Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 07:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fca50a8eb3d09f7dcf1a385bb7e2e7b401cf744fc67d6b5be8657ca1c99e4855.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
fca50a8eb3d09f7dcf1a385bb7e2e7b401cf744fc67d6b5be8657ca1c99e4855.exe
-
Size
454KB
-
MD5
75b45440c68a77a22eb034a20d23183c
-
SHA1
62bab74060808fc285ba0dbddfc00a9c98be90e2
-
SHA256
fca50a8eb3d09f7dcf1a385bb7e2e7b401cf744fc67d6b5be8657ca1c99e4855
-
SHA512
5628817e192c2ab362f029dbcdf4ab7b434abec7e4dc0c8cfb0cfb3c654c0d3dd461e7e584a89653853a8be19548627e9ad6240c63012b84e505894991bcf556
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbee:q7Tc2NYHUrAwfMp3CDe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2148-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-91-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/3048-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-122-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2928-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-132-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2552-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-204-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/284-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/284-216-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1868-222-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1924-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-240-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2024-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-276-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2428-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/596-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/596-307-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1912-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-376-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2628-382-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2860-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-460-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1328-480-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1944-486-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1372-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-551-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1584-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-665-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3048-686-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/840-706-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-918-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-976-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1960-1032-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1924-1047-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2112 3tnhth.exe 2176 5bntbh.exe 2276 dvdvd.exe 2232 xlrlrrr.exe 2792 jvdvd.exe 2740 lrxxfrl.exe 2332 vjjvv.exe 2712 rfrflff.exe 2908 7tnnnh.exe 2652 vjvjj.exe 2668 7nhhth.exe 3048 pppdd.exe 2928 flfxlrl.exe 2060 bhttbt.exe 2552 rrrxrff.exe 2584 5tbnbh.exe 1628 7lxfrxl.exe 1308 bbtbnt.exe 2144 rrlflrl.exe 2396 xfxxflx.exe 1264 vpddv.exe 284 rxrllxr.exe 1868 flxxrxl.exe 1924 llrfflx.exe 912 djpjd.exe 2024 lrlxxlf.exe 1064 3pvdp.exe 2344 bbbnht.exe 2428 djjvj.exe 2488 fffrrrf.exe 2676 tnnhbt.exe 596 3fxlrfr.exe 2184 djjpv.exe 2500 xrxxrxf.exe 1912 hbnbbb.exe 2688 vvjjv.exe 1272 fxllrrr.exe 2800 btttbb.exe 2748 nbhbhb.exe 2432 vdpjd.exe 2832 xrlxflf.exe 2012 nttbnh.exe 2708 dvjpj.exe 2628 jjdpp.exe 3044 xrrfxfx.exe 2860 bhnntn.exe 1036 djvdj.exe 868 9pvvp.exe 2312 xlxfrrf.exe 1956 hbhnhn.exe 820 nnnbnb.exe 1684 5jddj.exe 1620 fxxrrrx.exe 1252 1tnbnt.exe 1304 hhbnbn.exe 3028 fxllxxl.exe 2388 rlxxfrx.exe 1328 9bbbnh.exe 1944 vvpdp.exe 2528 llxrxlr.exe 908 fxrxflx.exe 1248 hhnbhn.exe 1676 3dvdv.exe 1372 ppvvv.exe -
resource yara_rule behavioral1/memory/2112-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-216-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1924-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-307-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1912-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-494-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/1372-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-551-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1584-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-665-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/3048-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-686-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/840-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-893-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-918-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/636-937-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-950-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-1020-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-1047-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2148 wrote to memory of 2112 2148 fca50a8eb3d09f7dcf1a385bb7e2e7b401cf744fc67d6b5be8657ca1c99e4855.exe 30 PID 2148 wrote to memory of 2112 2148 fca50a8eb3d09f7dcf1a385bb7e2e7b401cf744fc67d6b5be8657ca1c99e4855.exe 30 PID 2148 wrote to memory of 2112 2148 fca50a8eb3d09f7dcf1a385bb7e2e7b401cf744fc67d6b5be8657ca1c99e4855.exe 30 PID 2148 wrote to memory of 2112 2148 fca50a8eb3d09f7dcf1a385bb7e2e7b401cf744fc67d6b5be8657ca1c99e4855.exe 30 PID 2112 wrote to memory of 2176 2112 3tnhth.exe 31 PID 2112 wrote to memory of 2176 2112 3tnhth.exe 31 PID 2112 wrote to memory of 2176 2112 3tnhth.exe 31 PID 2112 wrote to memory of 2176 2112 3tnhth.exe 31 PID 2176 wrote to memory of 2276 2176 5bntbh.exe 32 PID 2176 wrote to memory of 2276 2176 5bntbh.exe 32 PID 2176 wrote to memory of 2276 2176 5bntbh.exe 32 PID 2176 wrote to memory of 2276 2176 5bntbh.exe 32 PID 2276 wrote to memory of 2232 2276 dvdvd.exe 33 PID 2276 wrote to memory of 2232 2276 dvdvd.exe 33 PID 2276 wrote to memory of 2232 2276 dvdvd.exe 33 PID 2276 wrote to memory of 2232 2276 dvdvd.exe 33 PID 2232 wrote to memory of 2792 2232 xlrlrrr.exe 34 PID 2232 wrote to memory of 2792 2232 xlrlrrr.exe 34 PID 2232 wrote to memory of 2792 2232 xlrlrrr.exe 34 PID 2232 wrote to memory of 2792 2232 xlrlrrr.exe 34 PID 2792 wrote to memory of 2740 2792 jvdvd.exe 35 PID 2792 wrote to memory of 2740 2792 jvdvd.exe 35 PID 2792 wrote to memory of 2740 2792 jvdvd.exe 35 PID 2792 wrote to memory of 2740 2792 jvdvd.exe 35 PID 2740 wrote to memory of 2332 2740 lrxxfrl.exe 36 PID 2740 wrote to memory of 2332 2740 lrxxfrl.exe 36 PID 2740 wrote to memory of 2332 2740 lrxxfrl.exe 36 PID 2740 wrote to memory of 2332 2740 lrxxfrl.exe 36 PID 2332 wrote to memory of 2712 2332 vjjvv.exe 37 PID 2332 wrote to memory of 2712 2332 vjjvv.exe 37 PID 2332 wrote to memory of 2712 2332 vjjvv.exe 37 PID 2332 wrote to memory of 2712 2332 vjjvv.exe 37 PID 2712 wrote to memory of 2908 2712 rfrflff.exe 38 PID 2712 wrote to memory of 2908 2712 rfrflff.exe 38 PID 2712 wrote to memory of 2908 2712 rfrflff.exe 38 PID 2712 wrote to memory of 2908 2712 rfrflff.exe 38 PID 2908 wrote to memory of 2652 2908 7tnnnh.exe 39 PID 2908 wrote to memory of 2652 2908 7tnnnh.exe 39 PID 2908 wrote to memory of 2652 2908 7tnnnh.exe 39 PID 2908 wrote to memory of 2652 2908 7tnnnh.exe 39 PID 2652 wrote to memory of 2668 2652 vjvjj.exe 40 PID 2652 wrote to memory of 2668 2652 vjvjj.exe 40 PID 2652 wrote to memory of 2668 2652 vjvjj.exe 40 PID 2652 wrote to memory of 2668 2652 vjvjj.exe 40 PID 2668 wrote to memory of 3048 2668 7nhhth.exe 41 PID 2668 wrote to memory of 3048 2668 7nhhth.exe 41 PID 2668 wrote to memory of 3048 2668 7nhhth.exe 41 PID 2668 wrote to memory of 3048 2668 7nhhth.exe 41 PID 3048 wrote to memory of 2928 3048 pppdd.exe 42 PID 3048 wrote to memory of 2928 3048 pppdd.exe 42 PID 3048 wrote to memory of 2928 3048 pppdd.exe 42 PID 3048 wrote to memory of 2928 3048 pppdd.exe 42 PID 2928 wrote to memory of 2060 2928 flfxlrl.exe 43 PID 2928 wrote to memory of 2060 2928 flfxlrl.exe 43 PID 2928 wrote to memory of 2060 2928 flfxlrl.exe 43 PID 2928 wrote to memory of 2060 2928 flfxlrl.exe 43 PID 2060 wrote to memory of 2552 2060 bhttbt.exe 44 PID 2060 wrote to memory of 2552 2060 bhttbt.exe 44 PID 2060 wrote to memory of 2552 2060 bhttbt.exe 44 PID 2060 wrote to memory of 2552 2060 bhttbt.exe 44 PID 2552 wrote to memory of 2584 2552 rrrxrff.exe 45 PID 2552 wrote to memory of 2584 2552 rrrxrff.exe 45 PID 2552 wrote to memory of 2584 2552 rrrxrff.exe 45 PID 2552 wrote to memory of 2584 2552 rrrxrff.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fca50a8eb3d09f7dcf1a385bb7e2e7b401cf744fc67d6b5be8657ca1c99e4855.exe"C:\Users\Admin\AppData\Local\Temp\fca50a8eb3d09f7dcf1a385bb7e2e7b401cf744fc67d6b5be8657ca1c99e4855.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\3tnhth.exec:\3tnhth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\5bntbh.exec:\5bntbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\dvdvd.exec:\dvdvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\xlrlrrr.exec:\xlrlrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\jvdvd.exec:\jvdvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\lrxxfrl.exec:\lrxxfrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\vjjvv.exec:\vjjvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\rfrflff.exec:\rfrflff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\7tnnnh.exec:\7tnnnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\vjvjj.exec:\vjvjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\7nhhth.exec:\7nhhth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\pppdd.exec:\pppdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\flfxlrl.exec:\flfxlrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\bhttbt.exec:\bhttbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\rrrxrff.exec:\rrrxrff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\5tbnbh.exec:\5tbnbh.exe17⤵
- Executes dropped EXE
PID:2584 -
\??\c:\7lxfrxl.exec:\7lxfrxl.exe18⤵
- Executes dropped EXE
PID:1628 -
\??\c:\bbtbnt.exec:\bbtbnt.exe19⤵
- Executes dropped EXE
PID:1308 -
\??\c:\rrlflrl.exec:\rrlflrl.exe20⤵
- Executes dropped EXE
PID:2144 -
\??\c:\xfxxflx.exec:\xfxxflx.exe21⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vpddv.exec:\vpddv.exe22⤵
- Executes dropped EXE
PID:1264 -
\??\c:\rxrllxr.exec:\rxrllxr.exe23⤵
- Executes dropped EXE
PID:284 -
\??\c:\flxxrxl.exec:\flxxrxl.exe24⤵
- Executes dropped EXE
PID:1868 -
\??\c:\llrfflx.exec:\llrfflx.exe25⤵
- Executes dropped EXE
PID:1924 -
\??\c:\djpjd.exec:\djpjd.exe26⤵
- Executes dropped EXE
PID:912 -
\??\c:\lrlxxlf.exec:\lrlxxlf.exe27⤵
- Executes dropped EXE
PID:2024 -
\??\c:\3pvdp.exec:\3pvdp.exe28⤵
- Executes dropped EXE
PID:1064 -
\??\c:\bbbnht.exec:\bbbnht.exe29⤵
- Executes dropped EXE
PID:2344 -
\??\c:\djjvj.exec:\djjvj.exe30⤵
- Executes dropped EXE
PID:2428 -
\??\c:\fffrrrf.exec:\fffrrrf.exe31⤵
- Executes dropped EXE
PID:2488 -
\??\c:\tnnhbt.exec:\tnnhbt.exe32⤵
- Executes dropped EXE
PID:2676 -
\??\c:\3fxlrfr.exec:\3fxlrfr.exe33⤵
- Executes dropped EXE
PID:596 -
\??\c:\djjpv.exec:\djjpv.exe34⤵
- Executes dropped EXE
PID:2184 -
\??\c:\xrxxrxf.exec:\xrxxrxf.exe35⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hbnbbb.exec:\hbnbbb.exe36⤵
- Executes dropped EXE
PID:1912 -
\??\c:\vvjjv.exec:\vvjjv.exe37⤵
- Executes dropped EXE
PID:2688 -
\??\c:\fxllrrr.exec:\fxllrrr.exe38⤵
- Executes dropped EXE
PID:1272 -
\??\c:\btttbb.exec:\btttbb.exe39⤵
- Executes dropped EXE
PID:2800 -
\??\c:\nbhbhb.exec:\nbhbhb.exe40⤵
- Executes dropped EXE
PID:2748 -
\??\c:\vdpjd.exec:\vdpjd.exe41⤵
- Executes dropped EXE
PID:2432 -
\??\c:\xrlxflf.exec:\xrlxflf.exe42⤵
- Executes dropped EXE
PID:2832 -
\??\c:\nttbnh.exec:\nttbnh.exe43⤵
- Executes dropped EXE
PID:2012 -
\??\c:\dvjpj.exec:\dvjpj.exe44⤵
- Executes dropped EXE
PID:2708 -
\??\c:\jjdpp.exec:\jjdpp.exe45⤵
- Executes dropped EXE
PID:2628 -
\??\c:\xrrfxfx.exec:\xrrfxfx.exe46⤵
- Executes dropped EXE
PID:3044 -
\??\c:\bhnntn.exec:\bhnntn.exe47⤵
- Executes dropped EXE
PID:2860 -
\??\c:\djvdj.exec:\djvdj.exe48⤵
- Executes dropped EXE
PID:1036 -
\??\c:\9pvvp.exec:\9pvvp.exe49⤵
- Executes dropped EXE
PID:868 -
\??\c:\xlxfrrf.exec:\xlxfrrf.exe50⤵
- Executes dropped EXE
PID:2312 -
\??\c:\hbhnhn.exec:\hbhnhn.exe51⤵
- Executes dropped EXE
PID:1956 -
\??\c:\nnnbnb.exec:\nnnbnb.exe52⤵
- Executes dropped EXE
PID:820 -
\??\c:\5jddj.exec:\5jddj.exe53⤵
- Executes dropped EXE
PID:1684 -
\??\c:\fxxrrrx.exec:\fxxrrrx.exe54⤵
- Executes dropped EXE
PID:1620 -
\??\c:\1tnbnt.exec:\1tnbnt.exe55⤵
- Executes dropped EXE
PID:1252 -
\??\c:\hhbnbn.exec:\hhbnbn.exe56⤵
- Executes dropped EXE
PID:1304 -
\??\c:\fxllxxl.exec:\fxllxxl.exe57⤵
- Executes dropped EXE
PID:3028 -
\??\c:\rlxxfrx.exec:\rlxxfrx.exe58⤵
- Executes dropped EXE
PID:2388 -
\??\c:\9bbbnh.exec:\9bbbnh.exe59⤵
- Executes dropped EXE
PID:1328 -
\??\c:\vvpdp.exec:\vvpdp.exe60⤵
- Executes dropped EXE
PID:1944 -
\??\c:\llxrxlr.exec:\llxrxlr.exe61⤵
- Executes dropped EXE
PID:2528 -
\??\c:\fxrxflx.exec:\fxrxflx.exe62⤵
- Executes dropped EXE
PID:908 -
\??\c:\hhnbhn.exec:\hhnbhn.exe63⤵
- Executes dropped EXE
PID:1248 -
\??\c:\3dvdv.exec:\3dvdv.exe64⤵
- Executes dropped EXE
PID:1676 -
\??\c:\ppvvv.exec:\ppvvv.exe65⤵
- Executes dropped EXE
PID:1372 -
\??\c:\xrxxxrf.exec:\xrxxxrf.exe66⤵PID:888
-
\??\c:\nbhhht.exec:\nbhhht.exe67⤵PID:2024
-
\??\c:\3vppj.exec:\3vppj.exe68⤵PID:1776
-
\??\c:\djjpj.exec:\djjpj.exe69⤵PID:2532
-
\??\c:\lrfrllf.exec:\lrfrllf.exe70⤵PID:2368
-
\??\c:\tbhtbn.exec:\tbhtbn.exe71⤵PID:2508
-
\??\c:\tttbnb.exec:\tttbnb.exe72⤵PID:1584
-
\??\c:\jdppp.exec:\jdppp.exe73⤵
- System Location Discovery: System Language Discovery
PID:2420 -
\??\c:\3rflflf.exec:\3rflflf.exe74⤵PID:788
-
\??\c:\5tnbhn.exec:\5tnbhn.exe75⤵PID:2372
-
\??\c:\pjdpd.exec:\pjdpd.exe76⤵PID:2104
-
\??\c:\pppvp.exec:\pppvp.exe77⤵PID:2292
-
\??\c:\1xfrfxr.exec:\1xfrfxr.exe78⤵PID:2736
-
\??\c:\bthtnt.exec:\bthtnt.exe79⤵PID:2804
-
\??\c:\pvvpj.exec:\pvvpj.exe80⤵PID:2232
-
\??\c:\xrrxfll.exec:\xrrxfll.exe81⤵PID:2704
-
\??\c:\tthbtt.exec:\tthbtt.exe82⤵PID:2892
-
\??\c:\jpjpj.exec:\jpjpj.exe83⤵PID:2632
-
\??\c:\lrllfrf.exec:\lrllfrf.exe84⤵PID:2712
-
\??\c:\xflrflx.exec:\xflrflx.exe85⤵PID:2764
-
\??\c:\thnhnt.exec:\thnhnt.exe86⤵PID:2600
-
\??\c:\dvvpp.exec:\dvvpp.exe87⤵PID:3036
-
\??\c:\rfrfxlf.exec:\rfrfxlf.exe88⤵PID:2668
-
\??\c:\nnnhhn.exec:\nnnhhn.exe89⤵PID:1712
-
\??\c:\jddvp.exec:\jddvp.exe90⤵PID:2888
-
\??\c:\vjvpp.exec:\vjvpp.exe91⤵PID:3048
-
\??\c:\xxrxlrl.exec:\xxrxlrl.exe92⤵PID:2320
-
\??\c:\nhnbhh.exec:\nhnbhh.exe93⤵PID:2880
-
\??\c:\jddpd.exec:\jddpd.exe94⤵PID:1596
-
\??\c:\lfxrxlx.exec:\lfxrxlx.exe95⤵PID:840
-
\??\c:\tnntbh.exec:\tnntbh.exe96⤵PID:1620
-
\??\c:\hhhbtt.exec:\hhhbtt.exe97⤵PID:3056
-
\??\c:\pvdpp.exec:\pvdpp.exe98⤵PID:3060
-
\??\c:\lfxrflf.exec:\lfxrflf.exe99⤵
- System Location Discovery: System Language Discovery
PID:3068 -
\??\c:\btnbnn.exec:\btnbnn.exe100⤵PID:2396
-
\??\c:\nbhhnh.exec:\nbhhnh.exe101⤵PID:2212
-
\??\c:\ppdpp.exec:\ppdpp.exe102⤵PID:1872
-
\??\c:\rlrrflx.exec:\rlrrflx.exe103⤵PID:304
-
\??\c:\hnnbnh.exec:\hnnbnh.exe104⤵PID:1576
-
\??\c:\7jppj.exec:\7jppj.exe105⤵PID:2032
-
\??\c:\9djdd.exec:\9djdd.exe106⤵PID:968
-
\??\c:\lxllrxl.exec:\lxllrxl.exe107⤵PID:956
-
\??\c:\bbbhtb.exec:\bbbhtb.exe108⤵PID:2424
-
\??\c:\djppp.exec:\djppp.exe109⤵PID:2540
-
\??\c:\xrxrffr.exec:\xrxrffr.exe110⤵PID:1292
-
\??\c:\ttbhtt.exec:\ttbhtt.exe111⤵PID:2576
-
\??\c:\jjpjv.exec:\jjpjv.exe112⤵PID:2016
-
\??\c:\fffrxll.exec:\fffrxll.exe113⤵PID:2368
-
\??\c:\9hbhhh.exec:\9hbhhh.exe114⤵PID:2508
-
\??\c:\lflxxxr.exec:\lflxxxr.exe115⤵PID:1668
-
\??\c:\thtntn.exec:\thtntn.exe116⤵PID:2420
-
\??\c:\vpvvp.exec:\vpvvp.exe117⤵PID:2056
-
\??\c:\xrxlxxf.exec:\xrxlxxf.exe118⤵PID:2380
-
\??\c:\llxrlff.exec:\llxrlff.exe119⤵PID:2276
-
\??\c:\ntbntt.exec:\ntbntt.exe120⤵PID:2912
-
\??\c:\pdjjd.exec:\pdjjd.exe121⤵PID:2824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-