Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 00:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe
-
Size
456KB
-
MD5
a0682084762c8b43e2b90c401f22143f
-
SHA1
a4058f7ec326914611cf8081a70187f017b6c74c
-
SHA256
b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9
-
SHA512
c51285661f46543e219d584525a98f0d17b57656b0535f5336d79dd889a7a7c7113ee7b5e9e3e702555ac1f03d6eb94f34882ac16a3d9e933e4425196bc9156d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRx:q7Tc2NYHUrAwfMp3CDRx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2440-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1396-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/296-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/276-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-455-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2200-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/708-490-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/292-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-520-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/912-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-528-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1704-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-595-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1888-748-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2960-883-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1896-892-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2908-905-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2168 xrflrrf.exe 2320 9bhhtb.exe 1628 xrlxlfl.exe 2808 5jppv.exe 892 ffxlxxl.exe 2904 xrxrrlr.exe 2752 1tnnth.exe 2888 hbhhnh.exe 1396 flxrrfl.exe 2616 1jdpv.exe 1420 7rllrxr.exe 2112 ddvdv.exe 2028 flxflrf.exe 3020 7vjpp.exe 2352 7lfxlrx.exe 2720 rrrxlrx.exe 3004 vpvjp.exe 1880 1xflrfl.exe 2716 3htthh.exe 1868 bttbhn.exe 2496 nhbhhh.exe 3056 bbnbht.exe 1516 hhtbnn.exe 380 lrxxxxx.exe 296 tnhhtt.exe 276 7xlrrrx.exe 1564 9bbhnt.exe 3060 jjvdj.exe 2076 3rlflrr.exe 2064 9dvvj.exe 2056 vddvv.exe 572 jdvvj.exe 2208 pjvdv.exe 1548 hthnbb.exe 2552 btntbb.exe 1124 ddvvj.exe 2340 lfxfrxl.exe 2484 fxlrxxl.exe 2764 htnthh.exe 2908 vpppd.exe 2904 fxlllfl.exe 1048 ffrflrx.exe 3000 tnntbt.exe 2736 9jpvv.exe 2732 vpdjd.exe 2632 rllfllx.exe 2932 7nhnbb.exe 2692 nhbhhh.exe 1420 9dvjp.exe 1200 9pvpp.exe 2036 rfxxxxx.exe 3008 7thbhh.exe 2852 btbbhn.exe 2860 7vjdd.exe 2720 rrfflrf.exe 2312 fxrrrrx.exe 2200 3htbbh.exe 2380 vjvjp.exe 2368 vpjjv.exe 2816 rlrxrfr.exe 340 tntbhb.exe 708 5pddd.exe 292 5lxxfxx.exe 304 ntbttn.exe -
resource yara_rule behavioral1/memory/2440-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/296-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-253-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2064-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/292-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-528-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1704-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-763-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-824-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-837-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-859-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-878-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-892-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1912-1002-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-1258-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lfxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2168 2440 b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe 30 PID 2440 wrote to memory of 2168 2440 b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe 30 PID 2440 wrote to memory of 2168 2440 b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe 30 PID 2440 wrote to memory of 2168 2440 b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe 30 PID 2168 wrote to memory of 2320 2168 xrflrrf.exe 31 PID 2168 wrote to memory of 2320 2168 xrflrrf.exe 31 PID 2168 wrote to memory of 2320 2168 xrflrrf.exe 31 PID 2168 wrote to memory of 2320 2168 xrflrrf.exe 31 PID 2320 wrote to memory of 1628 2320 9bhhtb.exe 32 PID 2320 wrote to memory of 1628 2320 9bhhtb.exe 32 PID 2320 wrote to memory of 1628 2320 9bhhtb.exe 32 PID 2320 wrote to memory of 1628 2320 9bhhtb.exe 32 PID 1628 wrote to memory of 2808 1628 xrlxlfl.exe 33 PID 1628 wrote to memory of 2808 1628 xrlxlfl.exe 33 PID 1628 wrote to memory of 2808 1628 xrlxlfl.exe 33 PID 1628 wrote to memory of 2808 1628 xrlxlfl.exe 33 PID 2808 wrote to memory of 892 2808 5jppv.exe 34 PID 2808 wrote to memory of 892 2808 5jppv.exe 34 PID 2808 wrote to memory of 892 2808 5jppv.exe 34 PID 2808 wrote to memory of 892 2808 5jppv.exe 34 PID 892 wrote to memory of 2904 892 ffxlxxl.exe 35 PID 892 wrote to memory of 2904 892 ffxlxxl.exe 35 PID 892 wrote to memory of 2904 892 ffxlxxl.exe 35 PID 892 wrote to memory of 2904 892 ffxlxxl.exe 35 PID 2904 wrote to memory of 2752 2904 xrxrrlr.exe 36 PID 2904 wrote to memory of 2752 2904 xrxrrlr.exe 36 PID 2904 wrote to memory of 2752 2904 xrxrrlr.exe 36 PID 2904 wrote to memory of 2752 2904 xrxrrlr.exe 36 PID 2752 wrote to memory of 2888 2752 1tnnth.exe 37 PID 2752 wrote to memory of 2888 2752 1tnnth.exe 37 PID 2752 wrote to memory of 2888 2752 1tnnth.exe 37 PID 2752 wrote to memory of 2888 2752 1tnnth.exe 37 PID 2888 wrote to memory of 1396 2888 hbhhnh.exe 38 PID 2888 wrote to memory of 1396 2888 hbhhnh.exe 38 PID 2888 wrote to memory of 1396 2888 hbhhnh.exe 38 PID 2888 wrote to memory of 1396 2888 hbhhnh.exe 38 PID 1396 wrote to memory of 2616 1396 flxrrfl.exe 39 PID 1396 wrote to memory of 2616 1396 flxrrfl.exe 39 PID 1396 wrote to memory of 2616 1396 flxrrfl.exe 39 PID 1396 wrote to memory of 2616 1396 flxrrfl.exe 39 PID 2616 wrote to memory of 1420 2616 1jdpv.exe 40 PID 2616 wrote to memory of 1420 2616 1jdpv.exe 40 PID 2616 wrote to memory of 1420 2616 1jdpv.exe 40 PID 2616 wrote to memory of 1420 2616 1jdpv.exe 40 PID 1420 wrote to memory of 2112 1420 7rllrxr.exe 41 PID 1420 wrote to memory of 2112 1420 7rllrxr.exe 41 PID 1420 wrote to memory of 2112 1420 7rllrxr.exe 41 PID 1420 wrote to memory of 2112 1420 7rllrxr.exe 41 PID 2112 wrote to memory of 2028 2112 ddvdv.exe 42 PID 2112 wrote to memory of 2028 2112 ddvdv.exe 42 PID 2112 wrote to memory of 2028 2112 ddvdv.exe 42 PID 2112 wrote to memory of 2028 2112 ddvdv.exe 42 PID 2028 wrote to memory of 3020 2028 flxflrf.exe 43 PID 2028 wrote to memory of 3020 2028 flxflrf.exe 43 PID 2028 wrote to memory of 3020 2028 flxflrf.exe 43 PID 2028 wrote to memory of 3020 2028 flxflrf.exe 43 PID 3020 wrote to memory of 2352 3020 7vjpp.exe 44 PID 3020 wrote to memory of 2352 3020 7vjpp.exe 44 PID 3020 wrote to memory of 2352 3020 7vjpp.exe 44 PID 3020 wrote to memory of 2352 3020 7vjpp.exe 44 PID 2352 wrote to memory of 2720 2352 7lfxlrx.exe 45 PID 2352 wrote to memory of 2720 2352 7lfxlrx.exe 45 PID 2352 wrote to memory of 2720 2352 7lfxlrx.exe 45 PID 2352 wrote to memory of 2720 2352 7lfxlrx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe"C:\Users\Admin\AppData\Local\Temp\b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\xrflrrf.exec:\xrflrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\9bhhtb.exec:\9bhhtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\xrlxlfl.exec:\xrlxlfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\5jppv.exec:\5jppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\ffxlxxl.exec:\ffxlxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\xrxrrlr.exec:\xrxrrlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\1tnnth.exec:\1tnnth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\hbhhnh.exec:\hbhhnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\flxrrfl.exec:\flxrrfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\1jdpv.exec:\1jdpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\7rllrxr.exec:\7rllrxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\ddvdv.exec:\ddvdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\flxflrf.exec:\flxflrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\7vjpp.exec:\7vjpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\7lfxlrx.exec:\7lfxlrx.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\rrrxlrx.exec:\rrrxlrx.exe17⤵
- Executes dropped EXE
PID:2720 -
\??\c:\vpvjp.exec:\vpvjp.exe18⤵
- Executes dropped EXE
PID:3004 -
\??\c:\1xflrfl.exec:\1xflrfl.exe19⤵
- Executes dropped EXE
PID:1880 -
\??\c:\3htthh.exec:\3htthh.exe20⤵
- Executes dropped EXE
PID:2716 -
\??\c:\bttbhn.exec:\bttbhn.exe21⤵
- Executes dropped EXE
PID:1868 -
\??\c:\nhbhhh.exec:\nhbhhh.exe22⤵
- Executes dropped EXE
PID:2496 -
\??\c:\bbnbht.exec:\bbnbht.exe23⤵
- Executes dropped EXE
PID:3056 -
\??\c:\hhtbnn.exec:\hhtbnn.exe24⤵
- Executes dropped EXE
PID:1516 -
\??\c:\lrxxxxx.exec:\lrxxxxx.exe25⤵
- Executes dropped EXE
PID:380 -
\??\c:\tnhhtt.exec:\tnhhtt.exe26⤵
- Executes dropped EXE
PID:296 -
\??\c:\7xlrrrx.exec:\7xlrrrx.exe27⤵
- Executes dropped EXE
PID:276 -
\??\c:\9bbhnt.exec:\9bbhnt.exe28⤵
- Executes dropped EXE
PID:1564 -
\??\c:\jjvdj.exec:\jjvdj.exe29⤵
- Executes dropped EXE
PID:3060 -
\??\c:\3rlflrr.exec:\3rlflrr.exe30⤵
- Executes dropped EXE
PID:2076 -
\??\c:\9dvvj.exec:\9dvvj.exe31⤵
- Executes dropped EXE
PID:2064 -
\??\c:\vddvv.exec:\vddvv.exe32⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jdvvj.exec:\jdvvj.exe33⤵
- Executes dropped EXE
PID:572 -
\??\c:\pjvdv.exec:\pjvdv.exe34⤵
- Executes dropped EXE
PID:2208 -
\??\c:\hthnbb.exec:\hthnbb.exe35⤵
- Executes dropped EXE
PID:1548 -
\??\c:\btntbb.exec:\btntbb.exe36⤵
- Executes dropped EXE
PID:2552 -
\??\c:\ddvvj.exec:\ddvvj.exe37⤵
- Executes dropped EXE
PID:1124 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe38⤵
- Executes dropped EXE
PID:2340 -
\??\c:\fxlrxxl.exec:\fxlrxxl.exe39⤵
- Executes dropped EXE
PID:2484 -
\??\c:\htnthh.exec:\htnthh.exe40⤵
- Executes dropped EXE
PID:2764 -
\??\c:\vpppd.exec:\vpppd.exe41⤵
- Executes dropped EXE
PID:2908 -
\??\c:\fxlllfl.exec:\fxlllfl.exe42⤵
- Executes dropped EXE
PID:2904 -
\??\c:\ffrflrx.exec:\ffrflrx.exe43⤵
- Executes dropped EXE
PID:1048 -
\??\c:\tnntbt.exec:\tnntbt.exe44⤵
- Executes dropped EXE
PID:3000 -
\??\c:\9jpvv.exec:\9jpvv.exe45⤵
- Executes dropped EXE
PID:2736 -
\??\c:\vpdjd.exec:\vpdjd.exe46⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rllfllx.exec:\rllfllx.exe47⤵
- Executes dropped EXE
PID:2632 -
\??\c:\7nhnbb.exec:\7nhnbb.exe48⤵
- Executes dropped EXE
PID:2932 -
\??\c:\nhbhhh.exec:\nhbhhh.exe49⤵
- Executes dropped EXE
PID:2692 -
\??\c:\9dvjp.exec:\9dvjp.exe50⤵
- Executes dropped EXE
PID:1420 -
\??\c:\9pvpp.exec:\9pvpp.exe51⤵
- Executes dropped EXE
PID:1200 -
\??\c:\rfxxxxx.exec:\rfxxxxx.exe52⤵
- Executes dropped EXE
PID:2036 -
\??\c:\7thbhh.exec:\7thbhh.exe53⤵
- Executes dropped EXE
PID:3008 -
\??\c:\btbbhn.exec:\btbbhn.exe54⤵
- Executes dropped EXE
PID:2852 -
\??\c:\7vjdd.exec:\7vjdd.exe55⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rrfflrf.exec:\rrfflrf.exe56⤵
- Executes dropped EXE
PID:2720 -
\??\c:\fxrrrrx.exec:\fxrrrrx.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2312 -
\??\c:\3htbbh.exec:\3htbbh.exe58⤵
- Executes dropped EXE
PID:2200 -
\??\c:\vjvjp.exec:\vjvjp.exe59⤵
- Executes dropped EXE
PID:2380 -
\??\c:\vpjjv.exec:\vpjjv.exe60⤵
- Executes dropped EXE
PID:2368 -
\??\c:\rlrxrfr.exec:\rlrxrfr.exe61⤵
- Executes dropped EXE
PID:2816 -
\??\c:\tntbhb.exec:\tntbhb.exe62⤵
- Executes dropped EXE
PID:340 -
\??\c:\5pddd.exec:\5pddd.exe63⤵
- Executes dropped EXE
PID:708 -
\??\c:\5lxxfxx.exec:\5lxxfxx.exe64⤵
- Executes dropped EXE
PID:292 -
\??\c:\ntbttn.exec:\ntbttn.exe65⤵
- Executes dropped EXE
PID:304 -
\??\c:\nhnbnt.exec:\nhnbnt.exe66⤵PID:380
-
\??\c:\3jvpp.exec:\3jvpp.exe67⤵PID:1712
-
\??\c:\9pddj.exec:\9pddj.exe68⤵PID:912
-
\??\c:\frxrrfl.exec:\frxrrfl.exe69⤵PID:1644
-
\??\c:\nntnbh.exec:\nntnbh.exe70⤵PID:616
-
\??\c:\vjppd.exec:\vjppd.exe71⤵PID:2072
-
\??\c:\dpjvd.exec:\dpjvd.exe72⤵PID:3032
-
\??\c:\flxrlfl.exec:\flxrlfl.exe73⤵PID:1704
-
\??\c:\bhttbt.exec:\bhttbt.exe74⤵PID:772
-
\??\c:\hbhbnn.exec:\hbhbnn.exe75⤵PID:988
-
\??\c:\ppppv.exec:\ppppv.exe76⤵PID:2548
-
\??\c:\rlflxfl.exec:\rlflxfl.exe77⤵PID:2204
-
\??\c:\3rlfrxl.exec:\3rlfrxl.exe78⤵PID:1720
-
\??\c:\tthttt.exec:\tthttt.exe79⤵PID:2336
-
\??\c:\jjddp.exec:\jjddp.exe80⤵PID:2120
-
\??\c:\rlffllx.exec:\rlffllx.exe81⤵PID:2568
-
\??\c:\fxrrxrx.exec:\fxrrxrx.exe82⤵PID:2340
-
\??\c:\tntnnh.exec:\tntnnh.exe83⤵PID:2484
-
\??\c:\5vpvj.exec:\5vpvj.exe84⤵PID:2728
-
\??\c:\5vjdv.exec:\5vjdv.exe85⤵PID:2912
-
\??\c:\xrflrrf.exec:\xrflrrf.exe86⤵PID:2936
-
\??\c:\bbttbn.exec:\bbttbn.exe87⤵PID:2464
-
\??\c:\nhttbb.exec:\nhttbb.exe88⤵PID:2876
-
\??\c:\1jvvv.exec:\1jvvv.exe89⤵PID:2660
-
\??\c:\rlrrfxf.exec:\rlrrfxf.exe90⤵PID:2640
-
\??\c:\3xfxfff.exec:\3xfxfff.exe91⤵PID:2632
-
\??\c:\btntbb.exec:\btntbb.exe92⤵PID:2404
-
\??\c:\5jvjd.exec:\5jvjd.exe93⤵PID:2324
-
\??\c:\pjddj.exec:\pjddj.exe94⤵PID:1464
-
\??\c:\rfxxffr.exec:\rfxxffr.exe95⤵PID:2020
-
\??\c:\xrrrxrf.exec:\xrrrxrf.exe96⤵PID:2992
-
\??\c:\hbnthb.exec:\hbnthb.exe97⤵PID:1992
-
\??\c:\dvjpv.exec:\dvjpv.exe98⤵PID:2472
-
\??\c:\3jpjj.exec:\3jpjj.exe99⤵PID:2860
-
\??\c:\rlrxllx.exec:\rlrxllx.exe100⤵PID:3016
-
\??\c:\hhhhtt.exec:\hhhhtt.exe101⤵PID:1880
-
\??\c:\hnbnbb.exec:\hnbnbb.exe102⤵PID:2268
-
\??\c:\5pvdp.exec:\5pvdp.exe103⤵PID:2200
-
\??\c:\xxlrxfr.exec:\xxlrxfr.exe104⤵PID:1888
-
\??\c:\7hnbbb.exec:\7hnbbb.exe105⤵PID:2716
-
\??\c:\btnthh.exec:\btnthh.exe106⤵PID:3064
-
\??\c:\5jpjj.exec:\5jpjj.exe107⤵PID:2272
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe108⤵
- System Location Discovery: System Language Discovery
PID:856 -
\??\c:\rlffllr.exec:\rlffllr.exe109⤵PID:292
-
\??\c:\thnhbb.exec:\thnhbb.exe110⤵PID:304
-
\??\c:\ppdpd.exec:\ppdpd.exe111⤵
- System Location Discovery: System Language Discovery
PID:1696 -
\??\c:\dpdjv.exec:\dpdjv.exe112⤵PID:1712
-
\??\c:\rrflrrx.exec:\rrflrrx.exe113⤵PID:1536
-
\??\c:\9bhtbh.exec:\9bhtbh.exe114⤵PID:596
-
\??\c:\3jpjj.exec:\3jpjj.exe115⤵PID:2084
-
\??\c:\pjjjp.exec:\pjjjp.exe116⤵PID:1072
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe117⤵PID:1928
-
\??\c:\ttthnt.exec:\ttthnt.exe118⤵PID:564
-
\??\c:\5tntbh.exec:\5tntbh.exe119⤵PID:1472
-
\??\c:\7pjpv.exec:\7pjpv.exe120⤵PID:2540
-
\??\c:\xlrxrrr.exec:\xlrxrrr.exe121⤵PID:1960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-