Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/12/2024, 11:33
Behavioral task
behavioral1
Sample
4ec200b1e8fcdbd55e44610c1d73482d8b3b96f5c24be9c9fd31133a7b7e6a5d.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
General
-
Target
4ec200b1e8fcdbd55e44610c1d73482d8b3b96f5c24be9c9fd31133a7b7e6a5d.exe
-
Size
3.7MB
-
MD5
dd046b69e8d48ebf28c12b52eb1d4d0b
-
SHA1
234697c421a46f588c2674bad6a0ce2328c2751e
-
SHA256
4ec200b1e8fcdbd55e44610c1d73482d8b3b96f5c24be9c9fd31133a7b7e6a5d
-
SHA512
cc910d67380e2f62fb26d702f11c05ef2f73035f85ac8a166571335dfc089234a6127ee273e07622cadabfc783312329464ff313df6e0fafeb79ad927d1c98e2
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98O:U6XLq/qPPslzKx/dJg1ErmNx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2824-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-44-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2596-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/964-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/848-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1504-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1168-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1972-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2248-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1616-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/796-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1868-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1908-281-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2800-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/860-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1944-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3016-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-455-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2252-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/284-508-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2204-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1676-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-567-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-625-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-675-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-707-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2452-752-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-773-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-911-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-924-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1436-953-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/1436-952-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/1916-1077-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2900-1147-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2880-1160-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1844-1200-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 2736 jjppd.exe 2800 nnbhtt.exe 1536 1fxxrfl.exe 2632 xxlrlfr.exe 2596 ttntbn.exe 2468 hhnbbt.exe 964 ddpdp.exe 2124 vvpjd.exe 1084 nthhht.exe 2860 xfrlrff.exe 2564 flfxxrr.exe 2960 rxflfxx.exe 2676 7nhhhh.exe 3048 tbthtn.exe 1268 pdppp.exe 1504 xflrxff.exe 848 pvppd.exe 2176 vjvpd.exe 1168 btntbt.exe 2248 tnthth.exe 1972 5dvvp.exe 844 xrflrrl.exe 1616 rflxxfr.exe 796 frrxxfx.exe 296 btbhbt.exe 1508 frrlxll.exe 2500 pvdjd.exe 1868 hnbbnt.exe 1876 5jvvj.exe 1908 vvvpv.exe 2180 rlflflr.exe 2284 frlfrlf.exe 2036 rxlxfxx.exe 2816 xlrlxll.exe 2704 bhbnnh.exe 2212 htnbbn.exe 2600 tnbtbb.exe 2800 lfxfxfr.exe 2576 ttbttb.exe 2648 bhtbbn.exe 860 ntttnh.exe 1944 fxxlrlx.exe 2964 5xrxrlx.exe 2368 vvvjv.exe 1240 ddjdp.exe 2984 tnbhtn.exe 2940 lfxflxx.exe 3016 lffrfll.exe 2748 vjdpv.exe 3040 nbnbnb.exe 2572 bthnnb.exe 2588 3rxllfr.exe 1160 9rxrllf.exe 2108 rlflrxr.exe 1840 vppvj.exe 2200 vddpd.exe 3052 btnhbh.exe 2428 nttbth.exe 2252 thnbbh.exe 1592 9frxlxx.exe 1416 3xffxfl.exe 1928 rfxxfff.exe 1616 xrllrlr.exe 1484 dvdjv.exe -
resource yara_rule behavioral1/memory/2824-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000120f6-10.dat upx behavioral1/memory/2736-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d63-19.dat upx behavioral1/files/0x0007000000016d69-25.dat upx behavioral1/files/0x0008000000016d6d-35.dat upx behavioral1/memory/1536-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2632-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016dd9-47.dat upx behavioral1/memory/2596-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0034000000016d3f-57.dat upx behavioral1/files/0x0007000000016de0-66.dat upx behavioral1/memory/2468-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/964-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016dea-75.dat upx behavioral1/files/0x0008000000016eb4-84.dat upx behavioral1/memory/2124-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000017047-92.dat upx behavioral1/files/0x0005000000019227-101.dat upx behavioral1/memory/2564-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001922c-113.dat upx behavioral1/memory/2960-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001925e-122.dat upx behavioral1/memory/2960-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019261-130.dat upx behavioral1/files/0x000500000001926a-139.dat upx behavioral1/memory/1268-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019279-146.dat upx behavioral1/files/0x0005000000019284-157.dat upx behavioral1/memory/848-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1504-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000192a9-165.dat upx behavioral1/files/0x0005000000019379-173.dat upx behavioral1/memory/2248-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001939d-183.dat upx behavioral1/memory/1168-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193a4-196.dat upx behavioral1/memory/1972-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193ac-205.dat upx behavioral1/memory/2248-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001942c-212.dat upx behavioral1/memory/1616-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019438-222.dat upx behavioral1/files/0x0005000000019456-231.dat upx behavioral1/files/0x000500000001945c-238.dat upx behavioral1/memory/796-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1508-246-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019467-248.dat upx behavioral1/memory/1868-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019496-256.dat upx behavioral1/files/0x00050000000194ad-265.dat upx behavioral1/files/0x00050000000194d0-272.dat upx behavioral1/memory/1908-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2180-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194ef-284.dat upx behavioral1/files/0x00050000000194fc-293.dat upx behavioral1/memory/2284-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2816-306-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2212-319-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2800-338-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/860-351-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1944-364-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2368-377-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrllrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ntntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxllfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2736 2824 4ec200b1e8fcdbd55e44610c1d73482d8b3b96f5c24be9c9fd31133a7b7e6a5d.exe 30 PID 2824 wrote to memory of 2736 2824 4ec200b1e8fcdbd55e44610c1d73482d8b3b96f5c24be9c9fd31133a7b7e6a5d.exe 30 PID 2824 wrote to memory of 2736 2824 4ec200b1e8fcdbd55e44610c1d73482d8b3b96f5c24be9c9fd31133a7b7e6a5d.exe 30 PID 2824 wrote to memory of 2736 2824 4ec200b1e8fcdbd55e44610c1d73482d8b3b96f5c24be9c9fd31133a7b7e6a5d.exe 30 PID 2736 wrote to memory of 2800 2736 jjppd.exe 31 PID 2736 wrote to memory of 2800 2736 jjppd.exe 31 PID 2736 wrote to memory of 2800 2736 jjppd.exe 31 PID 2736 wrote to memory of 2800 2736 jjppd.exe 31 PID 2800 wrote to memory of 1536 2800 nnbhtt.exe 32 PID 2800 wrote to memory of 1536 2800 nnbhtt.exe 32 PID 2800 wrote to memory of 1536 2800 nnbhtt.exe 32 PID 2800 wrote to memory of 1536 2800 nnbhtt.exe 32 PID 1536 wrote to memory of 2632 1536 1fxxrfl.exe 114 PID 1536 wrote to memory of 2632 1536 1fxxrfl.exe 114 PID 1536 wrote to memory of 2632 1536 1fxxrfl.exe 114 PID 1536 wrote to memory of 2632 1536 1fxxrfl.exe 114 PID 2632 wrote to memory of 2596 2632 xxlrlfr.exe 34 PID 2632 wrote to memory of 2596 2632 xxlrlfr.exe 34 PID 2632 wrote to memory of 2596 2632 xxlrlfr.exe 34 PID 2632 wrote to memory of 2596 2632 xxlrlfr.exe 34 PID 2596 wrote to memory of 2468 2596 ttntbn.exe 35 PID 2596 wrote to memory of 2468 2596 ttntbn.exe 35 PID 2596 wrote to memory of 2468 2596 ttntbn.exe 35 PID 2596 wrote to memory of 2468 2596 ttntbn.exe 35 PID 2468 wrote to memory of 964 2468 hhnbbt.exe 36 PID 2468 wrote to memory of 964 2468 hhnbbt.exe 36 PID 2468 wrote to memory of 964 2468 hhnbbt.exe 36 PID 2468 wrote to memory of 964 2468 hhnbbt.exe 36 PID 964 wrote to memory of 2124 964 ddpdp.exe 37 PID 964 wrote to memory of 2124 964 ddpdp.exe 37 PID 964 wrote to memory of 2124 964 ddpdp.exe 37 PID 964 wrote to memory of 2124 964 ddpdp.exe 37 PID 2124 wrote to memory of 1084 2124 vvpjd.exe 38 PID 2124 wrote to memory of 1084 2124 vvpjd.exe 38 PID 2124 wrote to memory of 1084 2124 vvpjd.exe 38 PID 2124 wrote to memory of 1084 2124 vvpjd.exe 38 PID 1084 wrote to memory of 2860 1084 nthhht.exe 39 PID 1084 wrote to memory of 2860 1084 nthhht.exe 39 PID 1084 wrote to memory of 2860 1084 nthhht.exe 39 PID 1084 wrote to memory of 2860 1084 nthhht.exe 39 PID 2860 wrote to memory of 2564 2860 xfrlrff.exe 40 PID 2860 wrote to memory of 2564 2860 xfrlrff.exe 40 PID 2860 wrote to memory of 2564 2860 xfrlrff.exe 40 PID 2860 wrote to memory of 2564 2860 xfrlrff.exe 40 PID 2564 wrote to memory of 2960 2564 flfxxrr.exe 41 PID 2564 wrote to memory of 2960 2564 flfxxrr.exe 41 PID 2564 wrote to memory of 2960 2564 flfxxrr.exe 41 PID 2564 wrote to memory of 2960 2564 flfxxrr.exe 41 PID 2960 wrote to memory of 2676 2960 rxflfxx.exe 42 PID 2960 wrote to memory of 2676 2960 rxflfxx.exe 42 PID 2960 wrote to memory of 2676 2960 rxflfxx.exe 42 PID 2960 wrote to memory of 2676 2960 rxflfxx.exe 42 PID 2676 wrote to memory of 3048 2676 7nhhhh.exe 43 PID 2676 wrote to memory of 3048 2676 7nhhhh.exe 43 PID 2676 wrote to memory of 3048 2676 7nhhhh.exe 43 PID 2676 wrote to memory of 3048 2676 7nhhhh.exe 43 PID 3048 wrote to memory of 1268 3048 tbthtn.exe 44 PID 3048 wrote to memory of 1268 3048 tbthtn.exe 44 PID 3048 wrote to memory of 1268 3048 tbthtn.exe 44 PID 3048 wrote to memory of 1268 3048 tbthtn.exe 44 PID 1268 wrote to memory of 1504 1268 pdppp.exe 45 PID 1268 wrote to memory of 1504 1268 pdppp.exe 45 PID 1268 wrote to memory of 1504 1268 pdppp.exe 45 PID 1268 wrote to memory of 1504 1268 pdppp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ec200b1e8fcdbd55e44610c1d73482d8b3b96f5c24be9c9fd31133a7b7e6a5d.exe"C:\Users\Admin\AppData\Local\Temp\4ec200b1e8fcdbd55e44610c1d73482d8b3b96f5c24be9c9fd31133a7b7e6a5d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\jjppd.exec:\jjppd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\nnbhtt.exec:\nnbhtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\1fxxrfl.exec:\1fxxrfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\xxlrlfr.exec:\xxlrlfr.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\ttntbn.exec:\ttntbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\hhnbbt.exec:\hhnbbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\ddpdp.exec:\ddpdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\vvpjd.exec:\vvpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\nthhht.exec:\nthhht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\xfrlrff.exec:\xfrlrff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\flfxxrr.exec:\flfxxrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\rxflfxx.exec:\rxflfxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\7nhhhh.exec:\7nhhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\tbthtn.exec:\tbthtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\pdppp.exec:\pdppp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\xflrxff.exec:\xflrxff.exe17⤵
- Executes dropped EXE
PID:1504 -
\??\c:\pvppd.exec:\pvppd.exe18⤵
- Executes dropped EXE
PID:848 -
\??\c:\vjvpd.exec:\vjvpd.exe19⤵
- Executes dropped EXE
PID:2176 -
\??\c:\btntbt.exec:\btntbt.exe20⤵
- Executes dropped EXE
PID:1168 -
\??\c:\tnthth.exec:\tnthth.exe21⤵
- Executes dropped EXE
PID:2248 -
\??\c:\5dvvp.exec:\5dvvp.exe22⤵
- Executes dropped EXE
PID:1972 -
\??\c:\xrflrrl.exec:\xrflrrl.exe23⤵
- Executes dropped EXE
PID:844 -
\??\c:\rflxxfr.exec:\rflxxfr.exe24⤵
- Executes dropped EXE
PID:1616 -
\??\c:\frrxxfx.exec:\frrxxfx.exe25⤵
- Executes dropped EXE
PID:796 -
\??\c:\btbhbt.exec:\btbhbt.exe26⤵
- Executes dropped EXE
PID:296 -
\??\c:\frrlxll.exec:\frrlxll.exe27⤵
- Executes dropped EXE
PID:1508 -
\??\c:\pvdjd.exec:\pvdjd.exe28⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hnbbnt.exec:\hnbbnt.exe29⤵
- Executes dropped EXE
PID:1868 -
\??\c:\5jvvj.exec:\5jvvj.exe30⤵
- Executes dropped EXE
PID:1876 -
\??\c:\vvvpv.exec:\vvvpv.exe31⤵
- Executes dropped EXE
PID:1908 -
\??\c:\rlflflr.exec:\rlflflr.exe32⤵
- Executes dropped EXE
PID:2180 -
\??\c:\frlfrlf.exec:\frlfrlf.exe33⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rxlxfxx.exec:\rxlxfxx.exe34⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xlrlxll.exec:\xlrlxll.exe35⤵
- Executes dropped EXE
PID:2816 -
\??\c:\bhbnnh.exec:\bhbnnh.exe36⤵
- Executes dropped EXE
PID:2704 -
\??\c:\htnbbn.exec:\htnbbn.exe37⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tnbtbb.exec:\tnbtbb.exe38⤵
- Executes dropped EXE
PID:2600 -
\??\c:\lfxfxfr.exec:\lfxfxfr.exe39⤵
- Executes dropped EXE
PID:2800 -
\??\c:\ttbttb.exec:\ttbttb.exe40⤵
- Executes dropped EXE
PID:2576 -
\??\c:\bhtbbn.exec:\bhtbbn.exe41⤵
- Executes dropped EXE
PID:2648 -
\??\c:\ntttnh.exec:\ntttnh.exe42⤵
- Executes dropped EXE
PID:860 -
\??\c:\fxxlrlx.exec:\fxxlrlx.exe43⤵
- Executes dropped EXE
PID:1944 -
\??\c:\5xrxrlx.exec:\5xrxrlx.exe44⤵
- Executes dropped EXE
PID:2964 -
\??\c:\vvvjv.exec:\vvvjv.exe45⤵
- Executes dropped EXE
PID:2368 -
\??\c:\ddjdp.exec:\ddjdp.exe46⤵
- Executes dropped EXE
PID:1240 -
\??\c:\tnbhtn.exec:\tnbhtn.exe47⤵
- Executes dropped EXE
PID:2984 -
\??\c:\lfxflxx.exec:\lfxflxx.exe48⤵
- Executes dropped EXE
PID:2940 -
\??\c:\lffrfll.exec:\lffrfll.exe49⤵
- Executes dropped EXE
PID:3016 -
\??\c:\vjdpv.exec:\vjdpv.exe50⤵
- Executes dropped EXE
PID:2748 -
\??\c:\nbnbnb.exec:\nbnbnb.exe51⤵
- Executes dropped EXE
PID:3040 -
\??\c:\bthnnb.exec:\bthnnb.exe52⤵
- Executes dropped EXE
PID:2572 -
\??\c:\3rxllfr.exec:\3rxllfr.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2588 -
\??\c:\9rxrllf.exec:\9rxrllf.exe54⤵
- Executes dropped EXE
PID:1160 -
\??\c:\rlflrxr.exec:\rlflrxr.exe55⤵
- Executes dropped EXE
PID:2108 -
\??\c:\vppvj.exec:\vppvj.exe56⤵
- Executes dropped EXE
PID:1840 -
\??\c:\vddpd.exec:\vddpd.exe57⤵
- Executes dropped EXE
PID:2200 -
\??\c:\btnhbh.exec:\btnhbh.exe58⤵
- Executes dropped EXE
PID:3052 -
\??\c:\nttbth.exec:\nttbth.exe59⤵
- Executes dropped EXE
PID:2428 -
\??\c:\thnbbh.exec:\thnbbh.exe60⤵
- Executes dropped EXE
PID:2252 -
\??\c:\9frxlxx.exec:\9frxlxx.exe61⤵
- Executes dropped EXE
PID:1592 -
\??\c:\3xffxfl.exec:\3xffxfl.exe62⤵
- Executes dropped EXE
PID:1416 -
\??\c:\rfxxfff.exec:\rfxxfff.exe63⤵
- Executes dropped EXE
PID:1928 -
\??\c:\xrllrlr.exec:\xrllrlr.exe64⤵
- Executes dropped EXE
PID:1616 -
\??\c:\dvdjv.exec:\dvdjv.exe65⤵
- Executes dropped EXE
PID:1484 -
\??\c:\dvjpv.exec:\dvjpv.exe66⤵PID:284
-
\??\c:\pjvdd.exec:\pjvdd.exe67⤵PID:1676
-
\??\c:\tnhbnt.exec:\tnhbnt.exe68⤵PID:2204
-
\??\c:\btbhnt.exec:\btbhnt.exe69⤵PID:2280
-
\??\c:\bhtbtn.exec:\bhtbtn.exe70⤵PID:776
-
\??\c:\xrxrfrr.exec:\xrxrfrr.exe71⤵PID:2060
-
\??\c:\xxlllrf.exec:\xxlllrf.exe72⤵PID:1908
-
\??\c:\jjdvd.exec:\jjdvd.exe73⤵PID:2980
-
\??\c:\tbtbht.exec:\tbtbht.exe74⤵PID:1428
-
\??\c:\hhtbnt.exec:\hhtbnt.exe75⤵PID:2484
-
\??\c:\lfrxrfl.exec:\lfrxrfl.exe76⤵PID:1524
-
\??\c:\5vppv.exec:\5vppv.exe77⤵PID:1520
-
\??\c:\htnhtn.exec:\htnhtn.exe78⤵PID:2756
-
\??\c:\bthbtb.exec:\bthbtb.exe79⤵PID:2888
-
\??\c:\lxrxflx.exec:\lxrxflx.exe80⤵PID:700
-
\??\c:\ppjpd.exec:\ppjpd.exe81⤵PID:2820
-
\??\c:\bntnbn.exec:\bntnbn.exe82⤵PID:1900
-
\??\c:\9bnhtb.exec:\9bnhtb.exe83⤵PID:1940
-
\??\c:\rxrflxf.exec:\rxrflxf.exe84⤵PID:2652
-
\??\c:\jjpdp.exec:\jjpdp.exe85⤵PID:2160
-
\??\c:\pddpv.exec:\pddpv.exe86⤵PID:2632
-
\??\c:\bbbbnn.exec:\bbbbnn.exe87⤵PID:2524
-
\??\c:\3fxxflr.exec:\3fxxflr.exe88⤵PID:2372
-
\??\c:\1xflflr.exec:\1xflflr.exe89⤵PID:1864
-
\??\c:\1jdjd.exec:\1jdjd.exe90⤵PID:2796
-
\??\c:\tnhtnh.exec:\tnhtnh.exe91⤵PID:2920
-
\??\c:\7rllrxf.exec:\7rllrxf.exe92⤵PID:2936
-
\??\c:\pdjjv.exec:\pdjjv.exe93⤵PID:3016
-
\??\c:\pjpvd.exec:\pjpvd.exe94⤵PID:2748
-
\??\c:\5bbnbh.exec:\5bbnbh.exe95⤵PID:684
-
\??\c:\rxlxrxl.exec:\rxlxrxl.exe96⤵PID:2848
-
\??\c:\ppvpj.exec:\ppvpj.exe97⤵
- System Location Discovery: System Language Discovery
PID:264 -
\??\c:\pppdp.exec:\pppdp.exe98⤵PID:2260
-
\??\c:\tntthb.exec:\tntthb.exe99⤵PID:1688
-
\??\c:\3tntbb.exec:\3tntbb.exe100⤵PID:2548
-
\??\c:\lfxxffr.exec:\lfxxffr.exe101⤵PID:2172
-
\??\c:\vpvdj.exec:\vpvdj.exe102⤵PID:2272
-
\??\c:\ddpjv.exec:\ddpjv.exe103⤵PID:2380
-
\??\c:\bbttbt.exec:\bbttbt.exe104⤵PID:2452
-
\??\c:\fxlrlrl.exec:\fxlrlrl.exe105⤵PID:1976
-
\??\c:\vjpdv.exec:\vjpdv.exe106⤵PID:2464
-
\??\c:\pjjjj.exec:\pjjjj.exe107⤵PID:1004
-
\??\c:\bhnbht.exec:\bhnbht.exe108⤵PID:1548
-
\??\c:\5xrffxf.exec:\5xrffxf.exe109⤵PID:1288
-
\??\c:\fxrxflx.exec:\fxrxflx.exe110⤵
- System Location Discovery: System Language Discovery
PID:796 -
\??\c:\3vppj.exec:\3vppj.exe111⤵PID:1196
-
\??\c:\tnbbbb.exec:\tnbbbb.exe112⤵PID:908
-
\??\c:\lrrrfxl.exec:\lrrrfxl.exe113⤵PID:980
-
\??\c:\fflrfxl.exec:\fflrfxl.exe114⤵PID:1912
-
\??\c:\jjpdp.exec:\jjpdp.exe115⤵PID:892
-
\??\c:\bbttnn.exec:\bbttnn.exe116⤵PID:776
-
\??\c:\rrxrlrf.exec:\rrxrlrf.exe117⤵PID:864
-
\??\c:\fxrxllr.exec:\fxrxllr.exe118⤵PID:1680
-
\??\c:\hbnthh.exec:\hbnthh.exe119⤵PID:2444
-
\??\c:\rrxlxlx.exec:\rrxlxlx.exe120⤵
- System Location Discovery: System Language Discovery
PID:1704 -
\??\c:\vddpv.exec:\vddpv.exe121⤵PID:1636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-