Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/12/2024, 03:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2f32f1cadf5995b04811a844675c50c4779388a993caaf95c1215a441c720bafN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
2f32f1cadf5995b04811a844675c50c4779388a993caaf95c1215a441c720bafN.exe
-
Size
454KB
-
MD5
7c3a485f6d7bc56bac070859943e7d10
-
SHA1
6b6d8dddab20e57da09c6af1e034021ab2ce3142
-
SHA256
2f32f1cadf5995b04811a844675c50c4779388a993caaf95c1215a441c720baf
-
SHA512
a16d2ea271d83ee9557ae2e2b26146ce595c005705bdeb705d882d1c9adadce3c470b357b189c940382afd32ff28fd7b1bc6ff07c6751b95efa38a6861f8267f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/1032-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-35-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2228-33-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/3032-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-73-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2728-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-267-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2328-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-282-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1996-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-314-0x00000000777B0000-0x00000000778CF000-memory.dmp family_blackmoon behavioral1/memory/1708-323-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/316-327-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2788-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-340-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2224-358-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/284-363-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3040-372-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2740-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-562-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/3012-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/792-601-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2100-637-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2616-728-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1716-767-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1704-781-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1940-795-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1692-814-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2480-827-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1040 bntbhb.exe 1708 3bnnbh.exe 2228 ffxxrrr.exe 2944 ttthbh.exe 3032 vvpdp.exe 2456 vdpvv.exe 2064 rrrxfrl.exe 2728 xrrxrxx.exe 2912 xxllxxr.exe 2696 jvpdp.exe 2820 lrrfxlx.exe 2680 tbhbht.exe 2616 xxrxflf.exe 2988 hbbhnb.exe 1532 lllxlrf.exe 2016 pjdjd.exe 1796 lfxlflf.exe 1784 dpjvp.exe 2468 frxrxxf.exe 1968 jvdjp.exe 1772 dpdjp.exe 1740 nbtbht.exe 2368 ffrrxfl.exe 1128 rrlrxxl.exe 1244 vppjp.exe 940 9tthnn.exe 2364 vvpdp.exe 3012 9jjvj.exe 792 xrffrlr.exe 2328 lrrxflx.exe 1996 frfrfxl.exe 3024 1xxlfrl.exe 1100 ddvpj.exe 2204 lrxllxx.exe 316 xlxlfxr.exe 2100 hhhnhn.exe 2788 jvvdv.exe 2944 jjpjp.exe 2224 rrrfrxr.exe 284 bhbtht.exe 3040 dddpj.exe 2192 3rrrlxr.exe 2740 rlxfrxl.exe 2748 1nnnbb.exe 2600 pjppp.exe 2760 djdpv.exe 2524 lllrflf.exe 1720 thhbtn.exe 2700 htttnb.exe 2968 1pvdv.exe 1296 rrrrxfr.exe 564 hhhbnh.exe 1820 tbhttn.exe 1652 rlfrrrx.exe 876 hbtntt.exe 1364 htbtth.exe 1396 vvvjd.exe 1736 3xflfxr.exe 1600 fxrxlrf.exe 1968 nnntnh.exe 2824 9jjvp.exe 2844 5xrfxrf.exe 1092 5nnhhh.exe 448 jpvvd.exe -
resource yara_rule behavioral1/memory/1032-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-314-0x00000000777B0000-0x00000000778CF000-memory.dmp upx behavioral1/memory/2788-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-637-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2644-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-728-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1812-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-767-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1704-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-864-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ntbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1032 wrote to memory of 1040 1032 2f32f1cadf5995b04811a844675c50c4779388a993caaf95c1215a441c720bafN.exe 28 PID 1032 wrote to memory of 1040 1032 2f32f1cadf5995b04811a844675c50c4779388a993caaf95c1215a441c720bafN.exe 28 PID 1032 wrote to memory of 1040 1032 2f32f1cadf5995b04811a844675c50c4779388a993caaf95c1215a441c720bafN.exe 28 PID 1032 wrote to memory of 1040 1032 2f32f1cadf5995b04811a844675c50c4779388a993caaf95c1215a441c720bafN.exe 28 PID 1040 wrote to memory of 1708 1040 bntbhb.exe 29 PID 1040 wrote to memory of 1708 1040 bntbhb.exe 29 PID 1040 wrote to memory of 1708 1040 bntbhb.exe 29 PID 1040 wrote to memory of 1708 1040 bntbhb.exe 29 PID 1708 wrote to memory of 2228 1708 3bnnbh.exe 30 PID 1708 wrote to memory of 2228 1708 3bnnbh.exe 30 PID 1708 wrote to memory of 2228 1708 3bnnbh.exe 30 PID 1708 wrote to memory of 2228 1708 3bnnbh.exe 30 PID 2228 wrote to memory of 2944 2228 ffxxrrr.exe 31 PID 2228 wrote to memory of 2944 2228 ffxxrrr.exe 31 PID 2228 wrote to memory of 2944 2228 ffxxrrr.exe 31 PID 2228 wrote to memory of 2944 2228 ffxxrrr.exe 31 PID 2944 wrote to memory of 3032 2944 ttthbh.exe 32 PID 2944 wrote to memory of 3032 2944 ttthbh.exe 32 PID 2944 wrote to memory of 3032 2944 ttthbh.exe 32 PID 2944 wrote to memory of 3032 2944 ttthbh.exe 32 PID 3032 wrote to memory of 2456 3032 vvpdp.exe 33 PID 3032 wrote to memory of 2456 3032 vvpdp.exe 33 PID 3032 wrote to memory of 2456 3032 vvpdp.exe 33 PID 3032 wrote to memory of 2456 3032 vvpdp.exe 33 PID 2456 wrote to memory of 2064 2456 vdpvv.exe 34 PID 2456 wrote to memory of 2064 2456 vdpvv.exe 34 PID 2456 wrote to memory of 2064 2456 vdpvv.exe 34 PID 2456 wrote to memory of 2064 2456 vdpvv.exe 34 PID 2064 wrote to memory of 2728 2064 rrrxfrl.exe 35 PID 2064 wrote to memory of 2728 2064 rrrxfrl.exe 35 PID 2064 wrote to memory of 2728 2064 rrrxfrl.exe 35 PID 2064 wrote to memory of 2728 2064 rrrxfrl.exe 35 PID 2728 wrote to memory of 2912 2728 xrrxrxx.exe 36 PID 2728 wrote to memory of 2912 2728 xrrxrxx.exe 36 PID 2728 wrote to memory of 2912 2728 xrrxrxx.exe 36 PID 2728 wrote to memory of 2912 2728 xrrxrxx.exe 36 PID 2912 wrote to memory of 2696 2912 xxllxxr.exe 37 PID 2912 wrote to memory of 2696 2912 xxllxxr.exe 37 PID 2912 wrote to memory of 2696 2912 xxllxxr.exe 37 PID 2912 wrote to memory of 2696 2912 xxllxxr.exe 37 PID 2696 wrote to memory of 2820 2696 jvpdp.exe 38 PID 2696 wrote to memory of 2820 2696 jvpdp.exe 38 PID 2696 wrote to memory of 2820 2696 jvpdp.exe 38 PID 2696 wrote to memory of 2820 2696 jvpdp.exe 38 PID 2820 wrote to memory of 2680 2820 lrrfxlx.exe 39 PID 2820 wrote to memory of 2680 2820 lrrfxlx.exe 39 PID 2820 wrote to memory of 2680 2820 lrrfxlx.exe 39 PID 2820 wrote to memory of 2680 2820 lrrfxlx.exe 39 PID 2680 wrote to memory of 2616 2680 tbhbht.exe 40 PID 2680 wrote to memory of 2616 2680 tbhbht.exe 40 PID 2680 wrote to memory of 2616 2680 tbhbht.exe 40 PID 2680 wrote to memory of 2616 2680 tbhbht.exe 40 PID 2616 wrote to memory of 2988 2616 xxrxflf.exe 41 PID 2616 wrote to memory of 2988 2616 xxrxflf.exe 41 PID 2616 wrote to memory of 2988 2616 xxrxflf.exe 41 PID 2616 wrote to memory of 2988 2616 xxrxflf.exe 41 PID 2988 wrote to memory of 1532 2988 hbbhnb.exe 42 PID 2988 wrote to memory of 1532 2988 hbbhnb.exe 42 PID 2988 wrote to memory of 1532 2988 hbbhnb.exe 42 PID 2988 wrote to memory of 1532 2988 hbbhnb.exe 42 PID 1532 wrote to memory of 2016 1532 lllxlrf.exe 43 PID 1532 wrote to memory of 2016 1532 lllxlrf.exe 43 PID 1532 wrote to memory of 2016 1532 lllxlrf.exe 43 PID 1532 wrote to memory of 2016 1532 lllxlrf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f32f1cadf5995b04811a844675c50c4779388a993caaf95c1215a441c720bafN.exe"C:\Users\Admin\AppData\Local\Temp\2f32f1cadf5995b04811a844675c50c4779388a993caaf95c1215a441c720bafN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\bntbhb.exec:\bntbhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\3bnnbh.exec:\3bnnbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\ffxxrrr.exec:\ffxxrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\ttthbh.exec:\ttthbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\vvpdp.exec:\vvpdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\vdpvv.exec:\vdpvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\rrrxfrl.exec:\rrrxfrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\xrrxrxx.exec:\xrrxrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\xxllxxr.exec:\xxllxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\jvpdp.exec:\jvpdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\lrrfxlx.exec:\lrrfxlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\tbhbht.exec:\tbhbht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\xxrxflf.exec:\xxrxflf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\hbbhnb.exec:\hbbhnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\lllxlrf.exec:\lllxlrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\pjdjd.exec:\pjdjd.exe17⤵
- Executes dropped EXE
PID:2016 -
\??\c:\lfxlflf.exec:\lfxlflf.exe18⤵
- Executes dropped EXE
PID:1796 -
\??\c:\dpjvp.exec:\dpjvp.exe19⤵
- Executes dropped EXE
PID:1784 -
\??\c:\frxrxxf.exec:\frxrxxf.exe20⤵
- Executes dropped EXE
PID:2468 -
\??\c:\jvdjp.exec:\jvdjp.exe21⤵
- Executes dropped EXE
PID:1968 -
\??\c:\dpdjp.exec:\dpdjp.exe22⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nbtbht.exec:\nbtbht.exe23⤵
- Executes dropped EXE
PID:1740 -
\??\c:\ffrrxfl.exec:\ffrrxfl.exe24⤵
- Executes dropped EXE
PID:2368 -
\??\c:\rrlrxxl.exec:\rrlrxxl.exe25⤵
- Executes dropped EXE
PID:1128 -
\??\c:\vppjp.exec:\vppjp.exe26⤵
- Executes dropped EXE
PID:1244 -
\??\c:\9tthnn.exec:\9tthnn.exe27⤵
- Executes dropped EXE
PID:940 -
\??\c:\vvpdp.exec:\vvpdp.exe28⤵
- Executes dropped EXE
PID:2364 -
\??\c:\9jjvj.exec:\9jjvj.exe29⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xrffrlr.exec:\xrffrlr.exe30⤵
- Executes dropped EXE
PID:792 -
\??\c:\lrrxflx.exec:\lrrxflx.exe31⤵
- Executes dropped EXE
PID:2328 -
\??\c:\frfrfxl.exec:\frfrfxl.exe32⤵
- Executes dropped EXE
PID:1996 -
\??\c:\1xxlfrl.exec:\1xxlfrl.exe33⤵
- Executes dropped EXE
PID:3024 -
\??\c:\ddvpj.exec:\ddvpj.exe34⤵
- Executes dropped EXE
PID:1100 -
\??\c:\lrxllxx.exec:\lrxllxx.exe35⤵
- Executes dropped EXE
PID:2204 -
\??\c:\rxxlflf.exec:\rxxlflf.exe36⤵PID:1708
-
\??\c:\xlxlfxr.exec:\xlxlfxr.exe37⤵
- Executes dropped EXE
PID:316 -
\??\c:\hhhnhn.exec:\hhhnhn.exe38⤵
- Executes dropped EXE
PID:2100 -
\??\c:\jvvdv.exec:\jvvdv.exe39⤵
- Executes dropped EXE
PID:2788 -
\??\c:\jjpjp.exec:\jjpjp.exe40⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rrrfrxr.exec:\rrrfrxr.exe41⤵
- Executes dropped EXE
PID:2224 -
\??\c:\bhbtht.exec:\bhbtht.exe42⤵
- Executes dropped EXE
PID:284 -
\??\c:\dddpj.exec:\dddpj.exe43⤵
- Executes dropped EXE
PID:3040 -
\??\c:\3rrrlxr.exec:\3rrrlxr.exe44⤵
- Executes dropped EXE
PID:2192 -
\??\c:\rlxfrxl.exec:\rlxfrxl.exe45⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1nnnbb.exec:\1nnnbb.exe46⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pjppp.exec:\pjppp.exe47⤵
- Executes dropped EXE
PID:2600 -
\??\c:\djdpv.exec:\djdpv.exe48⤵
- Executes dropped EXE
PID:2760 -
\??\c:\lllrflf.exec:\lllrflf.exe49⤵
- Executes dropped EXE
PID:2524 -
\??\c:\thhbtn.exec:\thhbtn.exe50⤵
- Executes dropped EXE
PID:1720 -
\??\c:\htttnb.exec:\htttnb.exe51⤵
- Executes dropped EXE
PID:2700 -
\??\c:\1pvdv.exec:\1pvdv.exe52⤵
- Executes dropped EXE
PID:2968 -
\??\c:\rrrrxfr.exec:\rrrrxfr.exe53⤵
- Executes dropped EXE
PID:1296 -
\??\c:\hhhbnh.exec:\hhhbnh.exe54⤵
- Executes dropped EXE
PID:564 -
\??\c:\tbhttn.exec:\tbhttn.exe55⤵
- Executes dropped EXE
PID:1820 -
\??\c:\rlfrrrx.exec:\rlfrrrx.exe56⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hbtntt.exec:\hbtntt.exe57⤵
- Executes dropped EXE
PID:876 -
\??\c:\htbtth.exec:\htbtth.exe58⤵
- Executes dropped EXE
PID:1364 -
\??\c:\vvvjd.exec:\vvvjd.exe59⤵
- Executes dropped EXE
PID:1396 -
\??\c:\3xflfxr.exec:\3xflfxr.exe60⤵
- Executes dropped EXE
PID:1736 -
\??\c:\fxrxlrf.exec:\fxrxlrf.exe61⤵
- Executes dropped EXE
PID:1600 -
\??\c:\nnntnh.exec:\nnntnh.exe62⤵
- Executes dropped EXE
PID:1968 -
\??\c:\9jjvp.exec:\9jjvp.exe63⤵
- Executes dropped EXE
PID:2824 -
\??\c:\5xrfxrf.exec:\5xrfxrf.exe64⤵
- Executes dropped EXE
PID:2844 -
\??\c:\5nnhhh.exec:\5nnhhh.exe65⤵
- Executes dropped EXE
PID:1092 -
\??\c:\jpvvd.exec:\jpvvd.exe66⤵
- Executes dropped EXE
PID:448 -
\??\c:\xlfxrlr.exec:\xlfxrlr.exe67⤵PID:1128
-
\??\c:\1xxlfrr.exec:\1xxlfrr.exe68⤵PID:1384
-
\??\c:\3bnntb.exec:\3bnntb.exe69⤵PID:1244
-
\??\c:\1ppvj.exec:\1ppvj.exe70⤵PID:968
-
\??\c:\jddjv.exec:\jddjv.exe71⤵PID:1712
-
\??\c:\lrllxlr.exec:\lrllxlr.exe72⤵PID:1288
-
\??\c:\nththn.exec:\nththn.exe73⤵PID:3012
-
\??\c:\dppdp.exec:\dppdp.exe74⤵PID:792
-
\??\c:\ffxllrf.exec:\ffxllrf.exe75⤵PID:764
-
\??\c:\flrrrff.exec:\flrrrff.exe76⤵PID:2216
-
\??\c:\nnhbnb.exec:\nnhbnb.exe77⤵PID:1512
-
\??\c:\vvjpd.exec:\vvjpd.exe78⤵PID:1788
-
\??\c:\xffrlxr.exec:\xffrlxr.exe79⤵PID:2076
-
\??\c:\tbhnht.exec:\tbhnht.exe80⤵PID:2904
-
\??\c:\ttntbn.exec:\ttntbn.exe81⤵PID:1708
-
\??\c:\djjvj.exec:\djjvj.exe82⤵
- System Location Discovery: System Language Discovery
PID:3020 -
\??\c:\lxfrfrr.exec:\lxfrfrr.exe83⤵PID:2100
-
\??\c:\htbhht.exec:\htbhht.exe84⤵PID:2788
-
\??\c:\9jjdj.exec:\9jjdj.exe85⤵PID:2960
-
\??\c:\7ddjd.exec:\7ddjd.exe86⤵PID:3008
-
\??\c:\ffllxrr.exec:\ffllxrr.exe87⤵PID:3036
-
\??\c:\1ntbth.exec:\1ntbth.exe88⤵PID:2652
-
\??\c:\5jpdp.exec:\5jpdp.exe89⤵PID:2636
-
\??\c:\rxrxflx.exec:\rxrxflx.exe90⤵PID:2644
-
\??\c:\fllfrxr.exec:\fllfrxr.exe91⤵PID:2728
-
\??\c:\7ntbnh.exec:\7ntbnh.exe92⤵PID:1656
-
\??\c:\pddvp.exec:\pddvp.exe93⤵PID:2532
-
\??\c:\lfffrxx.exec:\lfffrxx.exe94⤵
- System Location Discovery: System Language Discovery
PID:2560 -
\??\c:\rxfrlrl.exec:\rxfrlrl.exe95⤵PID:2528
-
\??\c:\ntbnth.exec:\ntbnth.exe96⤵PID:2700
-
\??\c:\dddpj.exec:\dddpj.exe97⤵PID:2616
-
\??\c:\vvdpd.exec:\vvdpd.exe98⤵PID:1432
-
\??\c:\rrlrxll.exec:\rrlrxll.exe99⤵PID:1144
-
\??\c:\3ntbnn.exec:\3ntbnn.exe100⤵
- System Location Discovery: System Language Discovery
PID:640 -
\??\c:\ppjvv.exec:\ppjvv.exe101⤵PID:1812
-
\??\c:\pppdd.exec:\pppdd.exe102⤵PID:1436
-
\??\c:\lrrfxrl.exec:\lrrfxrl.exe103⤵PID:1716
-
\??\c:\ntttnn.exec:\ntttnn.exe104⤵PID:684
-
\??\c:\dddjv.exec:\dddjv.exe105⤵PID:1704
-
\??\c:\fllxlrl.exec:\fllxlrl.exe106⤵PID:1960
-
\??\c:\lxxlxfr.exec:\lxxlxfr.exe107⤵PID:1940
-
\??\c:\5nbhnb.exec:\5nbhnb.exe108⤵PID:2808
-
\??\c:\djpvd.exec:\djpvd.exe109⤵PID:2480
-
\??\c:\7rrxfll.exec:\7rrxfll.exe110⤵PID:1692
-
\??\c:\rfllrll.exec:\rfllrll.exe111⤵PID:580
-
\??\c:\ntbnht.exec:\ntbnht.exe112⤵PID:1300
-
\??\c:\vddvj.exec:\vddvj.exe113⤵PID:536
-
\??\c:\vvvjv.exec:\vvvjv.exe114⤵PID:1244
-
\??\c:\lrxrxll.exec:\lrxrxll.exe115⤵PID:1152
-
\??\c:\ttthbh.exec:\ttthbh.exe116⤵PID:1052
-
\??\c:\5hbnnb.exec:\5hbnnb.exe117⤵PID:2208
-
\??\c:\jppvp.exec:\jppvp.exe118⤵PID:2348
-
\??\c:\3xxfrxr.exec:\3xxfrxr.exe119⤵PID:2388
-
\??\c:\xxlffrl.exec:\xxlffrl.exe120⤵PID:2152
-
\??\c:\hnhbnb.exec:\hnhbnb.exe121⤵PID:1996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-