Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 00:37
Behavioral task
behavioral1
Sample
1f308ed69b170d54007e48160814b32b31744f5131cc8c754e2969d9714babc6N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
1f308ed69b170d54007e48160814b32b31744f5131cc8c754e2969d9714babc6N.exe
-
Size
97KB
-
MD5
d44c9356d68532bca2e01071945eb700
-
SHA1
28b000b72f37b6933324764a9e7b09d662b9de42
-
SHA256
1f308ed69b170d54007e48160814b32b31744f5131cc8c754e2969d9714babc6
-
SHA512
a701bb3375afd3fa755bdbb2170075564264890cfa84d282dfe9927c9eff42022432dc346654871e64ff936d8d68fd68b841128253f6cd13197f21ece5218a40
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzgl:8cm4FmowdHoSgWrXUgl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/2088-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2608-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2204-72-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2112-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1352-147-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2952-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1352-171-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1556-172-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1556-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/352-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1048-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2268-198-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2376-227-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2240-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2152-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-292-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2848-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-392-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1920-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/864-432-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2104-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-457-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2252-466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/752-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/752-469-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1616-480-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1616-479-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1940-506-0x00000000001C0000-0x00000000001E7000-memory.dmp family_blackmoon behavioral1/memory/2380-516-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2392-519-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/3052-541-0x00000000775F0000-0x000000007770F000-memory.dmp family_blackmoon behavioral1/memory/1772-548-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1568-552-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2004-655-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1520-779-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2484-794-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/1312-900-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1896-941-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3052-21061-0x00000000775F0000-0x000000007770F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2696 nnbnbh.exe 2708 jvjdd.exe 2864 xrrfllx.exe 2608 3nbhhb.exe 2904 bnbbbh.exe 2828 1nnbbb.exe 2596 5jjvp.exe 2204 5vppd.exe 2196 lxllffr.exe 2112 rlxlrxf.exe 2488 bnhnhh.exe 2520 1hthhh.exe 2940 pjppj.exe 2000 vjjvj.exe 2896 dpdpj.exe 1920 frfflll.exe 1352 xrfxfrr.exe 2952 nbbhtn.exe 1608 pdvjj.exe 1556 9thtbb.exe 352 jdpvd.exe 1048 fxlrrxl.exe 2268 dvpvd.exe 2176 7vjjj.exe 1480 xrfrxfl.exe 1840 hbbbnt.exe 2376 vpdjv.exe 984 9xxlflx.exe 2064 xrxlrrx.exe 3032 9bhbnn.exe 1844 vpppd.exe 2072 7lfllrx.exe 268 xrlrxfr.exe 2240 htbhhh.exe 2152 nnhbbh.exe 1600 pjvvd.exe 2164 lfrfrlx.exe 2848 rlfrxrr.exe 2756 tththt.exe 2864 3vjjp.exe 2944 vpdvv.exe 2776 fxlrrxf.exe 2616 nhtbhn.exe 2716 5tthtb.exe 2612 dpvvd.exe 2020 lrllrlx.exe 2724 bnbnhn.exe 2196 httnhn.exe 1720 jdddv.exe 2180 1pjdd.exe 2312 xlxlrlr.exe 1448 rfxflfl.exe 2352 nhtnhh.exe 1972 vjjdp.exe 2344 jvjvd.exe 1928 dvjdv.exe 840 ffxlrfl.exe 1920 htbhnn.exe 864 5jvjj.exe 1084 vjvdv.exe 2952 xxlfxxl.exe 1332 flxxlrr.exe 1504 hbhtbh.exe 3020 nbntbh.exe -
resource yara_rule behavioral1/memory/2088-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2088-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001211a-7.dat upx behavioral1/memory/2696-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2696-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000161f6-16.dat upx behavioral1/memory/2864-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016307-26.dat upx behavioral1/memory/2708-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016aa9-52.dat upx behavioral1/memory/2904-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001658c-35.dat upx behavioral1/files/0x0007000000016855-44.dat upx behavioral1/memory/2864-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2608-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2596-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c62-61.dat upx behavioral1/memory/2828-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173f1-85.dat upx behavioral1/memory/2196-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000173da-77.dat upx behavioral1/files/0x0008000000016c84-69.dat upx behavioral1/files/0x00060000000173f4-94.dat upx behavioral1/memory/2112-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173fc-101.dat upx behavioral1/memory/2940-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017472-109.dat upx behavioral1/memory/2520-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174a2-126.dat upx behavioral1/files/0x0006000000017487-117.dat upx behavioral1/memory/2000-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017525-133.dat upx behavioral1/memory/1920-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0014000000018663-141.dat upx behavioral1/files/0x000d00000001866e-148.dat upx behavioral1/memory/2952-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018687-155.dat upx behavioral1/memory/1608-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018792-164.dat upx behavioral1/memory/1556-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018c1a-173.dat upx behavioral1/files/0x0006000000018c26-182.dat upx behavioral1/memory/352-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018f53-189.dat upx behavioral1/memory/1048-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2268-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001903b-199.dat upx behavioral1/files/0x00060000000190ce-206.dat upx behavioral1/files/0x00060000000190e0-213.dat upx behavioral1/files/0x00050000000191d4-220.dat upx behavioral1/files/0x00050000000191ff-228.dat upx behavioral1/files/0x000500000001922c-235.dat upx behavioral1/files/0x0005000000019244-243.dat upx behavioral1/files/0x0036000000015f81-250.dat upx behavioral1/files/0x0005000000019256-257.dat upx behavioral1/memory/2240-274-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2152-280-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1600-287-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2164-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1600-288-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2848-301-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2724-350-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1720-361-0x0000000000220000-0x0000000000247000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2696 2088 1f308ed69b170d54007e48160814b32b31744f5131cc8c754e2969d9714babc6N.exe 30 PID 2088 wrote to memory of 2696 2088 1f308ed69b170d54007e48160814b32b31744f5131cc8c754e2969d9714babc6N.exe 30 PID 2088 wrote to memory of 2696 2088 1f308ed69b170d54007e48160814b32b31744f5131cc8c754e2969d9714babc6N.exe 30 PID 2088 wrote to memory of 2696 2088 1f308ed69b170d54007e48160814b32b31744f5131cc8c754e2969d9714babc6N.exe 30 PID 2696 wrote to memory of 2708 2696 nnbnbh.exe 31 PID 2696 wrote to memory of 2708 2696 nnbnbh.exe 31 PID 2696 wrote to memory of 2708 2696 nnbnbh.exe 31 PID 2696 wrote to memory of 2708 2696 nnbnbh.exe 31 PID 2708 wrote to memory of 2864 2708 jvjdd.exe 32 PID 2708 wrote to memory of 2864 2708 jvjdd.exe 32 PID 2708 wrote to memory of 2864 2708 jvjdd.exe 32 PID 2708 wrote to memory of 2864 2708 jvjdd.exe 32 PID 2864 wrote to memory of 2608 2864 xrrfllx.exe 33 PID 2864 wrote to memory of 2608 2864 xrrfllx.exe 33 PID 2864 wrote to memory of 2608 2864 xrrfllx.exe 33 PID 2864 wrote to memory of 2608 2864 xrrfllx.exe 33 PID 2608 wrote to memory of 2904 2608 3nbhhb.exe 34 PID 2608 wrote to memory of 2904 2608 3nbhhb.exe 34 PID 2608 wrote to memory of 2904 2608 3nbhhb.exe 34 PID 2608 wrote to memory of 2904 2608 3nbhhb.exe 34 PID 2904 wrote to memory of 2828 2904 bnbbbh.exe 35 PID 2904 wrote to memory of 2828 2904 bnbbbh.exe 35 PID 2904 wrote to memory of 2828 2904 bnbbbh.exe 35 PID 2904 wrote to memory of 2828 2904 bnbbbh.exe 35 PID 2828 wrote to memory of 2596 2828 1nnbbb.exe 36 PID 2828 wrote to memory of 2596 2828 1nnbbb.exe 36 PID 2828 wrote to memory of 2596 2828 1nnbbb.exe 36 PID 2828 wrote to memory of 2596 2828 1nnbbb.exe 36 PID 2596 wrote to memory of 2204 2596 5jjvp.exe 37 PID 2596 wrote to memory of 2204 2596 5jjvp.exe 37 PID 2596 wrote to memory of 2204 2596 5jjvp.exe 37 PID 2596 wrote to memory of 2204 2596 5jjvp.exe 37 PID 2204 wrote to memory of 2196 2204 5vppd.exe 38 PID 2204 wrote to memory of 2196 2204 5vppd.exe 38 PID 2204 wrote to memory of 2196 2204 5vppd.exe 38 PID 2204 wrote to memory of 2196 2204 5vppd.exe 38 PID 2196 wrote to memory of 2112 2196 lxllffr.exe 39 PID 2196 wrote to memory of 2112 2196 lxllffr.exe 39 PID 2196 wrote to memory of 2112 2196 lxllffr.exe 39 PID 2196 wrote to memory of 2112 2196 lxllffr.exe 39 PID 2112 wrote to memory of 2488 2112 rlxlrxf.exe 40 PID 2112 wrote to memory of 2488 2112 rlxlrxf.exe 40 PID 2112 wrote to memory of 2488 2112 rlxlrxf.exe 40 PID 2112 wrote to memory of 2488 2112 rlxlrxf.exe 40 PID 2488 wrote to memory of 2520 2488 bnhnhh.exe 41 PID 2488 wrote to memory of 2520 2488 bnhnhh.exe 41 PID 2488 wrote to memory of 2520 2488 bnhnhh.exe 41 PID 2488 wrote to memory of 2520 2488 bnhnhh.exe 41 PID 2520 wrote to memory of 2940 2520 1hthhh.exe 42 PID 2520 wrote to memory of 2940 2520 1hthhh.exe 42 PID 2520 wrote to memory of 2940 2520 1hthhh.exe 42 PID 2520 wrote to memory of 2940 2520 1hthhh.exe 42 PID 2940 wrote to memory of 2000 2940 pjppj.exe 43 PID 2940 wrote to memory of 2000 2940 pjppj.exe 43 PID 2940 wrote to memory of 2000 2940 pjppj.exe 43 PID 2940 wrote to memory of 2000 2940 pjppj.exe 43 PID 2000 wrote to memory of 2896 2000 vjjvj.exe 44 PID 2000 wrote to memory of 2896 2000 vjjvj.exe 44 PID 2000 wrote to memory of 2896 2000 vjjvj.exe 44 PID 2000 wrote to memory of 2896 2000 vjjvj.exe 44 PID 2896 wrote to memory of 1920 2896 dpdpj.exe 45 PID 2896 wrote to memory of 1920 2896 dpdpj.exe 45 PID 2896 wrote to memory of 1920 2896 dpdpj.exe 45 PID 2896 wrote to memory of 1920 2896 dpdpj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f308ed69b170d54007e48160814b32b31744f5131cc8c754e2969d9714babc6N.exe"C:\Users\Admin\AppData\Local\Temp\1f308ed69b170d54007e48160814b32b31744f5131cc8c754e2969d9714babc6N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\nnbnbh.exec:\nnbnbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\jvjdd.exec:\jvjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\xrrfllx.exec:\xrrfllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\3nbhhb.exec:\3nbhhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\bnbbbh.exec:\bnbbbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\1nnbbb.exec:\1nnbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\5jjvp.exec:\5jjvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\5vppd.exec:\5vppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\lxllffr.exec:\lxllffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\rlxlrxf.exec:\rlxlrxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\bnhnhh.exec:\bnhnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\1hthhh.exec:\1hthhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\pjppj.exec:\pjppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\vjjvj.exec:\vjjvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\dpdpj.exec:\dpdpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\frfflll.exec:\frfflll.exe17⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xrfxfrr.exec:\xrfxfrr.exe18⤵
- Executes dropped EXE
PID:1352 -
\??\c:\nbbhtn.exec:\nbbhtn.exe19⤵
- Executes dropped EXE
PID:2952 -
\??\c:\pdvjj.exec:\pdvjj.exe20⤵
- Executes dropped EXE
PID:1608 -
\??\c:\9thtbb.exec:\9thtbb.exe21⤵
- Executes dropped EXE
PID:1556 -
\??\c:\jdpvd.exec:\jdpvd.exe22⤵
- Executes dropped EXE
PID:352 -
\??\c:\fxlrrxl.exec:\fxlrrxl.exe23⤵
- Executes dropped EXE
PID:1048 -
\??\c:\dvpvd.exec:\dvpvd.exe24⤵
- Executes dropped EXE
PID:2268 -
\??\c:\7vjjj.exec:\7vjjj.exe25⤵
- Executes dropped EXE
PID:2176 -
\??\c:\xrfrxfl.exec:\xrfrxfl.exe26⤵
- Executes dropped EXE
PID:1480 -
\??\c:\hbbbnt.exec:\hbbbnt.exe27⤵
- Executes dropped EXE
PID:1840 -
\??\c:\vpdjv.exec:\vpdjv.exe28⤵
- Executes dropped EXE
PID:2376 -
\??\c:\9xxlflx.exec:\9xxlflx.exe29⤵
- Executes dropped EXE
PID:984 -
\??\c:\xrxlrrx.exec:\xrxlrrx.exe30⤵
- Executes dropped EXE
PID:2064 -
\??\c:\9bhbnn.exec:\9bhbnn.exe31⤵
- Executes dropped EXE
PID:3032 -
\??\c:\vpppd.exec:\vpppd.exe32⤵
- Executes dropped EXE
PID:1844 -
\??\c:\7lfllrx.exec:\7lfllrx.exe33⤵
- Executes dropped EXE
PID:2072 -
\??\c:\xrlrxfr.exec:\xrlrxfr.exe34⤵
- Executes dropped EXE
PID:268 -
\??\c:\htbhhh.exec:\htbhhh.exe35⤵
- Executes dropped EXE
PID:2240 -
\??\c:\nnhbbh.exec:\nnhbbh.exe36⤵
- Executes dropped EXE
PID:2152 -
\??\c:\pjvvd.exec:\pjvvd.exe37⤵
- Executes dropped EXE
PID:1600 -
\??\c:\lfrfrlx.exec:\lfrfrlx.exe38⤵
- Executes dropped EXE
PID:2164 -
\??\c:\rlfrxrr.exec:\rlfrxrr.exe39⤵
- Executes dropped EXE
PID:2848 -
\??\c:\tththt.exec:\tththt.exe40⤵
- Executes dropped EXE
PID:2756 -
\??\c:\3vjjp.exec:\3vjjp.exe41⤵
- Executes dropped EXE
PID:2864 -
\??\c:\vpdvv.exec:\vpdvv.exe42⤵
- Executes dropped EXE
PID:2944 -
\??\c:\fxlrrxf.exec:\fxlrrxf.exe43⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nhtbhn.exec:\nhtbhn.exe44⤵
- Executes dropped EXE
PID:2616 -
\??\c:\5tthtb.exec:\5tthtb.exe45⤵
- Executes dropped EXE
PID:2716 -
\??\c:\dpvvd.exec:\dpvvd.exe46⤵
- Executes dropped EXE
PID:2612 -
\??\c:\lrllrlx.exec:\lrllrlx.exe47⤵
- Executes dropped EXE
PID:2020 -
\??\c:\bnbnhn.exec:\bnbnhn.exe48⤵
- Executes dropped EXE
PID:2724 -
\??\c:\httnhn.exec:\httnhn.exe49⤵
- Executes dropped EXE
PID:2196 -
\??\c:\jdddv.exec:\jdddv.exe50⤵
- Executes dropped EXE
PID:1720 -
\??\c:\1pjdd.exec:\1pjdd.exe51⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xlxlrlr.exec:\xlxlrlr.exe52⤵
- Executes dropped EXE
PID:2312 -
\??\c:\rfxflfl.exec:\rfxflfl.exe53⤵
- Executes dropped EXE
PID:1448 -
\??\c:\nhtnhh.exec:\nhtnhh.exe54⤵
- Executes dropped EXE
PID:2352 -
\??\c:\vjjdp.exec:\vjjdp.exe55⤵
- Executes dropped EXE
PID:1972 -
\??\c:\jvjvd.exec:\jvjvd.exe56⤵
- Executes dropped EXE
PID:2344 -
\??\c:\dvjdv.exec:\dvjdv.exe57⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ffxlrfl.exec:\ffxlrfl.exe58⤵
- Executes dropped EXE
PID:840 -
\??\c:\htbhnn.exec:\htbhnn.exe59⤵
- Executes dropped EXE
PID:1920 -
\??\c:\5jvjj.exec:\5jvjj.exe60⤵
- Executes dropped EXE
PID:864 -
\??\c:\vjvdv.exec:\vjvdv.exe61⤵
- Executes dropped EXE
PID:1084 -
\??\c:\xxlfxxl.exec:\xxlfxxl.exe62⤵
- Executes dropped EXE
PID:2952 -
\??\c:\flxxlrr.exec:\flxxlrr.exe63⤵
- Executes dropped EXE
PID:1332 -
\??\c:\hbhtbh.exec:\hbhtbh.exe64⤵
- Executes dropped EXE
PID:1504 -
\??\c:\nbntbh.exec:\nbntbh.exe65⤵
- Executes dropped EXE
PID:3020 -
\??\c:\7vvjd.exec:\7vvjd.exe66⤵PID:2456
-
\??\c:\dpdjv.exec:\dpdjv.exe67⤵PID:2104
-
\??\c:\frfllrr.exec:\frfllrr.exe68⤵PID:3008
-
\??\c:\lxlrrrr.exec:\lxlrrrr.exe69⤵
- System Location Discovery: System Language Discovery
PID:2252 -
\??\c:\nhtbtt.exec:\nhtbtt.exe70⤵PID:752
-
\??\c:\bnbhnn.exec:\bnbhnn.exe71⤵PID:1616
-
\??\c:\dpdpj.exec:\dpdpj.exe72⤵PID:1688
-
\??\c:\xrxrffl.exec:\xrxrffl.exe73⤵PID:628
-
\??\c:\5rxlrxf.exec:\5rxlrxf.exe74⤵PID:2528
-
\??\c:\bntnhh.exec:\bntnhh.exe75⤵PID:1052
-
\??\c:\7tbhnb.exec:\7tbhnb.exe76⤵PID:1940
-
\??\c:\1pdjp.exec:\1pdjp.exe77⤵PID:2380
-
\??\c:\xrrxflr.exec:\xrrxflr.exe78⤵PID:2392
-
\??\c:\5xxfrxx.exec:\5xxfrxx.exe79⤵PID:1736
-
\??\c:\nbhnnt.exec:\nbhnnt.exe80⤵PID:2208
-
\??\c:\nbnhhn.exec:\nbnhhn.exe81⤵PID:2316
-
\??\c:\7jjpd.exec:\7jjpd.exe82⤵PID:3052
-
\??\c:\1dpjj.exec:\1dpjj.exe83⤵PID:1772
-
\??\c:\5hnntt.exec:\5hnntt.exe84⤵PID:1568
-
\??\c:\1jvdj.exec:\1jvdj.exe85⤵PID:2752
-
\??\c:\3fxrxrl.exec:\3fxrxrl.exe86⤵PID:2844
-
\??\c:\lfrrxxx.exec:\lfrrxxx.exe87⤵PID:2860
-
\??\c:\5xrxlll.exec:\5xrxlll.exe88⤵PID:2876
-
\??\c:\3nbtnh.exec:\3nbtnh.exe89⤵PID:2944
-
\??\c:\dvjjj.exec:\dvjjj.exe90⤵PID:2668
-
\??\c:\pddpd.exec:\pddpd.exe91⤵PID:2796
-
\??\c:\7xxxllx.exec:\7xxxllx.exe92⤵PID:1836
-
\??\c:\xllflrf.exec:\xllflrf.exe93⤵PID:2276
-
\??\c:\thttbh.exec:\thttbh.exe94⤵PID:3048
-
\??\c:\ddjpd.exec:\ddjpd.exe95⤵PID:2452
-
\??\c:\vvdjv.exec:\vvdjv.exe96⤵PID:2196
-
\??\c:\xlllrxf.exec:\xlllrxf.exe97⤵PID:2972
-
\??\c:\frflrrr.exec:\frflrrr.exe98⤵PID:2472
-
\??\c:\hbbtnn.exec:\hbbtnn.exe99⤵PID:2932
-
\??\c:\hbhnbh.exec:\hbhnbh.exe100⤵PID:2004
-
\??\c:\vpvvv.exec:\vpvvv.exe101⤵PID:1492
-
\??\c:\5vvpp.exec:\5vvpp.exe102⤵PID:1972
-
\??\c:\9rffffl.exec:\9rffffl.exe103⤵PID:2664
-
\??\c:\5ffxflr.exec:\5ffxflr.exe104⤵PID:1924
-
\??\c:\1hnnnt.exec:\1hnnnt.exe105⤵PID:2924
-
\??\c:\7dvvp.exec:\7dvvp.exe106⤵PID:2928
-
\??\c:\dpvpp.exec:\dpvpp.exe107⤵PID:864
-
\??\c:\xrrrllr.exec:\xrrrllr.exe108⤵PID:572
-
\??\c:\7lxxxff.exec:\7lxxxff.exe109⤵PID:1748
-
\??\c:\tntbbh.exec:\tntbbh.exe110⤵PID:1328
-
\??\c:\7htbbh.exec:\7htbbh.exe111⤵PID:1504
-
\??\c:\vpppp.exec:\vpppp.exe112⤵PID:1768
-
\??\c:\7vvjp.exec:\7vvjp.exe113⤵PID:2236
-
\??\c:\jdjvj.exec:\jdjvj.exe114⤵PID:2792
-
\??\c:\5fxxxfl.exec:\5fxxxfl.exe115⤵PID:2172
-
\??\c:\1rllrrr.exec:\1rllrrr.exe116⤵PID:600
-
\??\c:\5htthn.exec:\5htthn.exe117⤵PID:2428
-
\??\c:\nbbntn.exec:\nbbntn.exe118⤵PID:2400
-
\??\c:\pjppv.exec:\pjppv.exe119⤵PID:1756
-
\??\c:\ddpjp.exec:\ddpjp.exe120⤵PID:1688
-
\??\c:\1xfrxfx.exec:\1xfrxfx.exe121⤵PID:2872
-
\??\c:\fxllllr.exec:\fxllllr.exe122⤵PID:2868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-