Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 09:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe
-
Size
455KB
-
MD5
73840ae348c002e76799d16e9cb1ec38
-
SHA1
1085bb6307d1fc9c075fabfb1b279e1009813be3
-
SHA256
11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688
-
SHA512
2f0a6ede90d4cba102fb3bac83373c0d671d014ca422559ef2081f81f4a0ee1b35c715425f543190274060787cb965e161bcebffc87a56e3bbae32c87d14018b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJ:q7Tc2NYHUrAwfMp3CDJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2516-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-190-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2476-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-281-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2960-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-549-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/536-650-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1044-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-810-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2248-824-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-703-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-702-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1044-676-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2608-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/596-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-369-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2620-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-272-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2456-263-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2340-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-136-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3052-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-56-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1076-1066-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/892-1075-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3020 9bbhtt.exe 2336 rlffrfx.exe 1692 xxxlfrx.exe 2304 ddpdp.exe 2800 rrrxfxl.exe 2748 vvpdj.exe 2712 vddvp.exe 3068 ttbhht.exe 2596 pvvjj.exe 2716 flfrxxl.exe 3052 5rfffxx.exe 1480 jpjvj.exe 3036 xlflrrl.exe 1484 hnnhtb.exe 2940 jpjjd.exe 2340 xfxlxfl.exe 3012 bbnhnn.exe 1448 vppvv.exe 1088 xrffffl.exe 1664 5bntht.exe 1280 1pvjp.exe 792 pvvjj.exe 2476 7xrffxx.exe 2980 7tbbbh.exe 1816 ttthhh.exe 2164 xxfrxxf.exe 2388 tthnhn.exe 2456 jpdjv.exe 336 rlrllxx.exe 1940 dvpvp.exe 1252 3pdjj.exe 1612 rfrxrxl.exe 2408 bbbhbn.exe 2336 vvjjp.exe 1908 rlxfflr.exe 2688 bhtthh.exe 2820 jpvpd.exe 2960 3djjv.exe 2972 llxfrxr.exe 2620 hbtbtb.exe 2812 ppdjp.exe 3068 rllffrf.exe 2600 btntnn.exe 2084 1dvvj.exe 1488 vpvdp.exe 1976 fxlffxx.exe 3060 fxllrrr.exe 2656 hbhntn.exe 2944 1bbnnn.exe 1584 djdvd.exe 596 xrfrffx.exe 1684 tnhbnn.exe 2040 1hbhhn.exe 2896 vvpvd.exe 2136 3vppd.exe 2552 frxrfxx.exe 1640 thbnhn.exe 1280 bbnhnn.exe 1688 dpdjj.exe 2968 lxlrrrf.exe 1316 7lxxxxf.exe 1716 tnbbnh.exe 1132 httnnb.exe 2072 3vpvv.exe -
resource yara_rule behavioral1/memory/3020-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-598-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/776-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-857-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-824-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-1088-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-1101-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lflxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2516 wrote to memory of 3020 2516 11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe 30 PID 2516 wrote to memory of 3020 2516 11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe 30 PID 2516 wrote to memory of 3020 2516 11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe 30 PID 2516 wrote to memory of 3020 2516 11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe 30 PID 3020 wrote to memory of 2336 3020 9bbhtt.exe 31 PID 3020 wrote to memory of 2336 3020 9bbhtt.exe 31 PID 3020 wrote to memory of 2336 3020 9bbhtt.exe 31 PID 3020 wrote to memory of 2336 3020 9bbhtt.exe 31 PID 2336 wrote to memory of 1692 2336 rlffrfx.exe 32 PID 2336 wrote to memory of 1692 2336 rlffrfx.exe 32 PID 2336 wrote to memory of 1692 2336 rlffrfx.exe 32 PID 2336 wrote to memory of 1692 2336 rlffrfx.exe 32 PID 1692 wrote to memory of 2304 1692 xxxlfrx.exe 33 PID 1692 wrote to memory of 2304 1692 xxxlfrx.exe 33 PID 1692 wrote to memory of 2304 1692 xxxlfrx.exe 33 PID 1692 wrote to memory of 2304 1692 xxxlfrx.exe 33 PID 2304 wrote to memory of 2800 2304 ddpdp.exe 34 PID 2304 wrote to memory of 2800 2304 ddpdp.exe 34 PID 2304 wrote to memory of 2800 2304 ddpdp.exe 34 PID 2304 wrote to memory of 2800 2304 ddpdp.exe 34 PID 2800 wrote to memory of 2748 2800 rrrxfxl.exe 35 PID 2800 wrote to memory of 2748 2800 rrrxfxl.exe 35 PID 2800 wrote to memory of 2748 2800 rrrxfxl.exe 35 PID 2800 wrote to memory of 2748 2800 rrrxfxl.exe 35 PID 2748 wrote to memory of 2712 2748 vvpdj.exe 110 PID 2748 wrote to memory of 2712 2748 vvpdj.exe 110 PID 2748 wrote to memory of 2712 2748 vvpdj.exe 110 PID 2748 wrote to memory of 2712 2748 vvpdj.exe 110 PID 2712 wrote to memory of 3068 2712 vddvp.exe 71 PID 2712 wrote to memory of 3068 2712 vddvp.exe 71 PID 2712 wrote to memory of 3068 2712 vddvp.exe 71 PID 2712 wrote to memory of 3068 2712 vddvp.exe 71 PID 3068 wrote to memory of 2596 3068 ttbhht.exe 38 PID 3068 wrote to memory of 2596 3068 ttbhht.exe 38 PID 3068 wrote to memory of 2596 3068 ttbhht.exe 38 PID 3068 wrote to memory of 2596 3068 ttbhht.exe 38 PID 2596 wrote to memory of 2716 2596 pvvjj.exe 39 PID 2596 wrote to memory of 2716 2596 pvvjj.exe 39 PID 2596 wrote to memory of 2716 2596 pvvjj.exe 39 PID 2596 wrote to memory of 2716 2596 pvvjj.exe 39 PID 2716 wrote to memory of 3052 2716 flfrxxl.exe 40 PID 2716 wrote to memory of 3052 2716 flfrxxl.exe 40 PID 2716 wrote to memory of 3052 2716 flfrxxl.exe 40 PID 2716 wrote to memory of 3052 2716 flfrxxl.exe 40 PID 3052 wrote to memory of 1480 3052 5rfffxx.exe 41 PID 3052 wrote to memory of 1480 3052 5rfffxx.exe 41 PID 3052 wrote to memory of 1480 3052 5rfffxx.exe 41 PID 3052 wrote to memory of 1480 3052 5rfffxx.exe 41 PID 1480 wrote to memory of 3036 1480 jpjvj.exe 42 PID 1480 wrote to memory of 3036 1480 jpjvj.exe 42 PID 1480 wrote to memory of 3036 1480 jpjvj.exe 42 PID 1480 wrote to memory of 3036 1480 jpjvj.exe 42 PID 3036 wrote to memory of 1484 3036 xlflrrl.exe 43 PID 3036 wrote to memory of 1484 3036 xlflrrl.exe 43 PID 3036 wrote to memory of 1484 3036 xlflrrl.exe 43 PID 3036 wrote to memory of 1484 3036 xlflrrl.exe 43 PID 1484 wrote to memory of 2940 1484 hnnhtb.exe 44 PID 1484 wrote to memory of 2940 1484 hnnhtb.exe 44 PID 1484 wrote to memory of 2940 1484 hnnhtb.exe 44 PID 1484 wrote to memory of 2940 1484 hnnhtb.exe 44 PID 2940 wrote to memory of 2340 2940 jpjjd.exe 45 PID 2940 wrote to memory of 2340 2940 jpjjd.exe 45 PID 2940 wrote to memory of 2340 2940 jpjjd.exe 45 PID 2940 wrote to memory of 2340 2940 jpjjd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe"C:\Users\Admin\AppData\Local\Temp\11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\9bbhtt.exec:\9bbhtt.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\rlffrfx.exec:\rlffrfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\xxxlfrx.exec:\xxxlfrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\ddpdp.exec:\ddpdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\rrrxfxl.exec:\rrrxfxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\vvpdj.exec:\vvpdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\vddvp.exec:\vddvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\ttbhht.exec:\ttbhht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\pvvjj.exec:\pvvjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\flfrxxl.exec:\flfrxxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\5rfffxx.exec:\5rfffxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\jpjvj.exec:\jpjvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\xlflrrl.exec:\xlflrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\hnnhtb.exec:\hnnhtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\jpjjd.exec:\jpjjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\xfxlxfl.exec:\xfxlxfl.exe17⤵
- Executes dropped EXE
PID:2340 -
\??\c:\bbnhnn.exec:\bbnhnn.exe18⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vppvv.exec:\vppvv.exe19⤵
- Executes dropped EXE
PID:1448 -
\??\c:\xrffffl.exec:\xrffffl.exe20⤵
- Executes dropped EXE
PID:1088 -
\??\c:\5bntht.exec:\5bntht.exe21⤵
- Executes dropped EXE
PID:1664 -
\??\c:\1pvjp.exec:\1pvjp.exe22⤵
- Executes dropped EXE
PID:1280 -
\??\c:\pvvjj.exec:\pvvjj.exe23⤵
- Executes dropped EXE
PID:792 -
\??\c:\7xrffxx.exec:\7xrffxx.exe24⤵
- Executes dropped EXE
PID:2476 -
\??\c:\7tbbbh.exec:\7tbbbh.exe25⤵
- Executes dropped EXE
PID:2980 -
\??\c:\ttthhh.exec:\ttthhh.exe26⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xxfrxxf.exec:\xxfrxxf.exe27⤵
- Executes dropped EXE
PID:2164 -
\??\c:\tthnhn.exec:\tthnhn.exe28⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jpdjv.exec:\jpdjv.exe29⤵
- Executes dropped EXE
PID:2456 -
\??\c:\rlrllxx.exec:\rlrllxx.exe30⤵
- Executes dropped EXE
PID:336 -
\??\c:\dvpvp.exec:\dvpvp.exe31⤵
- Executes dropped EXE
PID:1940 -
\??\c:\3pdjj.exec:\3pdjj.exe32⤵
- Executes dropped EXE
PID:1252 -
\??\c:\rfrxrxl.exec:\rfrxrxl.exe33⤵
- Executes dropped EXE
PID:1612 -
\??\c:\bbbhbn.exec:\bbbhbn.exe34⤵
- Executes dropped EXE
PID:2408 -
\??\c:\vvjjp.exec:\vvjjp.exe35⤵
- Executes dropped EXE
PID:2336 -
\??\c:\rlxfflr.exec:\rlxfflr.exe36⤵
- Executes dropped EXE
PID:1908 -
\??\c:\bhtthh.exec:\bhtthh.exe37⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jpvpd.exec:\jpvpd.exe38⤵
- Executes dropped EXE
PID:2820 -
\??\c:\3djjv.exec:\3djjv.exe39⤵
- Executes dropped EXE
PID:2960 -
\??\c:\llxfrxr.exec:\llxfrxr.exe40⤵
- Executes dropped EXE
PID:2972 -
\??\c:\hbtbtb.exec:\hbtbtb.exe41⤵
- Executes dropped EXE
PID:2620 -
\??\c:\ppdjp.exec:\ppdjp.exe42⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rllffrf.exec:\rllffrf.exe43⤵
- Executes dropped EXE
PID:3068 -
\??\c:\btntnn.exec:\btntnn.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\1dvvj.exec:\1dvvj.exe45⤵
- Executes dropped EXE
PID:2084 -
\??\c:\vpvdp.exec:\vpvdp.exe46⤵
- Executes dropped EXE
PID:1488 -
\??\c:\fxlffxx.exec:\fxlffxx.exe47⤵
- Executes dropped EXE
PID:1976 -
\??\c:\fxllrrr.exec:\fxllrrr.exe48⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hbhntn.exec:\hbhntn.exe49⤵
- Executes dropped EXE
PID:2656 -
\??\c:\1bbnnn.exec:\1bbnnn.exe50⤵
- Executes dropped EXE
PID:2944 -
\??\c:\djdvd.exec:\djdvd.exe51⤵
- Executes dropped EXE
PID:1584 -
\??\c:\xrfrffx.exec:\xrfrffx.exe52⤵
- Executes dropped EXE
PID:596 -
\??\c:\tnhbnn.exec:\tnhbnn.exe53⤵
- Executes dropped EXE
PID:1684 -
\??\c:\1hbhhn.exec:\1hbhhn.exe54⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vvpvd.exec:\vvpvd.exe55⤵
- Executes dropped EXE
PID:2896 -
\??\c:\3vppd.exec:\3vppd.exe56⤵
- Executes dropped EXE
PID:2136 -
\??\c:\frxrfxx.exec:\frxrfxx.exe57⤵
- Executes dropped EXE
PID:2552 -
\??\c:\thbnhn.exec:\thbnhn.exe58⤵
- Executes dropped EXE
PID:1640 -
\??\c:\bbnhnn.exec:\bbnhnn.exe59⤵
- Executes dropped EXE
PID:1280 -
\??\c:\dpdjj.exec:\dpdjj.exe60⤵
- Executes dropped EXE
PID:1688 -
\??\c:\lxlrrrf.exec:\lxlrrrf.exe61⤵
- Executes dropped EXE
PID:2968 -
\??\c:\7lxxxxf.exec:\7lxxxxf.exe62⤵
- Executes dropped EXE
PID:1316 -
\??\c:\tnbbnh.exec:\tnbbnh.exe63⤵
- Executes dropped EXE
PID:1716 -
\??\c:\httnnb.exec:\httnnb.exe64⤵
- Executes dropped EXE
PID:1132 -
\??\c:\3vpvv.exec:\3vpvv.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2072 -
\??\c:\xrllllx.exec:\xrllllx.exe66⤵PID:2692
-
\??\c:\1xllrxf.exec:\1xllrxf.exe67⤵PID:2388
-
\??\c:\9bnnbh.exec:\9bnnbh.exe68⤵PID:1512
-
\??\c:\bntbnn.exec:\bntbnn.exe69⤵PID:2452
-
\??\c:\pvvjd.exec:\pvvjd.exe70⤵PID:884
-
\??\c:\xrxllfr.exec:\xrxllfr.exe71⤵PID:1944
-
\??\c:\fxfflrr.exec:\fxfflrr.exe72⤵PID:2524
-
\??\c:\nhtbhh.exec:\nhtbhh.exe73⤵PID:1612
-
\??\c:\btnbhn.exec:\btnbhn.exe74⤵PID:2160
-
\??\c:\dpdjv.exec:\dpdjv.exe75⤵PID:2852
-
\??\c:\5pvvv.exec:\5pvvv.exe76⤵PID:1724
-
\??\c:\xlrlrll.exec:\xlrlrll.exe77⤵PID:1908
-
\??\c:\nhtbhh.exec:\nhtbhh.exe78⤵PID:2860
-
\??\c:\tnbhnb.exec:\tnbhnb.exe79⤵PID:2728
-
\??\c:\jdpvd.exec:\jdpvd.exe80⤵PID:2956
-
\??\c:\3dppj.exec:\3dppj.exe81⤵PID:1692
-
\??\c:\lxrrxff.exec:\lxrrxff.exe82⤵PID:2712
-
\??\c:\7nhtth.exec:\7nhtth.exe83⤵PID:2608
-
\??\c:\ntthbh.exec:\ntthbh.exe84⤵PID:2628
-
\??\c:\5dvvj.exec:\5dvvj.exe85⤵PID:2916
-
\??\c:\vvjjp.exec:\vvjjp.exe86⤵PID:680
-
\??\c:\xfflffr.exec:\xfflffr.exe87⤵PID:536
-
\??\c:\bnbttb.exec:\bnbttb.exe88⤵PID:1108
-
\??\c:\tbtnhn.exec:\tbtnhn.exe89⤵PID:776
-
\??\c:\jvvdd.exec:\jvvdd.exe90⤵PID:3064
-
\??\c:\lxxlxrr.exec:\lxxlxrr.exe91⤵PID:1044
-
\??\c:\9rrrrlf.exec:\9rrrrlf.exe92⤵PID:304
-
\??\c:\hthnbh.exec:\hthnbh.exe93⤵PID:484
-
\??\c:\9dvjp.exec:\9dvjp.exe94⤵PID:2696
-
\??\c:\pddpv.exec:\pddpv.exe95⤵PID:2104
-
\??\c:\lrxrfrr.exec:\lrxrfrr.exe96⤵PID:852
-
\??\c:\lxxfxrx.exec:\lxxfxrx.exe97⤵PID:320
-
\??\c:\5bntnb.exec:\5bntnb.exe98⤵PID:1968
-
\??\c:\vvjvj.exec:\vvjvj.exe99⤵PID:2928
-
\??\c:\pvpdv.exec:\pvpdv.exe100⤵PID:2116
-
\??\c:\lllxfrr.exec:\lllxfrr.exe101⤵PID:2652
-
\??\c:\fxlxlxr.exec:\fxlxlxr.exe102⤵PID:2568
-
\??\c:\hnnbbn.exec:\hnnbbn.exe103⤵PID:1160
-
\??\c:\ppdpj.exec:\ppdpj.exe104⤵PID:1400
-
\??\c:\ddjjj.exec:\ddjjj.exe105⤵PID:2036
-
\??\c:\3frflxx.exec:\3frflxx.exe106⤵PID:2276
-
\??\c:\lrfrxrf.exec:\lrfrxrf.exe107⤵PID:2372
-
\??\c:\nnbnht.exec:\nnbnht.exe108⤵PID:2128
-
\??\c:\1dpjd.exec:\1dpjd.exe109⤵PID:2364
-
\??\c:\pvpvp.exec:\pvpvp.exe110⤵PID:2388
-
\??\c:\rlxxffr.exec:\rlxxffr.exe111⤵PID:1512
-
\??\c:\llfrlrr.exec:\llfrlrr.exe112⤵PID:1644
-
\??\c:\bbthbb.exec:\bbthbb.exe113⤵PID:884
-
\??\c:\9hbthn.exec:\9hbthn.exe114⤵PID:2248
-
\??\c:\3xxfllx.exec:\3xxfllx.exe115⤵PID:2060
-
\??\c:\xfrrfxf.exec:\xfrrfxf.exe116⤵PID:1612
-
\??\c:\ttthbb.exec:\ttthbb.exe117⤵PID:2948
-
\??\c:\nhtnnb.exec:\nhtnnb.exe118⤵PID:1632
-
\??\c:\vpdpp.exec:\vpdpp.exe119⤵PID:2808
-
\??\c:\lxrxlxf.exec:\lxrxlxf.exe120⤵PID:2220
-
\??\c:\3rlrffl.exec:\3rlrffl.exe121⤵PID:1384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-