Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 21:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1fdf6f0bd4ecf75e40b3149d127614435494a31fd9aacb616c87300e0f0e7b77N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
1fdf6f0bd4ecf75e40b3149d127614435494a31fd9aacb616c87300e0f0e7b77N.exe
-
Size
454KB
-
MD5
b2ba63df2c440cba32dba8d540953ef0
-
SHA1
661b62e72dbfab87aea13d0677633b9113139d78
-
SHA256
1fdf6f0bd4ecf75e40b3149d127614435494a31fd9aacb616c87300e0f0e7b77
-
SHA512
21adf3990b7daf8b5771dedb7ec402179dacd36c6098e192a6cbe96467674a4c520e91e0c82b8889188d4660483f042b0a3f2d894257b7207998acde732f1055
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2540-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-145-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1960-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-723-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1988-816-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-736-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2588-716-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1700-673-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1464-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-192-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1108-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-163-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1468-153-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1468-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-97-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/316-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-1034-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1912-1036-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1068-1086-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/880-1100-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2752-1115-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2752-1113-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1796-1202-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2316-1277-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1704 rrrxlxx.exe 2388 btnbnt.exe 1616 lfxrrfx.exe 2220 nhhhnn.exe 2756 ddvdp.exe 2860 frxlxll.exe 1968 jdjvp.exe 2636 rxrfllf.exe 316 btnbnt.exe 2724 dvpvj.exe 2664 flxfflr.exe 2152 9flrlrf.exe 1536 tnhbhb.exe 1736 pddjp.exe 2432 lxflffx.exe 1468 ttbhnn.exe 2712 7vpdd.exe 2076 5frlxfx.exe 1108 nnhtnt.exe 2336 jdvdj.exe 1632 vpdvd.exe 980 bntnbb.exe 2592 jpvpj.exe 1644 fxfrlrl.exe 2004 dvjpv.exe 768 1pdpv.exe 2280 bnbhnt.exe 2412 jppdp.exe 2120 rllrflf.exe 876 bbthth.exe 1824 jddpp.exe 1584 frxlxff.exe 1704 dvvjv.exe 2576 rxrffxx.exe 1960 bttttb.exe 2500 hhbhhh.exe 2796 5jdpj.exe 2740 nbthth.exe 2996 1bbbnt.exe 2832 djvdj.exe 2960 5rrxrxr.exe 2636 rrlxrff.exe 2624 nhbhnn.exe 2732 vvdjv.exe 1340 jjpjd.exe 1464 rfxxxff.exe 2888 hthbht.exe 2652 tttbbh.exe 1328 jjjdp.exe 2676 ddpdj.exe 1572 rrlfrxr.exe 2116 bntnht.exe 1752 hbtbnb.exe 3060 vpjpp.exe 2268 dddpj.exe 2912 ffxfxfr.exe 2204 hhhttt.exe 756 9jjvd.exe 1120 5djjp.exe 576 rlllrxr.exe 1636 llxxffr.exe 2200 hnhtbt.exe 2216 pppdp.exe 1984 pvjvp.exe -
resource yara_rule behavioral1/memory/2540-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-886-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-984-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-816-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-1074-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-1215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-1316-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2540 wrote to memory of 1704 2540 1fdf6f0bd4ecf75e40b3149d127614435494a31fd9aacb616c87300e0f0e7b77N.exe 62 PID 2540 wrote to memory of 1704 2540 1fdf6f0bd4ecf75e40b3149d127614435494a31fd9aacb616c87300e0f0e7b77N.exe 62 PID 2540 wrote to memory of 1704 2540 1fdf6f0bd4ecf75e40b3149d127614435494a31fd9aacb616c87300e0f0e7b77N.exe 62 PID 2540 wrote to memory of 1704 2540 1fdf6f0bd4ecf75e40b3149d127614435494a31fd9aacb616c87300e0f0e7b77N.exe 62 PID 1704 wrote to memory of 2388 1704 rrrxlxx.exe 31 PID 1704 wrote to memory of 2388 1704 rrrxlxx.exe 31 PID 1704 wrote to memory of 2388 1704 rrrxlxx.exe 31 PID 1704 wrote to memory of 2388 1704 rrrxlxx.exe 31 PID 2388 wrote to memory of 1616 2388 btnbnt.exe 32 PID 2388 wrote to memory of 1616 2388 btnbnt.exe 32 PID 2388 wrote to memory of 1616 2388 btnbnt.exe 32 PID 2388 wrote to memory of 1616 2388 btnbnt.exe 32 PID 1616 wrote to memory of 2220 1616 lfxrrfx.exe 33 PID 1616 wrote to memory of 2220 1616 lfxrrfx.exe 33 PID 1616 wrote to memory of 2220 1616 lfxrrfx.exe 33 PID 1616 wrote to memory of 2220 1616 lfxrrfx.exe 33 PID 2220 wrote to memory of 2756 2220 nhhhnn.exe 149 PID 2220 wrote to memory of 2756 2220 nhhhnn.exe 149 PID 2220 wrote to memory of 2756 2220 nhhhnn.exe 149 PID 2220 wrote to memory of 2756 2220 nhhhnn.exe 149 PID 2756 wrote to memory of 2860 2756 ddvdp.exe 109 PID 2756 wrote to memory of 2860 2756 ddvdp.exe 109 PID 2756 wrote to memory of 2860 2756 ddvdp.exe 109 PID 2756 wrote to memory of 2860 2756 ddvdp.exe 109 PID 2860 wrote to memory of 1968 2860 frxlxll.exe 111 PID 2860 wrote to memory of 1968 2860 frxlxll.exe 111 PID 2860 wrote to memory of 1968 2860 frxlxll.exe 111 PID 2860 wrote to memory of 1968 2860 frxlxll.exe 111 PID 1968 wrote to memory of 2636 1968 jdjvp.exe 37 PID 1968 wrote to memory of 2636 1968 jdjvp.exe 37 PID 1968 wrote to memory of 2636 1968 jdjvp.exe 37 PID 1968 wrote to memory of 2636 1968 jdjvp.exe 37 PID 2636 wrote to memory of 316 2636 rxrfllf.exe 38 PID 2636 wrote to memory of 316 2636 rxrfllf.exe 38 PID 2636 wrote to memory of 316 2636 rxrfllf.exe 38 PID 2636 wrote to memory of 316 2636 rxrfllf.exe 38 PID 316 wrote to memory of 2724 316 btnbnt.exe 39 PID 316 wrote to memory of 2724 316 btnbnt.exe 39 PID 316 wrote to memory of 2724 316 btnbnt.exe 39 PID 316 wrote to memory of 2724 316 btnbnt.exe 39 PID 2724 wrote to memory of 2664 2724 dvpvj.exe 40 PID 2724 wrote to memory of 2664 2724 dvpvj.exe 40 PID 2724 wrote to memory of 2664 2724 dvpvj.exe 40 PID 2724 wrote to memory of 2664 2724 dvpvj.exe 40 PID 2664 wrote to memory of 2152 2664 flxfflr.exe 41 PID 2664 wrote to memory of 2152 2664 flxfflr.exe 41 PID 2664 wrote to memory of 2152 2664 flxfflr.exe 41 PID 2664 wrote to memory of 2152 2664 flxfflr.exe 41 PID 2152 wrote to memory of 1536 2152 9flrlrf.exe 42 PID 2152 wrote to memory of 1536 2152 9flrlrf.exe 42 PID 2152 wrote to memory of 1536 2152 9flrlrf.exe 42 PID 2152 wrote to memory of 1536 2152 9flrlrf.exe 42 PID 1536 wrote to memory of 1736 1536 tnhbhb.exe 43 PID 1536 wrote to memory of 1736 1536 tnhbhb.exe 43 PID 1536 wrote to memory of 1736 1536 tnhbhb.exe 43 PID 1536 wrote to memory of 1736 1536 tnhbhb.exe 43 PID 1736 wrote to memory of 2432 1736 pddjp.exe 44 PID 1736 wrote to memory of 2432 1736 pddjp.exe 44 PID 1736 wrote to memory of 2432 1736 pddjp.exe 44 PID 1736 wrote to memory of 2432 1736 pddjp.exe 44 PID 2432 wrote to memory of 1468 2432 lxflffx.exe 45 PID 2432 wrote to memory of 1468 2432 lxflffx.exe 45 PID 2432 wrote to memory of 1468 2432 lxflffx.exe 45 PID 2432 wrote to memory of 1468 2432 lxflffx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fdf6f0bd4ecf75e40b3149d127614435494a31fd9aacb616c87300e0f0e7b77N.exe"C:\Users\Admin\AppData\Local\Temp\1fdf6f0bd4ecf75e40b3149d127614435494a31fd9aacb616c87300e0f0e7b77N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\rrrxlxx.exec:\rrrxlxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\btnbnt.exec:\btnbnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\lfxrrfx.exec:\lfxrrfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\nhhhnn.exec:\nhhhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\ddvdp.exec:\ddvdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\frxlxll.exec:\frxlxll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\jdjvp.exec:\jdjvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\rxrfllf.exec:\rxrfllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\btnbnt.exec:\btnbnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\dvpvj.exec:\dvpvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\flxfflr.exec:\flxfflr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\9flrlrf.exec:\9flrlrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\tnhbhb.exec:\tnhbhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\pddjp.exec:\pddjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\lxflffx.exec:\lxflffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\ttbhnn.exec:\ttbhnn.exe17⤵
- Executes dropped EXE
PID:1468 -
\??\c:\7vpdd.exec:\7vpdd.exe18⤵
- Executes dropped EXE
PID:2712 -
\??\c:\5frlxfx.exec:\5frlxfx.exe19⤵
- Executes dropped EXE
PID:2076 -
\??\c:\nnhtnt.exec:\nnhtnt.exe20⤵
- Executes dropped EXE
PID:1108 -
\??\c:\jdvdj.exec:\jdvdj.exe21⤵
- Executes dropped EXE
PID:2336 -
\??\c:\vpdvd.exec:\vpdvd.exe22⤵
- Executes dropped EXE
PID:1632 -
\??\c:\bntnbb.exec:\bntnbb.exe23⤵
- Executes dropped EXE
PID:980 -
\??\c:\jpvpj.exec:\jpvpj.exe24⤵
- Executes dropped EXE
PID:2592 -
\??\c:\fxfrlrl.exec:\fxfrlrl.exe25⤵
- Executes dropped EXE
PID:1644 -
\??\c:\dvjpv.exec:\dvjpv.exe26⤵
- Executes dropped EXE
PID:2004 -
\??\c:\1pdpv.exec:\1pdpv.exe27⤵
- Executes dropped EXE
PID:768 -
\??\c:\bnbhnt.exec:\bnbhnt.exe28⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jppdp.exec:\jppdp.exe29⤵
- Executes dropped EXE
PID:2412 -
\??\c:\rllrflf.exec:\rllrflf.exe30⤵
- Executes dropped EXE
PID:2120 -
\??\c:\bbthth.exec:\bbthth.exe31⤵
- Executes dropped EXE
PID:876 -
\??\c:\jddpp.exec:\jddpp.exe32⤵
- Executes dropped EXE
PID:1824 -
\??\c:\frxlxff.exec:\frxlxff.exe33⤵
- Executes dropped EXE
PID:1584 -
\??\c:\dvvjv.exec:\dvvjv.exe34⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rxrffxx.exec:\rxrffxx.exe35⤵
- Executes dropped EXE
PID:2576 -
\??\c:\bttttb.exec:\bttttb.exe36⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hhbhhh.exec:\hhbhhh.exe37⤵
- Executes dropped EXE
PID:2500 -
\??\c:\5jdpj.exec:\5jdpj.exe38⤵
- Executes dropped EXE
PID:2796 -
\??\c:\nbthth.exec:\nbthth.exe39⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1bbbnt.exec:\1bbbnt.exe40⤵
- Executes dropped EXE
PID:2996 -
\??\c:\djvdj.exec:\djvdj.exe41⤵
- Executes dropped EXE
PID:2832 -
\??\c:\5rrxrxr.exec:\5rrxrxr.exe42⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rrlxrff.exec:\rrlxrff.exe43⤵
- Executes dropped EXE
PID:2636 -
\??\c:\nhbhnn.exec:\nhbhnn.exe44⤵
- Executes dropped EXE
PID:2624 -
\??\c:\vvdjv.exec:\vvdjv.exe45⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jjpjd.exec:\jjpjd.exe46⤵
- Executes dropped EXE
PID:1340 -
\??\c:\rfxxxff.exec:\rfxxxff.exe47⤵
- Executes dropped EXE
PID:1464 -
\??\c:\hthbht.exec:\hthbht.exe48⤵
- Executes dropped EXE
PID:2888 -
\??\c:\tttbbh.exec:\tttbbh.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2652 -
\??\c:\jjjdp.exec:\jjjdp.exe50⤵
- Executes dropped EXE
PID:1328 -
\??\c:\ddpdj.exec:\ddpdj.exe51⤵
- Executes dropped EXE
PID:2676 -
\??\c:\rrlfrxr.exec:\rrlfrxr.exe52⤵
- Executes dropped EXE
PID:1572 -
\??\c:\bntnht.exec:\bntnht.exe53⤵
- Executes dropped EXE
PID:2116 -
\??\c:\hbtbnb.exec:\hbtbnb.exe54⤵
- Executes dropped EXE
PID:1752 -
\??\c:\vpjpp.exec:\vpjpp.exe55⤵
- Executes dropped EXE
PID:3060 -
\??\c:\dddpj.exec:\dddpj.exe56⤵
- Executes dropped EXE
PID:2268 -
\??\c:\ffxfxfr.exec:\ffxfxfr.exe57⤵
- Executes dropped EXE
PID:2912 -
\??\c:\hhhttt.exec:\hhhttt.exe58⤵
- Executes dropped EXE
PID:2204 -
\??\c:\9jjvd.exec:\9jjvd.exe59⤵
- Executes dropped EXE
PID:756 -
\??\c:\5djjp.exec:\5djjp.exe60⤵
- Executes dropped EXE
PID:1120 -
\??\c:\rlllrxr.exec:\rlllrxr.exe61⤵
- Executes dropped EXE
PID:576 -
\??\c:\llxxffr.exec:\llxxffr.exe62⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hnhtbt.exec:\hnhtbt.exe63⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pppdp.exec:\pppdp.exe64⤵
- Executes dropped EXE
PID:2216 -
\??\c:\pvjvp.exec:\pvjvp.exe65⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xrfffxl.exec:\xrfffxl.exe66⤵PID:1912
-
\??\c:\nhhhbb.exec:\nhhhbb.exe67⤵PID:1432
-
\??\c:\hnhbbn.exec:\hnhbbn.exe68⤵PID:1740
-
\??\c:\1pvpj.exec:\1pvpj.exe69⤵PID:2408
-
\??\c:\lfxlxxf.exec:\lfxlxxf.exe70⤵PID:1744
-
\??\c:\nnnbtb.exec:\nnnbtb.exe71⤵PID:404
-
\??\c:\nthbtn.exec:\nthbtn.exe72⤵PID:1684
-
\??\c:\vpjdp.exec:\vpjdp.exe73⤵PID:2692
-
\??\c:\lrffrxf.exec:\lrffrxf.exe74⤵PID:1680
-
\??\c:\lfxlflf.exec:\lfxlflf.exe75⤵PID:2972
-
\??\c:\7tbnnb.exec:\7tbnnb.exe76⤵PID:264
-
\??\c:\jppjp.exec:\jppjp.exe77⤵PID:2420
-
\??\c:\vjpdd.exec:\vjpdd.exe78⤵PID:2252
-
\??\c:\1fxflrf.exec:\1fxflrf.exe79⤵PID:2820
-
\??\c:\9ttnnb.exec:\9ttnnb.exe80⤵PID:2740
-
\??\c:\ppvpd.exec:\ppvpd.exe81⤵PID:2860
-
\??\c:\pdjdj.exec:\pdjdj.exe82⤵PID:3020
-
\??\c:\lrrllxx.exec:\lrrllxx.exe83⤵PID:1968
-
\??\c:\nbnbth.exec:\nbnbth.exe84⤵PID:2840
-
\??\c:\btbbbb.exec:\btbbbb.exe85⤵
- System Location Discovery: System Language Discovery
PID:2184 -
\??\c:\3pvdp.exec:\3pvdp.exe86⤵PID:2624
-
\??\c:\rfxrxxx.exec:\rfxrxxx.exe87⤵PID:2732
-
\??\c:\fxlxrrf.exec:\fxlxrrf.exe88⤵PID:780
-
\??\c:\1nbtth.exec:\1nbtth.exe89⤵PID:2956
-
\??\c:\pddvp.exec:\pddvp.exe90⤵PID:2616
-
\??\c:\vpjvj.exec:\vpjvj.exe91⤵PID:1204
-
\??\c:\xfrffxx.exec:\xfrffxx.exe92⤵PID:1252
-
\??\c:\hhhtnh.exec:\hhhtnh.exe93⤵PID:1700
-
\??\c:\nbhnth.exec:\nbhnth.exe94⤵PID:1420
-
\??\c:\7jvvd.exec:\7jvvd.exe95⤵PID:1908
-
\??\c:\xlrfrll.exec:\xlrfrll.exe96⤵PID:3068
-
\??\c:\7thbbb.exec:\7thbbb.exe97⤵PID:3040
-
\??\c:\dpvpv.exec:\dpvpv.exe98⤵PID:2292
-
\??\c:\ddpdp.exec:\ddpdp.exe99⤵PID:2128
-
\??\c:\rlrffxf.exec:\rlrffxf.exe100⤵PID:2588
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe101⤵PID:1852
-
\??\c:\bntbhh.exec:\bntbhh.exe102⤵PID:2188
-
\??\c:\pjvdp.exec:\pjvdp.exe103⤵PID:1956
-
\??\c:\fxlrlfx.exec:\fxlrlfx.exe104⤵PID:1148
-
\??\c:\bbhbbb.exec:\bbhbbb.exe105⤵PID:1992
-
\??\c:\5djpv.exec:\5djpv.exe106⤵PID:2052
-
\??\c:\ppjpd.exec:\ppjpd.exe107⤵PID:1132
-
\??\c:\lxrxrrx.exec:\lxrxrrx.exe108⤵PID:3036
-
\??\c:\bbbbtn.exec:\bbbbtn.exe109⤵PID:1472
-
\??\c:\ttnbnn.exec:\ttnbnn.exe110⤵
- System Location Discovery: System Language Discovery
PID:2120 -
\??\c:\7vjjp.exec:\7vjjp.exe111⤵PID:2916
-
\??\c:\flfrlxr.exec:\flfrlxr.exe112⤵PID:2424
-
\??\c:\lllxrxr.exec:\lllxrxr.exe113⤵PID:1548
-
\??\c:\hhbnht.exec:\hhbnht.exe114⤵PID:1556
-
\??\c:\hnhnht.exec:\hnhnht.exe115⤵PID:2400
-
\??\c:\jppvp.exec:\jppvp.exe116⤵PID:2532
-
\??\c:\7frlrfr.exec:\7frlrfr.exe117⤵PID:1988
-
\??\c:\rlfrffr.exec:\rlfrffr.exe118⤵
- System Location Discovery: System Language Discovery
PID:2584 -
\??\c:\nbbnbh.exec:\nbbnbh.exe119⤵PID:1960
-
\??\c:\3ddjv.exec:\3ddjv.exe120⤵PID:2752
-
\??\c:\djdjv.exec:\djdjv.exe121⤵PID:2756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-