Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 21:29
Static task
static1
Behavioral task
behavioral1
Sample
3194648a861f3bbbf39799bc5425568321a60e749dc53f8be940c0608e3d94a4.exe
Resource
win7-20240903-en
General
-
Target
3194648a861f3bbbf39799bc5425568321a60e749dc53f8be940c0608e3d94a4.exe
-
Size
453KB
-
MD5
483c5dbbd2ad5cfedd2e7e1c0ed6b6ac
-
SHA1
21778785e8b4e0875817b1e07f059c2e95f18be5
-
SHA256
3194648a861f3bbbf39799bc5425568321a60e749dc53f8be940c0608e3d94a4
-
SHA512
c479e66f7b441e96c897913a1e6ffa20a88ab194ef4e771a31359a2c6ab165a7057fdb43ea84859f37b475b57a29210650d20c0df81ebcf12d9c116a846b4a94
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeG:q7Tc2NYHUrAwfMp3CDG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 58 IoCs
resource yara_rule behavioral1/memory/1628-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-46-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2428-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-111-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2888-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/608-136-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/608-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-156-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2824-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-175-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2452-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-193-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1948-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-213-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1312-223-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/552-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-278-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2076-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-373-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2628-414-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2824-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/704-470-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1448-481-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2292-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-527-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2440-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-533-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1532-546-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2248-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-572-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2856-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-597-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-652-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1584-723-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-738-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2500-818-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2808-845-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2056-958-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2424-1019-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-1044-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-1092-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1868 pdjjp.exe 2364 btbbbb.exe 3064 jpdvd.exe 2668 frflrlr.exe 2852 5pjjp.exe 2428 vvvjd.exe 2596 flrrrrx.exe 1716 bhbbbt.exe 2564 lrflrlr.exe 2680 rlxxxxf.exe 2152 pddjd.exe 600 tntttt.exe 2888 ddjvv.exe 608 9pdvp.exe 2788 tnbttt.exe 2824 hbnttt.exe 1980 pddjj.exe 2600 rlxrxxf.exe 2452 hthnnn.exe 1948 bthtbb.exe 2168 lxxlfff.exe 1496 nbnbbb.exe 1312 jdvdv.exe 2148 rlxfflr.exe 552 5thhhh.exe 624 1jpjp.exe 3008 hhthnb.exe 2960 thtttt.exe 2312 lfxflrf.exe 2076 nnhthh.exe 2488 3jpvv.exe 2500 fxrxxff.exe 2172 pjvvd.exe 2688 frrlfxf.exe 2272 jpjpd.exe 2952 lflrffl.exe 2720 hhbhnn.exe 2428 vjpjd.exe 3068 lxxfllx.exe 2604 rfxxxxr.exe 3044 1nbbbb.exe 2224 9vvvv.exe 1800 pdppd.exe 1480 lxlrflr.exe 2628 hbhbbb.exe 2888 tnhntt.exe 608 9pdjd.exe 484 rlxfrrl.exe 712 hththh.exe 2824 ththhn.exe 1036 vpddp.exe 3028 7frffrf.exe 2200 lfflxfl.exe 2216 9bnhnn.exe 2180 vjvpj.exe 1600 jdpvv.exe 704 9lxxfxr.exe 1448 nhnbbt.exe 1748 tbnnhn.exe 1932 ddpdj.exe 1524 rlflffr.exe 2232 rfrrrlr.exe 2432 bnhhbt.exe 2292 dvjdp.exe -
resource yara_rule behavioral1/memory/1868-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-136-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/608-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/552-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-302-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2172-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-373-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2824-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/704-470-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2292-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-527-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2440-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-533-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/2248-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-572-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2856-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-675-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2204-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-723-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-818-0x00000000005C0000-0x00000000005EA000-memory.dmp upx behavioral1/memory/2920-895-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-951-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-1019-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-1044-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-1092-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2560-1116-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrxrx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1628 wrote to memory of 1868 1628 3194648a861f3bbbf39799bc5425568321a60e749dc53f8be940c0608e3d94a4.exe 31 PID 1628 wrote to memory of 1868 1628 3194648a861f3bbbf39799bc5425568321a60e749dc53f8be940c0608e3d94a4.exe 31 PID 1628 wrote to memory of 1868 1628 3194648a861f3bbbf39799bc5425568321a60e749dc53f8be940c0608e3d94a4.exe 31 PID 1628 wrote to memory of 1868 1628 3194648a861f3bbbf39799bc5425568321a60e749dc53f8be940c0608e3d94a4.exe 31 PID 1868 wrote to memory of 2364 1868 pdjjp.exe 32 PID 1868 wrote to memory of 2364 1868 pdjjp.exe 32 PID 1868 wrote to memory of 2364 1868 pdjjp.exe 32 PID 1868 wrote to memory of 2364 1868 pdjjp.exe 32 PID 2364 wrote to memory of 3064 2364 btbbbb.exe 33 PID 2364 wrote to memory of 3064 2364 btbbbb.exe 33 PID 2364 wrote to memory of 3064 2364 btbbbb.exe 33 PID 2364 wrote to memory of 3064 2364 btbbbb.exe 33 PID 3064 wrote to memory of 2668 3064 jpdvd.exe 34 PID 3064 wrote to memory of 2668 3064 jpdvd.exe 34 PID 3064 wrote to memory of 2668 3064 jpdvd.exe 34 PID 3064 wrote to memory of 2668 3064 jpdvd.exe 34 PID 2668 wrote to memory of 2852 2668 frflrlr.exe 35 PID 2668 wrote to memory of 2852 2668 frflrlr.exe 35 PID 2668 wrote to memory of 2852 2668 frflrlr.exe 35 PID 2668 wrote to memory of 2852 2668 frflrlr.exe 35 PID 2852 wrote to memory of 2428 2852 5pjjp.exe 36 PID 2852 wrote to memory of 2428 2852 5pjjp.exe 36 PID 2852 wrote to memory of 2428 2852 5pjjp.exe 36 PID 2852 wrote to memory of 2428 2852 5pjjp.exe 36 PID 2428 wrote to memory of 2596 2428 vvvjd.exe 37 PID 2428 wrote to memory of 2596 2428 vvvjd.exe 37 PID 2428 wrote to memory of 2596 2428 vvvjd.exe 37 PID 2428 wrote to memory of 2596 2428 vvvjd.exe 37 PID 2596 wrote to memory of 1716 2596 flrrrrx.exe 38 PID 2596 wrote to memory of 1716 2596 flrrrrx.exe 38 PID 2596 wrote to memory of 1716 2596 flrrrrx.exe 38 PID 2596 wrote to memory of 1716 2596 flrrrrx.exe 38 PID 1716 wrote to memory of 2564 1716 bhbbbt.exe 39 PID 1716 wrote to memory of 2564 1716 bhbbbt.exe 39 PID 1716 wrote to memory of 2564 1716 bhbbbt.exe 39 PID 1716 wrote to memory of 2564 1716 bhbbbt.exe 39 PID 2564 wrote to memory of 2680 2564 lrflrlr.exe 40 PID 2564 wrote to memory of 2680 2564 lrflrlr.exe 40 PID 2564 wrote to memory of 2680 2564 lrflrlr.exe 40 PID 2564 wrote to memory of 2680 2564 lrflrlr.exe 40 PID 2680 wrote to memory of 2152 2680 rlxxxxf.exe 41 PID 2680 wrote to memory of 2152 2680 rlxxxxf.exe 41 PID 2680 wrote to memory of 2152 2680 rlxxxxf.exe 41 PID 2680 wrote to memory of 2152 2680 rlxxxxf.exe 41 PID 2152 wrote to memory of 600 2152 pddjd.exe 42 PID 2152 wrote to memory of 600 2152 pddjd.exe 42 PID 2152 wrote to memory of 600 2152 pddjd.exe 42 PID 2152 wrote to memory of 600 2152 pddjd.exe 42 PID 600 wrote to memory of 2888 600 tntttt.exe 43 PID 600 wrote to memory of 2888 600 tntttt.exe 43 PID 600 wrote to memory of 2888 600 tntttt.exe 43 PID 600 wrote to memory of 2888 600 tntttt.exe 43 PID 2888 wrote to memory of 608 2888 ddjvv.exe 44 PID 2888 wrote to memory of 608 2888 ddjvv.exe 44 PID 2888 wrote to memory of 608 2888 ddjvv.exe 44 PID 2888 wrote to memory of 608 2888 ddjvv.exe 44 PID 608 wrote to memory of 2788 608 9pdvp.exe 45 PID 608 wrote to memory of 2788 608 9pdvp.exe 45 PID 608 wrote to memory of 2788 608 9pdvp.exe 45 PID 608 wrote to memory of 2788 608 9pdvp.exe 45 PID 2788 wrote to memory of 2824 2788 tnbttt.exe 46 PID 2788 wrote to memory of 2824 2788 tnbttt.exe 46 PID 2788 wrote to memory of 2824 2788 tnbttt.exe 46 PID 2788 wrote to memory of 2824 2788 tnbttt.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\3194648a861f3bbbf39799bc5425568321a60e749dc53f8be940c0608e3d94a4.exe"C:\Users\Admin\AppData\Local\Temp\3194648a861f3bbbf39799bc5425568321a60e749dc53f8be940c0608e3d94a4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\pdjjp.exec:\pdjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\btbbbb.exec:\btbbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\jpdvd.exec:\jpdvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\frflrlr.exec:\frflrlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\5pjjp.exec:\5pjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\vvvjd.exec:\vvvjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\flrrrrx.exec:\flrrrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\bhbbbt.exec:\bhbbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\lrflrlr.exec:\lrflrlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\pddjd.exec:\pddjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\tntttt.exec:\tntttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\ddjvv.exec:\ddjvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\9pdvp.exec:\9pdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:608 -
\??\c:\tnbttt.exec:\tnbttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\hbnttt.exec:\hbnttt.exe17⤵
- Executes dropped EXE
PID:2824 -
\??\c:\pddjj.exec:\pddjj.exe18⤵
- Executes dropped EXE
PID:1980 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe19⤵
- Executes dropped EXE
PID:2600 -
\??\c:\hthnnn.exec:\hthnnn.exe20⤵
- Executes dropped EXE
PID:2452 -
\??\c:\bthtbb.exec:\bthtbb.exe21⤵
- Executes dropped EXE
PID:1948 -
\??\c:\lxxlfff.exec:\lxxlfff.exe22⤵
- Executes dropped EXE
PID:2168 -
\??\c:\nbnbbb.exec:\nbnbbb.exe23⤵
- Executes dropped EXE
PID:1496 -
\??\c:\jdvdv.exec:\jdvdv.exe24⤵
- Executes dropped EXE
PID:1312 -
\??\c:\rlxfflr.exec:\rlxfflr.exe25⤵
- Executes dropped EXE
PID:2148 -
\??\c:\5thhhh.exec:\5thhhh.exe26⤵
- Executes dropped EXE
PID:552 -
\??\c:\1jpjp.exec:\1jpjp.exe27⤵
- Executes dropped EXE
PID:624 -
\??\c:\hhthnb.exec:\hhthnb.exe28⤵
- Executes dropped EXE
PID:3008 -
\??\c:\thtttt.exec:\thtttt.exe29⤵
- Executes dropped EXE
PID:2960 -
\??\c:\lfxflrf.exec:\lfxflrf.exe30⤵
- Executes dropped EXE
PID:2312 -
\??\c:\nnhthh.exec:\nnhthh.exe31⤵
- Executes dropped EXE
PID:2076 -
\??\c:\3jpvv.exec:\3jpvv.exe32⤵
- Executes dropped EXE
PID:2488 -
\??\c:\fxrxxff.exec:\fxrxxff.exe33⤵
- Executes dropped EXE
PID:2500 -
\??\c:\pjvvd.exec:\pjvvd.exe34⤵
- Executes dropped EXE
PID:2172 -
\??\c:\frrlfxf.exec:\frrlfxf.exe35⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jpjpd.exec:\jpjpd.exe36⤵
- Executes dropped EXE
PID:2272 -
\??\c:\lflrffl.exec:\lflrffl.exe37⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hhbhnn.exec:\hhbhnn.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\vjpjd.exec:\vjpjd.exe39⤵
- Executes dropped EXE
PID:2428 -
\??\c:\lxxfllx.exec:\lxxfllx.exe40⤵
- Executes dropped EXE
PID:3068 -
\??\c:\rfxxxxr.exec:\rfxxxxr.exe41⤵
- Executes dropped EXE
PID:2604 -
\??\c:\1nbbbb.exec:\1nbbbb.exe42⤵
- Executes dropped EXE
PID:3044 -
\??\c:\9vvvv.exec:\9vvvv.exe43⤵
- Executes dropped EXE
PID:2224 -
\??\c:\pdppd.exec:\pdppd.exe44⤵
- Executes dropped EXE
PID:1800 -
\??\c:\lxlrflr.exec:\lxlrflr.exe45⤵
- Executes dropped EXE
PID:1480 -
\??\c:\hbhbbb.exec:\hbhbbb.exe46⤵
- Executes dropped EXE
PID:2628 -
\??\c:\tnhntt.exec:\tnhntt.exe47⤵
- Executes dropped EXE
PID:2888 -
\??\c:\9pdjd.exec:\9pdjd.exe48⤵
- Executes dropped EXE
PID:608 -
\??\c:\rlxfrrl.exec:\rlxfrrl.exe49⤵
- Executes dropped EXE
PID:484 -
\??\c:\hththh.exec:\hththh.exe50⤵
- Executes dropped EXE
PID:712 -
\??\c:\ththhn.exec:\ththhn.exe51⤵
- Executes dropped EXE
PID:2824 -
\??\c:\vpddp.exec:\vpddp.exe52⤵
- Executes dropped EXE
PID:1036 -
\??\c:\7frffrf.exec:\7frffrf.exe53⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lfflxfl.exec:\lfflxfl.exe54⤵
- Executes dropped EXE
PID:2200 -
\??\c:\9bnhnn.exec:\9bnhnn.exe55⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vjvpj.exec:\vjvpj.exe56⤵
- Executes dropped EXE
PID:2180 -
\??\c:\jdpvv.exec:\jdpvv.exe57⤵
- Executes dropped EXE
PID:1600 -
\??\c:\9lxxfxr.exec:\9lxxfxr.exe58⤵
- Executes dropped EXE
PID:704 -
\??\c:\nhnbbt.exec:\nhnbbt.exe59⤵
- Executes dropped EXE
PID:1448 -
\??\c:\tbnnhn.exec:\tbnnhn.exe60⤵
- Executes dropped EXE
PID:1748 -
\??\c:\ddpdj.exec:\ddpdj.exe61⤵
- Executes dropped EXE
PID:1932 -
\??\c:\rlflffr.exec:\rlflffr.exe62⤵
- Executes dropped EXE
PID:1524 -
\??\c:\rfrrrlr.exec:\rfrrrlr.exe63⤵
- Executes dropped EXE
PID:2232 -
\??\c:\bnhhbt.exec:\bnhhbt.exe64⤵
- Executes dropped EXE
PID:2432 -
\??\c:\dvjdp.exec:\dvjdp.exe65⤵
- Executes dropped EXE
PID:2292 -
\??\c:\vvjvp.exec:\vvjvp.exe66⤵PID:796
-
\??\c:\rlxxlrf.exec:\rlxxlrf.exe67⤵PID:2440
-
\??\c:\btnnnt.exec:\btnnnt.exe68⤵PID:2996
-
\??\c:\vvjjv.exec:\vvjjv.exe69⤵PID:1648
-
\??\c:\3vddj.exec:\3vddj.exe70⤵PID:1532
-
\??\c:\xlfflfl.exec:\xlfflfl.exe71⤵PID:1504
-
\??\c:\nhbbhn.exec:\nhbbhn.exe72⤵PID:1428
-
\??\c:\nbbthh.exec:\nbbthh.exe73⤵PID:2248
-
\??\c:\3vjvv.exec:\3vjvv.exe74⤵PID:2704
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe75⤵PID:2836
-
\??\c:\btnbhh.exec:\btnbhh.exe76⤵PID:2856
-
\??\c:\hnhhtn.exec:\hnhhtn.exe77⤵PID:2708
-
\??\c:\5vjjp.exec:\5vjjp.exe78⤵PID:2748
-
\??\c:\5lfflrx.exec:\5lfflrx.exe79⤵PID:2820
-
\??\c:\3xxflrr.exec:\3xxflrr.exe80⤵PID:2592
-
\??\c:\hbnntt.exec:\hbnntt.exe81⤵PID:2576
-
\??\c:\vjjjp.exec:\vjjjp.exe82⤵PID:2624
-
\??\c:\dpjpv.exec:\dpjpv.exe83⤵PID:2732
-
\??\c:\5xffrxl.exec:\5xffrxl.exe84⤵PID:2152
-
\??\c:\9httbh.exec:\9httbh.exe85⤵PID:2928
-
\??\c:\5bnnhh.exec:\5bnnhh.exe86⤵PID:2328
-
\??\c:\vvvvp.exec:\vvvvp.exe87⤵PID:2784
-
\??\c:\llffrxf.exec:\llffrxf.exe88⤵PID:2924
-
\??\c:\btbbnn.exec:\btbbnn.exe89⤵PID:2788
-
\??\c:\1vjpv.exec:\1vjpv.exe90⤵PID:2620
-
\??\c:\vvjvp.exec:\vvjvp.exe91⤵PID:2892
-
\??\c:\lfxflrx.exec:\lfxflrx.exe92⤵PID:3032
-
\??\c:\7bhnbh.exec:\7bhnbh.exe93⤵PID:1328
-
\??\c:\3bbbhh.exec:\3bbbhh.exe94⤵PID:3028
-
\??\c:\vpddp.exec:\vpddp.exe95⤵PID:1700
-
\??\c:\flflffx.exec:\flflffx.exe96⤵PID:2204
-
\??\c:\xrflrrx.exec:\xrflrrx.exe97⤵PID:2180
-
\??\c:\bbtbhb.exec:\bbtbhb.exe98⤵PID:1584
-
\??\c:\bthbhh.exec:\bthbhh.exe99⤵PID:704
-
\??\c:\dvjjp.exec:\dvjjp.exe100⤵PID:2504
-
\??\c:\lfrxxrr.exec:\lfrxxrr.exe101⤵PID:968
-
\??\c:\thnthn.exec:\thnthn.exe102⤵PID:852
-
\??\c:\hhnbtt.exec:\hhnbtt.exe103⤵PID:1740
-
\??\c:\jvjvp.exec:\jvjvp.exe104⤵PID:2300
-
\??\c:\flrfxxr.exec:\flrfxxr.exe105⤵PID:284
-
\??\c:\lrlxflx.exec:\lrlxflx.exe106⤵PID:1596
-
\??\c:\9ntthn.exec:\9ntthn.exe107⤵PID:892
-
\??\c:\5djdp.exec:\5djdp.exe108⤵PID:768
-
\??\c:\vpdjd.exec:\vpdjd.exe109⤵PID:2996
-
\??\c:\9ffxrxf.exec:\9ffxrxf.exe110⤵PID:276
-
\??\c:\7bnntt.exec:\7bnntt.exe111⤵PID:1652
-
\??\c:\thtnnn.exec:\thtnnn.exe112⤵PID:2536
-
\??\c:\dpvvd.exec:\dpvvd.exe113⤵PID:2500
-
\??\c:\ppjpv.exec:\ppjpv.exe114⤵PID:1428
-
\??\c:\9fflrxf.exec:\9fflrxf.exe115⤵PID:2896
-
\??\c:\5thnbb.exec:\5thnbb.exe116⤵PID:2716
-
\??\c:\1btthh.exec:\1btthh.exe117⤵PID:2808
-
\??\c:\vpdjv.exec:\vpdjv.exe118⤵PID:2736
-
\??\c:\xrxxlff.exec:\xrxxlff.exe119⤵PID:2744
-
\??\c:\fxlrflx.exec:\fxlrflx.exe120⤵PID:2596
-
\??\c:\nbbbbn.exec:\nbbbbn.exe121⤵PID:2904
-
\??\c:\jdpvj.exec:\jdpvj.exe122⤵PID:2592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-