Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 01:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a8543637e704976244542bbb8d99ac306070c68160a562540ac4b9b101132659N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a8543637e704976244542bbb8d99ac306070c68160a562540ac4b9b101132659N.exe
-
Size
453KB
-
MD5
61b00eb098a5eef8c13c0b6d73b706d0
-
SHA1
0e9c63fa4b9c74dc77421e2af9cd936173d321c0
-
SHA256
a8543637e704976244542bbb8d99ac306070c68160a562540ac4b9b101132659
-
SHA512
81df39cd04a071d7876cd198328a34749d243d05a6ee2232f1e23d0940fb9d691ce116dfdce7d728054a3c021cc48a688c0f94074c1971fd69f1313edd92615e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbel:q7Tc2NYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/1624-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-37-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2284-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/344-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-400-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2480-539-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2832-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-803-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/864-1172-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/2452-1076-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1672-1022-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-1013-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-919-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2684-866-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2092-777-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/328-684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-558-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2128-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/684-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1180-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1180-155-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2052-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-133-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2556-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-1337-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2300 dpvjp.exe 604 ffxrxfl.exe 2424 nbhhbt.exe 2704 dpjdp.exe 2820 5xlrlll.exe 2792 hhnhhb.exe 2832 1ddvp.exe 2284 lfxllfl.exe 2556 bntttt.exe 344 nbhhhh.exe 700 9jpjj.exe 2864 fxllllr.exe 864 7bhhth.exe 320 9djjj.exe 2052 xllflll.exe 1180 bthbnh.exe 1436 7dppp.exe 2116 1pvpp.exe 2596 rflrxrx.exe 684 bthntn.exe 2200 hbntbb.exe 1060 jdjdj.exe 2180 9xfxxrr.exe 1244 5llffff.exe 2988 vdvpv.exe 1536 lfllrrr.exe 3016 xlxflff.exe 2368 btbbhh.exe 3000 7djdd.exe 1764 9lfrrll.exe 2276 7rfllll.exe 1676 djdpv.exe 2080 jpdvd.exe 2452 nnttbt.exe 2412 hthhhb.exe 2752 jdjdj.exe 2712 3lxxxrr.exe 2968 xlrlxrr.exe 2780 9bnnnh.exe 2652 btttbn.exe 2728 vpvjp.exe 2568 3lrrxxf.exe 2556 tnnttn.exe 1156 nhhhth.exe 1028 hnhbtt.exe 1220 vdpjp.exe 2876 3xxrrxr.exe 2636 5frlllf.exe 320 bnbbbt.exe 1196 httntt.exe 1504 jvjdp.exe 1784 1lffxxx.exe 1644 llffflr.exe 468 hthnnn.exe 2596 nnnnht.exe 112 djvpv.exe 2656 jpvjp.exe 1636 rflfffl.exe 2612 frxrxrf.exe 908 nhnhnn.exe 1720 5ntntn.exe 2972 vpddd.exe 1264 pdpjp.exe 3032 3frffrx.exe -
resource yara_rule behavioral1/memory/1624-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-981-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-1159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-1172-0x0000000001C80000-0x0000000001CAA000-memory.dmp upx behavioral1/memory/1504-1203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-1022-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-1013-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-1344-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bththb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhhb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1624 wrote to memory of 2300 1624 a8543637e704976244542bbb8d99ac306070c68160a562540ac4b9b101132659N.exe 31 PID 1624 wrote to memory of 2300 1624 a8543637e704976244542bbb8d99ac306070c68160a562540ac4b9b101132659N.exe 31 PID 1624 wrote to memory of 2300 1624 a8543637e704976244542bbb8d99ac306070c68160a562540ac4b9b101132659N.exe 31 PID 1624 wrote to memory of 2300 1624 a8543637e704976244542bbb8d99ac306070c68160a562540ac4b9b101132659N.exe 31 PID 2300 wrote to memory of 604 2300 dpvjp.exe 102 PID 2300 wrote to memory of 604 2300 dpvjp.exe 102 PID 2300 wrote to memory of 604 2300 dpvjp.exe 102 PID 2300 wrote to memory of 604 2300 dpvjp.exe 102 PID 604 wrote to memory of 2424 604 ffxrxfl.exe 186 PID 604 wrote to memory of 2424 604 ffxrxfl.exe 186 PID 604 wrote to memory of 2424 604 ffxrxfl.exe 186 PID 604 wrote to memory of 2424 604 ffxrxfl.exe 186 PID 2424 wrote to memory of 2704 2424 nbhhbt.exe 34 PID 2424 wrote to memory of 2704 2424 nbhhbt.exe 34 PID 2424 wrote to memory of 2704 2424 nbhhbt.exe 34 PID 2424 wrote to memory of 2704 2424 nbhhbt.exe 34 PID 2704 wrote to memory of 2820 2704 dpjdp.exe 35 PID 2704 wrote to memory of 2820 2704 dpjdp.exe 35 PID 2704 wrote to memory of 2820 2704 dpjdp.exe 35 PID 2704 wrote to memory of 2820 2704 dpjdp.exe 35 PID 2820 wrote to memory of 2792 2820 5xlrlll.exe 36 PID 2820 wrote to memory of 2792 2820 5xlrlll.exe 36 PID 2820 wrote to memory of 2792 2820 5xlrlll.exe 36 PID 2820 wrote to memory of 2792 2820 5xlrlll.exe 36 PID 2792 wrote to memory of 2832 2792 hhnhhb.exe 37 PID 2792 wrote to memory of 2832 2792 hhnhhb.exe 37 PID 2792 wrote to memory of 2832 2792 hhnhhb.exe 37 PID 2792 wrote to memory of 2832 2792 hhnhhb.exe 37 PID 2832 wrote to memory of 2284 2832 1ddvp.exe 38 PID 2832 wrote to memory of 2284 2832 1ddvp.exe 38 PID 2832 wrote to memory of 2284 2832 1ddvp.exe 38 PID 2832 wrote to memory of 2284 2832 1ddvp.exe 38 PID 2284 wrote to memory of 2556 2284 lfxllfl.exe 39 PID 2284 wrote to memory of 2556 2284 lfxllfl.exe 39 PID 2284 wrote to memory of 2556 2284 lfxllfl.exe 39 PID 2284 wrote to memory of 2556 2284 lfxllfl.exe 39 PID 2556 wrote to memory of 344 2556 bntttt.exe 40 PID 2556 wrote to memory of 344 2556 bntttt.exe 40 PID 2556 wrote to memory of 344 2556 bntttt.exe 40 PID 2556 wrote to memory of 344 2556 bntttt.exe 40 PID 344 wrote to memory of 700 344 nbhhhh.exe 41 PID 344 wrote to memory of 700 344 nbhhhh.exe 41 PID 344 wrote to memory of 700 344 nbhhhh.exe 41 PID 344 wrote to memory of 700 344 nbhhhh.exe 41 PID 700 wrote to memory of 2864 700 9jpjj.exe 42 PID 700 wrote to memory of 2864 700 9jpjj.exe 42 PID 700 wrote to memory of 2864 700 9jpjj.exe 42 PID 700 wrote to memory of 2864 700 9jpjj.exe 42 PID 2864 wrote to memory of 864 2864 fxllllr.exe 43 PID 2864 wrote to memory of 864 2864 fxllllr.exe 43 PID 2864 wrote to memory of 864 2864 fxllllr.exe 43 PID 2864 wrote to memory of 864 2864 fxllllr.exe 43 PID 864 wrote to memory of 320 864 7bhhth.exe 79 PID 864 wrote to memory of 320 864 7bhhth.exe 79 PID 864 wrote to memory of 320 864 7bhhth.exe 79 PID 864 wrote to memory of 320 864 7bhhth.exe 79 PID 320 wrote to memory of 2052 320 9djjj.exe 45 PID 320 wrote to memory of 2052 320 9djjj.exe 45 PID 320 wrote to memory of 2052 320 9djjj.exe 45 PID 320 wrote to memory of 2052 320 9djjj.exe 45 PID 2052 wrote to memory of 1180 2052 xllflll.exe 46 PID 2052 wrote to memory of 1180 2052 xllflll.exe 46 PID 2052 wrote to memory of 1180 2052 xllflll.exe 46 PID 2052 wrote to memory of 1180 2052 xllflll.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8543637e704976244542bbb8d99ac306070c68160a562540ac4b9b101132659N.exe"C:\Users\Admin\AppData\Local\Temp\a8543637e704976244542bbb8d99ac306070c68160a562540ac4b9b101132659N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\dpvjp.exec:\dpvjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\ffxrxfl.exec:\ffxrxfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\nbhhbt.exec:\nbhhbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\dpjdp.exec:\dpjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\5xlrlll.exec:\5xlrlll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\hhnhhb.exec:\hhnhhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\1ddvp.exec:\1ddvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\lfxllfl.exec:\lfxllfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\bntttt.exec:\bntttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\nbhhhh.exec:\nbhhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\9jpjj.exec:\9jpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\fxllllr.exec:\fxllllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\7bhhth.exec:\7bhhth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\9djjj.exec:\9djjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\xllflll.exec:\xllflll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\bthbnh.exec:\bthbnh.exe17⤵
- Executes dropped EXE
PID:1180 -
\??\c:\7dppp.exec:\7dppp.exe18⤵
- Executes dropped EXE
PID:1436 -
\??\c:\1pvpp.exec:\1pvpp.exe19⤵
- Executes dropped EXE
PID:2116 -
\??\c:\rflrxrx.exec:\rflrxrx.exe20⤵
- Executes dropped EXE
PID:2596 -
\??\c:\bthntn.exec:\bthntn.exe21⤵
- Executes dropped EXE
PID:684 -
\??\c:\hbntbb.exec:\hbntbb.exe22⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jdjdj.exec:\jdjdj.exe23⤵
- Executes dropped EXE
PID:1060 -
\??\c:\9xfxxrr.exec:\9xfxxrr.exe24⤵
- Executes dropped EXE
PID:2180 -
\??\c:\5llffff.exec:\5llffff.exe25⤵
- Executes dropped EXE
PID:1244 -
\??\c:\vdvpv.exec:\vdvpv.exe26⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lfllrrr.exec:\lfllrrr.exe27⤵
- Executes dropped EXE
PID:1536 -
\??\c:\xlxflff.exec:\xlxflff.exe28⤵
- Executes dropped EXE
PID:3016 -
\??\c:\btbbhh.exec:\btbbhh.exe29⤵
- Executes dropped EXE
PID:2368 -
\??\c:\7djdd.exec:\7djdd.exe30⤵
- Executes dropped EXE
PID:3000 -
\??\c:\9lfrrll.exec:\9lfrrll.exe31⤵
- Executes dropped EXE
PID:1764 -
\??\c:\7rfllll.exec:\7rfllll.exe32⤵
- Executes dropped EXE
PID:2276 -
\??\c:\djdpv.exec:\djdpv.exe33⤵
- Executes dropped EXE
PID:1676 -
\??\c:\jpdvd.exec:\jpdvd.exe34⤵
- Executes dropped EXE
PID:2080 -
\??\c:\nnttbt.exec:\nnttbt.exe35⤵
- Executes dropped EXE
PID:2452 -
\??\c:\hthhhb.exec:\hthhhb.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2412 -
\??\c:\jdjdj.exec:\jdjdj.exe37⤵
- Executes dropped EXE
PID:2752 -
\??\c:\3lxxxrr.exec:\3lxxxrr.exe38⤵
- Executes dropped EXE
PID:2712 -
\??\c:\xlrlxrr.exec:\xlrlxrr.exe39⤵
- Executes dropped EXE
PID:2968 -
\??\c:\9bnnnh.exec:\9bnnnh.exe40⤵
- Executes dropped EXE
PID:2780 -
\??\c:\btttbn.exec:\btttbn.exe41⤵
- Executes dropped EXE
PID:2652 -
\??\c:\vpvjp.exec:\vpvjp.exe42⤵
- Executes dropped EXE
PID:2728 -
\??\c:\3lrrxxf.exec:\3lrrxxf.exe43⤵
- Executes dropped EXE
PID:2568 -
\??\c:\tnnttn.exec:\tnnttn.exe44⤵
- Executes dropped EXE
PID:2556 -
\??\c:\nhhhth.exec:\nhhhth.exe45⤵
- Executes dropped EXE
PID:1156 -
\??\c:\hnhbtt.exec:\hnhbtt.exe46⤵
- Executes dropped EXE
PID:1028 -
\??\c:\vdpjp.exec:\vdpjp.exe47⤵
- Executes dropped EXE
PID:1220 -
\??\c:\3xxrrxr.exec:\3xxrrxr.exe48⤵
- Executes dropped EXE
PID:2876 -
\??\c:\5frlllf.exec:\5frlllf.exe49⤵
- Executes dropped EXE
PID:2636 -
\??\c:\bnbbbt.exec:\bnbbbt.exe50⤵
- Executes dropped EXE
PID:320 -
\??\c:\httntt.exec:\httntt.exe51⤵
- Executes dropped EXE
PID:1196 -
\??\c:\jvjdp.exec:\jvjdp.exe52⤵
- Executes dropped EXE
PID:1504 -
\??\c:\1lffxxx.exec:\1lffxxx.exe53⤵
- Executes dropped EXE
PID:1784 -
\??\c:\llffflr.exec:\llffflr.exe54⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hthnnn.exec:\hthnnn.exe55⤵
- Executes dropped EXE
PID:468 -
\??\c:\nnnnht.exec:\nnnnht.exe56⤵
- Executes dropped EXE
PID:2596 -
\??\c:\djvpv.exec:\djvpv.exe57⤵
- Executes dropped EXE
PID:112 -
\??\c:\jpvjp.exec:\jpvjp.exe58⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rflfffl.exec:\rflfffl.exe59⤵
- Executes dropped EXE
PID:1636 -
\??\c:\frxrxrf.exec:\frxrxrf.exe60⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nhnhnn.exec:\nhnhnn.exe61⤵
- Executes dropped EXE
PID:908 -
\??\c:\5ntntn.exec:\5ntntn.exe62⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vpddd.exec:\vpddd.exe63⤵
- Executes dropped EXE
PID:2972 -
\??\c:\pdpjp.exec:\pdpjp.exe64⤵
- Executes dropped EXE
PID:1264 -
\??\c:\3frffrx.exec:\3frffrx.exe65⤵
- Executes dropped EXE
PID:3032 -
\??\c:\rflrllf.exec:\rflrllf.exe66⤵PID:1776
-
\??\c:\nhnntt.exec:\nhnntt.exe67⤵PID:2128
-
\??\c:\thnnnh.exec:\thnnnh.exe68⤵PID:580
-
\??\c:\jvdvv.exec:\jvdvv.exe69⤵PID:2916
-
\??\c:\djjvv.exec:\djjvv.exe70⤵PID:2012
-
\??\c:\lxrrllr.exec:\lxrrllr.exe71⤵PID:2480
-
\??\c:\xlxxxfl.exec:\xlxxxfl.exe72⤵PID:1680
-
\??\c:\9tbttn.exec:\9tbttn.exe73⤵PID:604
-
\??\c:\hnbnnb.exec:\hnbnnb.exe74⤵PID:2020
-
\??\c:\9pvdv.exec:\9pvdv.exe75⤵PID:2708
-
\??\c:\5jjjd.exec:\5jjjd.exe76⤵PID:2880
-
\??\c:\lxfffxf.exec:\lxfffxf.exe77⤵PID:2504
-
\??\c:\rlrxrlf.exec:\rlrxrlf.exe78⤵PID:2760
-
\??\c:\bbnhnh.exec:\bbnhnh.exe79⤵PID:2692
-
\??\c:\hthhnh.exec:\hthhnh.exe80⤵PID:2832
-
\??\c:\7dpdd.exec:\7dpdd.exe81⤵PID:2688
-
\??\c:\5pjdd.exec:\5pjdd.exe82⤵PID:1476
-
\??\c:\jppdp.exec:\jppdp.exe83⤵PID:2784
-
\??\c:\7frfffx.exec:\7frfffx.exe84⤵PID:3060
-
\??\c:\rflffxf.exec:\rflffxf.exe85⤵PID:2940
-
\??\c:\bnthtn.exec:\bnthtn.exe86⤵PID:2924
-
\??\c:\dpvpv.exec:\dpvpv.exe87⤵PID:2620
-
\??\c:\dvjpv.exec:\dvjpv.exe88⤵PID:2900
-
\??\c:\xxllllr.exec:\xxllllr.exe89⤵PID:1996
-
\??\c:\nbbhhh.exec:\nbbhhh.exe90⤵PID:2636
-
\??\c:\5bnhhh.exec:\5bnhhh.exe91⤵PID:320
-
\??\c:\httnbt.exec:\httnbt.exe92⤵PID:848
-
\??\c:\7pjdv.exec:\7pjdv.exe93⤵PID:1504
-
\??\c:\jpjvj.exec:\jpjvj.exe94⤵PID:328
-
\??\c:\7lxrxxf.exec:\7lxrxxf.exe95⤵PID:2240
-
\??\c:\bthbbt.exec:\bthbbt.exe96⤵PID:2608
-
\??\c:\nbtttt.exec:\nbtttt.exe97⤵PID:2244
-
\??\c:\5pddd.exec:\5pddd.exe98⤵PID:1900
-
\??\c:\9jddd.exec:\9jddd.exe99⤵PID:3036
-
\??\c:\rfllfxf.exec:\rfllfxf.exe100⤵PID:988
-
\??\c:\3lxffff.exec:\3lxffff.exe101⤵PID:1592
-
\??\c:\ttnbnn.exec:\ttnbnn.exe102⤵PID:2364
-
\??\c:\bttbnn.exec:\bttbnn.exe103⤵PID:1964
-
\??\c:\jdvjv.exec:\jdvjv.exe104⤵PID:3024
-
\??\c:\dpvpp.exec:\dpvpp.exe105⤵PID:2972
-
\??\c:\1fllrxl.exec:\1fllrxl.exe106⤵PID:2960
-
\??\c:\3htnnh.exec:\3htnnh.exe107⤵PID:3032
-
\??\c:\nnhntb.exec:\nnhntb.exe108⤵PID:1804
-
\??\c:\3pdvd.exec:\3pdvd.exe109⤵PID:2092
-
\??\c:\1pdjv.exec:\1pdjv.exe110⤵PID:1764
-
\??\c:\rlrflfl.exec:\rlrflfl.exe111⤵PID:408
-
\??\c:\rxrxrxr.exec:\rxrxrxr.exe112⤵PID:1580
-
\??\c:\htbbnn.exec:\htbbnn.exe113⤵PID:2484
-
\??\c:\1nbbhb.exec:\1nbbhb.exe114⤵PID:1676
-
\??\c:\vpdjp.exec:\vpdjp.exe115⤵PID:604
-
\??\c:\3dvdj.exec:\3dvdj.exe116⤵PID:2488
-
\??\c:\5llrrrf.exec:\5llrrrf.exe117⤵PID:2756
-
\??\c:\9xxflxf.exec:\9xxflxf.exe118⤵PID:528
-
\??\c:\5thhhn.exec:\5thhhn.exe119⤵PID:1068
-
\??\c:\nbnttn.exec:\nbnttn.exe120⤵PID:1800
-
\??\c:\dpjdp.exec:\dpjdp.exe121⤵PID:2780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-