Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 02:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a0c76e7dbb5d2bcf0b384ff196631a72c113e3e5d6a9869be81054f0c1a5fce9.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a0c76e7dbb5d2bcf0b384ff196631a72c113e3e5d6a9869be81054f0c1a5fce9.exe
-
Size
454KB
-
MD5
45d651c469cf77ff4c500e16a4493c42
-
SHA1
b13205bd401a67ff2a98dc83538732f4379180af
-
SHA256
a0c76e7dbb5d2bcf0b384ff196631a72c113e3e5d6a9869be81054f0c1a5fce9
-
SHA512
ab90b90d019fbbbcea42eb6af8fc44b5f45d01f5af967bb61a2b33f6aec8cdebcdda75cdbb36f3cb9318c8a335d154c2525518ee925db0b0e9680adb773f0d83
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeZ:q7Tc2NYHUrAwfMp3CDZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2396-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-74-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2872-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/528-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-214-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1924-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-284-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3044-310-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1700-320-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1700-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/676-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-483-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/968-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-562-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1680-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-619-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2948-737-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-790-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1028-834-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-866-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2148-867-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-1019-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/816-1076-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1980 htttnh.exe 2348 1htbtt.exe 2332 jdpdj.exe 2704 5pppv.exe 2852 5ddjp.exe 2728 hbntbh.exe 2212 jjjjd.exe 2872 hbbhtb.exe 2592 jjvpj.exe 2764 3ttnbb.exe 1788 5thbtt.exe 1308 xrfrxfl.exe 1388 btbbbn.exe 528 fffxfxl.exe 576 hbthnn.exe 1644 pdppv.exe 1812 frflrxf.exe 1640 vjdpv.exe 2892 xlrrxrr.exe 2328 tntbth.exe 2372 1pjdj.exe 1856 frfflrx.exe 1136 7ttttt.exe 1924 9lffffr.exe 1744 tthnbb.exe 3032 jdjjp.exe 1820 fxrxllf.exe 1488 jjjpv.exe 2084 xfxrrrx.exe 3044 thtbbh.exe 2160 ppppd.exe 2524 bnbthh.exe 2528 jvdjp.exe 1588 3rxxxfr.exe 1700 xlxxfxf.exe 1952 9btbhn.exe 2288 pvvdp.exe 3020 rfrxxxf.exe 2604 5hhhbb.exe 2840 pjdpd.exe 2792 lfrxllf.exe 3008 xrrxflr.exe 2600 nnbntb.exe 2668 3ddvv.exe 2640 xrllxxf.exe 1936 7ffxllr.exe 1652 hthnnt.exe 676 nntbhn.exe 2664 jpvvd.exe 936 7lfflrf.exe 760 rrrrfrf.exe 2432 5btbnn.exe 396 pjvpj.exe 2496 lxfxffx.exe 1912 ffxflrr.exe 1812 1hbnnt.exe 2696 pjpjp.exe 2472 dvppp.exe 2484 lfxfrrf.exe 1720 thnntb.exe 732 7vddp.exe 2576 vjjjp.exe 968 3rfflrx.exe 1136 bnntbh.exe -
resource yara_rule behavioral1/memory/2396-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/528-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/936-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/968-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-730-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2948-737-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/732-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/968-777-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-790-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1028-834-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-853-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-866-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2148-867-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-880-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-906-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-926-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-982-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-1019-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-1038-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/816-1069-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/816-1076-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-1077-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2396 wrote to memory of 1980 2396 a0c76e7dbb5d2bcf0b384ff196631a72c113e3e5d6a9869be81054f0c1a5fce9.exe 30 PID 2396 wrote to memory of 1980 2396 a0c76e7dbb5d2bcf0b384ff196631a72c113e3e5d6a9869be81054f0c1a5fce9.exe 30 PID 2396 wrote to memory of 1980 2396 a0c76e7dbb5d2bcf0b384ff196631a72c113e3e5d6a9869be81054f0c1a5fce9.exe 30 PID 2396 wrote to memory of 1980 2396 a0c76e7dbb5d2bcf0b384ff196631a72c113e3e5d6a9869be81054f0c1a5fce9.exe 30 PID 1980 wrote to memory of 2348 1980 htttnh.exe 31 PID 1980 wrote to memory of 2348 1980 htttnh.exe 31 PID 1980 wrote to memory of 2348 1980 htttnh.exe 31 PID 1980 wrote to memory of 2348 1980 htttnh.exe 31 PID 2348 wrote to memory of 2332 2348 1htbtt.exe 32 PID 2348 wrote to memory of 2332 2348 1htbtt.exe 32 PID 2348 wrote to memory of 2332 2348 1htbtt.exe 32 PID 2348 wrote to memory of 2332 2348 1htbtt.exe 32 PID 2332 wrote to memory of 2704 2332 jdpdj.exe 33 PID 2332 wrote to memory of 2704 2332 jdpdj.exe 33 PID 2332 wrote to memory of 2704 2332 jdpdj.exe 33 PID 2332 wrote to memory of 2704 2332 jdpdj.exe 33 PID 2704 wrote to memory of 2852 2704 5pppv.exe 34 PID 2704 wrote to memory of 2852 2704 5pppv.exe 34 PID 2704 wrote to memory of 2852 2704 5pppv.exe 34 PID 2704 wrote to memory of 2852 2704 5pppv.exe 34 PID 2852 wrote to memory of 2728 2852 5ddjp.exe 35 PID 2852 wrote to memory of 2728 2852 5ddjp.exe 35 PID 2852 wrote to memory of 2728 2852 5ddjp.exe 35 PID 2852 wrote to memory of 2728 2852 5ddjp.exe 35 PID 2728 wrote to memory of 2212 2728 hbntbh.exe 36 PID 2728 wrote to memory of 2212 2728 hbntbh.exe 36 PID 2728 wrote to memory of 2212 2728 hbntbh.exe 36 PID 2728 wrote to memory of 2212 2728 hbntbh.exe 36 PID 2212 wrote to memory of 2872 2212 jjjjd.exe 37 PID 2212 wrote to memory of 2872 2212 jjjjd.exe 37 PID 2212 wrote to memory of 2872 2212 jjjjd.exe 37 PID 2212 wrote to memory of 2872 2212 jjjjd.exe 37 PID 2872 wrote to memory of 2592 2872 hbbhtb.exe 38 PID 2872 wrote to memory of 2592 2872 hbbhtb.exe 38 PID 2872 wrote to memory of 2592 2872 hbbhtb.exe 38 PID 2872 wrote to memory of 2592 2872 hbbhtb.exe 38 PID 2592 wrote to memory of 2764 2592 jjvpj.exe 39 PID 2592 wrote to memory of 2764 2592 jjvpj.exe 39 PID 2592 wrote to memory of 2764 2592 jjvpj.exe 39 PID 2592 wrote to memory of 2764 2592 jjvpj.exe 39 PID 2764 wrote to memory of 1788 2764 3ttnbb.exe 40 PID 2764 wrote to memory of 1788 2764 3ttnbb.exe 40 PID 2764 wrote to memory of 1788 2764 3ttnbb.exe 40 PID 2764 wrote to memory of 1788 2764 3ttnbb.exe 40 PID 1788 wrote to memory of 1308 1788 5thbtt.exe 41 PID 1788 wrote to memory of 1308 1788 5thbtt.exe 41 PID 1788 wrote to memory of 1308 1788 5thbtt.exe 41 PID 1788 wrote to memory of 1308 1788 5thbtt.exe 41 PID 1308 wrote to memory of 1388 1308 xrfrxfl.exe 42 PID 1308 wrote to memory of 1388 1308 xrfrxfl.exe 42 PID 1308 wrote to memory of 1388 1308 xrfrxfl.exe 42 PID 1308 wrote to memory of 1388 1308 xrfrxfl.exe 42 PID 1388 wrote to memory of 528 1388 btbbbn.exe 43 PID 1388 wrote to memory of 528 1388 btbbbn.exe 43 PID 1388 wrote to memory of 528 1388 btbbbn.exe 43 PID 1388 wrote to memory of 528 1388 btbbbn.exe 43 PID 528 wrote to memory of 576 528 fffxfxl.exe 44 PID 528 wrote to memory of 576 528 fffxfxl.exe 44 PID 528 wrote to memory of 576 528 fffxfxl.exe 44 PID 528 wrote to memory of 576 528 fffxfxl.exe 44 PID 576 wrote to memory of 1644 576 hbthnn.exe 45 PID 576 wrote to memory of 1644 576 hbthnn.exe 45 PID 576 wrote to memory of 1644 576 hbthnn.exe 45 PID 576 wrote to memory of 1644 576 hbthnn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0c76e7dbb5d2bcf0b384ff196631a72c113e3e5d6a9869be81054f0c1a5fce9.exe"C:\Users\Admin\AppData\Local\Temp\a0c76e7dbb5d2bcf0b384ff196631a72c113e3e5d6a9869be81054f0c1a5fce9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\htttnh.exec:\htttnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\1htbtt.exec:\1htbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\jdpdj.exec:\jdpdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\5pppv.exec:\5pppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\5ddjp.exec:\5ddjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\hbntbh.exec:\hbntbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\jjjjd.exec:\jjjjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\hbbhtb.exec:\hbbhtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\jjvpj.exec:\jjvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\3ttnbb.exec:\3ttnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\5thbtt.exec:\5thbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\xrfrxfl.exec:\xrfrxfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\btbbbn.exec:\btbbbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\fffxfxl.exec:\fffxfxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\hbthnn.exec:\hbthnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\pdppv.exec:\pdppv.exe17⤵
- Executes dropped EXE
PID:1644 -
\??\c:\frflrxf.exec:\frflrxf.exe18⤵
- Executes dropped EXE
PID:1812 -
\??\c:\vjdpv.exec:\vjdpv.exe19⤵
- Executes dropped EXE
PID:1640 -
\??\c:\xlrrxrr.exec:\xlrrxrr.exe20⤵
- Executes dropped EXE
PID:2892 -
\??\c:\tntbth.exec:\tntbth.exe21⤵
- Executes dropped EXE
PID:2328 -
\??\c:\1pjdj.exec:\1pjdj.exe22⤵
- Executes dropped EXE
PID:2372 -
\??\c:\frfflrx.exec:\frfflrx.exe23⤵
- Executes dropped EXE
PID:1856 -
\??\c:\7ttttt.exec:\7ttttt.exe24⤵
- Executes dropped EXE
PID:1136 -
\??\c:\9lffffr.exec:\9lffffr.exe25⤵
- Executes dropped EXE
PID:1924 -
\??\c:\tthnbb.exec:\tthnbb.exe26⤵
- Executes dropped EXE
PID:1744 -
\??\c:\jdjjp.exec:\jdjjp.exe27⤵
- Executes dropped EXE
PID:3032 -
\??\c:\fxrxllf.exec:\fxrxllf.exe28⤵
- Executes dropped EXE
PID:1820 -
\??\c:\jjjpv.exec:\jjjpv.exe29⤵
- Executes dropped EXE
PID:1488 -
\??\c:\xfxrrrx.exec:\xfxrrrx.exe30⤵
- Executes dropped EXE
PID:2084 -
\??\c:\thtbbh.exec:\thtbbh.exe31⤵
- Executes dropped EXE
PID:3044 -
\??\c:\ppppd.exec:\ppppd.exe32⤵
- Executes dropped EXE
PID:2160 -
\??\c:\bnbthh.exec:\bnbthh.exe33⤵
- Executes dropped EXE
PID:2524 -
\??\c:\jvdjp.exec:\jvdjp.exe34⤵
- Executes dropped EXE
PID:2528 -
\??\c:\3rxxxfr.exec:\3rxxxfr.exe35⤵
- Executes dropped EXE
PID:1588 -
\??\c:\xlxxfxf.exec:\xlxxfxf.exe36⤵
- Executes dropped EXE
PID:1700 -
\??\c:\9btbhn.exec:\9btbhn.exe37⤵
- Executes dropped EXE
PID:1952 -
\??\c:\pvvdp.exec:\pvvdp.exe38⤵
- Executes dropped EXE
PID:2288 -
\??\c:\rfrxxxf.exec:\rfrxxxf.exe39⤵
- Executes dropped EXE
PID:3020 -
\??\c:\5hhhbb.exec:\5hhhbb.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2604 -
\??\c:\pjdpd.exec:\pjdpd.exe41⤵
- Executes dropped EXE
PID:2840 -
\??\c:\lfrxllf.exec:\lfrxllf.exe42⤵
- Executes dropped EXE
PID:2792 -
\??\c:\xrrxflr.exec:\xrrxflr.exe43⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nnbntb.exec:\nnbntb.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\3ddvv.exec:\3ddvv.exe45⤵
- Executes dropped EXE
PID:2668 -
\??\c:\xrllxxf.exec:\xrllxxf.exe46⤵
- Executes dropped EXE
PID:2640 -
\??\c:\7ffxllr.exec:\7ffxllr.exe47⤵
- Executes dropped EXE
PID:1936 -
\??\c:\hthnnt.exec:\hthnnt.exe48⤵
- Executes dropped EXE
PID:1652 -
\??\c:\nntbhn.exec:\nntbhn.exe49⤵
- Executes dropped EXE
PID:676 -
\??\c:\jpvvd.exec:\jpvvd.exe50⤵
- Executes dropped EXE
PID:2664 -
\??\c:\7lfflrf.exec:\7lfflrf.exe51⤵
- Executes dropped EXE
PID:936 -
\??\c:\rrrrfrf.exec:\rrrrfrf.exe52⤵
- Executes dropped EXE
PID:760 -
\??\c:\5btbnn.exec:\5btbnn.exe53⤵
- Executes dropped EXE
PID:2432 -
\??\c:\pjvpj.exec:\pjvpj.exe54⤵
- Executes dropped EXE
PID:396 -
\??\c:\lxfxffx.exec:\lxfxffx.exe55⤵
- Executes dropped EXE
PID:2496 -
\??\c:\ffxflrr.exec:\ffxflrr.exe56⤵
- Executes dropped EXE
PID:1912 -
\??\c:\1hbnnt.exec:\1hbnnt.exe57⤵
- Executes dropped EXE
PID:1812 -
\??\c:\pjpjp.exec:\pjpjp.exe58⤵
- Executes dropped EXE
PID:2696 -
\??\c:\dvppp.exec:\dvppp.exe59⤵
- Executes dropped EXE
PID:2472 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe60⤵
- Executes dropped EXE
PID:2484 -
\??\c:\thnntb.exec:\thnntb.exe61⤵
- Executes dropped EXE
PID:1720 -
\??\c:\7vddp.exec:\7vddp.exe62⤵
- Executes dropped EXE
PID:732 -
\??\c:\vjjjp.exec:\vjjjp.exe63⤵
- Executes dropped EXE
PID:2576 -
\??\c:\3rfflrx.exec:\3rfflrx.exe64⤵
- Executes dropped EXE
PID:968 -
\??\c:\bnntbh.exec:\bnntbh.exe65⤵
- Executes dropped EXE
PID:1136 -
\??\c:\bthhbh.exec:\bthhbh.exe66⤵PID:1800
-
\??\c:\dvjjd.exec:\dvjjd.exe67⤵PID:1092
-
\??\c:\1rfffff.exec:\1rfffff.exe68⤵PID:2240
-
\??\c:\rlxxfxf.exec:\rlxxfxf.exe69⤵PID:3064
-
\??\c:\9hbntt.exec:\9hbntt.exe70⤵PID:1820
-
\??\c:\1dvpp.exec:\1dvpp.exe71⤵PID:1636
-
\??\c:\frxrrrr.exec:\frxrrrr.exe72⤵PID:352
-
\??\c:\5bbbtt.exec:\5bbbtt.exe73⤵PID:2280
-
\??\c:\nhnnnh.exec:\nhnnnh.exe74⤵PID:1748
-
\??\c:\jjdvp.exec:\jjdvp.exe75⤵PID:1680
-
\??\c:\7rfxxrx.exec:\7rfxxrx.exe76⤵PID:2116
-
\??\c:\thnnth.exec:\thnnth.exe77⤵PID:2528
-
\??\c:\3vvdv.exec:\3vvdv.exe78⤵PID:2004
-
\??\c:\dvjjj.exec:\dvjjj.exe79⤵PID:2152
-
\??\c:\1lxfflr.exec:\1lxfflr.exe80⤵PID:2740
-
\??\c:\1tbttn.exec:\1tbttn.exe81⤵PID:2856
-
\??\c:\btnnnn.exec:\btnnnn.exe82⤵PID:2748
-
\??\c:\jdjdv.exec:\jdjdv.exe83⤵PID:2800
-
\??\c:\lfrffxx.exec:\lfrffxx.exe84⤵PID:2956
-
\??\c:\rfrrrrr.exec:\rfrrrrr.exe85⤵PID:2760
-
\??\c:\thhbhn.exec:\thhbhn.exe86⤵PID:2652
-
\??\c:\vjvvd.exec:\vjvvd.exe87⤵PID:2660
-
\??\c:\dvdjd.exec:\dvdjd.exe88⤵PID:2592
-
\??\c:\1ffxfxf.exec:\1ffxfxf.exe89⤵PID:2420
-
\??\c:\5nhnhn.exec:\5nhnhn.exe90⤵PID:1424
-
\??\c:\1thbhh.exec:\1thbhh.exe91⤵PID:1468
-
\??\c:\pdpjj.exec:\pdpjj.exe92⤵PID:1308
-
\??\c:\9rlflrr.exec:\9rlflrr.exe93⤵PID:756
-
\??\c:\3xrrrrx.exec:\3xrrrrx.exe94⤵PID:808
-
\??\c:\btbbhb.exec:\btbbhb.exe95⤵PID:1472
-
\??\c:\dpvjj.exec:\dpvjj.exe96⤵PID:2336
-
\??\c:\frfrxlf.exec:\frfrxlf.exe97⤵PID:1644
-
\??\c:\7rfxffl.exec:\7rfxffl.exe98⤵PID:2904
-
\??\c:\bhnbth.exec:\bhnbth.exe99⤵PID:1916
-
\??\c:\7jddp.exec:\7jddp.exe100⤵PID:2948
-
\??\c:\jvjpp.exec:\jvjpp.exe101⤵PID:2980
-
\??\c:\lxlfllr.exec:\lxlfllr.exe102⤵PID:2472
-
\??\c:\tnhhhh.exec:\tnhhhh.exe103⤵PID:2484
-
\??\c:\dvjdd.exec:\dvjdd.exe104⤵PID:1720
-
\??\c:\jvdvv.exec:\jvdvv.exe105⤵PID:732
-
\??\c:\9xlfxrr.exec:\9xlfxrr.exe106⤵PID:684
-
\??\c:\tthhbb.exec:\tthhbb.exe107⤵PID:968
-
\??\c:\bhthnh.exec:\bhthnh.exe108⤵PID:1868
-
\??\c:\dpddd.exec:\dpddd.exe109⤵PID:816
-
\??\c:\pvvpj.exec:\pvvpj.exe110⤵PID:1744
-
\??\c:\rlrrlll.exec:\rlrrlll.exe111⤵PID:2072
-
\??\c:\7nbtnn.exec:\7nbtnn.exe112⤵PID:2448
-
\??\c:\thtbbt.exec:\thtbbt.exe113⤵PID:820
-
\??\c:\1jppv.exec:\1jppv.exe114⤵PID:1636
-
\??\c:\lxlffxr.exec:\lxlffxr.exe115⤵PID:1028
-
\??\c:\bnbbhh.exec:\bnbbhh.exe116⤵PID:1944
-
\??\c:\nhthbt.exec:\nhthbt.exe117⤵PID:2548
-
\??\c:\3jddv.exec:\3jddv.exe118⤵PID:1984
-
\??\c:\fxfllll.exec:\fxfllll.exe119⤵PID:2536
-
\??\c:\flffllr.exec:\flffllr.exe120⤵PID:2788
-
\??\c:\7bbtbb.exec:\7bbtbb.exe121⤵PID:2148
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-