Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 01:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3729e8722f640f3c800590083c7a35a7473e62a1606436cb290edfbb9bbe737a.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
3729e8722f640f3c800590083c7a35a7473e62a1606436cb290edfbb9bbe737a.exe
-
Size
416KB
-
MD5
da7c400b271ca2f43e7c34b4c5c04400
-
SHA1
48582fea0e6b6d56065cf6692e47191aed03c6cf
-
SHA256
3729e8722f640f3c800590083c7a35a7473e62a1606436cb290edfbb9bbe737a
-
SHA512
e83a5236d42388f3af9a776ea8fbe08a6132546241e750bf2179188fa646dba98a087979c0c5c45e3761f21361fd23c7d61b899e3fa5fc543a2faa995800d044
-
SSDEEP
3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFwD7arnDX+X5fFMyeU:8cm7ImGddXmNt251UriZFwfsDX+XtFN9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2072-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-112-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1424-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-138-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1672-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-140-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1204-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-177-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3032-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-196-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/912-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-332-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2500-333-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2696-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-374-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2696-395-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2364-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-645-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2288-653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-725-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3024-742-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1636-823-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2792-916-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/576-942-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-1016-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1852-1018-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-1025-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2072 jvjjp.exe 1804 fxlrxxf.exe 2060 thtbbt.exe 2500 rfxrfrf.exe 2864 btbbhh.exe 2712 btnntb.exe 2820 frrfxfx.exe 2952 frxrlxx.exe 2840 lfxfllx.exe 2620 tnbhth.exe 2584 ntttht.exe 3052 pdpjv.exe 1424 nnhntt.exe 1672 9dvjj.exe 2012 httntt.exe 1204 vdppj.exe 1944 vvjdp.exe 572 llfrrlr.exe 2920 fxfrflr.exe 3032 jpddj.exe 2668 lxrrxxf.exe 2144 lflfrxf.exe 912 hbttht.exe 2104 rrlrfrr.exe 1260 dpvpp.exe 1532 bntbhh.exe 2536 vvvjd.exe 2068 xfxrrxr.exe 1896 hnnhnt.exe 952 xrflrlx.exe 2400 lxlxlrf.exe 1808 fxrrllf.exe 2652 bbtbnh.exe 2004 fxrxllx.exe 2008 hhtbnn.exe 2500 pvjdp.exe 2512 xrffrrf.exe 2756 ntnntt.exe 2772 jjdpd.exe 2768 dpvvj.exe 2804 frrrlxl.exe 2696 5bnnbb.exe 2152 jpvjv.exe 2628 lxlrffx.exe 2568 fxrxrxr.exe 3056 hbbthh.exe 2364 7ddjd.exe 3048 frflxxl.exe 1720 hbthbb.exe 2316 vjdjp.exe 2012 flxxffl.exe 1712 lrrrflx.exe 1552 bnthhb.exe 1516 vddjv.exe 1800 xllfrxl.exe 2816 3nhnbn.exe 1668 pjvjd.exe 3028 rfrlxfl.exe 2916 ttthbh.exe 1344 ntbhtb.exe 404 jjdpd.exe 1512 9rxlrfx.exe 2180 nbtthb.exe 2104 nbnnbb.exe -
resource yara_rule behavioral1/memory/2072-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-332-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2772-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/404-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-725-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2916-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-823-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/576-935-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-942-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-998-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-1016-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1852-1018-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbtt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1960 wrote to memory of 2072 1960 3729e8722f640f3c800590083c7a35a7473e62a1606436cb290edfbb9bbe737a.exe 30 PID 1960 wrote to memory of 2072 1960 3729e8722f640f3c800590083c7a35a7473e62a1606436cb290edfbb9bbe737a.exe 30 PID 1960 wrote to memory of 2072 1960 3729e8722f640f3c800590083c7a35a7473e62a1606436cb290edfbb9bbe737a.exe 30 PID 1960 wrote to memory of 2072 1960 3729e8722f640f3c800590083c7a35a7473e62a1606436cb290edfbb9bbe737a.exe 30 PID 2072 wrote to memory of 1804 2072 jvjjp.exe 31 PID 2072 wrote to memory of 1804 2072 jvjjp.exe 31 PID 2072 wrote to memory of 1804 2072 jvjjp.exe 31 PID 2072 wrote to memory of 1804 2072 jvjjp.exe 31 PID 1804 wrote to memory of 2060 1804 fxlrxxf.exe 32 PID 1804 wrote to memory of 2060 1804 fxlrxxf.exe 32 PID 1804 wrote to memory of 2060 1804 fxlrxxf.exe 32 PID 1804 wrote to memory of 2060 1804 fxlrxxf.exe 32 PID 2060 wrote to memory of 2500 2060 thtbbt.exe 33 PID 2060 wrote to memory of 2500 2060 thtbbt.exe 33 PID 2060 wrote to memory of 2500 2060 thtbbt.exe 33 PID 2060 wrote to memory of 2500 2060 thtbbt.exe 33 PID 2500 wrote to memory of 2864 2500 rfxrfrf.exe 34 PID 2500 wrote to memory of 2864 2500 rfxrfrf.exe 34 PID 2500 wrote to memory of 2864 2500 rfxrfrf.exe 34 PID 2500 wrote to memory of 2864 2500 rfxrfrf.exe 34 PID 2864 wrote to memory of 2712 2864 btbbhh.exe 35 PID 2864 wrote to memory of 2712 2864 btbbhh.exe 35 PID 2864 wrote to memory of 2712 2864 btbbhh.exe 35 PID 2864 wrote to memory of 2712 2864 btbbhh.exe 35 PID 2712 wrote to memory of 2820 2712 btnntb.exe 36 PID 2712 wrote to memory of 2820 2712 btnntb.exe 36 PID 2712 wrote to memory of 2820 2712 btnntb.exe 36 PID 2712 wrote to memory of 2820 2712 btnntb.exe 36 PID 2820 wrote to memory of 2952 2820 frrfxfx.exe 37 PID 2820 wrote to memory of 2952 2820 frrfxfx.exe 37 PID 2820 wrote to memory of 2952 2820 frrfxfx.exe 37 PID 2820 wrote to memory of 2952 2820 frrfxfx.exe 37 PID 2952 wrote to memory of 2840 2952 frxrlxx.exe 38 PID 2952 wrote to memory of 2840 2952 frxrlxx.exe 38 PID 2952 wrote to memory of 2840 2952 frxrlxx.exe 38 PID 2952 wrote to memory of 2840 2952 frxrlxx.exe 38 PID 2840 wrote to memory of 2620 2840 lfxfllx.exe 39 PID 2840 wrote to memory of 2620 2840 lfxfllx.exe 39 PID 2840 wrote to memory of 2620 2840 lfxfllx.exe 39 PID 2840 wrote to memory of 2620 2840 lfxfllx.exe 39 PID 2620 wrote to memory of 2584 2620 tnbhth.exe 40 PID 2620 wrote to memory of 2584 2620 tnbhth.exe 40 PID 2620 wrote to memory of 2584 2620 tnbhth.exe 40 PID 2620 wrote to memory of 2584 2620 tnbhth.exe 40 PID 2584 wrote to memory of 3052 2584 ntttht.exe 41 PID 2584 wrote to memory of 3052 2584 ntttht.exe 41 PID 2584 wrote to memory of 3052 2584 ntttht.exe 41 PID 2584 wrote to memory of 3052 2584 ntttht.exe 41 PID 3052 wrote to memory of 1424 3052 pdpjv.exe 42 PID 3052 wrote to memory of 1424 3052 pdpjv.exe 42 PID 3052 wrote to memory of 1424 3052 pdpjv.exe 42 PID 3052 wrote to memory of 1424 3052 pdpjv.exe 42 PID 1424 wrote to memory of 1672 1424 nnhntt.exe 43 PID 1424 wrote to memory of 1672 1424 nnhntt.exe 43 PID 1424 wrote to memory of 1672 1424 nnhntt.exe 43 PID 1424 wrote to memory of 1672 1424 nnhntt.exe 43 PID 1672 wrote to memory of 2012 1672 9dvjj.exe 44 PID 1672 wrote to memory of 2012 1672 9dvjj.exe 44 PID 1672 wrote to memory of 2012 1672 9dvjj.exe 44 PID 1672 wrote to memory of 2012 1672 9dvjj.exe 44 PID 2012 wrote to memory of 1204 2012 httntt.exe 45 PID 2012 wrote to memory of 1204 2012 httntt.exe 45 PID 2012 wrote to memory of 1204 2012 httntt.exe 45 PID 2012 wrote to memory of 1204 2012 httntt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3729e8722f640f3c800590083c7a35a7473e62a1606436cb290edfbb9bbe737a.exe"C:\Users\Admin\AppData\Local\Temp\3729e8722f640f3c800590083c7a35a7473e62a1606436cb290edfbb9bbe737a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\jvjjp.exec:\jvjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\thtbbt.exec:\thtbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\rfxrfrf.exec:\rfxrfrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\btbbhh.exec:\btbbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\btnntb.exec:\btnntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\frrfxfx.exec:\frrfxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\frxrlxx.exec:\frxrlxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\lfxfllx.exec:\lfxfllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\tnbhth.exec:\tnbhth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\ntttht.exec:\ntttht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\pdpjv.exec:\pdpjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\nnhntt.exec:\nnhntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\9dvjj.exec:\9dvjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\httntt.exec:\httntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\vdppj.exec:\vdppj.exe17⤵
- Executes dropped EXE
PID:1204 -
\??\c:\vvjdp.exec:\vvjdp.exe18⤵
- Executes dropped EXE
PID:1944 -
\??\c:\llfrrlr.exec:\llfrrlr.exe19⤵
- Executes dropped EXE
PID:572 -
\??\c:\fxfrflr.exec:\fxfrflr.exe20⤵
- Executes dropped EXE
PID:2920 -
\??\c:\jpddj.exec:\jpddj.exe21⤵
- Executes dropped EXE
PID:3032 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe22⤵
- Executes dropped EXE
PID:2668 -
\??\c:\lflfrxf.exec:\lflfrxf.exe23⤵
- Executes dropped EXE
PID:2144 -
\??\c:\hbttht.exec:\hbttht.exe24⤵
- Executes dropped EXE
PID:912 -
\??\c:\rrlrfrr.exec:\rrlrfrr.exe25⤵
- Executes dropped EXE
PID:2104 -
\??\c:\dpvpp.exec:\dpvpp.exe26⤵
- Executes dropped EXE
PID:1260 -
\??\c:\bntbhh.exec:\bntbhh.exe27⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vvvjd.exec:\vvvjd.exe28⤵
- Executes dropped EXE
PID:2536 -
\??\c:\xfxrrxr.exec:\xfxrrxr.exe29⤵
- Executes dropped EXE
PID:2068 -
\??\c:\hnnhnt.exec:\hnnhnt.exe30⤵
- Executes dropped EXE
PID:1896 -
\??\c:\xrflrlx.exec:\xrflrlx.exe31⤵
- Executes dropped EXE
PID:952 -
\??\c:\lxlxlrf.exec:\lxlxlrf.exe32⤵
- Executes dropped EXE
PID:2400 -
\??\c:\fxrrllf.exec:\fxrrllf.exe33⤵
- Executes dropped EXE
PID:1808 -
\??\c:\bbtbnh.exec:\bbtbnh.exe34⤵
- Executes dropped EXE
PID:2652 -
\??\c:\fxrxllx.exec:\fxrxllx.exe35⤵
- Executes dropped EXE
PID:2004 -
\??\c:\hhtbnn.exec:\hhtbnn.exe36⤵
- Executes dropped EXE
PID:2008 -
\??\c:\pvjdp.exec:\pvjdp.exe37⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xrffrrf.exec:\xrffrrf.exe38⤵
- Executes dropped EXE
PID:2512 -
\??\c:\ntnntt.exec:\ntnntt.exe39⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jjdpd.exec:\jjdpd.exe40⤵
- Executes dropped EXE
PID:2772 -
\??\c:\dpvvj.exec:\dpvvj.exe41⤵
- Executes dropped EXE
PID:2768 -
\??\c:\frrrlxl.exec:\frrrlxl.exe42⤵
- Executes dropped EXE
PID:2804 -
\??\c:\5bnnbb.exec:\5bnnbb.exe43⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jpvjv.exec:\jpvjv.exe44⤵
- Executes dropped EXE
PID:2152 -
\??\c:\lxlrffx.exec:\lxlrffx.exe45⤵
- Executes dropped EXE
PID:2628 -
\??\c:\fxrxrxr.exec:\fxrxrxr.exe46⤵
- Executes dropped EXE
PID:2568 -
\??\c:\hbbthh.exec:\hbbthh.exe47⤵
- Executes dropped EXE
PID:3056 -
\??\c:\7ddjd.exec:\7ddjd.exe48⤵
- Executes dropped EXE
PID:2364 -
\??\c:\frflxxl.exec:\frflxxl.exe49⤵
- Executes dropped EXE
PID:3048 -
\??\c:\hbthbb.exec:\hbthbb.exe50⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vjdjp.exec:\vjdjp.exe51⤵
- Executes dropped EXE
PID:2316 -
\??\c:\flxxffl.exec:\flxxffl.exe52⤵
- Executes dropped EXE
PID:2012 -
\??\c:\lrrrflx.exec:\lrrrflx.exe53⤵
- Executes dropped EXE
PID:1712 -
\??\c:\bnthhb.exec:\bnthhb.exe54⤵
- Executes dropped EXE
PID:1552 -
\??\c:\vddjv.exec:\vddjv.exe55⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xllfrxl.exec:\xllfrxl.exe56⤵
- Executes dropped EXE
PID:1800 -
\??\c:\3nhnbn.exec:\3nhnbn.exe57⤵
- Executes dropped EXE
PID:2816 -
\??\c:\pjvjd.exec:\pjvjd.exe58⤵
- Executes dropped EXE
PID:1668 -
\??\c:\rfrlxfl.exec:\rfrlxfl.exe59⤵
- Executes dropped EXE
PID:3028 -
\??\c:\ttthbh.exec:\ttthbh.exe60⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ntbhtb.exec:\ntbhtb.exe61⤵
- Executes dropped EXE
PID:1344 -
\??\c:\jjdpd.exec:\jjdpd.exe62⤵
- Executes dropped EXE
PID:404 -
\??\c:\9rxlrfx.exec:\9rxlrfx.exe63⤵
- Executes dropped EXE
PID:1512 -
\??\c:\nbtthb.exec:\nbtthb.exe64⤵
- Executes dropped EXE
PID:2180 -
\??\c:\nbnnbb.exec:\nbnnbb.exe65⤵
- Executes dropped EXE
PID:2104 -
\??\c:\dpjpj.exec:\dpjpj.exe66⤵PID:1768
-
\??\c:\rxxlxlf.exec:\rxxlxlf.exe67⤵PID:2788
-
\??\c:\tttbth.exec:\tttbth.exe68⤵PID:2552
-
\??\c:\5hbhnt.exec:\5hbhnt.exe69⤵PID:2432
-
\??\c:\dvppv.exec:\dvppv.exe70⤵PID:2408
-
\??\c:\frflfxl.exec:\frflfxl.exe71⤵PID:1636
-
\??\c:\tbhhtb.exec:\tbhhtb.exe72⤵PID:2532
-
\??\c:\ppjjv.exec:\ppjjv.exe73⤵PID:984
-
\??\c:\vdppv.exec:\vdppv.exe74⤵PID:2052
-
\??\c:\xxxlxlf.exec:\xxxlxlf.exe75⤵PID:1324
-
\??\c:\ntbbhh.exec:\ntbbhh.exe76⤵PID:1588
-
\??\c:\jjpvj.exec:\jjpvj.exe77⤵PID:2212
-
\??\c:\dpjpd.exec:\dpjpd.exe78⤵PID:1440
-
\??\c:\rlflrfr.exec:\rlflrfr.exe79⤵PID:2328
-
\??\c:\5bthtb.exec:\5bthtb.exe80⤵PID:2292
-
\??\c:\bhbnbn.exec:\bhbnbn.exe81⤵PID:2256
-
\??\c:\vjjvv.exec:\vjjvv.exe82⤵PID:2756
-
\??\c:\7lfrfrf.exec:\7lfrfrf.exe83⤵PID:2964
-
\??\c:\hhbtnt.exec:\hhbtnt.exe84⤵PID:2416
-
\??\c:\7pdvj.exec:\7pdvj.exe85⤵PID:2820
-
\??\c:\dpdjd.exec:\dpdjd.exe86⤵PID:2696
-
\??\c:\flrrxfl.exec:\flrrxfl.exe87⤵PID:2288
-
\??\c:\thnnbt.exec:\thnnbt.exe88⤵PID:2684
-
\??\c:\jppdp.exec:\jppdp.exe89⤵PID:2568
-
\??\c:\jdppd.exec:\jdppd.exe90⤵PID:2128
-
\??\c:\fffxrxr.exec:\fffxrxr.exe91⤵PID:2364
-
\??\c:\tnbhbb.exec:\tnbhbb.exe92⤵PID:1992
-
\??\c:\9dddp.exec:\9dddp.exe93⤵PID:1720
-
\??\c:\lllrflx.exec:\lllrflx.exe94⤵PID:1912
-
\??\c:\rfrxffr.exec:\rfrxffr.exe95⤵PID:1652
-
\??\c:\5bhbbh.exec:\5bhbbh.exe96⤵PID:1712
-
\??\c:\3dpvd.exec:\3dpvd.exe97⤵PID:1404
-
\??\c:\7vjdj.exec:\7vjdj.exe98⤵PID:1432
-
\??\c:\xrrxfrx.exec:\xrrxfrx.exe99⤵PID:2640
-
\??\c:\ttnhbn.exec:\ttnhbn.exe100⤵PID:2880
-
\??\c:\3jjdp.exec:\3jjdp.exe101⤵PID:3024
-
\??\c:\vpdjp.exec:\vpdjp.exe102⤵PID:3028
-
\??\c:\rrlrrrf.exec:\rrlrrrf.exe103⤵PID:2916
-
\??\c:\hhhbtb.exec:\hhhbtb.exe104⤵PID:444
-
\??\c:\pvpvj.exec:\pvpvj.exe105⤵PID:404
-
\??\c:\xffrxlx.exec:\xffrxlx.exe106⤵PID:688
-
\??\c:\ntnbnb.exec:\ntnbnb.exe107⤵PID:2180
-
\??\c:\htntnt.exec:\htntnt.exe108⤵PID:2156
-
\??\c:\7jjjd.exec:\7jjjd.exe109⤵PID:1660
-
\??\c:\rllfxfl.exec:\rllfxfl.exe110⤵PID:2788
-
\??\c:\1tnbht.exec:\1tnbht.exe111⤵PID:2552
-
\??\c:\vvpdv.exec:\vvpdv.exe112⤵PID:2432
-
\??\c:\rrlxlxr.exec:\rrlxlxr.exe113⤵PID:2068
-
\??\c:\1ntbbb.exec:\1ntbbb.exe114⤵PID:1636
-
\??\c:\djddv.exec:\djddv.exe115⤵PID:880
-
\??\c:\fxrxrxf.exec:\fxrxrxf.exe116⤵PID:984
-
\??\c:\fxrxrfr.exec:\fxrxrfr.exe117⤵PID:2052
-
\??\c:\hhtbth.exec:\hhtbth.exe118⤵PID:1324
-
\??\c:\vpjpj.exec:\vpjpj.exe119⤵PID:1588
-
\??\c:\vvpdv.exec:\vvpdv.exe120⤵PID:2108
-
\??\c:\lrlrxxf.exec:\lrlrxxf.exe121⤵PID:1440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-