Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 05:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe
-
Size
453KB
-
MD5
8ed18ab56af2ed7a15f895f87fd9ba8f
-
SHA1
6d028d5984cc852029e3c0c2877ba7d50328b020
-
SHA256
57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a
-
SHA512
f8b5b14f023948fd50a6c317a535bae1c0534f162a8ddb1479ea1bbdb8491121411c6a7575a397cd03f8a604dc501602bbf3e59281bd972bd77e83ad191b9c49
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbel:q7Tc2NYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2528-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/556-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-292-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2512-290-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2316-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/304-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-724-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-738-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/888-804-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/304-811-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-836-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2716-868-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2444-889-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2212-897-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2740-1143-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2260-1320-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1352-1347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1112-1346-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2896-1358-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1568 nbhnnt.exe 680 7jdjp.exe 2516 1hbhhn.exe 2284 9djpd.exe 2820 1xrrxxf.exe 2252 1hthnn.exe 2748 pjvjv.exe 2908 5dvvd.exe 2876 rflxlrx.exe 2664 tnnbnt.exe 2220 vvjpd.exe 2340 rlxflrx.exe 2116 hbhnbn.exe 1864 pdppv.exe 2164 9llxfrx.exe 1388 tbtbnn.exe 1616 pjdjv.exe 1436 xfrfxfl.exe 2912 9bbhtb.exe 2244 jpjjd.exe 2128 5fxfrxx.exe 2160 nhtbtb.exe 1432 vvpjd.exe 944 7xrxlrx.exe 2232 bbtbhn.exe 768 jvjjd.exe 2080 hbtbnh.exe 556 pjpvd.exe 3040 rlfrflr.exe 324 5pvpj.exe 2452 vpddj.exe 2512 1jpvd.exe 1624 nhbbnb.exe 2532 ddvdp.exe 2496 lffxllx.exe 2316 bbbtnt.exe 1740 vvpjp.exe 2256 9rlrfrf.exe 2744 hhbbtb.exe 2740 7jvvd.exe 2096 rlfrxfr.exe 2608 9rxfflx.exe 2588 nnhnnn.exe 1860 3hnthn.exe 2208 7vdvd.exe 2044 xfrfxlf.exe 1648 hbtbtb.exe 2596 9vvjp.exe 2108 rfrrrxf.exe 2408 rlfrxlf.exe 1388 9tntbh.exe 1640 3pddj.exe 1852 3vjpp.exe 2832 lflrxfl.exe 2764 nhtttb.exe 2244 ttnnbt.exe 1872 jvjjd.exe 1836 9fffflr.exe 2236 hbhhnt.exe 2968 tttbnt.exe 1280 3pvvd.exe 2232 xrrxxfr.exe 1204 lxrrrrx.exe 2364 1tnntb.exe -
resource yara_rule behavioral1/memory/2528-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-292-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2316-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-674-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-724-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-804-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-811-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-869-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-1130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-1143-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2596-1181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-1206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-1231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-1244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-1269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-1307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-1347-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 1568 2528 57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe 30 PID 2528 wrote to memory of 1568 2528 57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe 30 PID 2528 wrote to memory of 1568 2528 57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe 30 PID 2528 wrote to memory of 1568 2528 57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe 30 PID 1568 wrote to memory of 680 1568 nbhnnt.exe 31 PID 1568 wrote to memory of 680 1568 nbhnnt.exe 31 PID 1568 wrote to memory of 680 1568 nbhnnt.exe 31 PID 1568 wrote to memory of 680 1568 nbhnnt.exe 31 PID 680 wrote to memory of 2516 680 7jdjp.exe 32 PID 680 wrote to memory of 2516 680 7jdjp.exe 32 PID 680 wrote to memory of 2516 680 7jdjp.exe 32 PID 680 wrote to memory of 2516 680 7jdjp.exe 32 PID 2516 wrote to memory of 2284 2516 1hbhhn.exe 33 PID 2516 wrote to memory of 2284 2516 1hbhhn.exe 33 PID 2516 wrote to memory of 2284 2516 1hbhhn.exe 33 PID 2516 wrote to memory of 2284 2516 1hbhhn.exe 33 PID 2284 wrote to memory of 2820 2284 9djpd.exe 34 PID 2284 wrote to memory of 2820 2284 9djpd.exe 34 PID 2284 wrote to memory of 2820 2284 9djpd.exe 34 PID 2284 wrote to memory of 2820 2284 9djpd.exe 34 PID 2820 wrote to memory of 2252 2820 1xrrxxf.exe 35 PID 2820 wrote to memory of 2252 2820 1xrrxxf.exe 35 PID 2820 wrote to memory of 2252 2820 1xrrxxf.exe 35 PID 2820 wrote to memory of 2252 2820 1xrrxxf.exe 35 PID 2252 wrote to memory of 2748 2252 1hthnn.exe 36 PID 2252 wrote to memory of 2748 2252 1hthnn.exe 36 PID 2252 wrote to memory of 2748 2252 1hthnn.exe 36 PID 2252 wrote to memory of 2748 2252 1hthnn.exe 36 PID 2748 wrote to memory of 2908 2748 pjvjv.exe 37 PID 2748 wrote to memory of 2908 2748 pjvjv.exe 37 PID 2748 wrote to memory of 2908 2748 pjvjv.exe 37 PID 2748 wrote to memory of 2908 2748 pjvjv.exe 37 PID 2908 wrote to memory of 2876 2908 5dvvd.exe 38 PID 2908 wrote to memory of 2876 2908 5dvvd.exe 38 PID 2908 wrote to memory of 2876 2908 5dvvd.exe 38 PID 2908 wrote to memory of 2876 2908 5dvvd.exe 38 PID 2876 wrote to memory of 2664 2876 rflxlrx.exe 40 PID 2876 wrote to memory of 2664 2876 rflxlrx.exe 40 PID 2876 wrote to memory of 2664 2876 rflxlrx.exe 40 PID 2876 wrote to memory of 2664 2876 rflxlrx.exe 40 PID 2664 wrote to memory of 2220 2664 tnnbnt.exe 41 PID 2664 wrote to memory of 2220 2664 tnnbnt.exe 41 PID 2664 wrote to memory of 2220 2664 tnnbnt.exe 41 PID 2664 wrote to memory of 2220 2664 tnnbnt.exe 41 PID 2220 wrote to memory of 2340 2220 vvjpd.exe 42 PID 2220 wrote to memory of 2340 2220 vvjpd.exe 42 PID 2220 wrote to memory of 2340 2220 vvjpd.exe 42 PID 2220 wrote to memory of 2340 2220 vvjpd.exe 42 PID 2340 wrote to memory of 2116 2340 rlxflrx.exe 43 PID 2340 wrote to memory of 2116 2340 rlxflrx.exe 43 PID 2340 wrote to memory of 2116 2340 rlxflrx.exe 43 PID 2340 wrote to memory of 2116 2340 rlxflrx.exe 43 PID 2116 wrote to memory of 1864 2116 hbhnbn.exe 44 PID 2116 wrote to memory of 1864 2116 hbhnbn.exe 44 PID 2116 wrote to memory of 1864 2116 hbhnbn.exe 44 PID 2116 wrote to memory of 1864 2116 hbhnbn.exe 44 PID 1864 wrote to memory of 2164 1864 pdppv.exe 45 PID 1864 wrote to memory of 2164 1864 pdppv.exe 45 PID 1864 wrote to memory of 2164 1864 pdppv.exe 45 PID 1864 wrote to memory of 2164 1864 pdppv.exe 45 PID 2164 wrote to memory of 1388 2164 9llxfrx.exe 46 PID 2164 wrote to memory of 1388 2164 9llxfrx.exe 46 PID 2164 wrote to memory of 1388 2164 9llxfrx.exe 46 PID 2164 wrote to memory of 1388 2164 9llxfrx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe"C:\Users\Admin\AppData\Local\Temp\57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\nbhnnt.exec:\nbhnnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\7jdjp.exec:\7jdjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\1hbhhn.exec:\1hbhhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\9djpd.exec:\9djpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\1xrrxxf.exec:\1xrrxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\1hthnn.exec:\1hthnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\pjvjv.exec:\pjvjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\5dvvd.exec:\5dvvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\rflxlrx.exec:\rflxlrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\tnnbnt.exec:\tnnbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\vvjpd.exec:\vvjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\rlxflrx.exec:\rlxflrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\hbhnbn.exec:\hbhnbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\pdppv.exec:\pdppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\9llxfrx.exec:\9llxfrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\tbtbnn.exec:\tbtbnn.exe17⤵
- Executes dropped EXE
PID:1388 -
\??\c:\pjdjv.exec:\pjdjv.exe18⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xfrfxfl.exec:\xfrfxfl.exe19⤵
- Executes dropped EXE
PID:1436 -
\??\c:\9bbhtb.exec:\9bbhtb.exe20⤵
- Executes dropped EXE
PID:2912 -
\??\c:\jpjjd.exec:\jpjjd.exe21⤵
- Executes dropped EXE
PID:2244 -
\??\c:\5fxfrxx.exec:\5fxfrxx.exe22⤵
- Executes dropped EXE
PID:2128 -
\??\c:\nhtbtb.exec:\nhtbtb.exe23⤵
- Executes dropped EXE
PID:2160 -
\??\c:\vvpjd.exec:\vvpjd.exe24⤵
- Executes dropped EXE
PID:1432 -
\??\c:\7xrxlrx.exec:\7xrxlrx.exe25⤵
- Executes dropped EXE
PID:944 -
\??\c:\bbtbhn.exec:\bbtbhn.exe26⤵
- Executes dropped EXE
PID:2232 -
\??\c:\jvjjd.exec:\jvjjd.exe27⤵
- Executes dropped EXE
PID:768 -
\??\c:\hbtbnh.exec:\hbtbnh.exe28⤵
- Executes dropped EXE
PID:2080 -
\??\c:\pjpvd.exec:\pjpvd.exe29⤵
- Executes dropped EXE
PID:556 -
\??\c:\rlfrflr.exec:\rlfrflr.exe30⤵
- Executes dropped EXE
PID:3040 -
\??\c:\5pvpj.exec:\5pvpj.exe31⤵
- Executes dropped EXE
PID:324 -
\??\c:\vpddj.exec:\vpddj.exe32⤵
- Executes dropped EXE
PID:2452 -
\??\c:\1jpvd.exec:\1jpvd.exe33⤵
- Executes dropped EXE
PID:2512 -
\??\c:\nhbbnb.exec:\nhbbnb.exe34⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ddvdp.exec:\ddvdp.exe35⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lffxllx.exec:\lffxllx.exe36⤵
- Executes dropped EXE
PID:2496 -
\??\c:\bbbtnt.exec:\bbbtnt.exe37⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vvpjp.exec:\vvpjp.exe38⤵
- Executes dropped EXE
PID:1740 -
\??\c:\9rlrfrf.exec:\9rlrfrf.exe39⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hhbbtb.exec:\hhbbtb.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\7jvvd.exec:\7jvvd.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\rlfrxfr.exec:\rlfrxfr.exe42⤵
- Executes dropped EXE
PID:2096 -
\??\c:\9rxfflx.exec:\9rxfflx.exe43⤵
- Executes dropped EXE
PID:2608 -
\??\c:\nnhnnn.exec:\nnhnnn.exe44⤵
- Executes dropped EXE
PID:2588 -
\??\c:\3hnthn.exec:\3hnthn.exe45⤵
- Executes dropped EXE
PID:1860 -
\??\c:\7vdvd.exec:\7vdvd.exe46⤵
- Executes dropped EXE
PID:2208 -
\??\c:\xfrfxlf.exec:\xfrfxlf.exe47⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hbtbtb.exec:\hbtbtb.exe48⤵
- Executes dropped EXE
PID:1648 -
\??\c:\9vvjp.exec:\9vvjp.exe49⤵
- Executes dropped EXE
PID:2596 -
\??\c:\rfrrrxf.exec:\rfrrrxf.exe50⤵
- Executes dropped EXE
PID:2108 -
\??\c:\rlfrxlf.exec:\rlfrxlf.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2408 -
\??\c:\9tntbh.exec:\9tntbh.exe52⤵
- Executes dropped EXE
PID:1388 -
\??\c:\3pddj.exec:\3pddj.exe53⤵
- Executes dropped EXE
PID:1640 -
\??\c:\3vjpp.exec:\3vjpp.exe54⤵
- Executes dropped EXE
PID:1852 -
\??\c:\lflrxfl.exec:\lflrxfl.exe55⤵
- Executes dropped EXE
PID:2832 -
\??\c:\nhtttb.exec:\nhtttb.exe56⤵
- Executes dropped EXE
PID:2764 -
\??\c:\ttnnbt.exec:\ttnnbt.exe57⤵
- Executes dropped EXE
PID:2244 -
\??\c:\jvjjd.exec:\jvjjd.exe58⤵
- Executes dropped EXE
PID:1872 -
\??\c:\9fffflr.exec:\9fffflr.exe59⤵
- Executes dropped EXE
PID:1836 -
\??\c:\hbhhnt.exec:\hbhhnt.exe60⤵
- Executes dropped EXE
PID:2236 -
\??\c:\tttbnt.exec:\tttbnt.exe61⤵
- Executes dropped EXE
PID:2968 -
\??\c:\3pvvd.exec:\3pvvd.exe62⤵
- Executes dropped EXE
PID:1280 -
\??\c:\xrrxxfr.exec:\xrrxxfr.exe63⤵
- Executes dropped EXE
PID:2232 -
\??\c:\lxrrrrx.exec:\lxrrrrx.exe64⤵
- Executes dropped EXE
PID:1204 -
\??\c:\1tnntb.exec:\1tnntb.exe65⤵
- Executes dropped EXE
PID:2364 -
\??\c:\nhbhbh.exec:\nhbhbh.exe66⤵PID:1776
-
\??\c:\pvpvd.exec:\pvpvd.exe67⤵PID:768
-
\??\c:\flfxxxf.exec:\flfxxxf.exe68⤵PID:700
-
\??\c:\frllrrr.exec:\frllrrr.exe69⤵PID:2132
-
\??\c:\bnbbhh.exec:\bnbbhh.exe70⤵PID:2448
-
\??\c:\dvpvj.exec:\dvpvj.exe71⤵PID:1700
-
\??\c:\xrffxxx.exec:\xrffxxx.exe72⤵
- System Location Discovery: System Language Discovery
PID:304 -
\??\c:\lxxxxrf.exec:\lxxxxrf.exe73⤵PID:1112
-
\??\c:\nbtbhh.exec:\nbtbhh.exe74⤵
- System Location Discovery: System Language Discovery
PID:2368 -
\??\c:\ddjdp.exec:\ddjdp.exe75⤵PID:1632
-
\??\c:\3ffxrll.exec:\3ffxrll.exe76⤵PID:2348
-
\??\c:\llxlxxl.exec:\llxlxxl.exe77⤵PID:2376
-
\??\c:\hbnthh.exec:\hbnthh.exe78⤵PID:2300
-
\??\c:\pdjpj.exec:\pdjpj.exe79⤵PID:2680
-
\??\c:\rlfflrf.exec:\rlfflrf.exe80⤵PID:2284
-
\??\c:\frrxlfl.exec:\frrxlfl.exe81⤵PID:2808
-
\??\c:\bbbbtt.exec:\bbbbtt.exe82⤵PID:2864
-
\??\c:\vpjjd.exec:\vpjjd.exe83⤵PID:2740
-
\??\c:\xxlxflf.exec:\xxlxflf.exe84⤵PID:2640
-
\??\c:\fxllrlr.exec:\fxllrlr.exe85⤵PID:2608
-
\??\c:\5htnnn.exec:\5htnnn.exe86⤵PID:2616
-
\??\c:\pvjpj.exec:\pvjpj.exe87⤵PID:1860
-
\??\c:\jddvj.exec:\jddvj.exe88⤵PID:2220
-
\??\c:\5flfrrx.exec:\5flfrrx.exe89⤵PID:2488
-
\??\c:\rfrrrrf.exec:\rfrrrrf.exe90⤵PID:2020
-
\??\c:\7bnnbh.exec:\7bnnbh.exe91⤵PID:1864
-
\??\c:\1jppj.exec:\1jppj.exe92⤵PID:2484
-
\??\c:\pjdjj.exec:\pjdjj.exe93⤵PID:2816
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe94⤵PID:1060
-
\??\c:\lfrlxrx.exec:\lfrlxrx.exe95⤵PID:1016
-
\??\c:\tbnhnt.exec:\tbnhnt.exe96⤵PID:2984
-
\??\c:\vpdpp.exec:\vpdpp.exe97⤵PID:2904
-
\??\c:\rrllxfr.exec:\rrllxfr.exe98⤵PID:1944
-
\??\c:\rfrlrrx.exec:\rfrlrrx.exe99⤵PID:988
-
\??\c:\btnnnh.exec:\btnnnh.exe100⤵PID:1264
-
\??\c:\hbnhnn.exec:\hbnhnn.exe101⤵PID:1920
-
\??\c:\pjpjd.exec:\pjpjd.exe102⤵PID:2980
-
\??\c:\9lxfrfr.exec:\9lxfrfr.exe103⤵PID:3024
-
\??\c:\3hhnnn.exec:\3hhnnn.exe104⤵PID:1172
-
\??\c:\7thhnn.exec:\7thhnn.exe105⤵PID:3020
-
\??\c:\ddpvd.exec:\ddpvd.exe106⤵PID:1036
-
\??\c:\9xrxlrf.exec:\9xrxlrf.exe107⤵PID:628
-
\??\c:\7frlfff.exec:\7frlfff.exe108⤵PID:2456
-
\??\c:\nnhbnt.exec:\nnhbnt.exe109⤵PID:2080
-
\??\c:\pdppv.exec:\pdppv.exe110⤵PID:2140
-
\??\c:\vjpvj.exec:\vjpvj.exe111⤵PID:924
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe112⤵PID:1932
-
\??\c:\bnhhnt.exec:\bnhhnt.exe113⤵PID:888
-
\??\c:\jvddj.exec:\jvddj.exe114⤵PID:304
-
\??\c:\1pdpd.exec:\1pdpd.exe115⤵PID:2440
-
\??\c:\lfrllxf.exec:\lfrllxf.exe116⤵PID:1576
-
\??\c:\hhthbh.exec:\hhthbh.exe117⤵PID:1632
-
\??\c:\nhnntn.exec:\nhnntn.exe118⤵PID:2292
-
\??\c:\pjvvd.exec:\pjvvd.exe119⤵PID:1392
-
\??\c:\dvvjv.exec:\dvvjv.exe120⤵PID:2300
-
\??\c:\lflrrll.exec:\lflrrll.exe121⤵PID:2872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-