Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 10:35
Behavioral task
behavioral1
Sample
54dfd30f8476669fa88b6d84cfb89c2d92502ca5aaed6b290e39d1e6fde1a48d.exe
Resource
win7-20240729-en
General
-
Target
54dfd30f8476669fa88b6d84cfb89c2d92502ca5aaed6b290e39d1e6fde1a48d.exe
-
Size
67KB
-
MD5
87fd57d32f54a02186b4850acdb92c89
-
SHA1
6f6dbb996ae8a20e6138620cada0eac8dbe543ff
-
SHA256
54dfd30f8476669fa88b6d84cfb89c2d92502ca5aaed6b290e39d1e6fde1a48d
-
SHA512
f03914a30a1180860c9667285bb45ccd01d522071c5c9f6e52687367ea214d51fd7cbce9ed2a96a402e3e635c0b526052f8b9b73872d5fd5823cc0f649ae9495
-
SSDEEP
1536:/vQBeOGtrYS3srx93UBWfwC6Ggnouy8jb5DiLKrb08I:/hOmTsF93UYfwC6GIoutcKbe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 58 IoCs
resource yara_rule behavioral1/memory/2188-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2972-89-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2100-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2424-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2100-109-0x0000000001B50000-0x0000000001B77000-memory.dmp family_blackmoon behavioral1/memory/1260-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/296-132-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/448-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/296-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-170-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/772-187-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/772-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2204-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2356-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1144-223-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/600-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1556-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1480-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1980-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2424-390-0x00000000001C0000-0x00000000001E7000-memory.dmp family_blackmoon behavioral1/memory/1260-409-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2832-416-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1260-431-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1908-490-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-567-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-566-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2232-574-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1364-588-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-607-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1564-668-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-693-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1020-706-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1300-726-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/1528-733-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1784-753-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2076-765-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-877-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-901-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2456-988-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2388-1105-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/832-1326-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2284-1347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1336-1385-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2772-1398-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3004-1425-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2596-1432-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3004-1448-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3056-1476-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2232 5dvvd.exe 2772 9xflrxx.exe 2740 rxrfxfx.exe 2708 pjvjv.exe 2972 dvjpp.exe 2056 xffrfrf.exe 2656 nbnnnb.exe 2360 7thttt.exe 900 jdddv.exe 2424 rxllrfr.exe 2100 3ntbnt.exe 1260 tnbhhh.exe 296 dvjjd.exe 2812 xrlxrlr.exe 448 tbbtbh.exe 2676 5nhtth.exe 2852 vpddj.exe 2136 rrrrxxl.exe 772 nnttbb.exe 2204 jdppj.exe 2012 7fxxfrx.exe 2356 9bbbtt.exe 1144 nnntbh.exe 600 jdjpv.exe 1016 xxfflfl.exe 1556 hbhntb.exe 2284 ttnbnt.exe 1992 jppvj.exe 664 ffllxxf.exe 880 1nbhnb.exe 2400 tnttnt.exe 2520 jpdvp.exe 2800 rxlfrrx.exe 2780 nhhhnh.exe 1480 bhnthh.exe 2392 jjjvj.exe 1716 1jvjd.exe 3004 xxffllx.exe 2628 ffxxlll.exe 2584 bbbnth.exe 1980 jdpvj.exe 2632 jjvdp.exe 1516 vvjvv.exe 2440 ffrrxfl.exe 1580 ntnhbh.exe 2424 nnhhbn.exe 2064 ddjjv.exe 1520 flrfrrf.exe 1260 lrlxrfr.exe 2832 hnbttb.exe 1496 1bnttn.exe 1020 jdvjv.exe 1140 9xlfrfr.exe 2940 xrxfxlr.exe 1976 hnbhtb.exe 1528 7btbtt.exe 1392 djjpd.exe 324 lfrxrfx.exe 772 lrlrlxf.exe 884 tthnht.exe 2332 tbhhnt.exe 1908 5dpdj.exe 1276 jdpvd.exe 892 flfrllf.exe -
resource yara_rule behavioral1/memory/2188-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b00000001225e-5.dat upx behavioral1/memory/2232-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2188-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001930d-19.dat upx behavioral1/memory/2772-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2232-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2740-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001932d-30.dat upx behavioral1/memory/2772-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001933b-39.dat upx behavioral1/memory/2708-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019374-48.dat upx behavioral1/memory/2972-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001939b-60.dat upx behavioral1/memory/2972-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000193b3-69.dat upx behavioral1/memory/2056-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000193b5-78.dat upx behavioral1/memory/2656-76-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019dbf-85.dat upx behavioral1/memory/2100-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019f94-105.dat upx behavioral1/memory/2424-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019f8a-96.dat upx behavioral1/memory/1260-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a075-115.dat upx behavioral1/files/0x000500000001a07e-123.dat upx behavioral1/memory/448-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a359-151.dat upx behavioral1/files/0x000500000001a307-143.dat upx behavioral1/files/0x000500000001a09e-135.dat upx behavioral1/memory/296-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/296-130-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2676-160-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001a41b-162.dat upx behavioral1/memory/2676-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-158-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001a41d-172.dat upx behavioral1/files/0x000500000001a41e-179.dat upx behavioral1/files/0x000500000001a427-190.dat upx behavioral1/memory/772-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a42d-196.dat upx behavioral1/memory/2204-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a46f-206.dat upx behavioral1/files/0x000500000001a48b-215.dat upx behavioral1/memory/2356-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1144-223-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001a48d-225.dat upx behavioral1/files/0x000500000001a499-233.dat upx behavioral1/memory/600-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a49a-242.dat upx behavioral1/memory/1556-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4a9-250.dat upx behavioral1/files/0x000500000001a4af-258.dat upx behavioral1/files/0x000500000001a4b1-266.dat upx behavioral1/files/0x0036000000019240-274.dat upx behavioral1/memory/880-275-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b3-283.dat upx behavioral1/memory/1992-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b5-292.dat upx behavioral1/memory/2520-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2780-313-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1480-320-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2232 2188 54dfd30f8476669fa88b6d84cfb89c2d92502ca5aaed6b290e39d1e6fde1a48d.exe 30 PID 2188 wrote to memory of 2232 2188 54dfd30f8476669fa88b6d84cfb89c2d92502ca5aaed6b290e39d1e6fde1a48d.exe 30 PID 2188 wrote to memory of 2232 2188 54dfd30f8476669fa88b6d84cfb89c2d92502ca5aaed6b290e39d1e6fde1a48d.exe 30 PID 2188 wrote to memory of 2232 2188 54dfd30f8476669fa88b6d84cfb89c2d92502ca5aaed6b290e39d1e6fde1a48d.exe 30 PID 2232 wrote to memory of 2772 2232 5dvvd.exe 31 PID 2232 wrote to memory of 2772 2232 5dvvd.exe 31 PID 2232 wrote to memory of 2772 2232 5dvvd.exe 31 PID 2232 wrote to memory of 2772 2232 5dvvd.exe 31 PID 2772 wrote to memory of 2740 2772 9xflrxx.exe 32 PID 2772 wrote to memory of 2740 2772 9xflrxx.exe 32 PID 2772 wrote to memory of 2740 2772 9xflrxx.exe 32 PID 2772 wrote to memory of 2740 2772 9xflrxx.exe 32 PID 2740 wrote to memory of 2708 2740 rxrfxfx.exe 33 PID 2740 wrote to memory of 2708 2740 rxrfxfx.exe 33 PID 2740 wrote to memory of 2708 2740 rxrfxfx.exe 33 PID 2740 wrote to memory of 2708 2740 rxrfxfx.exe 33 PID 2708 wrote to memory of 2972 2708 pjvjv.exe 34 PID 2708 wrote to memory of 2972 2708 pjvjv.exe 34 PID 2708 wrote to memory of 2972 2708 pjvjv.exe 34 PID 2708 wrote to memory of 2972 2708 pjvjv.exe 34 PID 2972 wrote to memory of 2056 2972 dvjpp.exe 35 PID 2972 wrote to memory of 2056 2972 dvjpp.exe 35 PID 2972 wrote to memory of 2056 2972 dvjpp.exe 35 PID 2972 wrote to memory of 2056 2972 dvjpp.exe 35 PID 2056 wrote to memory of 2656 2056 xffrfrf.exe 36 PID 2056 wrote to memory of 2656 2056 xffrfrf.exe 36 PID 2056 wrote to memory of 2656 2056 xffrfrf.exe 36 PID 2056 wrote to memory of 2656 2056 xffrfrf.exe 36 PID 2656 wrote to memory of 2360 2656 nbnnnb.exe 37 PID 2656 wrote to memory of 2360 2656 nbnnnb.exe 37 PID 2656 wrote to memory of 2360 2656 nbnnnb.exe 37 PID 2656 wrote to memory of 2360 2656 nbnnnb.exe 37 PID 2360 wrote to memory of 900 2360 7thttt.exe 38 PID 2360 wrote to memory of 900 2360 7thttt.exe 38 PID 2360 wrote to memory of 900 2360 7thttt.exe 38 PID 2360 wrote to memory of 900 2360 7thttt.exe 38 PID 900 wrote to memory of 2424 900 jdddv.exe 39 PID 900 wrote to memory of 2424 900 jdddv.exe 39 PID 900 wrote to memory of 2424 900 jdddv.exe 39 PID 900 wrote to memory of 2424 900 jdddv.exe 39 PID 2424 wrote to memory of 2100 2424 rxllrfr.exe 40 PID 2424 wrote to memory of 2100 2424 rxllrfr.exe 40 PID 2424 wrote to memory of 2100 2424 rxllrfr.exe 40 PID 2424 wrote to memory of 2100 2424 rxllrfr.exe 40 PID 2100 wrote to memory of 1260 2100 3ntbnt.exe 41 PID 2100 wrote to memory of 1260 2100 3ntbnt.exe 41 PID 2100 wrote to memory of 1260 2100 3ntbnt.exe 41 PID 2100 wrote to memory of 1260 2100 3ntbnt.exe 41 PID 1260 wrote to memory of 296 1260 tnbhhh.exe 42 PID 1260 wrote to memory of 296 1260 tnbhhh.exe 42 PID 1260 wrote to memory of 296 1260 tnbhhh.exe 42 PID 1260 wrote to memory of 296 1260 tnbhhh.exe 42 PID 296 wrote to memory of 2812 296 dvjjd.exe 43 PID 296 wrote to memory of 2812 296 dvjjd.exe 43 PID 296 wrote to memory of 2812 296 dvjjd.exe 43 PID 296 wrote to memory of 2812 296 dvjjd.exe 43 PID 2812 wrote to memory of 448 2812 xrlxrlr.exe 44 PID 2812 wrote to memory of 448 2812 xrlxrlr.exe 44 PID 2812 wrote to memory of 448 2812 xrlxrlr.exe 44 PID 2812 wrote to memory of 448 2812 xrlxrlr.exe 44 PID 448 wrote to memory of 2676 448 tbbtbh.exe 45 PID 448 wrote to memory of 2676 448 tbbtbh.exe 45 PID 448 wrote to memory of 2676 448 tbbtbh.exe 45 PID 448 wrote to memory of 2676 448 tbbtbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\54dfd30f8476669fa88b6d84cfb89c2d92502ca5aaed6b290e39d1e6fde1a48d.exe"C:\Users\Admin\AppData\Local\Temp\54dfd30f8476669fa88b6d84cfb89c2d92502ca5aaed6b290e39d1e6fde1a48d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\5dvvd.exec:\5dvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\9xflrxx.exec:\9xflrxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\rxrfxfx.exec:\rxrfxfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\pjvjv.exec:\pjvjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\dvjpp.exec:\dvjpp.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\xffrfrf.exec:\xffrfrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\nbnnnb.exec:\nbnnnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\7thttt.exec:\7thttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\jdddv.exec:\jdddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
\??\c:\rxllrfr.exec:\rxllrfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\3ntbnt.exec:\3ntbnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\tnbhhh.exec:\tnbhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\dvjjd.exec:\dvjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
\??\c:\xrlxrlr.exec:\xrlxrlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\tbbtbh.exec:\tbbtbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\5nhtth.exec:\5nhtth.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2676 -
\??\c:\vpddj.exec:\vpddj.exe18⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rrrrxxl.exec:\rrrrxxl.exe19⤵
- Executes dropped EXE
PID:2136 -
\??\c:\nnttbb.exec:\nnttbb.exe20⤵
- Executes dropped EXE
PID:772 -
\??\c:\jdppj.exec:\jdppj.exe21⤵
- Executes dropped EXE
PID:2204 -
\??\c:\7fxxfrx.exec:\7fxxfrx.exe22⤵
- Executes dropped EXE
PID:2012 -
\??\c:\9bbbtt.exec:\9bbbtt.exe23⤵
- Executes dropped EXE
PID:2356 -
\??\c:\nnntbh.exec:\nnntbh.exe24⤵
- Executes dropped EXE
PID:1144 -
\??\c:\jdjpv.exec:\jdjpv.exe25⤵
- Executes dropped EXE
PID:600 -
\??\c:\xxfflfl.exec:\xxfflfl.exe26⤵
- Executes dropped EXE
PID:1016 -
\??\c:\hbhntb.exec:\hbhntb.exe27⤵
- Executes dropped EXE
PID:1556 -
\??\c:\ttnbnt.exec:\ttnbnt.exe28⤵
- Executes dropped EXE
PID:2284 -
\??\c:\jppvj.exec:\jppvj.exe29⤵
- Executes dropped EXE
PID:1992 -
\??\c:\ffllxxf.exec:\ffllxxf.exe30⤵
- Executes dropped EXE
PID:664 -
\??\c:\1nbhnb.exec:\1nbhnb.exe31⤵
- Executes dropped EXE
PID:880 -
\??\c:\tnttnt.exec:\tnttnt.exe32⤵
- Executes dropped EXE
PID:2400 -
\??\c:\jpdvp.exec:\jpdvp.exe33⤵
- Executes dropped EXE
PID:2520 -
\??\c:\rxlfrrx.exec:\rxlfrrx.exe34⤵
- Executes dropped EXE
PID:2800 -
\??\c:\nhhhnh.exec:\nhhhnh.exe35⤵
- Executes dropped EXE
PID:2780 -
\??\c:\bhnthh.exec:\bhnthh.exe36⤵
- Executes dropped EXE
PID:1480 -
\??\c:\jjjvj.exec:\jjjvj.exe37⤵
- Executes dropped EXE
PID:2392 -
\??\c:\1jvjd.exec:\1jvjd.exe38⤵
- Executes dropped EXE
PID:1716 -
\??\c:\xxffllx.exec:\xxffllx.exe39⤵
- Executes dropped EXE
PID:3004 -
\??\c:\ffxxlll.exec:\ffxxlll.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\bbbnth.exec:\bbbnth.exe41⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jdpvj.exec:\jdpvj.exe42⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jjvdp.exec:\jjvdp.exe43⤵
- Executes dropped EXE
PID:2632 -
\??\c:\vvjvv.exec:\vvjvv.exe44⤵
- Executes dropped EXE
PID:1516 -
\??\c:\ffrrxfl.exec:\ffrrxfl.exe45⤵
- Executes dropped EXE
PID:2440 -
\??\c:\ntnhbh.exec:\ntnhbh.exe46⤵
- Executes dropped EXE
PID:1580 -
\??\c:\nnhhbn.exec:\nnhhbn.exe47⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ddjjv.exec:\ddjjv.exe48⤵
- Executes dropped EXE
PID:2064 -
\??\c:\flrfrrf.exec:\flrfrrf.exe49⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lrlxrfr.exec:\lrlxrfr.exe50⤵
- Executes dropped EXE
PID:1260 -
\??\c:\hnbttb.exec:\hnbttb.exe51⤵
- Executes dropped EXE
PID:2832 -
\??\c:\1bnttn.exec:\1bnttn.exe52⤵
- Executes dropped EXE
PID:1496 -
\??\c:\jdvjv.exec:\jdvjv.exe53⤵
- Executes dropped EXE
PID:1020 -
\??\c:\9xlfrfr.exec:\9xlfrfr.exe54⤵
- Executes dropped EXE
PID:1140 -
\??\c:\xrxfxlr.exec:\xrxfxlr.exe55⤵
- Executes dropped EXE
PID:2940 -
\??\c:\hnbhtb.exec:\hnbhtb.exe56⤵
- Executes dropped EXE
PID:1976 -
\??\c:\7btbtt.exec:\7btbtt.exe57⤵
- Executes dropped EXE
PID:1528 -
\??\c:\djjpd.exec:\djjpd.exe58⤵
- Executes dropped EXE
PID:1392 -
\??\c:\lfrxrfx.exec:\lfrxrfx.exe59⤵
- Executes dropped EXE
PID:324 -
\??\c:\lrlrlxf.exec:\lrlrlxf.exe60⤵
- Executes dropped EXE
PID:772 -
\??\c:\tthnht.exec:\tthnht.exe61⤵
- Executes dropped EXE
PID:884 -
\??\c:\tbhhnt.exec:\tbhhnt.exe62⤵
- Executes dropped EXE
PID:2332 -
\??\c:\5dpdj.exec:\5dpdj.exe63⤵
- Executes dropped EXE
PID:1908 -
\??\c:\jdpvd.exec:\jdpvd.exe64⤵
- Executes dropped EXE
PID:1276 -
\??\c:\flfrllf.exec:\flfrllf.exe65⤵
- Executes dropped EXE
PID:892 -
\??\c:\bbntht.exec:\bbntht.exe66⤵PID:2684
-
\??\c:\hhhhnh.exec:\hhhhnh.exe67⤵PID:1432
-
\??\c:\jvpdp.exec:\jvpdp.exe68⤵PID:2244
-
\??\c:\7pjpj.exec:\7pjpj.exe69⤵PID:1556
-
\??\c:\1lxlxxl.exec:\1lxlxxl.exe70⤵PID:2664
-
\??\c:\llxxrxl.exec:\llxxrxl.exe71⤵PID:2196
-
\??\c:\tnhhhb.exec:\tnhhhb.exe72⤵PID:1656
-
\??\c:\btttbh.exec:\btttbh.exe73⤵PID:1216
-
\??\c:\djddp.exec:\djddp.exe74⤵PID:876
-
\??\c:\jvjjd.exec:\jvjjd.exe75⤵PID:2188
-
\??\c:\fflrxxl.exec:\fflrxxl.exe76⤵PID:2232
-
\??\c:\hnbhtt.exec:\hnbhtt.exe77⤵PID:2732
-
\??\c:\1tnthn.exec:\1tnthn.exe78⤵PID:2876
-
\??\c:\3pdjv.exec:\3pdjv.exe79⤵PID:1364
-
\??\c:\djpdp.exec:\djpdp.exe80⤵PID:2700
-
\??\c:\rrxfrrx.exec:\rrxfrrx.exe81⤵PID:3020
-
\??\c:\rrrxfxl.exec:\rrrxfxl.exe82⤵PID:2764
-
\??\c:\ttbhtb.exec:\ttbhtb.exe83⤵PID:2696
-
\??\c:\9jvjd.exec:\9jvjd.exe84⤵PID:2056
-
\??\c:\pvjvv.exec:\pvjvv.exe85⤵PID:1996
-
\??\c:\xflxlrf.exec:\xflxlrf.exe86⤵PID:2260
-
\??\c:\flllxlr.exec:\flllxlr.exe87⤵PID:2348
-
\??\c:\hhbntt.exec:\hhbntt.exe88⤵PID:1516
-
\??\c:\3hbnhb.exec:\3hbnhb.exe89⤵PID:2440
-
\??\c:\jdpdp.exec:\jdpdp.exe90⤵PID:1580
-
\??\c:\ddpjd.exec:\ddpjd.exe91⤵PID:1564
-
\??\c:\xlxlrxf.exec:\xlxlrxf.exe92⤵PID:1052
-
\??\c:\rxfrrxl.exec:\rxfrrxl.exe93⤵PID:1520
-
\??\c:\lrrxrlf.exec:\lrrxrlf.exe94⤵PID:1260
-
\??\c:\5nbbht.exec:\5nbbht.exe95⤵PID:1728
-
\??\c:\ththth.exec:\ththth.exe96⤵PID:1800
-
\??\c:\vjjdd.exec:\vjjdd.exe97⤵PID:1020
-
\??\c:\vdvdv.exec:\vdvdv.exe98⤵PID:1200
-
\??\c:\flxxlxl.exec:\flxxlxl.exe99⤵PID:2940
-
\??\c:\9hbhhh.exec:\9hbhhh.exe100⤵PID:1300
-
\??\c:\9btnnb.exec:\9btnnb.exe101⤵PID:1528
-
\??\c:\ntbtht.exec:\ntbtht.exe102⤵PID:2420
-
\??\c:\3jjjv.exec:\3jjjv.exe103⤵PID:2328
-
\??\c:\lxlxfrl.exec:\lxlxfrl.exe104⤵PID:1784
-
\??\c:\rrflrfr.exec:\rrflrfr.exe105⤵PID:884
-
\??\c:\hnhbht.exec:\hnhbht.exe106⤵PID:2076
-
\??\c:\pvpdp.exec:\pvpdp.exe107⤵PID:2368
-
\??\c:\lrxfrxr.exec:\lrxfrxr.exe108⤵PID:892
-
\??\c:\xflxlxr.exec:\xflxlxr.exe109⤵PID:1624
-
\??\c:\bbbhnt.exec:\bbbhnt.exe110⤵PID:1016
-
\??\c:\nbbtht.exec:\nbbtht.exe111⤵PID:2524
-
\??\c:\jvjvv.exec:\jvjvv.exe112⤵PID:1536
-
\??\c:\pvjvd.exec:\pvjvd.exe113⤵PID:2180
-
\??\c:\flxlxfx.exec:\flxlxfx.exe114⤵PID:1992
-
\??\c:\xfxrxrx.exec:\xfxrxrx.exe115⤵PID:2428
-
\??\c:\5flrfxl.exec:\5flrfxl.exe116⤵PID:1216
-
\??\c:\nnhhtt.exec:\nnhhtt.exe117⤵PID:2112
-
\??\c:\1nhtbn.exec:\1nhtbn.exe118⤵PID:876
-
\??\c:\vdpvd.exec:\vdpvd.exe119⤵PID:2384
-
\??\c:\ddpdp.exec:\ddpdp.exe120⤵PID:2232
-
\??\c:\lrxflrx.exec:\lrxflrx.exe121⤵PID:2800
-
\??\c:\7xllffx.exec:\7xllffx.exe122⤵PID:2712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-