Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 21:40
Static task
static1
Behavioral task
behavioral1
Sample
74091e51c5b3ee973e1ef38240689bf7743d694c0ef240c1b5a6f9124e32657e.exe
Resource
win7-20240903-en
General
-
Target
74091e51c5b3ee973e1ef38240689bf7743d694c0ef240c1b5a6f9124e32657e.exe
-
Size
454KB
-
MD5
3b8697916aff86e42255e5cc4f31ac69
-
SHA1
22ea5b5e0aa777d9b044a024493edabd918d0204
-
SHA256
74091e51c5b3ee973e1ef38240689bf7743d694c0ef240c1b5a6f9124e32657e
-
SHA512
41ed4250d7bdb48a4a0ccb2c9c72bca02f34b3f6b1405d6441298dde42db7d8bbf8b0accb6ea7b7f10d159ffc0b71b5772199b4e431a3234c61ca91fbd59ded0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2648-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-44-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2592-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-83-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1244-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-81-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1184-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-170-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1940-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1384-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-754-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-801-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2104-829-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-1098-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-1168-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2612-1173-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2612-1178-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2268 bthhbb.exe 2808 fxxfrxr.exe 2564 5dvjp.exe 2592 nhbhbh.exe 2844 pjjjv.exe 2552 lxxfrxl.exe 2964 hhthtb.exe 1244 3jvvd.exe 1184 vppdj.exe 2156 ppvjd.exe 2452 hbtbhn.exe 2856 xrrrlrf.exe 1764 htbhbb.exe 2788 dvvjv.exe 1380 hhbnth.exe 2244 ttnbnt.exe 2044 xxrxlrf.exe 1940 bnbhnn.exe 2012 ddpvv.exe 668 rrlrllf.exe 2536 9fxxrfx.exe 2288 tnbthn.exe 1236 frfrfrl.exe 236 ddppj.exe 1660 bhhthh.exe 2068 hbbtht.exe 916 lrrxrff.exe 1312 jdvjv.exe 2292 xrflrrx.exe 2936 pjdjd.exe 2360 xrrxlfl.exe 1704 nhthtb.exe 3028 5jvdj.exe 2696 hhhnhh.exe 2268 hhbtbh.exe 2680 3pjpp.exe 2892 xxxrfrr.exe 2860 nntttb.exe 2720 3vdvj.exe 2612 jdvvd.exe 2588 rlfrflf.exe 2608 ttbhth.exe 2984 dvvdj.exe 576 dvvpd.exe 1756 xfxxllx.exe 1296 bttnhn.exe 2064 vppvj.exe 1844 lfflrrf.exe 2340 nhthhh.exe 2856 tnhthn.exe 1608 dvvjj.exe 1384 7rrxrfr.exe 2616 3nhnhn.exe 1972 vdvdj.exe 2428 9dppd.exe 1912 lrxfllf.exe 2872 1tbnbt.exe 2232 9pjjp.exe 864 rlflxxl.exe 1684 rxlrrxl.exe 1468 5tnbht.exe 3060 jjjvv.exe 1768 7rlrfll.exe 1240 ffxlxfx.exe -
resource yara_rule behavioral1/memory/2648-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-855-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2672-870-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-908-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-1170-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/2612-1173-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/880-1185-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2268 2648 74091e51c5b3ee973e1ef38240689bf7743d694c0ef240c1b5a6f9124e32657e.exe 30 PID 2648 wrote to memory of 2268 2648 74091e51c5b3ee973e1ef38240689bf7743d694c0ef240c1b5a6f9124e32657e.exe 30 PID 2648 wrote to memory of 2268 2648 74091e51c5b3ee973e1ef38240689bf7743d694c0ef240c1b5a6f9124e32657e.exe 30 PID 2648 wrote to memory of 2268 2648 74091e51c5b3ee973e1ef38240689bf7743d694c0ef240c1b5a6f9124e32657e.exe 30 PID 2268 wrote to memory of 2808 2268 bthhbb.exe 31 PID 2268 wrote to memory of 2808 2268 bthhbb.exe 31 PID 2268 wrote to memory of 2808 2268 bthhbb.exe 31 PID 2268 wrote to memory of 2808 2268 bthhbb.exe 31 PID 2808 wrote to memory of 2564 2808 fxxfrxr.exe 32 PID 2808 wrote to memory of 2564 2808 fxxfrxr.exe 32 PID 2808 wrote to memory of 2564 2808 fxxfrxr.exe 32 PID 2808 wrote to memory of 2564 2808 fxxfrxr.exe 32 PID 2564 wrote to memory of 2592 2564 5dvjp.exe 33 PID 2564 wrote to memory of 2592 2564 5dvjp.exe 33 PID 2564 wrote to memory of 2592 2564 5dvjp.exe 33 PID 2564 wrote to memory of 2592 2564 5dvjp.exe 33 PID 2592 wrote to memory of 2844 2592 nhbhbh.exe 34 PID 2592 wrote to memory of 2844 2592 nhbhbh.exe 34 PID 2592 wrote to memory of 2844 2592 nhbhbh.exe 34 PID 2592 wrote to memory of 2844 2592 nhbhbh.exe 34 PID 2844 wrote to memory of 2552 2844 pjjjv.exe 35 PID 2844 wrote to memory of 2552 2844 pjjjv.exe 35 PID 2844 wrote to memory of 2552 2844 pjjjv.exe 35 PID 2844 wrote to memory of 2552 2844 pjjjv.exe 35 PID 2552 wrote to memory of 2964 2552 lxxfrxl.exe 36 PID 2552 wrote to memory of 2964 2552 lxxfrxl.exe 36 PID 2552 wrote to memory of 2964 2552 lxxfrxl.exe 36 PID 2552 wrote to memory of 2964 2552 lxxfrxl.exe 36 PID 2964 wrote to memory of 1244 2964 hhthtb.exe 37 PID 2964 wrote to memory of 1244 2964 hhthtb.exe 37 PID 2964 wrote to memory of 1244 2964 hhthtb.exe 37 PID 2964 wrote to memory of 1244 2964 hhthtb.exe 37 PID 1244 wrote to memory of 1184 1244 3jvvd.exe 38 PID 1244 wrote to memory of 1184 1244 3jvvd.exe 38 PID 1244 wrote to memory of 1184 1244 3jvvd.exe 38 PID 1244 wrote to memory of 1184 1244 3jvvd.exe 38 PID 1184 wrote to memory of 2156 1184 vppdj.exe 39 PID 1184 wrote to memory of 2156 1184 vppdj.exe 39 PID 1184 wrote to memory of 2156 1184 vppdj.exe 39 PID 1184 wrote to memory of 2156 1184 vppdj.exe 39 PID 2156 wrote to memory of 2452 2156 ppvjd.exe 40 PID 2156 wrote to memory of 2452 2156 ppvjd.exe 40 PID 2156 wrote to memory of 2452 2156 ppvjd.exe 40 PID 2156 wrote to memory of 2452 2156 ppvjd.exe 40 PID 2452 wrote to memory of 2856 2452 hbtbhn.exe 41 PID 2452 wrote to memory of 2856 2452 hbtbhn.exe 41 PID 2452 wrote to memory of 2856 2452 hbtbhn.exe 41 PID 2452 wrote to memory of 2856 2452 hbtbhn.exe 41 PID 2856 wrote to memory of 1764 2856 xrrrlrf.exe 42 PID 2856 wrote to memory of 1764 2856 xrrrlrf.exe 42 PID 2856 wrote to memory of 1764 2856 xrrrlrf.exe 42 PID 2856 wrote to memory of 1764 2856 xrrrlrf.exe 42 PID 1764 wrote to memory of 2788 1764 htbhbb.exe 43 PID 1764 wrote to memory of 2788 1764 htbhbb.exe 43 PID 1764 wrote to memory of 2788 1764 htbhbb.exe 43 PID 1764 wrote to memory of 2788 1764 htbhbb.exe 43 PID 2788 wrote to memory of 1380 2788 dvvjv.exe 44 PID 2788 wrote to memory of 1380 2788 dvvjv.exe 44 PID 2788 wrote to memory of 1380 2788 dvvjv.exe 44 PID 2788 wrote to memory of 1380 2788 dvvjv.exe 44 PID 1380 wrote to memory of 2244 1380 hhbnth.exe 45 PID 1380 wrote to memory of 2244 1380 hhbnth.exe 45 PID 1380 wrote to memory of 2244 1380 hhbnth.exe 45 PID 1380 wrote to memory of 2244 1380 hhbnth.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\74091e51c5b3ee973e1ef38240689bf7743d694c0ef240c1b5a6f9124e32657e.exe"C:\Users\Admin\AppData\Local\Temp\74091e51c5b3ee973e1ef38240689bf7743d694c0ef240c1b5a6f9124e32657e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\bthhbb.exec:\bthhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\fxxfrxr.exec:\fxxfrxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\5dvjp.exec:\5dvjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\nhbhbh.exec:\nhbhbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\pjjjv.exec:\pjjjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\lxxfrxl.exec:\lxxfrxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\hhthtb.exec:\hhthtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\3jvvd.exec:\3jvvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\vppdj.exec:\vppdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\ppvjd.exec:\ppvjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\hbtbhn.exec:\hbtbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\xrrrlrf.exec:\xrrrlrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\htbhbb.exec:\htbhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\dvvjv.exec:\dvvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\hhbnth.exec:\hhbnth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\ttnbnt.exec:\ttnbnt.exe17⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe18⤵
- Executes dropped EXE
PID:2044 -
\??\c:\bnbhnn.exec:\bnbhnn.exe19⤵
- Executes dropped EXE
PID:1940 -
\??\c:\ddpvv.exec:\ddpvv.exe20⤵
- Executes dropped EXE
PID:2012 -
\??\c:\rrlrllf.exec:\rrlrllf.exe21⤵
- Executes dropped EXE
PID:668 -
\??\c:\9fxxrfx.exec:\9fxxrfx.exe22⤵
- Executes dropped EXE
PID:2536 -
\??\c:\tnbthn.exec:\tnbthn.exe23⤵
- Executes dropped EXE
PID:2288 -
\??\c:\frfrfrl.exec:\frfrfrl.exe24⤵
- Executes dropped EXE
PID:1236 -
\??\c:\ddppj.exec:\ddppj.exe25⤵
- Executes dropped EXE
PID:236 -
\??\c:\bhhthh.exec:\bhhthh.exe26⤵
- Executes dropped EXE
PID:1660 -
\??\c:\hbbtht.exec:\hbbtht.exe27⤵
- Executes dropped EXE
PID:2068 -
\??\c:\lrrxrff.exec:\lrrxrff.exe28⤵
- Executes dropped EXE
PID:916 -
\??\c:\jdvjv.exec:\jdvjv.exe29⤵
- Executes dropped EXE
PID:1312 -
\??\c:\xrflrrx.exec:\xrflrrx.exe30⤵
- Executes dropped EXE
PID:2292 -
\??\c:\pjdjd.exec:\pjdjd.exe31⤵
- Executes dropped EXE
PID:2936 -
\??\c:\xrrxlfl.exec:\xrrxlfl.exe32⤵
- Executes dropped EXE
PID:2360 -
\??\c:\nhthtb.exec:\nhthtb.exe33⤵
- Executes dropped EXE
PID:1704 -
\??\c:\5jvdj.exec:\5jvdj.exe34⤵
- Executes dropped EXE
PID:3028 -
\??\c:\hhhnhh.exec:\hhhnhh.exe35⤵
- Executes dropped EXE
PID:2696 -
\??\c:\hhbtbh.exec:\hhbtbh.exe36⤵
- Executes dropped EXE
PID:2268 -
\??\c:\3pjpp.exec:\3pjpp.exe37⤵
- Executes dropped EXE
PID:2680 -
\??\c:\xxxrfrr.exec:\xxxrfrr.exe38⤵
- Executes dropped EXE
PID:2892 -
\??\c:\nntttb.exec:\nntttb.exe39⤵
- Executes dropped EXE
PID:2860 -
\??\c:\3vdvj.exec:\3vdvj.exe40⤵
- Executes dropped EXE
PID:2720 -
\??\c:\jdvvd.exec:\jdvvd.exe41⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rlfrflf.exec:\rlfrflf.exe42⤵
- Executes dropped EXE
PID:2588 -
\??\c:\ttbhth.exec:\ttbhth.exe43⤵
- Executes dropped EXE
PID:2608 -
\??\c:\dvvdj.exec:\dvvdj.exe44⤵
- Executes dropped EXE
PID:2984 -
\??\c:\dvvpd.exec:\dvvpd.exe45⤵
- Executes dropped EXE
PID:576 -
\??\c:\xfxxllx.exec:\xfxxllx.exe46⤵
- Executes dropped EXE
PID:1756 -
\??\c:\bttnhn.exec:\bttnhn.exe47⤵
- Executes dropped EXE
PID:1296 -
\??\c:\vppvj.exec:\vppvj.exe48⤵
- Executes dropped EXE
PID:2064 -
\??\c:\lfflrrf.exec:\lfflrrf.exe49⤵
- Executes dropped EXE
PID:1844 -
\??\c:\nhthhh.exec:\nhthhh.exe50⤵
- Executes dropped EXE
PID:2340 -
\??\c:\tnhthn.exec:\tnhthn.exe51⤵
- Executes dropped EXE
PID:2856 -
\??\c:\dvvjj.exec:\dvvjj.exe52⤵
- Executes dropped EXE
PID:1608 -
\??\c:\7rrxrfr.exec:\7rrxrfr.exe53⤵
- Executes dropped EXE
PID:1384 -
\??\c:\3nhnhn.exec:\3nhnhn.exe54⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vdvdj.exec:\vdvdj.exe55⤵
- Executes dropped EXE
PID:1972 -
\??\c:\9dppd.exec:\9dppd.exe56⤵
- Executes dropped EXE
PID:2428 -
\??\c:\lrxfllf.exec:\lrxfllf.exe57⤵
- Executes dropped EXE
PID:1912 -
\??\c:\1tbnbt.exec:\1tbnbt.exe58⤵
- Executes dropped EXE
PID:2872 -
\??\c:\9pjjp.exec:\9pjjp.exe59⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rlflxxl.exec:\rlflxxl.exe60⤵
- Executes dropped EXE
PID:864 -
\??\c:\rxlrrxl.exec:\rxlrrxl.exe61⤵
- Executes dropped EXE
PID:1684 -
\??\c:\5tnbht.exec:\5tnbht.exe62⤵
- Executes dropped EXE
PID:1468 -
\??\c:\jjjvv.exec:\jjjvv.exe63⤵
- Executes dropped EXE
PID:3060 -
\??\c:\7rlrfll.exec:\7rlrfll.exe64⤵
- Executes dropped EXE
PID:1768 -
\??\c:\ffxlxfx.exec:\ffxlxfx.exe65⤵
- Executes dropped EXE
PID:1240 -
\??\c:\7tntbn.exec:\7tntbn.exe66⤵PID:1848
-
\??\c:\ppjjp.exec:\ppjjp.exe67⤵PID:1344
-
\??\c:\fxlfrrx.exec:\fxlfrrx.exe68⤵PID:2008
-
\??\c:\9lxflrx.exec:\9lxflrx.exe69⤵PID:2364
-
\??\c:\tnhnth.exec:\tnhnth.exe70⤵PID:2132
-
\??\c:\pjdjp.exec:\pjdjp.exe71⤵PID:996
-
\??\c:\7pddj.exec:\7pddj.exe72⤵PID:2332
-
\??\c:\xxlrxfl.exec:\xxlrxfl.exe73⤵PID:3024
-
\??\c:\7nnnbb.exec:\7nnnbb.exe74⤵PID:1492
-
\??\c:\pppvd.exec:\pppvd.exe75⤵PID:2312
-
\??\c:\7fxfllx.exec:\7fxfllx.exe76⤵PID:2664
-
\??\c:\7tnnht.exec:\7tnnht.exe77⤵PID:2520
-
\??\c:\httbnb.exec:\httbnb.exe78⤵PID:2752
-
\??\c:\jjjdj.exec:\jjjdj.exe79⤵PID:2900
-
\??\c:\lxrrffr.exec:\lxrrffr.exe80⤵PID:3048
-
\??\c:\btnbnt.exec:\btnbnt.exe81⤵PID:2680
-
\??\c:\thbhnn.exec:\thbhnn.exe82⤵PID:2892
-
\??\c:\3pjvj.exec:\3pjvj.exe83⤵PID:2860
-
\??\c:\flxfrxl.exec:\flxfrxl.exe84⤵PID:2764
-
\??\c:\7lflfrf.exec:\7lflfrf.exe85⤵PID:2632
-
\??\c:\5thhnn.exec:\5thhnn.exe86⤵PID:2828
-
\??\c:\1ppdd.exec:\1ppdd.exe87⤵PID:1476
-
\??\c:\rlfrxxl.exec:\rlfrxxl.exe88⤵PID:992
-
\??\c:\bbnntb.exec:\bbnntb.exe89⤵PID:2172
-
\??\c:\jdpvj.exec:\jdpvj.exe90⤵PID:1792
-
\??\c:\3ddvp.exec:\3ddvp.exe91⤵PID:2184
-
\??\c:\fxxfflx.exec:\fxxfflx.exe92⤵PID:2460
-
\??\c:\5rfrxlx.exec:\5rfrxlx.exe93⤵PID:2384
-
\??\c:\5bbnhn.exec:\5bbnhn.exe94⤵PID:1948
-
\??\c:\vjdvd.exec:\vjdvd.exe95⤵PID:1280
-
\??\c:\5pdjp.exec:\5pdjp.exe96⤵PID:2644
-
\??\c:\llflxlf.exec:\llflxlf.exe97⤵PID:2412
-
\??\c:\ttnbhn.exec:\ttnbhn.exe98⤵PID:2952
-
\??\c:\tnhntt.exec:\tnhntt.exe99⤵PID:2044
-
\??\c:\ppjpj.exec:\ppjpj.exe100⤵PID:1436
-
\??\c:\rrxrffr.exec:\rrxrffr.exe101⤵PID:1908
-
\??\c:\3xlrfrf.exec:\3xlrfrf.exe102⤵PID:2012
-
\??\c:\hbhtnn.exec:\hbhtnn.exe103⤵PID:3044
-
\??\c:\1pjpv.exec:\1pjpv.exe104⤵PID:2096
-
\??\c:\jjjpv.exec:\jjjpv.exe105⤵PID:548
-
\??\c:\llrxllr.exec:\llrxllr.exe106⤵PID:948
-
\??\c:\1nbhbn.exec:\1nbhbn.exe107⤵PID:1324
-
\??\c:\hhbbhh.exec:\hhbbhh.exe108⤵PID:1236
-
\??\c:\1vvpj.exec:\1vvpj.exe109⤵PID:1696
-
\??\c:\fxflflf.exec:\fxflflf.exe110⤵PID:1708
-
\??\c:\hbttbh.exec:\hbttbh.exe111⤵PID:904
-
\??\c:\7thnbh.exec:\7thnbh.exe112⤵PID:604
-
\??\c:\vjppv.exec:\vjppv.exe113⤵PID:2212
-
\??\c:\rlxxrfr.exec:\rlxxrfr.exe114⤵PID:1312
-
\??\c:\tnnbtt.exec:\tnnbtt.exe115⤵PID:2104
-
\??\c:\bbtbth.exec:\bbtbth.exe116⤵PID:976
-
\??\c:\lfrrxrx.exec:\lfrrxrx.exe117⤵PID:2532
-
\??\c:\1hnnbh.exec:\1hnnbh.exe118⤵PID:1220
-
\??\c:\1hbntt.exec:\1hbntt.exe119⤵PID:2468
-
\??\c:\jdjpd.exec:\jdjpd.exe120⤵PID:2520
-
\??\c:\xrflllf.exec:\xrflllf.exe121⤵PID:2712
-
\??\c:\hbtbnn.exec:\hbtbnn.exe122⤵PID:2672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-