Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 07:04
Static task
static1
Behavioral task
behavioral1
Sample
f6f81b207472b34ff03b0053fa0cfffb8e2833a9b8b2f8ad75b36c8421cef10c.exe
Resource
win7-20240903-en
General
-
Target
f6f81b207472b34ff03b0053fa0cfffb8e2833a9b8b2f8ad75b36c8421cef10c.exe
-
Size
454KB
-
MD5
929a6af4011a6d9fcc527866d52247f6
-
SHA1
f6679015b38dae5af380b4a4daf4a896388f0d3f
-
SHA256
f6f81b207472b34ff03b0053fa0cfffb8e2833a9b8b2f8ad75b36c8421cef10c
-
SHA512
026301d44b3901b6b8ddc65a5a61184661d071b438cb14a612a13b5dcf44bce63c0ff6bec8505c70de8df06857e90eefbed55cbe3c6918963bacc5378ca20346
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe+:q7Tc2NYHUrAwfMp3CD+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral1/memory/1984-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-35-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2712-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-43-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2712-51-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2672-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-64-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2988-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-83-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2612-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-107-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/484-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1204-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-196-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1328-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-238-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1972-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-319-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2760-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-350-0x00000000001E0000-0x000000000020A000-memory.dmp family_blackmoon behavioral1/memory/2556-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/808-476-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1848-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-599-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3032-600-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/3032-597-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2504-607-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/484-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-692-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2132-738-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2132-740-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1596-748-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/952-757-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/896-768-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1596-769-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2232-789-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2528-808-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2804-876-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-889-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2572-927-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-990-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2104-1096-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-1140-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2260-1202-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1812 5xxlrfl.exe 2464 jppdj.exe 2504 jddpp.exe 2768 ttnbbn.exe 2712 5frfxfr.exe 2672 rlrxflr.exe 2988 9fffrxx.exe 2612 9jjpp.exe 2628 7lfrxlr.exe 2156 7pjjp.exe 484 lfxfrxx.exe 2616 lfrxrrl.exe 2084 xxrxllr.exe 1204 nhbnhn.exe 1128 vjdvd.exe 2856 rxlxffl.exe 1936 htbtbb.exe 2140 5nhthn.exe 3044 3hbthh.exe 1952 jpvvv.exe 1100 nhbhtb.exe 1540 ttnntt.exe 1700 dddjd.exe 1344 vpdjd.exe 1328 jdpdv.exe 1536 lrflrxl.exe 1972 djvvv.exe 2420 lllrrrl.exe 2412 jjjvd.exe 1748 5xxxxfr.exe 2960 jpddj.exe 1288 xxxlffx.exe 1780 jpjdp.exe 1592 ddddv.exe 3036 rrlrxll.exe 2684 9nttth.exe 2848 vddvp.exe 2900 xxxlxll.exe 2760 lrrfrff.exe 2796 tbbnnn.exe 2752 ppvjd.exe 2556 jdvdv.exe 2668 lxrfxll.exe 2820 tnntht.exe 540 vvvjp.exe 1248 dvvdp.exe 2012 9llrxlx.exe 2044 lfxxlfl.exe 2616 9bthtb.exe 768 pjjpv.exe 1204 rlffrxl.exe 1128 xxrxrxl.exe 2188 ttthtb.exe 2116 dddpp.exe 2212 7pddd.exe 1936 xrfflrf.exe 940 nhbbtt.exe 2656 7hhtnn.exe 808 pdvdv.exe 924 fxlrxfr.exe 1100 rrlrllx.exe 836 9nhtnb.exe 1080 vvpvj.exe 1648 dpppv.exe -
resource yara_rule behavioral1/memory/1984-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-43-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/2672-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-83-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2612-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-85-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/484-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-238-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1972-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-350-0x00000000001E0000-0x000000000020A000-memory.dmp upx behavioral1/memory/2752-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-476-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1848-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-584-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2460-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-597-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2976-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-757-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1320-770-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-876-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-927-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-971-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-990-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/940-1015-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2384-1083-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-1096-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-1202-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1248-1209-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfffrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1984 wrote to memory of 1812 1984 f6f81b207472b34ff03b0053fa0cfffb8e2833a9b8b2f8ad75b36c8421cef10c.exe 31 PID 1984 wrote to memory of 1812 1984 f6f81b207472b34ff03b0053fa0cfffb8e2833a9b8b2f8ad75b36c8421cef10c.exe 31 PID 1984 wrote to memory of 1812 1984 f6f81b207472b34ff03b0053fa0cfffb8e2833a9b8b2f8ad75b36c8421cef10c.exe 31 PID 1984 wrote to memory of 1812 1984 f6f81b207472b34ff03b0053fa0cfffb8e2833a9b8b2f8ad75b36c8421cef10c.exe 31 PID 1812 wrote to memory of 2464 1812 5xxlrfl.exe 32 PID 1812 wrote to memory of 2464 1812 5xxlrfl.exe 32 PID 1812 wrote to memory of 2464 1812 5xxlrfl.exe 32 PID 1812 wrote to memory of 2464 1812 5xxlrfl.exe 32 PID 2464 wrote to memory of 2504 2464 jppdj.exe 33 PID 2464 wrote to memory of 2504 2464 jppdj.exe 33 PID 2464 wrote to memory of 2504 2464 jppdj.exe 33 PID 2464 wrote to memory of 2504 2464 jppdj.exe 33 PID 2504 wrote to memory of 2768 2504 jddpp.exe 34 PID 2504 wrote to memory of 2768 2504 jddpp.exe 34 PID 2504 wrote to memory of 2768 2504 jddpp.exe 34 PID 2504 wrote to memory of 2768 2504 jddpp.exe 34 PID 2768 wrote to memory of 2712 2768 ttnbbn.exe 35 PID 2768 wrote to memory of 2712 2768 ttnbbn.exe 35 PID 2768 wrote to memory of 2712 2768 ttnbbn.exe 35 PID 2768 wrote to memory of 2712 2768 ttnbbn.exe 35 PID 2712 wrote to memory of 2672 2712 5frfxfr.exe 36 PID 2712 wrote to memory of 2672 2712 5frfxfr.exe 36 PID 2712 wrote to memory of 2672 2712 5frfxfr.exe 36 PID 2712 wrote to memory of 2672 2712 5frfxfr.exe 36 PID 2672 wrote to memory of 2988 2672 rlrxflr.exe 37 PID 2672 wrote to memory of 2988 2672 rlrxflr.exe 37 PID 2672 wrote to memory of 2988 2672 rlrxflr.exe 37 PID 2672 wrote to memory of 2988 2672 rlrxflr.exe 37 PID 2988 wrote to memory of 2612 2988 9fffrxx.exe 38 PID 2988 wrote to memory of 2612 2988 9fffrxx.exe 38 PID 2988 wrote to memory of 2612 2988 9fffrxx.exe 38 PID 2988 wrote to memory of 2612 2988 9fffrxx.exe 38 PID 2612 wrote to memory of 2628 2612 9jjpp.exe 39 PID 2612 wrote to memory of 2628 2612 9jjpp.exe 39 PID 2612 wrote to memory of 2628 2612 9jjpp.exe 39 PID 2612 wrote to memory of 2628 2612 9jjpp.exe 39 PID 2628 wrote to memory of 2156 2628 7lfrxlr.exe 40 PID 2628 wrote to memory of 2156 2628 7lfrxlr.exe 40 PID 2628 wrote to memory of 2156 2628 7lfrxlr.exe 40 PID 2628 wrote to memory of 2156 2628 7lfrxlr.exe 40 PID 2156 wrote to memory of 484 2156 7pjjp.exe 41 PID 2156 wrote to memory of 484 2156 7pjjp.exe 41 PID 2156 wrote to memory of 484 2156 7pjjp.exe 41 PID 2156 wrote to memory of 484 2156 7pjjp.exe 41 PID 484 wrote to memory of 2616 484 lfxfrxx.exe 42 PID 484 wrote to memory of 2616 484 lfxfrxx.exe 42 PID 484 wrote to memory of 2616 484 lfxfrxx.exe 42 PID 484 wrote to memory of 2616 484 lfxfrxx.exe 42 PID 2616 wrote to memory of 2084 2616 lfrxrrl.exe 43 PID 2616 wrote to memory of 2084 2616 lfrxrrl.exe 43 PID 2616 wrote to memory of 2084 2616 lfrxrrl.exe 43 PID 2616 wrote to memory of 2084 2616 lfrxrrl.exe 43 PID 2084 wrote to memory of 1204 2084 xxrxllr.exe 44 PID 2084 wrote to memory of 1204 2084 xxrxllr.exe 44 PID 2084 wrote to memory of 1204 2084 xxrxllr.exe 44 PID 2084 wrote to memory of 1204 2084 xxrxllr.exe 44 PID 1204 wrote to memory of 1128 1204 nhbnhn.exe 45 PID 1204 wrote to memory of 1128 1204 nhbnhn.exe 45 PID 1204 wrote to memory of 1128 1204 nhbnhn.exe 45 PID 1204 wrote to memory of 1128 1204 nhbnhn.exe 45 PID 1128 wrote to memory of 2856 1128 vjdvd.exe 46 PID 1128 wrote to memory of 2856 1128 vjdvd.exe 46 PID 1128 wrote to memory of 2856 1128 vjdvd.exe 46 PID 1128 wrote to memory of 2856 1128 vjdvd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6f81b207472b34ff03b0053fa0cfffb8e2833a9b8b2f8ad75b36c8421cef10c.exe"C:\Users\Admin\AppData\Local\Temp\f6f81b207472b34ff03b0053fa0cfffb8e2833a9b8b2f8ad75b36c8421cef10c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\5xxlrfl.exec:\5xxlrfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\jppdj.exec:\jppdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\jddpp.exec:\jddpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\ttnbbn.exec:\ttnbbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\5frfxfr.exec:\5frfxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\rlrxflr.exec:\rlrxflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\9fffrxx.exec:\9fffrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\9jjpp.exec:\9jjpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\7lfrxlr.exec:\7lfrxlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\7pjjp.exec:\7pjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\lfxfrxx.exec:\lfxfrxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\lfrxrrl.exec:\lfrxrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\xxrxllr.exec:\xxrxllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\nhbnhn.exec:\nhbnhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\vjdvd.exec:\vjdvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\rxlxffl.exec:\rxlxffl.exe17⤵
- Executes dropped EXE
PID:2856 -
\??\c:\htbtbb.exec:\htbtbb.exe18⤵
- Executes dropped EXE
PID:1936 -
\??\c:\5nhthn.exec:\5nhthn.exe19⤵
- Executes dropped EXE
PID:2140 -
\??\c:\3hbthh.exec:\3hbthh.exe20⤵
- Executes dropped EXE
PID:3044 -
\??\c:\jpvvv.exec:\jpvvv.exe21⤵
- Executes dropped EXE
PID:1952 -
\??\c:\nhbhtb.exec:\nhbhtb.exe22⤵
- Executes dropped EXE
PID:1100 -
\??\c:\ttnntt.exec:\ttnntt.exe23⤵
- Executes dropped EXE
PID:1540 -
\??\c:\dddjd.exec:\dddjd.exe24⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vpdjd.exec:\vpdjd.exe25⤵
- Executes dropped EXE
PID:1344 -
\??\c:\jdpdv.exec:\jdpdv.exe26⤵
- Executes dropped EXE
PID:1328 -
\??\c:\lrflrxl.exec:\lrflrxl.exe27⤵
- Executes dropped EXE
PID:1536 -
\??\c:\djvvv.exec:\djvvv.exe28⤵
- Executes dropped EXE
PID:1972 -
\??\c:\lllrrrl.exec:\lllrrrl.exe29⤵
- Executes dropped EXE
PID:2420 -
\??\c:\jjjvd.exec:\jjjvd.exe30⤵
- Executes dropped EXE
PID:2412 -
\??\c:\5xxxxfr.exec:\5xxxxfr.exe31⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jpddj.exec:\jpddj.exe32⤵
- Executes dropped EXE
PID:2960 -
\??\c:\xxxlffx.exec:\xxxlffx.exe33⤵
- Executes dropped EXE
PID:1288 -
\??\c:\jpjdp.exec:\jpjdp.exe34⤵
- Executes dropped EXE
PID:1780 -
\??\c:\ddddv.exec:\ddddv.exe35⤵
- Executes dropped EXE
PID:1592 -
\??\c:\rrlrxll.exec:\rrlrxll.exe36⤵
- Executes dropped EXE
PID:3036 -
\??\c:\9nttth.exec:\9nttth.exe37⤵
- Executes dropped EXE
PID:2684 -
\??\c:\vddvp.exec:\vddvp.exe38⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xxxlxll.exec:\xxxlxll.exe39⤵
- Executes dropped EXE
PID:2900 -
\??\c:\lrrfrff.exec:\lrrfrff.exe40⤵
- Executes dropped EXE
PID:2760 -
\??\c:\tbbnnn.exec:\tbbnnn.exe41⤵
- Executes dropped EXE
PID:2796 -
\??\c:\ppvjd.exec:\ppvjd.exe42⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jdvdv.exec:\jdvdv.exe43⤵
- Executes dropped EXE
PID:2556 -
\??\c:\lxrfxll.exec:\lxrfxll.exe44⤵
- Executes dropped EXE
PID:2668 -
\??\c:\tnntht.exec:\tnntht.exe45⤵
- Executes dropped EXE
PID:2820 -
\??\c:\vvvjp.exec:\vvvjp.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:540 -
\??\c:\dvvdp.exec:\dvvdp.exe47⤵
- Executes dropped EXE
PID:1248 -
\??\c:\9llrxlx.exec:\9llrxlx.exe48⤵
- Executes dropped EXE
PID:2012 -
\??\c:\lfxxlfl.exec:\lfxxlfl.exe49⤵
- Executes dropped EXE
PID:2044 -
\??\c:\9bthtb.exec:\9bthtb.exe50⤵
- Executes dropped EXE
PID:2616 -
\??\c:\pjjpv.exec:\pjjpv.exe51⤵
- Executes dropped EXE
PID:768 -
\??\c:\rlffrxl.exec:\rlffrxl.exe52⤵
- Executes dropped EXE
PID:1204 -
\??\c:\xxrxrxl.exec:\xxrxrxl.exe53⤵
- Executes dropped EXE
PID:1128 -
\??\c:\ttthtb.exec:\ttthtb.exe54⤵
- Executes dropped EXE
PID:2188 -
\??\c:\dddpp.exec:\dddpp.exe55⤵
- Executes dropped EXE
PID:2116 -
\??\c:\7pddd.exec:\7pddd.exe56⤵
- Executes dropped EXE
PID:2212 -
\??\c:\xrfflrf.exec:\xrfflrf.exe57⤵
- Executes dropped EXE
PID:1936 -
\??\c:\nhbbtt.exec:\nhbbtt.exe58⤵
- Executes dropped EXE
PID:940 -
\??\c:\7hhtnn.exec:\7hhtnn.exe59⤵
- Executes dropped EXE
PID:2656 -
\??\c:\pdvdv.exec:\pdvdv.exe60⤵
- Executes dropped EXE
PID:808 -
\??\c:\fxlrxfr.exec:\fxlrxfr.exe61⤵
- Executes dropped EXE
PID:924 -
\??\c:\rrlrllx.exec:\rrlrllx.exe62⤵
- Executes dropped EXE
PID:1100 -
\??\c:\9nhtnb.exec:\9nhtnb.exe63⤵
- Executes dropped EXE
PID:836 -
\??\c:\vvpvj.exec:\vvpvj.exe64⤵
- Executes dropped EXE
PID:1080 -
\??\c:\dpppv.exec:\dpppv.exe65⤵
- Executes dropped EXE
PID:1648 -
\??\c:\5frrxxl.exec:\5frrxxl.exe66⤵PID:1848
-
\??\c:\bbthbn.exec:\bbthbn.exe67⤵PID:984
-
\??\c:\btnbhn.exec:\btnbhn.exe68⤵PID:2272
-
\??\c:\vpdvv.exec:\vpdvv.exe69⤵PID:2516
-
\??\c:\rlflxfx.exec:\rlflxfx.exe70⤵PID:1972
-
\??\c:\rxfrlfr.exec:\rxfrlfr.exe71⤵PID:684
-
\??\c:\tnnbhb.exec:\tnnbhb.exe72⤵PID:872
-
\??\c:\5dvdj.exec:\5dvdj.exe73⤵PID:2996
-
\??\c:\ffxfxxx.exec:\ffxfxxx.exe74⤵PID:2640
-
\??\c:\9fxxrrx.exec:\9fxxrrx.exe75⤵PID:1984
-
\??\c:\hhhbtb.exec:\hhhbtb.exe76⤵PID:2456
-
\??\c:\bntnbn.exec:\bntnbn.exe77⤵PID:3020
-
\??\c:\pjjjj.exec:\pjjjj.exe78⤵PID:2460
-
\??\c:\7frrxlx.exec:\7frrxlx.exe79⤵PID:3032
-
\??\c:\nhbhbh.exec:\nhbhbh.exe80⤵PID:2504
-
\??\c:\9pjpp.exec:\9pjpp.exe81⤵PID:2776
-
\??\c:\lrrfrfl.exec:\lrrfrfl.exe82⤵PID:2896
-
\??\c:\xxfxlrf.exec:\xxfxlrf.exe83⤵PID:2360
-
\??\c:\tnnthn.exec:\tnnthn.exe84⤵PID:2672
-
\??\c:\1dpvj.exec:\1dpvj.exe85⤵PID:2860
-
\??\c:\jjddp.exec:\jjddp.exe86⤵PID:2572
-
\??\c:\xfffrrl.exec:\xfffrrl.exe87⤵
- System Location Discovery: System Language Discovery
PID:2976 -
\??\c:\tttbnh.exec:\tttbnh.exe88⤵PID:2980
-
\??\c:\hnnhbh.exec:\hnnhbh.exe89⤵PID:1092
-
\??\c:\jdpvv.exec:\jdpvv.exe90⤵PID:1728
-
\??\c:\xxffllr.exec:\xxffllr.exe91⤵PID:484
-
\??\c:\3fxrffl.exec:\3fxrffl.exe92⤵PID:1788
-
\??\c:\tnhnhh.exec:\tnhnhh.exe93⤵PID:1164
-
\??\c:\ppvdj.exec:\ppvdj.exe94⤵PID:1856
-
\??\c:\pppvj.exec:\pppvj.exe95⤵PID:2112
-
\??\c:\ffxlxrl.exec:\ffxlxrl.exe96⤵PID:2732
-
\??\c:\tbbbnt.exec:\tbbbnt.exe97⤵PID:2872
-
\??\c:\dvjpd.exec:\dvjpd.exe98⤵PID:2204
-
\??\c:\7vvdj.exec:\7vvdj.exe99⤵PID:2100
-
\??\c:\rlflrrf.exec:\rlflrrf.exe100⤵PID:2220
-
\??\c:\hthnht.exec:\hthnht.exe101⤵PID:2132
-
\??\c:\tnbnbh.exec:\tnbnbh.exe102⤵PID:1596
-
\??\c:\ddjvd.exec:\ddjvd.exe103⤵PID:668
-
\??\c:\9rxfxxl.exec:\9rxfxxl.exe104⤵PID:952
-
\??\c:\tnhnbn.exec:\tnhnbn.exe105⤵PID:896
-
\??\c:\hhbhbb.exec:\hhbhbb.exe106⤵PID:1320
-
\??\c:\3pjpd.exec:\3pjpd.exe107⤵PID:2436
-
\??\c:\lfrrxlf.exec:\lfrrxlf.exe108⤵PID:2232
-
\??\c:\xxxlflr.exec:\xxxlflr.exe109⤵PID:1848
-
\??\c:\7hbbbh.exec:\7hbbbh.exe110⤵PID:1808
-
\??\c:\ddvvv.exec:\ddvvv.exe111⤵PID:2528
-
\??\c:\xfxfxxl.exec:\xfxfxxl.exe112⤵PID:2516
-
\??\c:\fxlxlrr.exec:\fxlxlrr.exe113⤵PID:2936
-
\??\c:\tthnbb.exec:\tthnbb.exe114⤵PID:684
-
\??\c:\djdpd.exec:\djdpd.exe115⤵PID:1084
-
\??\c:\xlrrffx.exec:\xlrrffx.exe116⤵PID:2996
-
\??\c:\tnnnbt.exec:\tnnnbt.exe117⤵PID:2640
-
\??\c:\1htbnt.exec:\1htbnt.exe118⤵PID:1984
-
\??\c:\jvpdv.exec:\jvpdv.exe119⤵PID:2456
-
\??\c:\7xlrllr.exec:\7xlrllr.exe120⤵PID:2880
-
\??\c:\bhbtnb.exec:\bhbtnb.exe121⤵PID:3064
-
\??\c:\vvdjv.exec:\vvdjv.exe122⤵PID:2804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-