Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/12/2024, 17:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
502c9ddf90c94ebf4f36659ddafaff6de3fb72cb819cfe512a70c1e87720f3cfN.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
502c9ddf90c94ebf4f36659ddafaff6de3fb72cb819cfe512a70c1e87720f3cfN.exe
-
Size
454KB
-
MD5
657a8a5f91bb9333103592907a117eb0
-
SHA1
bedd052792e3e516363e05922c9c0f3c4cc7818e
-
SHA256
502c9ddf90c94ebf4f36659ddafaff6de3fb72cb819cfe512a70c1e87720f3cf
-
SHA512
ad9ec23d0d6db306833a9672862f8f8d6587784941ef3d5a880f7607c506bb0ea01a8c8039361b1603fd20e51dd8880d8a7aeb8f2d52fd137d7307d754935350
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTj:q7Tc2NYHUrAwfMp3CDP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/528-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-98-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1904-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-171-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/264-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/528-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/636-403-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/1700-410-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1696-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1292-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-444-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/532-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-463-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2540-465-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2168-473-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1572-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-576-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2704-635-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2420-691-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-699-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3040-706-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2884-732-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2520-733-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/536-746-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/976-772-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2100-801-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2100-800-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-824-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3024 1djjj.exe 2180 3nttnh.exe 2968 ffflrrf.exe 2220 tbntbt.exe 3020 xfrxflf.exe 2920 llffrfl.exe 2756 pvjjp.exe 776 thbbnb.exe 2748 9jpvd.exe 1904 rlrlxfr.exe 1200 vjpjv.exe 1996 rrffffl.exe 1696 9pjdj.exe 2064 llxxffl.exe 2256 ddppv.exe 3056 5djvd.exe 2260 7nbbbt.exe 2900 rrrfrrx.exe 264 hhttbh.exe 2408 fxfffxf.exe 2140 7pddp.exe 2316 dddvd.exe 2380 dvdjj.exe 1628 vdppv.exe 2580 1vppv.exe 2376 jdvdd.exe 1884 xxflxfl.exe 1552 vpvpv.exe 2052 ddvpv.exe 1148 7xlrrff.exe 1088 hhtbbt.exe 528 jpppd.exe 2536 hbhbhh.exe 1672 jdppv.exe 2952 lllllfx.exe 2992 hhhntt.exe 2044 7vvjd.exe 3008 pjddp.exe 1976 3lrxxfr.exe 2876 hhnhhn.exe 2700 ppvvp.exe 2780 5jpvd.exe 2172 ffflrrf.exe 1352 btttbb.exe 1700 djvvj.exe 444 5frrfrx.exe 636 7hbntt.exe 1996 3djjj.exe 1696 vvvpv.exe 2280 ffrxlrx.exe 2256 3bhnnt.exe 1292 1jddp.exe 2540 flxffxl.exe 2260 fxffxxf.exe 532 htntbb.exe 1652 jdjdj.exe 2168 rrxxxxf.exe 2148 nnbbnn.exe 2356 pdvvj.exe 2336 vppvd.exe 896 5fxxxrr.exe 1480 thbnbh.exe 1484 7ppvd.exe 2444 rflllxf.exe -
resource yara_rule behavioral1/memory/528-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/528-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/636-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-418-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1696-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-473-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1572-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-576-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2420-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-732-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/536-746-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1648-787-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2516-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-800-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-809-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-824-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rlrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rllxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhnn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 528 wrote to memory of 3024 528 502c9ddf90c94ebf4f36659ddafaff6de3fb72cb819cfe512a70c1e87720f3cfN.exe 30 PID 528 wrote to memory of 3024 528 502c9ddf90c94ebf4f36659ddafaff6de3fb72cb819cfe512a70c1e87720f3cfN.exe 30 PID 528 wrote to memory of 3024 528 502c9ddf90c94ebf4f36659ddafaff6de3fb72cb819cfe512a70c1e87720f3cfN.exe 30 PID 528 wrote to memory of 3024 528 502c9ddf90c94ebf4f36659ddafaff6de3fb72cb819cfe512a70c1e87720f3cfN.exe 30 PID 3024 wrote to memory of 2180 3024 1djjj.exe 31 PID 3024 wrote to memory of 2180 3024 1djjj.exe 31 PID 3024 wrote to memory of 2180 3024 1djjj.exe 31 PID 3024 wrote to memory of 2180 3024 1djjj.exe 31 PID 2180 wrote to memory of 2968 2180 3nttnh.exe 32 PID 2180 wrote to memory of 2968 2180 3nttnh.exe 32 PID 2180 wrote to memory of 2968 2180 3nttnh.exe 32 PID 2180 wrote to memory of 2968 2180 3nttnh.exe 32 PID 2968 wrote to memory of 2220 2968 ffflrrf.exe 33 PID 2968 wrote to memory of 2220 2968 ffflrrf.exe 33 PID 2968 wrote to memory of 2220 2968 ffflrrf.exe 33 PID 2968 wrote to memory of 2220 2968 ffflrrf.exe 33 PID 2220 wrote to memory of 3020 2220 tbntbt.exe 34 PID 2220 wrote to memory of 3020 2220 tbntbt.exe 34 PID 2220 wrote to memory of 3020 2220 tbntbt.exe 34 PID 2220 wrote to memory of 3020 2220 tbntbt.exe 34 PID 3020 wrote to memory of 2920 3020 xfrxflf.exe 35 PID 3020 wrote to memory of 2920 3020 xfrxflf.exe 35 PID 3020 wrote to memory of 2920 3020 xfrxflf.exe 35 PID 3020 wrote to memory of 2920 3020 xfrxflf.exe 35 PID 2920 wrote to memory of 2756 2920 llffrfl.exe 36 PID 2920 wrote to memory of 2756 2920 llffrfl.exe 36 PID 2920 wrote to memory of 2756 2920 llffrfl.exe 36 PID 2920 wrote to memory of 2756 2920 llffrfl.exe 36 PID 2756 wrote to memory of 776 2756 pvjjp.exe 37 PID 2756 wrote to memory of 776 2756 pvjjp.exe 37 PID 2756 wrote to memory of 776 2756 pvjjp.exe 37 PID 2756 wrote to memory of 776 2756 pvjjp.exe 37 PID 776 wrote to memory of 2748 776 thbbnb.exe 38 PID 776 wrote to memory of 2748 776 thbbnb.exe 38 PID 776 wrote to memory of 2748 776 thbbnb.exe 38 PID 776 wrote to memory of 2748 776 thbbnb.exe 38 PID 2748 wrote to memory of 1904 2748 9jpvd.exe 39 PID 2748 wrote to memory of 1904 2748 9jpvd.exe 39 PID 2748 wrote to memory of 1904 2748 9jpvd.exe 39 PID 2748 wrote to memory of 1904 2748 9jpvd.exe 39 PID 1904 wrote to memory of 1200 1904 rlrlxfr.exe 40 PID 1904 wrote to memory of 1200 1904 rlrlxfr.exe 40 PID 1904 wrote to memory of 1200 1904 rlrlxfr.exe 40 PID 1904 wrote to memory of 1200 1904 rlrlxfr.exe 40 PID 1200 wrote to memory of 1996 1200 vjpjv.exe 41 PID 1200 wrote to memory of 1996 1200 vjpjv.exe 41 PID 1200 wrote to memory of 1996 1200 vjpjv.exe 41 PID 1200 wrote to memory of 1996 1200 vjpjv.exe 41 PID 1996 wrote to memory of 1696 1996 rrffffl.exe 42 PID 1996 wrote to memory of 1696 1996 rrffffl.exe 42 PID 1996 wrote to memory of 1696 1996 rrffffl.exe 42 PID 1996 wrote to memory of 1696 1996 rrffffl.exe 42 PID 1696 wrote to memory of 2064 1696 9pjdj.exe 43 PID 1696 wrote to memory of 2064 1696 9pjdj.exe 43 PID 1696 wrote to memory of 2064 1696 9pjdj.exe 43 PID 1696 wrote to memory of 2064 1696 9pjdj.exe 43 PID 2064 wrote to memory of 2256 2064 llxxffl.exe 44 PID 2064 wrote to memory of 2256 2064 llxxffl.exe 44 PID 2064 wrote to memory of 2256 2064 llxxffl.exe 44 PID 2064 wrote to memory of 2256 2064 llxxffl.exe 44 PID 2256 wrote to memory of 3056 2256 ddppv.exe 45 PID 2256 wrote to memory of 3056 2256 ddppv.exe 45 PID 2256 wrote to memory of 3056 2256 ddppv.exe 45 PID 2256 wrote to memory of 3056 2256 ddppv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\502c9ddf90c94ebf4f36659ddafaff6de3fb72cb819cfe512a70c1e87720f3cfN.exe"C:\Users\Admin\AppData\Local\Temp\502c9ddf90c94ebf4f36659ddafaff6de3fb72cb819cfe512a70c1e87720f3cfN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\1djjj.exec:\1djjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\3nttnh.exec:\3nttnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\ffflrrf.exec:\ffflrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\tbntbt.exec:\tbntbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\xfrxflf.exec:\xfrxflf.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\llffrfl.exec:\llffrfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\pvjjp.exec:\pvjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\thbbnb.exec:\thbbnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\9jpvd.exec:\9jpvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\rlrlxfr.exec:\rlrlxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\vjpjv.exec:\vjpjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\rrffffl.exec:\rrffffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\9pjdj.exec:\9pjdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\llxxffl.exec:\llxxffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\ddppv.exec:\ddppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\5djvd.exec:\5djvd.exe17⤵
- Executes dropped EXE
PID:3056 -
\??\c:\7nbbbt.exec:\7nbbbt.exe18⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rrrfrrx.exec:\rrrfrrx.exe19⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hhttbh.exec:\hhttbh.exe20⤵
- Executes dropped EXE
PID:264 -
\??\c:\fxfffxf.exec:\fxfffxf.exe21⤵
- Executes dropped EXE
PID:2408 -
\??\c:\7pddp.exec:\7pddp.exe22⤵
- Executes dropped EXE
PID:2140 -
\??\c:\dddvd.exec:\dddvd.exe23⤵
- Executes dropped EXE
PID:2316 -
\??\c:\dvdjj.exec:\dvdjj.exe24⤵
- Executes dropped EXE
PID:2380 -
\??\c:\vdppv.exec:\vdppv.exe25⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1vppv.exec:\1vppv.exe26⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jdvdd.exec:\jdvdd.exe27⤵
- Executes dropped EXE
PID:2376 -
\??\c:\xxflxfl.exec:\xxflxfl.exe28⤵
- Executes dropped EXE
PID:1884 -
\??\c:\vpvpv.exec:\vpvpv.exe29⤵
- Executes dropped EXE
PID:1552 -
\??\c:\ddvpv.exec:\ddvpv.exe30⤵
- Executes dropped EXE
PID:2052 -
\??\c:\7xlrrff.exec:\7xlrrff.exe31⤵
- Executes dropped EXE
PID:1148 -
\??\c:\hhtbbt.exec:\hhtbbt.exe32⤵
- Executes dropped EXE
PID:1088 -
\??\c:\jpppd.exec:\jpppd.exe33⤵
- Executes dropped EXE
PID:528 -
\??\c:\hbhbhh.exec:\hbhbhh.exe34⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jdppv.exec:\jdppv.exe35⤵
- Executes dropped EXE
PID:1672 -
\??\c:\lllllfx.exec:\lllllfx.exe36⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hhhntt.exec:\hhhntt.exe37⤵
- Executes dropped EXE
PID:2992 -
\??\c:\7vvjd.exec:\7vvjd.exe38⤵
- Executes dropped EXE
PID:2044 -
\??\c:\pjddp.exec:\pjddp.exe39⤵
- Executes dropped EXE
PID:3008 -
\??\c:\3lrxxfr.exec:\3lrxxfr.exe40⤵
- Executes dropped EXE
PID:1976 -
\??\c:\hhnhhn.exec:\hhnhhn.exe41⤵
- Executes dropped EXE
PID:2876 -
\??\c:\ppvvp.exec:\ppvvp.exe42⤵
- Executes dropped EXE
PID:2700 -
\??\c:\5jpvd.exec:\5jpvd.exe43⤵
- Executes dropped EXE
PID:2780 -
\??\c:\ffflrrf.exec:\ffflrrf.exe44⤵
- Executes dropped EXE
PID:2172 -
\??\c:\btttbb.exec:\btttbb.exe45⤵
- Executes dropped EXE
PID:1352 -
\??\c:\djvvj.exec:\djvvj.exe46⤵
- Executes dropped EXE
PID:1700 -
\??\c:\5frrfrx.exec:\5frrfrx.exe47⤵
- Executes dropped EXE
PID:444 -
\??\c:\7hbntt.exec:\7hbntt.exe48⤵
- Executes dropped EXE
PID:636 -
\??\c:\3djjj.exec:\3djjj.exe49⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vvvpv.exec:\vvvpv.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1696 -
\??\c:\ffrxlrx.exec:\ffrxlrx.exe51⤵
- Executes dropped EXE
PID:2280 -
\??\c:\3bhnnt.exec:\3bhnnt.exe52⤵
- Executes dropped EXE
PID:2256 -
\??\c:\1jddp.exec:\1jddp.exe53⤵
- Executes dropped EXE
PID:1292 -
\??\c:\flxffxl.exec:\flxffxl.exe54⤵
- Executes dropped EXE
PID:2540 -
\??\c:\fxffxxf.exec:\fxffxxf.exe55⤵
- Executes dropped EXE
PID:2260 -
\??\c:\htntbb.exec:\htntbb.exe56⤵
- Executes dropped EXE
PID:532 -
\??\c:\jdjdj.exec:\jdjdj.exe57⤵
- Executes dropped EXE
PID:1652 -
\??\c:\rrxxxxf.exec:\rrxxxxf.exe58⤵
- Executes dropped EXE
PID:2168 -
\??\c:\nnbbnn.exec:\nnbbnn.exe59⤵
- Executes dropped EXE
PID:2148 -
\??\c:\pdvvj.exec:\pdvvj.exe60⤵
- Executes dropped EXE
PID:2356 -
\??\c:\vppvd.exec:\vppvd.exe61⤵
- Executes dropped EXE
PID:2336 -
\??\c:\5fxxxrr.exec:\5fxxxrr.exe62⤵
- Executes dropped EXE
PID:896 -
\??\c:\thbnbh.exec:\thbnbh.exe63⤵
- Executes dropped EXE
PID:1480 -
\??\c:\7ppvd.exec:\7ppvd.exe64⤵
- Executes dropped EXE
PID:1484 -
\??\c:\rflllxf.exec:\rflllxf.exe65⤵
- Executes dropped EXE
PID:2444 -
\??\c:\hhnbhh.exec:\hhnbhh.exe66⤵PID:2668
-
\??\c:\tbhhtb.exec:\tbhhtb.exe67⤵PID:1368
-
\??\c:\jvpdv.exec:\jvpdv.exe68⤵PID:1896
-
\??\c:\1pvdd.exec:\1pvdd.exe69⤵PID:2500
-
\??\c:\xxrxfrx.exec:\xxrxfrx.exe70⤵PID:1072
-
\??\c:\5nhbth.exec:\5nhbth.exe71⤵PID:3028
-
\??\c:\djddp.exec:\djddp.exe72⤵PID:1964
-
\??\c:\rffrxll.exec:\rffrxll.exe73⤵PID:1572
-
\??\c:\fxfflxf.exec:\fxfflxf.exe74⤵PID:1096
-
\??\c:\bnhbhb.exec:\bnhbhb.exe75⤵PID:576
-
\??\c:\rrflllr.exec:\rrflllr.exe76⤵PID:2816
-
\??\c:\llfrflx.exec:\llfrflx.exe77⤵PID:1672
-
\??\c:\3nnntb.exec:\3nnntb.exe78⤵PID:2240
-
\??\c:\ddppv.exec:\ddppv.exe79⤵PID:2956
-
\??\c:\1xlrxll.exec:\1xlrxll.exe80⤵PID:2044
-
\??\c:\7frllff.exec:\7frllff.exe81⤵PID:2072
-
\??\c:\9bnbnb.exec:\9bnbnb.exe82⤵PID:1976
-
\??\c:\1jdvd.exec:\1jdvd.exe83⤵PID:2704
-
\??\c:\xlxxfrx.exec:\xlxxfrx.exe84⤵PID:2784
-
\??\c:\lfrrxxx.exec:\lfrrxxx.exe85⤵PID:1604
-
\??\c:\bbntbh.exec:\bbntbh.exe86⤵PID:1556
-
\??\c:\dvjjv.exec:\dvjjv.exe87⤵PID:2548
-
\??\c:\xrflrrf.exec:\xrflrrf.exe88⤵PID:2460
-
\??\c:\9fxflxr.exec:\9fxflxr.exe89⤵PID:1744
-
\??\c:\3nbhnb.exec:\3nbhnb.exe90⤵PID:2212
-
\??\c:\jjvvd.exec:\jjvvd.exe91⤵PID:2068
-
\??\c:\lrlfxrf.exec:\lrlfxrf.exe92⤵PID:2420
-
\??\c:\bbhhbh.exec:\bbhhbh.exe93⤵PID:2064
-
\??\c:\9jdjv.exec:\9jdjv.exe94⤵PID:3040
-
\??\c:\jpdjv.exec:\jpdjv.exe95⤵PID:2520
-
\??\c:\rxrxllx.exec:\rxrxllx.exe96⤵PID:2304
-
\??\c:\nnthnb.exec:\nnthnb.exe97⤵PID:2888
-
\??\c:\5hbbbh.exec:\5hbbbh.exe98⤵PID:2884
-
\??\c:\ddppd.exec:\ddppd.exe99⤵PID:2196
-
\??\c:\xlflxxl.exec:\xlflxxl.exe100⤵PID:536
-
\??\c:\xxrflrf.exec:\xxrflrf.exe101⤵PID:2364
-
\??\c:\3nbbbb.exec:\3nbbbb.exe102⤵PID:2412
-
\??\c:\1jppd.exec:\1jppd.exe103⤵PID:2192
-
\??\c:\9pjvp.exec:\9pjvp.exe104⤵PID:976
-
\??\c:\flflxfr.exec:\flflxfr.exe105⤵PID:896
-
\??\c:\7hbbnt.exec:\7hbbnt.exe106⤵PID:1648
-
\??\c:\bbhtnn.exec:\bbhtnn.exe107⤵PID:2472
-
\??\c:\ddjpv.exec:\ddjpv.exe108⤵PID:2100
-
\??\c:\xrflrxf.exec:\xrflrxf.exe109⤵PID:2516
-
\??\c:\hhhtbh.exec:\hhhtbh.exe110⤵PID:1884
-
\??\c:\jpjvj.exec:\jpjvj.exe111⤵PID:1720
-
\??\c:\lllxrxr.exec:\lllxrxr.exe112⤵PID:1724
-
\??\c:\hhbbnt.exec:\hhbbnt.exe113⤵PID:1968
-
\??\c:\jjvdd.exec:\jjvdd.exe114⤵PID:1548
-
\??\c:\llrxxfr.exec:\llrxxfr.exe115⤵PID:1572
-
\??\c:\1nbhnb.exec:\1nbhnb.exe116⤵
- System Location Discovery: System Language Discovery
PID:2096 -
\??\c:\jjppd.exec:\jjppd.exe117⤵PID:576
-
\??\c:\vdjjv.exec:\vdjjv.exe118⤵PID:2980
-
\??\c:\rlxrrlx.exec:\rlxrrlx.exe119⤵PID:1672
-
\??\c:\hnhbnb.exec:\hnhbnb.exe120⤵PID:3004
-
\??\c:\jddpd.exec:\jddpd.exe121⤵PID:2216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-