Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/12/2024, 03:55
Static task
static1
Behavioral task
behavioral1
Sample
adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe
Resource
win7-20240903-en
General
-
Target
adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe
-
Size
454KB
-
MD5
20b111875971d37c6362dd0f4099814d
-
SHA1
5623bd2fcc32c842c3518127c31d0acd7681f260
-
SHA256
adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a
-
SHA512
0c1ebd0b3434877e217a34696bd6c77a32df28337b60d436caada2d811b88cbb788b3c08a7b08aa8fa8c60205d54a7a10d800243799cf42428257191378b49ee
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe9:q7Tc2NYHUrAwfMp3CD9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2376-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-27-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2860-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-46-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2776-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-84-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2744-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-123-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1948-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/620-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-292-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3012-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-379-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/580-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-428-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1768-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-452-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2556-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-795-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-902-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2208-988-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3000-1076-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1788-1087-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/824-1112-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2212-1236-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2164 7htbhh.exe 2860 vpjjj.exe 2548 dvpvv.exe 2128 1rlxxff.exe 2776 hthhnn.exe 2680 9pjjv.exe 2764 7nthnt.exe 2748 jjjpj.exe 2744 xrlrxxl.exe 2596 tnthtb.exe 3032 5xfxxfl.exe 1212 bbnhtn.exe 1732 vpdjp.exe 376 rlflrxf.exe 1948 7dppp.exe 2888 frllrrx.exe 1912 hhhnbh.exe 2528 pjvvv.exe 2868 lfxlxlr.exe 2392 tnbbhh.exe 2224 jdddd.exe 1108 3rrrffl.exe 2976 pvddj.exe 1700 dpdjp.exe 620 5bnntt.exe 2496 jvppv.exe 2536 fxlrrrx.exe 2272 xrfrxxf.exe 2448 dpddp.exe 2308 fxrxlfr.exe 1956 1tttbb.exe 3012 7vpvv.exe 2016 jvpvv.exe 2196 bnhhhn.exe 2668 jvddv.exe 1656 lrfxrll.exe 2800 llllxxl.exe 2696 nnbbbh.exe 2856 9vjjp.exe 2840 7jdjj.exe 2920 frxrxxf.exe 1252 rfrrrrr.exe 2740 hbtnbh.exe 2576 dvpdv.exe 580 lxfxfxf.exe 2044 5rffffl.exe 2896 thbbhh.exe 2472 ddvjd.exe 1564 dvpdp.exe 1856 7lfxxxf.exe 1948 bthntt.exe 1784 dvpvv.exe 1688 jvjjp.exe 1768 5xllfff.exe 3048 htnnnn.exe 2924 7htnnn.exe 2228 ddvvd.exe 2392 fxxfxrl.exe 1584 thtbnt.exe 328 1nbbtn.exe 2556 5vjpj.exe 1708 rrrrlrf.exe 1700 rfxrxxl.exe 1776 hhhbnb.exe -
resource yara_rule behavioral1/memory/2376-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-428-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1768-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-795-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-864-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-885-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-957-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-1076-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1788-1087-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2212-1236-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2616-1259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-1364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-3124-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxlfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2376 wrote to memory of 2164 2376 adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe 30 PID 2376 wrote to memory of 2164 2376 adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe 30 PID 2376 wrote to memory of 2164 2376 adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe 30 PID 2376 wrote to memory of 2164 2376 adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe 30 PID 2164 wrote to memory of 2860 2164 7htbhh.exe 31 PID 2164 wrote to memory of 2860 2164 7htbhh.exe 31 PID 2164 wrote to memory of 2860 2164 7htbhh.exe 31 PID 2164 wrote to memory of 2860 2164 7htbhh.exe 31 PID 2860 wrote to memory of 2548 2860 vpjjj.exe 32 PID 2860 wrote to memory of 2548 2860 vpjjj.exe 32 PID 2860 wrote to memory of 2548 2860 vpjjj.exe 32 PID 2860 wrote to memory of 2548 2860 vpjjj.exe 32 PID 2548 wrote to memory of 2128 2548 dvpvv.exe 33 PID 2548 wrote to memory of 2128 2548 dvpvv.exe 33 PID 2548 wrote to memory of 2128 2548 dvpvv.exe 33 PID 2548 wrote to memory of 2128 2548 dvpvv.exe 33 PID 2128 wrote to memory of 2776 2128 1rlxxff.exe 34 PID 2128 wrote to memory of 2776 2128 1rlxxff.exe 34 PID 2128 wrote to memory of 2776 2128 1rlxxff.exe 34 PID 2128 wrote to memory of 2776 2128 1rlxxff.exe 34 PID 2776 wrote to memory of 2680 2776 hthhnn.exe 35 PID 2776 wrote to memory of 2680 2776 hthhnn.exe 35 PID 2776 wrote to memory of 2680 2776 hthhnn.exe 35 PID 2776 wrote to memory of 2680 2776 hthhnn.exe 35 PID 2680 wrote to memory of 2764 2680 9pjjv.exe 36 PID 2680 wrote to memory of 2764 2680 9pjjv.exe 36 PID 2680 wrote to memory of 2764 2680 9pjjv.exe 36 PID 2680 wrote to memory of 2764 2680 9pjjv.exe 36 PID 2764 wrote to memory of 2748 2764 7nthnt.exe 37 PID 2764 wrote to memory of 2748 2764 7nthnt.exe 37 PID 2764 wrote to memory of 2748 2764 7nthnt.exe 37 PID 2764 wrote to memory of 2748 2764 7nthnt.exe 37 PID 2748 wrote to memory of 2744 2748 jjjpj.exe 38 PID 2748 wrote to memory of 2744 2748 jjjpj.exe 38 PID 2748 wrote to memory of 2744 2748 jjjpj.exe 38 PID 2748 wrote to memory of 2744 2748 jjjpj.exe 38 PID 2744 wrote to memory of 2596 2744 xrlrxxl.exe 39 PID 2744 wrote to memory of 2596 2744 xrlrxxl.exe 39 PID 2744 wrote to memory of 2596 2744 xrlrxxl.exe 39 PID 2744 wrote to memory of 2596 2744 xrlrxxl.exe 39 PID 2596 wrote to memory of 3032 2596 tnthtb.exe 40 PID 2596 wrote to memory of 3032 2596 tnthtb.exe 40 PID 2596 wrote to memory of 3032 2596 tnthtb.exe 40 PID 2596 wrote to memory of 3032 2596 tnthtb.exe 40 PID 3032 wrote to memory of 1212 3032 5xfxxfl.exe 41 PID 3032 wrote to memory of 1212 3032 5xfxxfl.exe 41 PID 3032 wrote to memory of 1212 3032 5xfxxfl.exe 41 PID 3032 wrote to memory of 1212 3032 5xfxxfl.exe 41 PID 1212 wrote to memory of 1732 1212 bbnhtn.exe 42 PID 1212 wrote to memory of 1732 1212 bbnhtn.exe 42 PID 1212 wrote to memory of 1732 1212 bbnhtn.exe 42 PID 1212 wrote to memory of 1732 1212 bbnhtn.exe 42 PID 1732 wrote to memory of 376 1732 vpdjp.exe 43 PID 1732 wrote to memory of 376 1732 vpdjp.exe 43 PID 1732 wrote to memory of 376 1732 vpdjp.exe 43 PID 1732 wrote to memory of 376 1732 vpdjp.exe 43 PID 376 wrote to memory of 1948 376 rlflrxf.exe 44 PID 376 wrote to memory of 1948 376 rlflrxf.exe 44 PID 376 wrote to memory of 1948 376 rlflrxf.exe 44 PID 376 wrote to memory of 1948 376 rlflrxf.exe 44 PID 1948 wrote to memory of 2888 1948 7dppp.exe 45 PID 1948 wrote to memory of 2888 1948 7dppp.exe 45 PID 1948 wrote to memory of 2888 1948 7dppp.exe 45 PID 1948 wrote to memory of 2888 1948 7dppp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe"C:\Users\Admin\AppData\Local\Temp\adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\7htbhh.exec:\7htbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\vpjjj.exec:\vpjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\dvpvv.exec:\dvpvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\1rlxxff.exec:\1rlxxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\hthhnn.exec:\hthhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\9pjjv.exec:\9pjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\7nthnt.exec:\7nthnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\jjjpj.exec:\jjjpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\xrlrxxl.exec:\xrlrxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\tnthtb.exec:\tnthtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\5xfxxfl.exec:\5xfxxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\bbnhtn.exec:\bbnhtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\vpdjp.exec:\vpdjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\rlflrxf.exec:\rlflrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\7dppp.exec:\7dppp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\frllrrx.exec:\frllrrx.exe17⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hhhnbh.exec:\hhhnbh.exe18⤵
- Executes dropped EXE
PID:1912 -
\??\c:\pjvvv.exec:\pjvvv.exe19⤵
- Executes dropped EXE
PID:2528 -
\??\c:\lfxlxlr.exec:\lfxlxlr.exe20⤵
- Executes dropped EXE
PID:2868 -
\??\c:\tnbbhh.exec:\tnbbhh.exe21⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jdddd.exec:\jdddd.exe22⤵
- Executes dropped EXE
PID:2224 -
\??\c:\3rrrffl.exec:\3rrrffl.exe23⤵
- Executes dropped EXE
PID:1108 -
\??\c:\pvddj.exec:\pvddj.exe24⤵
- Executes dropped EXE
PID:2976 -
\??\c:\dpdjp.exec:\dpdjp.exe25⤵
- Executes dropped EXE
PID:1700 -
\??\c:\5bnntt.exec:\5bnntt.exe26⤵
- Executes dropped EXE
PID:620 -
\??\c:\jvppv.exec:\jvppv.exe27⤵
- Executes dropped EXE
PID:2496 -
\??\c:\fxlrrrx.exec:\fxlrrrx.exe28⤵
- Executes dropped EXE
PID:2536 -
\??\c:\xrfrxxf.exec:\xrfrxxf.exe29⤵
- Executes dropped EXE
PID:2272 -
\??\c:\dpddp.exec:\dpddp.exe30⤵
- Executes dropped EXE
PID:2448 -
\??\c:\fxrxlfr.exec:\fxrxlfr.exe31⤵
- Executes dropped EXE
PID:2308 -
\??\c:\1tttbb.exec:\1tttbb.exe32⤵
- Executes dropped EXE
PID:1956 -
\??\c:\7vpvv.exec:\7vpvv.exe33⤵
- Executes dropped EXE
PID:3012 -
\??\c:\jvpvv.exec:\jvpvv.exe34⤵
- Executes dropped EXE
PID:2016 -
\??\c:\bnhhhn.exec:\bnhhhn.exe35⤵
- Executes dropped EXE
PID:2196 -
\??\c:\jvddv.exec:\jvddv.exe36⤵
- Executes dropped EXE
PID:2668 -
\??\c:\lrfxrll.exec:\lrfxrll.exe37⤵
- Executes dropped EXE
PID:1656 -
\??\c:\llllxxl.exec:\llllxxl.exe38⤵
- Executes dropped EXE
PID:2800 -
\??\c:\nnbbbh.exec:\nnbbbh.exe39⤵
- Executes dropped EXE
PID:2696 -
\??\c:\9vjjp.exec:\9vjjp.exe40⤵
- Executes dropped EXE
PID:2856 -
\??\c:\7jdjj.exec:\7jdjj.exe41⤵
- Executes dropped EXE
PID:2840 -
\??\c:\frxrxxf.exec:\frxrxxf.exe42⤵
- Executes dropped EXE
PID:2920 -
\??\c:\rfrrrrr.exec:\rfrrrrr.exe43⤵
- Executes dropped EXE
PID:1252 -
\??\c:\hbtnbh.exec:\hbtnbh.exe44⤵
- Executes dropped EXE
PID:2740 -
\??\c:\dvpdv.exec:\dvpdv.exe45⤵
- Executes dropped EXE
PID:2576 -
\??\c:\lxfxfxf.exec:\lxfxfxf.exe46⤵
- Executes dropped EXE
PID:580 -
\??\c:\5rffffl.exec:\5rffffl.exe47⤵
- Executes dropped EXE
PID:2044 -
\??\c:\thbbhh.exec:\thbbhh.exe48⤵
- Executes dropped EXE
PID:2896 -
\??\c:\ddvjd.exec:\ddvjd.exe49⤵
- Executes dropped EXE
PID:2472 -
\??\c:\dvpdp.exec:\dvpdp.exe50⤵
- Executes dropped EXE
PID:1564 -
\??\c:\7lfxxxf.exec:\7lfxxxf.exe51⤵
- Executes dropped EXE
PID:1856 -
\??\c:\bthntt.exec:\bthntt.exe52⤵
- Executes dropped EXE
PID:1948 -
\??\c:\dvpvv.exec:\dvpvv.exe53⤵
- Executes dropped EXE
PID:1784 -
\??\c:\jvjjp.exec:\jvjjp.exe54⤵
- Executes dropped EXE
PID:1688 -
\??\c:\5xllfff.exec:\5xllfff.exe55⤵
- Executes dropped EXE
PID:1768 -
\??\c:\htnnnn.exec:\htnnnn.exe56⤵
- Executes dropped EXE
PID:3048 -
\??\c:\7htnnn.exec:\7htnnn.exe57⤵
- Executes dropped EXE
PID:2924 -
\??\c:\ddvvd.exec:\ddvvd.exe58⤵
- Executes dropped EXE
PID:2228 -
\??\c:\fxxfxrl.exec:\fxxfxrl.exe59⤵
- Executes dropped EXE
PID:2392 -
\??\c:\thtbnt.exec:\thtbnt.exe60⤵
- Executes dropped EXE
PID:1584 -
\??\c:\1nbbtn.exec:\1nbbtn.exe61⤵
- Executes dropped EXE
PID:328 -
\??\c:\5vjpj.exec:\5vjpj.exe62⤵
- Executes dropped EXE
PID:2556 -
\??\c:\rrrrlrf.exec:\rrrrlrf.exe63⤵
- Executes dropped EXE
PID:1708 -
\??\c:\rfxrxxl.exec:\rfxrxxl.exe64⤵
- Executes dropped EXE
PID:1700 -
\??\c:\hhhbnb.exec:\hhhbnb.exe65⤵
- Executes dropped EXE
PID:1776 -
\??\c:\ppjjd.exec:\ppjjd.exe66⤵PID:2360
-
\??\c:\vpvvd.exec:\vpvvd.exe67⤵PID:2220
-
\??\c:\rfxffff.exec:\rfxffff.exe68⤵PID:484
-
\??\c:\9tnttt.exec:\9tnttt.exe69⤵PID:2296
-
\??\c:\nbttbb.exec:\nbttbb.exe70⤵PID:320
-
\??\c:\3vppd.exec:\3vppd.exe71⤵PID:592
-
\??\c:\1lfllll.exec:\1lfllll.exe72⤵PID:1984
-
\??\c:\lfxlrrr.exec:\lfxlrrr.exe73⤵PID:1956
-
\??\c:\3nbhhn.exec:\3nbhhn.exe74⤵PID:3064
-
\??\c:\nhbhtb.exec:\nhbhtb.exe75⤵PID:1060
-
\??\c:\pdvvp.exec:\pdvvp.exe76⤵PID:3052
-
\??\c:\1rxrxxr.exec:\1rxrxxr.exe77⤵PID:1156
-
\??\c:\llffxrl.exec:\llffxrl.exe78⤵PID:2780
-
\??\c:\7nbbhh.exec:\7nbbhh.exe79⤵PID:2712
-
\??\c:\jvpvv.exec:\jvpvv.exe80⤵PID:2772
-
\??\c:\vpdvv.exec:\vpdvv.exe81⤵PID:2824
-
\??\c:\rlrllff.exec:\rlrllff.exe82⤵PID:2856
-
\??\c:\btbhhh.exec:\btbhhh.exe83⤵PID:3056
-
\??\c:\7djpd.exec:\7djpd.exe84⤵PID:2600
-
\??\c:\3vvpp.exec:\3vvpp.exe85⤵PID:2624
-
\??\c:\xrflrxl.exec:\xrflrxl.exe86⤵PID:2692
-
\??\c:\3htntt.exec:\3htntt.exe87⤵PID:2580
-
\??\c:\nbnbhh.exec:\nbnbhh.exe88⤵PID:2756
-
\??\c:\vpddj.exec:\vpddj.exe89⤵PID:3040
-
\??\c:\lfxxffr.exec:\lfxxffr.exe90⤵PID:1540
-
\??\c:\ttnthn.exec:\ttnthn.exe91⤵PID:1208
-
\??\c:\thntnb.exec:\thntnb.exe92⤵PID:2384
-
\??\c:\dpjjv.exec:\dpjjv.exe93⤵PID:1992
-
\??\c:\7lxxxfl.exec:\7lxxxfl.exe94⤵PID:1220
-
\??\c:\btbtbt.exec:\btbtbt.exe95⤵PID:2888
-
\??\c:\3jpjj.exec:\3jpjj.exe96⤵PID:1912
-
\??\c:\5vjvp.exec:\5vjvp.exe97⤵
- System Location Discovery: System Language Discovery
PID:1428 -
\??\c:\rfrxflr.exec:\rfrxflr.exe98⤵PID:2268
-
\??\c:\nbnnnn.exec:\nbnnnn.exe99⤵PID:2868
-
\??\c:\thttbh.exec:\thttbh.exe100⤵PID:1872
-
\??\c:\pjvvd.exec:\pjvvd.exe101⤵PID:2228
-
\??\c:\rfllxfl.exec:\rfllxfl.exe102⤵PID:2392
-
\??\c:\xxrxxrf.exec:\xxrxxrf.exe103⤵PID:632
-
\??\c:\9hhhnt.exec:\9hhhnt.exe104⤵PID:1316
-
\??\c:\1pdpp.exec:\1pdpp.exe105⤵PID:640
-
\??\c:\vjddj.exec:\vjddj.exe106⤵PID:1652
-
\??\c:\rllrlxx.exec:\rllrlxx.exe107⤵PID:964
-
\??\c:\bnbbbt.exec:\bnbbbt.exe108⤵PID:2312
-
\??\c:\vppvv.exec:\vppvv.exe109⤵PID:1520
-
\??\c:\1dpjj.exec:\1dpjj.exe110⤵PID:2536
-
\??\c:\5rffxxf.exec:\5rffxxf.exe111⤵PID:2184
-
\??\c:\llrrxlr.exec:\llrrxlr.exe112⤵PID:2272
-
\??\c:\5thhhb.exec:\5thhhb.exe113⤵PID:2336
-
\??\c:\vpjjp.exec:\vpjjp.exe114⤵PID:2992
-
\??\c:\1lffllr.exec:\1lffllr.exe115⤵PID:2072
-
\??\c:\xlffrxf.exec:\xlffrxf.exe116⤵PID:2932
-
\??\c:\nhtttb.exec:\nhtttb.exe117⤵PID:2148
-
\??\c:\3bnhnt.exec:\3bnhnt.exe118⤵PID:2760
-
\??\c:\jdvvd.exec:\jdvvd.exe119⤵PID:3052
-
\??\c:\rfxflff.exec:\rfxflff.exe120⤵PID:2128
-
\??\c:\xxrfllx.exec:\xxrfllx.exe121⤵PID:2784
-
\??\c:\1ttnnn.exec:\1ttnnn.exe122⤵PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-