Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 11:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0267679d201c437d001b1bea688c5642dadde324f4617e80cf16b8834da8198a.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
0267679d201c437d001b1bea688c5642dadde324f4617e80cf16b8834da8198a.exe
-
Size
454KB
-
MD5
52628940128b7538e06e15f537615f90
-
SHA1
3894297d789357897fe5128c1c2c06f43735a9bb
-
SHA256
0267679d201c437d001b1bea688c5642dadde324f4617e80cf16b8834da8198a
-
SHA512
2504a886bf8806f48d2b6c72ce8079b8aa16c46706ded2e9bd085a6f5b06bd70329d2ab7eb4c304194d6e7081b3ec81950113ce524c51b6690648d47faf36514
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe7:q7Tc2NYHUrAwfMp3CD7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2280-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1324-406-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1264-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1392-484-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2908-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-285-0x0000000077A30000-0x0000000077B2A000-memory.dmp family_blackmoon behavioral1/memory/2296-284-0x0000000077910000-0x0000000077A2F000-memory.dmp family_blackmoon behavioral1/memory/1664-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-247-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1352-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1392-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-152-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2204-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-62-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2780-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-45-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/316-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/984-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-503-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/984-508-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/984-513-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/3052-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-557-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2380-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-615-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2708-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-648-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2592-647-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2844-697-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2380-841-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-1025-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2364-1105-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3016-1146-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2972 xxfxfrr.exe 316 xfxxxxf.exe 544 5nhtht.exe 1660 nbttth.exe 2780 vvppd.exe 2788 vvvpd.exe 3016 xxfrxll.exe 2412 jjdpj.exe 2632 fflxfxf.exe 2752 jdjpj.exe 2252 fxrfxxx.exe 1760 dppjd.exe 2204 lxlxrrl.exe 1964 vjddd.exe 2692 nhnntt.exe 2732 jvdvv.exe 1768 lrrfrfx.exe 2020 dpjvj.exe 2088 vjdvd.exe 1728 jjvvp.exe 1392 vdjpj.exe 1352 vdjjp.exe 2080 lrrlxxr.exe 3040 hhnbbh.exe 2992 pvvpj.exe 1744 xxfrlxl.exe 2168 pdjdv.exe 1664 fxxfxxr.exe 1512 tbhbtn.exe 2296 hnttnt.exe 2544 xfflfxr.exe 1740 nnbbtt.exe 1612 1fffffl.exe 2824 nnnnbn.exe 2772 jjpdj.exe 2908 frffxfr.exe 2780 5rfrfrl.exe 2640 htbtbt.exe 2872 5jdpj.exe 2680 pjjdd.exe 2688 rrfllxl.exe 2676 bnbtnt.exe 2300 hnbbtt.exe 2104 9jpjj.exe 2860 jjjvp.exe 1264 rrxlxlf.exe 1324 bbbnht.exe 2620 ttntbn.exe 2400 pjpdp.exe 2844 lrxxxrr.exe 2692 bbbhth.exe 2540 7ntnbn.exe 1832 9ppjj.exe 1564 7xfrfrl.exe 2280 1rlrlrf.exe 1500 hbtbnb.exe 2112 3jjdj.exe 1864 ddjdv.exe 1392 3rxxlfl.exe 1352 9nbtnh.exe 3036 1jddv.exe 1972 vpjvd.exe 984 nnhthn.exe 2052 nnhbnn.exe -
resource yara_rule behavioral1/memory/1500-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-284-0x0000000077910000-0x0000000077A2F000-memory.dmp upx behavioral1/memory/1664-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-503-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3052-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-557-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2380-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-647-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2844-697-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1132-756-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2380-841-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-908-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-945-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-958-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-1045-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2364-1105-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2724-1107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-1126-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3016-1146-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2976-1147-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fflrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3llxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2712 wrote to memory of 2972 2712 0267679d201c437d001b1bea688c5642dadde324f4617e80cf16b8834da8198a.exe 30 PID 2712 wrote to memory of 2972 2712 0267679d201c437d001b1bea688c5642dadde324f4617e80cf16b8834da8198a.exe 30 PID 2712 wrote to memory of 2972 2712 0267679d201c437d001b1bea688c5642dadde324f4617e80cf16b8834da8198a.exe 30 PID 2712 wrote to memory of 2972 2712 0267679d201c437d001b1bea688c5642dadde324f4617e80cf16b8834da8198a.exe 30 PID 2972 wrote to memory of 316 2972 xxfxfrr.exe 31 PID 2972 wrote to memory of 316 2972 xxfxfrr.exe 31 PID 2972 wrote to memory of 316 2972 xxfxfrr.exe 31 PID 2972 wrote to memory of 316 2972 xxfxfrr.exe 31 PID 316 wrote to memory of 544 316 xfxxxxf.exe 32 PID 316 wrote to memory of 544 316 xfxxxxf.exe 32 PID 316 wrote to memory of 544 316 xfxxxxf.exe 32 PID 316 wrote to memory of 544 316 xfxxxxf.exe 32 PID 544 wrote to memory of 1660 544 5nhtht.exe 33 PID 544 wrote to memory of 1660 544 5nhtht.exe 33 PID 544 wrote to memory of 1660 544 5nhtht.exe 33 PID 544 wrote to memory of 1660 544 5nhtht.exe 33 PID 1660 wrote to memory of 2780 1660 nbttth.exe 34 PID 1660 wrote to memory of 2780 1660 nbttth.exe 34 PID 1660 wrote to memory of 2780 1660 nbttth.exe 34 PID 1660 wrote to memory of 2780 1660 nbttth.exe 34 PID 2780 wrote to memory of 2788 2780 vvppd.exe 35 PID 2780 wrote to memory of 2788 2780 vvppd.exe 35 PID 2780 wrote to memory of 2788 2780 vvppd.exe 35 PID 2780 wrote to memory of 2788 2780 vvppd.exe 35 PID 2788 wrote to memory of 3016 2788 vvvpd.exe 36 PID 2788 wrote to memory of 3016 2788 vvvpd.exe 36 PID 2788 wrote to memory of 3016 2788 vvvpd.exe 36 PID 2788 wrote to memory of 3016 2788 vvvpd.exe 36 PID 3016 wrote to memory of 2412 3016 xxfrxll.exe 37 PID 3016 wrote to memory of 2412 3016 xxfrxll.exe 37 PID 3016 wrote to memory of 2412 3016 xxfrxll.exe 37 PID 3016 wrote to memory of 2412 3016 xxfrxll.exe 37 PID 2412 wrote to memory of 2632 2412 jjdpj.exe 38 PID 2412 wrote to memory of 2632 2412 jjdpj.exe 38 PID 2412 wrote to memory of 2632 2412 jjdpj.exe 38 PID 2412 wrote to memory of 2632 2412 jjdpj.exe 38 PID 2632 wrote to memory of 2752 2632 fflxfxf.exe 39 PID 2632 wrote to memory of 2752 2632 fflxfxf.exe 39 PID 2632 wrote to memory of 2752 2632 fflxfxf.exe 39 PID 2632 wrote to memory of 2752 2632 fflxfxf.exe 39 PID 2752 wrote to memory of 2252 2752 jdjpj.exe 40 PID 2752 wrote to memory of 2252 2752 jdjpj.exe 40 PID 2752 wrote to memory of 2252 2752 jdjpj.exe 40 PID 2752 wrote to memory of 2252 2752 jdjpj.exe 40 PID 2252 wrote to memory of 1760 2252 fxrfxxx.exe 41 PID 2252 wrote to memory of 1760 2252 fxrfxxx.exe 41 PID 2252 wrote to memory of 1760 2252 fxrfxxx.exe 41 PID 2252 wrote to memory of 1760 2252 fxrfxxx.exe 41 PID 1760 wrote to memory of 2204 1760 dppjd.exe 42 PID 1760 wrote to memory of 2204 1760 dppjd.exe 42 PID 1760 wrote to memory of 2204 1760 dppjd.exe 42 PID 1760 wrote to memory of 2204 1760 dppjd.exe 42 PID 2204 wrote to memory of 1964 2204 lxlxrrl.exe 43 PID 2204 wrote to memory of 1964 2204 lxlxrrl.exe 43 PID 2204 wrote to memory of 1964 2204 lxlxrrl.exe 43 PID 2204 wrote to memory of 1964 2204 lxlxrrl.exe 43 PID 1964 wrote to memory of 2692 1964 vjddd.exe 44 PID 1964 wrote to memory of 2692 1964 vjddd.exe 44 PID 1964 wrote to memory of 2692 1964 vjddd.exe 44 PID 1964 wrote to memory of 2692 1964 vjddd.exe 44 PID 2692 wrote to memory of 2732 2692 nhnntt.exe 45 PID 2692 wrote to memory of 2732 2692 nhnntt.exe 45 PID 2692 wrote to memory of 2732 2692 nhnntt.exe 45 PID 2692 wrote to memory of 2732 2692 nhnntt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4183940270\zmstage.exeC:\Users\Admin\AppData\Local\Temp\4183940270\zmstage.exe1⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\0267679d201c437d001b1bea688c5642dadde324f4617e80cf16b8834da8198a.exe"C:\Users\Admin\AppData\Local\Temp\0267679d201c437d001b1bea688c5642dadde324f4617e80cf16b8834da8198a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\xxfxfrr.exec:\xxfxfrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\xfxxxxf.exec:\xfxxxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\5nhtht.exec:\5nhtht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\nbttth.exec:\nbttth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\vvppd.exec:\vvppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\vvvpd.exec:\vvvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\xxfrxll.exec:\xxfrxll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\jjdpj.exec:\jjdpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\fflxfxf.exec:\fflxfxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\jdjpj.exec:\jdjpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\fxrfxxx.exec:\fxrfxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\dppjd.exec:\dppjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\lxlxrrl.exec:\lxlxrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\vjddd.exec:\vjddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\nhnntt.exec:\nhnntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\jvdvv.exec:\jvdvv.exe17⤵
- Executes dropped EXE
PID:2732 -
\??\c:\lrrfrfx.exec:\lrrfrfx.exe18⤵
- Executes dropped EXE
PID:1768 -
\??\c:\dpjvj.exec:\dpjvj.exe19⤵
- Executes dropped EXE
PID:2020 -
\??\c:\vjdvd.exec:\vjdvd.exe20⤵
- Executes dropped EXE
PID:2088 -
\??\c:\jjvvp.exec:\jjvvp.exe21⤵
- Executes dropped EXE
PID:1728 -
\??\c:\vdjpj.exec:\vdjpj.exe22⤵
- Executes dropped EXE
PID:1392 -
\??\c:\vdjjp.exec:\vdjjp.exe23⤵
- Executes dropped EXE
PID:1352 -
\??\c:\lrrlxxr.exec:\lrrlxxr.exe24⤵
- Executes dropped EXE
PID:2080 -
\??\c:\hhnbbh.exec:\hhnbbh.exe25⤵
- Executes dropped EXE
PID:3040 -
\??\c:\pvvpj.exec:\pvvpj.exe26⤵
- Executes dropped EXE
PID:2992 -
\??\c:\xxfrlxl.exec:\xxfrlxl.exe27⤵
- Executes dropped EXE
PID:1744 -
\??\c:\pdjdv.exec:\pdjdv.exe28⤵
- Executes dropped EXE
PID:2168 -
\??\c:\fxxfxxr.exec:\fxxfxxr.exe29⤵
- Executes dropped EXE
PID:1664 -
\??\c:\tbhbtn.exec:\tbhbtn.exe30⤵
- Executes dropped EXE
PID:1512 -
\??\c:\hnttnt.exec:\hnttnt.exe31⤵
- Executes dropped EXE
PID:2296 -
\??\c:\bnnbbh.exec:\bnnbbh.exe32⤵PID:3000
-
\??\c:\xfflfxr.exec:\xfflfxr.exe33⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nnbbtt.exec:\nnbbtt.exe34⤵
- Executes dropped EXE
PID:1740 -
\??\c:\1fffffl.exec:\1fffffl.exe35⤵
- Executes dropped EXE
PID:1612 -
\??\c:\nnnnbn.exec:\nnnnbn.exe36⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jjpdj.exec:\jjpdj.exe37⤵
- Executes dropped EXE
PID:2772 -
\??\c:\frffxfr.exec:\frffxfr.exe38⤵
- Executes dropped EXE
PID:2908 -
\??\c:\5rfrfrl.exec:\5rfrfrl.exe39⤵
- Executes dropped EXE
PID:2780 -
\??\c:\htbtbt.exec:\htbtbt.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2640 -
\??\c:\5jdpj.exec:\5jdpj.exe41⤵
- Executes dropped EXE
PID:2872 -
\??\c:\pjjdd.exec:\pjjdd.exe42⤵
- Executes dropped EXE
PID:2680 -
\??\c:\rrfllxl.exec:\rrfllxl.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2688 -
\??\c:\bnbtnt.exec:\bnbtnt.exe44⤵
- Executes dropped EXE
PID:2676 -
\??\c:\hnbbtt.exec:\hnbbtt.exe45⤵
- Executes dropped EXE
PID:2300 -
\??\c:\9jpjj.exec:\9jpjj.exe46⤵
- Executes dropped EXE
PID:2104 -
\??\c:\jjjvp.exec:\jjjvp.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2860 -
\??\c:\rrxlxlf.exec:\rrxlxlf.exe48⤵
- Executes dropped EXE
PID:1264 -
\??\c:\bbbnht.exec:\bbbnht.exe49⤵
- Executes dropped EXE
PID:1324 -
\??\c:\ttntbn.exec:\ttntbn.exe50⤵
- Executes dropped EXE
PID:2620 -
\??\c:\pjpdp.exec:\pjpdp.exe51⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lrxxxrr.exec:\lrxxxrr.exe52⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bbbhth.exec:\bbbhth.exe53⤵
- Executes dropped EXE
PID:2692 -
\??\c:\7ntnbn.exec:\7ntnbn.exe54⤵
- Executes dropped EXE
PID:2540 -
\??\c:\9ppjj.exec:\9ppjj.exe55⤵
- Executes dropped EXE
PID:1832 -
\??\c:\7xfrfrl.exec:\7xfrfrl.exe56⤵
- Executes dropped EXE
PID:1564 -
\??\c:\1rlrlrf.exec:\1rlrlrf.exe57⤵
- Executes dropped EXE
PID:2280 -
\??\c:\hbtbnb.exec:\hbtbnb.exe58⤵
- Executes dropped EXE
PID:1500 -
\??\c:\3jjdj.exec:\3jjdj.exe59⤵
- Executes dropped EXE
PID:2112 -
\??\c:\ddjdv.exec:\ddjdv.exe60⤵
- Executes dropped EXE
PID:1864 -
\??\c:\3rxxlfl.exec:\3rxxlfl.exe61⤵
- Executes dropped EXE
PID:1392 -
\??\c:\9nbtnh.exec:\9nbtnh.exe62⤵
- Executes dropped EXE
PID:1352 -
\??\c:\1jddv.exec:\1jddv.exe63⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vpjvd.exec:\vpjvd.exe64⤵
- Executes dropped EXE
PID:1972 -
\??\c:\nnhthn.exec:\nnhthn.exe65⤵
- Executes dropped EXE
PID:984 -
\??\c:\nnhbnn.exec:\nnhbnn.exe66⤵
- Executes dropped EXE
PID:2052 -
\??\c:\rfxxflf.exec:\rfxxflf.exe67⤵PID:2208
-
\??\c:\7bhnhb.exec:\7bhnhb.exe68⤵PID:2132
-
\??\c:\vjvjd.exec:\vjvjd.exe69⤵PID:308
-
\??\c:\llffrll.exec:\llffrll.exe70⤵PID:888
-
\??\c:\bnttnb.exec:\bnttnb.exe71⤵PID:3052
-
\??\c:\pjjvp.exec:\pjjvp.exe72⤵PID:2520
-
\??\c:\bnbhbb.exec:\bnbhbb.exe73⤵PID:2608
-
\??\c:\nbnbbt.exec:\nbnbbt.exe74⤵PID:2380
-
\??\c:\7ddpj.exec:\7ddpj.exe75⤵PID:3068
-
\??\c:\xlfxllf.exec:\xlfxllf.exe76⤵PID:2724
-
\??\c:\vvvvj.exec:\vvvvj.exe77⤵PID:1612
-
\??\c:\rxlfxrf.exec:\rxlfxrf.exe78⤵PID:2892
-
\??\c:\ddvjd.exec:\ddvjd.exe79⤵PID:2784
-
\??\c:\jdjvj.exec:\jdjvj.exe80⤵PID:2908
-
\??\c:\7hhnbn.exec:\7hhnbn.exe81⤵PID:2960
-
\??\c:\3vvjv.exec:\3vvjv.exe82⤵PID:2932
-
\??\c:\fxrfxlx.exec:\fxrfxlx.exe83⤵PID:2924
-
\??\c:\1thbnb.exec:\1thbnb.exe84⤵PID:2648
-
\??\c:\pvpvj.exec:\pvpvj.exe85⤵PID:2708
-
\??\c:\rlrlrfl.exec:\rlrlrfl.exe86⤵PID:2592
-
\??\c:\vvvjd.exec:\vvvjd.exe87⤵PID:1924
-
\??\c:\5jjdd.exec:\5jjdd.exe88⤵PID:1812
-
\??\c:\fflfxfx.exec:\fflfxfx.exe89⤵PID:264
-
\??\c:\nnhbnt.exec:\nnhbnt.exe90⤵PID:1732
-
\??\c:\dpppj.exec:\dpppj.exe91⤵PID:1324
-
\??\c:\lrrxrlf.exec:\lrrxrlf.exe92⤵PID:2620
-
\??\c:\hhhbbt.exec:\hhhbbt.exe93⤵PID:2876
-
\??\c:\7vjvv.exec:\7vjvv.exe94⤵PID:2844
-
\??\c:\xrxxllr.exec:\xrxxllr.exe95⤵PID:528
-
\??\c:\thtntn.exec:\thtntn.exe96⤵PID:1768
-
\??\c:\5xfxxlx.exec:\5xfxxlx.exe97⤵PID:2196
-
\??\c:\hnhbnh.exec:\hnhbnh.exe98⤵PID:1564
-
\??\c:\jpjdp.exec:\jpjdp.exe99⤵PID:2108
-
\??\c:\ddpvj.exec:\ddpvj.exe100⤵PID:1492
-
\??\c:\7fxfrfr.exec:\7fxfrfr.exe101⤵PID:1132
-
\??\c:\btnhnb.exec:\btnhnb.exe102⤵PID:2348
-
\??\c:\xxrlxlf.exec:\xxrlxlf.exe103⤵PID:2092
-
\??\c:\hhbnhn.exec:\hhbnhn.exe104⤵PID:3044
-
\??\c:\dpddd.exec:\dpddd.exe105⤵PID:3036
-
\??\c:\7rrrrlr.exec:\7rrrrlr.exe106⤵PID:304
-
\??\c:\nntbtb.exec:\nntbtb.exe107⤵PID:1648
-
\??\c:\ppvpv.exec:\ppvpv.exe108⤵PID:560
-
\??\c:\jdvpv.exec:\jdvpv.exe109⤵PID:2352
-
\??\c:\xxllflf.exec:\xxllflf.exe110⤵PID:2356
-
\??\c:\btthtb.exec:\btthtb.exe111⤵PID:1316
-
\??\c:\jdvdv.exec:\jdvdv.exe112⤵PID:2408
-
\??\c:\jpddj.exec:\jpddj.exe113⤵PID:1516
-
\??\c:\llfllrl.exec:\llfllrl.exe114⤵PID:2972
-
\??\c:\hnnhhh.exec:\hnnhhh.exe115⤵PID:2384
-
\??\c:\vppjp.exec:\vppjp.exe116⤵PID:1604
-
\??\c:\xrrxlrl.exec:\xrrxlrl.exe117⤵PID:2380
-
\??\c:\lfxxlrx.exec:\lfxxlrx.exe118⤵PID:1740
-
\??\c:\5tnntt.exec:\5tnntt.exe119⤵PID:1620
-
\??\c:\dvdvp.exec:\dvdvp.exe120⤵PID:2904
-
\??\c:\pvpjv.exec:\pvpjv.exe121⤵PID:3020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-