbb.exec:\btnnbb.exe80⤵PID:2760
-
\??\c:\jjvjp.exec:\jjvjp.exe81⤵PID:2804
-
\??\c:\pdvjv.exec:\pdvjv.exe82⤵PID:2768
-
\??\c:\7xllrrx.exec:\7xllrrx.exe83⤵PID:2808
-
\??\c:\rlrxxlr.exec:\rlrxxlr.exe84⤵PID:2996
-
\??\c:\nnbbnn.exec:\nnbbnn.exe85⤵PID:2052
-
\??\c:\dpdjp.exec:\dpdjp.exe86⤵PID:2632
-
\??\c:\vppvd.exec:\vppvd.exe87⤵PID:2684
-
\??\c:\9lfflrx.exec:\9lfflrx.exe88⤵PID:2676
-
\??\c:\9thnbh.exec:\9thnbh.exe89⤵PID:664
-
\??\c:\9nhnnt.exec:\9nhnnt.exe90⤵PID:2924
-
\??\c:\jjjdp.exec:\jjjdp.exe91⤵PID:1712
-
\??\c:\rrrfxfr.exec:\rrrfxfr.exe92⤵PID:2936
-
\??\c:\hnhhnb.exec:\hnhhnb.exe93⤵PID:1404
-
\??\c:\btbhhh.exec:\btbhhh.exe94⤵PID:2712
-
\??\c:\pvpjd.exec:\pvpjd.exe95⤵PID:2928
-
\??\c:\xxxfxlx.exec:\xxxfxlx.exe96⤵PID:2908
-
\??\c:\hbbnbn.exec:\hbbnbn.exe97⤵PID:1552
-
\??\c:\tnhntb.exec:\tnhntb.exe98⤵PID:1036
-
\??\c:\7ppvd.exec:\7ppvd.exe99⤵PID:2164
-
\??\c:\lfrxllx.exec:\lfrxllx.exe100⤵PID:2388
-
\??\c:\7lxflxf.exec:\7lxflxf.exe101⤵PID:2412
-
\??\c:\nhhnht.exec:\nhhnht.exe102⤵PID:1612
-
\??\c:\bbthtb.exec:\bbthtb.exe103⤵PID:2328
-
\??\c:\vvvvv.exec:\vvvvv.exe104⤵PID:2140
-
\??\c:\flflxxr.exec:\flflxxr.exe105⤵PID:2208
-
\??\c:\ttthnb.exec:\ttthnb.exe106⤵PID:2332
-
\??\c:\hnhbth.exec:\hnhbth.exe107⤵PID:1704
-
\??\c:\jpvjd.exec:\jpvjd.exe108⤵PID:1540
-
\??\c:\xxrrflx.exec:\xxrrflx.exe109⤵PID:2472
-
\??\c:\llfrflf.exec:\llfrflf.exe110⤵PID:1592
-
\??\c:\nhbntb.exec:\nhbntb.exe111⤵PID:844
-
\??\c:\pjjvp.exec:\pjjvp.exe112⤵PID:1196
-
\??\c:\rrxrfrl.exec:\rrxrfrl.exe113⤵PID:2252
-
\??\c:\xxrflrf.exec:\xxrflrf.exe114⤵PID:2540
-
\??\c:\7nthtb.exec:\7nthtb.exe115⤵PID:700
-
\??\c:\jjjvd.exec:\jjjvd.exe116⤵PID:2144
-
\??\c:\7pvdp.exec:\7pvdp.exe117⤵PID:2524
-
\??\c:\xllxlrf.exec:\xllxlrf.exe118⤵PID:1656
-
\??\c:\btnbnt.exec:\btnbnt.exe119⤵PID:236
-
\??\c:\vppdp.exec:\vppdp.exe120⤵PID:316
-
\??\c:\vdjjp.exec:\vdjjp.exe121⤵PID:3060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-