Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 15:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8de23b1d7d29539f621e72778b363a6e2da512ba91c30674c83866b7da202a8c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
8de23b1d7d29539f621e72778b363a6e2da512ba91c30674c83866b7da202a8c.exe
-
Size
454KB
-
MD5
a319505930a36727b0caaf4835f67c4d
-
SHA1
df378a9be4fedd0ba75abc9b0aae4b98eb63a80f
-
SHA256
8de23b1d7d29539f621e72778b363a6e2da512ba91c30674c83866b7da202a8c
-
SHA512
f9ca48fdbb43b1336f9a727ec285950037bcd2294972fe4ae9c07d3f632f7fba374211379f42605b5bae927c54db08cf136d57321c57881fe2def271ae5b3742
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1A:q7Tc2NYHUrAwfMp3CD1A
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/3064-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-80-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/880-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-98-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2624-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1284-175-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1032-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/992-414-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1320-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-283-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/336-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-237-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2944-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-192-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/320-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-441-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/1816-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-451-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3004-476-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2188-479-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2336-491-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2784-494-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1548-511-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-545-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2456-548-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1608-571-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2332-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-713-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-726-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3052-770-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2380 nhttbn.exe 2112 pjddd.exe 2340 htnnhh.exe 1304 7vjdp.exe 2836 llrxffr.exe 880 7dvjd.exe 2184 ddpvj.exe 2828 9xxllxr.exe 2624 3thhnn.exe 2320 rlflflx.exe 1288 3rrlrrx.exe 1040 vppjp.exe 320 rlllrxl.exe 600 5ttbhh.exe 1148 9dpdp.exe 1484 frrxffl.exe 1284 lfrfxxf.exe 2916 nhtbbt.exe 2796 7xrlxfr.exe 2124 bnhtnt.exe 2336 3djpv.exe 2944 fxlrlll.exe 1032 bnhtbh.exe 1548 pjvjd.exe 1984 dppdv.exe 1528 xxrfrrl.exe 336 vjjjv.exe 2252 xfxlxrl.exe 1080 3ththn.exe 2244 vpjvj.exe 1736 7llrflf.exe 2408 ttnbnt.exe 1864 dvjpd.exe 2848 ddvjj.exe 2708 llllfll.exe 2696 9hbhnn.exe 2812 nhtbnn.exe 1320 7jpvp.exe 2960 rxrxlrf.exe 2184 ffxfrxr.exe 2640 ttnbth.exe 2676 hhbnbh.exe 2624 7jjpv.exe 2180 lxrxrlx.exe 2608 xrrxrxl.exe 1760 ttntnn.exe 1040 hnbhnt.exe 992 jjdvj.exe 1496 3pjjp.exe 900 lllrffx.exe 1148 5frfxlx.exe 904 ttnthn.exe 1816 jdvdv.exe 2964 hnbbhh.exe 1764 djvvv.exe 816 tnbhbh.exe 3004 jvjdv.exe 2188 rflfrlr.exe 2336 lxlrfff.exe 2784 7vvvd.exe 1032 vjvpj.exe 1548 nbnttt.exe 2588 7hnbbh.exe 2052 jdddd.exe -
resource yara_rule behavioral1/memory/3064-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-441-0x0000000001C60000-0x0000000001C8A000-memory.dmp upx behavioral1/memory/1816-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-489-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1548-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-571-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2332-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-694-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1148-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-757-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/688-771-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fllffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3064 wrote to memory of 2380 3064 8de23b1d7d29539f621e72778b363a6e2da512ba91c30674c83866b7da202a8c.exe 30 PID 3064 wrote to memory of 2380 3064 8de23b1d7d29539f621e72778b363a6e2da512ba91c30674c83866b7da202a8c.exe 30 PID 3064 wrote to memory of 2380 3064 8de23b1d7d29539f621e72778b363a6e2da512ba91c30674c83866b7da202a8c.exe 30 PID 3064 wrote to memory of 2380 3064 8de23b1d7d29539f621e72778b363a6e2da512ba91c30674c83866b7da202a8c.exe 30 PID 2380 wrote to memory of 2112 2380 nhttbn.exe 31 PID 2380 wrote to memory of 2112 2380 nhttbn.exe 31 PID 2380 wrote to memory of 2112 2380 nhttbn.exe 31 PID 2380 wrote to memory of 2112 2380 nhttbn.exe 31 PID 2112 wrote to memory of 2340 2112 pjddd.exe 32 PID 2112 wrote to memory of 2340 2112 pjddd.exe 32 PID 2112 wrote to memory of 2340 2112 pjddd.exe 32 PID 2112 wrote to memory of 2340 2112 pjddd.exe 32 PID 2340 wrote to memory of 1304 2340 htnnhh.exe 33 PID 2340 wrote to memory of 1304 2340 htnnhh.exe 33 PID 2340 wrote to memory of 1304 2340 htnnhh.exe 33 PID 2340 wrote to memory of 1304 2340 htnnhh.exe 33 PID 1304 wrote to memory of 2836 1304 7vjdp.exe 34 PID 1304 wrote to memory of 2836 1304 7vjdp.exe 34 PID 1304 wrote to memory of 2836 1304 7vjdp.exe 34 PID 1304 wrote to memory of 2836 1304 7vjdp.exe 34 PID 2836 wrote to memory of 880 2836 llrxffr.exe 35 PID 2836 wrote to memory of 880 2836 llrxffr.exe 35 PID 2836 wrote to memory of 880 2836 llrxffr.exe 35 PID 2836 wrote to memory of 880 2836 llrxffr.exe 35 PID 880 wrote to memory of 2184 880 7dvjd.exe 69 PID 880 wrote to memory of 2184 880 7dvjd.exe 69 PID 880 wrote to memory of 2184 880 7dvjd.exe 69 PID 880 wrote to memory of 2184 880 7dvjd.exe 69 PID 2184 wrote to memory of 2828 2184 ddpvj.exe 37 PID 2184 wrote to memory of 2828 2184 ddpvj.exe 37 PID 2184 wrote to memory of 2828 2184 ddpvj.exe 37 PID 2184 wrote to memory of 2828 2184 ddpvj.exe 37 PID 2828 wrote to memory of 2624 2828 9xxllxr.exe 72 PID 2828 wrote to memory of 2624 2828 9xxllxr.exe 72 PID 2828 wrote to memory of 2624 2828 9xxllxr.exe 72 PID 2828 wrote to memory of 2624 2828 9xxllxr.exe 72 PID 2624 wrote to memory of 2320 2624 3thhnn.exe 39 PID 2624 wrote to memory of 2320 2624 3thhnn.exe 39 PID 2624 wrote to memory of 2320 2624 3thhnn.exe 39 PID 2624 wrote to memory of 2320 2624 3thhnn.exe 39 PID 2320 wrote to memory of 1288 2320 rlflflx.exe 40 PID 2320 wrote to memory of 1288 2320 rlflflx.exe 40 PID 2320 wrote to memory of 1288 2320 rlflflx.exe 40 PID 2320 wrote to memory of 1288 2320 rlflflx.exe 40 PID 1288 wrote to memory of 1040 1288 3rrlrrx.exe 76 PID 1288 wrote to memory of 1040 1288 3rrlrrx.exe 76 PID 1288 wrote to memory of 1040 1288 3rrlrrx.exe 76 PID 1288 wrote to memory of 1040 1288 3rrlrrx.exe 76 PID 1040 wrote to memory of 320 1040 vppjp.exe 42 PID 1040 wrote to memory of 320 1040 vppjp.exe 42 PID 1040 wrote to memory of 320 1040 vppjp.exe 42 PID 1040 wrote to memory of 320 1040 vppjp.exe 42 PID 320 wrote to memory of 600 320 rlllrxl.exe 43 PID 320 wrote to memory of 600 320 rlllrxl.exe 43 PID 320 wrote to memory of 600 320 rlllrxl.exe 43 PID 320 wrote to memory of 600 320 rlllrxl.exe 43 PID 600 wrote to memory of 1148 600 5ttbhh.exe 44 PID 600 wrote to memory of 1148 600 5ttbhh.exe 44 PID 600 wrote to memory of 1148 600 5ttbhh.exe 44 PID 600 wrote to memory of 1148 600 5ttbhh.exe 44 PID 1148 wrote to memory of 1484 1148 9dpdp.exe 45 PID 1148 wrote to memory of 1484 1148 9dpdp.exe 45 PID 1148 wrote to memory of 1484 1148 9dpdp.exe 45 PID 1148 wrote to memory of 1484 1148 9dpdp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8de23b1d7d29539f621e72778b363a6e2da512ba91c30674c83866b7da202a8c.exe"C:\Users\Admin\AppData\Local\Temp\8de23b1d7d29539f621e72778b363a6e2da512ba91c30674c83866b7da202a8c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\nhttbn.exec:\nhttbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\pjddd.exec:\pjddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\htnnhh.exec:\htnnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\7vjdp.exec:\7vjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\llrxffr.exec:\llrxffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\7dvjd.exec:\7dvjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\ddpvj.exec:\ddpvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\9xxllxr.exec:\9xxllxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\3thhnn.exec:\3thhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\rlflflx.exec:\rlflflx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\3rrlrrx.exec:\3rrlrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\vppjp.exec:\vppjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\rlllrxl.exec:\rlllrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\5ttbhh.exec:\5ttbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\9dpdp.exec:\9dpdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\frrxffl.exec:\frrxffl.exe17⤵
- Executes dropped EXE
PID:1484 -
\??\c:\lfrfxxf.exec:\lfrfxxf.exe18⤵
- Executes dropped EXE
PID:1284 -
\??\c:\nhtbbt.exec:\nhtbbt.exe19⤵
- Executes dropped EXE
PID:2916 -
\??\c:\7xrlxfr.exec:\7xrlxfr.exe20⤵
- Executes dropped EXE
PID:2796 -
\??\c:\bnhtnt.exec:\bnhtnt.exe21⤵
- Executes dropped EXE
PID:2124 -
\??\c:\3djpv.exec:\3djpv.exe22⤵
- Executes dropped EXE
PID:2336 -
\??\c:\fxlrlll.exec:\fxlrlll.exe23⤵
- Executes dropped EXE
PID:2944 -
\??\c:\bnhtbh.exec:\bnhtbh.exe24⤵
- Executes dropped EXE
PID:1032 -
\??\c:\pjvjd.exec:\pjvjd.exe25⤵
- Executes dropped EXE
PID:1548 -
\??\c:\dppdv.exec:\dppdv.exe26⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xxrfrrl.exec:\xxrfrrl.exe27⤵
- Executes dropped EXE
PID:1528 -
\??\c:\vjjjv.exec:\vjjjv.exe28⤵
- Executes dropped EXE
PID:336 -
\??\c:\xfxlxrl.exec:\xfxlxrl.exe29⤵
- Executes dropped EXE
PID:2252 -
\??\c:\3ththn.exec:\3ththn.exe30⤵
- Executes dropped EXE
PID:1080 -
\??\c:\vpjvj.exec:\vpjvj.exe31⤵
- Executes dropped EXE
PID:2244 -
\??\c:\7llrflf.exec:\7llrflf.exe32⤵
- Executes dropped EXE
PID:1736 -
\??\c:\ttnbnt.exec:\ttnbnt.exe33⤵
- Executes dropped EXE
PID:2408 -
\??\c:\dvjpd.exec:\dvjpd.exe34⤵
- Executes dropped EXE
PID:1864 -
\??\c:\ddvjj.exec:\ddvjj.exe35⤵
- Executes dropped EXE
PID:2848 -
\??\c:\llllfll.exec:\llllfll.exe36⤵
- Executes dropped EXE
PID:2708 -
\??\c:\9hbhnn.exec:\9hbhnn.exe37⤵
- Executes dropped EXE
PID:2696 -
\??\c:\nhtbnn.exec:\nhtbnn.exe38⤵
- Executes dropped EXE
PID:2812 -
\??\c:\7jpvp.exec:\7jpvp.exe39⤵
- Executes dropped EXE
PID:1320 -
\??\c:\rxrxlrf.exec:\rxrxlrf.exe40⤵
- Executes dropped EXE
PID:2960 -
\??\c:\ffxfrxr.exec:\ffxfrxr.exe41⤵
- Executes dropped EXE
PID:2184 -
\??\c:\ttnbth.exec:\ttnbth.exe42⤵
- Executes dropped EXE
PID:2640 -
\??\c:\hhbnbh.exec:\hhbnbh.exe43⤵
- Executes dropped EXE
PID:2676 -
\??\c:\7jjpv.exec:\7jjpv.exe44⤵
- Executes dropped EXE
PID:2624 -
\??\c:\lxrxrlx.exec:\lxrxrlx.exe45⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xrrxrxl.exec:\xrrxrxl.exe46⤵
- Executes dropped EXE
PID:2608 -
\??\c:\ttntnn.exec:\ttntnn.exe47⤵
- Executes dropped EXE
PID:1760 -
\??\c:\hnbhnt.exec:\hnbhnt.exe48⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jjdvj.exec:\jjdvj.exe49⤵
- Executes dropped EXE
PID:992 -
\??\c:\3pjjp.exec:\3pjjp.exe50⤵
- Executes dropped EXE
PID:1496 -
\??\c:\lllrffx.exec:\lllrffx.exe51⤵
- Executes dropped EXE
PID:900 -
\??\c:\5frfxlx.exec:\5frfxlx.exe52⤵
- Executes dropped EXE
PID:1148 -
\??\c:\ttnthn.exec:\ttnthn.exe53⤵
- Executes dropped EXE
PID:904 -
\??\c:\jdvdv.exec:\jdvdv.exe54⤵
- Executes dropped EXE
PID:1816 -
\??\c:\hnbbhh.exec:\hnbbhh.exe55⤵
- Executes dropped EXE
PID:2964 -
\??\c:\djvvv.exec:\djvvv.exe56⤵
- Executes dropped EXE
PID:1764 -
\??\c:\tnbhbh.exec:\tnbhbh.exe57⤵
- Executes dropped EXE
PID:816 -
\??\c:\jvjdv.exec:\jvjdv.exe58⤵
- Executes dropped EXE
PID:3004 -
\??\c:\rflfrlr.exec:\rflfrlr.exe59⤵
- Executes dropped EXE
PID:2188 -
\??\c:\lxlrfff.exec:\lxlrfff.exe60⤵
- Executes dropped EXE
PID:2336 -
\??\c:\7vvvd.exec:\7vvvd.exe61⤵
- Executes dropped EXE
PID:2784 -
\??\c:\vjvpj.exec:\vjvpj.exe62⤵
- Executes dropped EXE
PID:1032 -
\??\c:\nbnttt.exec:\nbnttt.exe63⤵
- Executes dropped EXE
PID:1548 -
\??\c:\7hnbbh.exec:\7hnbbh.exe64⤵
- Executes dropped EXE
PID:2588 -
\??\c:\jdddd.exec:\jdddd.exe65⤵
- Executes dropped EXE
PID:2052 -
\??\c:\fxfxrff.exec:\fxfxrff.exe66⤵PID:2672
-
\??\c:\xfrrxrr.exec:\xfrrxrr.exe67⤵PID:2980
-
\??\c:\xrxlrrf.exec:\xrxlrrf.exe68⤵PID:1960
-
\??\c:\btbnht.exec:\btbnht.exe69⤵PID:2456
-
\??\c:\dvjjj.exec:\dvjjj.exe70⤵PID:2564
-
\??\c:\dpvdp.exec:\dpvdp.exe71⤵PID:1988
-
\??\c:\lfflrxl.exec:\lfflrxl.exe72⤵PID:1608
-
\??\c:\nnnbhh.exec:\nnnbhh.exe73⤵PID:1880
-
\??\c:\7pdjj.exec:\7pdjj.exe74⤵PID:2332
-
\??\c:\lfflxfr.exec:\lfflxfr.exe75⤵PID:2492
-
\??\c:\1nhhbh.exec:\1nhhbh.exe76⤵PID:3012
-
\??\c:\vddpv.exec:\vddpv.exe77⤵PID:2888
-
\??\c:\5pjvj.exec:\5pjvj.exe78⤵PID:892
-
\??\c:\fffrffr.exec:\fffrffr.exe79⤵PID:2540
-
\??\c:\thtthh.exec:\thtthh.exe80⤵
- System Location Discovery: System Language Discovery
PID:3064 -
\??\c:\5nhtbb.exec:\5nhtbb.exe81⤵PID:2872
-
\??\c:\9dpvd.exec:\9dpvd.exe82⤵PID:2648
-
\??\c:\7lffflr.exec:\7lffflr.exe83⤵PID:2892
-
\??\c:\nbttth.exec:\nbttth.exe84⤵PID:2464
-
\??\c:\7vvvj.exec:\7vvvj.exe85⤵PID:768
-
\??\c:\5dppd.exec:\5dppd.exe86⤵PID:2320
-
\??\c:\fxfrflr.exec:\fxfrflr.exe87⤵PID:1292
-
\??\c:\nbhntt.exec:\nbhntt.exe88⤵PID:1780
-
\??\c:\hhbhtb.exec:\hhbhtb.exe89⤵PID:1744
-
\??\c:\1vddd.exec:\1vddd.exe90⤵PID:992
-
\??\c:\rrrlxfx.exec:\rrrlxfx.exe91⤵PID:1496
-
\??\c:\rlfflrf.exec:\rlfflrf.exe92⤵PID:900
-
\??\c:\htnttb.exec:\htnttb.exe93⤵PID:1148
-
\??\c:\3vdpv.exec:\3vdpv.exe94⤵PID:784
-
\??\c:\dvjjp.exec:\dvjjp.exe95⤵PID:2956
-
\??\c:\fxffrrl.exec:\fxffrrl.exe96⤵PID:2840
-
\??\c:\3tbttb.exec:\3tbttb.exe97⤵PID:2152
-
\??\c:\5nhnnt.exec:\5nhnnt.exe98⤵PID:2372
-
\??\c:\jddpj.exec:\jddpj.exe99⤵PID:2488
-
\??\c:\rlfrxfr.exec:\rlfrxfr.exe100⤵PID:2900
-
\??\c:\fxrrxfr.exec:\fxrrxfr.exe101⤵PID:2080
-
\??\c:\thbhhh.exec:\thbhhh.exe102⤵PID:3052
-
\??\c:\vvpdp.exec:\vvpdp.exe103⤵PID:688
-
\??\c:\pdppp.exec:\pdppp.exe104⤵PID:1032
-
\??\c:\lfrrffx.exec:\lfrrffx.exe105⤵PID:2104
-
\??\c:\fxxxllr.exec:\fxxxllr.exe106⤵PID:2940
-
\??\c:\5thbbh.exec:\5thbbh.exe107⤵PID:2052
-
\??\c:\jvddd.exec:\jvddd.exe108⤵PID:2040
-
\??\c:\jvvvd.exec:\jvvvd.exe109⤵PID:2980
-
\??\c:\7rxxffx.exec:\7rxxffx.exe110⤵PID:2512
-
\??\c:\bbnhhh.exec:\bbnhhh.exe111⤵PID:2528
-
\??\c:\tnbttt.exec:\tnbttt.exe112⤵PID:1080
-
\??\c:\pjvjp.exec:\pjvjp.exe113⤵PID:2468
-
\??\c:\xrllrrf.exec:\xrllrrf.exe114⤵PID:2172
-
\??\c:\9lllxfr.exec:\9lllxfr.exe115⤵PID:1300
-
\??\c:\nhthhh.exec:\nhthhh.exe116⤵PID:1864
-
\??\c:\3vdpj.exec:\3vdpj.exe117⤵PID:2532
-
\??\c:\xxxlflf.exec:\xxxlflf.exe118⤵PID:2476
-
\??\c:\frxlfrr.exec:\frxlfrr.exe119⤵PID:2880
-
\??\c:\nhbnth.exec:\nhbnth.exe120⤵PID:2736
-
\??\c:\nntbht.exec:\nntbht.exe121⤵PID:2912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-