Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 16:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3aN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3aN.exe
-
Size
455KB
-
MD5
fde5e265ba6cdbb0270cbaddc3993a10
-
SHA1
f4d328bb4f667389b248f6e2509c04e153e2e87e
-
SHA256
ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3a
-
SHA512
055f22c437be2c63ae28d3bd567ca4801d2e537e9c827627d0f5003c3b21c8546abcd6e0e4b065914e5b5acc869e91e5006f2e7a70c948b40fc97221f52bd814
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/1204-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-31-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2200-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-92-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2620-90-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2700-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1440-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-129-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2344-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-161-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1800-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-267-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1548-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-293-0x0000000077230000-0x000000007734F000-memory.dmp family_blackmoon behavioral1/memory/2124-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-566-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1524-579-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1932-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-631-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2668-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-658-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2832-689-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1072-764-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/928-772-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2516 ppjjp.exe 2304 xfxxlrx.exe 2284 nbbnht.exe 2200 xxxfrxr.exe 2872 bbbthh.exe 2768 ffxfrrf.exe 2836 httttt.exe 2976 pjdpj.exe 2620 llxxxfl.exe 2700 hnhntb.exe 1916 rlfrffx.exe 1440 hbnttt.exe 2984 1lflrxl.exe 2940 1xlllrf.exe 2992 rfrlrlx.exe 2344 vppvd.exe 1800 fxrxfll.exe 1696 jdpdj.exe 2128 fxrlxff.exe 1788 pjvvd.exe 2412 5rfflrx.exe 1452 thtbhb.exe 2580 lfxfllr.exe 316 jdvvp.exe 1736 5rlrxxf.exe 2528 5pdjp.exe 1536 rlfrflf.exe 1548 tnbbhn.exe 2140 dddvj.exe 2544 pjvdv.exe 2124 fxllrxl.exe 2304 nbbhnn.exe 1992 vjdjp.exe 2716 dvjpv.exe 2268 rlflxfr.exe 2840 nhbnht.exe 2768 dpvvd.exe 2644 ddvjp.exe 2788 fxlflfr.exe 2820 bnbbnt.exe 2624 vpdpp.exe 1448 3dvdj.exe 2468 fxlrflr.exe 2972 5htntb.exe 308 bnbhnn.exe 692 djpjd.exe 2832 lxllrrf.exe 2916 bbtbnb.exe 2992 ttnbtt.exe 2248 pdppp.exe 1580 xxrxxlx.exe 2220 rfrlllx.exe 1568 hbthhn.exe 236 vpjpd.exe 2428 xrxrxrr.exe 1112 rrlxllx.exe 2276 nnnhnn.exe 2244 1jppp.exe 896 1pvvv.exe 2360 5rrxrrr.exe 1876 7nttth.exe 2576 7tbthh.exe 976 3dppj.exe 872 dvjpv.exe -
resource yara_rule behavioral1/memory/1204-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-579-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1932-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/928-772-0x0000000000330000-0x000000000035A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxlxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1204 wrote to memory of 2516 1204 ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3aN.exe 31 PID 1204 wrote to memory of 2516 1204 ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3aN.exe 31 PID 1204 wrote to memory of 2516 1204 ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3aN.exe 31 PID 1204 wrote to memory of 2516 1204 ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3aN.exe 31 PID 2516 wrote to memory of 2304 2516 ppjjp.exe 32 PID 2516 wrote to memory of 2304 2516 ppjjp.exe 32 PID 2516 wrote to memory of 2304 2516 ppjjp.exe 32 PID 2516 wrote to memory of 2304 2516 ppjjp.exe 32 PID 2304 wrote to memory of 2284 2304 xfxxlrx.exe 33 PID 2304 wrote to memory of 2284 2304 xfxxlrx.exe 33 PID 2304 wrote to memory of 2284 2304 xfxxlrx.exe 33 PID 2304 wrote to memory of 2284 2304 xfxxlrx.exe 33 PID 2284 wrote to memory of 2200 2284 nbbnht.exe 34 PID 2284 wrote to memory of 2200 2284 nbbnht.exe 34 PID 2284 wrote to memory of 2200 2284 nbbnht.exe 34 PID 2284 wrote to memory of 2200 2284 nbbnht.exe 34 PID 2200 wrote to memory of 2872 2200 xxxfrxr.exe 35 PID 2200 wrote to memory of 2872 2200 xxxfrxr.exe 35 PID 2200 wrote to memory of 2872 2200 xxxfrxr.exe 35 PID 2200 wrote to memory of 2872 2200 xxxfrxr.exe 35 PID 2872 wrote to memory of 2768 2872 bbbthh.exe 36 PID 2872 wrote to memory of 2768 2872 bbbthh.exe 36 PID 2872 wrote to memory of 2768 2872 bbbthh.exe 36 PID 2872 wrote to memory of 2768 2872 bbbthh.exe 36 PID 2768 wrote to memory of 2836 2768 ffxfrrf.exe 37 PID 2768 wrote to memory of 2836 2768 ffxfrrf.exe 37 PID 2768 wrote to memory of 2836 2768 ffxfrrf.exe 37 PID 2768 wrote to memory of 2836 2768 ffxfrrf.exe 37 PID 2836 wrote to memory of 2976 2836 httttt.exe 38 PID 2836 wrote to memory of 2976 2836 httttt.exe 38 PID 2836 wrote to memory of 2976 2836 httttt.exe 38 PID 2836 wrote to memory of 2976 2836 httttt.exe 38 PID 2976 wrote to memory of 2620 2976 pjdpj.exe 39 PID 2976 wrote to memory of 2620 2976 pjdpj.exe 39 PID 2976 wrote to memory of 2620 2976 pjdpj.exe 39 PID 2976 wrote to memory of 2620 2976 pjdpj.exe 39 PID 2620 wrote to memory of 2700 2620 llxxxfl.exe 40 PID 2620 wrote to memory of 2700 2620 llxxxfl.exe 40 PID 2620 wrote to memory of 2700 2620 llxxxfl.exe 40 PID 2620 wrote to memory of 2700 2620 llxxxfl.exe 40 PID 2700 wrote to memory of 1916 2700 hnhntb.exe 41 PID 2700 wrote to memory of 1916 2700 hnhntb.exe 41 PID 2700 wrote to memory of 1916 2700 hnhntb.exe 41 PID 2700 wrote to memory of 1916 2700 hnhntb.exe 41 PID 1916 wrote to memory of 1440 1916 rlfrffx.exe 42 PID 1916 wrote to memory of 1440 1916 rlfrffx.exe 42 PID 1916 wrote to memory of 1440 1916 rlfrffx.exe 42 PID 1916 wrote to memory of 1440 1916 rlfrffx.exe 42 PID 1440 wrote to memory of 2984 1440 hbnttt.exe 43 PID 1440 wrote to memory of 2984 1440 hbnttt.exe 43 PID 1440 wrote to memory of 2984 1440 hbnttt.exe 43 PID 1440 wrote to memory of 2984 1440 hbnttt.exe 43 PID 2984 wrote to memory of 2940 2984 1lflrxl.exe 44 PID 2984 wrote to memory of 2940 2984 1lflrxl.exe 44 PID 2984 wrote to memory of 2940 2984 1lflrxl.exe 44 PID 2984 wrote to memory of 2940 2984 1lflrxl.exe 44 PID 2940 wrote to memory of 2992 2940 1xlllrf.exe 45 PID 2940 wrote to memory of 2992 2940 1xlllrf.exe 45 PID 2940 wrote to memory of 2992 2940 1xlllrf.exe 45 PID 2940 wrote to memory of 2992 2940 1xlllrf.exe 45 PID 2992 wrote to memory of 2344 2992 rfrlrlx.exe 46 PID 2992 wrote to memory of 2344 2992 rfrlrlx.exe 46 PID 2992 wrote to memory of 2344 2992 rfrlrlx.exe 46 PID 2992 wrote to memory of 2344 2992 rfrlrlx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3aN.exe"C:\Users\Admin\AppData\Local\Temp\ebf18c1982c1ceec0f808a2e8a8b1fc11970a2483e2c92dc121d38292141ab3aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\ppjjp.exec:\ppjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\xfxxlrx.exec:\xfxxlrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\nbbnht.exec:\nbbnht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\xxxfrxr.exec:\xxxfrxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\bbbthh.exec:\bbbthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\ffxfrrf.exec:\ffxfrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\httttt.exec:\httttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\pjdpj.exec:\pjdpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\llxxxfl.exec:\llxxxfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\hnhntb.exec:\hnhntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\rlfrffx.exec:\rlfrffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\hbnttt.exec:\hbnttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\1lflrxl.exec:\1lflrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\1xlllrf.exec:\1xlllrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\rfrlrlx.exec:\rfrlrlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\vppvd.exec:\vppvd.exe17⤵
- Executes dropped EXE
PID:2344 -
\??\c:\fxrxfll.exec:\fxrxfll.exe18⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jdpdj.exec:\jdpdj.exe19⤵
- Executes dropped EXE
PID:1696 -
\??\c:\fxrlxff.exec:\fxrlxff.exe20⤵
- Executes dropped EXE
PID:2128 -
\??\c:\pjvvd.exec:\pjvvd.exe21⤵
- Executes dropped EXE
PID:1788 -
\??\c:\5rfflrx.exec:\5rfflrx.exe22⤵
- Executes dropped EXE
PID:2412 -
\??\c:\thtbhb.exec:\thtbhb.exe23⤵
- Executes dropped EXE
PID:1452 -
\??\c:\lfxfllr.exec:\lfxfllr.exe24⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jdvvp.exec:\jdvvp.exe25⤵
- Executes dropped EXE
PID:316 -
\??\c:\5rlrxxf.exec:\5rlrxxf.exe26⤵
- Executes dropped EXE
PID:1736 -
\??\c:\5pdjp.exec:\5pdjp.exe27⤵
- Executes dropped EXE
PID:2528 -
\??\c:\rlfrflf.exec:\rlfrflf.exe28⤵
- Executes dropped EXE
PID:1536 -
\??\c:\tnbbhn.exec:\tnbbhn.exe29⤵
- Executes dropped EXE
PID:1548 -
\??\c:\dddvj.exec:\dddvj.exe30⤵
- Executes dropped EXE
PID:2140 -
\??\c:\pjvdv.exec:\pjvdv.exe31⤵
- Executes dropped EXE
PID:2544 -
\??\c:\fxllrxl.exec:\fxllrxl.exe32⤵
- Executes dropped EXE
PID:2124 -
\??\c:\5httbn.exec:\5httbn.exe33⤵PID:2312
-
\??\c:\nbbhnn.exec:\nbbhnn.exe34⤵
- Executes dropped EXE
PID:2304 -
\??\c:\vjdjp.exec:\vjdjp.exe35⤵
- Executes dropped EXE
PID:1992 -
\??\c:\dvjpv.exec:\dvjpv.exe36⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rlflxfr.exec:\rlflxfr.exe37⤵
- Executes dropped EXE
PID:2268 -
\??\c:\nhbnht.exec:\nhbnht.exe38⤵
- Executes dropped EXE
PID:2840 -
\??\c:\dpvvd.exec:\dpvvd.exe39⤵
- Executes dropped EXE
PID:2768 -
\??\c:\ddvjp.exec:\ddvjp.exe40⤵
- Executes dropped EXE
PID:2644 -
\??\c:\fxlflfr.exec:\fxlflfr.exe41⤵
- Executes dropped EXE
PID:2788 -
\??\c:\bnbbnt.exec:\bnbbnt.exe42⤵
- Executes dropped EXE
PID:2820 -
\??\c:\vpdpp.exec:\vpdpp.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3dvdj.exec:\3dvdj.exe44⤵
- Executes dropped EXE
PID:1448 -
\??\c:\fxlrflr.exec:\fxlrflr.exe45⤵
- Executes dropped EXE
PID:2468 -
\??\c:\5htntb.exec:\5htntb.exe46⤵
- Executes dropped EXE
PID:2972 -
\??\c:\bnbhnn.exec:\bnbhnn.exe47⤵
- Executes dropped EXE
PID:308 -
\??\c:\djpjd.exec:\djpjd.exe48⤵
- Executes dropped EXE
PID:692 -
\??\c:\lxllrrf.exec:\lxllrrf.exe49⤵
- Executes dropped EXE
PID:2832 -
\??\c:\bbtbnb.exec:\bbtbnb.exe50⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ttnbtt.exec:\ttnbtt.exe51⤵
- Executes dropped EXE
PID:2992 -
\??\c:\pdppp.exec:\pdppp.exe52⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xxrxxlx.exec:\xxrxxlx.exe53⤵
- Executes dropped EXE
PID:1580 -
\??\c:\rfrlllx.exec:\rfrlllx.exe54⤵
- Executes dropped EXE
PID:2220 -
\??\c:\hbthhn.exec:\hbthhn.exe55⤵
- Executes dropped EXE
PID:1568 -
\??\c:\vpjpd.exec:\vpjpd.exe56⤵
- Executes dropped EXE
PID:236 -
\??\c:\xrxrxrr.exec:\xrxrxrr.exe57⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rrlxllx.exec:\rrlxllx.exe58⤵
- Executes dropped EXE
PID:1112 -
\??\c:\nnnhnn.exec:\nnnhnn.exe59⤵
- Executes dropped EXE
PID:2276 -
\??\c:\1jppp.exec:\1jppp.exe60⤵
- Executes dropped EXE
PID:2244 -
\??\c:\1pvvv.exec:\1pvvv.exe61⤵
- Executes dropped EXE
PID:896 -
\??\c:\5rrxrrr.exec:\5rrxrrr.exe62⤵
- Executes dropped EXE
PID:2360 -
\??\c:\7nttth.exec:\7nttth.exe63⤵
- Executes dropped EXE
PID:1876 -
\??\c:\7tbthh.exec:\7tbthh.exe64⤵
- Executes dropped EXE
PID:2576 -
\??\c:\3dppj.exec:\3dppj.exe65⤵
- Executes dropped EXE
PID:976 -
\??\c:\dvjpv.exec:\dvjpv.exe66⤵
- Executes dropped EXE
PID:872 -
\??\c:\fxffllr.exec:\fxffllr.exe67⤵PID:1432
-
\??\c:\tttbbb.exec:\tttbbb.exe68⤵PID:980
-
\??\c:\bbtbnt.exec:\bbtbnt.exe69⤵PID:1588
-
\??\c:\pjppj.exec:\pjppj.exe70⤵PID:2316
-
\??\c:\lffxffl.exec:\lffxffl.exe71⤵
- System Location Discovery: System Language Discovery
PID:2452 -
\??\c:\lxflfff.exec:\lxflfff.exe72⤵PID:2448
-
\??\c:\1nhthn.exec:\1nhthn.exe73⤵PID:1524
-
\??\c:\dpjpv.exec:\dpjpv.exe74⤵PID:1668
-
\??\c:\5ffflll.exec:\5ffflll.exe75⤵PID:2540
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe76⤵PID:2924
-
\??\c:\hthbhh.exec:\hthbhh.exe77⤵PID:2104
-
\??\c:\vpvdp.exec:\vpvdp.exe78⤵PID:2756
-
\??\c:\1jvvv.exec:\1jvvv.exe79⤵PID:2784
-
\??\c:\xxflrlr.exec:\xxflrlr.exe80⤵PID:1932
-
\??\c:\5thhnt.exec:\5thhnt.exe81⤵PID:3028
-
\??\c:\5htnbb.exec:\5htnbb.exe82⤵PID:2668
-
\??\c:\ddvdj.exec:\ddvdj.exe83⤵PID:2664
-
\??\c:\1frlfll.exec:\1frlfll.exe84⤵PID:1752
-
\??\c:\3lfxxrx.exec:\3lfxxrx.exe85⤵PID:1404
-
\??\c:\btthbh.exec:\btthbh.exe86⤵PID:1440
-
\??\c:\nnbbhh.exec:\nnbbhh.exe87⤵PID:1880
-
\??\c:\pdppd.exec:\pdppd.exe88⤵PID:2320
-
\??\c:\rlflrrl.exec:\rlflrrl.exe89⤵PID:2988
-
\??\c:\fxxxllx.exec:\fxxxllx.exe90⤵PID:2832
-
\??\c:\1ntttt.exec:\1ntttt.exe91⤵PID:2712
-
\??\c:\pvvvd.exec:\pvvvd.exe92⤵PID:1856
-
\??\c:\vjpvj.exec:\vjpvj.exe93⤵PID:1308
-
\??\c:\xxxfllx.exec:\xxxfllx.exe94⤵PID:2388
-
\??\c:\hhbbnt.exec:\hhbbnt.exe95⤵PID:1360
-
\??\c:\pvjdp.exec:\pvjdp.exe96⤵PID:1416
-
\??\c:\5vjdj.exec:\5vjdj.exe97⤵PID:2404
-
\??\c:\rfrxrxr.exec:\rfrxrxr.exe98⤵PID:2176
-
\??\c:\9tnthh.exec:\9tnthh.exe99⤵PID:2092
-
\??\c:\btnnbb.exec:\btnnbb.exe100⤵PID:2064
-
\??\c:\3vjjj.exec:\3vjjj.exe101⤵PID:2276
-
\??\c:\xrrrffr.exec:\xrrrffr.exe102⤵PID:1072
-
\??\c:\lfrrxrf.exec:\lfrrxrf.exe103⤵PID:928
-
\??\c:\nhbhnb.exec:\nhbhnb.exe104⤵PID:948
-
\??\c:\jddpd.exec:\jddpd.exe105⤵PID:1876
-
\??\c:\ppppv.exec:\ppppv.exe106⤵PID:2576
-
\??\c:\frffffl.exec:\frffffl.exe107⤵PID:1652
-
\??\c:\1htbhn.exec:\1htbhn.exe108⤵PID:536
-
\??\c:\tbnntn.exec:\tbnntn.exe109⤵PID:1432
-
\??\c:\3pjdd.exec:\3pjdd.exe110⤵PID:1548
-
\??\c:\rlflrrf.exec:\rlflrrf.exe111⤵PID:1588
-
\??\c:\5rlllrx.exec:\5rlllrx.exe112⤵PID:2316
-
\??\c:\bnthhh.exec:\bnthhh.exe113⤵PID:2492
-
\??\c:\pdjdj.exec:\pdjdj.exe114⤵PID:2500
-
\??\c:\pjvdj.exec:\pjvdj.exe115⤵PID:2772
-
\??\c:\xlrxxll.exec:\xlrxxll.exe116⤵PID:2856
-
\??\c:\htntbb.exec:\htntbb.exe117⤵PID:2728
-
\??\c:\5pjjv.exec:\5pjjv.exe118⤵PID:2828
-
\??\c:\5jppp.exec:\5jppp.exe119⤵PID:2740
-
\??\c:\7llrrxf.exec:\7llrrxf.exe120⤵PID:2308
-
\??\c:\7bttht.exec:\7bttht.exe121⤵PID:2644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-