Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 06:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
36ea78b5773a42b80c056a2df2ba8115e3bca17bea7e7b766d8ae02faf6c95be.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
36ea78b5773a42b80c056a2df2ba8115e3bca17bea7e7b766d8ae02faf6c95be.exe
-
Size
453KB
-
MD5
c7de20458ec2302bc9ff3342155be17e
-
SHA1
6622ce91feaca16de49c29a0e034eaa86cbc1979
-
SHA256
36ea78b5773a42b80c056a2df2ba8115e3bca17bea7e7b766d8ae02faf6c95be
-
SHA512
0d13aecc2d19520d805a8d3bc962ca03622de87b12ce2029ef5c8241b283651cf1b21aca734293199169b59ecb514108c511db71352e6d0d12a8b5ed6f55497e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbev:q7Tc2NYHUrAwfMp3CDv
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2516-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-114-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1556-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-148-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/332-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-189-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2308-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1188-210-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1104-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-299-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2008-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-306-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1536-308-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1728-314-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2552-318-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2868-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-367-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2740-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-373-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1456-391-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2624-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/704-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-465-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2228-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-572-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2764-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/328-716-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1324-723-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-786-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/1580-792-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2156-873-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1544 dvjdv.exe 2528 1rrllrf.exe 2160 nbbhth.exe 2272 ffxlxfr.exe 2864 nhthnt.exe 2768 rrffrxl.exe 3020 rrflxfl.exe 2948 jjdjv.exe 2736 rlxfrrf.exe 2696 jddjv.exe 1664 5jdjv.exe 1556 nbhnnb.exe 2928 1vdpd.exe 1636 hnbhht.exe 2820 dpjvj.exe 332 bntbtn.exe 996 djjpp.exe 2004 5xrrxfx.exe 2308 tbbnbh.exe 2420 xxlxllx.exe 1188 tnntnt.exe 2572 rrllrrx.exe 1104 rflrrrx.exe 1516 7jjjv.exe 2368 rlfrxxf.exe 764 btbhnt.exe 3056 pvvpp.exe 3068 thbtth.exe 1876 ddpdv.exe 884 lxlrllx.exe 2008 tnbnht.exe 1536 lfrrfxl.exe 1728 bnhbht.exe 2552 9jjvj.exe 2716 lrxlfrl.exe 2868 5ntbtb.exe 2752 djddd.exe 2756 5lflxxl.exe 2768 lxrlflx.exe 2932 nhbbhn.exe 2740 hhbtbb.exe 2676 dvpdj.exe 2652 1fxxlff.exe 1456 hnhthb.exe 1512 pjdjp.exe 2624 rrxxxfl.exe 704 lflfllx.exe 2964 nnbbhn.exe 2608 pjjvj.exe 2032 xflxfxf.exe 328 7bbhtb.exe 1324 hhbnnt.exe 1852 jddpd.exe 1860 ffxxffr.exe 2036 1htbnt.exe 2092 nnhnnn.exe 2308 jdvpv.exe 2420 rxlllff.exe 2536 5httht.exe 2208 tnhhbh.exe 3052 ppdjd.exe 408 lfxfffl.exe 1808 llffrrf.exe 2228 tnbntt.exe -
resource yara_rule behavioral1/memory/2516-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-114-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/1556-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/704-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-465-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/408-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-723-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-873-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2220-881-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-889-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-914-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2516 wrote to memory of 1544 2516 36ea78b5773a42b80c056a2df2ba8115e3bca17bea7e7b766d8ae02faf6c95be.exe 30 PID 2516 wrote to memory of 1544 2516 36ea78b5773a42b80c056a2df2ba8115e3bca17bea7e7b766d8ae02faf6c95be.exe 30 PID 2516 wrote to memory of 1544 2516 36ea78b5773a42b80c056a2df2ba8115e3bca17bea7e7b766d8ae02faf6c95be.exe 30 PID 2516 wrote to memory of 1544 2516 36ea78b5773a42b80c056a2df2ba8115e3bca17bea7e7b766d8ae02faf6c95be.exe 30 PID 1544 wrote to memory of 2528 1544 dvjdv.exe 31 PID 1544 wrote to memory of 2528 1544 dvjdv.exe 31 PID 1544 wrote to memory of 2528 1544 dvjdv.exe 31 PID 1544 wrote to memory of 2528 1544 dvjdv.exe 31 PID 2528 wrote to memory of 2160 2528 1rrllrf.exe 32 PID 2528 wrote to memory of 2160 2528 1rrllrf.exe 32 PID 2528 wrote to memory of 2160 2528 1rrllrf.exe 32 PID 2528 wrote to memory of 2160 2528 1rrllrf.exe 32 PID 2160 wrote to memory of 2272 2160 nbbhth.exe 33 PID 2160 wrote to memory of 2272 2160 nbbhth.exe 33 PID 2160 wrote to memory of 2272 2160 nbbhth.exe 33 PID 2160 wrote to memory of 2272 2160 nbbhth.exe 33 PID 2272 wrote to memory of 2864 2272 ffxlxfr.exe 34 PID 2272 wrote to memory of 2864 2272 ffxlxfr.exe 34 PID 2272 wrote to memory of 2864 2272 ffxlxfr.exe 34 PID 2272 wrote to memory of 2864 2272 ffxlxfr.exe 34 PID 2864 wrote to memory of 2768 2864 nhthnt.exe 35 PID 2864 wrote to memory of 2768 2864 nhthnt.exe 35 PID 2864 wrote to memory of 2768 2864 nhthnt.exe 35 PID 2864 wrote to memory of 2768 2864 nhthnt.exe 35 PID 2768 wrote to memory of 3020 2768 rrffrxl.exe 36 PID 2768 wrote to memory of 3020 2768 rrffrxl.exe 36 PID 2768 wrote to memory of 3020 2768 rrffrxl.exe 36 PID 2768 wrote to memory of 3020 2768 rrffrxl.exe 36 PID 3020 wrote to memory of 2948 3020 rrflxfl.exe 37 PID 3020 wrote to memory of 2948 3020 rrflxfl.exe 37 PID 3020 wrote to memory of 2948 3020 rrflxfl.exe 37 PID 3020 wrote to memory of 2948 3020 rrflxfl.exe 37 PID 2948 wrote to memory of 2736 2948 jjdjv.exe 38 PID 2948 wrote to memory of 2736 2948 jjdjv.exe 38 PID 2948 wrote to memory of 2736 2948 jjdjv.exe 38 PID 2948 wrote to memory of 2736 2948 jjdjv.exe 38 PID 2736 wrote to memory of 2696 2736 rlxfrrf.exe 39 PID 2736 wrote to memory of 2696 2736 rlxfrrf.exe 39 PID 2736 wrote to memory of 2696 2736 rlxfrrf.exe 39 PID 2736 wrote to memory of 2696 2736 rlxfrrf.exe 39 PID 2696 wrote to memory of 1664 2696 jddjv.exe 40 PID 2696 wrote to memory of 1664 2696 jddjv.exe 40 PID 2696 wrote to memory of 1664 2696 jddjv.exe 40 PID 2696 wrote to memory of 1664 2696 jddjv.exe 40 PID 1664 wrote to memory of 1556 1664 5jdjv.exe 41 PID 1664 wrote to memory of 1556 1664 5jdjv.exe 41 PID 1664 wrote to memory of 1556 1664 5jdjv.exe 41 PID 1664 wrote to memory of 1556 1664 5jdjv.exe 41 PID 1556 wrote to memory of 2928 1556 nbhnnb.exe 42 PID 1556 wrote to memory of 2928 1556 nbhnnb.exe 42 PID 1556 wrote to memory of 2928 1556 nbhnnb.exe 42 PID 1556 wrote to memory of 2928 1556 nbhnnb.exe 42 PID 2928 wrote to memory of 1636 2928 1vdpd.exe 43 PID 2928 wrote to memory of 1636 2928 1vdpd.exe 43 PID 2928 wrote to memory of 1636 2928 1vdpd.exe 43 PID 2928 wrote to memory of 1636 2928 1vdpd.exe 43 PID 1636 wrote to memory of 2820 1636 hnbhht.exe 44 PID 1636 wrote to memory of 2820 1636 hnbhht.exe 44 PID 1636 wrote to memory of 2820 1636 hnbhht.exe 44 PID 1636 wrote to memory of 2820 1636 hnbhht.exe 44 PID 2820 wrote to memory of 332 2820 dpjvj.exe 45 PID 2820 wrote to memory of 332 2820 dpjvj.exe 45 PID 2820 wrote to memory of 332 2820 dpjvj.exe 45 PID 2820 wrote to memory of 332 2820 dpjvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\36ea78b5773a42b80c056a2df2ba8115e3bca17bea7e7b766d8ae02faf6c95be.exe"C:\Users\Admin\AppData\Local\Temp\36ea78b5773a42b80c056a2df2ba8115e3bca17bea7e7b766d8ae02faf6c95be.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\dvjdv.exec:\dvjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\1rrllrf.exec:\1rrllrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\nbbhth.exec:\nbbhth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\ffxlxfr.exec:\ffxlxfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\nhthnt.exec:\nhthnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\rrffrxl.exec:\rrffrxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\rrflxfl.exec:\rrflxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\jjdjv.exec:\jjdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\rlxfrrf.exec:\rlxfrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\jddjv.exec:\jddjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\5jdjv.exec:\5jdjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\nbhnnb.exec:\nbhnnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\1vdpd.exec:\1vdpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\hnbhht.exec:\hnbhht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\dpjvj.exec:\dpjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\bntbtn.exec:\bntbtn.exe17⤵
- Executes dropped EXE
PID:332 -
\??\c:\djjpp.exec:\djjpp.exe18⤵
- Executes dropped EXE
PID:996 -
\??\c:\5xrrxfx.exec:\5xrrxfx.exe19⤵
- Executes dropped EXE
PID:2004 -
\??\c:\tbbnbh.exec:\tbbnbh.exe20⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xxlxllx.exec:\xxlxllx.exe21⤵
- Executes dropped EXE
PID:2420 -
\??\c:\tnntnt.exec:\tnntnt.exe22⤵
- Executes dropped EXE
PID:1188 -
\??\c:\rrllrrx.exec:\rrllrrx.exe23⤵
- Executes dropped EXE
PID:2572 -
\??\c:\rflrrrx.exec:\rflrrrx.exe24⤵
- Executes dropped EXE
PID:1104 -
\??\c:\7jjjv.exec:\7jjjv.exe25⤵
- Executes dropped EXE
PID:1516 -
\??\c:\rlfrxxf.exec:\rlfrxxf.exe26⤵
- Executes dropped EXE
PID:2368 -
\??\c:\btbhnt.exec:\btbhnt.exe27⤵
- Executes dropped EXE
PID:764 -
\??\c:\pvvpp.exec:\pvvpp.exe28⤵
- Executes dropped EXE
PID:3056 -
\??\c:\thbtth.exec:\thbtth.exe29⤵
- Executes dropped EXE
PID:3068 -
\??\c:\ddpdv.exec:\ddpdv.exe30⤵
- Executes dropped EXE
PID:1876 -
\??\c:\lxlrllx.exec:\lxlrllx.exe31⤵
- Executes dropped EXE
PID:884 -
\??\c:\tnbnht.exec:\tnbnht.exe32⤵
- Executes dropped EXE
PID:2008 -
\??\c:\lfrrfxl.exec:\lfrrfxl.exe33⤵
- Executes dropped EXE
PID:1536 -
\??\c:\bnhbht.exec:\bnhbht.exe34⤵
- Executes dropped EXE
PID:1728 -
\??\c:\9jjvj.exec:\9jjvj.exe35⤵
- Executes dropped EXE
PID:2552 -
\??\c:\lrxlfrl.exec:\lrxlfrl.exe36⤵
- Executes dropped EXE
PID:2716 -
\??\c:\5ntbtb.exec:\5ntbtb.exe37⤵
- Executes dropped EXE
PID:2868 -
\??\c:\djddd.exec:\djddd.exe38⤵
- Executes dropped EXE
PID:2752 -
\??\c:\5lflxxl.exec:\5lflxxl.exe39⤵
- Executes dropped EXE
PID:2756 -
\??\c:\lxrlflx.exec:\lxrlflx.exe40⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nhbbhn.exec:\nhbbhn.exe41⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hhbtbb.exec:\hhbtbb.exe42⤵
- Executes dropped EXE
PID:2740 -
\??\c:\dvpdj.exec:\dvpdj.exe43⤵
- Executes dropped EXE
PID:2676 -
\??\c:\1fxxlff.exec:\1fxxlff.exe44⤵
- Executes dropped EXE
PID:2652 -
\??\c:\hnhthb.exec:\hnhthb.exe45⤵
- Executes dropped EXE
PID:1456 -
\??\c:\pjdjp.exec:\pjdjp.exe46⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rrxxxfl.exec:\rrxxxfl.exe47⤵
- Executes dropped EXE
PID:2624 -
\??\c:\lflfllx.exec:\lflfllx.exe48⤵
- Executes dropped EXE
PID:704 -
\??\c:\nnbbhn.exec:\nnbbhn.exe49⤵
- Executes dropped EXE
PID:2964 -
\??\c:\pjjvj.exec:\pjjvj.exe50⤵
- Executes dropped EXE
PID:2608 -
\??\c:\xflxfxf.exec:\xflxfxf.exe51⤵
- Executes dropped EXE
PID:2032 -
\??\c:\7bbhtb.exec:\7bbhtb.exe52⤵
- Executes dropped EXE
PID:328 -
\??\c:\hhbnnt.exec:\hhbnnt.exe53⤵
- Executes dropped EXE
PID:1324 -
\??\c:\jddpd.exec:\jddpd.exe54⤵
- Executes dropped EXE
PID:1852 -
\??\c:\ffxxffr.exec:\ffxxffr.exe55⤵
- Executes dropped EXE
PID:1860 -
\??\c:\1htbnt.exec:\1htbnt.exe56⤵
- Executes dropped EXE
PID:2036 -
\??\c:\nnhnnn.exec:\nnhnnn.exe57⤵
- Executes dropped EXE
PID:2092 -
\??\c:\jdvpv.exec:\jdvpv.exe58⤵
- Executes dropped EXE
PID:2308 -
\??\c:\rxlllff.exec:\rxlllff.exe59⤵
- Executes dropped EXE
PID:2420 -
\??\c:\5httht.exec:\5httht.exe60⤵
- Executes dropped EXE
PID:2536 -
\??\c:\tnhhbh.exec:\tnhhbh.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2208 -
\??\c:\ppdjd.exec:\ppdjd.exe62⤵
- Executes dropped EXE
PID:3052 -
\??\c:\lfxfffl.exec:\lfxfffl.exe63⤵
- Executes dropped EXE
PID:408 -
\??\c:\llffrrf.exec:\llffrrf.exe64⤵
- Executes dropped EXE
PID:1808 -
\??\c:\tnbntt.exec:\tnbntt.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2228 -
\??\c:\dvpvj.exec:\dvpvj.exe66⤵PID:2452
-
\??\c:\5llrlrl.exec:\5llrlrl.exe67⤵PID:2084
-
\??\c:\fxrxflf.exec:\fxrxflf.exe68⤵PID:2660
-
\??\c:\hbnbnt.exec:\hbnbnt.exe69⤵PID:2436
-
\??\c:\pdppp.exec:\pdppp.exe70⤵PID:2324
-
\??\c:\flffflr.exec:\flffflr.exe71⤵PID:2548
-
\??\c:\llffllr.exec:\llffllr.exe72⤵PID:2184
-
\??\c:\nbnthh.exec:\nbnthh.exe73⤵PID:1992
-
\??\c:\tthbhn.exec:\tthbhn.exe74⤵PID:1532
-
\??\c:\vvvjp.exec:\vvvjp.exe75⤵PID:1536
-
\??\c:\rrxflxl.exec:\rrxflxl.exe76⤵PID:1252
-
\??\c:\9ttbhb.exec:\9ttbhb.exe77⤵PID:2936
-
\??\c:\ppjjj.exec:\ppjjj.exe78⤵PID:2220
-
\??\c:\fxrrxfr.exec:\fxrrxfr.exe79⤵PID:2856
-
\??\c:\fxxxlrl.exec:\fxxxlrl.exe80⤵PID:2764
-
\??\c:\hhhnbh.exec:\hhhnbh.exe81⤵PID:2748
-
\??\c:\ppdjv.exec:\ppdjv.exe82⤵
- System Location Discovery: System Language Discovery
PID:2852 -
\??\c:\jpjjp.exec:\jpjjp.exe83⤵PID:2848
-
\??\c:\rrrfxxx.exec:\rrrfxxx.exe84⤵PID:3020
-
\??\c:\1tnhhn.exec:\1tnhhn.exe85⤵PID:2676
-
\??\c:\jppvp.exec:\jppvp.exe86⤵PID:2844
-
\??\c:\vpjjv.exec:\vpjjv.exe87⤵PID:2504
-
\??\c:\rxxxrxr.exec:\rxxxrxr.exe88⤵PID:1624
-
\??\c:\7thhnn.exec:\7thhnn.exe89⤵PID:1444
-
\??\c:\nhtnnn.exec:\nhtnnn.exe90⤵PID:2924
-
\??\c:\jdppd.exec:\jdppd.exe91⤵PID:1588
-
\??\c:\5llxxrx.exec:\5llxxrx.exe92⤵PID:2836
-
\??\c:\xxflxfr.exec:\xxflxfr.exe93⤵PID:796
-
\??\c:\tnnbnb.exec:\tnnbnb.exe94⤵PID:752
-
\??\c:\jdvvp.exec:\jdvvp.exe95⤵PID:328
-
\??\c:\9vpvd.exec:\9vpvd.exe96⤵PID:1324
-
\??\c:\fxlrfll.exec:\fxlrfll.exe97⤵PID:1164
-
\??\c:\tnnnth.exec:\tnnnth.exe98⤵PID:2188
-
\??\c:\ntnhtn.exec:\ntnhtn.exe99⤵PID:2380
-
\??\c:\vjjjj.exec:\vjjjj.exe100⤵PID:1704
-
\??\c:\xrllrxl.exec:\xrllrxl.exe101⤵PID:2320
-
\??\c:\rlxllrf.exec:\rlxllrf.exe102⤵PID:2420
-
\??\c:\tnbnbb.exec:\tnbnbb.exe103⤵PID:2536
-
\??\c:\btnnbb.exec:\btnnbb.exe104⤵PID:2208
-
\??\c:\jdvjd.exec:\jdvjd.exe105⤵PID:3052
-
\??\c:\rrxxffx.exec:\rrxxffx.exe106⤵PID:956
-
\??\c:\htbtth.exec:\htbtth.exe107⤵PID:1580
-
\??\c:\nnhbth.exec:\nnhbth.exe108⤵PID:2840
-
\??\c:\dvppv.exec:\dvppv.exe109⤵PID:1796
-
\??\c:\rlxrflr.exec:\rlxrflr.exe110⤵PID:2108
-
\??\c:\llxfllx.exec:\llxfllx.exe111⤵PID:3068
-
\??\c:\nbnbbh.exec:\nbnbbh.exe112⤵PID:1864
-
\??\c:\vvppd.exec:\vvppd.exe113⤵PID:2132
-
\??\c:\lrllflx.exec:\lrllflx.exe114⤵PID:2516
-
\??\c:\7hhbnb.exec:\7hhbnb.exe115⤵PID:2184
-
\??\c:\bhhnhn.exec:\bhhnhn.exe116⤵PID:2008
-
\??\c:\dvjjv.exec:\dvjjv.exe117⤵PID:2156
-
\??\c:\9frxflx.exec:\9frxflx.exe118⤵PID:1688
-
\??\c:\llxlxrl.exec:\llxlxrl.exe119⤵PID:2552
-
\??\c:\tnbhnb.exec:\tnbhnb.exe120⤵PID:2256
-
\??\c:\nnhbht.exec:\nnhbht.exe121⤵PID:2500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-