Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 23:13
Behavioral task
behavioral1
Sample
79d5085a8820e90aff2fc626c204ed301074d0baa5ca0997e7737d934308af46.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
79d5085a8820e90aff2fc626c204ed301074d0baa5ca0997e7737d934308af46.exe
-
Size
331KB
-
MD5
36cd88908d3cd56f0b39bd788def1edb
-
SHA1
3df68d6be00757ebead6b7af7110c6b40ed27691
-
SHA256
79d5085a8820e90aff2fc626c204ed301074d0baa5ca0997e7737d934308af46
-
SHA512
c3cf0fe5d65db0157660235dfd639ab20cffcbb8d78dba4de7189ba47122201accef3d5fd6b4978f66a0b0a3a67d8b19fbf142497ff16184186abb0c7a7faf5a
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeU:R4wFHoSHYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2780-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2668-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1840-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-99-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1308-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1272-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1316-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1316-208-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2968-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-270-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2700-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1932-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1436-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2132-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/756-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1184-490-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/812-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/812-513-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2676-546-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2936-557-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2576-564-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2936-558-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-575-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-582-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3020-601-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2860-612-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/332-651-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2992-802-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2800 rlflxxl.exe 2752 nhtthb.exe 2128 pjvvj.exe 2684 rfxxxlr.exe 2544 vpjjp.exe 2668 lfrxffx.exe 1840 jdvdd.exe 1712 3rfrllr.exe 2876 bnhhnn.exe 2900 pjjjp.exe 2268 frxrrrr.exe 1308 hbhhnn.exe 2340 9pvvv.exe 1588 jvjjp.exe 2028 lfxfllr.exe 2856 dpdvd.exe 1444 7xrxflr.exe 2116 hbnthb.exe 2148 vppdd.exe 2188 rlxlxxf.exe 2380 3httbh.exe 2368 rfxxrrx.exe 1100 1lxrflx.exe 2108 tnbttb.exe 1316 pvpvd.exe 1272 9lrrrlx.exe 1856 bttttn.exe 628 ppddv.exe 1132 lxrrxxf.exe 2968 bntnnh.exe 1720 jjvpv.exe 2312 5nbbnt.exe 3008 9pjvd.exe 1992 lfrxllf.exe 2784 rrllrlx.exe 1516 ttntbb.exe 2820 5jdjp.exe 2700 lflfrrf.exe 2764 xxlrfxf.exe 2808 btbtbt.exe 2912 dpdvv.exe 2548 1rfxflf.exe 2720 1fllxxx.exe 2544 nhtbnh.exe 1784 pjvdd.exe 1400 rrffllf.exe 2344 rfxrrxf.exe 2884 7thtbb.exe 2892 vpvvj.exe 3012 dpjpv.exe 2644 rllfllx.exe 1932 tnbthn.exe 1620 pjdjv.exe 332 9pjjv.exe 1500 7xlrxrr.exe 1632 7tnbhh.exe 2536 nnntnn.exe 1436 1jvvv.exe 548 jvdvv.exe 1196 rfrrrxx.exe 2956 bthhnn.exe 2528 pjppd.exe 2112 jjjdj.exe 2132 rrlllrx.exe -
resource yara_rule behavioral1/memory/2780-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120cd-5.dat upx behavioral1/memory/2780-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000186ee-15.dat upx behavioral1/memory/2752-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2800-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2128-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000186fd-25.dat upx behavioral1/memory/2752-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2684-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001873d-34.dat upx behavioral1/files/0x000600000001878f-42.dat upx behavioral1/memory/2684-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2544-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000187a5-49.dat upx behavioral1/files/0x0007000000019023-58.dat upx behavioral1/memory/2668-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1840-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001925e-65.dat upx behavioral1/files/0x0007000000019261-74.dat upx behavioral1/memory/1712-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019609-82.dat upx behavioral1/memory/2900-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2876-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960b-92.dat upx behavioral1/files/0x000500000001960d-101.dat upx behavioral1/memory/1308-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960f-110.dat upx behavioral1/files/0x0005000000019611-118.dat upx behavioral1/files/0x0005000000019613-124.dat upx behavioral1/files/0x0005000000019615-131.dat upx behavioral1/memory/2856-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019617-140.dat upx behavioral1/memory/2856-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019619-147.dat upx behavioral1/memory/2116-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961b-156.dat upx behavioral1/memory/2116-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001961d-163.dat upx behavioral1/files/0x000500000001961f-170.dat upx behavioral1/files/0x0034000000018683-177.dat upx behavioral1/memory/2368-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019621-185.dat upx behavioral1/files/0x0005000000019622-193.dat upx behavioral1/files/0x0005000000019623-201.dat upx behavioral1/memory/2108-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019667-220.dat upx behavioral1/memory/1272-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019625-212.dat upx behavioral1/memory/1316-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000196af-226.dat upx behavioral1/files/0x00050000000196b1-233.dat upx behavioral1/files/0x000500000001977d-241.dat upx behavioral1/files/0x00050000000197f8-249.dat upx behavioral1/memory/2968-243-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2312-259-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019838-258.dat upx behavioral1/memory/3008-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2700-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2764-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2544-331-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1932-373-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1436-405-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2780 wrote to memory of 2800 2780 79d5085a8820e90aff2fc626c204ed301074d0baa5ca0997e7737d934308af46.exe 30 PID 2780 wrote to memory of 2800 2780 79d5085a8820e90aff2fc626c204ed301074d0baa5ca0997e7737d934308af46.exe 30 PID 2780 wrote to memory of 2800 2780 79d5085a8820e90aff2fc626c204ed301074d0baa5ca0997e7737d934308af46.exe 30 PID 2780 wrote to memory of 2800 2780 79d5085a8820e90aff2fc626c204ed301074d0baa5ca0997e7737d934308af46.exe 30 PID 2800 wrote to memory of 2752 2800 rlflxxl.exe 31 PID 2800 wrote to memory of 2752 2800 rlflxxl.exe 31 PID 2800 wrote to memory of 2752 2800 rlflxxl.exe 31 PID 2800 wrote to memory of 2752 2800 rlflxxl.exe 31 PID 2752 wrote to memory of 2128 2752 nhtthb.exe 32 PID 2752 wrote to memory of 2128 2752 nhtthb.exe 32 PID 2752 wrote to memory of 2128 2752 nhtthb.exe 32 PID 2752 wrote to memory of 2128 2752 nhtthb.exe 32 PID 2128 wrote to memory of 2684 2128 pjvvj.exe 33 PID 2128 wrote to memory of 2684 2128 pjvvj.exe 33 PID 2128 wrote to memory of 2684 2128 pjvvj.exe 33 PID 2128 wrote to memory of 2684 2128 pjvvj.exe 33 PID 2684 wrote to memory of 2544 2684 rfxxxlr.exe 34 PID 2684 wrote to memory of 2544 2684 rfxxxlr.exe 34 PID 2684 wrote to memory of 2544 2684 rfxxxlr.exe 34 PID 2684 wrote to memory of 2544 2684 rfxxxlr.exe 34 PID 2544 wrote to memory of 2668 2544 vpjjp.exe 35 PID 2544 wrote to memory of 2668 2544 vpjjp.exe 35 PID 2544 wrote to memory of 2668 2544 vpjjp.exe 35 PID 2544 wrote to memory of 2668 2544 vpjjp.exe 35 PID 2668 wrote to memory of 1840 2668 lfrxffx.exe 36 PID 2668 wrote to memory of 1840 2668 lfrxffx.exe 36 PID 2668 wrote to memory of 1840 2668 lfrxffx.exe 36 PID 2668 wrote to memory of 1840 2668 lfrxffx.exe 36 PID 1840 wrote to memory of 1712 1840 jdvdd.exe 37 PID 1840 wrote to memory of 1712 1840 jdvdd.exe 37 PID 1840 wrote to memory of 1712 1840 jdvdd.exe 37 PID 1840 wrote to memory of 1712 1840 jdvdd.exe 37 PID 1712 wrote to memory of 2876 1712 3rfrllr.exe 38 PID 1712 wrote to memory of 2876 1712 3rfrllr.exe 38 PID 1712 wrote to memory of 2876 1712 3rfrllr.exe 38 PID 1712 wrote to memory of 2876 1712 3rfrllr.exe 38 PID 2876 wrote to memory of 2900 2876 bnhhnn.exe 39 PID 2876 wrote to memory of 2900 2876 bnhhnn.exe 39 PID 2876 wrote to memory of 2900 2876 bnhhnn.exe 39 PID 2876 wrote to memory of 2900 2876 bnhhnn.exe 39 PID 2900 wrote to memory of 2268 2900 pjjjp.exe 40 PID 2900 wrote to memory of 2268 2900 pjjjp.exe 40 PID 2900 wrote to memory of 2268 2900 pjjjp.exe 40 PID 2900 wrote to memory of 2268 2900 pjjjp.exe 40 PID 2268 wrote to memory of 1308 2268 frxrrrr.exe 41 PID 2268 wrote to memory of 1308 2268 frxrrrr.exe 41 PID 2268 wrote to memory of 1308 2268 frxrrrr.exe 41 PID 2268 wrote to memory of 1308 2268 frxrrrr.exe 41 PID 1308 wrote to memory of 2340 1308 hbhhnn.exe 42 PID 1308 wrote to memory of 2340 1308 hbhhnn.exe 42 PID 1308 wrote to memory of 2340 1308 hbhhnn.exe 42 PID 1308 wrote to memory of 2340 1308 hbhhnn.exe 42 PID 2340 wrote to memory of 1588 2340 9pvvv.exe 43 PID 2340 wrote to memory of 1588 2340 9pvvv.exe 43 PID 2340 wrote to memory of 1588 2340 9pvvv.exe 43 PID 2340 wrote to memory of 1588 2340 9pvvv.exe 43 PID 1588 wrote to memory of 2028 1588 jvjjp.exe 44 PID 1588 wrote to memory of 2028 1588 jvjjp.exe 44 PID 1588 wrote to memory of 2028 1588 jvjjp.exe 44 PID 1588 wrote to memory of 2028 1588 jvjjp.exe 44 PID 2028 wrote to memory of 2856 2028 lfxfllr.exe 45 PID 2028 wrote to memory of 2856 2028 lfxfllr.exe 45 PID 2028 wrote to memory of 2856 2028 lfxfllr.exe 45 PID 2028 wrote to memory of 2856 2028 lfxfllr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\79d5085a8820e90aff2fc626c204ed301074d0baa5ca0997e7737d934308af46.exe"C:\Users\Admin\AppData\Local\Temp\79d5085a8820e90aff2fc626c204ed301074d0baa5ca0997e7737d934308af46.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\rlflxxl.exec:\rlflxxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\nhtthb.exec:\nhtthb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\pjvvj.exec:\pjvvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\rfxxxlr.exec:\rfxxxlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\vpjjp.exec:\vpjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\lfrxffx.exec:\lfrxffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\jdvdd.exec:\jdvdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\3rfrllr.exec:\3rfrllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\bnhhnn.exec:\bnhhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\pjjjp.exec:\pjjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\frxrrrr.exec:\frxrrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\hbhhnn.exec:\hbhhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\9pvvv.exec:\9pvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\jvjjp.exec:\jvjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\lfxfllr.exec:\lfxfllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\dpdvd.exec:\dpdvd.exe17⤵
- Executes dropped EXE
PID:2856 -
\??\c:\7xrxflr.exec:\7xrxflr.exe18⤵
- Executes dropped EXE
PID:1444 -
\??\c:\hbnthb.exec:\hbnthb.exe19⤵
- Executes dropped EXE
PID:2116 -
\??\c:\vppdd.exec:\vppdd.exe20⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rlxlxxf.exec:\rlxlxxf.exe21⤵
- Executes dropped EXE
PID:2188 -
\??\c:\3httbh.exec:\3httbh.exe22⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rfxxrrx.exec:\rfxxrrx.exe23⤵
- Executes dropped EXE
PID:2368 -
\??\c:\1lxrflx.exec:\1lxrflx.exe24⤵
- Executes dropped EXE
PID:1100 -
\??\c:\tnbttb.exec:\tnbttb.exe25⤵
- Executes dropped EXE
PID:2108 -
\??\c:\pvpvd.exec:\pvpvd.exe26⤵
- Executes dropped EXE
PID:1316 -
\??\c:\9lrrrlx.exec:\9lrrrlx.exe27⤵
- Executes dropped EXE
PID:1272 -
\??\c:\bttttn.exec:\bttttn.exe28⤵
- Executes dropped EXE
PID:1856 -
\??\c:\ppddv.exec:\ppddv.exe29⤵
- Executes dropped EXE
PID:628 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe30⤵
- Executes dropped EXE
PID:1132 -
\??\c:\bntnnh.exec:\bntnnh.exe31⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jjvpv.exec:\jjvpv.exe32⤵
- Executes dropped EXE
PID:1720 -
\??\c:\5nbbnt.exec:\5nbbnt.exe33⤵
- Executes dropped EXE
PID:2312 -
\??\c:\9pjvd.exec:\9pjvd.exe34⤵
- Executes dropped EXE
PID:3008 -
\??\c:\lfrxllf.exec:\lfrxllf.exe35⤵
- Executes dropped EXE
PID:1992 -
\??\c:\rrllrlx.exec:\rrllrlx.exe36⤵
- Executes dropped EXE
PID:2784 -
\??\c:\ttntbb.exec:\ttntbb.exe37⤵
- Executes dropped EXE
PID:1516 -
\??\c:\5jdjp.exec:\5jdjp.exe38⤵
- Executes dropped EXE
PID:2820 -
\??\c:\lflfrrf.exec:\lflfrrf.exe39⤵
- Executes dropped EXE
PID:2700 -
\??\c:\xxlrfxf.exec:\xxlrfxf.exe40⤵
- Executes dropped EXE
PID:2764 -
\??\c:\btbtbt.exec:\btbtbt.exe41⤵
- Executes dropped EXE
PID:2808 -
\??\c:\dpdvv.exec:\dpdvv.exe42⤵
- Executes dropped EXE
PID:2912 -
\??\c:\1rfxflf.exec:\1rfxflf.exe43⤵
- Executes dropped EXE
PID:2548 -
\??\c:\1fllxxx.exec:\1fllxxx.exe44⤵
- Executes dropped EXE
PID:2720 -
\??\c:\nhtbnh.exec:\nhtbnh.exe45⤵
- Executes dropped EXE
PID:2544 -
\??\c:\pjvdd.exec:\pjvdd.exe46⤵
- Executes dropped EXE
PID:1784 -
\??\c:\rrffllf.exec:\rrffllf.exe47⤵
- Executes dropped EXE
PID:1400 -
\??\c:\rfxrrxf.exec:\rfxrrxf.exe48⤵
- Executes dropped EXE
PID:2344 -
\??\c:\7thtbb.exec:\7thtbb.exe49⤵
- Executes dropped EXE
PID:2884 -
\??\c:\vpvvj.exec:\vpvvj.exe50⤵
- Executes dropped EXE
PID:2892 -
\??\c:\dpjpv.exec:\dpjpv.exe51⤵
- Executes dropped EXE
PID:3012 -
\??\c:\rllfllx.exec:\rllfllx.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2644 -
\??\c:\tnbthn.exec:\tnbthn.exe53⤵
- Executes dropped EXE
PID:1932 -
\??\c:\pjdjv.exec:\pjdjv.exe54⤵
- Executes dropped EXE
PID:1620 -
\??\c:\9pjjv.exec:\9pjjv.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:332 -
\??\c:\7xlrxrr.exec:\7xlrxrr.exe56⤵
- Executes dropped EXE
PID:1500 -
\??\c:\7tnbhh.exec:\7tnbhh.exe57⤵
- Executes dropped EXE
PID:1632 -
\??\c:\nnntnn.exec:\nnntnn.exe58⤵
- Executes dropped EXE
PID:2536 -
\??\c:\1jvvv.exec:\1jvvv.exe59⤵
- Executes dropped EXE
PID:1436 -
\??\c:\jvdvv.exec:\jvdvv.exe60⤵
- Executes dropped EXE
PID:548 -
\??\c:\rfrrrxx.exec:\rfrrrxx.exe61⤵
- Executes dropped EXE
PID:1196 -
\??\c:\bthhnn.exec:\bthhnn.exe62⤵
- Executes dropped EXE
PID:2956 -
\??\c:\pjppd.exec:\pjppd.exe63⤵
- Executes dropped EXE
PID:2528 -
\??\c:\jjjdj.exec:\jjjdj.exe64⤵
- Executes dropped EXE
PID:2112 -
\??\c:\rrlllrx.exec:\rrlllrx.exe65⤵
- Executes dropped EXE
PID:2132 -
\??\c:\tthhbb.exec:\tthhbb.exe66⤵PID:2412
-
\??\c:\nhnnbb.exec:\nhnnbb.exe67⤵PID:1640
-
\??\c:\dvjvd.exec:\dvjvd.exe68⤵PID:1604
-
\??\c:\fxrxxrx.exec:\fxrxxrx.exe69⤵PID:2212
-
\??\c:\fxflrrx.exec:\fxflrrx.exe70⤵PID:1584
-
\??\c:\nhnthh.exec:\nhnthh.exe71⤵PID:756
-
\??\c:\9vpjj.exec:\9vpjj.exe72⤵PID:1848
-
\??\c:\fxlrrxf.exec:\fxlrrxf.exe73⤵PID:744
-
\??\c:\9rfffff.exec:\9rfffff.exe74⤵PID:1184
-
\??\c:\9thhtt.exec:\9thhtt.exe75⤵
- System Location Discovery: System Language Discovery
PID:1560 -
\??\c:\tnhntn.exec:\tnhntn.exe76⤵PID:684
-
\??\c:\pjdvd.exec:\pjdvd.exe77⤵PID:344
-
\??\c:\3lxlxxx.exec:\3lxlxxx.exe78⤵PID:812
-
\??\c:\rlffrrx.exec:\rlffrrx.exe79⤵
- System Location Discovery: System Language Discovery
PID:1432 -
\??\c:\tnttbh.exec:\tnttbh.exe80⤵PID:1616
-
\??\c:\tthbhh.exec:\tthbhh.exe81⤵PID:1016
-
\??\c:\3dvpp.exec:\3dvpp.exe82⤵PID:3008
-
\??\c:\rxrrffl.exec:\rxrrffl.exe83⤵PID:2440
-
\??\c:\1frlxxf.exec:\1frlxxf.exe84⤵PID:2676
-
\??\c:\3tbbtb.exec:\3tbbtb.exe85⤵PID:1524
-
\??\c:\nhtnnh.exec:\nhtnnh.exe86⤵PID:2936
-
\??\c:\dvddd.exec:\dvddd.exe87⤵PID:2576
-
\??\c:\vpvdj.exec:\vpvdj.exe88⤵PID:2664
-
\??\c:\rlflllr.exec:\rlflllr.exe89⤵PID:2260
-
\??\c:\bnbbnn.exec:\bnbbnn.exe90⤵PID:2564
-
\??\c:\dpvpv.exec:\dpvpv.exe91⤵PID:2548
-
\??\c:\vjvdj.exec:\vjvdj.exe92⤵PID:3040
-
\??\c:\9rflflr.exec:\9rflflr.exe93⤵PID:3020
-
\??\c:\btnbnn.exec:\btnbnn.exe94⤵PID:1840
-
\??\c:\pdvdj.exec:\pdvdj.exe95⤵PID:2860
-
\??\c:\jdvvp.exec:\jdvvp.exe96⤵PID:2904
-
\??\c:\rflrrfl.exec:\rflrrfl.exe97⤵PID:2392
-
\??\c:\fflrxfl.exec:\fflrxfl.exe98⤵PID:3012
-
\??\c:\5nntth.exec:\5nntth.exe99⤵PID:1656
-
\??\c:\tnhthb.exec:\tnhthb.exe100⤵PID:580
-
\??\c:\pjpvd.exec:\pjpvd.exe101⤵PID:1180
-
\??\c:\3rfffff.exec:\3rfffff.exe102⤵PID:332
-
\??\c:\lflllrr.exec:\lflllrr.exe103⤵PID:1396
-
\??\c:\bbnhnn.exec:\bbnhnn.exe104⤵PID:2616
-
\??\c:\vjjpp.exec:\vjjpp.exe105⤵PID:1572
-
\??\c:\jdpjj.exec:\jdpjj.exe106⤵PID:832
-
\??\c:\lflllfx.exec:\lflllfx.exe107⤵PID:292
-
\??\c:\xrrrrrx.exec:\xrrrrrx.exe108⤵PID:2532
-
\??\c:\1nnnnb.exec:\1nnnnb.exe109⤵PID:2956
-
\??\c:\7vppv.exec:\7vppv.exe110⤵PID:2840
-
\??\c:\9jppp.exec:\9jppp.exe111⤵PID:2396
-
\??\c:\5lfrxxx.exec:\5lfrxxx.exe112⤵PID:2120
-
\??\c:\1bnbhn.exec:\1bnbhn.exe113⤵PID:2352
-
\??\c:\7thhth.exec:\7thhth.exe114⤵PID:2416
-
\??\c:\dvdjv.exec:\dvdjv.exe115⤵PID:1624
-
\??\c:\llxxlrl.exec:\llxxlrl.exe116⤵PID:2212
-
\??\c:\rlrxllr.exec:\rlrxllr.exe117⤵PID:2496
-
\??\c:\tnbbhh.exec:\tnbbhh.exe118⤵PID:1316
-
\??\c:\bntntt.exec:\bntntt.exe119⤵PID:1688
-
\??\c:\vvjvd.exec:\vvjvd.exe120⤵PID:1884
-
\??\c:\fxrxxfl.exec:\fxrxxfl.exe121⤵PID:1972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-