Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 21:35
Static task
static1
Behavioral task
behavioral1
Sample
25f8b6a718607062deb028978519b11d4c8cda8df6a355092e136065dcb84dbc.exe
Resource
win7-20240903-en
General
-
Target
25f8b6a718607062deb028978519b11d4c8cda8df6a355092e136065dcb84dbc.exe
-
Size
454KB
-
MD5
2295ecead46ec7a7b200ceeffec735c3
-
SHA1
e384200d341d3c9b866d4f75a5fa78903082159e
-
SHA256
25f8b6a718607062deb028978519b11d4c8cda8df6a355092e136065dcb84dbc
-
SHA512
d8adb81235cd66f6d18077b7b5548eecdfc4dc81368f4197d1af714cce3a20c873cf0e03c1701a18cc73cdeb9072f0e89c14df2348d02696a38a744a99e92f54
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe+:q7Tc2NYHUrAwfMp3CD+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2572-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-339-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2312-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-123-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1704-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-114-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3048-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-65-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2720-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-22-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1820-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-436-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2576-470-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2788-482-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/592-498-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1876-510-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2616-627-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/108-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-708-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-780-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1584-813-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2572 hhhtht.exe 2916 jdppv.exe 2800 3tbnhb.exe 2720 5djpv.exe 2860 lflflll.exe 2892 3tbttn.exe 2852 lxlffxx.exe 2784 nbhhbh.exe 2624 rfrrlxr.exe 3048 dpdvv.exe 1704 xxrrfxf.exe 2184 5tnntt.exe 1800 jdvpv.exe 1836 1hthnb.exe 2180 pdppj.exe 2592 tnntnb.exe 1292 frfxxrr.exe 2456 hntbbb.exe 1968 dpddj.exe 2036 hnhbtb.exe 1308 vdjdv.exe 908 frfxfxf.exe 1348 nhbhnt.exe 1668 9ppjj.exe 1992 bntntb.exe 2292 9jvpv.exe 676 thhhbt.exe 2176 vjvvv.exe 2448 rflllff.exe 2196 tbthtb.exe 2140 lrfxrxr.exe 2212 lrxllrf.exe 2392 9vpvd.exe 1036 jdvvp.exe 1844 xxlrlll.exe 2016 bhnhbh.exe 2872 9rrfxlf.exe 2324 lfxfxff.exe 2312 bbhthn.exe 2844 dvppj.exe 2776 fllfxrf.exe 2836 xxxlxff.exe 2784 hbbtnt.exe 2228 pvpdd.exe 2544 lrrrrxl.exe 3048 bbbbnt.exe 1820 xrlrrfl.exe 1976 bthhtt.exe 2340 1vjdp.exe 2024 rfffllx.exe 1632 jdjpp.exe 2136 rxxffxl.exe 2192 1hbnbh.exe 1380 pjvdj.exe 1808 ffxflrf.exe 2576 tbnhbh.exe 1296 jddpd.exe 2788 fllxrfr.exe 1616 bnhbht.exe 592 nhbnbh.exe 936 vvpvj.exe 1876 xfffrfx.exe 1284 ttnbnb.exe 1668 ddpvp.exe -
resource yara_rule behavioral1/memory/2572-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-708-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-781-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfflxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2392 wrote to memory of 2572 2392 25f8b6a718607062deb028978519b11d4c8cda8df6a355092e136065dcb84dbc.exe 30 PID 2392 wrote to memory of 2572 2392 25f8b6a718607062deb028978519b11d4c8cda8df6a355092e136065dcb84dbc.exe 30 PID 2392 wrote to memory of 2572 2392 25f8b6a718607062deb028978519b11d4c8cda8df6a355092e136065dcb84dbc.exe 30 PID 2392 wrote to memory of 2572 2392 25f8b6a718607062deb028978519b11d4c8cda8df6a355092e136065dcb84dbc.exe 30 PID 2572 wrote to memory of 2916 2572 hhhtht.exe 31 PID 2572 wrote to memory of 2916 2572 hhhtht.exe 31 PID 2572 wrote to memory of 2916 2572 hhhtht.exe 31 PID 2572 wrote to memory of 2916 2572 hhhtht.exe 31 PID 2916 wrote to memory of 2800 2916 jdppv.exe 32 PID 2916 wrote to memory of 2800 2916 jdppv.exe 32 PID 2916 wrote to memory of 2800 2916 jdppv.exe 32 PID 2916 wrote to memory of 2800 2916 jdppv.exe 32 PID 2800 wrote to memory of 2720 2800 3tbnhb.exe 33 PID 2800 wrote to memory of 2720 2800 3tbnhb.exe 33 PID 2800 wrote to memory of 2720 2800 3tbnhb.exe 33 PID 2800 wrote to memory of 2720 2800 3tbnhb.exe 33 PID 2720 wrote to memory of 2860 2720 5djpv.exe 34 PID 2720 wrote to memory of 2860 2720 5djpv.exe 34 PID 2720 wrote to memory of 2860 2720 5djpv.exe 34 PID 2720 wrote to memory of 2860 2720 5djpv.exe 34 PID 2860 wrote to memory of 2892 2860 lflflll.exe 35 PID 2860 wrote to memory of 2892 2860 lflflll.exe 35 PID 2860 wrote to memory of 2892 2860 lflflll.exe 35 PID 2860 wrote to memory of 2892 2860 lflflll.exe 35 PID 2892 wrote to memory of 2852 2892 3tbttn.exe 36 PID 2892 wrote to memory of 2852 2892 3tbttn.exe 36 PID 2892 wrote to memory of 2852 2892 3tbttn.exe 36 PID 2892 wrote to memory of 2852 2892 3tbttn.exe 36 PID 2852 wrote to memory of 2784 2852 lxlffxx.exe 37 PID 2852 wrote to memory of 2784 2852 lxlffxx.exe 37 PID 2852 wrote to memory of 2784 2852 lxlffxx.exe 37 PID 2852 wrote to memory of 2784 2852 lxlffxx.exe 37 PID 2784 wrote to memory of 2624 2784 nbhhbh.exe 38 PID 2784 wrote to memory of 2624 2784 nbhhbh.exe 38 PID 2784 wrote to memory of 2624 2784 nbhhbh.exe 38 PID 2784 wrote to memory of 2624 2784 nbhhbh.exe 38 PID 2624 wrote to memory of 3048 2624 rfrrlxr.exe 75 PID 2624 wrote to memory of 3048 2624 rfrrlxr.exe 75 PID 2624 wrote to memory of 3048 2624 rfrrlxr.exe 75 PID 2624 wrote to memory of 3048 2624 rfrrlxr.exe 75 PID 3048 wrote to memory of 1704 3048 dpdvv.exe 40 PID 3048 wrote to memory of 1704 3048 dpdvv.exe 40 PID 3048 wrote to memory of 1704 3048 dpdvv.exe 40 PID 3048 wrote to memory of 1704 3048 dpdvv.exe 40 PID 1704 wrote to memory of 2184 1704 xxrrfxf.exe 41 PID 1704 wrote to memory of 2184 1704 xxrrfxf.exe 41 PID 1704 wrote to memory of 2184 1704 xxrrfxf.exe 41 PID 1704 wrote to memory of 2184 1704 xxrrfxf.exe 41 PID 2184 wrote to memory of 1800 2184 5tnntt.exe 42 PID 2184 wrote to memory of 1800 2184 5tnntt.exe 42 PID 2184 wrote to memory of 1800 2184 5tnntt.exe 42 PID 2184 wrote to memory of 1800 2184 5tnntt.exe 42 PID 1800 wrote to memory of 1836 1800 jdvpv.exe 43 PID 1800 wrote to memory of 1836 1800 jdvpv.exe 43 PID 1800 wrote to memory of 1836 1800 jdvpv.exe 43 PID 1800 wrote to memory of 1836 1800 jdvpv.exe 43 PID 1836 wrote to memory of 2180 1836 1hthnb.exe 44 PID 1836 wrote to memory of 2180 1836 1hthnb.exe 44 PID 1836 wrote to memory of 2180 1836 1hthnb.exe 44 PID 1836 wrote to memory of 2180 1836 1hthnb.exe 44 PID 2180 wrote to memory of 2592 2180 pdppj.exe 45 PID 2180 wrote to memory of 2592 2180 pdppj.exe 45 PID 2180 wrote to memory of 2592 2180 pdppj.exe 45 PID 2180 wrote to memory of 2592 2180 pdppj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\25f8b6a718607062deb028978519b11d4c8cda8df6a355092e136065dcb84dbc.exe"C:\Users\Admin\AppData\Local\Temp\25f8b6a718607062deb028978519b11d4c8cda8df6a355092e136065dcb84dbc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\hhhtht.exec:\hhhtht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\jdppv.exec:\jdppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\3tbnhb.exec:\3tbnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\5djpv.exec:\5djpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\lflflll.exec:\lflflll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\3tbttn.exec:\3tbttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\lxlffxx.exec:\lxlffxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\nbhhbh.exec:\nbhhbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\rfrrlxr.exec:\rfrrlxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\dpdvv.exec:\dpdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\xxrrfxf.exec:\xxrrfxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\5tnntt.exec:\5tnntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\jdvpv.exec:\jdvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\1hthnb.exec:\1hthnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\pdppj.exec:\pdppj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\tnntnb.exec:\tnntnb.exe17⤵
- Executes dropped EXE
PID:2592 -
\??\c:\frfxxrr.exec:\frfxxrr.exe18⤵
- Executes dropped EXE
PID:1292 -
\??\c:\hntbbb.exec:\hntbbb.exe19⤵
- Executes dropped EXE
PID:2456 -
\??\c:\dpddj.exec:\dpddj.exe20⤵
- Executes dropped EXE
PID:1968 -
\??\c:\hnhbtb.exec:\hnhbtb.exe21⤵
- Executes dropped EXE
PID:2036 -
\??\c:\vdjdv.exec:\vdjdv.exe22⤵
- Executes dropped EXE
PID:1308 -
\??\c:\frfxfxf.exec:\frfxfxf.exe23⤵
- Executes dropped EXE
PID:908 -
\??\c:\nhbhnt.exec:\nhbhnt.exe24⤵
- Executes dropped EXE
PID:1348 -
\??\c:\9ppjj.exec:\9ppjj.exe25⤵
- Executes dropped EXE
PID:1668 -
\??\c:\bntntb.exec:\bntntb.exe26⤵
- Executes dropped EXE
PID:1992 -
\??\c:\9jvpv.exec:\9jvpv.exe27⤵
- Executes dropped EXE
PID:2292 -
\??\c:\thhhbt.exec:\thhhbt.exe28⤵
- Executes dropped EXE
PID:676 -
\??\c:\vjvvv.exec:\vjvvv.exe29⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rflllff.exec:\rflllff.exe30⤵
- Executes dropped EXE
PID:2448 -
\??\c:\tbthtb.exec:\tbthtb.exe31⤵
- Executes dropped EXE
PID:2196 -
\??\c:\lrfxrxr.exec:\lrfxrxr.exe32⤵
- Executes dropped EXE
PID:2140 -
\??\c:\lrxllrf.exec:\lrxllrf.exe33⤵
- Executes dropped EXE
PID:2212 -
\??\c:\9vpvd.exec:\9vpvd.exe34⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jdvvp.exec:\jdvvp.exe35⤵
- Executes dropped EXE
PID:1036 -
\??\c:\xxlrlll.exec:\xxlrlll.exe36⤵
- Executes dropped EXE
PID:1844 -
\??\c:\bhnhbh.exec:\bhnhbh.exe37⤵
- Executes dropped EXE
PID:2016 -
\??\c:\9rrfxlf.exec:\9rrfxlf.exe38⤵
- Executes dropped EXE
PID:2872 -
\??\c:\lfxfxff.exec:\lfxfxff.exe39⤵
- Executes dropped EXE
PID:2324 -
\??\c:\bbhthn.exec:\bbhthn.exe40⤵
- Executes dropped EXE
PID:2312 -
\??\c:\dvppj.exec:\dvppj.exe41⤵
- Executes dropped EXE
PID:2844 -
\??\c:\fllfxrf.exec:\fllfxrf.exe42⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xxxlxff.exec:\xxxlxff.exe43⤵
- Executes dropped EXE
PID:2836 -
\??\c:\hbbtnt.exec:\hbbtnt.exe44⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pvpdd.exec:\pvpdd.exe45⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lrrrrxl.exec:\lrrrrxl.exe46⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bbbbnt.exec:\bbbbnt.exe47⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xrlrrfl.exec:\xrlrrfl.exe48⤵
- Executes dropped EXE
PID:1820 -
\??\c:\bthhtt.exec:\bthhtt.exe49⤵
- Executes dropped EXE
PID:1976 -
\??\c:\1vjdp.exec:\1vjdp.exe50⤵
- Executes dropped EXE
PID:2340 -
\??\c:\rfffllx.exec:\rfffllx.exe51⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jdjpp.exec:\jdjpp.exe52⤵
- Executes dropped EXE
PID:1632 -
\??\c:\rxxffxl.exec:\rxxffxl.exe53⤵
- Executes dropped EXE
PID:2136 -
\??\c:\1hbnbh.exec:\1hbnbh.exe54⤵
- Executes dropped EXE
PID:2192 -
\??\c:\pjvdj.exec:\pjvdj.exe55⤵
- Executes dropped EXE
PID:1380 -
\??\c:\ffxflrf.exec:\ffxflrf.exe56⤵
- Executes dropped EXE
PID:1808 -
\??\c:\tbnhbh.exec:\tbnhbh.exe57⤵
- Executes dropped EXE
PID:2576 -
\??\c:\jddpd.exec:\jddpd.exe58⤵
- Executes dropped EXE
PID:1296 -
\??\c:\fllxrfr.exec:\fllxrfr.exe59⤵
- Executes dropped EXE
PID:2788 -
\??\c:\bnhbht.exec:\bnhbht.exe60⤵
- Executes dropped EXE
PID:1616 -
\??\c:\nhbnbh.exec:\nhbnbh.exe61⤵
- Executes dropped EXE
PID:592 -
\??\c:\vvpvj.exec:\vvpvj.exe62⤵
- Executes dropped EXE
PID:936 -
\??\c:\xfffrfx.exec:\xfffrfx.exe63⤵
- Executes dropped EXE
PID:1876 -
\??\c:\ttnbnb.exec:\ttnbnb.exe64⤵
- Executes dropped EXE
PID:1284 -
\??\c:\ddpvp.exec:\ddpvp.exe65⤵
- Executes dropped EXE
PID:1668 -
\??\c:\frrrxff.exec:\frrrxff.exe66⤵PID:2528
-
\??\c:\hbtbnt.exec:\hbtbnt.exe67⤵PID:2096
-
\??\c:\vvjvp.exec:\vvjvp.exe68⤵PID:2004
-
\??\c:\llxrlxl.exec:\llxrlxl.exe69⤵PID:2168
-
\??\c:\nnhhnn.exec:\nnhhnn.exe70⤵PID:2792
-
\??\c:\nhtnbh.exec:\nhtnbh.exe71⤵PID:1608
-
\??\c:\vjvjv.exec:\vjvjv.exe72⤵PID:1648
-
\??\c:\xxlffrl.exec:\xxlffrl.exe73⤵PID:2000
-
\??\c:\nhbhtb.exec:\nhbhtb.exe74⤵PID:2540
-
\??\c:\hbthbb.exec:\hbthbb.exe75⤵PID:264
-
\??\c:\jjpvp.exec:\jjpvp.exe76⤵PID:1100
-
\??\c:\lrxlfrl.exec:\lrxlfrl.exe77⤵PID:888
-
\??\c:\tnbntn.exec:\tnbntn.exe78⤵PID:2560
-
\??\c:\jpvdp.exec:\jpvdp.exe79⤵PID:2208
-
\??\c:\rfxrxxx.exec:\rfxrxxx.exe80⤵PID:2756
-
\??\c:\ntbhht.exec:\ntbhht.exe81⤵PID:2016
-
\??\c:\frlxxxx.exec:\frlxxxx.exe82⤵PID:2616
-
\??\c:\9htbbb.exec:\9htbbb.exe83⤵PID:108
-
\??\c:\vdjvv.exec:\vdjvv.exe84⤵PID:2644
-
\??\c:\1rrrxfl.exec:\1rrrxfl.exe85⤵
- System Location Discovery: System Language Discovery
PID:2940 -
\??\c:\tbnnnb.exec:\tbnnnb.exe86⤵PID:2568
-
\??\c:\ttbnht.exec:\ttbnht.exe87⤵PID:2536
-
\??\c:\pjdpp.exec:\pjdpp.exe88⤵PID:2808
-
\??\c:\3flrxfr.exec:\3flrxfr.exe89⤵PID:2760
-
\??\c:\nttbth.exec:\nttbth.exe90⤵PID:2632
-
\??\c:\pvvjv.exec:\pvvjv.exe91⤵PID:2732
-
\??\c:\jjvjp.exec:\jjvjp.exe92⤵PID:1684
-
\??\c:\xxrxlxr.exec:\xxrxlxr.exe93⤵PID:1980
-
\??\c:\hnnbtb.exec:\hnnbtb.exe94⤵PID:2436
-
\??\c:\pdpdj.exec:\pdpdj.exe95⤵PID:1064
-
\??\c:\rxlxrrl.exec:\rxlxrrl.exe96⤵PID:1868
-
\??\c:\lfflrxr.exec:\lfflrxr.exe97⤵PID:2220
-
\??\c:\thnnnh.exec:\thnnnh.exe98⤵PID:2592
-
\??\c:\ddpjv.exec:\ddpjv.exe99⤵PID:2992
-
\??\c:\xfrfxrr.exec:\xfrfxrr.exe100⤵PID:768
-
\??\c:\bnbbbt.exec:\bnbbbt.exe101⤵PID:2132
-
\??\c:\1nnbnb.exec:\1nnbnb.exe102⤵PID:1900
-
\??\c:\jddjv.exec:\jddjv.exe103⤵PID:272
-
\??\c:\lrlxxrr.exec:\lrlxxrr.exe104⤵PID:1768
-
\??\c:\vvpjd.exec:\vvpjd.exe105⤵PID:1552
-
\??\c:\xlllrxl.exec:\xlllrxl.exe106⤵PID:2520
-
\??\c:\nnntnt.exec:\nnntnt.exe107⤵PID:1584
-
\??\c:\jdpvv.exec:\jdpvv.exe108⤵PID:2472
-
\??\c:\fxrxfrx.exec:\fxrxfrx.exe109⤵PID:2104
-
\??\c:\ntnbht.exec:\ntnbht.exe110⤵PID:2336
-
\??\c:\pppdv.exec:\pppdv.exe111⤵PID:988
-
\??\c:\xxllfxf.exec:\xxllfxf.exe112⤵PID:2044
-
\??\c:\btntbh.exec:\btntbh.exe113⤵PID:1492
-
\??\c:\pppjp.exec:\pppjp.exe114⤵PID:2176
-
\??\c:\jdjjp.exec:\jdjjp.exe115⤵PID:2076
-
\??\c:\rxxllrr.exec:\rxxllrr.exe116⤵PID:1656
-
\??\c:\7bnnnt.exec:\7bnnnt.exe117⤵PID:2552
-
\??\c:\1jjpv.exec:\1jjpv.exe118⤵PID:1708
-
\??\c:\jjdpd.exec:\jjdpd.exe119⤵PID:2120
-
\??\c:\hbnnhh.exec:\hbnnhh.exe120⤵PID:916
-
\??\c:\hbtbnt.exec:\hbtbnt.exe121⤵PID:1328
-
\??\c:\7dppd.exec:\7dppd.exe122⤵PID:2704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-