Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 14:54
Static task
static1
Behavioral task
behavioral1
Sample
e1255d67b60e2c3764f8c837cb297acd89aa17f5d2cd88b3f2e39ce6e53f3d58N.exe
Resource
win7-20240903-en
General
-
Target
e1255d67b60e2c3764f8c837cb297acd89aa17f5d2cd88b3f2e39ce6e53f3d58N.exe
-
Size
456KB
-
MD5
b49a7e1a5c6d62c3850dd7a103f22b50
-
SHA1
48d0bd412217b4afc65ad70791a0406ad34ea7f1
-
SHA256
e1255d67b60e2c3764f8c837cb297acd89aa17f5d2cd88b3f2e39ce6e53f3d58
-
SHA512
bdb8434640133841779d5185ae733143541641b5d3b751436630d11b26b9b3067dd5e94609f787d16da8c0d04095dac6c3f2ee0ebd4698b7305b4057e43a8586
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRz:q7Tc2NYHUrAwfMp3CDRz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2648-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-36-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2776-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-93-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1056-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-128-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2320-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-283-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/912-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-321-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2564-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/468-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-685-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-752-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-848-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-882-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2608-890-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2664 hnhtbh.exe 2788 jdppp.exe 2784 7vddj.exe 2776 1xxfxlx.exe 1528 ppddj.exe 2552 lfrfrxl.exe 1976 btbtbb.exe 2124 djpjp.exe 2644 3htttt.exe 776 dvjjd.exe 1056 nhhbbb.exe 2612 1vppv.exe 2896 httntb.exe 324 xxrrxrx.exe 2320 1tbnbh.exe 1764 5xffxxf.exe 476 rlfrfrf.exe 2532 dpjjj.exe 3004 rrxflrx.exe 2144 9nbbhh.exe 908 9jvdp.exe 680 hbnnnt.exe 1712 jdjvp.exe 1776 tnhnbb.exe 2060 pjvvd.exe 2468 hnbbhn.exe 2340 pjvvd.exe 2280 3xrrlxf.exe 2472 ttbhnh.exe 1312 jjvjv.exe 2020 5xxrffl.exe 912 hhbntb.exe 2700 dvjpd.exe 1724 1lxfrxf.exe 2816 3nhttt.exe 2688 pjdjp.exe 1808 xlxflrr.exe 2580 1nbhhh.exe 2600 dvdvd.exe 2564 xxfxffl.exe 2624 rlxlllx.exe 2196 hhthnn.exe 2620 ppdjp.exe 2220 fffxflx.exe 2208 9lrlllr.exe 1124 nhttbb.exe 1476 dvjjv.exe 1948 lxllxxf.exe 2612 3lxxffl.exe 1952 hhnntn.exe 1088 7djjv.exe 2912 1rxxffr.exe 568 5frxlrx.exe 1764 hhbhnn.exe 3000 9jvjv.exe 2920 flxxlrx.exe 2248 bhtttt.exe 2264 3thnht.exe 1596 7jvjp.exe 1316 llflxrx.exe 2016 tthnhh.exe 592 7nhnnn.exe 1780 ddppj.exe 1740 lfrrflr.exe -
resource yara_rule behavioral1/memory/2648-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-93-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1056-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/468-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-826-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-848-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-875-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-897-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3htttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2664 2648 e1255d67b60e2c3764f8c837cb297acd89aa17f5d2cd88b3f2e39ce6e53f3d58N.exe 30 PID 2648 wrote to memory of 2664 2648 e1255d67b60e2c3764f8c837cb297acd89aa17f5d2cd88b3f2e39ce6e53f3d58N.exe 30 PID 2648 wrote to memory of 2664 2648 e1255d67b60e2c3764f8c837cb297acd89aa17f5d2cd88b3f2e39ce6e53f3d58N.exe 30 PID 2648 wrote to memory of 2664 2648 e1255d67b60e2c3764f8c837cb297acd89aa17f5d2cd88b3f2e39ce6e53f3d58N.exe 30 PID 2664 wrote to memory of 2788 2664 hnhtbh.exe 31 PID 2664 wrote to memory of 2788 2664 hnhtbh.exe 31 PID 2664 wrote to memory of 2788 2664 hnhtbh.exe 31 PID 2664 wrote to memory of 2788 2664 hnhtbh.exe 31 PID 2788 wrote to memory of 2784 2788 jdppp.exe 32 PID 2788 wrote to memory of 2784 2788 jdppp.exe 32 PID 2788 wrote to memory of 2784 2788 jdppp.exe 32 PID 2788 wrote to memory of 2784 2788 jdppp.exe 32 PID 2784 wrote to memory of 2776 2784 7vddj.exe 33 PID 2784 wrote to memory of 2776 2784 7vddj.exe 33 PID 2784 wrote to memory of 2776 2784 7vddj.exe 33 PID 2784 wrote to memory of 2776 2784 7vddj.exe 33 PID 2776 wrote to memory of 1528 2776 1xxfxlx.exe 34 PID 2776 wrote to memory of 1528 2776 1xxfxlx.exe 34 PID 2776 wrote to memory of 1528 2776 1xxfxlx.exe 34 PID 2776 wrote to memory of 1528 2776 1xxfxlx.exe 34 PID 1528 wrote to memory of 2552 1528 ppddj.exe 35 PID 1528 wrote to memory of 2552 1528 ppddj.exe 35 PID 1528 wrote to memory of 2552 1528 ppddj.exe 35 PID 1528 wrote to memory of 2552 1528 ppddj.exe 35 PID 2552 wrote to memory of 1976 2552 lfrfrxl.exe 36 PID 2552 wrote to memory of 1976 2552 lfrfrxl.exe 36 PID 2552 wrote to memory of 1976 2552 lfrfrxl.exe 36 PID 2552 wrote to memory of 1976 2552 lfrfrxl.exe 36 PID 1976 wrote to memory of 2124 1976 btbtbb.exe 37 PID 1976 wrote to memory of 2124 1976 btbtbb.exe 37 PID 1976 wrote to memory of 2124 1976 btbtbb.exe 37 PID 1976 wrote to memory of 2124 1976 btbtbb.exe 37 PID 2124 wrote to memory of 2644 2124 djpjp.exe 38 PID 2124 wrote to memory of 2644 2124 djpjp.exe 38 PID 2124 wrote to memory of 2644 2124 djpjp.exe 38 PID 2124 wrote to memory of 2644 2124 djpjp.exe 38 PID 2644 wrote to memory of 776 2644 3htttt.exe 39 PID 2644 wrote to memory of 776 2644 3htttt.exe 39 PID 2644 wrote to memory of 776 2644 3htttt.exe 39 PID 2644 wrote to memory of 776 2644 3htttt.exe 39 PID 776 wrote to memory of 1056 776 dvjjd.exe 40 PID 776 wrote to memory of 1056 776 dvjjd.exe 40 PID 776 wrote to memory of 1056 776 dvjjd.exe 40 PID 776 wrote to memory of 1056 776 dvjjd.exe 40 PID 1056 wrote to memory of 2612 1056 nhhbbb.exe 41 PID 1056 wrote to memory of 2612 1056 nhhbbb.exe 41 PID 1056 wrote to memory of 2612 1056 nhhbbb.exe 41 PID 1056 wrote to memory of 2612 1056 nhhbbb.exe 41 PID 2612 wrote to memory of 2896 2612 1vppv.exe 42 PID 2612 wrote to memory of 2896 2612 1vppv.exe 42 PID 2612 wrote to memory of 2896 2612 1vppv.exe 42 PID 2612 wrote to memory of 2896 2612 1vppv.exe 42 PID 2896 wrote to memory of 324 2896 httntb.exe 43 PID 2896 wrote to memory of 324 2896 httntb.exe 43 PID 2896 wrote to memory of 324 2896 httntb.exe 43 PID 2896 wrote to memory of 324 2896 httntb.exe 43 PID 324 wrote to memory of 2320 324 xxrrxrx.exe 44 PID 324 wrote to memory of 2320 324 xxrrxrx.exe 44 PID 324 wrote to memory of 2320 324 xxrrxrx.exe 44 PID 324 wrote to memory of 2320 324 xxrrxrx.exe 44 PID 2320 wrote to memory of 1764 2320 1tbnbh.exe 45 PID 2320 wrote to memory of 1764 2320 1tbnbh.exe 45 PID 2320 wrote to memory of 1764 2320 1tbnbh.exe 45 PID 2320 wrote to memory of 1764 2320 1tbnbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1255d67b60e2c3764f8c837cb297acd89aa17f5d2cd88b3f2e39ce6e53f3d58N.exe"C:\Users\Admin\AppData\Local\Temp\e1255d67b60e2c3764f8c837cb297acd89aa17f5d2cd88b3f2e39ce6e53f3d58N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\hnhtbh.exec:\hnhtbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\jdppp.exec:\jdppp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\7vddj.exec:\7vddj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\1xxfxlx.exec:\1xxfxlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\ppddj.exec:\ppddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\lfrfrxl.exec:\lfrfrxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\btbtbb.exec:\btbtbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\djpjp.exec:\djpjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\3htttt.exec:\3htttt.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\dvjjd.exec:\dvjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\nhhbbb.exec:\nhhbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\1vppv.exec:\1vppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\httntb.exec:\httntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\xxrrxrx.exec:\xxrrxrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\1tbnbh.exec:\1tbnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\5xffxxf.exec:\5xffxxf.exe17⤵
- Executes dropped EXE
PID:1764 -
\??\c:\rlfrfrf.exec:\rlfrfrf.exe18⤵
- Executes dropped EXE
PID:476 -
\??\c:\dpjjj.exec:\dpjjj.exe19⤵
- Executes dropped EXE
PID:2532 -
\??\c:\rrxflrx.exec:\rrxflrx.exe20⤵
- Executes dropped EXE
PID:3004 -
\??\c:\9nbbhh.exec:\9nbbhh.exe21⤵
- Executes dropped EXE
PID:2144 -
\??\c:\9jvdp.exec:\9jvdp.exe22⤵
- Executes dropped EXE
PID:908 -
\??\c:\hbnnnt.exec:\hbnnnt.exe23⤵
- Executes dropped EXE
PID:680 -
\??\c:\jdjvp.exec:\jdjvp.exe24⤵
- Executes dropped EXE
PID:1712 -
\??\c:\tnhnbb.exec:\tnhnbb.exe25⤵
- Executes dropped EXE
PID:1776 -
\??\c:\pjvvd.exec:\pjvvd.exe26⤵
- Executes dropped EXE
PID:2060 -
\??\c:\hnbbhn.exec:\hnbbhn.exe27⤵
- Executes dropped EXE
PID:2468 -
\??\c:\pjvvd.exec:\pjvvd.exe28⤵
- Executes dropped EXE
PID:2340 -
\??\c:\3xrrlxf.exec:\3xrrlxf.exe29⤵
- Executes dropped EXE
PID:2280 -
\??\c:\ttbhnh.exec:\ttbhnh.exe30⤵
- Executes dropped EXE
PID:2472 -
\??\c:\jjvjv.exec:\jjvjv.exe31⤵
- Executes dropped EXE
PID:1312 -
\??\c:\5xxrffl.exec:\5xxrffl.exe32⤵
- Executes dropped EXE
PID:2020 -
\??\c:\hhbntb.exec:\hhbntb.exe33⤵
- Executes dropped EXE
PID:912 -
\??\c:\dvjpd.exec:\dvjpd.exe34⤵
- Executes dropped EXE
PID:2700 -
\??\c:\1lxfrxf.exec:\1lxfrxf.exe35⤵
- Executes dropped EXE
PID:1724 -
\??\c:\3nhttt.exec:\3nhttt.exe36⤵
- Executes dropped EXE
PID:2816 -
\??\c:\pjdjp.exec:\pjdjp.exe37⤵
- Executes dropped EXE
PID:2688 -
\??\c:\xlxflrr.exec:\xlxflrr.exe38⤵
- Executes dropped EXE
PID:1808 -
\??\c:\1nbhhh.exec:\1nbhhh.exe39⤵
- Executes dropped EXE
PID:2580 -
\??\c:\dvdvd.exec:\dvdvd.exe40⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xxfxffl.exec:\xxfxffl.exe41⤵
- Executes dropped EXE
PID:2564 -
\??\c:\rlxlllx.exec:\rlxlllx.exe42⤵
- Executes dropped EXE
PID:2624 -
\??\c:\hhthnn.exec:\hhthnn.exe43⤵
- Executes dropped EXE
PID:2196 -
\??\c:\ppdjp.exec:\ppdjp.exe44⤵
- Executes dropped EXE
PID:2620 -
\??\c:\fffxflx.exec:\fffxflx.exe45⤵
- Executes dropped EXE
PID:2220 -
\??\c:\9lrlllr.exec:\9lrlllr.exe46⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nhttbb.exec:\nhttbb.exe47⤵
- Executes dropped EXE
PID:1124 -
\??\c:\dvjjv.exec:\dvjjv.exe48⤵
- Executes dropped EXE
PID:1476 -
\??\c:\lxllxxf.exec:\lxllxxf.exe49⤵
- Executes dropped EXE
PID:1948 -
\??\c:\3lxxffl.exec:\3lxxffl.exe50⤵
- Executes dropped EXE
PID:2612 -
\??\c:\hhnntn.exec:\hhnntn.exe51⤵
- Executes dropped EXE
PID:1952 -
\??\c:\7djjv.exec:\7djjv.exe52⤵
- Executes dropped EXE
PID:1088 -
\??\c:\1rxxffr.exec:\1rxxffr.exe53⤵
- Executes dropped EXE
PID:2912 -
\??\c:\5frxlrx.exec:\5frxlrx.exe54⤵
- Executes dropped EXE
PID:568 -
\??\c:\hhbhnn.exec:\hhbhnn.exe55⤵
- Executes dropped EXE
PID:1764 -
\??\c:\9jvjv.exec:\9jvjv.exe56⤵
- Executes dropped EXE
PID:3000 -
\??\c:\flxxlrx.exec:\flxxlrx.exe57⤵
- Executes dropped EXE
PID:2920 -
\??\c:\bhtttt.exec:\bhtttt.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2248 -
\??\c:\3thnht.exec:\3thnht.exe59⤵
- Executes dropped EXE
PID:2264 -
\??\c:\7jvjp.exec:\7jvjp.exe60⤵
- Executes dropped EXE
PID:1596 -
\??\c:\llflxrx.exec:\llflxrx.exe61⤵
- Executes dropped EXE
PID:1316 -
\??\c:\tthnhh.exec:\tthnhh.exe62⤵
- Executes dropped EXE
PID:2016 -
\??\c:\7nhnnn.exec:\7nhnnn.exe63⤵
- Executes dropped EXE
PID:592 -
\??\c:\ddppj.exec:\ddppj.exe64⤵
- Executes dropped EXE
PID:1780 -
\??\c:\lfrrflr.exec:\lfrrflr.exe65⤵
- Executes dropped EXE
PID:1740 -
\??\c:\rrlxffl.exec:\rrlxffl.exe66⤵PID:1728
-
\??\c:\tntntt.exec:\tntntt.exe67⤵PID:1500
-
\??\c:\3pdjj.exec:\3pdjj.exe68⤵PID:1524
-
\??\c:\fxlllfl.exec:\fxlllfl.exe69⤵PID:468
-
\??\c:\7flrrxr.exec:\7flrrxr.exe70⤵PID:2520
-
\??\c:\hhbhbb.exec:\hhbhbb.exe71⤵PID:2288
-
\??\c:\ddjdd.exec:\ddjdd.exe72⤵PID:1832
-
\??\c:\pjpjj.exec:\pjpjj.exe73⤵PID:2348
-
\??\c:\rrlrrrx.exec:\rrlrrrx.exe74⤵PID:1980
-
\??\c:\hhthnt.exec:\hhthnt.exe75⤵PID:2184
-
\??\c:\jjdvd.exec:\jjdvd.exe76⤵PID:1364
-
\??\c:\frlflrf.exec:\frlflrf.exe77⤵PID:2796
-
\??\c:\fxrxflx.exec:\fxrxflx.exe78⤵PID:2788
-
\??\c:\1tbhhn.exec:\1tbhhn.exe79⤵PID:2716
-
\??\c:\dvjjd.exec:\dvjjd.exe80⤵PID:2916
-
\??\c:\xxlrflf.exec:\xxlrflf.exe81⤵PID:2836
-
\??\c:\3ntntt.exec:\3ntntt.exe82⤵PID:2600
-
\??\c:\bhbbhh.exec:\bhbbhh.exe83⤵PID:2568
-
\??\c:\dvpvd.exec:\dvpvd.exe84⤵PID:1396
-
\??\c:\9lxxrxf.exec:\9lxxrxf.exe85⤵PID:2196
-
\??\c:\xlfxxrl.exec:\xlfxxrl.exe86⤵PID:2964
-
\??\c:\nbbbnn.exec:\nbbbnn.exe87⤵PID:2220
-
\??\c:\jdpvp.exec:\jdpvp.exe88⤵PID:3036
-
\??\c:\7xlfffl.exec:\7xlfffl.exe89⤵PID:2064
-
\??\c:\9tnntt.exec:\9tnntt.exe90⤵PID:1056
-
\??\c:\3hhhnh.exec:\3hhhnh.exe91⤵PID:2860
-
\??\c:\dvpvp.exec:\dvpvp.exe92⤵PID:2904
-
\??\c:\xxrxlrx.exec:\xxrxlrx.exe93⤵PID:2924
-
\??\c:\xrffxrx.exec:\xrffxrx.exe94⤵PID:1088
-
\??\c:\bnbhnn.exec:\bnbhnn.exe95⤵
- System Location Discovery: System Language Discovery
PID:2912 -
\??\c:\dpjvv.exec:\dpjvv.exe96⤵PID:264
-
\??\c:\jdpjp.exec:\jdpjp.exe97⤵PID:2480
-
\??\c:\7frrllr.exec:\7frrllr.exe98⤵PID:2992
-
\??\c:\nhtbhh.exec:\nhtbhh.exe99⤵PID:3012
-
\??\c:\nnhnhh.exec:\nnhnhh.exe100⤵PID:1964
-
\??\c:\dpjjj.exec:\dpjjj.exe101⤵PID:3004
-
\??\c:\lflrflf.exec:\lflrflf.exe102⤵PID:448
-
\??\c:\btnthh.exec:\btnthh.exe103⤵PID:1316
-
\??\c:\9dvvp.exec:\9dvvp.exe104⤵PID:836
-
\??\c:\jdppd.exec:\jdppd.exe105⤵PID:592
-
\??\c:\rlxfllr.exec:\rlxfllr.exe106⤵PID:1532
-
\??\c:\nhnnnn.exec:\nhnnnn.exe107⤵PID:1708
-
\??\c:\3nhnnt.exec:\3nhnnt.exe108⤵PID:1728
-
\??\c:\pjddd.exec:\pjddd.exe109⤵PID:1500
-
\??\c:\ffxxrrx.exec:\ffxxrrx.exe110⤵PID:2508
-
\??\c:\5nttbh.exec:\5nttbh.exe111⤵PID:468
-
\??\c:\5nbbnn.exec:\5nbbnn.exe112⤵PID:1000
-
\??\c:\vvdjj.exec:\vvdjj.exe113⤵PID:2288
-
\??\c:\7pjvj.exec:\7pjvj.exe114⤵PID:2096
-
\??\c:\3lfflrf.exec:\3lfflrf.exe115⤵PID:912
-
\??\c:\httthh.exec:\httthh.exe116⤵PID:2804
-
\??\c:\vvjpv.exec:\vvjpv.exe117⤵PID:2812
-
\??\c:\vvjvp.exec:\vvjvp.exe118⤵PID:2796
-
\??\c:\lfxfffl.exec:\lfxfffl.exe119⤵PID:852
-
\??\c:\hbntbb.exec:\hbntbb.exe120⤵PID:2908
-
\??\c:\1ddjp.exec:\1ddjp.exe121⤵PID:2720
-
\??\c:\lfflxfr.exec:\lfflxfr.exe122⤵PID:2608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-