Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 02:14
Static task
static1
Behavioral task
behavioral1
Sample
40dcb466c6b031d19f6ddb73885a1ac49ee054bc1190658600a39c82b90a045bN.exe
Resource
win7-20240903-en
General
-
Target
40dcb466c6b031d19f6ddb73885a1ac49ee054bc1190658600a39c82b90a045bN.exe
-
Size
456KB
-
MD5
09c3002f31a60134be42bdb5cda62c00
-
SHA1
b53a7ec811fe4271239a32779efaa4ea342551e2
-
SHA256
40dcb466c6b031d19f6ddb73885a1ac49ee054bc1190658600a39c82b90a045b
-
SHA512
7430e6994f482cfe9fb881ad992b9650d1cd64a5dcb3e11dee0dc3213cccb1ff534006d747e3e3843880dfd1a4829e41e4f6e6b1aa8d949bda2582f68d28c139
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRQ:q7Tc2NYHUrAwfMp3CDRQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/1984-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-93-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2840-106-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2076-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/288-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1112-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-247-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1656-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-281-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1568-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-372-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2672-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1428-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1340-514-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1656-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1356-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-865-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-904-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2976 xlrllfl.exe 1932 dvpvj.exe 2204 ntntbh.exe 2788 thnnnn.exe 2748 1bntbb.exe 2872 7jvjp.exe 2840 3ntttb.exe 1264 5vjjp.exe 1688 1thhnn.exe 2764 hbnnhb.exe 1244 bttthh.exe 1920 dpddj.exe 2076 tnbbbb.exe 288 pdjjp.exe 2348 tnbbhh.exe 1780 bthtbt.exe 1060 9tbbbb.exe 2256 vjppd.exe 1112 nhbhnn.exe 2236 bthbnn.exe 1600 xrllrrx.exe 448 ppjjp.exe 1804 rlxfllr.exe 1656 7btbhn.exe 1092 jpvpv.exe 1768 rlxlrll.exe 2828 rlxrxfl.exe 1556 9rxrrxx.exe 1732 1dppp.exe 2532 xrfrffl.exe 1568 5lxrrll.exe 2128 lfxffff.exe 3044 3pvvd.exe 2340 3rfffff.exe 2700 5fxfffr.exe 2736 7thbbb.exe 2940 jvppd.exe 2604 1xffffx.exe 2856 bnttbb.exe 2600 3hhhnh.exe 2672 jvdvj.exe 2768 frllxfl.exe 1688 hbhntt.exe 1848 thtntn.exe 1468 5vjpp.exe 2696 jvdvv.exe 1620 ffrxlfr.exe 1248 tbhbhh.exe 1928 7nhntn.exe 1224 5pdvj.exe 1964 lxffllr.exe 1428 rfllrxf.exe 1644 9tbtbb.exe 1060 pdpjp.exe 928 vvjdp.exe 692 3flxxrr.exe 908 5hhhnh.exe 1608 7htnnt.exe 880 9vjdj.exe 2252 rlffrxl.exe 1084 lxlrxxf.exe 1340 7tbntn.exe 1760 vjddp.exe 1656 jvjdd.exe -
resource yara_rule behavioral1/memory/1984-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1112-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-514-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1656-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/928-740-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-827-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-840-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-865-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-917-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-1004-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-1023-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffllr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1984 wrote to memory of 2976 1984 40dcb466c6b031d19f6ddb73885a1ac49ee054bc1190658600a39c82b90a045bN.exe 30 PID 1984 wrote to memory of 2976 1984 40dcb466c6b031d19f6ddb73885a1ac49ee054bc1190658600a39c82b90a045bN.exe 30 PID 1984 wrote to memory of 2976 1984 40dcb466c6b031d19f6ddb73885a1ac49ee054bc1190658600a39c82b90a045bN.exe 30 PID 1984 wrote to memory of 2976 1984 40dcb466c6b031d19f6ddb73885a1ac49ee054bc1190658600a39c82b90a045bN.exe 30 PID 2976 wrote to memory of 1932 2976 xlrllfl.exe 31 PID 2976 wrote to memory of 1932 2976 xlrllfl.exe 31 PID 2976 wrote to memory of 1932 2976 xlrllfl.exe 31 PID 2976 wrote to memory of 1932 2976 xlrllfl.exe 31 PID 1932 wrote to memory of 2204 1932 dvpvj.exe 32 PID 1932 wrote to memory of 2204 1932 dvpvj.exe 32 PID 1932 wrote to memory of 2204 1932 dvpvj.exe 32 PID 1932 wrote to memory of 2204 1932 dvpvj.exe 32 PID 2204 wrote to memory of 2788 2204 ntntbh.exe 33 PID 2204 wrote to memory of 2788 2204 ntntbh.exe 33 PID 2204 wrote to memory of 2788 2204 ntntbh.exe 33 PID 2204 wrote to memory of 2788 2204 ntntbh.exe 33 PID 2788 wrote to memory of 2748 2788 thnnnn.exe 34 PID 2788 wrote to memory of 2748 2788 thnnnn.exe 34 PID 2788 wrote to memory of 2748 2788 thnnnn.exe 34 PID 2788 wrote to memory of 2748 2788 thnnnn.exe 34 PID 2748 wrote to memory of 2872 2748 1bntbb.exe 35 PID 2748 wrote to memory of 2872 2748 1bntbb.exe 35 PID 2748 wrote to memory of 2872 2748 1bntbb.exe 35 PID 2748 wrote to memory of 2872 2748 1bntbb.exe 35 PID 2872 wrote to memory of 2840 2872 7jvjp.exe 36 PID 2872 wrote to memory of 2840 2872 7jvjp.exe 36 PID 2872 wrote to memory of 2840 2872 7jvjp.exe 36 PID 2872 wrote to memory of 2840 2872 7jvjp.exe 36 PID 2840 wrote to memory of 1264 2840 3ntttb.exe 37 PID 2840 wrote to memory of 1264 2840 3ntttb.exe 37 PID 2840 wrote to memory of 1264 2840 3ntttb.exe 37 PID 2840 wrote to memory of 1264 2840 3ntttb.exe 37 PID 1264 wrote to memory of 1688 1264 5vjjp.exe 38 PID 1264 wrote to memory of 1688 1264 5vjjp.exe 38 PID 1264 wrote to memory of 1688 1264 5vjjp.exe 38 PID 1264 wrote to memory of 1688 1264 5vjjp.exe 38 PID 1688 wrote to memory of 2764 1688 1thhnn.exe 39 PID 1688 wrote to memory of 2764 1688 1thhnn.exe 39 PID 1688 wrote to memory of 2764 1688 1thhnn.exe 39 PID 1688 wrote to memory of 2764 1688 1thhnn.exe 39 PID 2764 wrote to memory of 1244 2764 hbnnhb.exe 40 PID 2764 wrote to memory of 1244 2764 hbnnhb.exe 40 PID 2764 wrote to memory of 1244 2764 hbnnhb.exe 40 PID 2764 wrote to memory of 1244 2764 hbnnhb.exe 40 PID 1244 wrote to memory of 1920 1244 bttthh.exe 41 PID 1244 wrote to memory of 1920 1244 bttthh.exe 41 PID 1244 wrote to memory of 1920 1244 bttthh.exe 41 PID 1244 wrote to memory of 1920 1244 bttthh.exe 41 PID 1920 wrote to memory of 2076 1920 dpddj.exe 42 PID 1920 wrote to memory of 2076 1920 dpddj.exe 42 PID 1920 wrote to memory of 2076 1920 dpddj.exe 42 PID 1920 wrote to memory of 2076 1920 dpddj.exe 42 PID 2076 wrote to memory of 288 2076 tnbbbb.exe 43 PID 2076 wrote to memory of 288 2076 tnbbbb.exe 43 PID 2076 wrote to memory of 288 2076 tnbbbb.exe 43 PID 2076 wrote to memory of 288 2076 tnbbbb.exe 43 PID 288 wrote to memory of 2348 288 pdjjp.exe 44 PID 288 wrote to memory of 2348 288 pdjjp.exe 44 PID 288 wrote to memory of 2348 288 pdjjp.exe 44 PID 288 wrote to memory of 2348 288 pdjjp.exe 44 PID 2348 wrote to memory of 1780 2348 tnbbhh.exe 45 PID 2348 wrote to memory of 1780 2348 tnbbhh.exe 45 PID 2348 wrote to memory of 1780 2348 tnbbhh.exe 45 PID 2348 wrote to memory of 1780 2348 tnbbhh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\40dcb466c6b031d19f6ddb73885a1ac49ee054bc1190658600a39c82b90a045bN.exe"C:\Users\Admin\AppData\Local\Temp\40dcb466c6b031d19f6ddb73885a1ac49ee054bc1190658600a39c82b90a045bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\xlrllfl.exec:\xlrllfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\dvpvj.exec:\dvpvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\ntntbh.exec:\ntntbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\thnnnn.exec:\thnnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\1bntbb.exec:\1bntbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\7jvjp.exec:\7jvjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\3ntttb.exec:\3ntttb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\5vjjp.exec:\5vjjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\1thhnn.exec:\1thhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\hbnnhb.exec:\hbnnhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\bttthh.exec:\bttthh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\dpddj.exec:\dpddj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\tnbbbb.exec:\tnbbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\pdjjp.exec:\pdjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:288 -
\??\c:\tnbbhh.exec:\tnbbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\bthtbt.exec:\bthtbt.exe17⤵
- Executes dropped EXE
PID:1780 -
\??\c:\9tbbbb.exec:\9tbbbb.exe18⤵
- Executes dropped EXE
PID:1060 -
\??\c:\vjppd.exec:\vjppd.exe19⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nhbhnn.exec:\nhbhnn.exe20⤵
- Executes dropped EXE
PID:1112 -
\??\c:\bthbnn.exec:\bthbnn.exe21⤵
- Executes dropped EXE
PID:2236 -
\??\c:\xrllrrx.exec:\xrllrrx.exe22⤵
- Executes dropped EXE
PID:1600 -
\??\c:\ppjjp.exec:\ppjjp.exe23⤵
- Executes dropped EXE
PID:448 -
\??\c:\rlxfllr.exec:\rlxfllr.exe24⤵
- Executes dropped EXE
PID:1804 -
\??\c:\7btbhn.exec:\7btbhn.exe25⤵
- Executes dropped EXE
PID:1656 -
\??\c:\jpvpv.exec:\jpvpv.exe26⤵
- Executes dropped EXE
PID:1092 -
\??\c:\rlxlrll.exec:\rlxlrll.exe27⤵
- Executes dropped EXE
PID:1768 -
\??\c:\rlxrxfl.exec:\rlxrxfl.exe28⤵
- Executes dropped EXE
PID:2828 -
\??\c:\9rxrrxx.exec:\9rxrrxx.exe29⤵
- Executes dropped EXE
PID:1556 -
\??\c:\1dppp.exec:\1dppp.exe30⤵
- Executes dropped EXE
PID:1732 -
\??\c:\xrfrffl.exec:\xrfrffl.exe31⤵
- Executes dropped EXE
PID:2532 -
\??\c:\5lxrrll.exec:\5lxrrll.exe32⤵
- Executes dropped EXE
PID:1568 -
\??\c:\lfxffff.exec:\lfxffff.exe33⤵
- Executes dropped EXE
PID:2128 -
\??\c:\3pvvd.exec:\3pvvd.exe34⤵
- Executes dropped EXE
PID:3044 -
\??\c:\3rfffff.exec:\3rfffff.exe35⤵
- Executes dropped EXE
PID:2340 -
\??\c:\5fxfffr.exec:\5fxfffr.exe36⤵
- Executes dropped EXE
PID:2700 -
\??\c:\7thbbb.exec:\7thbbb.exe37⤵
- Executes dropped EXE
PID:2736 -
\??\c:\jvppd.exec:\jvppd.exe38⤵
- Executes dropped EXE
PID:2940 -
\??\c:\1xffffx.exec:\1xffffx.exe39⤵
- Executes dropped EXE
PID:2604 -
\??\c:\bnttbb.exec:\bnttbb.exe40⤵
- Executes dropped EXE
PID:2856 -
\??\c:\3hhhnh.exec:\3hhhnh.exe41⤵
- Executes dropped EXE
PID:2600 -
\??\c:\jvdvj.exec:\jvdvj.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\frllxfl.exec:\frllxfl.exe43⤵
- Executes dropped EXE
PID:2768 -
\??\c:\hbhntt.exec:\hbhntt.exe44⤵
- Executes dropped EXE
PID:1688 -
\??\c:\thtntn.exec:\thtntn.exe45⤵
- Executes dropped EXE
PID:1848 -
\??\c:\5vjpp.exec:\5vjpp.exe46⤵
- Executes dropped EXE
PID:1468 -
\??\c:\jvdvv.exec:\jvdvv.exe47⤵
- Executes dropped EXE
PID:2696 -
\??\c:\ffrxlfr.exec:\ffrxlfr.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1620 -
\??\c:\tbhbhh.exec:\tbhbhh.exe49⤵
- Executes dropped EXE
PID:1248 -
\??\c:\7nhntn.exec:\7nhntn.exe50⤵
- Executes dropped EXE
PID:1928 -
\??\c:\5pdvj.exec:\5pdvj.exe51⤵
- Executes dropped EXE
PID:1224 -
\??\c:\lxffllr.exec:\lxffllr.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1964 -
\??\c:\rfllrxf.exec:\rfllrxf.exe53⤵
- Executes dropped EXE
PID:1428 -
\??\c:\9tbtbb.exec:\9tbtbb.exe54⤵
- Executes dropped EXE
PID:1644 -
\??\c:\pdpjp.exec:\pdpjp.exe55⤵
- Executes dropped EXE
PID:1060 -
\??\c:\vvjdp.exec:\vvjdp.exe56⤵
- Executes dropped EXE
PID:928 -
\??\c:\3flxxrr.exec:\3flxxrr.exe57⤵
- Executes dropped EXE
PID:692 -
\??\c:\5hhhnh.exec:\5hhhnh.exe58⤵
- Executes dropped EXE
PID:908 -
\??\c:\7htnnt.exec:\7htnnt.exe59⤵
- Executes dropped EXE
PID:1608 -
\??\c:\9vjdj.exec:\9vjdj.exe60⤵
- Executes dropped EXE
PID:880 -
\??\c:\rlffrxl.exec:\rlffrxl.exe61⤵
- Executes dropped EXE
PID:2252 -
\??\c:\lxlrxxf.exec:\lxlrxxf.exe62⤵
- Executes dropped EXE
PID:1084 -
\??\c:\7tbntn.exec:\7tbntn.exe63⤵
- Executes dropped EXE
PID:1340 -
\??\c:\vjddp.exec:\vjddp.exe64⤵
- Executes dropped EXE
PID:1760 -
\??\c:\jvjdd.exec:\jvjdd.exe65⤵
- Executes dropped EXE
PID:1656 -
\??\c:\llrrfxx.exec:\llrrfxx.exe66⤵PID:2152
-
\??\c:\5bnhnt.exec:\5bnhnt.exe67⤵PID:2504
-
\??\c:\tnbbhn.exec:\tnbbhn.exe68⤵PID:2492
-
\??\c:\vpddj.exec:\vpddj.exe69⤵PID:2468
-
\??\c:\pvpjd.exec:\pvpjd.exe70⤵PID:1820
-
\??\c:\1xfflll.exec:\1xfflll.exe71⤵PID:2992
-
\??\c:\1tbntb.exec:\1tbntb.exe72⤵PID:2676
-
\??\c:\5nbntn.exec:\5nbntn.exe73⤵PID:2432
-
\??\c:\dvjdj.exec:\dvjdj.exe74⤵PID:1568
-
\??\c:\7lrrrfx.exec:\7lrrrfx.exe75⤵PID:1356
-
\??\c:\rflrxxl.exec:\rflrxxl.exe76⤵PID:2224
-
\??\c:\7bhhnn.exec:\7bhhnn.exe77⤵PID:2804
-
\??\c:\vjvpp.exec:\vjvpp.exe78⤵PID:2688
-
\??\c:\5vjdd.exec:\5vjdd.exe79⤵PID:2944
-
\??\c:\5fxrrrx.exec:\5fxrrrx.exe80⤵PID:2796
-
\??\c:\ntbhtn.exec:\ntbhtn.exe81⤵PID:2756
-
\??\c:\hthbnn.exec:\hthbnn.exe82⤵PID:2708
-
\??\c:\dpjdj.exec:\dpjdj.exe83⤵PID:1772
-
\??\c:\rlrfffl.exec:\rlrfffl.exe84⤵PID:2592
-
\??\c:\lfxrllr.exec:\lfxrllr.exe85⤵PID:2132
-
\??\c:\9tbhhn.exec:\9tbhhn.exe86⤵
- System Location Discovery: System Language Discovery
PID:1844 -
\??\c:\9vvdd.exec:\9vvdd.exe87⤵PID:988
-
\??\c:\lxrrxxl.exec:\lxrrxxl.exe88⤵PID:668
-
\??\c:\llxxffr.exec:\llxxffr.exe89⤵PID:1236
-
\??\c:\hbnthh.exec:\hbnthh.exe90⤵PID:1648
-
\??\c:\nnbntb.exec:\nnbntb.exe91⤵PID:2024
-
\??\c:\3jppv.exec:\3jppv.exe92⤵PID:2076
-
\??\c:\7xrrrxr.exec:\7xrrrxr.exe93⤵PID:1940
-
\??\c:\1rffrrf.exec:\1rffrrf.exe94⤵PID:1992
-
\??\c:\bnnnbb.exec:\bnnnbb.exe95⤵PID:2012
-
\??\c:\ppdvj.exec:\ppdvj.exe96⤵PID:1432
-
\??\c:\vpjjp.exec:\vpjjp.exe97⤵PID:2284
-
\??\c:\9fxrrrx.exec:\9fxrrrx.exe98⤵PID:1644
-
\??\c:\bbtntt.exec:\bbtntt.exe99⤵PID:2692
-
\??\c:\1nbhnn.exec:\1nbhnn.exe100⤵PID:928
-
\??\c:\jvdjp.exec:\jvdjp.exe101⤵PID:1720
-
\??\c:\xlfxflr.exec:\xlfxflr.exe102⤵PID:1492
-
\??\c:\9rlfllr.exec:\9rlfllr.exe103⤵PID:1608
-
\??\c:\nnbtbt.exec:\nnbtbt.exe104⤵PID:2328
-
\??\c:\jjvjp.exec:\jjvjp.exe105⤵PID:2252
-
\??\c:\7pddj.exec:\7pddj.exe106⤵PID:1808
-
\??\c:\9lllrrx.exec:\9lllrrx.exe107⤵PID:1340
-
\??\c:\9bbtbb.exec:\9bbtbb.exe108⤵PID:1760
-
\??\c:\bhtthh.exec:\bhtthh.exe109⤵PID:2280
-
\??\c:\ppjpd.exec:\ppjpd.exe110⤵PID:2156
-
\??\c:\frllrrx.exec:\frllrrx.exe111⤵PID:836
-
\??\c:\xlrrllx.exec:\xlrrllx.exe112⤵PID:300
-
\??\c:\tnbhnn.exec:\tnbhnn.exe113⤵PID:352
-
\??\c:\jdvvj.exec:\jdvvj.exe114⤵PID:872
-
\??\c:\vjvvj.exec:\vjvvj.exe115⤵PID:1984
-
\??\c:\xlfxffl.exec:\xlfxffl.exe116⤵PID:2680
-
\??\c:\btbttt.exec:\btbttt.exe117⤵
- System Location Discovery: System Language Discovery
PID:2188 -
\??\c:\9tnntt.exec:\9tnntt.exe118⤵PID:1192
-
\??\c:\pjvvd.exec:\pjvvd.exe119⤵PID:2356
-
\??\c:\7djdp.exec:\7djdp.exe120⤵PID:2136
-
\??\c:\rxlxfxx.exec:\rxlxfxx.exe121⤵PID:2812
-
\??\c:\7tbbbb.exec:\7tbbbb.exe122⤵PID:2864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-