Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 03:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
840b0a107965ba3c68fd33711caf57adf49d3da2cd3b503f79dd93bc711f0458N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
840b0a107965ba3c68fd33711caf57adf49d3da2cd3b503f79dd93bc711f0458N.exe
-
Size
454KB
-
MD5
c3a2b04188e0793c1cf40867941cd950
-
SHA1
aa47dd587e22ceb03a508bb591e859eee47a2d9a
-
SHA256
840b0a107965ba3c68fd33711caf57adf49d3da2cd3b503f79dd93bc711f0458
-
SHA512
c6c06beb0e0bee95d202743b7d57778cabad458604be8f7294455adece474550d68da57985903d954f18779625349001503189f04853fd921e6954e096dfe8a7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetP:q7Tc2NYHUrAwfMp3CDtP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/2936-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-65-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2816-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-133-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2008-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-167-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/3020-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-190-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2972-208-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1068-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-222-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/980-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1360-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1428-300-0x00000000770E0000-0x00000000771FF000-memory.dmp family_blackmoon behavioral1/memory/1428-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-336-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2868-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-404-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1200-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-495-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2784-514-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1696-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-553-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1060-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-586-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2792-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-639-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/272-678-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-806-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-832-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/532-876-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1504-982-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1504-985-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1876-1000-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2972-1037-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2996 nnbbbb.exe 2156 ffrrflr.exe 768 pjvjp.exe 2696 rxxrxrr.exe 2808 htnbnb.exe 2208 dddjp.exe 2332 1pjjj.exe 2628 lxxrrfx.exe 2816 djdpd.exe 2676 ffxrllf.exe 2268 1ppjp.exe 1624 9rrxlrr.exe 844 vppdp.exe 2008 xxrxlrf.exe 1072 btbtbb.exe 616 nbbnht.exe 3020 5ppjv.exe 2324 fxrffff.exe 2472 dvppv.exe 2188 fxllrxr.exe 2972 jjjpj.exe 1068 xxffrlf.exe 980 5vpvv.exe 1076 xrfxflf.exe 1704 vpjjv.exe 1360 pdppv.exe 2192 nnbnbh.exe 2576 1ppvd.exe 2420 nhbbhb.exe 2124 rrrxlrx.exe 2948 9bthtb.exe 1428 rrfllrx.exe 3064 ppjvd.exe 2320 hbnnbb.exe 2156 ddvpv.exe 2444 xrflllf.exe 2744 xffrlfx.exe 2868 htntnt.exe 2820 pdddp.exe 2464 5rlllrf.exe 2764 bbthtb.exe 2408 1jvdd.exe 2916 ddjvp.exe 2724 xrlrrrf.exe 3044 3btbth.exe 1048 5pjvp.exe 760 jddjd.exe 1636 xlfxxrf.exe 836 7tnhtb.exe 2848 djdvd.exe 1200 rrlrflx.exe 1876 bbhhnh.exe 2704 hhhnbh.exe 3016 jdpvd.exe 2468 lfxrxff.exe 2476 nhnntt.exe 2324 tttntb.exe 2456 jvpjp.exe 284 ffxfxfr.exe 2784 rlxlrrl.exe 1280 tnbhnt.exe 1676 pjddv.exe 980 1xfrllx.exe 1708 frlrrrl.exe -
resource yara_rule behavioral1/memory/2936-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-300-0x00000000770E0000-0x00000000771FF000-memory.dmp upx behavioral1/memory/1428-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-404-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1200-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-488-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1708-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-553-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1060-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-586-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2792-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-639-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/272-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-786-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1756-806-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-876-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1504-982-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1876-1000-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1280-1044-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xfrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrllfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2996 2936 840b0a107965ba3c68fd33711caf57adf49d3da2cd3b503f79dd93bc711f0458N.exe 30 PID 2936 wrote to memory of 2996 2936 840b0a107965ba3c68fd33711caf57adf49d3da2cd3b503f79dd93bc711f0458N.exe 30 PID 2936 wrote to memory of 2996 2936 840b0a107965ba3c68fd33711caf57adf49d3da2cd3b503f79dd93bc711f0458N.exe 30 PID 2936 wrote to memory of 2996 2936 840b0a107965ba3c68fd33711caf57adf49d3da2cd3b503f79dd93bc711f0458N.exe 30 PID 2996 wrote to memory of 2156 2996 nnbbbb.exe 31 PID 2996 wrote to memory of 2156 2996 nnbbbb.exe 31 PID 2996 wrote to memory of 2156 2996 nnbbbb.exe 31 PID 2996 wrote to memory of 2156 2996 nnbbbb.exe 31 PID 2156 wrote to memory of 768 2156 ffrrflr.exe 32 PID 2156 wrote to memory of 768 2156 ffrrflr.exe 32 PID 2156 wrote to memory of 768 2156 ffrrflr.exe 32 PID 2156 wrote to memory of 768 2156 ffrrflr.exe 32 PID 768 wrote to memory of 2696 768 pjvjp.exe 33 PID 768 wrote to memory of 2696 768 pjvjp.exe 33 PID 768 wrote to memory of 2696 768 pjvjp.exe 33 PID 768 wrote to memory of 2696 768 pjvjp.exe 33 PID 2696 wrote to memory of 2808 2696 rxxrxrr.exe 34 PID 2696 wrote to memory of 2808 2696 rxxrxrr.exe 34 PID 2696 wrote to memory of 2808 2696 rxxrxrr.exe 34 PID 2696 wrote to memory of 2808 2696 rxxrxrr.exe 34 PID 2808 wrote to memory of 2208 2808 htnbnb.exe 35 PID 2808 wrote to memory of 2208 2808 htnbnb.exe 35 PID 2808 wrote to memory of 2208 2808 htnbnb.exe 35 PID 2808 wrote to memory of 2208 2808 htnbnb.exe 35 PID 2208 wrote to memory of 2332 2208 dddjp.exe 36 PID 2208 wrote to memory of 2332 2208 dddjp.exe 36 PID 2208 wrote to memory of 2332 2208 dddjp.exe 36 PID 2208 wrote to memory of 2332 2208 dddjp.exe 36 PID 2332 wrote to memory of 2628 2332 1pjjj.exe 37 PID 2332 wrote to memory of 2628 2332 1pjjj.exe 37 PID 2332 wrote to memory of 2628 2332 1pjjj.exe 37 PID 2332 wrote to memory of 2628 2332 1pjjj.exe 37 PID 2628 wrote to memory of 2816 2628 lxxrrfx.exe 38 PID 2628 wrote to memory of 2816 2628 lxxrrfx.exe 38 PID 2628 wrote to memory of 2816 2628 lxxrrfx.exe 38 PID 2628 wrote to memory of 2816 2628 lxxrrfx.exe 38 PID 2816 wrote to memory of 2676 2816 djdpd.exe 39 PID 2816 wrote to memory of 2676 2816 djdpd.exe 39 PID 2816 wrote to memory of 2676 2816 djdpd.exe 39 PID 2816 wrote to memory of 2676 2816 djdpd.exe 39 PID 2676 wrote to memory of 2268 2676 ffxrllf.exe 40 PID 2676 wrote to memory of 2268 2676 ffxrllf.exe 40 PID 2676 wrote to memory of 2268 2676 ffxrllf.exe 40 PID 2676 wrote to memory of 2268 2676 ffxrllf.exe 40 PID 2268 wrote to memory of 1624 2268 1ppjp.exe 41 PID 2268 wrote to memory of 1624 2268 1ppjp.exe 41 PID 2268 wrote to memory of 1624 2268 1ppjp.exe 41 PID 2268 wrote to memory of 1624 2268 1ppjp.exe 41 PID 1624 wrote to memory of 844 1624 9rrxlrr.exe 42 PID 1624 wrote to memory of 844 1624 9rrxlrr.exe 42 PID 1624 wrote to memory of 844 1624 9rrxlrr.exe 42 PID 1624 wrote to memory of 844 1624 9rrxlrr.exe 42 PID 844 wrote to memory of 2008 844 vppdp.exe 43 PID 844 wrote to memory of 2008 844 vppdp.exe 43 PID 844 wrote to memory of 2008 844 vppdp.exe 43 PID 844 wrote to memory of 2008 844 vppdp.exe 43 PID 2008 wrote to memory of 1072 2008 xxrxlrf.exe 44 PID 2008 wrote to memory of 1072 2008 xxrxlrf.exe 44 PID 2008 wrote to memory of 1072 2008 xxrxlrf.exe 44 PID 2008 wrote to memory of 1072 2008 xxrxlrf.exe 44 PID 1072 wrote to memory of 616 1072 btbtbb.exe 45 PID 1072 wrote to memory of 616 1072 btbtbb.exe 45 PID 1072 wrote to memory of 616 1072 btbtbb.exe 45 PID 1072 wrote to memory of 616 1072 btbtbb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\840b0a107965ba3c68fd33711caf57adf49d3da2cd3b503f79dd93bc711f0458N.exe"C:\Users\Admin\AppData\Local\Temp\840b0a107965ba3c68fd33711caf57adf49d3da2cd3b503f79dd93bc711f0458N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\nnbbbb.exec:\nnbbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\ffrrflr.exec:\ffrrflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\pjvjp.exec:\pjvjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\rxxrxrr.exec:\rxxrxrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\htnbnb.exec:\htnbnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\dddjp.exec:\dddjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\1pjjj.exec:\1pjjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\lxxrrfx.exec:\lxxrrfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\djdpd.exec:\djdpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\ffxrllf.exec:\ffxrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\1ppjp.exec:\1ppjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\9rrxlrr.exec:\9rrxlrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\vppdp.exec:\vppdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\btbtbb.exec:\btbtbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\nbbnht.exec:\nbbnht.exe17⤵
- Executes dropped EXE
PID:616 -
\??\c:\5ppjv.exec:\5ppjv.exe18⤵
- Executes dropped EXE
PID:3020 -
\??\c:\fxrffff.exec:\fxrffff.exe19⤵
- Executes dropped EXE
PID:2324 -
\??\c:\dvppv.exec:\dvppv.exe20⤵
- Executes dropped EXE
PID:2472 -
\??\c:\fxllrxr.exec:\fxllrxr.exe21⤵
- Executes dropped EXE
PID:2188 -
\??\c:\jjjpj.exec:\jjjpj.exe22⤵
- Executes dropped EXE
PID:2972 -
\??\c:\xxffrlf.exec:\xxffrlf.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1068 -
\??\c:\5vpvv.exec:\5vpvv.exe24⤵
- Executes dropped EXE
PID:980 -
\??\c:\xrfxflf.exec:\xrfxflf.exe25⤵
- Executes dropped EXE
PID:1076 -
\??\c:\vpjjv.exec:\vpjjv.exe26⤵
- Executes dropped EXE
PID:1704 -
\??\c:\pdppv.exec:\pdppv.exe27⤵
- Executes dropped EXE
PID:1360 -
\??\c:\nnbnbh.exec:\nnbnbh.exe28⤵
- Executes dropped EXE
PID:2192 -
\??\c:\1ppvd.exec:\1ppvd.exe29⤵
- Executes dropped EXE
PID:2576 -
\??\c:\nhbbhb.exec:\nhbbhb.exe30⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rrrxlrx.exec:\rrrxlrx.exe31⤵
- Executes dropped EXE
PID:2124 -
\??\c:\9bthtb.exec:\9bthtb.exe32⤵
- Executes dropped EXE
PID:2948 -
\??\c:\rrfllrx.exec:\rrfllrx.exe33⤵
- Executes dropped EXE
PID:1428 -
\??\c:\ttnnbn.exec:\ttnnbn.exe34⤵PID:1628
-
\??\c:\ppjvd.exec:\ppjvd.exe35⤵
- Executes dropped EXE
PID:3064 -
\??\c:\hbnnbb.exec:\hbnnbb.exe36⤵
- Executes dropped EXE
PID:2320 -
\??\c:\ddvpv.exec:\ddvpv.exe37⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xrflllf.exec:\xrflllf.exe38⤵
- Executes dropped EXE
PID:2444 -
\??\c:\xffrlfx.exec:\xffrlfx.exe39⤵
- Executes dropped EXE
PID:2744 -
\??\c:\htntnt.exec:\htntnt.exe40⤵
- Executes dropped EXE
PID:2868 -
\??\c:\pdddp.exec:\pdddp.exe41⤵
- Executes dropped EXE
PID:2820 -
\??\c:\5rlllrf.exec:\5rlllrf.exe42⤵
- Executes dropped EXE
PID:2464 -
\??\c:\bbthtb.exec:\bbthtb.exe43⤵
- Executes dropped EXE
PID:2764 -
\??\c:\1jvdd.exec:\1jvdd.exe44⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ddjvp.exec:\ddjvp.exe45⤵
- Executes dropped EXE
PID:2916 -
\??\c:\xrlrrrf.exec:\xrlrrrf.exe46⤵
- Executes dropped EXE
PID:2724 -
\??\c:\3btbth.exec:\3btbth.exe47⤵
- Executes dropped EXE
PID:3044 -
\??\c:\5pjvp.exec:\5pjvp.exe48⤵
- Executes dropped EXE
PID:1048 -
\??\c:\jddjd.exec:\jddjd.exe49⤵
- Executes dropped EXE
PID:760 -
\??\c:\xlfxxrf.exec:\xlfxxrf.exe50⤵
- Executes dropped EXE
PID:1636 -
\??\c:\7tnhtb.exec:\7tnhtb.exe51⤵
- Executes dropped EXE
PID:836 -
\??\c:\djdvd.exec:\djdvd.exe52⤵
- Executes dropped EXE
PID:2848 -
\??\c:\rrlrflx.exec:\rrlrflx.exe53⤵
- Executes dropped EXE
PID:1200 -
\??\c:\bbhhnh.exec:\bbhhnh.exe54⤵
- Executes dropped EXE
PID:1876 -
\??\c:\hhhnbh.exec:\hhhnbh.exe55⤵
- Executes dropped EXE
PID:2704 -
\??\c:\jdpvd.exec:\jdpvd.exe56⤵
- Executes dropped EXE
PID:3016 -
\??\c:\lfxrxff.exec:\lfxrxff.exe57⤵
- Executes dropped EXE
PID:2468 -
\??\c:\nhnntt.exec:\nhnntt.exe58⤵
- Executes dropped EXE
PID:2476 -
\??\c:\tttntb.exec:\tttntb.exe59⤵
- Executes dropped EXE
PID:2324 -
\??\c:\jvpjp.exec:\jvpjp.exe60⤵
- Executes dropped EXE
PID:2456 -
\??\c:\ffxfxfr.exec:\ffxfxfr.exe61⤵
- Executes dropped EXE
PID:284 -
\??\c:\rlxlrrl.exec:\rlxlrrl.exe62⤵
- Executes dropped EXE
PID:2784 -
\??\c:\tnbhnt.exec:\tnbhnt.exe63⤵
- Executes dropped EXE
PID:1280 -
\??\c:\pjddv.exec:\pjddv.exe64⤵
- Executes dropped EXE
PID:1676 -
\??\c:\1xfrllx.exec:\1xfrllx.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:980 -
\??\c:\frlrrrl.exec:\frlrrrl.exe66⤵
- Executes dropped EXE
PID:1708 -
\??\c:\9nnhbh.exec:\9nnhbh.exe67⤵PID:1696
-
\??\c:\3vpvv.exec:\3vpvv.exe68⤵PID:1700
-
\??\c:\rrrfxfr.exec:\rrrfxfr.exe69⤵PID:1668
-
\??\c:\3xxfrxl.exec:\3xxfrxl.exe70⤵PID:2192
-
\??\c:\5tnntt.exec:\5tnntt.exe71⤵PID:2364
-
\??\c:\pjdjp.exec:\pjdjp.exe72⤵PID:1952
-
\??\c:\lfxxlrl.exec:\lfxxlrl.exe73⤵PID:1060
-
\??\c:\1lflrxl.exec:\1lflrxl.exe74⤵PID:2124
-
\??\c:\hthbbb.exec:\hthbbb.exe75⤵PID:2860
-
\??\c:\3dpjp.exec:\3dpjp.exe76⤵PID:1580
-
\??\c:\jvddj.exec:\jvddj.exe77⤵PID:1884
-
\??\c:\xxlfxxl.exec:\xxlfxxl.exe78⤵PID:2932
-
\??\c:\htnnth.exec:\htnnth.exe79⤵PID:2328
-
\??\c:\ddjdd.exec:\ddjdd.exe80⤵PID:2792
-
\??\c:\jdpdd.exec:\jdpdd.exe81⤵PID:2184
-
\??\c:\xllrxfl.exec:\xllrxfl.exe82⤵PID:2696
-
\??\c:\7nhnbb.exec:\7nhnbb.exe83⤵PID:2728
-
\??\c:\bttbbb.exec:\bttbbb.exe84⤵PID:2856
-
\??\c:\1vvvj.exec:\1vvvj.exe85⤵PID:2208
-
\??\c:\rlrlxlf.exec:\rlrlxlf.exe86⤵PID:2632
-
\??\c:\ttnthn.exec:\ttnthn.exe87⤵PID:2332
-
\??\c:\tnhhnn.exec:\tnhhnn.exe88⤵PID:2620
-
\??\c:\dpdjp.exec:\dpdjp.exe89⤵PID:2816
-
\??\c:\rrllrrx.exec:\rrllrrx.exe90⤵PID:2724
-
\??\c:\5xxfxfx.exec:\5xxfxfx.exe91⤵PID:272
-
\??\c:\9hnbht.exec:\9hnbht.exe92⤵PID:3052
-
\??\c:\pjdpv.exec:\pjdpv.exe93⤵PID:2672
-
\??\c:\7pddj.exec:\7pddj.exe94⤵PID:836
-
\??\c:\xrllrrf.exec:\xrllrrf.exe95⤵PID:2848
-
\??\c:\nnhhtt.exec:\nnhhtt.exe96⤵PID:1772
-
\??\c:\9jddj.exec:\9jddj.exe97⤵PID:1876
-
\??\c:\rlfrxxl.exec:\rlfrxxl.exe98⤵PID:1736
-
\??\c:\5xlfffl.exec:\5xlfffl.exe99⤵PID:2884
-
\??\c:\5nnbtb.exec:\5nnbtb.exe100⤵PID:1916
-
\??\c:\3ddpp.exec:\3ddpp.exe101⤵
- System Location Discovery: System Language Discovery
PID:2176 -
\??\c:\jpjjj.exec:\jpjjj.exe102⤵PID:2292
-
\??\c:\9lxfflr.exec:\9lxfflr.exe103⤵PID:3032
-
\??\c:\hhtbnb.exec:\hhtbnb.exe104⤵PID:2952
-
\??\c:\ntnntb.exec:\ntnntb.exe105⤵PID:1036
-
\??\c:\ppjjj.exec:\ppjjj.exe106⤵PID:1068
-
\??\c:\lllfrxl.exec:\lllfrxl.exe107⤵PID:1732
-
\??\c:\5rllxfr.exec:\5rllxfr.exe108⤵PID:1016
-
\??\c:\bbthtt.exec:\bbthtt.exe109⤵PID:1188
-
\??\c:\3pjpv.exec:\3pjpv.exe110⤵PID:1756
-
\??\c:\jdddj.exec:\jdddj.exe111⤵PID:1704
-
\??\c:\tnhhnt.exec:\tnhhnt.exe112⤵PID:1512
-
\??\c:\5hhttt.exec:\5hhttt.exe113⤵PID:2132
-
\??\c:\vvpvj.exec:\vvpvj.exe114⤵PID:684
-
\??\c:\rflxrff.exec:\rflxrff.exe115⤵PID:2356
-
\??\c:\9hthtb.exec:\9hthtb.exe116⤵PID:2064
-
\??\c:\bhhhbh.exec:\bhhhbh.exe117⤵PID:1744
-
\??\c:\7jvpp.exec:\7jvpp.exe118⤵PID:1584
-
\??\c:\frffffl.exec:\frffffl.exe119⤵PID:1628
-
\??\c:\1rlxxxr.exec:\1rlxxxr.exe120⤵PID:2164
-
\??\c:\nnnntb.exec:\nnnntb.exe121⤵PID:532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-