Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 08:36
Static task
static1
Behavioral task
behavioral1
Sample
858522ade56ef8346756e95f4ffc9ce5db17b6f4b7070cf92abc1d1854b78397.exe
Resource
win7-20240903-en
General
-
Target
858522ade56ef8346756e95f4ffc9ce5db17b6f4b7070cf92abc1d1854b78397.exe
-
Size
456KB
-
MD5
879edf229a3ad8d1bd495ee5144949c4
-
SHA1
c016fedda18e1a7bd17e50beecb3e16447901e72
-
SHA256
858522ade56ef8346756e95f4ffc9ce5db17b6f4b7070cf92abc1d1854b78397
-
SHA512
b46534caf4c14742000ecef02f7a14f574a060d3a2cbaa4455df966080a51450c684322814de035afa7d1a7af8d231e56efc9bd0d055cada9e511ffc6276497d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRM:q7Tc2NYHUrAwfMp3CDRM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/1968-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-72-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2696-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-128-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2784-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/348-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/440-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-345-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2832-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/668-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/660-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-615-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2844-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-777-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1672-797-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2816-804-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1572-857-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2520-864-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1984-921-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1708-968-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2376 frflrlx.exe 2116 frxfrxl.exe 2392 htbntb.exe 2676 jpvjv.exe 2732 ffrlfff.exe 2832 ntbthh.exe 2592 7pvdp.exe 2756 llrllfl.exe 2696 pvvpd.exe 2648 lrrxrxx.exe 2920 rxrfxlx.exe 616 xrfxxff.exe 2904 bnbthh.exe 1528 9vpvp.exe 2784 tbbttn.exe 2960 vdjjd.exe 1848 jvjdp.exe 1444 9bbnnb.exe 1660 rrxffrl.exe 348 tbhbhn.exe 440 9pjvd.exe 1044 9frrfrx.exe 1672 bbhtth.exe 2040 bhtnnn.exe 1692 pjjdp.exe 1556 fflxlxl.exe 2156 bbnbnb.exe 3052 djddj.exe 2304 flfflfl.exe 1764 pdjdj.exe 1076 xxxrxxr.exe 2404 fllfxrr.exe 1936 hhthbn.exe 1724 jdjjj.exe 2344 7ffrrxl.exe 1928 bhbbhb.exe 1048 nththn.exe 2124 vppdp.exe 2828 llfxlxl.exe 2740 httnht.exe 2832 thbbhh.exe 2744 ppjpj.exe 2780 lrfxffl.exe 2596 nbbbhh.exe 2916 jdppd.exe 2656 3llrfrl.exe 2328 nttnht.exe 668 ttthtb.exe 2416 vddjd.exe 1708 fffrfrr.exe 824 tbhbbn.exe 2936 djjdp.exe 1356 frrlxfx.exe 3000 tttnbh.exe 1152 5hbnbn.exe 2320 pppdp.exe 2972 xlxxllr.exe 2384 1bnhnn.exe 904 nhhnth.exe 1132 jpppd.exe 1288 xxxrlrr.exe 952 httbbn.exe 2460 pjddp.exe 660 3ppjv.exe -
resource yara_rule behavioral1/memory/1968-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-32-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2676-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/616-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-128-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2784-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-167-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1444-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/440-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-317-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1928-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-345-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2744-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/660-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/660-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-757-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-818-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-838-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-864-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/1868-928-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-941-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-968-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1688-1034-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-1053-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhntnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2376 1968 858522ade56ef8346756e95f4ffc9ce5db17b6f4b7070cf92abc1d1854b78397.exe 30 PID 1968 wrote to memory of 2376 1968 858522ade56ef8346756e95f4ffc9ce5db17b6f4b7070cf92abc1d1854b78397.exe 30 PID 1968 wrote to memory of 2376 1968 858522ade56ef8346756e95f4ffc9ce5db17b6f4b7070cf92abc1d1854b78397.exe 30 PID 1968 wrote to memory of 2376 1968 858522ade56ef8346756e95f4ffc9ce5db17b6f4b7070cf92abc1d1854b78397.exe 30 PID 2376 wrote to memory of 2116 2376 frflrlx.exe 31 PID 2376 wrote to memory of 2116 2376 frflrlx.exe 31 PID 2376 wrote to memory of 2116 2376 frflrlx.exe 31 PID 2376 wrote to memory of 2116 2376 frflrlx.exe 31 PID 2116 wrote to memory of 2392 2116 frxfrxl.exe 32 PID 2116 wrote to memory of 2392 2116 frxfrxl.exe 32 PID 2116 wrote to memory of 2392 2116 frxfrxl.exe 32 PID 2116 wrote to memory of 2392 2116 frxfrxl.exe 32 PID 2392 wrote to memory of 2676 2392 htbntb.exe 33 PID 2392 wrote to memory of 2676 2392 htbntb.exe 33 PID 2392 wrote to memory of 2676 2392 htbntb.exe 33 PID 2392 wrote to memory of 2676 2392 htbntb.exe 33 PID 2676 wrote to memory of 2732 2676 jpvjv.exe 34 PID 2676 wrote to memory of 2732 2676 jpvjv.exe 34 PID 2676 wrote to memory of 2732 2676 jpvjv.exe 34 PID 2676 wrote to memory of 2732 2676 jpvjv.exe 34 PID 2732 wrote to memory of 2832 2732 ffrlfff.exe 35 PID 2732 wrote to memory of 2832 2732 ffrlfff.exe 35 PID 2732 wrote to memory of 2832 2732 ffrlfff.exe 35 PID 2732 wrote to memory of 2832 2732 ffrlfff.exe 35 PID 2832 wrote to memory of 2592 2832 ntbthh.exe 36 PID 2832 wrote to memory of 2592 2832 ntbthh.exe 36 PID 2832 wrote to memory of 2592 2832 ntbthh.exe 36 PID 2832 wrote to memory of 2592 2832 ntbthh.exe 36 PID 2592 wrote to memory of 2756 2592 7pvdp.exe 37 PID 2592 wrote to memory of 2756 2592 7pvdp.exe 37 PID 2592 wrote to memory of 2756 2592 7pvdp.exe 37 PID 2592 wrote to memory of 2756 2592 7pvdp.exe 37 PID 2756 wrote to memory of 2696 2756 llrllfl.exe 38 PID 2756 wrote to memory of 2696 2756 llrllfl.exe 38 PID 2756 wrote to memory of 2696 2756 llrllfl.exe 38 PID 2756 wrote to memory of 2696 2756 llrllfl.exe 38 PID 2696 wrote to memory of 2648 2696 pvvpd.exe 39 PID 2696 wrote to memory of 2648 2696 pvvpd.exe 39 PID 2696 wrote to memory of 2648 2696 pvvpd.exe 39 PID 2696 wrote to memory of 2648 2696 pvvpd.exe 39 PID 2648 wrote to memory of 2920 2648 lrrxrxx.exe 40 PID 2648 wrote to memory of 2920 2648 lrrxrxx.exe 40 PID 2648 wrote to memory of 2920 2648 lrrxrxx.exe 40 PID 2648 wrote to memory of 2920 2648 lrrxrxx.exe 40 PID 2920 wrote to memory of 616 2920 rxrfxlx.exe 41 PID 2920 wrote to memory of 616 2920 rxrfxlx.exe 41 PID 2920 wrote to memory of 616 2920 rxrfxlx.exe 41 PID 2920 wrote to memory of 616 2920 rxrfxlx.exe 41 PID 616 wrote to memory of 2904 616 xrfxxff.exe 42 PID 616 wrote to memory of 2904 616 xrfxxff.exe 42 PID 616 wrote to memory of 2904 616 xrfxxff.exe 42 PID 616 wrote to memory of 2904 616 xrfxxff.exe 42 PID 2904 wrote to memory of 1528 2904 bnbthh.exe 43 PID 2904 wrote to memory of 1528 2904 bnbthh.exe 43 PID 2904 wrote to memory of 1528 2904 bnbthh.exe 43 PID 2904 wrote to memory of 1528 2904 bnbthh.exe 43 PID 1528 wrote to memory of 2784 1528 9vpvp.exe 44 PID 1528 wrote to memory of 2784 1528 9vpvp.exe 44 PID 1528 wrote to memory of 2784 1528 9vpvp.exe 44 PID 1528 wrote to memory of 2784 1528 9vpvp.exe 44 PID 2784 wrote to memory of 2960 2784 tbbttn.exe 45 PID 2784 wrote to memory of 2960 2784 tbbttn.exe 45 PID 2784 wrote to memory of 2960 2784 tbbttn.exe 45 PID 2784 wrote to memory of 2960 2784 tbbttn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\858522ade56ef8346756e95f4ffc9ce5db17b6f4b7070cf92abc1d1854b78397.exe"C:\Users\Admin\AppData\Local\Temp\858522ade56ef8346756e95f4ffc9ce5db17b6f4b7070cf92abc1d1854b78397.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\frflrlx.exec:\frflrlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\frxfrxl.exec:\frxfrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\htbntb.exec:\htbntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\jpvjv.exec:\jpvjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\ffrlfff.exec:\ffrlfff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\ntbthh.exec:\ntbthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\7pvdp.exec:\7pvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\llrllfl.exec:\llrllfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\pvvpd.exec:\pvvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\lrrxrxx.exec:\lrrxrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\rxrfxlx.exec:\rxrfxlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\xrfxxff.exec:\xrfxxff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
\??\c:\bnbthh.exec:\bnbthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\9vpvp.exec:\9vpvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\tbbttn.exec:\tbbttn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\vdjjd.exec:\vdjjd.exe17⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jvjdp.exec:\jvjdp.exe18⤵
- Executes dropped EXE
PID:1848 -
\??\c:\9bbnnb.exec:\9bbnnb.exe19⤵
- Executes dropped EXE
PID:1444 -
\??\c:\rrxffrl.exec:\rrxffrl.exe20⤵
- Executes dropped EXE
PID:1660 -
\??\c:\tbhbhn.exec:\tbhbhn.exe21⤵
- Executes dropped EXE
PID:348 -
\??\c:\9pjvd.exec:\9pjvd.exe22⤵
- Executes dropped EXE
PID:440 -
\??\c:\9frrfrx.exec:\9frrfrx.exe23⤵
- Executes dropped EXE
PID:1044 -
\??\c:\bbhtth.exec:\bbhtth.exe24⤵
- Executes dropped EXE
PID:1672 -
\??\c:\bhtnnn.exec:\bhtnnn.exe25⤵
- Executes dropped EXE
PID:2040 -
\??\c:\pjjdp.exec:\pjjdp.exe26⤵
- Executes dropped EXE
PID:1692 -
\??\c:\fflxlxl.exec:\fflxlxl.exe27⤵
- Executes dropped EXE
PID:1556 -
\??\c:\bbnbnb.exec:\bbnbnb.exe28⤵
- Executes dropped EXE
PID:2156 -
\??\c:\djddj.exec:\djddj.exe29⤵
- Executes dropped EXE
PID:3052 -
\??\c:\flfflfl.exec:\flfflfl.exe30⤵
- Executes dropped EXE
PID:2304 -
\??\c:\pdjdj.exec:\pdjdj.exe31⤵
- Executes dropped EXE
PID:1764 -
\??\c:\xxxrxxr.exec:\xxxrxxr.exe32⤵
- Executes dropped EXE
PID:1076 -
\??\c:\fllfxrr.exec:\fllfxrr.exe33⤵
- Executes dropped EXE
PID:2404 -
\??\c:\hhthbn.exec:\hhthbn.exe34⤵
- Executes dropped EXE
PID:1936 -
\??\c:\jdjjj.exec:\jdjjj.exe35⤵
- Executes dropped EXE
PID:1724 -
\??\c:\7ffrrxl.exec:\7ffrrxl.exe36⤵
- Executes dropped EXE
PID:2344 -
\??\c:\bhbbhb.exec:\bhbbhb.exe37⤵
- Executes dropped EXE
PID:1928 -
\??\c:\nththn.exec:\nththn.exe38⤵
- Executes dropped EXE
PID:1048 -
\??\c:\vppdp.exec:\vppdp.exe39⤵
- Executes dropped EXE
PID:2124 -
\??\c:\llfxlxl.exec:\llfxlxl.exe40⤵
- Executes dropped EXE
PID:2828 -
\??\c:\httnht.exec:\httnht.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\thbbhh.exec:\thbbhh.exe42⤵
- Executes dropped EXE
PID:2832 -
\??\c:\ppjpj.exec:\ppjpj.exe43⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lrfxffl.exec:\lrfxffl.exe44⤵
- Executes dropped EXE
PID:2780 -
\??\c:\nbbbhh.exec:\nbbbhh.exe45⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jdppd.exec:\jdppd.exe46⤵
- Executes dropped EXE
PID:2916 -
\??\c:\3llrfrl.exec:\3llrfrl.exe47⤵
- Executes dropped EXE
PID:2656 -
\??\c:\nttnht.exec:\nttnht.exe48⤵
- Executes dropped EXE
PID:2328 -
\??\c:\ttthtb.exec:\ttthtb.exe49⤵
- Executes dropped EXE
PID:668 -
\??\c:\vddjd.exec:\vddjd.exe50⤵
- Executes dropped EXE
PID:2416 -
\??\c:\fffrfrr.exec:\fffrfrr.exe51⤵
- Executes dropped EXE
PID:1708 -
\??\c:\tbhbbn.exec:\tbhbbn.exe52⤵
- Executes dropped EXE
PID:824 -
\??\c:\djjdp.exec:\djjdp.exe53⤵
- Executes dropped EXE
PID:2936 -
\??\c:\frrlxfx.exec:\frrlxfx.exe54⤵
- Executes dropped EXE
PID:1356 -
\??\c:\tttnbh.exec:\tttnbh.exe55⤵
- Executes dropped EXE
PID:3000 -
\??\c:\5hbnbn.exec:\5hbnbn.exe56⤵
- Executes dropped EXE
PID:1152 -
\??\c:\pppdp.exec:\pppdp.exe57⤵
- Executes dropped EXE
PID:2320 -
\??\c:\xlxxllr.exec:\xlxxllr.exe58⤵
- Executes dropped EXE
PID:2972 -
\??\c:\1bnhnn.exec:\1bnhnn.exe59⤵
- Executes dropped EXE
PID:2384 -
\??\c:\nhhnth.exec:\nhhnth.exe60⤵
- Executes dropped EXE
PID:904 -
\??\c:\jpppd.exec:\jpppd.exe61⤵
- Executes dropped EXE
PID:1132 -
\??\c:\xxxrlrr.exec:\xxxrlrr.exe62⤵
- Executes dropped EXE
PID:1288 -
\??\c:\httbbn.exec:\httbbn.exe63⤵
- Executes dropped EXE
PID:952 -
\??\c:\pjddp.exec:\pjddp.exe64⤵
- Executes dropped EXE
PID:2460 -
\??\c:\3ppjv.exec:\3ppjv.exe65⤵
- Executes dropped EXE
PID:660 -
\??\c:\5lrlfxl.exec:\5lrlfxl.exe66⤵PID:892
-
\??\c:\thtnhn.exec:\thtnhn.exe67⤵PID:1448
-
\??\c:\jdjjd.exec:\jdjjd.exe68⤵PID:692
-
\??\c:\fffrrff.exec:\fffrrff.exe69⤵PID:1088
-
\??\c:\hhntnt.exec:\hhntnt.exe70⤵PID:2436
-
\??\c:\djdvj.exec:\djdvj.exe71⤵PID:2552
-
\??\c:\pvvpp.exec:\pvvpp.exe72⤵PID:1532
-
\??\c:\fxxfrrl.exec:\fxxfrrl.exe73⤵PID:2272
-
\??\c:\hhhbnb.exec:\hhhbnb.exe74⤵PID:1192
-
\??\c:\5jpdp.exec:\5jpdp.exe75⤵PID:2500
-
\??\c:\dpjdd.exec:\dpjdd.exe76⤵PID:1592
-
\??\c:\lxflxxx.exec:\lxflxxx.exe77⤵PID:2664
-
\??\c:\tbhhtb.exec:\tbhhtb.exe78⤵PID:1704
-
\??\c:\djjvj.exec:\djjvj.exe79⤵PID:2928
-
\??\c:\rrffrrx.exec:\rrffrrx.exe80⤵PID:1928
-
\??\c:\nhtnbb.exec:\nhtnbb.exe81⤵PID:2060
-
\??\c:\thbbbn.exec:\thbbbn.exe82⤵PID:2844
-
\??\c:\jpppd.exec:\jpppd.exe83⤵PID:2872
-
\??\c:\lfffxrr.exec:\lfffxrr.exe84⤵PID:2740
-
\??\c:\tttnht.exec:\tttnht.exe85⤵PID:2180
-
\??\c:\ppjvd.exec:\ppjvd.exe86⤵PID:2796
-
\??\c:\dvvvj.exec:\dvvvj.exe87⤵PID:2580
-
\??\c:\xrxxfxl.exec:\xrxxfxl.exe88⤵PID:2788
-
\??\c:\btbnhn.exec:\btbnhn.exe89⤵PID:2600
-
\??\c:\vjvpj.exec:\vjvpj.exe90⤵PID:2316
-
\??\c:\vjjpp.exec:\vjjpp.exe91⤵PID:2572
-
\??\c:\3rfflfr.exec:\3rfflfr.exe92⤵PID:2888
-
\??\c:\hhtbnn.exec:\hhtbnn.exe93⤵PID:2348
-
\??\c:\pjdpd.exec:\pjdpd.exe94⤵PID:1336
-
\??\c:\9xfxfll.exec:\9xfxfll.exe95⤵PID:2900
-
\??\c:\nnnnbb.exec:\nnnnbb.exe96⤵PID:300
-
\??\c:\jdpjv.exec:\jdpjv.exe97⤵PID:1972
-
\??\c:\xfrrflx.exec:\xfrrflx.exe98⤵
- System Location Discovery: System Language Discovery
PID:1296 -
\??\c:\nnhhtb.exec:\nnhhtb.exe99⤵PID:3012
-
\??\c:\pdpjp.exec:\pdpjp.exe100⤵PID:2948
-
\??\c:\1vjjp.exec:\1vjjp.exe101⤵PID:1072
-
\??\c:\xxrllrr.exec:\xxrllrr.exe102⤵PID:2568
-
\??\c:\btbhnh.exec:\btbhnh.exe103⤵PID:3024
-
\??\c:\djvpv.exec:\djvpv.exe104⤵PID:920
-
\??\c:\9lrrrrl.exec:\9lrrrrl.exe105⤵PID:1184
-
\??\c:\5lflxfx.exec:\5lflxfx.exe106⤵PID:1672
-
\??\c:\7hbnbn.exec:\7hbnbn.exe107⤵PID:1796
-
\??\c:\dpjjp.exec:\dpjjp.exe108⤵PID:1684
-
\??\c:\rrrfxfx.exec:\rrrfxfx.exe109⤵PID:892
-
\??\c:\3tttnb.exec:\3tttnb.exe110⤵PID:2816
-
\??\c:\vvpvv.exec:\vvpvv.exe111⤵PID:2448
-
\??\c:\xrffrxf.exec:\xrffrxf.exe112⤵PID:1300
-
\??\c:\lrrlxxr.exec:\lrrlxxr.exe113⤵PID:2184
-
\??\c:\tnhbhb.exec:\tnhbhb.exe114⤵PID:880
-
\??\c:\ffxlxlf.exec:\ffxlxlf.exe115⤵PID:2272
-
\??\c:\xlxxlfr.exec:\xlxxlfr.exe116⤵PID:1076
-
\??\c:\nttbth.exec:\nttbth.exe117⤵PID:1728
-
\??\c:\dvjdd.exec:\dvjdd.exe118⤵PID:1572
-
\??\c:\rrfrxll.exec:\rrfrxll.exe119⤵PID:2520
-
\??\c:\3bbhbh.exec:\3bbhbh.exe120⤵PID:2768
-
\??\c:\7ttnbn.exec:\7ttnbn.exe121⤵PID:3040
-
\??\c:\9jjpj.exec:\9jjpj.exe122⤵PID:1520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-