Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 01:11
Static task
static1
Behavioral task
behavioral1
Sample
a2f1c78c7a80fb3544cb494fbfd9570ec5a4d61e3c647f4d441502735ffb5ee0.exe
Resource
win7-20240903-en
General
-
Target
a2f1c78c7a80fb3544cb494fbfd9570ec5a4d61e3c647f4d441502735ffb5ee0.exe
-
Size
454KB
-
MD5
ac7af43888ea256b1e1fb543f6dd2c69
-
SHA1
67f01fe07a841d744f2f5c92331988746b109d51
-
SHA256
a2f1c78c7a80fb3544cb494fbfd9570ec5a4d61e3c647f4d441502735ffb5ee0
-
SHA512
ad7e11c7c4ae1b59a8d16d5deff2d201051688c11b10b81e1df39e16efec43d3a698d03137e06c9e9cf85d20fc3666d5d00c52f5897429461b97f7f093f4a165
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetQ:q7Tc2NYHUrAwfMp3CDtQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral1/memory/2952-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1368-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-66-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2884-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-103-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2580-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-139-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1640-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-157-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2728-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-211-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/948-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-276-0x0000000077960000-0x0000000077A7F000-memory.dmp family_blackmoon behavioral1/memory/2692-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-414-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1892-425-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/628-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-460-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/348-467-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1396-488-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/944-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-575-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2660-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-617-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1152-694-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1084-729-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1840-747-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1840-746-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-766-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-785-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2836-861-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-868-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2636-871-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1128-987-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/1128-1005-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/1528-1027-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/872-1034-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2472-1041-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1444-1066-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2684-1087-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/484-1201-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2244-1327-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2800-1370-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2828-1378-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2828-2493-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2952 hhbhhn.exe 3024 hbntnt.exe 2188 3fxxlrx.exe 1368 1tnhnn.exe 2664 ddvdj.exe 2784 1nnthh.exe 2832 rrfrflr.exe 2884 ppjpd.exe 2588 rrxxffr.exe 2580 djvvj.exe 2848 xrffrrf.exe 588 vpjvj.exe 1240 5fflrxr.exe 1640 1tthnt.exe 764 lrlflrl.exe 1672 jjjvp.exe 2724 lllrxfx.exe 1156 7djjd.exe 2728 3rffllr.exe 2140 bbntbh.exe 2064 xfxfrrx.exe 2176 7nbbhh.exe 2292 ddvjd.exe 948 xrxrxff.exe 372 vpdjd.exe 1756 nnhthn.exe 2264 5jvvd.exe 496 3lfxxlf.exe 2040 3lflrxr.exe 2336 tbtbnt.exe 3020 xxxfxll.exe 2248 tntbnt.exe 2156 3hhtnt.exe 2408 ffllllx.exe 2644 bthnnt.exe 2788 nhhhnt.exe 2692 ddvdd.exe 2828 lfrxxxl.exe 2696 9btnhn.exe 2636 3pdjv.exe 868 ppdpv.exe 2548 xrrrfxl.exe 2656 nhbbtb.exe 2596 vddpj.exe 852 pjjpv.exe 2364 xfflrxr.exe 1644 tnnthh.exe 1768 ddpvj.exe 1932 1xxfrxl.exe 1036 5llrflx.exe 1736 5tnnth.exe 1892 dvpvj.exe 628 fxrxrfl.exe 2876 3nntbb.exe 2732 djdjv.exe 2728 jvppd.exe 2416 7fflrrr.exe 348 tnhnth.exe 2928 7jjjp.exe 2224 jddpj.exe 1396 7httbn.exe 944 9nbbhn.exe 2000 ppdjv.exe 2056 rxrlxfx.exe -
resource yara_rule behavioral1/memory/2952-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-103-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2580-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-211-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/948-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-276-0x0000000077960000-0x0000000077A7F000-memory.dmp upx behavioral1/memory/2692-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-414-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1892-425-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/628-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-617-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1152-694-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1084-729-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1840-747-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1840-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-785-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2408-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-861-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-868-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2636-871-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/992-1013-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1528-1027-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/872-1034-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2472-1041-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1444-1066-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/2356-1182-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/484-1201-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/948-1257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-1327-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2680-1346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-1370-0x0000000000320000-0x000000000034A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflrxl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1716 wrote to memory of 2952 1716 a2f1c78c7a80fb3544cb494fbfd9570ec5a4d61e3c647f4d441502735ffb5ee0.exe 31 PID 1716 wrote to memory of 2952 1716 a2f1c78c7a80fb3544cb494fbfd9570ec5a4d61e3c647f4d441502735ffb5ee0.exe 31 PID 1716 wrote to memory of 2952 1716 a2f1c78c7a80fb3544cb494fbfd9570ec5a4d61e3c647f4d441502735ffb5ee0.exe 31 PID 1716 wrote to memory of 2952 1716 a2f1c78c7a80fb3544cb494fbfd9570ec5a4d61e3c647f4d441502735ffb5ee0.exe 31 PID 2952 wrote to memory of 3024 2952 hhbhhn.exe 32 PID 2952 wrote to memory of 3024 2952 hhbhhn.exe 32 PID 2952 wrote to memory of 3024 2952 hhbhhn.exe 32 PID 2952 wrote to memory of 3024 2952 hhbhhn.exe 32 PID 3024 wrote to memory of 2188 3024 hbntnt.exe 33 PID 3024 wrote to memory of 2188 3024 hbntnt.exe 33 PID 3024 wrote to memory of 2188 3024 hbntnt.exe 33 PID 3024 wrote to memory of 2188 3024 hbntnt.exe 33 PID 2188 wrote to memory of 1368 2188 3fxxlrx.exe 34 PID 2188 wrote to memory of 1368 2188 3fxxlrx.exe 34 PID 2188 wrote to memory of 1368 2188 3fxxlrx.exe 34 PID 2188 wrote to memory of 1368 2188 3fxxlrx.exe 34 PID 1368 wrote to memory of 2664 1368 1tnhnn.exe 35 PID 1368 wrote to memory of 2664 1368 1tnhnn.exe 35 PID 1368 wrote to memory of 2664 1368 1tnhnn.exe 35 PID 1368 wrote to memory of 2664 1368 1tnhnn.exe 35 PID 2664 wrote to memory of 2784 2664 ddvdj.exe 36 PID 2664 wrote to memory of 2784 2664 ddvdj.exe 36 PID 2664 wrote to memory of 2784 2664 ddvdj.exe 36 PID 2664 wrote to memory of 2784 2664 ddvdj.exe 36 PID 2784 wrote to memory of 2832 2784 1nnthh.exe 37 PID 2784 wrote to memory of 2832 2784 1nnthh.exe 37 PID 2784 wrote to memory of 2832 2784 1nnthh.exe 37 PID 2784 wrote to memory of 2832 2784 1nnthh.exe 37 PID 2832 wrote to memory of 2884 2832 rrfrflr.exe 38 PID 2832 wrote to memory of 2884 2832 rrfrflr.exe 38 PID 2832 wrote to memory of 2884 2832 rrfrflr.exe 38 PID 2832 wrote to memory of 2884 2832 rrfrflr.exe 38 PID 2884 wrote to memory of 2588 2884 ppjpd.exe 39 PID 2884 wrote to memory of 2588 2884 ppjpd.exe 39 PID 2884 wrote to memory of 2588 2884 ppjpd.exe 39 PID 2884 wrote to memory of 2588 2884 ppjpd.exe 39 PID 2588 wrote to memory of 2580 2588 rrxxffr.exe 40 PID 2588 wrote to memory of 2580 2588 rrxxffr.exe 40 PID 2588 wrote to memory of 2580 2588 rrxxffr.exe 40 PID 2588 wrote to memory of 2580 2588 rrxxffr.exe 40 PID 2580 wrote to memory of 2848 2580 djvvj.exe 41 PID 2580 wrote to memory of 2848 2580 djvvj.exe 41 PID 2580 wrote to memory of 2848 2580 djvvj.exe 41 PID 2580 wrote to memory of 2848 2580 djvvj.exe 41 PID 2848 wrote to memory of 588 2848 xrffrrf.exe 42 PID 2848 wrote to memory of 588 2848 xrffrrf.exe 42 PID 2848 wrote to memory of 588 2848 xrffrrf.exe 42 PID 2848 wrote to memory of 588 2848 xrffrrf.exe 42 PID 588 wrote to memory of 1240 588 vpjvj.exe 43 PID 588 wrote to memory of 1240 588 vpjvj.exe 43 PID 588 wrote to memory of 1240 588 vpjvj.exe 43 PID 588 wrote to memory of 1240 588 vpjvj.exe 43 PID 1240 wrote to memory of 1640 1240 5fflrxr.exe 44 PID 1240 wrote to memory of 1640 1240 5fflrxr.exe 44 PID 1240 wrote to memory of 1640 1240 5fflrxr.exe 44 PID 1240 wrote to memory of 1640 1240 5fflrxr.exe 44 PID 1640 wrote to memory of 764 1640 1tthnt.exe 45 PID 1640 wrote to memory of 764 1640 1tthnt.exe 45 PID 1640 wrote to memory of 764 1640 1tthnt.exe 45 PID 1640 wrote to memory of 764 1640 1tthnt.exe 45 PID 764 wrote to memory of 1672 764 lrlflrl.exe 46 PID 764 wrote to memory of 1672 764 lrlflrl.exe 46 PID 764 wrote to memory of 1672 764 lrlflrl.exe 46 PID 764 wrote to memory of 1672 764 lrlflrl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2f1c78c7a80fb3544cb494fbfd9570ec5a4d61e3c647f4d441502735ffb5ee0.exe"C:\Users\Admin\AppData\Local\Temp\a2f1c78c7a80fb3544cb494fbfd9570ec5a4d61e3c647f4d441502735ffb5ee0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\hhbhhn.exec:\hhbhhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\hbntnt.exec:\hbntnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\3fxxlrx.exec:\3fxxlrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\1tnhnn.exec:\1tnhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\ddvdj.exec:\ddvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\1nnthh.exec:\1nnthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\rrfrflr.exec:\rrfrflr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\ppjpd.exec:\ppjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\rrxxffr.exec:\rrxxffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\djvvj.exec:\djvvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\xrffrrf.exec:\xrffrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\vpjvj.exec:\vpjvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\5fflrxr.exec:\5fflrxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\1tthnt.exec:\1tthnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\lrlflrl.exec:\lrlflrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\jjjvp.exec:\jjjvp.exe17⤵
- Executes dropped EXE
PID:1672 -
\??\c:\lllrxfx.exec:\lllrxfx.exe18⤵
- Executes dropped EXE
PID:2724 -
\??\c:\7djjd.exec:\7djjd.exe19⤵
- Executes dropped EXE
PID:1156 -
\??\c:\3rffllr.exec:\3rffllr.exe20⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bbntbh.exec:\bbntbh.exe21⤵
- Executes dropped EXE
PID:2140 -
\??\c:\xfxfrrx.exec:\xfxfrrx.exe22⤵
- Executes dropped EXE
PID:2064 -
\??\c:\7nbbhh.exec:\7nbbhh.exe23⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ddvjd.exec:\ddvjd.exe24⤵
- Executes dropped EXE
PID:2292 -
\??\c:\xrxrxff.exec:\xrxrxff.exe25⤵
- Executes dropped EXE
PID:948 -
\??\c:\vpdjd.exec:\vpdjd.exe26⤵
- Executes dropped EXE
PID:372 -
\??\c:\nnhthn.exec:\nnhthn.exe27⤵
- Executes dropped EXE
PID:1756 -
\??\c:\5jvvd.exec:\5jvvd.exe28⤵
- Executes dropped EXE
PID:2264 -
\??\c:\3lfxxlf.exec:\3lfxxlf.exe29⤵
- Executes dropped EXE
PID:496 -
\??\c:\3lflrxr.exec:\3lflrxr.exe30⤵
- Executes dropped EXE
PID:2040 -
\??\c:\tbtbnt.exec:\tbtbnt.exe31⤵
- Executes dropped EXE
PID:2336 -
\??\c:\xrlxffr.exec:\xrlxffr.exe32⤵PID:1588
-
\??\c:\xxxfxll.exec:\xxxfxll.exe33⤵
- Executes dropped EXE
PID:3020 -
\??\c:\tntbnt.exec:\tntbnt.exe34⤵
- Executes dropped EXE
PID:2248 -
\??\c:\3hhtnt.exec:\3hhtnt.exe35⤵
- Executes dropped EXE
PID:2156 -
\??\c:\ffllllx.exec:\ffllllx.exe36⤵
- Executes dropped EXE
PID:2408 -
\??\c:\bthnnt.exec:\bthnnt.exe37⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nhhhnt.exec:\nhhhnt.exe38⤵
- Executes dropped EXE
PID:2788 -
\??\c:\ddvdd.exec:\ddvdd.exe39⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lfrxxxl.exec:\lfrxxxl.exe40⤵
- Executes dropped EXE
PID:2828 -
\??\c:\9btnhn.exec:\9btnhn.exe41⤵
- Executes dropped EXE
PID:2696 -
\??\c:\3pdjv.exec:\3pdjv.exe42⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ppdpv.exec:\ppdpv.exe43⤵
- Executes dropped EXE
PID:868 -
\??\c:\xrrrfxl.exec:\xrrrfxl.exe44⤵
- Executes dropped EXE
PID:2548 -
\??\c:\nhbbtb.exec:\nhbbtb.exe45⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vddpj.exec:\vddpj.exe46⤵
- Executes dropped EXE
PID:2596 -
\??\c:\pjjpv.exec:\pjjpv.exe47⤵
- Executes dropped EXE
PID:852 -
\??\c:\xfflrxr.exec:\xfflrxr.exe48⤵
- Executes dropped EXE
PID:2364 -
\??\c:\tnnthh.exec:\tnnthh.exe49⤵
- Executes dropped EXE
PID:1644 -
\??\c:\ddpvj.exec:\ddpvj.exe50⤵
- Executes dropped EXE
PID:1768 -
\??\c:\1xxfrxl.exec:\1xxfrxl.exe51⤵
- Executes dropped EXE
PID:1932 -
\??\c:\5llrflx.exec:\5llrflx.exe52⤵
- Executes dropped EXE
PID:1036 -
\??\c:\5tnnth.exec:\5tnnth.exe53⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dvpvj.exec:\dvpvj.exe54⤵
- Executes dropped EXE
PID:1892 -
\??\c:\fxrxrfl.exec:\fxrxrfl.exe55⤵
- Executes dropped EXE
PID:628 -
\??\c:\3nntbb.exec:\3nntbb.exe56⤵
- Executes dropped EXE
PID:2876 -
\??\c:\djdjv.exec:\djdjv.exe57⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jvppd.exec:\jvppd.exe58⤵
- Executes dropped EXE
PID:2728 -
\??\c:\7fflrrr.exec:\7fflrrr.exe59⤵
- Executes dropped EXE
PID:2416 -
\??\c:\tnhnth.exec:\tnhnth.exe60⤵
- Executes dropped EXE
PID:348 -
\??\c:\7jjjp.exec:\7jjjp.exe61⤵
- Executes dropped EXE
PID:2928 -
\??\c:\jddpj.exec:\jddpj.exe62⤵
- Executes dropped EXE
PID:2224 -
\??\c:\7httbn.exec:\7httbn.exe63⤵
- Executes dropped EXE
PID:1396 -
\??\c:\9nbbhn.exec:\9nbbhn.exe64⤵
- Executes dropped EXE
PID:944 -
\??\c:\ppdjv.exec:\ppdjv.exe65⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rxrlxfx.exec:\rxrlxfx.exe66⤵
- Executes dropped EXE
PID:2056 -
\??\c:\3xflxxf.exec:\3xflxxf.exe67⤵PID:2480
-
\??\c:\hbtbnt.exec:\hbtbnt.exe68⤵PID:2348
-
\??\c:\jdvdp.exec:\jdvdp.exe69⤵PID:888
-
\??\c:\7xrrxfr.exec:\7xrrxfr.exe70⤵PID:1044
-
\??\c:\5flrfxf.exec:\5flrfxf.exe71⤵PID:1496
-
\??\c:\tnhnnn.exec:\tnhnnn.exe72⤵PID:3012
-
\??\c:\ddpdp.exec:\ddpdp.exe73⤵PID:2936
-
\??\c:\9jvpp.exec:\9jvpp.exe74⤵PID:2324
-
\??\c:\7xlrxxl.exec:\7xlrxxl.exe75⤵PID:2160
-
\??\c:\hbtbnn.exec:\hbtbnn.exe76⤵PID:2208
-
\??\c:\5vppv.exec:\5vppv.exe77⤵PID:3060
-
\??\c:\dvjjp.exec:\dvjjp.exe78⤵PID:1368
-
\??\c:\rlflrxl.exec:\rlflrxl.exe79⤵PID:2792
-
\??\c:\bnbbhb.exec:\bnbbhb.exe80⤵PID:2660
-
\??\c:\1bbthn.exec:\1bbthn.exe81⤵PID:2772
-
\??\c:\ppjvj.exec:\ppjvj.exe82⤵PID:2560
-
\??\c:\ffxfxfl.exec:\ffxfxfl.exe83⤵PID:2708
-
\??\c:\nbhhnt.exec:\nbhhnt.exe84⤵PID:2532
-
\??\c:\7thntt.exec:\7thntt.exe85⤵PID:2608
-
\??\c:\vpjpv.exec:\vpjpv.exe86⤵PID:660
-
\??\c:\xxrrlrl.exec:\xxrrlrl.exe87⤵PID:1316
-
\??\c:\5nhttb.exec:\5nhttb.exe88⤵PID:2356
-
\??\c:\7hbhtt.exec:\7hbhtt.exe89⤵PID:588
-
\??\c:\1pvdv.exec:\1pvdv.exe90⤵PID:792
-
\??\c:\frlrxfx.exec:\frlrxfx.exe91⤵PID:2068
-
\??\c:\1nbhtn.exec:\1nbhtn.exe92⤵PID:540
-
\??\c:\pjvdv.exec:\pjvdv.exe93⤵PID:1760
-
\??\c:\jdddj.exec:\jdddj.exe94⤵PID:1284
-
\??\c:\frxrxxx.exec:\frxrxxx.exe95⤵PID:2716
-
\??\c:\nbnnbh.exec:\nbnnbh.exe96⤵PID:1152
-
\??\c:\ppjpd.exec:\ppjpd.exe97⤵PID:1384
-
\??\c:\rrfrxfr.exec:\rrfrxfr.exe98⤵PID:2976
-
\??\c:\lfflrxl.exec:\lfflrxl.exe99⤵
- System Location Discovery: System Language Discovery
PID:2180 -
\??\c:\ttthtn.exec:\ttthtn.exe100⤵PID:1668
-
\??\c:\vdvjj.exec:\vdvjj.exe101⤵PID:2064
-
\??\c:\5xlfxfx.exec:\5xlfxfx.exe102⤵PID:1084
-
\??\c:\xxrfllx.exec:\xxrfllx.exe103⤵PID:2292
-
\??\c:\3hhtbb.exec:\3hhtbb.exe104⤵PID:1840
-
\??\c:\ddvvd.exec:\ddvvd.exe105⤵PID:1048
-
\??\c:\rllxlxr.exec:\rllxlxr.exe106⤵PID:2124
-
\??\c:\nhtbhn.exec:\nhtbhn.exe107⤵PID:1756
-
\??\c:\7vddd.exec:\7vddd.exe108⤵PID:2056
-
\??\c:\1xrfrxl.exec:\1xrfrxl.exe109⤵PID:2264
-
\??\c:\7bbbnn.exec:\7bbbnn.exe110⤵PID:1492
-
\??\c:\hthhbb.exec:\hthhbb.exe111⤵PID:1632
-
\??\c:\jppvj.exec:\jppvj.exe112⤵PID:1552
-
\??\c:\1ffllrf.exec:\1ffllrf.exe113⤵PID:1696
-
\??\c:\tnbbht.exec:\tnbbht.exe114⤵PID:1580
-
\??\c:\9nhntb.exec:\9nhntb.exe115⤵PID:2892
-
\??\c:\dpdjv.exec:\dpdjv.exe116⤵PID:3064
-
\??\c:\fxxxflx.exec:\fxxxflx.exe117⤵PID:1292
-
\??\c:\lflrrrx.exec:\lflrrrx.exe118⤵PID:2408
-
\??\c:\bbntbb.exec:\bbntbb.exe119⤵PID:2644
-
\??\c:\dvjjp.exec:\dvjjp.exe120⤵PID:2840
-
\??\c:\pjdjp.exec:\pjdjp.exe121⤵PID:2784
-
\??\c:\llllrrx.exec:\llllrrx.exe122⤵PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-