Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
69s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 22:53
Behavioral task
behavioral1
Sample
466e506bdb901c41a6db1bae2dc97a899c8d016aef38e0515d103c2a71a103c5N.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
120 seconds
General
-
Target
466e506bdb901c41a6db1bae2dc97a899c8d016aef38e0515d103c2a71a103c5N.exe
-
Size
254KB
-
MD5
ffa4325a3ad4f104ebdb9e41491f29f0
-
SHA1
8ab87968da4fcc59608bae089b8b81d4cd9c846e
-
SHA256
466e506bdb901c41a6db1bae2dc97a899c8d016aef38e0515d103c2a71a103c5
-
SHA512
7605b2b77a642b462d8185c7b46bf4af30f081f85c04cc387e4d3ad0aeeef6b251c7b38e9d4076e0e6d1c102de2c9d369ce06006e534fbd4e25bd6d26126a7b9
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpolTjZXvEQo9dfBP/e:y4wFHoS3eFaKHpKT9XvEhdfBP/e
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/1724-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2396-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2052-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1992-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1496-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/400-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1836-174-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1080-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1204-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/984-240-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2532-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/952-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2012-375-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1732-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1496-441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1408-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-313-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/592-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1436-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1752-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/984-210-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2448-473-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2156-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1780-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/748-506-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/448-518-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/448-520-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1972-552-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2168-856-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/1516-1046-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/748-1060-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/984-1058-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/684-1083-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2248-1094-0x00000000003D0000-0x00000000003F7000-memory.dmp family_blackmoon behavioral1/memory/1540-1132-0x00000000001C0000-0x00000000001E7000-memory.dmp family_blackmoon behavioral1/memory/1624-1234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1692-1266-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1792-1324-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2204-1380-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2396 jvdvd.exe 2168 3htthn.exe 1644 268404.exe 2468 thttnt.exe 2764 7vjjv.exe 2856 1dpjp.exe 2620 hbthhh.exe 2064 20246.exe 2780 hbbhnt.exe 2624 fxrxfll.exe 2260 820684.exe 2052 c284000.exe 1716 dvdjd.exe 1992 nttntn.exe 2196 26028.exe 1496 0244444.exe 400 042868.exe 1836 tnbbhb.exe 1080 9vppv.exe 2956 04280.exe 2292 66446.exe 984 pdpvj.exe 1752 a4228.exe 1204 5btthh.exe 2004 2626624.exe 1272 lxrxflr.exe 3048 26440.exe 2556 nntbht.exe 2532 c024684.exe 1944 djddv.exe 1436 26828.exe 2368 46826.exe 592 20666.exe 2168 thnttt.exe 1636 dpdjp.exe 1408 9pjdj.exe 952 a8040.exe 2768 rfrrxxl.exe 2300 5vdvj.exe 2012 4688888.exe 2876 824448.exe 2776 6466640.exe 1656 k24400.exe 2780 80602.exe 2608 9llrfll.exe 2736 640482.exe 916 66024.exe 1032 vjvdj.exe 1592 dpddd.exe 1964 i460084.exe 628 200620.exe 1732 42268.exe 1496 pdppd.exe 1712 9flllll.exe 1440 xfrxfxl.exe 1228 pdpjv.exe 2916 nbnnnh.exe 2448 u084444.exe 1516 i680666.exe 2156 9fxrxrf.exe 1780 7bttth.exe 2436 202242.exe 2120 flrrffr.exe 748 djvpp.exe -
resource yara_rule behavioral1/memory/1724-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1724-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000a00000001225f-7.dat upx behavioral1/files/0x0008000000019329-17.dat upx behavioral1/memory/2168-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000019345-25.dat upx behavioral1/memory/2468-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000019369-35.dat upx behavioral1/memory/1644-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2396-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001938e-61.dat upx behavioral1/memory/2856-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019382-53.dat upx behavioral1/memory/2764-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001937b-44.dat upx behavioral1/memory/2780-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000193d1-80.dat upx behavioral1/memory/2064-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000193a8-71.dat upx behavioral1/memory/2620-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000195d0-87.dat upx behavioral1/memory/2624-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a445-97.dat upx behavioral1/memory/1716-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a452-117.dat upx behavioral1/memory/2052-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a447-108.dat upx behavioral1/files/0x000500000001a454-126.dat upx behavioral1/memory/1716-124-0x0000000000230000-0x0000000000257000-memory.dmp upx behavioral1/memory/2052-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2260-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1992-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a463-135.dat upx behavioral1/memory/1496-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a470-158.dat upx behavioral1/files/0x000500000001a46d-148.dat upx behavioral1/memory/1496-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2196-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a472-165.dat upx behavioral1/memory/400-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001921d-175.dat upx behavioral1/memory/1080-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a478-186.dat upx behavioral1/files/0x000500000001a47c-193.dat upx behavioral1/files/0x000500000001a481-211.dat upx behavioral1/files/0x000500000001a483-221.dat upx behavioral1/memory/1204-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a487-241.dat upx behavioral1/files/0x000500000001a48b-256.dat upx behavioral1/files/0x000500000001a48d-265.dat upx behavioral1/files/0x000500000001a48f-275.dat upx behavioral1/memory/2532-274-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2368-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a493-291.dat upx behavioral1/memory/2368-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1636-315-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-336-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/952-335-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2876-356-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1732-434-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1496-441-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1032-408-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/1408-328-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2168-314-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q46806.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 480624.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4800628.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46666.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00424.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w46000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g0828.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w46800.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 268404.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 424000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86884.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1724 wrote to memory of 2396 1724 466e506bdb901c41a6db1bae2dc97a899c8d016aef38e0515d103c2a71a103c5N.exe 30 PID 1724 wrote to memory of 2396 1724 466e506bdb901c41a6db1bae2dc97a899c8d016aef38e0515d103c2a71a103c5N.exe 30 PID 1724 wrote to memory of 2396 1724 466e506bdb901c41a6db1bae2dc97a899c8d016aef38e0515d103c2a71a103c5N.exe 30 PID 1724 wrote to memory of 2396 1724 466e506bdb901c41a6db1bae2dc97a899c8d016aef38e0515d103c2a71a103c5N.exe 30 PID 2396 wrote to memory of 2168 2396 jvdvd.exe 31 PID 2396 wrote to memory of 2168 2396 jvdvd.exe 31 PID 2396 wrote to memory of 2168 2396 jvdvd.exe 31 PID 2396 wrote to memory of 2168 2396 jvdvd.exe 31 PID 2168 wrote to memory of 1644 2168 3htthn.exe 32 PID 2168 wrote to memory of 1644 2168 3htthn.exe 32 PID 2168 wrote to memory of 1644 2168 3htthn.exe 32 PID 2168 wrote to memory of 1644 2168 3htthn.exe 32 PID 1644 wrote to memory of 2468 1644 268404.exe 33 PID 1644 wrote to memory of 2468 1644 268404.exe 33 PID 1644 wrote to memory of 2468 1644 268404.exe 33 PID 1644 wrote to memory of 2468 1644 268404.exe 33 PID 2468 wrote to memory of 2764 2468 thttnt.exe 34 PID 2468 wrote to memory of 2764 2468 thttnt.exe 34 PID 2468 wrote to memory of 2764 2468 thttnt.exe 34 PID 2468 wrote to memory of 2764 2468 thttnt.exe 34 PID 2764 wrote to memory of 2856 2764 7vjjv.exe 35 PID 2764 wrote to memory of 2856 2764 7vjjv.exe 35 PID 2764 wrote to memory of 2856 2764 7vjjv.exe 35 PID 2764 wrote to memory of 2856 2764 7vjjv.exe 35 PID 2856 wrote to memory of 2620 2856 1dpjp.exe 36 PID 2856 wrote to memory of 2620 2856 1dpjp.exe 36 PID 2856 wrote to memory of 2620 2856 1dpjp.exe 36 PID 2856 wrote to memory of 2620 2856 1dpjp.exe 36 PID 2620 wrote to memory of 2064 2620 hbthhh.exe 37 PID 2620 wrote to memory of 2064 2620 hbthhh.exe 37 PID 2620 wrote to memory of 2064 2620 hbthhh.exe 37 PID 2620 wrote to memory of 2064 2620 hbthhh.exe 37 PID 2064 wrote to memory of 2780 2064 20246.exe 38 PID 2064 wrote to memory of 2780 2064 20246.exe 38 PID 2064 wrote to memory of 2780 2064 20246.exe 38 PID 2064 wrote to memory of 2780 2064 20246.exe 38 PID 2780 wrote to memory of 2624 2780 hbbhnt.exe 39 PID 2780 wrote to memory of 2624 2780 hbbhnt.exe 39 PID 2780 wrote to memory of 2624 2780 hbbhnt.exe 39 PID 2780 wrote to memory of 2624 2780 hbbhnt.exe 39 PID 2624 wrote to memory of 2260 2624 fxrxfll.exe 40 PID 2624 wrote to memory of 2260 2624 fxrxfll.exe 40 PID 2624 wrote to memory of 2260 2624 fxrxfll.exe 40 PID 2624 wrote to memory of 2260 2624 fxrxfll.exe 40 PID 2260 wrote to memory of 2052 2260 820684.exe 41 PID 2260 wrote to memory of 2052 2260 820684.exe 41 PID 2260 wrote to memory of 2052 2260 820684.exe 41 PID 2260 wrote to memory of 2052 2260 820684.exe 41 PID 2052 wrote to memory of 1716 2052 c284000.exe 42 PID 2052 wrote to memory of 1716 2052 c284000.exe 42 PID 2052 wrote to memory of 1716 2052 c284000.exe 42 PID 2052 wrote to memory of 1716 2052 c284000.exe 42 PID 1716 wrote to memory of 1992 1716 dvdjd.exe 43 PID 1716 wrote to memory of 1992 1716 dvdjd.exe 43 PID 1716 wrote to memory of 1992 1716 dvdjd.exe 43 PID 1716 wrote to memory of 1992 1716 dvdjd.exe 43 PID 1992 wrote to memory of 2196 1992 nttntn.exe 44 PID 1992 wrote to memory of 2196 1992 nttntn.exe 44 PID 1992 wrote to memory of 2196 1992 nttntn.exe 44 PID 1992 wrote to memory of 2196 1992 nttntn.exe 44 PID 2196 wrote to memory of 1496 2196 26028.exe 82 PID 2196 wrote to memory of 1496 2196 26028.exe 82 PID 2196 wrote to memory of 1496 2196 26028.exe 82 PID 2196 wrote to memory of 1496 2196 26028.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\466e506bdb901c41a6db1bae2dc97a899c8d016aef38e0515d103c2a71a103c5N.exe"C:\Users\Admin\AppData\Local\Temp\466e506bdb901c41a6db1bae2dc97a899c8d016aef38e0515d103c2a71a103c5N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\jvdvd.exec:\jvdvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\3htthn.exec:\3htthn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\268404.exec:\268404.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\thttnt.exec:\thttnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\7vjjv.exec:\7vjjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\1dpjp.exec:\1dpjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\hbthhh.exec:\hbthhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\20246.exec:\20246.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\hbbhnt.exec:\hbbhnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\fxrxfll.exec:\fxrxfll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\820684.exec:\820684.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\c284000.exec:\c284000.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\dvdjd.exec:\dvdjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\nttntn.exec:\nttntn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\26028.exec:\26028.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\0244444.exec:\0244444.exe17⤵
- Executes dropped EXE
PID:1496 -
\??\c:\042868.exec:\042868.exe18⤵
- Executes dropped EXE
PID:400 -
\??\c:\tnbbhb.exec:\tnbbhb.exe19⤵
- Executes dropped EXE
PID:1836 -
\??\c:\9vppv.exec:\9vppv.exe20⤵
- Executes dropped EXE
PID:1080 -
\??\c:\04280.exec:\04280.exe21⤵
- Executes dropped EXE
PID:2956 -
\??\c:\66446.exec:\66446.exe22⤵
- Executes dropped EXE
PID:2292 -
\??\c:\pdpvj.exec:\pdpvj.exe23⤵
- Executes dropped EXE
PID:984 -
\??\c:\a4228.exec:\a4228.exe24⤵
- Executes dropped EXE
PID:1752 -
\??\c:\5btthh.exec:\5btthh.exe25⤵
- Executes dropped EXE
PID:1204 -
\??\c:\2626624.exec:\2626624.exe26⤵
- Executes dropped EXE
PID:2004 -
\??\c:\lxrxflr.exec:\lxrxflr.exe27⤵
- Executes dropped EXE
PID:1272 -
\??\c:\26440.exec:\26440.exe28⤵
- Executes dropped EXE
PID:3048 -
\??\c:\nntbht.exec:\nntbht.exe29⤵
- Executes dropped EXE
PID:2556 -
\??\c:\c024684.exec:\c024684.exe30⤵
- Executes dropped EXE
PID:2532 -
\??\c:\djddv.exec:\djddv.exe31⤵
- Executes dropped EXE
PID:1944 -
\??\c:\26828.exec:\26828.exe32⤵
- Executes dropped EXE
PID:1436 -
\??\c:\46826.exec:\46826.exe33⤵
- Executes dropped EXE
PID:2368 -
\??\c:\20666.exec:\20666.exe34⤵
- Executes dropped EXE
PID:592 -
\??\c:\thnttt.exec:\thnttt.exe35⤵
- Executes dropped EXE
PID:2168 -
\??\c:\dpdjp.exec:\dpdjp.exe36⤵
- Executes dropped EXE
PID:1636 -
\??\c:\9pjdj.exec:\9pjdj.exe37⤵
- Executes dropped EXE
PID:1408 -
\??\c:\a8040.exec:\a8040.exe38⤵
- Executes dropped EXE
PID:952 -
\??\c:\rfrrxxl.exec:\rfrrxxl.exe39⤵
- Executes dropped EXE
PID:2768 -
\??\c:\5vdvj.exec:\5vdvj.exe40⤵
- Executes dropped EXE
PID:2300 -
\??\c:\4688888.exec:\4688888.exe41⤵
- Executes dropped EXE
PID:2012 -
\??\c:\824448.exec:\824448.exe42⤵
- Executes dropped EXE
PID:2876 -
\??\c:\6466640.exec:\6466640.exe43⤵
- Executes dropped EXE
PID:2776 -
\??\c:\k24400.exec:\k24400.exe44⤵
- Executes dropped EXE
PID:1656 -
\??\c:\80602.exec:\80602.exe45⤵
- Executes dropped EXE
PID:2780 -
\??\c:\9llrfll.exec:\9llrfll.exe46⤵
- Executes dropped EXE
PID:2608 -
\??\c:\640482.exec:\640482.exe47⤵
- Executes dropped EXE
PID:2736 -
\??\c:\66024.exec:\66024.exe48⤵
- Executes dropped EXE
PID:916 -
\??\c:\vjvdj.exec:\vjvdj.exe49⤵
- Executes dropped EXE
PID:1032 -
\??\c:\dpddd.exec:\dpddd.exe50⤵
- Executes dropped EXE
PID:1592 -
\??\c:\i460084.exec:\i460084.exe51⤵
- Executes dropped EXE
PID:1964 -
\??\c:\200620.exec:\200620.exe52⤵
- Executes dropped EXE
PID:628 -
\??\c:\42268.exec:\42268.exe53⤵
- Executes dropped EXE
PID:1732 -
\??\c:\pdppd.exec:\pdppd.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1496 -
\??\c:\9flllll.exec:\9flllll.exe55⤵
- Executes dropped EXE
PID:1712 -
\??\c:\xfrxfxl.exec:\xfrxfxl.exe56⤵
- Executes dropped EXE
PID:1440 -
\??\c:\pdpjv.exec:\pdpjv.exe57⤵
- Executes dropped EXE
PID:1228 -
\??\c:\nbnnnh.exec:\nbnnnh.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2916 -
\??\c:\u084444.exec:\u084444.exe59⤵
- Executes dropped EXE
PID:2448 -
\??\c:\i680666.exec:\i680666.exe60⤵
- Executes dropped EXE
PID:1516 -
\??\c:\9fxrxrf.exec:\9fxrxrf.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2156 -
\??\c:\7bttth.exec:\7bttth.exe62⤵
- Executes dropped EXE
PID:1780 -
\??\c:\202242.exec:\202242.exe63⤵
- Executes dropped EXE
PID:2436 -
\??\c:\flrrffr.exec:\flrrffr.exe64⤵
- Executes dropped EXE
PID:2120 -
\??\c:\djvpp.exec:\djvpp.exe65⤵
- Executes dropped EXE
PID:748 -
\??\c:\0862866.exec:\0862866.exe66⤵PID:448
-
\??\c:\o088822.exec:\o088822.exe67⤵PID:2424
-
\??\c:\rlrfrrr.exec:\rlrfrrr.exe68⤵PID:684
-
\??\c:\lrffxxx.exec:\lrffxxx.exe69⤵PID:2056
-
\??\c:\thbthb.exec:\thbthb.exe70⤵PID:2532
-
\??\c:\3vvpj.exec:\3vvpj.exe71⤵PID:1972
-
\??\c:\dpvdj.exec:\dpvdj.exe72⤵PID:1748
-
\??\c:\80226.exec:\80226.exe73⤵PID:2416
-
\??\c:\thnnth.exec:\thnnth.exe74⤵PID:2172
-
\??\c:\e68848.exec:\e68848.exe75⤵PID:2192
-
\??\c:\48006.exec:\48006.exe76⤵PID:1504
-
\??\c:\2400666.exec:\2400666.exe77⤵PID:1628
-
\??\c:\jdvdj.exec:\jdvdj.exe78⤵PID:388
-
\??\c:\djpdd.exec:\djpdd.exe79⤵PID:2704
-
\??\c:\m8040.exec:\m8040.exe80⤵PID:2860
-
\??\c:\o848262.exec:\o848262.exe81⤵PID:2844
-
\??\c:\pdjjj.exec:\pdjjj.exe82⤵PID:2840
-
\??\c:\6600406.exec:\6600406.exe83⤵PID:2012
-
\??\c:\dvddv.exec:\dvddv.exe84⤵PID:2636
-
\??\c:\9hhnnh.exec:\9hhnnh.exe85⤵PID:2728
-
\??\c:\vvvdp.exec:\vvvdp.exe86⤵PID:2812
-
\??\c:\a0646.exec:\a0646.exe87⤵PID:1656
-
\??\c:\1tbtnh.exec:\1tbtnh.exe88⤵PID:2664
-
\??\c:\6422284.exec:\6422284.exe89⤵PID:2256
-
\??\c:\82404.exec:\82404.exe90⤵PID:2260
-
\??\c:\20662.exec:\20662.exe91⤵PID:1404
-
\??\c:\u026660.exec:\u026660.exe92⤵PID:1624
-
\??\c:\q06244.exec:\q06244.exe93⤵PID:2920
-
\??\c:\lffrrll.exec:\lffrrll.exe94⤵PID:2968
-
\??\c:\04280.exec:\04280.exe95⤵PID:792
-
\??\c:\bnbtbh.exec:\bnbtbh.exe96⤵PID:1920
-
\??\c:\7rfllxx.exec:\7rfllxx.exe97⤵PID:1876
-
\??\c:\7ppvv.exec:\7ppvv.exe98⤵PID:1668
-
\??\c:\lfrlfff.exec:\lfrlfff.exe99⤵PID:1712
-
\??\c:\u466806.exec:\u466806.exe100⤵PID:1440
-
\??\c:\6468822.exec:\6468822.exe101⤵PID:2948
-
\??\c:\flrxxrx.exec:\flrxxrx.exe102⤵PID:2984
-
\??\c:\pddpp.exec:\pddpp.exe103⤵PID:2964
-
\??\c:\i688484.exec:\i688484.exe104⤵PID:1704
-
\??\c:\4868686.exec:\4868686.exe105⤵PID:2156
-
\??\c:\frfllff.exec:\frfllff.exe106⤵PID:2992
-
\??\c:\frfrlrx.exec:\frfrlrx.exe107⤵PID:1752
-
\??\c:\1bhbbt.exec:\1bhbbt.exe108⤵PID:1152
-
\??\c:\pdjpp.exec:\pdjpp.exe109⤵PID:1604
-
\??\c:\k02228.exec:\k02228.exe110⤵PID:828
-
\??\c:\4240668.exec:\4240668.exe111⤵PID:1488
-
\??\c:\dvjvd.exec:\dvjvd.exe112⤵PID:1120
-
\??\c:\1rfxlrf.exec:\1rfxlrf.exe113⤵PID:684
-
\??\c:\20806.exec:\20806.exe114⤵PID:1664
-
\??\c:\dvjvd.exec:\dvjvd.exe115⤵PID:1948
-
\??\c:\3btthh.exec:\3btthh.exe116⤵PID:1652
-
\??\c:\5hnhht.exec:\5hnhht.exe117⤵PID:1724
-
\??\c:\5lrlfff.exec:\5lrlfff.exe118⤵PID:2412
-
\??\c:\m8068.exec:\m8068.exe119⤵PID:320
-
\??\c:\lfrxlfr.exec:\lfrxlfr.exe120⤵PID:2284
-
\??\c:\9nnthh.exec:\9nnthh.exe121⤵PID:2168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-