Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 00:37
Static task
static1
Behavioral task
behavioral1
Sample
b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe
Resource
win7-20240729-en
General
-
Target
b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe
-
Size
456KB
-
MD5
a0682084762c8b43e2b90c401f22143f
-
SHA1
a4058f7ec326914611cf8081a70187f017b6c74c
-
SHA256
b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9
-
SHA512
c51285661f46543e219d584525a98f0d17b57656b0535f5336d79dd889a7a7c7113ee7b5e9e3e702555ac1f03d6eb94f34882ac16a3d9e933e4425196bc9156d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRx:q7Tc2NYHUrAwfMp3CDRx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/1712-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-101-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2876-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-136-0x0000000000280000-0x00000000002AA000-memory.dmp family_blackmoon behavioral1/memory/2332-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-152-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2904-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/792-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-195-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2124-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-354-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2080-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-496-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2564-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-506-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/668-662-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2680-701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-715-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2236-753-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1988-785-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2620-905-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-918-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1464-1109-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2088 vpvpp.exe 2712 dvdvp.exe 2760 7frrxxf.exe 2916 nnbbnt.exe 2744 lfxfxfr.exe 2980 tbnbnt.exe 2784 ppddp.exe 2660 5rlrllx.exe 1096 5hbhtt.exe 2892 rfrfrff.exe 2184 hhbbhn.exe 2384 xfflrfl.exe 2876 rxfllxx.exe 2332 vppvj.exe 592 rxlrxxx.exe 2904 pvvvd.exe 3004 7lxrlff.exe 792 7pvdp.exe 1132 nnttbh.exe 2124 pvvdd.exe 2264 lrlrfff.exe 2380 9pjpj.exe 2404 lrxxffr.exe 1220 hbtnnb.exe 1856 vpjpj.exe 1968 hhtthn.exe 2280 vvjjp.exe 3068 ttbhnb.exe 860 rrrrrff.exe 1464 bbtbnn.exe 2592 vjdjj.exe 2704 1xllrrx.exe 1192 vjjdd.exe 2088 llfrrll.exe 3024 7nhhhn.exe 3036 7jpvp.exe 2776 ffflrrx.exe 2916 nnhtbh.exe 2752 vdpvj.exe 1640 jdjpp.exe 2664 9fxxrrr.exe 2696 tntbbb.exe 2080 bnbhtt.exe 2084 vvdjp.exe 880 7lfrxrr.exe 2188 fxxffff.exe 1196 btbhhn.exe 276 djddj.exe 2720 xxffrxx.exe 1896 llxllrx.exe 1016 bttttn.exe 2796 jdjpv.exe 2868 7llxfll.exe 2996 btbtbn.exe 1160 vvjjv.exe 604 llxxfff.exe 1032 7flfxff.exe 1132 nhtntn.exe 2468 vvddj.exe 2216 3lxflff.exe 2268 flrrxrr.exe 2228 ttbttb.exe 2564 jjjjp.exe 2492 ffrxflr.exe -
resource yara_rule behavioral1/memory/1712-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/792-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-506-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1468-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-662-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2680-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-847-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-905-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-1084-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-1122-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxlrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrffrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2088 1712 b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe 29 PID 1712 wrote to memory of 2088 1712 b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe 29 PID 1712 wrote to memory of 2088 1712 b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe 29 PID 1712 wrote to memory of 2088 1712 b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe 29 PID 2088 wrote to memory of 2712 2088 vpvpp.exe 30 PID 2088 wrote to memory of 2712 2088 vpvpp.exe 30 PID 2088 wrote to memory of 2712 2088 vpvpp.exe 30 PID 2088 wrote to memory of 2712 2088 vpvpp.exe 30 PID 2712 wrote to memory of 2760 2712 dvdvp.exe 31 PID 2712 wrote to memory of 2760 2712 dvdvp.exe 31 PID 2712 wrote to memory of 2760 2712 dvdvp.exe 31 PID 2712 wrote to memory of 2760 2712 dvdvp.exe 31 PID 2760 wrote to memory of 2916 2760 7frrxxf.exe 32 PID 2760 wrote to memory of 2916 2760 7frrxxf.exe 32 PID 2760 wrote to memory of 2916 2760 7frrxxf.exe 32 PID 2760 wrote to memory of 2916 2760 7frrxxf.exe 32 PID 2916 wrote to memory of 2744 2916 nnbbnt.exe 33 PID 2916 wrote to memory of 2744 2916 nnbbnt.exe 33 PID 2916 wrote to memory of 2744 2916 nnbbnt.exe 33 PID 2916 wrote to memory of 2744 2916 nnbbnt.exe 33 PID 2744 wrote to memory of 2980 2744 lfxfxfr.exe 34 PID 2744 wrote to memory of 2980 2744 lfxfxfr.exe 34 PID 2744 wrote to memory of 2980 2744 lfxfxfr.exe 34 PID 2744 wrote to memory of 2980 2744 lfxfxfr.exe 34 PID 2980 wrote to memory of 2784 2980 tbnbnt.exe 35 PID 2980 wrote to memory of 2784 2980 tbnbnt.exe 35 PID 2980 wrote to memory of 2784 2980 tbnbnt.exe 35 PID 2980 wrote to memory of 2784 2980 tbnbnt.exe 35 PID 2784 wrote to memory of 2660 2784 ppddp.exe 36 PID 2784 wrote to memory of 2660 2784 ppddp.exe 36 PID 2784 wrote to memory of 2660 2784 ppddp.exe 36 PID 2784 wrote to memory of 2660 2784 ppddp.exe 36 PID 2660 wrote to memory of 1096 2660 5rlrllx.exe 37 PID 2660 wrote to memory of 1096 2660 5rlrllx.exe 37 PID 2660 wrote to memory of 1096 2660 5rlrllx.exe 37 PID 2660 wrote to memory of 1096 2660 5rlrllx.exe 37 PID 1096 wrote to memory of 2892 1096 5hbhtt.exe 38 PID 1096 wrote to memory of 2892 1096 5hbhtt.exe 38 PID 1096 wrote to memory of 2892 1096 5hbhtt.exe 38 PID 1096 wrote to memory of 2892 1096 5hbhtt.exe 38 PID 2892 wrote to memory of 2184 2892 rfrfrff.exe 39 PID 2892 wrote to memory of 2184 2892 rfrfrff.exe 39 PID 2892 wrote to memory of 2184 2892 rfrfrff.exe 39 PID 2892 wrote to memory of 2184 2892 rfrfrff.exe 39 PID 2184 wrote to memory of 2384 2184 hhbbhn.exe 40 PID 2184 wrote to memory of 2384 2184 hhbbhn.exe 40 PID 2184 wrote to memory of 2384 2184 hhbbhn.exe 40 PID 2184 wrote to memory of 2384 2184 hhbbhn.exe 40 PID 2384 wrote to memory of 2876 2384 xfflrfl.exe 41 PID 2384 wrote to memory of 2876 2384 xfflrfl.exe 41 PID 2384 wrote to memory of 2876 2384 xfflrfl.exe 41 PID 2384 wrote to memory of 2876 2384 xfflrfl.exe 41 PID 2876 wrote to memory of 2332 2876 rxfllxx.exe 42 PID 2876 wrote to memory of 2332 2876 rxfllxx.exe 42 PID 2876 wrote to memory of 2332 2876 rxfllxx.exe 42 PID 2876 wrote to memory of 2332 2876 rxfllxx.exe 42 PID 2332 wrote to memory of 592 2332 vppvj.exe 43 PID 2332 wrote to memory of 592 2332 vppvj.exe 43 PID 2332 wrote to memory of 592 2332 vppvj.exe 43 PID 2332 wrote to memory of 592 2332 vppvj.exe 43 PID 592 wrote to memory of 2904 592 rxlrxxx.exe 44 PID 592 wrote to memory of 2904 592 rxlrxxx.exe 44 PID 592 wrote to memory of 2904 592 rxlrxxx.exe 44 PID 592 wrote to memory of 2904 592 rxlrxxx.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe"C:\Users\Admin\AppData\Local\Temp\b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\vpvpp.exec:\vpvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\dvdvp.exec:\dvdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\7frrxxf.exec:\7frrxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\nnbbnt.exec:\nnbbnt.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\lfxfxfr.exec:\lfxfxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\tbnbnt.exec:\tbnbnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\ppddp.exec:\ppddp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\5rlrllx.exec:\5rlrllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\5hbhtt.exec:\5hbhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\rfrfrff.exec:\rfrfrff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\hhbbhn.exec:\hhbbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\xfflrfl.exec:\xfflrfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\rxfllxx.exec:\rxfllxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\vppvj.exec:\vppvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\rxlrxxx.exec:\rxlrxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\pvvvd.exec:\pvvvd.exe17⤵
- Executes dropped EXE
PID:2904 -
\??\c:\7lxrlff.exec:\7lxrlff.exe18⤵
- Executes dropped EXE
PID:3004 -
\??\c:\7pvdp.exec:\7pvdp.exe19⤵
- Executes dropped EXE
PID:792 -
\??\c:\nnttbh.exec:\nnttbh.exe20⤵
- Executes dropped EXE
PID:1132 -
\??\c:\pvvdd.exec:\pvvdd.exe21⤵
- Executes dropped EXE
PID:2124 -
\??\c:\lrlrfff.exec:\lrlrfff.exe22⤵
- Executes dropped EXE
PID:2264 -
\??\c:\9pjpj.exec:\9pjpj.exe23⤵
- Executes dropped EXE
PID:2380 -
\??\c:\lrxxffr.exec:\lrxxffr.exe24⤵
- Executes dropped EXE
PID:2404 -
\??\c:\hbtnnb.exec:\hbtnnb.exe25⤵
- Executes dropped EXE
PID:1220 -
\??\c:\vpjpj.exec:\vpjpj.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1856 -
\??\c:\hhtthn.exec:\hhtthn.exe27⤵
- Executes dropped EXE
PID:1968 -
\??\c:\vvjjp.exec:\vvjjp.exe28⤵
- Executes dropped EXE
PID:2280 -
\??\c:\ttbhnb.exec:\ttbhnb.exe29⤵
- Executes dropped EXE
PID:3068 -
\??\c:\rrrrrff.exec:\rrrrrff.exe30⤵
- Executes dropped EXE
PID:860 -
\??\c:\bbtbnn.exec:\bbtbnn.exe31⤵
- Executes dropped EXE
PID:1464 -
\??\c:\vjdjj.exec:\vjdjj.exe32⤵
- Executes dropped EXE
PID:2592 -
\??\c:\1xllrrx.exec:\1xllrrx.exe33⤵
- Executes dropped EXE
PID:2704 -
\??\c:\vjjdd.exec:\vjjdd.exe34⤵
- Executes dropped EXE
PID:1192 -
\??\c:\llfrrll.exec:\llfrrll.exe35⤵
- Executes dropped EXE
PID:2088 -
\??\c:\7nhhhn.exec:\7nhhhn.exe36⤵
- Executes dropped EXE
PID:3024 -
\??\c:\7jpvp.exec:\7jpvp.exe37⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ffflrrx.exec:\ffflrrx.exe38⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nnhtbh.exec:\nnhtbh.exe39⤵
- Executes dropped EXE
PID:2916 -
\??\c:\vdpvj.exec:\vdpvj.exe40⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jdjpp.exec:\jdjpp.exe41⤵
- Executes dropped EXE
PID:1640 -
\??\c:\9fxxrrr.exec:\9fxxrrr.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\tntbbb.exec:\tntbbb.exe43⤵
- Executes dropped EXE
PID:2696 -
\??\c:\bnbhtt.exec:\bnbhtt.exe44⤵
- Executes dropped EXE
PID:2080 -
\??\c:\vvdjp.exec:\vvdjp.exe45⤵
- Executes dropped EXE
PID:2084 -
\??\c:\7lfrxrr.exec:\7lfrxrr.exe46⤵
- Executes dropped EXE
PID:880 -
\??\c:\fxxffff.exec:\fxxffff.exe47⤵
- Executes dropped EXE
PID:2188 -
\??\c:\btbhhn.exec:\btbhhn.exe48⤵
- Executes dropped EXE
PID:1196 -
\??\c:\djddj.exec:\djddj.exe49⤵
- Executes dropped EXE
PID:276 -
\??\c:\xxffrxx.exec:\xxffrxx.exe50⤵
- Executes dropped EXE
PID:2720 -
\??\c:\llxllrx.exec:\llxllrx.exe51⤵
- Executes dropped EXE
PID:1896 -
\??\c:\bttttn.exec:\bttttn.exe52⤵
- Executes dropped EXE
PID:1016 -
\??\c:\jdjpv.exec:\jdjpv.exe53⤵
- Executes dropped EXE
PID:2796 -
\??\c:\7llxfll.exec:\7llxfll.exe54⤵
- Executes dropped EXE
PID:2868 -
\??\c:\btbtbn.exec:\btbtbn.exe55⤵
- Executes dropped EXE
PID:2996 -
\??\c:\vvjjv.exec:\vvjjv.exe56⤵
- Executes dropped EXE
PID:1160 -
\??\c:\llxxfff.exec:\llxxfff.exe57⤵
- Executes dropped EXE
PID:604 -
\??\c:\7flfxff.exec:\7flfxff.exe58⤵
- Executes dropped EXE
PID:1032 -
\??\c:\nhtntn.exec:\nhtntn.exe59⤵
- Executes dropped EXE
PID:1132 -
\??\c:\vvddj.exec:\vvddj.exe60⤵
- Executes dropped EXE
PID:2468 -
\??\c:\3lxflff.exec:\3lxflff.exe61⤵
- Executes dropped EXE
PID:2216 -
\??\c:\flrrxrr.exec:\flrrxrr.exe62⤵
- Executes dropped EXE
PID:2268 -
\??\c:\ttbttb.exec:\ttbttb.exe63⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jjjjp.exec:\jjjjp.exe64⤵
- Executes dropped EXE
PID:2564 -
\??\c:\ffrxflr.exec:\ffrxflr.exe65⤵
- Executes dropped EXE
PID:2492 -
\??\c:\fxlrfff.exec:\fxlrfff.exe66⤵PID:1468
-
\??\c:\hnttbh.exec:\hnttbh.exe67⤵PID:1856
-
\??\c:\jjpjv.exec:\jjpjv.exe68⤵PID:2432
-
\??\c:\ffrfrrr.exec:\ffrfrrr.exe69⤵PID:1924
-
\??\c:\xrfflff.exec:\xrfflff.exe70⤵PID:1476
-
\??\c:\bnnnnn.exec:\bnnnnn.exe71⤵
- System Location Discovery: System Language Discovery
PID:1076 -
\??\c:\9vppv.exec:\9vppv.exe72⤵PID:1584
-
\??\c:\jjppp.exec:\jjppp.exe73⤵PID:980
-
\??\c:\rrxfllx.exec:\rrxfllx.exe74⤵PID:1660
-
\??\c:\3tnthn.exec:\3tnthn.exe75⤵PID:2592
-
\??\c:\bhttbb.exec:\bhttbb.exe76⤵PID:1380
-
\??\c:\vpdjp.exec:\vpdjp.exe77⤵PID:2304
-
\??\c:\7rllxxf.exec:\7rllxxf.exe78⤵PID:2724
-
\??\c:\ttbtbb.exec:\ttbtbb.exe79⤵PID:2812
-
\??\c:\ddpjp.exec:\ddpjp.exe80⤵PID:2816
-
\??\c:\vpjjv.exec:\vpjjv.exe81⤵PID:2932
-
\??\c:\frxrffr.exec:\frxrffr.exe82⤵PID:2736
-
\??\c:\7tnbhb.exec:\7tnbhb.exe83⤵PID:2792
-
\??\c:\jjppv.exec:\jjppv.exe84⤵PID:2644
-
\??\c:\pdjvj.exec:\pdjvj.exe85⤵PID:2684
-
\??\c:\1rlrxrx.exec:\1rlrxrx.exe86⤵PID:2632
-
\??\c:\btbntt.exec:\btbntt.exe87⤵PID:2588
-
\??\c:\tntttb.exec:\tntttb.exe88⤵PID:1996
-
\??\c:\ppppd.exec:\ppppd.exe89⤵PID:668
-
\??\c:\xxflrxr.exec:\xxflrxr.exe90⤵PID:2716
-
\??\c:\nthntb.exec:\nthntb.exe91⤵PID:2164
-
\??\c:\nnttnh.exec:\nnttnh.exe92⤵PID:2908
-
\??\c:\jdjdj.exec:\jdjdj.exe93⤵PID:1632
-
\??\c:\rlffrrr.exec:\rlffrrr.exe94⤵PID:1288
-
\??\c:\tnttbb.exec:\tnttbb.exe95⤵PID:2680
-
\??\c:\5nnhtt.exec:\5nnhtt.exe96⤵PID:2852
-
\??\c:\dpvvp.exec:\dpvvp.exe97⤵PID:2880
-
\??\c:\rxffllr.exec:\rxffllr.exe98⤵PID:2172
-
\??\c:\lxrffrx.exec:\lxrffrx.exe99⤵PID:820
-
\??\c:\hbhnnn.exec:\hbhnnn.exe100⤵PID:2508
-
\??\c:\jjpdd.exec:\jjpdd.exe101⤵PID:908
-
\??\c:\fxfflfl.exec:\fxfflfl.exe102⤵PID:3040
-
\??\c:\rrxxlff.exec:\rrxxlff.exe103⤵PID:2236
-
\??\c:\hbnnbb.exec:\hbnnbb.exe104⤵PID:2428
-
\??\c:\dpjjp.exec:\dpjjp.exe105⤵PID:2136
-
\??\c:\vvdvv.exec:\vvdvv.exe106⤵PID:3032
-
\??\c:\fflrrxr.exec:\fflrrxr.exe107⤵PID:2404
-
\??\c:\ttttnb.exec:\ttttnb.exe108⤵PID:1988
-
\??\c:\5vjpp.exec:\5vjpp.exe109⤵PID:1804
-
\??\c:\rxrrxff.exec:\rxrrxff.exe110⤵PID:1860
-
\??\c:\rlxxfff.exec:\rlxxfff.exe111⤵PID:2408
-
\??\c:\ntbhtt.exec:\ntbhtt.exe112⤵PID:2432
-
\??\c:\ppddp.exec:\ppddp.exe113⤵PID:1684
-
\??\c:\xxfxxxr.exec:\xxfxxxr.exe114⤵PID:3068
-
\??\c:\5bbbnn.exec:\5bbbnn.exe115⤵PID:3016
-
\??\c:\tthnbb.exec:\tthnbb.exe116⤵PID:1848
-
\??\c:\9ppvd.exec:\9ppvd.exe117⤵PID:876
-
\??\c:\lrrrxfl.exec:\lrrrxfl.exe118⤵PID:2052
-
\??\c:\hbhhbn.exec:\hbhhbn.exe119⤵PID:1956
-
\??\c:\jjpvv.exec:\jjpvv.exe120⤵PID:2320
-
\??\c:\ddjjp.exec:\ddjjp.exe121⤵PID:2828
-
\??\c:\fxlrflr.exec:\fxlrflr.exe122⤵PID:2748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-