Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/12/2024, 03:01
Behavioral task
behavioral1
Sample
1bf50c5ebe6bf6721a47d7f32bf621fe589d5becfd8e63aafc70361e846ad647N.exe
Resource
win7-20240903-en
General
-
Target
1bf50c5ebe6bf6721a47d7f32bf621fe589d5becfd8e63aafc70361e846ad647N.exe
-
Size
85KB
-
MD5
829f319caed04181cc4b9ecee7e98960
-
SHA1
8e1996dc6aaa6ec0c7db9b67f586d3b93f9b1ab0
-
SHA256
1bf50c5ebe6bf6721a47d7f32bf621fe589d5becfd8e63aafc70361e846ad647
-
SHA512
9733e56eb6d53a2572d00628e9ccc10a0032ac8a5b5c716c38fa6e5e58b4ce0bf37e4020a8b963a2c8e38e31622f61e08e8352de16b2b4995122b98b50d01eb1
-
SSDEEP
1536:cvQBeOGtrYS3srx93UBWfwC6Ggnouy8HglW8wk8miJd1Rtt8Nqz1xw++:chOmTsF93UYfwC6GIout3tk8mItt8N5P
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 60 IoCs
resource yara_rule behavioral1/memory/2476-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2240-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2384-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2692-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-73-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2900-86-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2900-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1000-123-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1000-121-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/592-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1896-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/520-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1336-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-349-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2792-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-377-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2600-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-380-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3060-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-398-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1592-405-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/472-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1060-419-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2028-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-422-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/1292-446-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1516-459-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1516-460-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2192-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2284-486-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/2284-508-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/3024-537-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1796-556-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-623-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2196-662-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2504-718-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1516-736-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1724-756-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-831-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-865-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1736-1031-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/440-1040-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/620-1063-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/112-1091-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1812-1104-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1300-1226-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1844-1245-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1580-1272-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2240 9bbbnt.exe 2384 vjpvd.exe 2164 xxrxlxl.exe 2692 9tntbh.exe 2704 vpjjp.exe 2800 vjvvv.exe 2840 lfflxfr.exe 2900 1bnntn.exe 2820 jjdjv.exe 2672 1jjjj.exe 2648 lrlllxl.exe 1000 hbhbbh.exe 2936 jdpvj.exe 592 dvppv.exe 1896 vpvvd.exe 520 fxflrrf.exe 1696 nbnntt.exe 1268 3thhbt.exe 1500 ppvdp.exe 1736 rlrlxxf.exe 2284 rlrfxff.exe 2060 7bbbhn.exe 1640 btttbb.exe 2780 9jdjv.exe 1336 xlxfrrr.exe 1920 nnhhhb.exe 3024 jdddj.exe 2904 xrfrflr.exe 112 xfrlxxr.exe 1856 nhtttn.exe 1928 9pjjv.exe 2436 pjvvv.exe 1712 rlrrffl.exe 2240 7xrlxfx.exe 2328 lxllxrx.exe 1924 hthttb.exe 1952 nbnhtn.exe 2172 jjvvd.exe 2744 dvjjd.exe 2740 1rlflxl.exe 2864 rrfxffx.exe 2792 hbnnnt.exe 2860 pdpjj.exe 2600 pdjjd.exe 2820 rrlxlxf.exe 2656 hthnbh.exe 3060 5bnnnb.exe 1592 3vjdd.exe 472 vpdjv.exe 1060 5llrflx.exe 2028 lfxfrxf.exe 264 hbtbnt.exe 2932 htnhbh.exe 1292 3dpvp.exe 2420 dpddj.exe 1516 5xrrxfl.exe 2192 tntnnt.exe 2084 5hbbbb.exe 1736 3pvvd.exe 2284 dvddv.exe 2512 rrflxrx.exe 404 7xrrfrx.exe 2992 5nhhnt.exe 1612 5nbhhn.exe -
resource yara_rule behavioral1/memory/2476-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012101-5.dat upx behavioral1/memory/2476-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2240-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001739b-17.dat upx behavioral1/memory/2384-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000173b2-25.dat upx behavioral1/memory/2164-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000173ee-36.dat upx behavioral1/memory/2692-44-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2692-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001746c-45.dat upx behavioral1/memory/2704-54-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2704-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000017474-55.dat upx behavioral1/memory/2800-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000017481-65.dat upx behavioral1/files/0x00090000000174bf-74.dat upx behavioral1/memory/2840-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2840-73-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000600000001925d-87.dat upx behavioral1/memory/2900-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-84-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0005000000019263-95.dat upx behavioral1/memory/2672-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019278-103.dat upx behavioral1/memory/1000-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019280-113.dat upx behavioral1/memory/2648-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001938b-125.dat upx behavioral1/memory/2936-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019399-134.dat upx behavioral1/memory/592-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193b7-141.dat upx behavioral1/memory/1896-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193c1-151.dat upx behavioral1/memory/520-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193c8-159.dat upx behavioral1/files/0x00050000000193d4-169.dat upx behavioral1/memory/1696-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193ec-178.dat upx behavioral1/files/0x0005000000019417-186.dat upx behavioral1/memory/1736-193-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x000500000001941a-194.dat upx behavioral1/memory/1736-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019436-204.dat upx behavioral1/memory/1640-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019441-213.dat upx behavioral1/files/0x00050000000194bd-222.dat upx behavioral1/memory/1640-223-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2780-231-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00050000000194f3-232.dat upx behavioral1/memory/1336-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019537-242.dat upx behavioral1/memory/1336-241-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1920-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000195d9-250.dat upx behavioral1/files/0x000500000001960a-258.dat upx behavioral1/files/0x000500000001960c-266.dat upx behavioral1/files/0x000500000001960d-274.dat upx behavioral1/files/0x000500000001960e-282.dat upx behavioral1/memory/2436-291-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019610-289.dat upx behavioral1/memory/1712-305-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2240 2476 1bf50c5ebe6bf6721a47d7f32bf621fe589d5becfd8e63aafc70361e846ad647N.exe 30 PID 2476 wrote to memory of 2240 2476 1bf50c5ebe6bf6721a47d7f32bf621fe589d5becfd8e63aafc70361e846ad647N.exe 30 PID 2476 wrote to memory of 2240 2476 1bf50c5ebe6bf6721a47d7f32bf621fe589d5becfd8e63aafc70361e846ad647N.exe 30 PID 2476 wrote to memory of 2240 2476 1bf50c5ebe6bf6721a47d7f32bf621fe589d5becfd8e63aafc70361e846ad647N.exe 30 PID 2240 wrote to memory of 2384 2240 9bbbnt.exe 31 PID 2240 wrote to memory of 2384 2240 9bbbnt.exe 31 PID 2240 wrote to memory of 2384 2240 9bbbnt.exe 31 PID 2240 wrote to memory of 2384 2240 9bbbnt.exe 31 PID 2384 wrote to memory of 2164 2384 vjpvd.exe 32 PID 2384 wrote to memory of 2164 2384 vjpvd.exe 32 PID 2384 wrote to memory of 2164 2384 vjpvd.exe 32 PID 2384 wrote to memory of 2164 2384 vjpvd.exe 32 PID 2164 wrote to memory of 2692 2164 xxrxlxl.exe 33 PID 2164 wrote to memory of 2692 2164 xxrxlxl.exe 33 PID 2164 wrote to memory of 2692 2164 xxrxlxl.exe 33 PID 2164 wrote to memory of 2692 2164 xxrxlxl.exe 33 PID 2692 wrote to memory of 2704 2692 9tntbh.exe 34 PID 2692 wrote to memory of 2704 2692 9tntbh.exe 34 PID 2692 wrote to memory of 2704 2692 9tntbh.exe 34 PID 2692 wrote to memory of 2704 2692 9tntbh.exe 34 PID 2704 wrote to memory of 2800 2704 vpjjp.exe 35 PID 2704 wrote to memory of 2800 2704 vpjjp.exe 35 PID 2704 wrote to memory of 2800 2704 vpjjp.exe 35 PID 2704 wrote to memory of 2800 2704 vpjjp.exe 35 PID 2800 wrote to memory of 2840 2800 vjvvv.exe 36 PID 2800 wrote to memory of 2840 2800 vjvvv.exe 36 PID 2800 wrote to memory of 2840 2800 vjvvv.exe 36 PID 2800 wrote to memory of 2840 2800 vjvvv.exe 36 PID 2840 wrote to memory of 2900 2840 lfflxfr.exe 37 PID 2840 wrote to memory of 2900 2840 lfflxfr.exe 37 PID 2840 wrote to memory of 2900 2840 lfflxfr.exe 37 PID 2840 wrote to memory of 2900 2840 lfflxfr.exe 37 PID 2900 wrote to memory of 2820 2900 1bnntn.exe 38 PID 2900 wrote to memory of 2820 2900 1bnntn.exe 38 PID 2900 wrote to memory of 2820 2900 1bnntn.exe 38 PID 2900 wrote to memory of 2820 2900 1bnntn.exe 38 PID 2820 wrote to memory of 2672 2820 jjdjv.exe 39 PID 2820 wrote to memory of 2672 2820 jjdjv.exe 39 PID 2820 wrote to memory of 2672 2820 jjdjv.exe 39 PID 2820 wrote to memory of 2672 2820 jjdjv.exe 39 PID 2672 wrote to memory of 2648 2672 1jjjj.exe 40 PID 2672 wrote to memory of 2648 2672 1jjjj.exe 40 PID 2672 wrote to memory of 2648 2672 1jjjj.exe 40 PID 2672 wrote to memory of 2648 2672 1jjjj.exe 40 PID 2648 wrote to memory of 1000 2648 lrlllxl.exe 41 PID 2648 wrote to memory of 1000 2648 lrlllxl.exe 41 PID 2648 wrote to memory of 1000 2648 lrlllxl.exe 41 PID 2648 wrote to memory of 1000 2648 lrlllxl.exe 41 PID 1000 wrote to memory of 2936 1000 hbhbbh.exe 42 PID 1000 wrote to memory of 2936 1000 hbhbbh.exe 42 PID 1000 wrote to memory of 2936 1000 hbhbbh.exe 42 PID 1000 wrote to memory of 2936 1000 hbhbbh.exe 42 PID 2936 wrote to memory of 592 2936 jdpvj.exe 43 PID 2936 wrote to memory of 592 2936 jdpvj.exe 43 PID 2936 wrote to memory of 592 2936 jdpvj.exe 43 PID 2936 wrote to memory of 592 2936 jdpvj.exe 43 PID 592 wrote to memory of 1896 592 dvppv.exe 44 PID 592 wrote to memory of 1896 592 dvppv.exe 44 PID 592 wrote to memory of 1896 592 dvppv.exe 44 PID 592 wrote to memory of 1896 592 dvppv.exe 44 PID 1896 wrote to memory of 520 1896 vpvvd.exe 45 PID 1896 wrote to memory of 520 1896 vpvvd.exe 45 PID 1896 wrote to memory of 520 1896 vpvvd.exe 45 PID 1896 wrote to memory of 520 1896 vpvvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bf50c5ebe6bf6721a47d7f32bf621fe589d5becfd8e63aafc70361e846ad647N.exe"C:\Users\Admin\AppData\Local\Temp\1bf50c5ebe6bf6721a47d7f32bf621fe589d5becfd8e63aafc70361e846ad647N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\9bbbnt.exec:\9bbbnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\vjpvd.exec:\vjpvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\xxrxlxl.exec:\xxrxlxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\9tntbh.exec:\9tntbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\vpjjp.exec:\vpjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\vjvvv.exec:\vjvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\lfflxfr.exec:\lfflxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\1bnntn.exec:\1bnntn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\jjdjv.exec:\jjdjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\1jjjj.exec:\1jjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\lrlllxl.exec:\lrlllxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\hbhbbh.exec:\hbhbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\jdpvj.exec:\jdpvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\dvppv.exec:\dvppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\vpvvd.exec:\vpvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\fxflrrf.exec:\fxflrrf.exe17⤵
- Executes dropped EXE
PID:520 -
\??\c:\nbnntt.exec:\nbnntt.exe18⤵
- Executes dropped EXE
PID:1696 -
\??\c:\3thhbt.exec:\3thhbt.exe19⤵
- Executes dropped EXE
PID:1268 -
\??\c:\ppvdp.exec:\ppvdp.exe20⤵
- Executes dropped EXE
PID:1500 -
\??\c:\rlrlxxf.exec:\rlrlxxf.exe21⤵
- Executes dropped EXE
PID:1736 -
\??\c:\rlrfxff.exec:\rlrfxff.exe22⤵
- Executes dropped EXE
PID:2284 -
\??\c:\7bbbhn.exec:\7bbbhn.exe23⤵
- Executes dropped EXE
PID:2060 -
\??\c:\btttbb.exec:\btttbb.exe24⤵
- Executes dropped EXE
PID:1640 -
\??\c:\9jdjv.exec:\9jdjv.exe25⤵
- Executes dropped EXE
PID:2780 -
\??\c:\xlxfrrr.exec:\xlxfrrr.exe26⤵
- Executes dropped EXE
PID:1336 -
\??\c:\nnhhhb.exec:\nnhhhb.exe27⤵
- Executes dropped EXE
PID:1920 -
\??\c:\jdddj.exec:\jdddj.exe28⤵
- Executes dropped EXE
PID:3024 -
\??\c:\xrfrflr.exec:\xrfrflr.exe29⤵
- Executes dropped EXE
PID:2904 -
\??\c:\xfrlxxr.exec:\xfrlxxr.exe30⤵
- Executes dropped EXE
PID:112 -
\??\c:\nhtttn.exec:\nhtttn.exe31⤵
- Executes dropped EXE
PID:1856 -
\??\c:\9pjjv.exec:\9pjjv.exe32⤵
- Executes dropped EXE
PID:1928 -
\??\c:\pjvvv.exec:\pjvvv.exe33⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rlrrffl.exec:\rlrrffl.exe34⤵
- Executes dropped EXE
PID:1712 -
\??\c:\7xrlxfx.exec:\7xrlxfx.exe35⤵
- Executes dropped EXE
PID:2240 -
\??\c:\lxllxrx.exec:\lxllxrx.exe36⤵
- Executes dropped EXE
PID:2328 -
\??\c:\hthttb.exec:\hthttb.exe37⤵
- Executes dropped EXE
PID:1924 -
\??\c:\nbnhtn.exec:\nbnhtn.exe38⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jjvvd.exec:\jjvvd.exe39⤵
- Executes dropped EXE
PID:2172 -
\??\c:\dvjjd.exec:\dvjjd.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\1rlflxl.exec:\1rlflxl.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\rrfxffx.exec:\rrfxffx.exe42⤵
- Executes dropped EXE
PID:2864 -
\??\c:\hbnnnt.exec:\hbnnnt.exe43⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pdpjj.exec:\pdpjj.exe44⤵
- Executes dropped EXE
PID:2860 -
\??\c:\pdjjd.exec:\pdjjd.exe45⤵
- Executes dropped EXE
PID:2600 -
\??\c:\rrlxlxf.exec:\rrlxlxf.exe46⤵
- Executes dropped EXE
PID:2820 -
\??\c:\hthnbh.exec:\hthnbh.exe47⤵
- Executes dropped EXE
PID:2656 -
\??\c:\5bnnnb.exec:\5bnnnb.exe48⤵
- Executes dropped EXE
PID:3060 -
\??\c:\3vjdd.exec:\3vjdd.exe49⤵
- Executes dropped EXE
PID:1592 -
\??\c:\vpdjv.exec:\vpdjv.exe50⤵
- Executes dropped EXE
PID:472 -
\??\c:\5llrflx.exec:\5llrflx.exe51⤵
- Executes dropped EXE
PID:1060 -
\??\c:\lfxfrxf.exec:\lfxfrxf.exe52⤵
- Executes dropped EXE
PID:2028 -
\??\c:\hbtbnt.exec:\hbtbnt.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:264 -
\??\c:\htnhbh.exec:\htnhbh.exe54⤵
- Executes dropped EXE
PID:2932 -
\??\c:\3dpvp.exec:\3dpvp.exe55⤵
- Executes dropped EXE
PID:1292 -
\??\c:\dpddj.exec:\dpddj.exe56⤵
- Executes dropped EXE
PID:2420 -
\??\c:\5xrrxfl.exec:\5xrrxfl.exe57⤵
- Executes dropped EXE
PID:1516 -
\??\c:\tntnnt.exec:\tntnnt.exe58⤵
- Executes dropped EXE
PID:2192 -
\??\c:\5hbbbb.exec:\5hbbbb.exe59⤵
- Executes dropped EXE
PID:2084 -
\??\c:\3pvvd.exec:\3pvvd.exe60⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dvddv.exec:\dvddv.exe61⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rrflxrx.exec:\rrflxrx.exe62⤵
- Executes dropped EXE
PID:2512 -
\??\c:\7xrrfrx.exec:\7xrrfrx.exe63⤵
- Executes dropped EXE
PID:404 -
\??\c:\5nhhnt.exec:\5nhhnt.exe64⤵
- Executes dropped EXE
PID:2992 -
\??\c:\5nbhhn.exec:\5nbhhn.exe65⤵
- Executes dropped EXE
PID:1612 -
\??\c:\jdjjv.exec:\jdjjv.exe66⤵PID:1628
-
\??\c:\dpddj.exec:\dpddj.exe67⤵PID:1056
-
\??\c:\xrflrfl.exec:\xrflrfl.exe68⤵PID:2520
-
\??\c:\fxrxffr.exec:\fxrxffr.exe69⤵PID:3024
-
\??\c:\bnbhtn.exec:\bnbhtn.exe70⤵PID:2968
-
\??\c:\hbbhnt.exec:\hbbhnt.exe71⤵PID:568
-
\??\c:\7vdjv.exec:\7vdjv.exe72⤵PID:1796
-
\??\c:\5jjpv.exec:\5jjpv.exe73⤵PID:1856
-
\??\c:\lfffflr.exec:\lfffflr.exe74⤵PID:1584
-
\??\c:\rrfflrx.exec:\rrfflrx.exe75⤵PID:2308
-
\??\c:\9hntnn.exec:\9hntnn.exe76⤵PID:1860
-
\??\c:\9hbbhh.exec:\9hbbhh.exe77⤵PID:2460
-
\??\c:\ffrflrx.exec:\ffrflrx.exe78⤵
- System Location Discovery: System Language Discovery
PID:2384 -
\??\c:\xlrxflr.exec:\xlrxflr.exe79⤵PID:2328
-
\??\c:\ttthnt.exec:\ttthnt.exe80⤵PID:1924
-
\??\c:\bttbnn.exec:\bttbnn.exe81⤵PID:2708
-
\??\c:\vpjjp.exec:\vpjjp.exe82⤵PID:2172
-
\??\c:\vjjjd.exec:\vjjjd.exe83⤵PID:2828
-
\??\c:\9xlrflr.exec:\9xlrflr.exe84⤵PID:2872
-
\??\c:\xlllrlx.exec:\xlllrlx.exe85⤵PID:2864
-
\??\c:\hbnnbh.exec:\hbnnbh.exe86⤵PID:2892
-
\??\c:\btnnbb.exec:\btnnbb.exe87⤵PID:2288
-
\??\c:\9jvdj.exec:\9jvdj.exe88⤵PID:2652
-
\??\c:\pdpvv.exec:\pdpvv.exe89⤵PID:2196
-
\??\c:\xxxfrrf.exec:\xxxfrrf.exe90⤵PID:2224
-
\??\c:\llxxffl.exec:\llxxffl.exe91⤵PID:1620
-
\??\c:\ntbnhn.exec:\ntbnhn.exe92⤵PID:1100
-
\??\c:\hthhnt.exec:\hthhnt.exe93⤵PID:1308
-
\??\c:\vpdpv.exec:\vpdpv.exe94⤵PID:2024
-
\??\c:\5jdvd.exec:\5jdvd.exe95⤵PID:2944
-
\??\c:\lfxflrf.exec:\lfxflrf.exe96⤵PID:792
-
\??\c:\7lfflrf.exec:\7lfflrf.exe97⤵PID:1900
-
\??\c:\thbntn.exec:\thbntn.exe98⤵PID:2504
-
\??\c:\vpdpd.exec:\vpdpd.exe99⤵PID:520
-
\??\c:\pdppj.exec:\pdppj.exe100⤵PID:1052
-
\??\c:\3xxlrfr.exec:\3xxlrfr.exe101⤵PID:1516
-
\??\c:\rlxflrx.exec:\rlxflrx.exe102⤵PID:1648
-
\??\c:\tnhttb.exec:\tnhttb.exe103⤵PID:2540
-
\??\c:\hbnntt.exec:\hbnntt.exe104⤵PID:1724
-
\??\c:\pdpjp.exec:\pdpjp.exe105⤵PID:2052
-
\??\c:\vjvvd.exec:\vjvvd.exe106⤵PID:2568
-
\??\c:\7ffxxfl.exec:\7ffxxfl.exe107⤵PID:1964
-
\??\c:\lfxrxxl.exec:\lfxrxxl.exe108⤵PID:2996
-
\??\c:\bhtbhb.exec:\bhtbhb.exe109⤵PID:2352
-
\??\c:\tnbhhh.exec:\tnbhhh.exe110⤵PID:1840
-
\??\c:\vvjjv.exec:\vvjjv.exe111⤵PID:1936
-
\??\c:\1jjjp.exec:\1jjjp.exe112⤵PID:2076
-
\??\c:\xfrlfxf.exec:\xfrlfxf.exe113⤵PID:712
-
\??\c:\3ffxlll.exec:\3ffxlll.exe114⤵PID:2968
-
\??\c:\btttbb.exec:\btttbb.exe115⤵PID:1048
-
\??\c:\nhbhnt.exec:\nhbhnt.exe116⤵PID:1632
-
\??\c:\hhhhtn.exec:\hhhhtn.exe117⤵PID:2548
-
\??\c:\vjppd.exec:\vjppd.exe118⤵PID:2484
-
\??\c:\9ddjp.exec:\9ddjp.exe119⤵PID:2436
-
\??\c:\lrfxrll.exec:\lrfxrll.exe120⤵PID:1576
-
\??\c:\lrlffxf.exec:\lrlffxf.exe121⤵PID:2376
-
\??\c:\9bthbb.exec:\9bthbb.exe122⤵PID:2964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-