Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 06:39
Static task
static1
Behavioral task
behavioral1
Sample
f1394086a1d4c66cb899cd682ce664bdb29350979c08eec86b998a940c68045a.exe
Resource
win7-20240708-en
General
-
Target
f1394086a1d4c66cb899cd682ce664bdb29350979c08eec86b998a940c68045a.exe
-
Size
454KB
-
MD5
29b01c8130e6df2fd85ee6d16c613881
-
SHA1
dd7c78fd43b691ffc4e584c769b0f5e441ce25cc
-
SHA256
f1394086a1d4c66cb899cd682ce664bdb29350979c08eec86b998a940c68045a
-
SHA512
eff9e4061b0c8acc037abe58927022de28a6cf5798cd2eaf0d924e8ebd278ce98913a6786218529363ccb1e4ba7c81d3ee3d6b88237a17837dd3837545e22eac
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2084-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-543-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2672-637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-643-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1860-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-697-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1188-836-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-844-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2856 rrlfxxl.exe 1032 rrlxrfr.exe 2748 nnhthn.exe 2684 lffrrff.exe 2740 208068.exe 2584 dddpv.exe 2604 8242664.exe 2600 o864202.exe 2608 xffrlxr.exe 2288 8448244.exe 2800 u868060.exe 1748 044028.exe 2820 5nnthh.exe 1736 fxrfxfr.exe 908 9nnthn.exe 2952 9tnnbt.exe 1264 e28428.exe 1768 ttbnhn.exe 1092 4424668.exe 2424 hbnbhb.exe 1752 60048.exe 1872 220468.exe 1620 000488.exe 2172 86284.exe 1652 a2648.exe 3044 808284.exe 3036 84886.exe 2240 dvpdj.exe 1680 s6068.exe 2492 k66484.exe 3040 260024.exe 1764 ffxlxlf.exe 2348 xfrrlrr.exe 1988 jjppj.exe 1696 1hnbnt.exe 2144 k66260.exe 2372 608406.exe 2692 26068.exe 2684 vjdpj.exe 2840 s0024.exe 2964 444640.exe 2672 004624.exe 2624 jjppj.exe 2120 rrfxffr.exe 2288 662286.exe 2808 28200.exe 2588 3xflxfr.exe 1748 btnthn.exe 1824 26406.exe 2544 a0062.exe 2948 82644.exe 316 rxfflll.exe 344 q20260.exe 1508 jdvjv.exe 1768 tbnbhh.exe 2212 fxxrrrx.exe 2260 7jjpv.exe 2044 lxxrrxr.exe 1980 62208.exe 2880 jjdjv.exe 1284 xrfxxrr.exe 1540 k04022.exe 892 086222.exe 1628 o262846.exe -
resource yara_rule behavioral1/memory/2084-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/296-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-836-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-851-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-898-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-925-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-956-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1664-963-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 486424.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40022.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g2400.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2840002.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrllrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 04628.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 828208.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e28428.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28200.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6664804.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 646844.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s0024.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0428202.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6028484.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4484000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlrlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2262840.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xfflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4806808.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4844086.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c064200.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 264422.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00460.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 004624.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00246.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 208644.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 042240.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 00406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 662286.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 846206.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2856 2084 f1394086a1d4c66cb899cd682ce664bdb29350979c08eec86b998a940c68045a.exe 30 PID 2084 wrote to memory of 2856 2084 f1394086a1d4c66cb899cd682ce664bdb29350979c08eec86b998a940c68045a.exe 30 PID 2084 wrote to memory of 2856 2084 f1394086a1d4c66cb899cd682ce664bdb29350979c08eec86b998a940c68045a.exe 30 PID 2084 wrote to memory of 2856 2084 f1394086a1d4c66cb899cd682ce664bdb29350979c08eec86b998a940c68045a.exe 30 PID 2856 wrote to memory of 1032 2856 rrlfxxl.exe 31 PID 2856 wrote to memory of 1032 2856 rrlfxxl.exe 31 PID 2856 wrote to memory of 1032 2856 rrlfxxl.exe 31 PID 2856 wrote to memory of 1032 2856 rrlfxxl.exe 31 PID 1032 wrote to memory of 2748 1032 rrlxrfr.exe 32 PID 1032 wrote to memory of 2748 1032 rrlxrfr.exe 32 PID 1032 wrote to memory of 2748 1032 rrlxrfr.exe 32 PID 1032 wrote to memory of 2748 1032 rrlxrfr.exe 32 PID 2748 wrote to memory of 2684 2748 nnhthn.exe 33 PID 2748 wrote to memory of 2684 2748 nnhthn.exe 33 PID 2748 wrote to memory of 2684 2748 nnhthn.exe 33 PID 2748 wrote to memory of 2684 2748 nnhthn.exe 33 PID 2684 wrote to memory of 2740 2684 lffrrff.exe 34 PID 2684 wrote to memory of 2740 2684 lffrrff.exe 34 PID 2684 wrote to memory of 2740 2684 lffrrff.exe 34 PID 2684 wrote to memory of 2740 2684 lffrrff.exe 34 PID 2740 wrote to memory of 2584 2740 208068.exe 35 PID 2740 wrote to memory of 2584 2740 208068.exe 35 PID 2740 wrote to memory of 2584 2740 208068.exe 35 PID 2740 wrote to memory of 2584 2740 208068.exe 35 PID 2584 wrote to memory of 2604 2584 dddpv.exe 36 PID 2584 wrote to memory of 2604 2584 dddpv.exe 36 PID 2584 wrote to memory of 2604 2584 dddpv.exe 36 PID 2584 wrote to memory of 2604 2584 dddpv.exe 36 PID 2604 wrote to memory of 2600 2604 8242664.exe 37 PID 2604 wrote to memory of 2600 2604 8242664.exe 37 PID 2604 wrote to memory of 2600 2604 8242664.exe 37 PID 2604 wrote to memory of 2600 2604 8242664.exe 37 PID 2600 wrote to memory of 2608 2600 o864202.exe 38 PID 2600 wrote to memory of 2608 2600 o864202.exe 38 PID 2600 wrote to memory of 2608 2600 o864202.exe 38 PID 2600 wrote to memory of 2608 2600 o864202.exe 38 PID 2608 wrote to memory of 2288 2608 xffrlxr.exe 39 PID 2608 wrote to memory of 2288 2608 xffrlxr.exe 39 PID 2608 wrote to memory of 2288 2608 xffrlxr.exe 39 PID 2608 wrote to memory of 2288 2608 xffrlxr.exe 39 PID 2288 wrote to memory of 2800 2288 8448244.exe 40 PID 2288 wrote to memory of 2800 2288 8448244.exe 40 PID 2288 wrote to memory of 2800 2288 8448244.exe 40 PID 2288 wrote to memory of 2800 2288 8448244.exe 40 PID 2800 wrote to memory of 1748 2800 u868060.exe 41 PID 2800 wrote to memory of 1748 2800 u868060.exe 41 PID 2800 wrote to memory of 1748 2800 u868060.exe 41 PID 2800 wrote to memory of 1748 2800 u868060.exe 41 PID 1748 wrote to memory of 2820 1748 044028.exe 42 PID 1748 wrote to memory of 2820 1748 044028.exe 42 PID 1748 wrote to memory of 2820 1748 044028.exe 42 PID 1748 wrote to memory of 2820 1748 044028.exe 42 PID 2820 wrote to memory of 1736 2820 5nnthh.exe 43 PID 2820 wrote to memory of 1736 2820 5nnthh.exe 43 PID 2820 wrote to memory of 1736 2820 5nnthh.exe 43 PID 2820 wrote to memory of 1736 2820 5nnthh.exe 43 PID 1736 wrote to memory of 908 1736 fxrfxfr.exe 44 PID 1736 wrote to memory of 908 1736 fxrfxfr.exe 44 PID 1736 wrote to memory of 908 1736 fxrfxfr.exe 44 PID 1736 wrote to memory of 908 1736 fxrfxfr.exe 44 PID 908 wrote to memory of 2952 908 9nnthn.exe 45 PID 908 wrote to memory of 2952 908 9nnthn.exe 45 PID 908 wrote to memory of 2952 908 9nnthn.exe 45 PID 908 wrote to memory of 2952 908 9nnthn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1394086a1d4c66cb899cd682ce664bdb29350979c08eec86b998a940c68045a.exe"C:\Users\Admin\AppData\Local\Temp\f1394086a1d4c66cb899cd682ce664bdb29350979c08eec86b998a940c68045a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\rrlfxxl.exec:\rrlfxxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\rrlxrfr.exec:\rrlxrfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\nnhthn.exec:\nnhthn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\lffrrff.exec:\lffrrff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\208068.exec:\208068.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\dddpv.exec:\dddpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\8242664.exec:\8242664.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\o864202.exec:\o864202.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\xffrlxr.exec:\xffrlxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\8448244.exec:\8448244.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\u868060.exec:\u868060.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\044028.exec:\044028.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\5nnthh.exec:\5nnthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\fxrfxfr.exec:\fxrfxfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\9nnthn.exec:\9nnthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\9tnnbt.exec:\9tnnbt.exe17⤵
- Executes dropped EXE
PID:2952 -
\??\c:\e28428.exec:\e28428.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1264 -
\??\c:\ttbnhn.exec:\ttbnhn.exe19⤵
- Executes dropped EXE
PID:1768 -
\??\c:\4424668.exec:\4424668.exe20⤵
- Executes dropped EXE
PID:1092 -
\??\c:\hbnbhb.exec:\hbnbhb.exe21⤵
- Executes dropped EXE
PID:2424 -
\??\c:\60048.exec:\60048.exe22⤵
- Executes dropped EXE
PID:1752 -
\??\c:\220468.exec:\220468.exe23⤵
- Executes dropped EXE
PID:1872 -
\??\c:\000488.exec:\000488.exe24⤵
- Executes dropped EXE
PID:1620 -
\??\c:\86284.exec:\86284.exe25⤵
- Executes dropped EXE
PID:2172 -
\??\c:\a2648.exec:\a2648.exe26⤵
- Executes dropped EXE
PID:1652 -
\??\c:\808284.exec:\808284.exe27⤵
- Executes dropped EXE
PID:3044 -
\??\c:\84886.exec:\84886.exe28⤵
- Executes dropped EXE
PID:3036 -
\??\c:\dvpdj.exec:\dvpdj.exe29⤵
- Executes dropped EXE
PID:2240 -
\??\c:\s6068.exec:\s6068.exe30⤵
- Executes dropped EXE
PID:1680 -
\??\c:\k66484.exec:\k66484.exe31⤵
- Executes dropped EXE
PID:2492 -
\??\c:\260024.exec:\260024.exe32⤵
- Executes dropped EXE
PID:3040 -
\??\c:\ffxlxlf.exec:\ffxlxlf.exe33⤵
- Executes dropped EXE
PID:1764 -
\??\c:\xfrrlrr.exec:\xfrrlrr.exe34⤵
- Executes dropped EXE
PID:2348 -
\??\c:\jjppj.exec:\jjppj.exe35⤵
- Executes dropped EXE
PID:1988 -
\??\c:\1hnbnt.exec:\1hnbnt.exe36⤵
- Executes dropped EXE
PID:1696 -
\??\c:\k66260.exec:\k66260.exe37⤵
- Executes dropped EXE
PID:2144 -
\??\c:\608406.exec:\608406.exe38⤵
- Executes dropped EXE
PID:2372 -
\??\c:\26068.exec:\26068.exe39⤵
- Executes dropped EXE
PID:2692 -
\??\c:\vjdpj.exec:\vjdpj.exe40⤵
- Executes dropped EXE
PID:2684 -
\??\c:\s0024.exec:\s0024.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2840 -
\??\c:\444640.exec:\444640.exe42⤵
- Executes dropped EXE
PID:2964 -
\??\c:\004624.exec:\004624.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2672 -
\??\c:\jjppj.exec:\jjppj.exe44⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rrfxffr.exec:\rrfxffr.exe45⤵
- Executes dropped EXE
PID:2120 -
\??\c:\662286.exec:\662286.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2288 -
\??\c:\28200.exec:\28200.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2808 -
\??\c:\3xflxfr.exec:\3xflxfr.exe48⤵
- Executes dropped EXE
PID:2588 -
\??\c:\btnthn.exec:\btnthn.exe49⤵
- Executes dropped EXE
PID:1748 -
\??\c:\26406.exec:\26406.exe50⤵
- Executes dropped EXE
PID:1824 -
\??\c:\a0062.exec:\a0062.exe51⤵
- Executes dropped EXE
PID:2544 -
\??\c:\82644.exec:\82644.exe52⤵
- Executes dropped EXE
PID:2948 -
\??\c:\rxfflll.exec:\rxfflll.exe53⤵
- Executes dropped EXE
PID:316 -
\??\c:\q20260.exec:\q20260.exe54⤵
- Executes dropped EXE
PID:344 -
\??\c:\jdvjv.exec:\jdvjv.exe55⤵
- Executes dropped EXE
PID:1508 -
\??\c:\tbnbhh.exec:\tbnbhh.exe56⤵
- Executes dropped EXE
PID:1768 -
\??\c:\fxxrrrx.exec:\fxxrrrx.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2212 -
\??\c:\7jjpv.exec:\7jjpv.exe58⤵
- Executes dropped EXE
PID:2260 -
\??\c:\lxxrrxr.exec:\lxxrrxr.exe59⤵
- Executes dropped EXE
PID:2044 -
\??\c:\62208.exec:\62208.exe60⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jjdjv.exec:\jjdjv.exe61⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xrfxxrr.exec:\xrfxxrr.exe62⤵
- Executes dropped EXE
PID:1284 -
\??\c:\k04022.exec:\k04022.exe63⤵
- Executes dropped EXE
PID:1540 -
\??\c:\086222.exec:\086222.exe64⤵
- Executes dropped EXE
PID:892 -
\??\c:\o262846.exec:\o262846.exe65⤵
- Executes dropped EXE
PID:1628 -
\??\c:\86442.exec:\86442.exe66⤵PID:860
-
\??\c:\8266408.exec:\8266408.exe67⤵PID:1704
-
\??\c:\5jpjd.exec:\5jpjd.exe68⤵PID:2536
-
\??\c:\dvddv.exec:\dvddv.exe69⤵PID:2440
-
\??\c:\400846.exec:\400846.exe70⤵PID:2476
-
\??\c:\hbttbt.exec:\hbttbt.exe71⤵PID:1244
-
\??\c:\1nhtnb.exec:\1nhtnb.exe72⤵PID:2336
-
\??\c:\vvdvv.exec:\vvdvv.exe73⤵PID:604
-
\??\c:\flrfrxf.exec:\flrfrxf.exe74⤵PID:328
-
\??\c:\486424.exec:\486424.exe75⤵
- System Location Discovery: System Language Discovery
PID:1956 -
\??\c:\i224826.exec:\i224826.exe76⤵PID:2040
-
\??\c:\5dpvd.exec:\5dpvd.exe77⤵PID:2292
-
\??\c:\88680.exec:\88680.exe78⤵PID:1696
-
\??\c:\422244.exec:\422244.exe79⤵PID:2748
-
\??\c:\0682262.exec:\0682262.exe80⤵PID:3000
-
\??\c:\82084.exec:\82084.exe81⤵PID:2692
-
\??\c:\0860460.exec:\0860460.exe82⤵PID:2592
-
\??\c:\0268062.exec:\0268062.exe83⤵PID:1612
-
\??\c:\xflxrll.exec:\xflxrll.exe84⤵PID:2200
-
\??\c:\xxllxrx.exec:\xxllxrx.exe85⤵PID:2672
-
\??\c:\i424628.exec:\i424628.exe86⤵PID:1816
-
\??\c:\jdjdj.exec:\jdjdj.exe87⤵
- System Location Discovery: System Language Discovery
PID:2120 -
\??\c:\jppdj.exec:\jppdj.exe88⤵PID:2288
-
\??\c:\6686864.exec:\6686864.exe89⤵PID:1860
-
\??\c:\2086026.exec:\2086026.exe90⤵PID:2588
-
\??\c:\6824682.exec:\6824682.exe91⤵PID:2968
-
\??\c:\xfxfxxl.exec:\xfxfxxl.exe92⤵PID:1824
-
\??\c:\hbnthn.exec:\hbnthn.exe93⤵PID:1972
-
\??\c:\g8628.exec:\g8628.exe94⤵PID:2540
-
\??\c:\8206882.exec:\8206882.exe95⤵PID:296
-
\??\c:\608428.exec:\608428.exe96⤵PID:1264
-
\??\c:\20464.exec:\20464.exe97⤵PID:3008
-
\??\c:\jvvjp.exec:\jvvjp.exe98⤵PID:1396
-
\??\c:\22866.exec:\22866.exe99⤵PID:2368
-
\??\c:\bnhhnn.exec:\bnhhnn.exe100⤵PID:2260
-
\??\c:\dvjvp.exec:\dvjvp.exe101⤵
- System Location Discovery: System Language Discovery
PID:2044 -
\??\c:\0466280.exec:\0466280.exe102⤵PID:1980
-
\??\c:\jdvvj.exec:\jdvvj.exe103⤵PID:1760
-
\??\c:\u222884.exec:\u222884.exe104⤵PID:1284
-
\??\c:\u480846.exec:\u480846.exe105⤵PID:1540
-
\??\c:\dpddp.exec:\dpddp.exe106⤵PID:744
-
\??\c:\60088.exec:\60088.exe107⤵PID:1628
-
\??\c:\22804.exec:\22804.exe108⤵PID:3028
-
\??\c:\tnhtnb.exec:\tnhtnb.exe109⤵PID:1692
-
\??\c:\440224.exec:\440224.exe110⤵PID:2104
-
\??\c:\6006064.exec:\6006064.exe111⤵PID:1260
-
\??\c:\8446862.exec:\8446862.exe112⤵PID:2184
-
\??\c:\222424.exec:\222424.exe113⤵PID:2492
-
\??\c:\680644.exec:\680644.exe114⤵PID:2320
-
\??\c:\2884020.exec:\2884020.exe115⤵PID:1188
-
\??\c:\llllflf.exec:\llllflf.exe116⤵PID:1020
-
\??\c:\4844086.exec:\4844086.exe117⤵
- System Location Discovery: System Language Discovery
PID:1956 -
\??\c:\s4246.exec:\s4246.exe118⤵PID:2348
-
\??\c:\80884.exec:\80884.exe119⤵PID:2220
-
\??\c:\264800.exec:\264800.exe120⤵PID:2768
-
\??\c:\448602.exec:\448602.exe121⤵PID:2564
-
\??\c:\00644.exec:\00644.exe122⤵PID:2980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-