Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 00:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
97edfb0b7d56f30679dcd1f6f7f51c84aebe5b03a77f3f5a3dfb1cc23150cf97.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
97edfb0b7d56f30679dcd1f6f7f51c84aebe5b03a77f3f5a3dfb1cc23150cf97.exe
-
Size
454KB
-
MD5
06c767e27f659dae548a928352426708
-
SHA1
f4ff5035542d868489d3e206e6b82a53519308e5
-
SHA256
97edfb0b7d56f30679dcd1f6f7f51c84aebe5b03a77f3f5a3dfb1cc23150cf97
-
SHA512
d3f99fa78ce97a2a55bcb568c2577969506f1bb2d7278c6e76a411d8b19e872cde8e2deeeb69acbd6293064de6a85ce63e6f61b1df58fc60135eb4633403dd4a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbem:q7Tc2NYHUrAwfMp3CDm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/3000-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-101-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2664-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-102-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/576-116-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1864-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-139-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/792-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-157-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2900-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-195-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1588-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-214-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2948-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-303-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2092-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1212-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-648-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1184-733-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1184-735-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2684-1111-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3060 nnhhnt.exe 2524 dddpd.exe 2676 7rllxfl.exe 1852 bbbtnt.exe 2784 flfxlxl.exe 2716 7nhnbh.exe 2216 tntbnt.exe 2864 fxlllfl.exe 2704 bbbnht.exe 2664 ffflxfr.exe 2320 pdvvv.exe 576 rrrflrl.exe 1864 5jdjd.exe 2652 fllfxfr.exe 792 vpjvp.exe 1592 djjpv.exe 2888 1lflrrx.exe 2900 dvpdp.exe 824 vpvdp.exe 2220 7thtbh.exe 2260 jjpdv.exe 1084 lflxflf.exe 1588 lrxlxlf.exe 1548 vddvp.exe 844 5lffrfr.exe 1580 ffxlxfx.exe 2948 tbthth.exe 868 3dvjd.exe 1288 pvpvp.exe 832 nhhnbb.exe 3004 9vjpv.exe 2112 xxrlflx.exe 1512 jvvjv.exe 2092 djjdj.exe 2296 xxrlffr.exe 2700 5tbbhn.exe 2820 1ddjj.exe 2968 vvvjd.exe 2788 9llrfrx.exe 2952 bbttht.exe 2760 ttnbtb.exe 2592 pvpvj.exe 2608 xfxlffx.exe 2624 5bttnt.exe 1720 9hhnth.exe 2680 5vjpv.exe 2580 xrxflrf.exe 1724 lfxlxrr.exe 1620 nbhhhb.exe 1044 ppjpj.exe 620 lllrxfx.exe 1212 1xfrxxr.exe 300 ttntnt.exe 1908 ntntnb.exe 1500 dvdvd.exe 2924 1xrxlrf.exe 1184 hnbnbh.exe 2172 1nhtbh.exe 2276 1jjpd.exe 1392 5lfxffr.exe 600 fxrfrrf.exe 2984 tnhthb.exe 1300 1vjvj.exe 2268 pjvvd.exe -
resource yara_rule behavioral1/memory/3000-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/792-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-245-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2948-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-508-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1732-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-848-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-910-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-941-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-1009-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-1095-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-1160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-1305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-1330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-1343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-1356-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 3060 3000 97edfb0b7d56f30679dcd1f6f7f51c84aebe5b03a77f3f5a3dfb1cc23150cf97.exe 30 PID 3000 wrote to memory of 3060 3000 97edfb0b7d56f30679dcd1f6f7f51c84aebe5b03a77f3f5a3dfb1cc23150cf97.exe 30 PID 3000 wrote to memory of 3060 3000 97edfb0b7d56f30679dcd1f6f7f51c84aebe5b03a77f3f5a3dfb1cc23150cf97.exe 30 PID 3000 wrote to memory of 3060 3000 97edfb0b7d56f30679dcd1f6f7f51c84aebe5b03a77f3f5a3dfb1cc23150cf97.exe 30 PID 3060 wrote to memory of 2524 3060 nnhhnt.exe 31 PID 3060 wrote to memory of 2524 3060 nnhhnt.exe 31 PID 3060 wrote to memory of 2524 3060 nnhhnt.exe 31 PID 3060 wrote to memory of 2524 3060 nnhhnt.exe 31 PID 2524 wrote to memory of 2676 2524 dddpd.exe 32 PID 2524 wrote to memory of 2676 2524 dddpd.exe 32 PID 2524 wrote to memory of 2676 2524 dddpd.exe 32 PID 2524 wrote to memory of 2676 2524 dddpd.exe 32 PID 2676 wrote to memory of 1852 2676 7rllxfl.exe 33 PID 2676 wrote to memory of 1852 2676 7rllxfl.exe 33 PID 2676 wrote to memory of 1852 2676 7rllxfl.exe 33 PID 2676 wrote to memory of 1852 2676 7rllxfl.exe 33 PID 1852 wrote to memory of 2784 1852 bbbtnt.exe 34 PID 1852 wrote to memory of 2784 1852 bbbtnt.exe 34 PID 1852 wrote to memory of 2784 1852 bbbtnt.exe 34 PID 1852 wrote to memory of 2784 1852 bbbtnt.exe 34 PID 2784 wrote to memory of 2716 2784 flfxlxl.exe 35 PID 2784 wrote to memory of 2716 2784 flfxlxl.exe 35 PID 2784 wrote to memory of 2716 2784 flfxlxl.exe 35 PID 2784 wrote to memory of 2716 2784 flfxlxl.exe 35 PID 2716 wrote to memory of 2216 2716 7nhnbh.exe 36 PID 2716 wrote to memory of 2216 2716 7nhnbh.exe 36 PID 2716 wrote to memory of 2216 2716 7nhnbh.exe 36 PID 2716 wrote to memory of 2216 2716 7nhnbh.exe 36 PID 2216 wrote to memory of 2864 2216 tntbnt.exe 37 PID 2216 wrote to memory of 2864 2216 tntbnt.exe 37 PID 2216 wrote to memory of 2864 2216 tntbnt.exe 37 PID 2216 wrote to memory of 2864 2216 tntbnt.exe 37 PID 2864 wrote to memory of 2704 2864 fxlllfl.exe 38 PID 2864 wrote to memory of 2704 2864 fxlllfl.exe 38 PID 2864 wrote to memory of 2704 2864 fxlllfl.exe 38 PID 2864 wrote to memory of 2704 2864 fxlllfl.exe 38 PID 2704 wrote to memory of 2664 2704 bbbnht.exe 39 PID 2704 wrote to memory of 2664 2704 bbbnht.exe 39 PID 2704 wrote to memory of 2664 2704 bbbnht.exe 39 PID 2704 wrote to memory of 2664 2704 bbbnht.exe 39 PID 2664 wrote to memory of 2320 2664 ffflxfr.exe 40 PID 2664 wrote to memory of 2320 2664 ffflxfr.exe 40 PID 2664 wrote to memory of 2320 2664 ffflxfr.exe 40 PID 2664 wrote to memory of 2320 2664 ffflxfr.exe 40 PID 2320 wrote to memory of 576 2320 pdvvv.exe 41 PID 2320 wrote to memory of 576 2320 pdvvv.exe 41 PID 2320 wrote to memory of 576 2320 pdvvv.exe 41 PID 2320 wrote to memory of 576 2320 pdvvv.exe 41 PID 576 wrote to memory of 1864 576 rrrflrl.exe 42 PID 576 wrote to memory of 1864 576 rrrflrl.exe 42 PID 576 wrote to memory of 1864 576 rrrflrl.exe 42 PID 576 wrote to memory of 1864 576 rrrflrl.exe 42 PID 1864 wrote to memory of 2652 1864 5jdjd.exe 43 PID 1864 wrote to memory of 2652 1864 5jdjd.exe 43 PID 1864 wrote to memory of 2652 1864 5jdjd.exe 43 PID 1864 wrote to memory of 2652 1864 5jdjd.exe 43 PID 2652 wrote to memory of 792 2652 fllfxfr.exe 44 PID 2652 wrote to memory of 792 2652 fllfxfr.exe 44 PID 2652 wrote to memory of 792 2652 fllfxfr.exe 44 PID 2652 wrote to memory of 792 2652 fllfxfr.exe 44 PID 792 wrote to memory of 1592 792 vpjvp.exe 45 PID 792 wrote to memory of 1592 792 vpjvp.exe 45 PID 792 wrote to memory of 1592 792 vpjvp.exe 45 PID 792 wrote to memory of 1592 792 vpjvp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\97edfb0b7d56f30679dcd1f6f7f51c84aebe5b03a77f3f5a3dfb1cc23150cf97.exe"C:\Users\Admin\AppData\Local\Temp\97edfb0b7d56f30679dcd1f6f7f51c84aebe5b03a77f3f5a3dfb1cc23150cf97.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\nnhhnt.exec:\nnhhnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\dddpd.exec:\dddpd.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\7rllxfl.exec:\7rllxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\bbbtnt.exec:\bbbtnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\flfxlxl.exec:\flfxlxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\7nhnbh.exec:\7nhnbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\tntbnt.exec:\tntbnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\fxlllfl.exec:\fxlllfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\bbbnht.exec:\bbbnht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\ffflxfr.exec:\ffflxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\pdvvv.exec:\pdvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\rrrflrl.exec:\rrrflrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\5jdjd.exec:\5jdjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\fllfxfr.exec:\fllfxfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\vpjvp.exec:\vpjvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\djjpv.exec:\djjpv.exe17⤵
- Executes dropped EXE
PID:1592 -
\??\c:\1lflrrx.exec:\1lflrrx.exe18⤵
- Executes dropped EXE
PID:2888 -
\??\c:\dvpdp.exec:\dvpdp.exe19⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vpvdp.exec:\vpvdp.exe20⤵
- Executes dropped EXE
PID:824 -
\??\c:\7thtbh.exec:\7thtbh.exe21⤵
- Executes dropped EXE
PID:2220 -
\??\c:\jjpdv.exec:\jjpdv.exe22⤵
- Executes dropped EXE
PID:2260 -
\??\c:\lflxflf.exec:\lflxflf.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1084 -
\??\c:\lrxlxlf.exec:\lrxlxlf.exe24⤵
- Executes dropped EXE
PID:1588 -
\??\c:\vddvp.exec:\vddvp.exe25⤵
- Executes dropped EXE
PID:1548 -
\??\c:\5lffrfr.exec:\5lffrfr.exe26⤵
- Executes dropped EXE
PID:844 -
\??\c:\ffxlxfx.exec:\ffxlxfx.exe27⤵
- Executes dropped EXE
PID:1580 -
\??\c:\tbthth.exec:\tbthth.exe28⤵
- Executes dropped EXE
PID:2948 -
\??\c:\3dvjd.exec:\3dvjd.exe29⤵
- Executes dropped EXE
PID:868 -
\??\c:\pvpvp.exec:\pvpvp.exe30⤵
- Executes dropped EXE
PID:1288 -
\??\c:\nhhnbb.exec:\nhhnbb.exe31⤵
- Executes dropped EXE
PID:832 -
\??\c:\9vjpv.exec:\9vjpv.exe32⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xxrlflx.exec:\xxrlflx.exe33⤵
- Executes dropped EXE
PID:2112 -
\??\c:\jvvjv.exec:\jvvjv.exe34⤵
- Executes dropped EXE
PID:1512 -
\??\c:\djjdj.exec:\djjdj.exe35⤵
- Executes dropped EXE
PID:2092 -
\??\c:\xxrlffr.exec:\xxrlffr.exe36⤵
- Executes dropped EXE
PID:2296 -
\??\c:\5tbbhn.exec:\5tbbhn.exe37⤵
- Executes dropped EXE
PID:2700 -
\??\c:\1ddjj.exec:\1ddjj.exe38⤵
- Executes dropped EXE
PID:2820 -
\??\c:\vvvjd.exec:\vvvjd.exe39⤵
- Executes dropped EXE
PID:2968 -
\??\c:\9llrfrx.exec:\9llrfrx.exe40⤵
- Executes dropped EXE
PID:2788 -
\??\c:\bbttht.exec:\bbttht.exe41⤵
- Executes dropped EXE
PID:2952 -
\??\c:\ttnbtb.exec:\ttnbtb.exe42⤵
- Executes dropped EXE
PID:2760 -
\??\c:\pvpvj.exec:\pvpvj.exe43⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xfxlffx.exec:\xfxlffx.exe44⤵
- Executes dropped EXE
PID:2608 -
\??\c:\5bttnt.exec:\5bttnt.exe45⤵
- Executes dropped EXE
PID:2624 -
\??\c:\9hhnth.exec:\9hhnth.exe46⤵
- Executes dropped EXE
PID:1720 -
\??\c:\5vjpv.exec:\5vjpv.exe47⤵
- Executes dropped EXE
PID:2680 -
\??\c:\xrxflrf.exec:\xrxflrf.exe48⤵
- Executes dropped EXE
PID:2580 -
\??\c:\lfxlxrr.exec:\lfxlxrr.exe49⤵
- Executes dropped EXE
PID:1724 -
\??\c:\nbhhhb.exec:\nbhhhb.exe50⤵
- Executes dropped EXE
PID:1620 -
\??\c:\ppjpj.exec:\ppjpj.exe51⤵
- Executes dropped EXE
PID:1044 -
\??\c:\lllrxfx.exec:\lllrxfx.exe52⤵
- Executes dropped EXE
PID:620 -
\??\c:\1xfrxxr.exec:\1xfrxxr.exe53⤵
- Executes dropped EXE
PID:1212 -
\??\c:\ttntnt.exec:\ttntnt.exe54⤵
- Executes dropped EXE
PID:300 -
\??\c:\ntntnb.exec:\ntntnb.exe55⤵
- Executes dropped EXE
PID:1908 -
\??\c:\dvdvd.exec:\dvdvd.exe56⤵
- Executes dropped EXE
PID:1500 -
\??\c:\1xrxlrf.exec:\1xrxlrf.exe57⤵
- Executes dropped EXE
PID:2924 -
\??\c:\hnbnbh.exec:\hnbnbh.exe58⤵
- Executes dropped EXE
PID:1184 -
\??\c:\1nhtbh.exec:\1nhtbh.exe59⤵
- Executes dropped EXE
PID:2172 -
\??\c:\1jjpd.exec:\1jjpd.exe60⤵
- Executes dropped EXE
PID:2276 -
\??\c:\5lfxffr.exec:\5lfxffr.exe61⤵
- Executes dropped EXE
PID:1392 -
\??\c:\fxrfrrf.exec:\fxrfrrf.exe62⤵
- Executes dropped EXE
PID:600 -
\??\c:\tnhthb.exec:\tnhthb.exe63⤵
- Executes dropped EXE
PID:2984 -
\??\c:\1vjvj.exec:\1vjvj.exe64⤵
- Executes dropped EXE
PID:1300 -
\??\c:\pjvvd.exec:\pjvvd.exe65⤵
- Executes dropped EXE
PID:2268 -
\??\c:\rlffllx.exec:\rlffllx.exe66⤵PID:336
-
\??\c:\nttbth.exec:\nttbth.exe67⤵PID:2472
-
\??\c:\hhtbtb.exec:\hhtbtb.exe68⤵PID:2948
-
\??\c:\pjvvj.exec:\pjvvj.exe69⤵PID:2988
-
\??\c:\xxrrxxx.exec:\xxrrxxx.exe70⤵PID:768
-
\??\c:\hhhtnb.exec:\hhhtnb.exe71⤵PID:1568
-
\??\c:\nntbnb.exec:\nntbnb.exe72⤵
- System Location Discovery: System Language Discovery
PID:2104 -
\??\c:\ppjpj.exec:\ppjpj.exe73⤵PID:1732
-
\??\c:\rxfflxx.exec:\rxfflxx.exe74⤵PID:2380
-
\??\c:\bbnbtt.exec:\bbnbtt.exe75⤵PID:2536
-
\??\c:\1btbht.exec:\1btbht.exe76⤵PID:2468
-
\??\c:\ppjvj.exec:\ppjvj.exe77⤵PID:1900
-
\??\c:\lllffll.exec:\lllffll.exe78⤵PID:2672
-
\??\c:\1lfrxrx.exec:\1lfrxrx.exe79⤵PID:2720
-
\??\c:\7hbhtb.exec:\7hbhtb.exe80⤵PID:2796
-
\??\c:\vpvjp.exec:\vpvjp.exe81⤵PID:2828
-
\??\c:\fllrxfr.exec:\fllrxfr.exe82⤵PID:2848
-
\??\c:\xxrflrf.exec:\xxrflrf.exe83⤵PID:2724
-
\??\c:\hhbhtb.exec:\hhbhtb.exe84⤵PID:2920
-
\??\c:\dddjd.exec:\dddjd.exe85⤵PID:2864
-
\??\c:\pjjpv.exec:\pjjpv.exe86⤵PID:2712
-
\??\c:\fffrlrf.exec:\fffrlrf.exe87⤵PID:2300
-
\??\c:\tnhntb.exec:\tnhntb.exe88⤵PID:1668
-
\??\c:\ddpvp.exec:\ddpvp.exe89⤵PID:2660
-
\??\c:\djpdp.exec:\djpdp.exe90⤵PID:1352
-
\??\c:\fffxlrf.exec:\fffxlrf.exe91⤵PID:1992
-
\??\c:\1nntbh.exec:\1nntbh.exe92⤵PID:1948
-
\??\c:\hbthbb.exec:\hbthbb.exe93⤵PID:1780
-
\??\c:\ddppd.exec:\ddppd.exe94⤵PID:236
-
\??\c:\lfxxffr.exec:\lfxxffr.exe95⤵
- System Location Discovery: System Language Discovery
PID:1584 -
\??\c:\xxxlxlx.exec:\xxxlxlx.exe96⤵PID:1740
-
\??\c:\nnntnt.exec:\nnntnt.exe97⤵PID:300
-
\??\c:\vvdpj.exec:\vvdpj.exe98⤵PID:1828
-
\??\c:\vjvpp.exec:\vjvpp.exe99⤵PID:2912
-
\??\c:\lflfllr.exec:\lflfllr.exe100⤵PID:2900
-
\??\c:\3tnnnt.exec:\3tnnnt.exe101⤵PID:1184
-
\??\c:\nhthtb.exec:\nhthtb.exe102⤵PID:2196
-
\??\c:\vdpdj.exec:\vdpdj.exe103⤵PID:1164
-
\??\c:\xxlrflx.exec:\xxlrflx.exe104⤵PID:1392
-
\??\c:\9nhbhh.exec:\9nhbhh.exe105⤵PID:1936
-
\??\c:\tnhtnt.exec:\tnhtnt.exe106⤵PID:1296
-
\??\c:\3jjpd.exec:\3jjpd.exe107⤵PID:2256
-
\??\c:\dvppp.exec:\dvppp.exe108⤵PID:2868
-
\??\c:\rlxlrxf.exec:\rlxlrxf.exe109⤵PID:980
-
\??\c:\hnbbnt.exec:\hnbbnt.exe110⤵
- System Location Discovery: System Language Discovery
PID:2472 -
\??\c:\5jvdp.exec:\5jvdp.exe111⤵PID:2436
-
\??\c:\ddvdp.exec:\ddvdp.exe112⤵PID:2988
-
\??\c:\7frrrxr.exec:\7frrrxr.exe113⤵PID:2204
-
\??\c:\tthhtt.exec:\tthhtt.exe114⤵PID:1524
-
\??\c:\9btbnn.exec:\9btbnn.exe115⤵PID:1968
-
\??\c:\7ppvv.exec:\7ppvv.exe116⤵PID:1944
-
\??\c:\dpjjv.exec:\dpjjv.exe117⤵PID:3000
-
\??\c:\xrrrxfr.exec:\xrrrxfr.exe118⤵PID:2180
-
\??\c:\ntnnbh.exec:\ntnnbh.exe119⤵PID:2192
-
\??\c:\jvvdd.exec:\jvvdd.exe120⤵PID:2844
-
\??\c:\lllxrxl.exec:\lllxrxl.exe121⤵PID:2672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-