Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 06:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a21273f8d02387e2a58c1b9527c8c77c3538e088b0cae78962246faa45b71fd9.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a21273f8d02387e2a58c1b9527c8c77c3538e088b0cae78962246faa45b71fd9.exe
-
Size
453KB
-
MD5
a6e33c979be27c236a3acea127d7dba1
-
SHA1
005441a31345b1970fcd94deb4eec64d701570af
-
SHA256
a21273f8d02387e2a58c1b9527c8c77c3538e088b0cae78962246faa45b71fd9
-
SHA512
ca15634c85f0214185a89c4a3b832d2e02334041b81a9511c6e1504bcee598f96087fd881871bbb92de30a34168f9247e46c9527757764cc4c5a63f4bdefd748
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2328-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-81-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2804-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-99-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2768-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1136-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-434-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2436-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1368-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1136-500-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1716-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-585-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2508-605-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2752-646-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2652-669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1368-750-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-774-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1416-784-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2824-932-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-946-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-965-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2904-997-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1840-1011-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1156 djdpv.exe 1268 fxlrxlr.exe 3056 jdvdp.exe 2060 llfrxxr.exe 2676 nhhtnb.exe 2728 9vdvv.exe 768 flxrfff.exe 2108 vdddv.exe 2804 7lrflrf.exe 2532 bhtnbb.exe 2608 1rxflff.exe 1028 nhtbht.exe 2768 7vdpv.exe 2892 frlrrxr.exe 824 9jjdj.exe 1152 dpvvd.exe 2764 nhtbhh.exe 1748 9nnthh.exe 1736 3fflxfr.exe 2248 hbnbhn.exe 1416 9bttbb.exe 1136 vpdvj.exe 2296 llrxlrf.exe 1120 ttnbnb.exe 844 vppvp.exe 1960 lfrflxf.exe 1500 btthbb.exe 1700 frlrflr.exe 2452 dpdjd.exe 1088 rrflrrl.exe 1432 5hnntn.exe 2360 rlrxrrf.exe 1548 nthhnb.exe 1944 pjpdp.exe 1912 dvddd.exe 3052 fxflxxf.exe 2864 nnhtnb.exe 2672 hbntbb.exe 700 9jdjd.exe 2688 flllllr.exe 2656 nhbhbn.exe 2568 pjvpv.exe 2560 xrxxffl.exe 2580 lxlrxxf.exe 2832 7hnhhh.exe 1864 pjvvv.exe 2700 frxxrrx.exe 2144 frlfffx.exe 1072 btbnhb.exe 2052 dpddp.exe 2892 3rflrrx.exe 2036 flxxffl.exe 2436 hbhbbt.exe 2792 9btthh.exe 1372 pdpvv.exe 1756 lfrrxxl.exe 1368 7nbtbb.exe 2956 htnhtn.exe 1420 jjvdj.exe 1568 fxfxxxf.exe 2056 hbnnhh.exe 1136 5bhhnn.exe 288 vvpvv.exe 1716 pjdjv.exe -
resource yara_rule behavioral1/memory/1156-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1136-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-353-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2560-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-646-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2652-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-750-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-775-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1616-774-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1548-849-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-932-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-939-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-946-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-984-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-997-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1840-1011-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 1156 2328 a21273f8d02387e2a58c1b9527c8c77c3538e088b0cae78962246faa45b71fd9.exe 30 PID 2328 wrote to memory of 1156 2328 a21273f8d02387e2a58c1b9527c8c77c3538e088b0cae78962246faa45b71fd9.exe 30 PID 2328 wrote to memory of 1156 2328 a21273f8d02387e2a58c1b9527c8c77c3538e088b0cae78962246faa45b71fd9.exe 30 PID 2328 wrote to memory of 1156 2328 a21273f8d02387e2a58c1b9527c8c77c3538e088b0cae78962246faa45b71fd9.exe 30 PID 1156 wrote to memory of 1268 1156 djdpv.exe 31 PID 1156 wrote to memory of 1268 1156 djdpv.exe 31 PID 1156 wrote to memory of 1268 1156 djdpv.exe 31 PID 1156 wrote to memory of 1268 1156 djdpv.exe 31 PID 1268 wrote to memory of 3056 1268 fxlrxlr.exe 32 PID 1268 wrote to memory of 3056 1268 fxlrxlr.exe 32 PID 1268 wrote to memory of 3056 1268 fxlrxlr.exe 32 PID 1268 wrote to memory of 3056 1268 fxlrxlr.exe 32 PID 3056 wrote to memory of 2060 3056 jdvdp.exe 33 PID 3056 wrote to memory of 2060 3056 jdvdp.exe 33 PID 3056 wrote to memory of 2060 3056 jdvdp.exe 33 PID 3056 wrote to memory of 2060 3056 jdvdp.exe 33 PID 2060 wrote to memory of 2676 2060 llfrxxr.exe 34 PID 2060 wrote to memory of 2676 2060 llfrxxr.exe 34 PID 2060 wrote to memory of 2676 2060 llfrxxr.exe 34 PID 2060 wrote to memory of 2676 2060 llfrxxr.exe 34 PID 2676 wrote to memory of 2728 2676 nhhtnb.exe 35 PID 2676 wrote to memory of 2728 2676 nhhtnb.exe 35 PID 2676 wrote to memory of 2728 2676 nhhtnb.exe 35 PID 2676 wrote to memory of 2728 2676 nhhtnb.exe 35 PID 2728 wrote to memory of 768 2728 9vdvv.exe 36 PID 2728 wrote to memory of 768 2728 9vdvv.exe 36 PID 2728 wrote to memory of 768 2728 9vdvv.exe 36 PID 2728 wrote to memory of 768 2728 9vdvv.exe 36 PID 768 wrote to memory of 2108 768 flxrfff.exe 37 PID 768 wrote to memory of 2108 768 flxrfff.exe 37 PID 768 wrote to memory of 2108 768 flxrfff.exe 37 PID 768 wrote to memory of 2108 768 flxrfff.exe 37 PID 2108 wrote to memory of 2804 2108 vdddv.exe 38 PID 2108 wrote to memory of 2804 2108 vdddv.exe 38 PID 2108 wrote to memory of 2804 2108 vdddv.exe 38 PID 2108 wrote to memory of 2804 2108 vdddv.exe 38 PID 2804 wrote to memory of 2532 2804 7lrflrf.exe 39 PID 2804 wrote to memory of 2532 2804 7lrflrf.exe 39 PID 2804 wrote to memory of 2532 2804 7lrflrf.exe 39 PID 2804 wrote to memory of 2532 2804 7lrflrf.exe 39 PID 2532 wrote to memory of 2608 2532 bhtnbb.exe 40 PID 2532 wrote to memory of 2608 2532 bhtnbb.exe 40 PID 2532 wrote to memory of 2608 2532 bhtnbb.exe 40 PID 2532 wrote to memory of 2608 2532 bhtnbb.exe 40 PID 2608 wrote to memory of 1028 2608 1rxflff.exe 41 PID 2608 wrote to memory of 1028 2608 1rxflff.exe 41 PID 2608 wrote to memory of 1028 2608 1rxflff.exe 41 PID 2608 wrote to memory of 1028 2608 1rxflff.exe 41 PID 1028 wrote to memory of 2768 1028 nhtbht.exe 42 PID 1028 wrote to memory of 2768 1028 nhtbht.exe 42 PID 1028 wrote to memory of 2768 1028 nhtbht.exe 42 PID 1028 wrote to memory of 2768 1028 nhtbht.exe 42 PID 2768 wrote to memory of 2892 2768 7vdpv.exe 43 PID 2768 wrote to memory of 2892 2768 7vdpv.exe 43 PID 2768 wrote to memory of 2892 2768 7vdpv.exe 43 PID 2768 wrote to memory of 2892 2768 7vdpv.exe 43 PID 2892 wrote to memory of 824 2892 frlrrxr.exe 44 PID 2892 wrote to memory of 824 2892 frlrrxr.exe 44 PID 2892 wrote to memory of 824 2892 frlrrxr.exe 44 PID 2892 wrote to memory of 824 2892 frlrrxr.exe 44 PID 824 wrote to memory of 1152 824 9jjdj.exe 45 PID 824 wrote to memory of 1152 824 9jjdj.exe 45 PID 824 wrote to memory of 1152 824 9jjdj.exe 45 PID 824 wrote to memory of 1152 824 9jjdj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a21273f8d02387e2a58c1b9527c8c77c3538e088b0cae78962246faa45b71fd9.exe"C:\Users\Admin\AppData\Local\Temp\a21273f8d02387e2a58c1b9527c8c77c3538e088b0cae78962246faa45b71fd9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\djdpv.exec:\djdpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\fxlrxlr.exec:\fxlrxlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\jdvdp.exec:\jdvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\llfrxxr.exec:\llfrxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\nhhtnb.exec:\nhhtnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\9vdvv.exec:\9vdvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\flxrfff.exec:\flxrfff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\vdddv.exec:\vdddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\7lrflrf.exec:\7lrflrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\bhtnbb.exec:\bhtnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\1rxflff.exec:\1rxflff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\nhtbht.exec:\nhtbht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\7vdpv.exec:\7vdpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\frlrrxr.exec:\frlrrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\9jjdj.exec:\9jjdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\dpvvd.exec:\dpvvd.exe17⤵
- Executes dropped EXE
PID:1152 -
\??\c:\nhtbhh.exec:\nhtbhh.exe18⤵
- Executes dropped EXE
PID:2764 -
\??\c:\9nnthh.exec:\9nnthh.exe19⤵
- Executes dropped EXE
PID:1748 -
\??\c:\3fflxfr.exec:\3fflxfr.exe20⤵
- Executes dropped EXE
PID:1736 -
\??\c:\hbnbhn.exec:\hbnbhn.exe21⤵
- Executes dropped EXE
PID:2248 -
\??\c:\9bttbb.exec:\9bttbb.exe22⤵
- Executes dropped EXE
PID:1416 -
\??\c:\vpdvj.exec:\vpdvj.exe23⤵
- Executes dropped EXE
PID:1136 -
\??\c:\llrxlrf.exec:\llrxlrf.exe24⤵
- Executes dropped EXE
PID:2296 -
\??\c:\ttnbnb.exec:\ttnbnb.exe25⤵
- Executes dropped EXE
PID:1120 -
\??\c:\vppvp.exec:\vppvp.exe26⤵
- Executes dropped EXE
PID:844 -
\??\c:\lfrflxf.exec:\lfrflxf.exe27⤵
- Executes dropped EXE
PID:1960 -
\??\c:\btthbb.exec:\btthbb.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1500 -
\??\c:\frlrflr.exec:\frlrflr.exe29⤵
- Executes dropped EXE
PID:1700 -
\??\c:\dpdjd.exec:\dpdjd.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2452 -
\??\c:\rrflrrl.exec:\rrflrrl.exe31⤵
- Executes dropped EXE
PID:1088 -
\??\c:\5hnntn.exec:\5hnntn.exe32⤵
- Executes dropped EXE
PID:1432 -
\??\c:\rlrxrrf.exec:\rlrxrrf.exe33⤵
- Executes dropped EXE
PID:2360 -
\??\c:\nthhnb.exec:\nthhnb.exe34⤵
- Executes dropped EXE
PID:1548 -
\??\c:\pjpdp.exec:\pjpdp.exe35⤵
- Executes dropped EXE
PID:1944 -
\??\c:\dvddd.exec:\dvddd.exe36⤵
- Executes dropped EXE
PID:1912 -
\??\c:\fxflxxf.exec:\fxflxxf.exe37⤵
- Executes dropped EXE
PID:3052 -
\??\c:\nnhtnb.exec:\nnhtnb.exe38⤵
- Executes dropped EXE
PID:2864 -
\??\c:\hbntbb.exec:\hbntbb.exe39⤵
- Executes dropped EXE
PID:2672 -
\??\c:\9jdjd.exec:\9jdjd.exe40⤵
- Executes dropped EXE
PID:700 -
\??\c:\flllllr.exec:\flllllr.exe41⤵
- Executes dropped EXE
PID:2688 -
\??\c:\nhbhbn.exec:\nhbhbn.exe42⤵
- Executes dropped EXE
PID:2656 -
\??\c:\pjvpv.exec:\pjvpv.exe43⤵
- Executes dropped EXE
PID:2568 -
\??\c:\xrxxffl.exec:\xrxxffl.exe44⤵
- Executes dropped EXE
PID:2560 -
\??\c:\lxlrxxf.exec:\lxlrxxf.exe45⤵
- Executes dropped EXE
PID:2580 -
\??\c:\7hnhhh.exec:\7hnhhh.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2832 -
\??\c:\pjvvv.exec:\pjvvv.exe47⤵
- Executes dropped EXE
PID:1864 -
\??\c:\frxxrrx.exec:\frxxrrx.exe48⤵
- Executes dropped EXE
PID:2700 -
\??\c:\frlfffx.exec:\frlfffx.exe49⤵
- Executes dropped EXE
PID:2144 -
\??\c:\btbnhb.exec:\btbnhb.exe50⤵
- Executes dropped EXE
PID:1072 -
\??\c:\dpddp.exec:\dpddp.exe51⤵
- Executes dropped EXE
PID:2052 -
\??\c:\3rflrrx.exec:\3rflrrx.exe52⤵
- Executes dropped EXE
PID:2892 -
\??\c:\flxxffl.exec:\flxxffl.exe53⤵
- Executes dropped EXE
PID:2036 -
\??\c:\hbhbbt.exec:\hbhbbt.exe54⤵
- Executes dropped EXE
PID:2436 -
\??\c:\9btthh.exec:\9btthh.exe55⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pdpvv.exec:\pdpvv.exe56⤵
- Executes dropped EXE
PID:1372 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe57⤵
- Executes dropped EXE
PID:1756 -
\??\c:\7nbtbb.exec:\7nbtbb.exe58⤵
- Executes dropped EXE
PID:1368 -
\??\c:\htnhtn.exec:\htnhtn.exe59⤵
- Executes dropped EXE
PID:2956 -
\??\c:\jjvdj.exec:\jjvdj.exe60⤵
- Executes dropped EXE
PID:1420 -
\??\c:\fxfxxxf.exec:\fxfxxxf.exe61⤵
- Executes dropped EXE
PID:1568 -
\??\c:\hbnnhh.exec:\hbnnhh.exe62⤵
- Executes dropped EXE
PID:2056 -
\??\c:\5bhhnn.exec:\5bhhnn.exe63⤵
- Executes dropped EXE
PID:1136 -
\??\c:\vvpvv.exec:\vvpvv.exe64⤵
- Executes dropped EXE
PID:288 -
\??\c:\pjdjv.exec:\pjdjv.exe65⤵
- Executes dropped EXE
PID:1716 -
\??\c:\fxllxxl.exec:\fxllxxl.exe66⤵PID:2400
-
\??\c:\nhnttt.exec:\nhnttt.exe67⤵PID:1644
-
\??\c:\pjjjp.exec:\pjjjp.exe68⤵PID:1960
-
\??\c:\3vjdd.exec:\3vjdd.exe69⤵PID:2132
-
\??\c:\7rxxxrr.exec:\7rxxxrr.exe70⤵PID:2316
-
\??\c:\nhnthh.exec:\nhnthh.exe71⤵PID:2216
-
\??\c:\9vjdp.exec:\9vjdp.exe72⤵PID:812
-
\??\c:\pjvvd.exec:\pjvvd.exe73⤵PID:884
-
\??\c:\lfrrffr.exec:\lfrrffr.exe74⤵PID:2192
-
\??\c:\btnhbh.exec:\btnhbh.exe75⤵PID:1556
-
\??\c:\bhnbhb.exec:\bhnbhb.exe76⤵PID:2508
-
\??\c:\djvjv.exec:\djvjv.exe77⤵PID:1660
-
\??\c:\lrxlllx.exec:\lrxlllx.exe78⤵PID:2468
-
\??\c:\lxllrrr.exec:\lxllrrr.exe79⤵PID:1268
-
\??\c:\7hbbbb.exec:\7hbbbb.exe80⤵PID:3056
-
\??\c:\5dvdj.exec:\5dvdj.exe81⤵PID:2060
-
\??\c:\dpjjj.exec:\dpjjj.exe82⤵PID:2672
-
\??\c:\frxxxxf.exec:\frxxxxf.exe83⤵PID:2660
-
\??\c:\5tnhnn.exec:\5tnhnn.exe84⤵PID:2688
-
\??\c:\1nbbbb.exec:\1nbbbb.exe85⤵PID:2656
-
\??\c:\dpjpd.exec:\dpjpd.exe86⤵PID:2752
-
\??\c:\rflffll.exec:\rflffll.exe87⤵PID:2856
-
\??\c:\nbttbb.exec:\nbttbb.exe88⤵PID:2668
-
\??\c:\1htbhb.exec:\1htbhb.exe89⤵PID:2832
-
\??\c:\1jdpv.exec:\1jdpv.exe90⤵PID:2652
-
\??\c:\lfxxlxr.exec:\lfxxlxr.exe91⤵PID:2152
-
\??\c:\5rrflrl.exec:\5rrflrl.exe92⤵PID:1252
-
\??\c:\bthtbh.exec:\bthtbh.exe93⤵PID:1380
-
\??\c:\7jvvd.exec:\7jvvd.exe94⤵PID:2768
-
\??\c:\jjvjv.exec:\jjvjv.exe95⤵PID:2504
-
\??\c:\5lxrrll.exec:\5lxrrll.exe96⤵PID:2784
-
\??\c:\bbbhnt.exec:\bbbhnt.exe97⤵PID:2900
-
\??\c:\vpdpp.exec:\vpdpp.exe98⤵PID:1728
-
\??\c:\jjvvj.exec:\jjvvj.exe99⤵PID:2792
-
\??\c:\xllffff.exec:\xllffff.exe100⤵PID:1748
-
\??\c:\1xxffrl.exec:\1xxffrl.exe101⤵PID:1756
-
\??\c:\hbhtbh.exec:\hbhtbh.exe102⤵PID:1368
-
\??\c:\jdddv.exec:\jdddv.exe103⤵PID:2248
-
\??\c:\llfflrx.exec:\llfflrx.exe104⤵PID:1416
-
\??\c:\nntbbb.exec:\nntbbb.exe105⤵PID:3064
-
\??\c:\bbtbnb.exec:\bbtbnb.exe106⤵PID:1616
-
\??\c:\5pjpj.exec:\5pjpj.exe107⤵PID:1044
-
\??\c:\lllrrxx.exec:\lllrrxx.exe108⤵PID:1624
-
\??\c:\tnhhbh.exec:\tnhhbh.exe109⤵PID:908
-
\??\c:\9hbbhn.exec:\9hbbhn.exe110⤵PID:108
-
\??\c:\vvpvp.exec:\vvpvp.exe111⤵PID:784
-
\??\c:\xxxlrxl.exec:\xxxlrxl.exe112⤵PID:580
-
\??\c:\llfrxlx.exec:\llfrxlx.exe113⤵PID:1700
-
\??\c:\5bntbh.exec:\5bntbh.exe114⤵PID:1572
-
\??\c:\dvpvj.exec:\dvpvj.exe115⤵PID:2456
-
\??\c:\pjjdv.exec:\pjjdv.exe116⤵PID:2204
-
\??\c:\xrlrfll.exec:\xrlrfll.exe117⤵PID:592
-
\??\c:\hnnnbt.exec:\hnnnbt.exe118⤵PID:2192
-
\??\c:\dvvvv.exec:\dvvvv.exe119⤵PID:1548
-
\??\c:\rlffxfr.exec:\rlffxfr.exe120⤵PID:2336
-
\??\c:\flfxfrf.exec:\flfxfrf.exe121⤵PID:2460
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-