Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 05:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e788f1750cf762c2c773ee02dfd77b5d569c6733d64f0b0103b544d749d7204d.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
e788f1750cf762c2c773ee02dfd77b5d569c6733d64f0b0103b544d749d7204d.exe
-
Size
454KB
-
MD5
e549e6f1d593b962096cac83bd4aef2e
-
SHA1
222d6be561d86b14232c857431be620ebb73dd28
-
SHA256
e788f1750cf762c2c773ee02dfd77b5d569c6733d64f0b0103b544d749d7204d
-
SHA512
ececf486ee74e7d4dcd8263c739da2acf39de88003f6741976c80fe5d5a95c7ac9c33011bb7d47548bb7ed69ffb3bd033f6315340f66872ad2138976a927b3de
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe9:q7Tc2NYHUrAwfMp3CD9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2104-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-154-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2984-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/468-227-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1660-233-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1660-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-237-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/904-244-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/904-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-307-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2408-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-333-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2180-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-452-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2952-466-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/548-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-561-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1984-568-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2368-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-754-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1672-793-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/2256-807-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/884-833-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-879-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-935-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2688-942-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2028-1003-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3004-1023-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-1054-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-1085-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-1164-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2924-1177-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2520 bnbnbh.exe 2368 lllxrxf.exe 2448 hhbtbt.exe 2232 5vvjp.exe 2920 dvjpd.exe 3024 7tbbtn.exe 1980 jvvvd.exe 2316 xlxxlfr.exe 2784 thhhtt.exe 1816 7xfrlrr.exe 2056 rlfxlrx.exe 1140 1lrflrx.exe 2668 rfrrlll.exe 776 thnbbt.exe 2876 7nnthn.exe 2028 nhhbnt.exe 2044 hhnnht.exe 1620 9jdjv.exe 2984 tttbtb.exe 1636 jpvpv.exe 448 fllxrll.exe 3048 jppjd.exe 1296 pvjpj.exe 468 fxrrfxl.exe 1660 jvpvd.exe 904 xrfxrrr.exe 2356 hhhnhn.exe 2936 3tbbnh.exe 2888 5nhbhn.exe 1984 jjdjd.exe 1712 htbbtb.exe 1924 7dpjv.exe 2408 bbbnht.exe 3008 jdpvp.exe 1988 llxflrl.exe 2524 bbnhbh.exe 2180 hhbhbh.exe 2272 5jddp.exe 1592 lllxfrl.exe 2844 bhhbth.exe 2644 vjjvv.exe 2996 rxlflxx.exe 2804 9fllfxx.exe 2620 nnbhbh.exe 2324 djjpd.exe 2480 lllflrl.exe 2020 nhtnhn.exe 1484 hhbntb.exe 560 jpjvj.exe 1268 rrrxxrl.exe 2596 hhnbnb.exe 2416 ppvvj.exe 1540 frrlrfl.exe 316 bnhbht.exe 2044 3vppj.exe 3000 5ppdv.exe 2952 nntbnn.exe 2052 hhnhbt.exe 2572 jpvvj.exe 3036 rrfxlfl.exe 3052 7nntnt.exe 1868 vdvvj.exe 1616 djjdp.exe 1672 llfxlxf.exe -
resource yara_rule behavioral1/memory/2104-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-61-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3024-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-307-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/2408-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-333-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2180-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-547-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/548-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-779-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-796-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2308-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-833-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-879-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-892-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-1003-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/3004-1023-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-1054-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-1085-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-1164-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2924-1177-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2520 2104 e788f1750cf762c2c773ee02dfd77b5d569c6733d64f0b0103b544d749d7204d.exe 30 PID 2104 wrote to memory of 2520 2104 e788f1750cf762c2c773ee02dfd77b5d569c6733d64f0b0103b544d749d7204d.exe 30 PID 2104 wrote to memory of 2520 2104 e788f1750cf762c2c773ee02dfd77b5d569c6733d64f0b0103b544d749d7204d.exe 30 PID 2104 wrote to memory of 2520 2104 e788f1750cf762c2c773ee02dfd77b5d569c6733d64f0b0103b544d749d7204d.exe 30 PID 2520 wrote to memory of 2368 2520 bnbnbh.exe 31 PID 2520 wrote to memory of 2368 2520 bnbnbh.exe 31 PID 2520 wrote to memory of 2368 2520 bnbnbh.exe 31 PID 2520 wrote to memory of 2368 2520 bnbnbh.exe 31 PID 2368 wrote to memory of 2448 2368 lllxrxf.exe 32 PID 2368 wrote to memory of 2448 2368 lllxrxf.exe 32 PID 2368 wrote to memory of 2448 2368 lllxrxf.exe 32 PID 2368 wrote to memory of 2448 2368 lllxrxf.exe 32 PID 2448 wrote to memory of 2232 2448 hhbtbt.exe 33 PID 2448 wrote to memory of 2232 2448 hhbtbt.exe 33 PID 2448 wrote to memory of 2232 2448 hhbtbt.exe 33 PID 2448 wrote to memory of 2232 2448 hhbtbt.exe 33 PID 2232 wrote to memory of 2920 2232 5vvjp.exe 34 PID 2232 wrote to memory of 2920 2232 5vvjp.exe 34 PID 2232 wrote to memory of 2920 2232 5vvjp.exe 34 PID 2232 wrote to memory of 2920 2232 5vvjp.exe 34 PID 2920 wrote to memory of 3024 2920 dvjpd.exe 35 PID 2920 wrote to memory of 3024 2920 dvjpd.exe 35 PID 2920 wrote to memory of 3024 2920 dvjpd.exe 35 PID 2920 wrote to memory of 3024 2920 dvjpd.exe 35 PID 3024 wrote to memory of 1980 3024 7tbbtn.exe 36 PID 3024 wrote to memory of 1980 3024 7tbbtn.exe 36 PID 3024 wrote to memory of 1980 3024 7tbbtn.exe 36 PID 3024 wrote to memory of 1980 3024 7tbbtn.exe 36 PID 1980 wrote to memory of 2316 1980 jvvvd.exe 37 PID 1980 wrote to memory of 2316 1980 jvvvd.exe 37 PID 1980 wrote to memory of 2316 1980 jvvvd.exe 37 PID 1980 wrote to memory of 2316 1980 jvvvd.exe 37 PID 2316 wrote to memory of 2784 2316 xlxxlfr.exe 38 PID 2316 wrote to memory of 2784 2316 xlxxlfr.exe 38 PID 2316 wrote to memory of 2784 2316 xlxxlfr.exe 38 PID 2316 wrote to memory of 2784 2316 xlxxlfr.exe 38 PID 2784 wrote to memory of 1816 2784 thhhtt.exe 39 PID 2784 wrote to memory of 1816 2784 thhhtt.exe 39 PID 2784 wrote to memory of 1816 2784 thhhtt.exe 39 PID 2784 wrote to memory of 1816 2784 thhhtt.exe 39 PID 1816 wrote to memory of 2056 1816 7xfrlrr.exe 40 PID 1816 wrote to memory of 2056 1816 7xfrlrr.exe 40 PID 1816 wrote to memory of 2056 1816 7xfrlrr.exe 40 PID 1816 wrote to memory of 2056 1816 7xfrlrr.exe 40 PID 2056 wrote to memory of 1140 2056 rlfxlrx.exe 41 PID 2056 wrote to memory of 1140 2056 rlfxlrx.exe 41 PID 2056 wrote to memory of 1140 2056 rlfxlrx.exe 41 PID 2056 wrote to memory of 1140 2056 rlfxlrx.exe 41 PID 1140 wrote to memory of 2668 1140 1lrflrx.exe 42 PID 1140 wrote to memory of 2668 1140 1lrflrx.exe 42 PID 1140 wrote to memory of 2668 1140 1lrflrx.exe 42 PID 1140 wrote to memory of 2668 1140 1lrflrx.exe 42 PID 2668 wrote to memory of 776 2668 rfrrlll.exe 43 PID 2668 wrote to memory of 776 2668 rfrrlll.exe 43 PID 2668 wrote to memory of 776 2668 rfrrlll.exe 43 PID 2668 wrote to memory of 776 2668 rfrrlll.exe 43 PID 776 wrote to memory of 2876 776 thnbbt.exe 44 PID 776 wrote to memory of 2876 776 thnbbt.exe 44 PID 776 wrote to memory of 2876 776 thnbbt.exe 44 PID 776 wrote to memory of 2876 776 thnbbt.exe 44 PID 2876 wrote to memory of 2028 2876 7nnthn.exe 45 PID 2876 wrote to memory of 2028 2876 7nnthn.exe 45 PID 2876 wrote to memory of 2028 2876 7nnthn.exe 45 PID 2876 wrote to memory of 2028 2876 7nnthn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e788f1750cf762c2c773ee02dfd77b5d569c6733d64f0b0103b544d749d7204d.exe"C:\Users\Admin\AppData\Local\Temp\e788f1750cf762c2c773ee02dfd77b5d569c6733d64f0b0103b544d749d7204d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\bnbnbh.exec:\bnbnbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\lllxrxf.exec:\lllxrxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\hhbtbt.exec:\hhbtbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\5vvjp.exec:\5vvjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\dvjpd.exec:\dvjpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\7tbbtn.exec:\7tbbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\jvvvd.exec:\jvvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\xlxxlfr.exec:\xlxxlfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\thhhtt.exec:\thhhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\7xfrlrr.exec:\7xfrlrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\rlfxlrx.exec:\rlfxlrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\1lrflrx.exec:\1lrflrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\rfrrlll.exec:\rfrrlll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\thnbbt.exec:\thnbbt.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\7nnthn.exec:\7nnthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\nhhbnt.exec:\nhhbnt.exe17⤵
- Executes dropped EXE
PID:2028 -
\??\c:\hhnnht.exec:\hhnnht.exe18⤵
- Executes dropped EXE
PID:2044 -
\??\c:\9jdjv.exec:\9jdjv.exe19⤵
- Executes dropped EXE
PID:1620 -
\??\c:\tttbtb.exec:\tttbtb.exe20⤵
- Executes dropped EXE
PID:2984 -
\??\c:\jpvpv.exec:\jpvpv.exe21⤵
- Executes dropped EXE
PID:1636 -
\??\c:\fllxrll.exec:\fllxrll.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:448 -
\??\c:\jppjd.exec:\jppjd.exe23⤵
- Executes dropped EXE
PID:3048 -
\??\c:\pvjpj.exec:\pvjpj.exe24⤵
- Executes dropped EXE
PID:1296 -
\??\c:\fxrrfxl.exec:\fxrrfxl.exe25⤵
- Executes dropped EXE
PID:468 -
\??\c:\jvpvd.exec:\jvpvd.exe26⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xrfxrrr.exec:\xrfxrrr.exe27⤵
- Executes dropped EXE
PID:904 -
\??\c:\hhhnhn.exec:\hhhnhn.exe28⤵
- Executes dropped EXE
PID:2356 -
\??\c:\3tbbnh.exec:\3tbbnh.exe29⤵
- Executes dropped EXE
PID:2936 -
\??\c:\5nhbhn.exec:\5nhbhn.exe30⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jjdjd.exec:\jjdjd.exe31⤵
- Executes dropped EXE
PID:1984 -
\??\c:\htbbtb.exec:\htbbtb.exe32⤵
- Executes dropped EXE
PID:1712 -
\??\c:\7dpjv.exec:\7dpjv.exe33⤵
- Executes dropped EXE
PID:1924 -
\??\c:\bbbnht.exec:\bbbnht.exe34⤵
- Executes dropped EXE
PID:2408 -
\??\c:\jdpvp.exec:\jdpvp.exe35⤵
- Executes dropped EXE
PID:3008 -
\??\c:\llxflrl.exec:\llxflrl.exe36⤵
- Executes dropped EXE
PID:1988 -
\??\c:\bbnhbh.exec:\bbnhbh.exe37⤵
- Executes dropped EXE
PID:2524 -
\??\c:\hhbhbh.exec:\hhbhbh.exe38⤵
- Executes dropped EXE
PID:2180 -
\??\c:\5jddp.exec:\5jddp.exe39⤵
- Executes dropped EXE
PID:2272 -
\??\c:\lllxfrl.exec:\lllxfrl.exe40⤵
- Executes dropped EXE
PID:1592 -
\??\c:\bhhbth.exec:\bhhbth.exe41⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vjjvv.exec:\vjjvv.exe42⤵
- Executes dropped EXE
PID:2644 -
\??\c:\rxlflxx.exec:\rxlflxx.exe43⤵
- Executes dropped EXE
PID:2996 -
\??\c:\9fllfxx.exec:\9fllfxx.exe44⤵
- Executes dropped EXE
PID:2804 -
\??\c:\nnbhbh.exec:\nnbhbh.exe45⤵
- Executes dropped EXE
PID:2620 -
\??\c:\djjpd.exec:\djjpd.exe46⤵
- Executes dropped EXE
PID:2324 -
\??\c:\lllflrl.exec:\lllflrl.exe47⤵
- Executes dropped EXE
PID:2480 -
\??\c:\nhtnhn.exec:\nhtnhn.exe48⤵
- Executes dropped EXE
PID:2020 -
\??\c:\hhbntb.exec:\hhbntb.exe49⤵
- Executes dropped EXE
PID:1484 -
\??\c:\jpjvj.exec:\jpjvj.exe50⤵
- Executes dropped EXE
PID:560 -
\??\c:\rrrxxrl.exec:\rrrxxrl.exe51⤵
- Executes dropped EXE
PID:1268 -
\??\c:\hhnbnb.exec:\hhnbnb.exe52⤵
- Executes dropped EXE
PID:2596 -
\??\c:\ppvvj.exec:\ppvvj.exe53⤵
- Executes dropped EXE
PID:2416 -
\??\c:\frrlrfl.exec:\frrlrfl.exe54⤵
- Executes dropped EXE
PID:1540 -
\??\c:\bnhbht.exec:\bnhbht.exe55⤵
- Executes dropped EXE
PID:316 -
\??\c:\3vppj.exec:\3vppj.exe56⤵
- Executes dropped EXE
PID:2044 -
\??\c:\5ppdv.exec:\5ppdv.exe57⤵
- Executes dropped EXE
PID:3000 -
\??\c:\nntbnn.exec:\nntbnn.exe58⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hhnhbt.exec:\hhnhbt.exe59⤵
- Executes dropped EXE
PID:2052 -
\??\c:\jpvvj.exec:\jpvvj.exe60⤵
- Executes dropped EXE
PID:2572 -
\??\c:\rrfxlfl.exec:\rrfxlfl.exe61⤵
- Executes dropped EXE
PID:3036 -
\??\c:\7nntnt.exec:\7nntnt.exe62⤵
- Executes dropped EXE
PID:3052 -
\??\c:\vdvvj.exec:\vdvvj.exe63⤵
- Executes dropped EXE
PID:1868 -
\??\c:\djjdp.exec:\djjdp.exe64⤵
- Executes dropped EXE
PID:1616 -
\??\c:\llfxlxf.exec:\llfxlxf.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1672 -
\??\c:\bhtnhb.exec:\bhtnhb.exe66⤵PID:1684
-
\??\c:\pvdvv.exec:\pvdvv.exe67⤵PID:932
-
\??\c:\llflxlf.exec:\llflxlf.exe68⤵PID:1532
-
\??\c:\nhhbnb.exec:\nhhbnb.exe69⤵
- System Location Discovery: System Language Discovery
PID:2312 -
\??\c:\bnthtn.exec:\bnthtn.exe70⤵PID:1952
-
\??\c:\ppjvp.exec:\ppjvp.exe71⤵PID:2492
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe72⤵PID:548
-
\??\c:\hhbnht.exec:\hhbnht.exe73⤵PID:2140
-
\??\c:\ddpdv.exec:\ddpdv.exe74⤵PID:1984
-
\??\c:\jvvvv.exec:\jvvvv.exe75⤵PID:3012
-
\??\c:\rlfrlxr.exec:\rlfrlxr.exe76⤵PID:2368
-
\??\c:\hnnbbb.exec:\hnnbbb.exe77⤵PID:2392
-
\??\c:\ffxfxfx.exec:\ffxfxfx.exe78⤵PID:2448
-
\??\c:\5flxrfx.exec:\5flxrfx.exe79⤵PID:2380
-
\??\c:\tbnbhn.exec:\tbnbhn.exe80⤵PID:2524
-
\??\c:\vdjvp.exec:\vdjvp.exe81⤵PID:1052
-
\??\c:\9rfxxlr.exec:\9rfxxlr.exe82⤵PID:2848
-
\??\c:\7thtbh.exec:\7thtbh.exe83⤵PID:2764
-
\??\c:\ddvdv.exec:\ddvdv.exe84⤵PID:2904
-
\??\c:\xrrfrxr.exec:\xrrfrxr.exe85⤵PID:2712
-
\??\c:\thnnnh.exec:\thnnnh.exe86⤵PID:2724
-
\??\c:\1btbnh.exec:\1btbnh.exe87⤵PID:2624
-
\??\c:\pjdpj.exec:\pjdpj.exe88⤵PID:2688
-
\??\c:\ffxlflf.exec:\ffxlflf.exe89⤵PID:2456
-
\??\c:\nnhnbh.exec:\nnhnbh.exe90⤵PID:1816
-
\??\c:\3jpdv.exec:\3jpdv.exe91⤵PID:704
-
\??\c:\rxflflx.exec:\rxflflx.exe92⤵PID:2864
-
\??\c:\fffrxll.exec:\fffrxll.exe93⤵PID:2040
-
\??\c:\nnbbbt.exec:\nnbbbt.exe94⤵PID:2668
-
\??\c:\ffflxxx.exec:\ffflxxx.exe95⤵PID:2412
-
\??\c:\ntthth.exec:\ntthth.exe96⤵PID:2344
-
\??\c:\1jjpd.exec:\1jjpd.exe97⤵PID:1560
-
\??\c:\rrrfxfr.exec:\rrrfxfr.exe98⤵PID:2028
-
\??\c:\hthtbt.exec:\hthtbt.exe99⤵PID:1148
-
\??\c:\jvddp.exec:\jvddp.exe100⤵PID:2956
-
\??\c:\rrrfrxr.exec:\rrrfrxr.exe101⤵PID:2248
-
\??\c:\tbbnbt.exec:\tbbnbt.exe102⤵PID:2460
-
\??\c:\7hbbhn.exec:\7hbbhn.exe103⤵PID:2236
-
\??\c:\ddvdv.exec:\ddvdv.exe104⤵PID:1156
-
\??\c:\1flxlxl.exec:\1flxlxl.exe105⤵PID:3036
-
\??\c:\nnhntb.exec:\nnhntb.exe106⤵PID:1316
-
\??\c:\bntnnh.exec:\bntnnh.exe107⤵PID:1868
-
\??\c:\jpjvj.exec:\jpjvj.exe108⤵PID:1616
-
\??\c:\xxxlxxl.exec:\xxxlxxl.exe109⤵PID:1672
-
\??\c:\ntnhht.exec:\ntnhht.exe110⤵PID:1684
-
\??\c:\bhhtbb.exec:\bhhtbb.exe111⤵PID:2256
-
\??\c:\dvvdv.exec:\dvvdv.exe112⤵PID:1820
-
\??\c:\xrrfxll.exec:\xrrfxll.exe113⤵PID:2308
-
\??\c:\bbbnbn.exec:\bbbnbn.exe114⤵PID:1800
-
\??\c:\pjjjd.exec:\pjjjd.exe115⤵PID:396
-
\??\c:\vpjjp.exec:\vpjjp.exe116⤵PID:884
-
\??\c:\7xlxlrf.exec:\7xlxlrf.exe117⤵PID:2528
-
\??\c:\1bnhnb.exec:\1bnhnb.exe118⤵PID:2504
-
\??\c:\jjdpd.exec:\jjdpd.exe119⤵PID:2488
-
\??\c:\djpvp.exec:\djpvp.exe120⤵PID:1552
-
\??\c:\flffxfx.exec:\flffxfx.exe121⤵PID:2392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-