Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 16:05
Static task
static1
Behavioral task
behavioral1
Sample
1a2a0dfc0ff30b979161b12e9852d490c51c92bdc92b75e7e78af58be9fe81d4.exe
Resource
win7-20240903-en
General
-
Target
1a2a0dfc0ff30b979161b12e9852d490c51c92bdc92b75e7e78af58be9fe81d4.exe
-
Size
454KB
-
MD5
878a3e07e54382b2059a998baaec2dd0
-
SHA1
4d549a873687338ab5bb59188e4d51009957535a
-
SHA256
1a2a0dfc0ff30b979161b12e9852d490c51c92bdc92b75e7e78af58be9fe81d4
-
SHA512
cc0bdac47dba100c1ac5f36c5aedf57cec07839a242dc8f49af3d4e6c07adbe0c212f2d7b2f3549856f7e476dd4164a9d81863edbfcf7c717ca76681defe12e6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbePY:q7Tc2NYHUrAwfMp3CDPY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2400-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/644-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-647-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2740-861-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-862-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-876-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2840-886-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-941-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2472-1030-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2124 bthnbn.exe 2772 9jvjv.exe 2844 rrrxffr.exe 2920 1ththt.exe 2652 vdvdj.exe 2572 fffrxxx.exe 2224 9tbnbb.exe 1128 9dppp.exe 2120 3thntb.exe 1780 fxlrrrf.exe 2104 btnnbh.exe 2116 llllflx.exe 2904 5hbhnb.exe 2636 1fllxxl.exe 3048 3hthtt.exe 1328 xxrfxfx.exe 484 ppjpd.exe 2440 llflrxr.exe 956 thnhnn.exe 2152 fxxxfrl.exe 832 9bbnbh.exe 2220 vvjdp.exe 1352 nhbbnt.exe 1732 7flllll.exe 1072 bnbbnh.exe 2276 pjvdv.exe 764 9htntt.exe 2040 ddpdj.exe 2960 frxfxfl.exe 2288 3bnntt.exe 2184 vjjpp.exe 2668 bbttbn.exe 2748 pvvjv.exe 2740 5xrlflf.exe 2672 1tnnbn.exe 2676 5vpvv.exe 2836 9djpv.exe 2760 fxxrxxl.exe 2596 hbhnbb.exe 1708 1pvpv.exe 3052 rrfrffr.exe 2224 rfrrflr.exe 2020 hhtbtb.exe 804 pjjvp.exe 2524 xflrfrl.exe 2420 9hhthn.exe 2580 dpvvv.exe 2788 jvvvd.exe 2924 fxfflrf.exe 2368 nhnhtt.exe 2880 nnbhnn.exe 2176 7pjdv.exe 2304 llflxlx.exe 636 btnhnn.exe 976 jdvvd.exe 2248 rlflflf.exe 2440 1lxffrr.exe 1320 nhbhtb.exe 1484 vjjdj.exe 896 lrlffrf.exe 772 3lxxffl.exe 824 bhbbhh.exe 1524 1jvvd.exe 644 9xrrrrx.exe -
resource yara_rule behavioral1/memory/2400-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/644-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-823-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-861-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-862-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-877-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-886-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-901-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-978-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-1030-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lllrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2124 2400 1a2a0dfc0ff30b979161b12e9852d490c51c92bdc92b75e7e78af58be9fe81d4.exe 30 PID 2400 wrote to memory of 2124 2400 1a2a0dfc0ff30b979161b12e9852d490c51c92bdc92b75e7e78af58be9fe81d4.exe 30 PID 2400 wrote to memory of 2124 2400 1a2a0dfc0ff30b979161b12e9852d490c51c92bdc92b75e7e78af58be9fe81d4.exe 30 PID 2400 wrote to memory of 2124 2400 1a2a0dfc0ff30b979161b12e9852d490c51c92bdc92b75e7e78af58be9fe81d4.exe 30 PID 2124 wrote to memory of 2772 2124 bthnbn.exe 31 PID 2124 wrote to memory of 2772 2124 bthnbn.exe 31 PID 2124 wrote to memory of 2772 2124 bthnbn.exe 31 PID 2124 wrote to memory of 2772 2124 bthnbn.exe 31 PID 2772 wrote to memory of 2844 2772 9jvjv.exe 32 PID 2772 wrote to memory of 2844 2772 9jvjv.exe 32 PID 2772 wrote to memory of 2844 2772 9jvjv.exe 32 PID 2772 wrote to memory of 2844 2772 9jvjv.exe 32 PID 2844 wrote to memory of 2920 2844 rrrxffr.exe 33 PID 2844 wrote to memory of 2920 2844 rrrxffr.exe 33 PID 2844 wrote to memory of 2920 2844 rrrxffr.exe 33 PID 2844 wrote to memory of 2920 2844 rrrxffr.exe 33 PID 2920 wrote to memory of 2652 2920 1ththt.exe 34 PID 2920 wrote to memory of 2652 2920 1ththt.exe 34 PID 2920 wrote to memory of 2652 2920 1ththt.exe 34 PID 2920 wrote to memory of 2652 2920 1ththt.exe 34 PID 2652 wrote to memory of 2572 2652 vdvdj.exe 35 PID 2652 wrote to memory of 2572 2652 vdvdj.exe 35 PID 2652 wrote to memory of 2572 2652 vdvdj.exe 35 PID 2652 wrote to memory of 2572 2652 vdvdj.exe 35 PID 2572 wrote to memory of 2224 2572 fffrxxx.exe 36 PID 2572 wrote to memory of 2224 2572 fffrxxx.exe 36 PID 2572 wrote to memory of 2224 2572 fffrxxx.exe 36 PID 2572 wrote to memory of 2224 2572 fffrxxx.exe 36 PID 2224 wrote to memory of 1128 2224 9tbnbb.exe 37 PID 2224 wrote to memory of 1128 2224 9tbnbb.exe 37 PID 2224 wrote to memory of 1128 2224 9tbnbb.exe 37 PID 2224 wrote to memory of 1128 2224 9tbnbb.exe 37 PID 1128 wrote to memory of 2120 1128 9dppp.exe 38 PID 1128 wrote to memory of 2120 1128 9dppp.exe 38 PID 1128 wrote to memory of 2120 1128 9dppp.exe 38 PID 1128 wrote to memory of 2120 1128 9dppp.exe 38 PID 2120 wrote to memory of 1780 2120 3thntb.exe 39 PID 2120 wrote to memory of 1780 2120 3thntb.exe 39 PID 2120 wrote to memory of 1780 2120 3thntb.exe 39 PID 2120 wrote to memory of 1780 2120 3thntb.exe 39 PID 1780 wrote to memory of 2104 1780 fxlrrrf.exe 40 PID 1780 wrote to memory of 2104 1780 fxlrrrf.exe 40 PID 1780 wrote to memory of 2104 1780 fxlrrrf.exe 40 PID 1780 wrote to memory of 2104 1780 fxlrrrf.exe 40 PID 2104 wrote to memory of 2116 2104 btnnbh.exe 41 PID 2104 wrote to memory of 2116 2104 btnnbh.exe 41 PID 2104 wrote to memory of 2116 2104 btnnbh.exe 41 PID 2104 wrote to memory of 2116 2104 btnnbh.exe 41 PID 2116 wrote to memory of 2904 2116 llllflx.exe 42 PID 2116 wrote to memory of 2904 2116 llllflx.exe 42 PID 2116 wrote to memory of 2904 2116 llllflx.exe 42 PID 2116 wrote to memory of 2904 2116 llllflx.exe 42 PID 2904 wrote to memory of 2636 2904 5hbhnb.exe 43 PID 2904 wrote to memory of 2636 2904 5hbhnb.exe 43 PID 2904 wrote to memory of 2636 2904 5hbhnb.exe 43 PID 2904 wrote to memory of 2636 2904 5hbhnb.exe 43 PID 2636 wrote to memory of 3048 2636 1fllxxl.exe 44 PID 2636 wrote to memory of 3048 2636 1fllxxl.exe 44 PID 2636 wrote to memory of 3048 2636 1fllxxl.exe 44 PID 2636 wrote to memory of 3048 2636 1fllxxl.exe 44 PID 3048 wrote to memory of 1328 3048 3hthtt.exe 45 PID 3048 wrote to memory of 1328 3048 3hthtt.exe 45 PID 3048 wrote to memory of 1328 3048 3hthtt.exe 45 PID 3048 wrote to memory of 1328 3048 3hthtt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a2a0dfc0ff30b979161b12e9852d490c51c92bdc92b75e7e78af58be9fe81d4.exe"C:\Users\Admin\AppData\Local\Temp\1a2a0dfc0ff30b979161b12e9852d490c51c92bdc92b75e7e78af58be9fe81d4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\bthnbn.exec:\bthnbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\9jvjv.exec:\9jvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\rrrxffr.exec:\rrrxffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\1ththt.exec:\1ththt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\vdvdj.exec:\vdvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\fffrxxx.exec:\fffrxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\9tbnbb.exec:\9tbnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\9dppp.exec:\9dppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\3thntb.exec:\3thntb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\fxlrrrf.exec:\fxlrrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\btnnbh.exec:\btnnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\llllflx.exec:\llllflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\5hbhnb.exec:\5hbhnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\1fllxxl.exec:\1fllxxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\3hthtt.exec:\3hthtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\xxrfxfx.exec:\xxrfxfx.exe17⤵
- Executes dropped EXE
PID:1328 -
\??\c:\ppjpd.exec:\ppjpd.exe18⤵
- Executes dropped EXE
PID:484 -
\??\c:\llflrxr.exec:\llflrxr.exe19⤵
- Executes dropped EXE
PID:2440 -
\??\c:\thnhnn.exec:\thnhnn.exe20⤵
- Executes dropped EXE
PID:956 -
\??\c:\fxxxfrl.exec:\fxxxfrl.exe21⤵
- Executes dropped EXE
PID:2152 -
\??\c:\9bbnbh.exec:\9bbnbh.exe22⤵
- Executes dropped EXE
PID:832 -
\??\c:\vvjdp.exec:\vvjdp.exe23⤵
- Executes dropped EXE
PID:2220 -
\??\c:\nhbbnt.exec:\nhbbnt.exe24⤵
- Executes dropped EXE
PID:1352 -
\??\c:\7flllll.exec:\7flllll.exe25⤵
- Executes dropped EXE
PID:1732 -
\??\c:\bnbbnh.exec:\bnbbnh.exe26⤵
- Executes dropped EXE
PID:1072 -
\??\c:\pjvdv.exec:\pjvdv.exe27⤵
- Executes dropped EXE
PID:2276 -
\??\c:\9htntt.exec:\9htntt.exe28⤵
- Executes dropped EXE
PID:764 -
\??\c:\ddpdj.exec:\ddpdj.exe29⤵
- Executes dropped EXE
PID:2040 -
\??\c:\frxfxfl.exec:\frxfxfl.exe30⤵
- Executes dropped EXE
PID:2960 -
\??\c:\3bnntt.exec:\3bnntt.exe31⤵
- Executes dropped EXE
PID:2288 -
\??\c:\vjjpp.exec:\vjjpp.exe32⤵
- Executes dropped EXE
PID:2184 -
\??\c:\bbttbn.exec:\bbttbn.exe33⤵
- Executes dropped EXE
PID:2668 -
\??\c:\pvvjv.exec:\pvvjv.exe34⤵
- Executes dropped EXE
PID:2748 -
\??\c:\5xrlflf.exec:\5xrlflf.exe35⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1tnnbn.exec:\1tnnbn.exe36⤵
- Executes dropped EXE
PID:2672 -
\??\c:\5vpvv.exec:\5vpvv.exe37⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9djpv.exec:\9djpv.exe38⤵
- Executes dropped EXE
PID:2836 -
\??\c:\fxxrxxl.exec:\fxxrxxl.exe39⤵
- Executes dropped EXE
PID:2760 -
\??\c:\hbhnbb.exec:\hbhnbb.exe40⤵
- Executes dropped EXE
PID:2596 -
\??\c:\1pvpv.exec:\1pvpv.exe41⤵
- Executes dropped EXE
PID:1708 -
\??\c:\rrfrffr.exec:\rrfrffr.exe42⤵
- Executes dropped EXE
PID:3052 -
\??\c:\rfrrflr.exec:\rfrrflr.exe43⤵
- Executes dropped EXE
PID:2224 -
\??\c:\hhtbtb.exec:\hhtbtb.exe44⤵
- Executes dropped EXE
PID:2020 -
\??\c:\pjjvp.exec:\pjjvp.exe45⤵
- Executes dropped EXE
PID:804 -
\??\c:\xflrfrl.exec:\xflrfrl.exe46⤵
- Executes dropped EXE
PID:2524 -
\??\c:\9hhthn.exec:\9hhthn.exe47⤵
- Executes dropped EXE
PID:2420 -
\??\c:\dpvvv.exec:\dpvvv.exe48⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jvvvd.exec:\jvvvd.exe49⤵
- Executes dropped EXE
PID:2788 -
\??\c:\fxfflrf.exec:\fxfflrf.exe50⤵
- Executes dropped EXE
PID:2924 -
\??\c:\nhnhtt.exec:\nhnhtt.exe51⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nnbhnn.exec:\nnbhnn.exe52⤵
- Executes dropped EXE
PID:2880 -
\??\c:\7pjdv.exec:\7pjdv.exe53⤵
- Executes dropped EXE
PID:2176 -
\??\c:\llflxlx.exec:\llflxlx.exe54⤵
- Executes dropped EXE
PID:2304 -
\??\c:\btnhnn.exec:\btnhnn.exe55⤵
- Executes dropped EXE
PID:636 -
\??\c:\jdvvd.exec:\jdvvd.exe56⤵
- Executes dropped EXE
PID:976 -
\??\c:\rlflflf.exec:\rlflflf.exe57⤵
- Executes dropped EXE
PID:2248 -
\??\c:\1lxffrr.exec:\1lxffrr.exe58⤵
- Executes dropped EXE
PID:2440 -
\??\c:\nhbhtb.exec:\nhbhtb.exe59⤵
- Executes dropped EXE
PID:1320 -
\??\c:\vjjdj.exec:\vjjdj.exe60⤵
- Executes dropped EXE
PID:1484 -
\??\c:\lrlffrf.exec:\lrlffrf.exe61⤵
- Executes dropped EXE
PID:896 -
\??\c:\3lxxffl.exec:\3lxxffl.exe62⤵
- Executes dropped EXE
PID:772 -
\??\c:\bhbbhh.exec:\bhbbhh.exe63⤵
- Executes dropped EXE
PID:824 -
\??\c:\1jvvd.exec:\1jvvd.exe64⤵
- Executes dropped EXE
PID:1524 -
\??\c:\9xrrrrx.exec:\9xrrrrx.exe65⤵
- Executes dropped EXE
PID:644 -
\??\c:\3rxlxxf.exec:\3rxlxxf.exe66⤵PID:1732
-
\??\c:\bthhhh.exec:\bthhhh.exe67⤵PID:1156
-
\??\c:\vdvvv.exec:\vdvvv.exe68⤵PID:1952
-
\??\c:\5rxfffl.exec:\5rxfffl.exe69⤵PID:372
-
\??\c:\bbthtb.exec:\bbthtb.exe70⤵PID:1620
-
\??\c:\vvvpp.exec:\vvvpp.exe71⤵PID:768
-
\??\c:\vvpjv.exec:\vvpjv.exe72⤵PID:1740
-
\??\c:\xfxfrfl.exec:\xfxfrfl.exe73⤵PID:2620
-
\??\c:\hbtbtb.exec:\hbtbtb.exe74⤵PID:1900
-
\??\c:\nhnhnn.exec:\nhnhnn.exe75⤵PID:2124
-
\??\c:\vvjdp.exec:\vvjdp.exe76⤵PID:1572
-
\??\c:\7xrfxxl.exec:\7xrfxxl.exe77⤵PID:2748
-
\??\c:\tthnhn.exec:\tthnhn.exe78⤵PID:2784
-
\??\c:\jdddp.exec:\jdddp.exe79⤵PID:2564
-
\??\c:\jdvdj.exec:\jdvdj.exe80⤵PID:2704
-
\??\c:\xxrxffr.exec:\xxrxffr.exe81⤵PID:2768
-
\??\c:\1hhhnt.exec:\1hhhnt.exe82⤵PID:2712
-
\??\c:\9vjdj.exec:\9vjdj.exe83⤵PID:1664
-
\??\c:\dvdjp.exec:\dvdjp.exe84⤵PID:2572
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe85⤵PID:3056
-
\??\c:\bbbbtb.exec:\bbbbtb.exe86⤵
- System Location Discovery: System Language Discovery
PID:2084 -
\??\c:\pppvj.exec:\pppvj.exe87⤵PID:1772
-
\??\c:\ffllxfx.exec:\ffllxfx.exe88⤵PID:2908
-
\??\c:\1hnntt.exec:\1hnntt.exe89⤵PID:672
-
\??\c:\djvvj.exec:\djvvj.exe90⤵PID:2992
-
\??\c:\1vvdj.exec:\1vvdj.exe91⤵PID:3028
-
\??\c:\xxlxxfl.exec:\xxlxxfl.exe92⤵PID:2916
-
\??\c:\nbnnnt.exec:\nbnnnt.exe93⤵PID:2872
-
\??\c:\jpjpp.exec:\jpjpp.exe94⤵PID:2828
-
\??\c:\rlxrffr.exec:\rlxrffr.exe95⤵PID:2128
-
\??\c:\rfrlxrx.exec:\rfrlxrx.exe96⤵PID:2408
-
\??\c:\7bnthn.exec:\7bnthn.exe97⤵PID:2600
-
\??\c:\vdvdp.exec:\vdvdp.exe98⤵PID:2348
-
\??\c:\rrlrflx.exec:\rrlrflx.exe99⤵PID:1696
-
\??\c:\3hhbnt.exec:\3hhbnt.exe100⤵PID:1280
-
\??\c:\tttbth.exec:\tttbth.exe101⤵PID:676
-
\??\c:\dvpvv.exec:\dvpvv.exe102⤵PID:2456
-
\??\c:\lllfffr.exec:\lllfffr.exe103⤵PID:828
-
\??\c:\fxxfflx.exec:\fxxfflx.exe104⤵PID:2432
-
\??\c:\thbntb.exec:\thbntb.exe105⤵PID:1100
-
\??\c:\djdpv.exec:\djdpv.exe106⤵
- System Location Discovery: System Language Discovery
PID:2220 -
\??\c:\fxlfllx.exec:\fxlfllx.exe107⤵PID:2452
-
\??\c:\lfrlflf.exec:\lfrlflf.exe108⤵PID:580
-
\??\c:\hbbtbt.exec:\hbbtbt.exe109⤵PID:2516
-
\??\c:\dddpd.exec:\dddpd.exe110⤵PID:2028
-
\??\c:\9xffxfr.exec:\9xffxfr.exe111⤵PID:1076
-
\??\c:\llfrrlx.exec:\llfrrlx.exe112⤵PID:1808
-
\??\c:\1nbbbh.exec:\1nbbbh.exe113⤵PID:2040
-
\??\c:\xrlrlxf.exec:\xrlrlxf.exe114⤵PID:2496
-
\??\c:\tthntt.exec:\tthntt.exe115⤵PID:1784
-
\??\c:\nhbbnn.exec:\nhbbnn.exe116⤵PID:2180
-
\??\c:\vvppv.exec:\vvppv.exe117⤵PID:2736
-
\??\c:\9lfrlrf.exec:\9lfrlrf.exe118⤵PID:1692
-
\??\c:\9bhnnn.exec:\9bhnnn.exe119⤵PID:2696
-
\??\c:\5ntbhh.exec:\5ntbhh.exe120⤵PID:2740
-
\??\c:\djjdp.exec:\djjdp.exe121⤵PID:2672
-
\??\c:\lllrlrr.exec:\lllrlrr.exe122⤵PID:2564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-