Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 05:14
Static task
static1
Behavioral task
behavioral1
Sample
dc01656a2360bb96913fe8611c96960b561b00d8ced3aaec3f458c65133e4aa7.exe
Resource
win7-20240903-en
General
-
Target
dc01656a2360bb96913fe8611c96960b561b00d8ced3aaec3f458c65133e4aa7.exe
-
Size
456KB
-
MD5
b09bdea933a38c902713063913c8ac65
-
SHA1
e348867186116fb2b0aa38a2bc07670b662cf7cd
-
SHA256
dc01656a2360bb96913fe8611c96960b561b00d8ced3aaec3f458c65133e4aa7
-
SHA512
5a051f3cb8973885999eab3ebf6a09ff49f3d0d39cabb446e3fe4bea441a6094c0fbc6a8e3e6bbb8f5b1ac5d95dcf3089d691090a1e36aedf39d79181678100c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRJ:q7Tc2NYHUrAwfMp3CDRJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/1144-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1292-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/616-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-63-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2832-67-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2832-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-78-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2784-96-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2620-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-126-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1532-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/880-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-310-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2488-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-433-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2980-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1404-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-508-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/888-516-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/744-523-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3040-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-633-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1532-722-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1292 7ttthn.exe 2568 rlfrflf.exe 2264 7bbtht.exe 616 llrxlrf.exe 1476 hhhnnt.exe 2832 ppppv.exe 2752 3rfxrfr.exe 2192 rxlfrrf.exe 2784 hthnbb.exe 2620 jjddd.exe 2512 xflffxr.exe 2340 pppjd.exe 1532 fllrlxr.exe 2960 5hbhhb.exe 880 vpdjv.exe 2928 9lllrrx.exe 1404 thhnnh.exe 2224 ddvjj.exe 572 rrrfrxr.exe 1792 jjjpj.exe 2268 lflrrxl.exe 1276 nhntbh.exe 2540 vpppj.exe 2032 fxrxrxl.exe 1776 djvdd.exe 1700 lfrxxrl.exe 2916 pvvvd.exe 1664 xxfllfx.exe 1480 ttntht.exe 1748 jjpdp.exe 1724 xxxrfrr.exe 2160 5dvvv.exe 868 lrrlflx.exe 2488 vjppj.exe 2108 frxrrll.exe 2476 bntnbt.exe 2764 vpddd.exe 2884 rxxllxx.exe 2840 rflffxx.exe 1644 ntbtnb.exe 2752 jvvpp.exe 2672 rlrfxrr.exe 2664 5bbtnn.exe 704 5nbhhh.exe 2740 djjdd.exe 2924 xxffrrx.exe 992 5fxflxl.exe 2952 dvvjj.exe 2948 1ffflrf.exe 2960 nhhnht.exe 880 vvjvp.exe 2980 lrrxxll.exe 2604 frxffff.exe 1404 dpdvp.exe 2076 llfxffl.exe 572 ddvjv.exe 1272 xfffffl.exe 2124 nhnbht.exe 1908 jpvpj.exe 1276 lrrrrfl.exe 1268 thntbt.exe 888 pjddv.exe 744 3vjpd.exe 1776 htbtnb.exe -
resource yara_rule behavioral1/memory/1144-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/616-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1404-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-508-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/888-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-712-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfllxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ntnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tththn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1144 wrote to memory of 1292 1144 dc01656a2360bb96913fe8611c96960b561b00d8ced3aaec3f458c65133e4aa7.exe 30 PID 1144 wrote to memory of 1292 1144 dc01656a2360bb96913fe8611c96960b561b00d8ced3aaec3f458c65133e4aa7.exe 30 PID 1144 wrote to memory of 1292 1144 dc01656a2360bb96913fe8611c96960b561b00d8ced3aaec3f458c65133e4aa7.exe 30 PID 1144 wrote to memory of 1292 1144 dc01656a2360bb96913fe8611c96960b561b00d8ced3aaec3f458c65133e4aa7.exe 30 PID 1292 wrote to memory of 2568 1292 7ttthn.exe 31 PID 1292 wrote to memory of 2568 1292 7ttthn.exe 31 PID 1292 wrote to memory of 2568 1292 7ttthn.exe 31 PID 1292 wrote to memory of 2568 1292 7ttthn.exe 31 PID 2568 wrote to memory of 2264 2568 rlfrflf.exe 32 PID 2568 wrote to memory of 2264 2568 rlfrflf.exe 32 PID 2568 wrote to memory of 2264 2568 rlfrflf.exe 32 PID 2568 wrote to memory of 2264 2568 rlfrflf.exe 32 PID 2264 wrote to memory of 616 2264 7bbtht.exe 33 PID 2264 wrote to memory of 616 2264 7bbtht.exe 33 PID 2264 wrote to memory of 616 2264 7bbtht.exe 33 PID 2264 wrote to memory of 616 2264 7bbtht.exe 33 PID 616 wrote to memory of 1476 616 llrxlrf.exe 34 PID 616 wrote to memory of 1476 616 llrxlrf.exe 34 PID 616 wrote to memory of 1476 616 llrxlrf.exe 34 PID 616 wrote to memory of 1476 616 llrxlrf.exe 34 PID 1476 wrote to memory of 2832 1476 hhhnnt.exe 35 PID 1476 wrote to memory of 2832 1476 hhhnnt.exe 35 PID 1476 wrote to memory of 2832 1476 hhhnnt.exe 35 PID 1476 wrote to memory of 2832 1476 hhhnnt.exe 35 PID 2832 wrote to memory of 2752 2832 ppppv.exe 36 PID 2832 wrote to memory of 2752 2832 ppppv.exe 36 PID 2832 wrote to memory of 2752 2832 ppppv.exe 36 PID 2832 wrote to memory of 2752 2832 ppppv.exe 36 PID 2752 wrote to memory of 2192 2752 3rfxrfr.exe 37 PID 2752 wrote to memory of 2192 2752 3rfxrfr.exe 37 PID 2752 wrote to memory of 2192 2752 3rfxrfr.exe 37 PID 2752 wrote to memory of 2192 2752 3rfxrfr.exe 37 PID 2192 wrote to memory of 2784 2192 rxlfrrf.exe 38 PID 2192 wrote to memory of 2784 2192 rxlfrrf.exe 38 PID 2192 wrote to memory of 2784 2192 rxlfrrf.exe 38 PID 2192 wrote to memory of 2784 2192 rxlfrrf.exe 38 PID 2784 wrote to memory of 2620 2784 hthnbb.exe 39 PID 2784 wrote to memory of 2620 2784 hthnbb.exe 39 PID 2784 wrote to memory of 2620 2784 hthnbb.exe 39 PID 2784 wrote to memory of 2620 2784 hthnbb.exe 39 PID 2620 wrote to memory of 2512 2620 jjddd.exe 40 PID 2620 wrote to memory of 2512 2620 jjddd.exe 40 PID 2620 wrote to memory of 2512 2620 jjddd.exe 40 PID 2620 wrote to memory of 2512 2620 jjddd.exe 40 PID 2512 wrote to memory of 2340 2512 xflffxr.exe 41 PID 2512 wrote to memory of 2340 2512 xflffxr.exe 41 PID 2512 wrote to memory of 2340 2512 xflffxr.exe 41 PID 2512 wrote to memory of 2340 2512 xflffxr.exe 41 PID 2340 wrote to memory of 1532 2340 pppjd.exe 42 PID 2340 wrote to memory of 1532 2340 pppjd.exe 42 PID 2340 wrote to memory of 1532 2340 pppjd.exe 42 PID 2340 wrote to memory of 1532 2340 pppjd.exe 42 PID 1532 wrote to memory of 2960 1532 fllrlxr.exe 43 PID 1532 wrote to memory of 2960 1532 fllrlxr.exe 43 PID 1532 wrote to memory of 2960 1532 fllrlxr.exe 43 PID 1532 wrote to memory of 2960 1532 fllrlxr.exe 43 PID 2960 wrote to memory of 880 2960 5hbhhb.exe 44 PID 2960 wrote to memory of 880 2960 5hbhhb.exe 44 PID 2960 wrote to memory of 880 2960 5hbhhb.exe 44 PID 2960 wrote to memory of 880 2960 5hbhhb.exe 44 PID 880 wrote to memory of 2928 880 vpdjv.exe 45 PID 880 wrote to memory of 2928 880 vpdjv.exe 45 PID 880 wrote to memory of 2928 880 vpdjv.exe 45 PID 880 wrote to memory of 2928 880 vpdjv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc01656a2360bb96913fe8611c96960b561b00d8ced3aaec3f458c65133e4aa7.exe"C:\Users\Admin\AppData\Local\Temp\dc01656a2360bb96913fe8611c96960b561b00d8ced3aaec3f458c65133e4aa7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\7ttthn.exec:\7ttthn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\rlfrflf.exec:\rlfrflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\7bbtht.exec:\7bbtht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\llrxlrf.exec:\llrxlrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
\??\c:\hhhnnt.exec:\hhhnnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\ppppv.exec:\ppppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\3rfxrfr.exec:\3rfxrfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\rxlfrrf.exec:\rxlfrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\hthnbb.exec:\hthnbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\jjddd.exec:\jjddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\xflffxr.exec:\xflffxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\pppjd.exec:\pppjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\fllrlxr.exec:\fllrlxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\5hbhhb.exec:\5hbhhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\vpdjv.exec:\vpdjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\9lllrrx.exec:\9lllrrx.exe17⤵
- Executes dropped EXE
PID:2928 -
\??\c:\thhnnh.exec:\thhnnh.exe18⤵
- Executes dropped EXE
PID:1404 -
\??\c:\ddvjj.exec:\ddvjj.exe19⤵
- Executes dropped EXE
PID:2224 -
\??\c:\rrrfrxr.exec:\rrrfrxr.exe20⤵
- Executes dropped EXE
PID:572 -
\??\c:\jjjpj.exec:\jjjpj.exe21⤵
- Executes dropped EXE
PID:1792 -
\??\c:\lflrrxl.exec:\lflrrxl.exe22⤵
- Executes dropped EXE
PID:2268 -
\??\c:\nhntbh.exec:\nhntbh.exe23⤵
- Executes dropped EXE
PID:1276 -
\??\c:\vpppj.exec:\vpppj.exe24⤵
- Executes dropped EXE
PID:2540 -
\??\c:\fxrxrxl.exec:\fxrxrxl.exe25⤵
- Executes dropped EXE
PID:2032 -
\??\c:\djvdd.exec:\djvdd.exe26⤵
- Executes dropped EXE
PID:1776 -
\??\c:\lfrxxrl.exec:\lfrxxrl.exe27⤵
- Executes dropped EXE
PID:1700 -
\??\c:\pvvvd.exec:\pvvvd.exe28⤵
- Executes dropped EXE
PID:2916 -
\??\c:\xxfllfx.exec:\xxfllfx.exe29⤵
- Executes dropped EXE
PID:1664 -
\??\c:\ttntht.exec:\ttntht.exe30⤵
- Executes dropped EXE
PID:1480 -
\??\c:\jjpdp.exec:\jjpdp.exe31⤵
- Executes dropped EXE
PID:1748 -
\??\c:\xxxrfrr.exec:\xxxrfrr.exe32⤵
- Executes dropped EXE
PID:1724 -
\??\c:\5dvvv.exec:\5dvvv.exe33⤵
- Executes dropped EXE
PID:2160 -
\??\c:\lrrlflx.exec:\lrrlflx.exe34⤵
- Executes dropped EXE
PID:868 -
\??\c:\vjppj.exec:\vjppj.exe35⤵
- Executes dropped EXE
PID:2488 -
\??\c:\frxrrll.exec:\frxrrll.exe36⤵
- Executes dropped EXE
PID:2108 -
\??\c:\bntnbt.exec:\bntnbt.exe37⤵
- Executes dropped EXE
PID:2476 -
\??\c:\vpddd.exec:\vpddd.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rxxllxx.exec:\rxxllxx.exe39⤵
- Executes dropped EXE
PID:2884 -
\??\c:\rflffxx.exec:\rflffxx.exe40⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ntbtnb.exec:\ntbtnb.exe41⤵
- Executes dropped EXE
PID:1644 -
\??\c:\jvvpp.exec:\jvvpp.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2752 -
\??\c:\rlrfxrr.exec:\rlrfxrr.exe43⤵
- Executes dropped EXE
PID:2672 -
\??\c:\5bbtnn.exec:\5bbtnn.exe44⤵
- Executes dropped EXE
PID:2664 -
\??\c:\5nbhhh.exec:\5nbhhh.exe45⤵
- Executes dropped EXE
PID:704 -
\??\c:\djjdd.exec:\djjdd.exe46⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xxffrrx.exec:\xxffrrx.exe47⤵
- Executes dropped EXE
PID:2924 -
\??\c:\5fxflxl.exec:\5fxflxl.exe48⤵
- Executes dropped EXE
PID:992 -
\??\c:\dvvjj.exec:\dvvjj.exe49⤵
- Executes dropped EXE
PID:2952 -
\??\c:\1ffflrf.exec:\1ffflrf.exe50⤵
- Executes dropped EXE
PID:2948 -
\??\c:\nhhnht.exec:\nhhnht.exe51⤵
- Executes dropped EXE
PID:2960 -
\??\c:\vvjvp.exec:\vvjvp.exe52⤵
- Executes dropped EXE
PID:880 -
\??\c:\lrrxxll.exec:\lrrxxll.exe53⤵
- Executes dropped EXE
PID:2980 -
\??\c:\frxffff.exec:\frxffff.exe54⤵
- Executes dropped EXE
PID:2604 -
\??\c:\dpdvp.exec:\dpdvp.exe55⤵
- Executes dropped EXE
PID:1404 -
\??\c:\llfxffl.exec:\llfxffl.exe56⤵
- Executes dropped EXE
PID:2076 -
\??\c:\ddvjv.exec:\ddvjv.exe57⤵
- Executes dropped EXE
PID:572 -
\??\c:\xfffffl.exec:\xfffffl.exe58⤵
- Executes dropped EXE
PID:1272 -
\??\c:\nhnbht.exec:\nhnbht.exe59⤵
- Executes dropped EXE
PID:2124 -
\??\c:\jpvpj.exec:\jpvpj.exe60⤵
- Executes dropped EXE
PID:1908 -
\??\c:\lrrrrfl.exec:\lrrrrfl.exe61⤵
- Executes dropped EXE
PID:1276 -
\??\c:\thntbt.exec:\thntbt.exe62⤵
- Executes dropped EXE
PID:1268 -
\??\c:\pjddv.exec:\pjddv.exe63⤵
- Executes dropped EXE
PID:888 -
\??\c:\3vjpd.exec:\3vjpd.exe64⤵
- Executes dropped EXE
PID:744 -
\??\c:\htbtnb.exec:\htbtnb.exe65⤵
- Executes dropped EXE
PID:1776 -
\??\c:\thtnnb.exec:\thtnnb.exe66⤵PID:2544
-
\??\c:\dpjjv.exec:\dpjjv.exe67⤵PID:564
-
\??\c:\rlrxxlf.exec:\rlrxxlf.exe68⤵PID:2148
-
\??\c:\3ntnnb.exec:\3ntnnb.exe69⤵
- System Location Discovery: System Language Discovery
PID:2284 -
\??\c:\ttnbtn.exec:\ttnbtn.exe70⤵PID:1752
-
\??\c:\3vvjd.exec:\3vvjd.exe71⤵PID:1988
-
\??\c:\xxxlfxx.exec:\xxxlfxx.exe72⤵
- System Location Discovery: System Language Discovery
PID:1724 -
\??\c:\thnbth.exec:\thnbth.exe73⤵PID:1956
-
\??\c:\jppdv.exec:\jppdv.exe74⤵PID:2532
-
\??\c:\pjdjd.exec:\pjdjd.exe75⤵PID:780
-
\??\c:\fllxrxr.exec:\fllxrxr.exe76⤵PID:2504
-
\??\c:\bnnnhn.exec:\bnnnhn.exe77⤵PID:2108
-
\??\c:\ppjdv.exec:\ppjdv.exe78⤵PID:2760
-
\??\c:\3vvdp.exec:\3vvdp.exe79⤵PID:596
-
\??\c:\9fffrrl.exec:\9fffrrl.exe80⤵PID:3040
-
\??\c:\bhhbtb.exec:\bhhbtb.exe81⤵PID:3044
-
\??\c:\tnntbn.exec:\tnntbn.exe82⤵PID:2840
-
\??\c:\9dpjp.exec:\9dpjp.exe83⤵PID:2720
-
\??\c:\xxrfrxr.exec:\xxrfrxr.exe84⤵PID:2896
-
\??\c:\3xxrlrf.exec:\3xxrlrf.exe85⤵PID:2672
-
\??\c:\hhhhhn.exec:\hhhhhn.exe86⤵PID:2784
-
\??\c:\jdppj.exec:\jdppj.exe87⤵PID:2660
-
\??\c:\frlrxfr.exec:\frlrxfr.exe88⤵PID:2212
-
\??\c:\fxfrrll.exec:\fxfrrll.exe89⤵PID:2972
-
\??\c:\1bhbtn.exec:\1bhbtn.exe90⤵PID:844
-
\??\c:\djjpj.exec:\djjpj.exe91⤵PID:1532
-
\??\c:\lrlrxxl.exec:\lrlrxxl.exe92⤵PID:1328
-
\??\c:\ffxrlxx.exec:\ffxrlxx.exe93⤵PID:2676
-
\??\c:\bhnhtn.exec:\bhnhtn.exe94⤵PID:348
-
\??\c:\pvpdp.exec:\pvpdp.exe95⤵PID:1332
-
\??\c:\vvvjv.exec:\vvvjv.exe96⤵
- System Location Discovery: System Language Discovery
PID:1968 -
\??\c:\xllfrrx.exec:\xllfrrx.exe97⤵PID:1404
-
\??\c:\9bntbh.exec:\9bntbh.exe98⤵PID:2064
-
\??\c:\pvvdv.exec:\pvvdv.exe99⤵PID:2152
-
\??\c:\dddjj.exec:\dddjj.exe100⤵PID:1524
-
\??\c:\flfxllr.exec:\flfxllr.exe101⤵PID:2084
-
\??\c:\ttthbh.exec:\ttthbh.exe102⤵PID:404
-
\??\c:\jpdvj.exec:\jpdvj.exe103⤵PID:1276
-
\??\c:\jppdp.exec:\jppdp.exe104⤵PID:1068
-
\??\c:\xxlxrll.exec:\xxlxrll.exe105⤵PID:2800
-
\??\c:\tntbnb.exec:\tntbnb.exe106⤵PID:956
-
\??\c:\dpvvd.exec:\dpvvd.exe107⤵PID:2588
-
\??\c:\rlfrfrx.exec:\rlfrfrx.exe108⤵PID:788
-
\??\c:\llfxrxr.exec:\llfxrxr.exe109⤵PID:2316
-
\??\c:\3hntht.exec:\3hntht.exe110⤵PID:564
-
\??\c:\pvpvj.exec:\pvpvj.exe111⤵PID:2392
-
\??\c:\1ppvv.exec:\1ppvv.exe112⤵PID:2272
-
\??\c:\7ffrlrl.exec:\7ffrlrl.exe113⤵PID:2388
-
\??\c:\nnbhtt.exec:\nnbhtt.exe114⤵PID:1144
-
\??\c:\vjpdv.exec:\vjpdv.exe115⤵PID:2172
-
\??\c:\rrxxllr.exec:\rrxxllr.exe116⤵PID:2532
-
\??\c:\jvjpp.exec:\jvjpp.exe117⤵PID:780
-
\??\c:\fxxlfrl.exec:\fxxlfrl.exe118⤵PID:2252
-
\??\c:\thbbhb.exec:\thbbhb.exe119⤵PID:1588
-
\??\c:\nnnbnb.exec:\nnnbnb.exe120⤵PID:2448
-
\??\c:\5jvdj.exec:\5jvdj.exe121⤵PID:2828
-
\??\c:\3flxlxr.exec:\3flxlxr.exe122⤵PID:2824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-