Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 11:07
Behavioral task
behavioral1
Sample
a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe
Resource
win7-20240903-en
General
-
Target
a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe
-
Size
79KB
-
MD5
db4d557f0966cb63b3f5e13b5c5b80bd
-
SHA1
4147b743c1503eafa8bfc539323d82980d568078
-
SHA256
a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165
-
SHA512
1606ac94b7a0ba40a53efb35b258f6ba0fcee09fa1f0f4c8435758567283e740e73787c447c6cfeb35f217db3dadef3e45eefce99f4edcb0e7e8cbd736efe735
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzx8/p7ke2t:xhOmTsF93UYfwC6GIout03LzGFO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/1704-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2384-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2356-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3000-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2204-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-72-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2904-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-90-0x0000000001B70000-0x0000000001B97000-memory.dmp family_blackmoon behavioral1/memory/3064-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-108-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2564-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1888-127-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1724-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1268-156-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1268-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/752-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/680-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1476-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2304-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1356-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2548-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-262-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1640-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-299-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2876-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-356-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2808-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2152-397-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1308-404-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2804-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1268-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1988-479-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-503-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2028-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1356-519-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/652-552-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1592-595-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-602-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2880-609-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2816-634-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1580-714-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/980-784-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2636-1179-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1468-1208-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/536-1280-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/300-1331-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1840-1380-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2356 ttbhtt.exe 2384 3ppdj.exe 2792 lflrlrl.exe 2748 bbbhbh.exe 3000 pvdvj.exe 2204 rrxrlxl.exe 2904 5bnbth.exe 2772 vjddv.exe 2620 frlxfxf.exe 3064 tnthbb.exe 1700 7pjdv.exe 2564 xxrxrlx.exe 1888 lffrllf.exe 1724 ttntnn.exe 2796 ppppv.exe 1268 rxflfrl.exe 2964 btthtb.exe 752 vvvpv.exe 2944 vvdpp.exe 680 rlfrllf.exe 1476 nhnhhn.exe 3012 ppvvj.exe 2304 pjdpv.exe 3008 llrlfrl.exe 1356 hhtnhn.exe 744 3hbtnt.exe 2548 pjddv.exe 3040 rrxrrrl.exe 1640 5tnhbn.exe 3032 1pvjj.exe 1648 frflffr.exe 2016 ntbnht.exe 2144 hhbtbn.exe 2528 vdppd.exe 1996 xrlrxrf.exe 1604 rxfxxfl.exe 2924 tbbtnb.exe 2760 tnnbbh.exe 2876 ppvdj.exe 2852 7jpvp.exe 2808 xrlxrfx.exe 2744 1ntttn.exe 2780 nhhtnt.exe 2680 7jjjd.exe 2620 djvvv.exe 2092 xxxrlrr.exe 2152 nnbhtt.exe 1308 ppvdv.exe 1780 dpddd.exe 2364 1xrrflx.exe 1724 llxfrxl.exe 2704 nhbhbn.exe 2804 pdppp.exe 1268 1pdvj.exe 1644 lfxxflx.exe 2188 5bbhbn.exe 3052 7hnbbt.exe 264 vddpj.exe 2588 3vjvd.exe 1988 fxflxxl.exe 2444 ffxxrxl.exe 3012 tttnth.exe 1128 jdvjd.exe 2028 3jjdj.exe -
resource yara_rule behavioral1/files/0x000700000001211a-5.dat upx behavioral1/memory/1704-6-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1704-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cd1-18.dat upx behavioral1/files/0x0009000000016cfc-27.dat upx behavioral1/memory/2384-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2356-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d36-38.dat upx behavioral1/files/0x0007000000016d3e-46.dat upx behavioral1/memory/2748-44-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2748-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2792-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d46-56.dat upx behavioral1/memory/3000-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d96-64.dat upx behavioral1/memory/2204-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2904-72-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2904-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d9a-73.dat upx behavioral1/files/0x0008000000016dd1-82.dat upx behavioral1/memory/2620-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018792-91.dat upx behavioral1/files/0x0006000000018c1a-101.dat upx behavioral1/memory/3064-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1700-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c26-110.dat upx behavioral1/files/0x0006000000018f53-120.dat upx behavioral1/memory/2564-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001903b-131.dat upx behavioral1/memory/1724-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190ce-139.dat upx behavioral1/memory/1724-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190e0-146.dat upx behavioral1/memory/2796-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191d4-158.dat upx behavioral1/memory/1268-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000191ff-168.dat upx behavioral1/files/0x000500000001922c-176.dat upx behavioral1/memory/752-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2796-180-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019244-186.dat upx behavioral1/files/0x0005000000019256-194.dat upx behavioral1/memory/680-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019259-204.dat upx behavioral1/memory/1476-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3012-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019263-212.dat upx behavioral1/files/0x0005000000019266-220.dat upx behavioral1/memory/3008-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2304-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019284-230.dat upx behavioral1/memory/1356-238-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001928c-240.dat upx behavioral1/files/0x0005000000019353-247.dat upx behavioral1/memory/2548-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c62-257.dat upx behavioral1/files/0x0005000000019356-264.dat upx behavioral1/memory/1640-274-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001936b-275.dat upx behavioral1/files/0x000500000001937b-283.dat upx behavioral1/files/0x0005000000019397-291.dat upx behavioral1/memory/2852-343-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2876-342-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2808-350-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1704 wrote to memory of 2356 1704 a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe 30 PID 1704 wrote to memory of 2356 1704 a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe 30 PID 1704 wrote to memory of 2356 1704 a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe 30 PID 1704 wrote to memory of 2356 1704 a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe 30 PID 2356 wrote to memory of 2384 2356 ttbhtt.exe 31 PID 2356 wrote to memory of 2384 2356 ttbhtt.exe 31 PID 2356 wrote to memory of 2384 2356 ttbhtt.exe 31 PID 2356 wrote to memory of 2384 2356 ttbhtt.exe 31 PID 2384 wrote to memory of 2792 2384 3ppdj.exe 32 PID 2384 wrote to memory of 2792 2384 3ppdj.exe 32 PID 2384 wrote to memory of 2792 2384 3ppdj.exe 32 PID 2384 wrote to memory of 2792 2384 3ppdj.exe 32 PID 2792 wrote to memory of 2748 2792 lflrlrl.exe 33 PID 2792 wrote to memory of 2748 2792 lflrlrl.exe 33 PID 2792 wrote to memory of 2748 2792 lflrlrl.exe 33 PID 2792 wrote to memory of 2748 2792 lflrlrl.exe 33 PID 2748 wrote to memory of 3000 2748 bbbhbh.exe 34 PID 2748 wrote to memory of 3000 2748 bbbhbh.exe 34 PID 2748 wrote to memory of 3000 2748 bbbhbh.exe 34 PID 2748 wrote to memory of 3000 2748 bbbhbh.exe 34 PID 3000 wrote to memory of 2204 3000 pvdvj.exe 35 PID 3000 wrote to memory of 2204 3000 pvdvj.exe 35 PID 3000 wrote to memory of 2204 3000 pvdvj.exe 35 PID 3000 wrote to memory of 2204 3000 pvdvj.exe 35 PID 2204 wrote to memory of 2904 2204 rrxrlxl.exe 36 PID 2204 wrote to memory of 2904 2204 rrxrlxl.exe 36 PID 2204 wrote to memory of 2904 2204 rrxrlxl.exe 36 PID 2204 wrote to memory of 2904 2204 rrxrlxl.exe 36 PID 2904 wrote to memory of 2772 2904 5bnbth.exe 37 PID 2904 wrote to memory of 2772 2904 5bnbth.exe 37 PID 2904 wrote to memory of 2772 2904 5bnbth.exe 37 PID 2904 wrote to memory of 2772 2904 5bnbth.exe 37 PID 2772 wrote to memory of 2620 2772 vjddv.exe 38 PID 2772 wrote to memory of 2620 2772 vjddv.exe 38 PID 2772 wrote to memory of 2620 2772 vjddv.exe 38 PID 2772 wrote to memory of 2620 2772 vjddv.exe 38 PID 2620 wrote to memory of 3064 2620 frlxfxf.exe 39 PID 2620 wrote to memory of 3064 2620 frlxfxf.exe 39 PID 2620 wrote to memory of 3064 2620 frlxfxf.exe 39 PID 2620 wrote to memory of 3064 2620 frlxfxf.exe 39 PID 3064 wrote to memory of 1700 3064 tnthbb.exe 40 PID 3064 wrote to memory of 1700 3064 tnthbb.exe 40 PID 3064 wrote to memory of 1700 3064 tnthbb.exe 40 PID 3064 wrote to memory of 1700 3064 tnthbb.exe 40 PID 1700 wrote to memory of 2564 1700 7pjdv.exe 41 PID 1700 wrote to memory of 2564 1700 7pjdv.exe 41 PID 1700 wrote to memory of 2564 1700 7pjdv.exe 41 PID 1700 wrote to memory of 2564 1700 7pjdv.exe 41 PID 2564 wrote to memory of 1888 2564 xxrxrlx.exe 42 PID 2564 wrote to memory of 1888 2564 xxrxrlx.exe 42 PID 2564 wrote to memory of 1888 2564 xxrxrlx.exe 42 PID 2564 wrote to memory of 1888 2564 xxrxrlx.exe 42 PID 1888 wrote to memory of 1724 1888 lffrllf.exe 43 PID 1888 wrote to memory of 1724 1888 lffrllf.exe 43 PID 1888 wrote to memory of 1724 1888 lffrllf.exe 43 PID 1888 wrote to memory of 1724 1888 lffrllf.exe 43 PID 1724 wrote to memory of 2796 1724 ttntnn.exe 44 PID 1724 wrote to memory of 2796 1724 ttntnn.exe 44 PID 1724 wrote to memory of 2796 1724 ttntnn.exe 44 PID 1724 wrote to memory of 2796 1724 ttntnn.exe 44 PID 2796 wrote to memory of 1268 2796 ppppv.exe 45 PID 2796 wrote to memory of 1268 2796 ppppv.exe 45 PID 2796 wrote to memory of 1268 2796 ppppv.exe 45 PID 2796 wrote to memory of 1268 2796 ppppv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe"C:\Users\Admin\AppData\Local\Temp\a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\ttbhtt.exec:\ttbhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\3ppdj.exec:\3ppdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\lflrlrl.exec:\lflrlrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\bbbhbh.exec:\bbbhbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\pvdvj.exec:\pvdvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\rrxrlxl.exec:\rrxrlxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\5bnbth.exec:\5bnbth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\vjddv.exec:\vjddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\frlxfxf.exec:\frlxfxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\tnthbb.exec:\tnthbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\7pjdv.exec:\7pjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\xxrxrlx.exec:\xxrxrlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\lffrllf.exec:\lffrllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\ttntnn.exec:\ttntnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\ppppv.exec:\ppppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\rxflfrl.exec:\rxflfrl.exe17⤵
- Executes dropped EXE
PID:1268 -
\??\c:\btthtb.exec:\btthtb.exe18⤵
- Executes dropped EXE
PID:2964 -
\??\c:\vvvpv.exec:\vvvpv.exe19⤵
- Executes dropped EXE
PID:752 -
\??\c:\vvdpp.exec:\vvdpp.exe20⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rlfrllf.exec:\rlfrllf.exe21⤵
- Executes dropped EXE
PID:680 -
\??\c:\nhnhhn.exec:\nhnhhn.exe22⤵
- Executes dropped EXE
PID:1476 -
\??\c:\ppvvj.exec:\ppvvj.exe23⤵
- Executes dropped EXE
PID:3012 -
\??\c:\pjdpv.exec:\pjdpv.exe24⤵
- Executes dropped EXE
PID:2304 -
\??\c:\llrlfrl.exec:\llrlfrl.exe25⤵
- Executes dropped EXE
PID:3008 -
\??\c:\hhtnhn.exec:\hhtnhn.exe26⤵
- Executes dropped EXE
PID:1356 -
\??\c:\3hbtnt.exec:\3hbtnt.exe27⤵
- Executes dropped EXE
PID:744 -
\??\c:\pjddv.exec:\pjddv.exe28⤵
- Executes dropped EXE
PID:2548 -
\??\c:\rrxrrrl.exec:\rrxrrrl.exe29⤵
- Executes dropped EXE
PID:3040 -
\??\c:\5tnhbn.exec:\5tnhbn.exe30⤵
- Executes dropped EXE
PID:1640 -
\??\c:\1pvjj.exec:\1pvjj.exe31⤵
- Executes dropped EXE
PID:3032 -
\??\c:\frflffr.exec:\frflffr.exe32⤵
- Executes dropped EXE
PID:1648 -
\??\c:\ntbnht.exec:\ntbnht.exe33⤵
- Executes dropped EXE
PID:2016 -
\??\c:\hhbtbn.exec:\hhbtbn.exe34⤵
- Executes dropped EXE
PID:2144 -
\??\c:\vdppd.exec:\vdppd.exe35⤵
- Executes dropped EXE
PID:2528 -
\??\c:\xrlrxrf.exec:\xrlrxrf.exe36⤵
- Executes dropped EXE
PID:1996 -
\??\c:\rxfxxfl.exec:\rxfxxfl.exe37⤵
- Executes dropped EXE
PID:1604 -
\??\c:\tbbtnb.exec:\tbbtnb.exe38⤵
- Executes dropped EXE
PID:2924 -
\??\c:\tnnbbh.exec:\tnnbbh.exe39⤵
- Executes dropped EXE
PID:2760 -
\??\c:\ppvdj.exec:\ppvdj.exe40⤵
- Executes dropped EXE
PID:2876 -
\??\c:\7jpvp.exec:\7jpvp.exe41⤵
- Executes dropped EXE
PID:2852 -
\??\c:\xrlxrfx.exec:\xrlxrfx.exe42⤵
- Executes dropped EXE
PID:2808 -
\??\c:\1ntttn.exec:\1ntttn.exe43⤵
- Executes dropped EXE
PID:2744 -
\??\c:\nhhtnt.exec:\nhhtnt.exe44⤵
- Executes dropped EXE
PID:2780 -
\??\c:\7jjjd.exec:\7jjjd.exe45⤵
- Executes dropped EXE
PID:2680 -
\??\c:\djvvv.exec:\djvvv.exe46⤵
- Executes dropped EXE
PID:2620 -
\??\c:\xxxrlrr.exec:\xxxrlrr.exe47⤵
- Executes dropped EXE
PID:2092 -
\??\c:\nnbhtt.exec:\nnbhtt.exe48⤵
- Executes dropped EXE
PID:2152 -
\??\c:\ppvdv.exec:\ppvdv.exe49⤵
- Executes dropped EXE
PID:1308 -
\??\c:\dpddd.exec:\dpddd.exe50⤵
- Executes dropped EXE
PID:1780 -
\??\c:\1xrrflx.exec:\1xrrflx.exe51⤵
- Executes dropped EXE
PID:2364 -
\??\c:\llxfrxl.exec:\llxfrxl.exe52⤵
- Executes dropped EXE
PID:1724 -
\??\c:\nhbhbn.exec:\nhbhbn.exe53⤵
- Executes dropped EXE
PID:2704 -
\??\c:\pdppp.exec:\pdppp.exe54⤵
- Executes dropped EXE
PID:2804 -
\??\c:\1pdvj.exec:\1pdvj.exe55⤵
- Executes dropped EXE
PID:1268 -
\??\c:\lfxxflx.exec:\lfxxflx.exe56⤵
- Executes dropped EXE
PID:1644 -
\??\c:\5bbhbn.exec:\5bbhbn.exe57⤵
- Executes dropped EXE
PID:2188 -
\??\c:\7hnbbt.exec:\7hnbbt.exe58⤵
- Executes dropped EXE
PID:3052 -
\??\c:\vddpj.exec:\vddpj.exe59⤵
- Executes dropped EXE
PID:264 -
\??\c:\3vjvd.exec:\3vjvd.exe60⤵
- Executes dropped EXE
PID:2588 -
\??\c:\fxflxxl.exec:\fxflxxl.exe61⤵
- Executes dropped EXE
PID:1988 -
\??\c:\ffxxrxl.exec:\ffxxrxl.exe62⤵
- Executes dropped EXE
PID:2444 -
\??\c:\tttnth.exec:\tttnth.exe63⤵
- Executes dropped EXE
PID:3012 -
\??\c:\jdvjd.exec:\jdvjd.exe64⤵
- Executes dropped EXE
PID:1128 -
\??\c:\3jjdj.exec:\3jjdj.exe65⤵
- Executes dropped EXE
PID:2028 -
\??\c:\xxlxflx.exec:\xxlxflx.exe66⤵PID:1664
-
\??\c:\hbtbhh.exec:\hbtbhh.exe67⤵PID:1356
-
\??\c:\nhbnth.exec:\nhbnth.exe68⤵PID:1916
-
\??\c:\3dpvj.exec:\3dpvj.exe69⤵PID:2212
-
\??\c:\xrxllxx.exec:\xrxllxx.exe70⤵PID:2052
-
\??\c:\flxxfxf.exec:\flxxfxf.exe71⤵PID:344
-
\??\c:\hbntnt.exec:\hbntnt.exe72⤵PID:652
-
\??\c:\nnnbhb.exec:\nnnbhb.exe73⤵PID:352
-
\??\c:\3dvjd.exec:\3dvjd.exe74⤵PID:1812
-
\??\c:\ffxrxlx.exec:\ffxrxlx.exe75⤵PID:1040
-
\??\c:\3xrlflf.exec:\3xrlflf.exe76⤵PID:2116
-
\??\c:\nnnbtb.exec:\nnnbtb.exe77⤵PID:1924
-
\??\c:\nbnhtt.exec:\nbnhtt.exe78⤵PID:2920
-
\??\c:\dvvdv.exec:\dvvdv.exe79⤵PID:1592
-
\??\c:\1ppjv.exec:\1ppjv.exe80⤵PID:1600
-
\??\c:\xxrrxlf.exec:\xxrrxlf.exe81⤵PID:2880
-
\??\c:\rrxrfll.exec:\rrxrfll.exe82⤵PID:2760
-
\??\c:\vpdjd.exec:\vpdjd.exe83⤵PID:2876
-
\??\c:\9jdpd.exec:\9jdpd.exe84⤵PID:2844
-
\??\c:\xlxxfrl.exec:\xlxxfrl.exe85⤵PID:2816
-
\??\c:\llfflxf.exec:\llfflxf.exe86⤵PID:1776
-
\??\c:\9hnnbb.exec:\9hnnbb.exe87⤵PID:2656
-
\??\c:\nnbhtt.exec:\nnbhtt.exe88⤵PID:2680
-
\??\c:\vdpdp.exec:\vdpdp.exe89⤵PID:2184
-
\??\c:\7ppvv.exec:\7ppvv.exe90⤵PID:820
-
\??\c:\1xfrxfr.exec:\1xfrxfr.exe91⤵PID:1108
-
\??\c:\3xrxrxf.exec:\3xrxrxf.exe92⤵PID:2820
-
\??\c:\hnhnbt.exec:\hnhnbt.exe93⤵PID:2840
-
\??\c:\ddvpd.exec:\ddvpd.exe94⤵PID:1780
-
\??\c:\jdpdv.exec:\jdpdv.exe95⤵PID:1260
-
\??\c:\rflxlxr.exec:\rflxlxr.exe96⤵PID:1724
-
\??\c:\llxrrrl.exec:\llxrrrl.exe97⤵PID:2704
-
\??\c:\hhhtnt.exec:\hhhtnt.exe98⤵PID:2804
-
\??\c:\ttthth.exec:\ttthth.exe99⤵PID:1580
-
\??\c:\7pjpv.exec:\7pjpv.exe100⤵PID:2960
-
\??\c:\jjvvd.exec:\jjvvd.exe101⤵PID:2188
-
\??\c:\llrrrfl.exec:\llrrrfl.exe102⤵PID:3052
-
\??\c:\1xlxllf.exec:\1xlxllf.exe103⤵PID:2280
-
\??\c:\nbbtnb.exec:\nbbtnb.exe104⤵PID:2208
-
\??\c:\ttbbht.exec:\ttbbht.exe105⤵PID:2368
-
\??\c:\dvjjd.exec:\dvjjd.exe106⤵PID:628
-
\??\c:\rrxxfrf.exec:\rrxxfrf.exe107⤵
- System Location Discovery: System Language Discovery
PID:1300 -
\??\c:\xrflxfl.exec:\xrflxfl.exe108⤵PID:1536
-
\??\c:\hhbtnt.exec:\hhbtnt.exe109⤵PID:2028
-
\??\c:\nbbnnt.exec:\nbbnnt.exe110⤵PID:980
-
\??\c:\vpjdd.exec:\vpjdd.exe111⤵PID:1852
-
\??\c:\pjvvd.exec:\pjvvd.exe112⤵PID:2472
-
\??\c:\5jppd.exec:\5jppd.exe113⤵PID:2988
-
\??\c:\xxxxxfr.exec:\xxxxxfr.exe114⤵PID:2296
-
\??\c:\nhhttb.exec:\nhhttb.exe115⤵PID:3040
-
\??\c:\nhbhbh.exec:\nhbhbh.exe116⤵PID:1496
-
\??\c:\ppjpj.exec:\ppjpj.exe117⤵PID:3032
-
\??\c:\vpvjv.exec:\vpvjv.exe118⤵PID:2268
-
\??\c:\lfrrlrl.exec:\lfrrlrl.exe119⤵PID:2112
-
\??\c:\9tthbh.exec:\9tthbh.exe120⤵PID:2372
-
\??\c:\tttbhn.exec:\tttbhn.exe121⤵PID:2144
-
\??\c:\vjjjj.exec:\vjjjj.exe122⤵PID:1732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-