Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 04:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
465090978fe86ba232e951e0c5716bca7b6a6b82950dcbf16cc6c7f62c7e25e8.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
465090978fe86ba232e951e0c5716bca7b6a6b82950dcbf16cc6c7f62c7e25e8.exe
-
Size
455KB
-
MD5
3bdbc74e2652b7b492e9ac08389c5c4b
-
SHA1
a3211ac53589ae7b8f59c37699bf4753fdc3cddb
-
SHA256
465090978fe86ba232e951e0c5716bca7b6a6b82950dcbf16cc6c7f62c7e25e8
-
SHA512
c9f66e562017c008fc1e535179fdfee72fe3c57f2e291eab26564df34290c530875f464ef4d0c9092635532100037ccdf5a2cdd93c91d4e7b81cd391695a7883
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRU:q7Tc2NYHUrAwfMp3CDRU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/1600-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-74-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2780-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1280-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-364-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2456-389-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1304-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-448-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1972-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-526-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2440-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-660-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/988-720-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-764-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1740-834-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2836-920-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/844-1037-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-1224-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1084-1235-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2972 hnbthn.exe 1620 rrlrxfx.exe 1712 bttbnt.exe 2128 vpjpd.exe 2856 ttthtt.exe 2576 dvpdj.exe 2780 lfxlrxf.exe 2636 hbnnbh.exe 2608 jdvjj.exe 1416 fxxlxfx.exe 2884 ttthtb.exe 1792 xlxlxfl.exe 1260 1lrflxl.exe 2720 3thntb.exe 2920 frlfxxl.exe 1752 jdvpj.exe 1572 9xrrxfl.exe 2500 rllflrf.exe 628 vpjjv.exe 2024 hhbnbh.exe 840 ddvdj.exe 1308 hbnbnn.exe 2448 nnntht.exe 1928 lllxlrl.exe 1780 thnhhb.exe 2568 jjvdp.exe 2352 rrrxflx.exe 2056 dvjpv.exe 2328 rrlxflx.exe 2392 tbbbht.exe 896 djpjd.exe 528 7lxxxfr.exe 472 hhttnn.exe 536 vvpdp.exe 1280 pjdpp.exe 1620 xxlfxfl.exe 1940 hnbtnt.exe 2340 hbtbhh.exe 2852 jdpvd.exe 2816 lflllrx.exe 2820 flxxrxf.exe 2456 nhbbnh.exe 2708 nnbnnb.exe 2640 7dvpj.exe 2680 xrlxffr.exe 2624 bhbnbn.exe 2692 hbbbnn.exe 1324 vvpvj.exe 1656 dvvjp.exe 1304 rlffllr.exe 2676 7bnnnt.exe 2716 dvvdp.exe 988 pjvdv.exe 2912 llfrffl.exe 2432 9hbbbt.exe 1756 vvpdj.exe 1164 9vppd.exe 2200 9rllrrx.exe 1804 1hnhhn.exe 1436 vpdjv.exe 1972 dvjvd.exe 2268 xrrxllr.exe 1968 nbthth.exe 1768 jpdjd.exe -
resource yara_rule behavioral1/memory/2972-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-733-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-764-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1740-834-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1276-839-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-964-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-1037-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-1050-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-1063-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-1083-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-1187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-1224-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2420-1275-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1600 wrote to memory of 2972 1600 465090978fe86ba232e951e0c5716bca7b6a6b82950dcbf16cc6c7f62c7e25e8.exe 30 PID 1600 wrote to memory of 2972 1600 465090978fe86ba232e951e0c5716bca7b6a6b82950dcbf16cc6c7f62c7e25e8.exe 30 PID 1600 wrote to memory of 2972 1600 465090978fe86ba232e951e0c5716bca7b6a6b82950dcbf16cc6c7f62c7e25e8.exe 30 PID 1600 wrote to memory of 2972 1600 465090978fe86ba232e951e0c5716bca7b6a6b82950dcbf16cc6c7f62c7e25e8.exe 30 PID 2972 wrote to memory of 1620 2972 hnbthn.exe 31 PID 2972 wrote to memory of 1620 2972 hnbthn.exe 31 PID 2972 wrote to memory of 1620 2972 hnbthn.exe 31 PID 2972 wrote to memory of 1620 2972 hnbthn.exe 31 PID 1620 wrote to memory of 1712 1620 rrlrxfx.exe 32 PID 1620 wrote to memory of 1712 1620 rrlrxfx.exe 32 PID 1620 wrote to memory of 1712 1620 rrlrxfx.exe 32 PID 1620 wrote to memory of 1712 1620 rrlrxfx.exe 32 PID 1712 wrote to memory of 2128 1712 bttbnt.exe 33 PID 1712 wrote to memory of 2128 1712 bttbnt.exe 33 PID 1712 wrote to memory of 2128 1712 bttbnt.exe 33 PID 1712 wrote to memory of 2128 1712 bttbnt.exe 33 PID 2128 wrote to memory of 2856 2128 vpjpd.exe 34 PID 2128 wrote to memory of 2856 2128 vpjpd.exe 34 PID 2128 wrote to memory of 2856 2128 vpjpd.exe 34 PID 2128 wrote to memory of 2856 2128 vpjpd.exe 34 PID 2856 wrote to memory of 2576 2856 ttthtt.exe 35 PID 2856 wrote to memory of 2576 2856 ttthtt.exe 35 PID 2856 wrote to memory of 2576 2856 ttthtt.exe 35 PID 2856 wrote to memory of 2576 2856 ttthtt.exe 35 PID 2576 wrote to memory of 2780 2576 dvpdj.exe 36 PID 2576 wrote to memory of 2780 2576 dvpdj.exe 36 PID 2576 wrote to memory of 2780 2576 dvpdj.exe 36 PID 2576 wrote to memory of 2780 2576 dvpdj.exe 36 PID 2780 wrote to memory of 2636 2780 lfxlrxf.exe 37 PID 2780 wrote to memory of 2636 2780 lfxlrxf.exe 37 PID 2780 wrote to memory of 2636 2780 lfxlrxf.exe 37 PID 2780 wrote to memory of 2636 2780 lfxlrxf.exe 37 PID 2636 wrote to memory of 2608 2636 hbnnbh.exe 38 PID 2636 wrote to memory of 2608 2636 hbnnbh.exe 38 PID 2636 wrote to memory of 2608 2636 hbnnbh.exe 38 PID 2636 wrote to memory of 2608 2636 hbnnbh.exe 38 PID 2608 wrote to memory of 1416 2608 jdvjj.exe 39 PID 2608 wrote to memory of 1416 2608 jdvjj.exe 39 PID 2608 wrote to memory of 1416 2608 jdvjj.exe 39 PID 2608 wrote to memory of 1416 2608 jdvjj.exe 39 PID 1416 wrote to memory of 2884 1416 fxxlxfx.exe 40 PID 1416 wrote to memory of 2884 1416 fxxlxfx.exe 40 PID 1416 wrote to memory of 2884 1416 fxxlxfx.exe 40 PID 1416 wrote to memory of 2884 1416 fxxlxfx.exe 40 PID 2884 wrote to memory of 1792 2884 ttthtb.exe 41 PID 2884 wrote to memory of 1792 2884 ttthtb.exe 41 PID 2884 wrote to memory of 1792 2884 ttthtb.exe 41 PID 2884 wrote to memory of 1792 2884 ttthtb.exe 41 PID 1792 wrote to memory of 1260 1792 xlxlxfl.exe 42 PID 1792 wrote to memory of 1260 1792 xlxlxfl.exe 42 PID 1792 wrote to memory of 1260 1792 xlxlxfl.exe 42 PID 1792 wrote to memory of 1260 1792 xlxlxfl.exe 42 PID 1260 wrote to memory of 2720 1260 1lrflxl.exe 43 PID 1260 wrote to memory of 2720 1260 1lrflxl.exe 43 PID 1260 wrote to memory of 2720 1260 1lrflxl.exe 43 PID 1260 wrote to memory of 2720 1260 1lrflxl.exe 43 PID 2720 wrote to memory of 2920 2720 3thntb.exe 44 PID 2720 wrote to memory of 2920 2720 3thntb.exe 44 PID 2720 wrote to memory of 2920 2720 3thntb.exe 44 PID 2720 wrote to memory of 2920 2720 3thntb.exe 44 PID 2920 wrote to memory of 1752 2920 frlfxxl.exe 45 PID 2920 wrote to memory of 1752 2920 frlfxxl.exe 45 PID 2920 wrote to memory of 1752 2920 frlfxxl.exe 45 PID 2920 wrote to memory of 1752 2920 frlfxxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\465090978fe86ba232e951e0c5716bca7b6a6b82950dcbf16cc6c7f62c7e25e8.exe"C:\Users\Admin\AppData\Local\Temp\465090978fe86ba232e951e0c5716bca7b6a6b82950dcbf16cc6c7f62c7e25e8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\hnbthn.exec:\hnbthn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\rrlrxfx.exec:\rrlrxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\bttbnt.exec:\bttbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\vpjpd.exec:\vpjpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\ttthtt.exec:\ttthtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\dvpdj.exec:\dvpdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\lfxlrxf.exec:\lfxlrxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\hbnnbh.exec:\hbnnbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\jdvjj.exec:\jdvjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\fxxlxfx.exec:\fxxlxfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\ttthtb.exec:\ttthtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\xlxlxfl.exec:\xlxlxfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\1lrflxl.exec:\1lrflxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\3thntb.exec:\3thntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\frlfxxl.exec:\frlfxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\jdvpj.exec:\jdvpj.exe17⤵
- Executes dropped EXE
PID:1752 -
\??\c:\9xrrxfl.exec:\9xrrxfl.exe18⤵
- Executes dropped EXE
PID:1572 -
\??\c:\rllflrf.exec:\rllflrf.exe19⤵
- Executes dropped EXE
PID:2500 -
\??\c:\vpjjv.exec:\vpjjv.exe20⤵
- Executes dropped EXE
PID:628 -
\??\c:\hhbnbh.exec:\hhbnbh.exe21⤵
- Executes dropped EXE
PID:2024 -
\??\c:\ddvdj.exec:\ddvdj.exe22⤵
- Executes dropped EXE
PID:840 -
\??\c:\hbnbnn.exec:\hbnbnn.exe23⤵
- Executes dropped EXE
PID:1308 -
\??\c:\nnntht.exec:\nnntht.exe24⤵
- Executes dropped EXE
PID:2448 -
\??\c:\lllxlrl.exec:\lllxlrl.exe25⤵
- Executes dropped EXE
PID:1928 -
\??\c:\thnhhb.exec:\thnhhb.exe26⤵
- Executes dropped EXE
PID:1780 -
\??\c:\jjvdp.exec:\jjvdp.exe27⤵
- Executes dropped EXE
PID:2568 -
\??\c:\rrrxflx.exec:\rrrxflx.exe28⤵
- Executes dropped EXE
PID:2352 -
\??\c:\dvjpv.exec:\dvjpv.exe29⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rrlxflx.exec:\rrlxflx.exe30⤵
- Executes dropped EXE
PID:2328 -
\??\c:\tbbbht.exec:\tbbbht.exe31⤵
- Executes dropped EXE
PID:2392 -
\??\c:\djpjd.exec:\djpjd.exe32⤵
- Executes dropped EXE
PID:896 -
\??\c:\7lxxxfr.exec:\7lxxxfr.exe33⤵
- Executes dropped EXE
PID:528 -
\??\c:\hhttnn.exec:\hhttnn.exe34⤵
- Executes dropped EXE
PID:472 -
\??\c:\vvpdp.exec:\vvpdp.exe35⤵
- Executes dropped EXE
PID:536 -
\??\c:\pjdpp.exec:\pjdpp.exe36⤵
- Executes dropped EXE
PID:1280 -
\??\c:\xxlfxfl.exec:\xxlfxfl.exe37⤵
- Executes dropped EXE
PID:1620 -
\??\c:\hnbtnt.exec:\hnbtnt.exe38⤵
- Executes dropped EXE
PID:1940 -
\??\c:\hbtbhh.exec:\hbtbhh.exe39⤵
- Executes dropped EXE
PID:2340 -
\??\c:\jdpvd.exec:\jdpvd.exe40⤵
- Executes dropped EXE
PID:2852 -
\??\c:\lflllrx.exec:\lflllrx.exe41⤵
- Executes dropped EXE
PID:2816 -
\??\c:\flxxrxf.exec:\flxxrxf.exe42⤵
- Executes dropped EXE
PID:2820 -
\??\c:\nhbbnh.exec:\nhbbnh.exe43⤵
- Executes dropped EXE
PID:2456 -
\??\c:\nnbnnb.exec:\nnbnnb.exe44⤵
- Executes dropped EXE
PID:2708 -
\??\c:\7dvpj.exec:\7dvpj.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xrlxffr.exec:\xrlxffr.exe46⤵
- Executes dropped EXE
PID:2680 -
\??\c:\bhbnbn.exec:\bhbnbn.exe47⤵
- Executes dropped EXE
PID:2624 -
\??\c:\hbbbnn.exec:\hbbbnn.exe48⤵
- Executes dropped EXE
PID:2692 -
\??\c:\vvpvj.exec:\vvpvj.exe49⤵
- Executes dropped EXE
PID:1324 -
\??\c:\dvvjp.exec:\dvvjp.exe50⤵
- Executes dropped EXE
PID:1656 -
\??\c:\rlffllr.exec:\rlffllr.exe51⤵
- Executes dropped EXE
PID:1304 -
\??\c:\7bnnnt.exec:\7bnnnt.exe52⤵
- Executes dropped EXE
PID:2676 -
\??\c:\dvvdp.exec:\dvvdp.exe53⤵
- Executes dropped EXE
PID:2716 -
\??\c:\pjvdv.exec:\pjvdv.exe54⤵
- Executes dropped EXE
PID:988 -
\??\c:\llfrffl.exec:\llfrffl.exe55⤵
- Executes dropped EXE
PID:2912 -
\??\c:\9hbbbt.exec:\9hbbbt.exe56⤵
- Executes dropped EXE
PID:2432 -
\??\c:\vvpdj.exec:\vvpdj.exe57⤵
- Executes dropped EXE
PID:1756 -
\??\c:\9vppd.exec:\9vppd.exe58⤵
- Executes dropped EXE
PID:1164 -
\??\c:\9rllrrx.exec:\9rllrrx.exe59⤵
- Executes dropped EXE
PID:2200 -
\??\c:\1hnhhn.exec:\1hnhhn.exe60⤵
- Executes dropped EXE
PID:1804 -
\??\c:\vpdjv.exec:\vpdjv.exe61⤵
- Executes dropped EXE
PID:1436 -
\??\c:\dvjvd.exec:\dvjvd.exe62⤵
- Executes dropped EXE
PID:1972 -
\??\c:\xrrxllr.exec:\xrrxllr.exe63⤵
- Executes dropped EXE
PID:2268 -
\??\c:\nbthth.exec:\nbthth.exe64⤵
- Executes dropped EXE
PID:1968 -
\??\c:\jpdjd.exec:\jpdjd.exe65⤵
- Executes dropped EXE
PID:1768 -
\??\c:\pdpvv.exec:\pdpvv.exe66⤵PID:852
-
\??\c:\frflxxf.exec:\frflxxf.exe67⤵PID:1928
-
\??\c:\frllrfl.exec:\frllrfl.exe68⤵PID:1388
-
\??\c:\tntnnh.exec:\tntnnh.exe69⤵PID:2440
-
\??\c:\jvjpp.exec:\jvjpp.exe70⤵PID:568
-
\??\c:\lfxflrx.exec:\lfxflrx.exe71⤵PID:2424
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe72⤵PID:2412
-
\??\c:\5nbbhh.exec:\5nbbhh.exe73⤵PID:1684
-
\??\c:\1dvdd.exec:\1dvdd.exe74⤵PID:1932
-
\??\c:\jdpvd.exec:\jdpvd.exe75⤵PID:2348
-
\??\c:\xrxfffx.exec:\xrxfffx.exe76⤵PID:1580
-
\??\c:\bbnbth.exec:\bbnbth.exe77⤵PID:2108
-
\??\c:\hhbtbh.exec:\hhbtbh.exe78⤵PID:2972
-
\??\c:\ppdpj.exec:\ppdpj.exe79⤵PID:1672
-
\??\c:\rfrlfxx.exec:\rfrlfxx.exe80⤵PID:2408
-
\??\c:\lxlfxfl.exec:\lxlfxfl.exe81⤵PID:2748
-
\??\c:\htbtbb.exec:\htbtbb.exe82⤵PID:2244
-
\??\c:\ddvdj.exec:\ddvdj.exe83⤵PID:2892
-
\??\c:\1pdjp.exec:\1pdjp.exe84⤵PID:2860
-
\??\c:\rfllllr.exec:\rfllllr.exe85⤵PID:2772
-
\??\c:\lfrllfl.exec:\lfrllfl.exe86⤵PID:2896
-
\??\c:\htbbbb.exec:\htbbbb.exe87⤵PID:2456
-
\??\c:\pdjpp.exec:\pdjpp.exe88⤵PID:2708
-
\??\c:\vjjpd.exec:\vjjpd.exe89⤵PID:2640
-
\??\c:\bnbtbb.exec:\bnbtbb.exe90⤵PID:2684
-
\??\c:\thbbtt.exec:\thbbtt.exe91⤵PID:1172
-
\??\c:\dvjvd.exec:\dvjvd.exe92⤵
- System Location Discovery: System Language Discovery
PID:992 -
\??\c:\7xffffl.exec:\7xffffl.exe93⤵PID:2932
-
\??\c:\btnnbt.exec:\btnnbt.exe94⤵PID:2364
-
\??\c:\9hbntb.exec:\9hbntb.exe95⤵PID:2872
-
\??\c:\vjppv.exec:\vjppv.exe96⤵PID:1800
-
\??\c:\vdppd.exec:\vdppd.exe97⤵PID:2796
-
\??\c:\5flrlfx.exec:\5flrlfx.exe98⤵PID:988
-
\??\c:\bnnthn.exec:\bnnthn.exe99⤵PID:1664
-
\??\c:\dppjp.exec:\dppjp.exe100⤵PID:2204
-
\??\c:\dvdpv.exec:\dvdpv.exe101⤵PID:1044
-
\??\c:\rxrxffl.exec:\rxrxffl.exe102⤵PID:1164
-
\??\c:\9rxlxrf.exec:\9rxlxrf.exe103⤵PID:1836
-
\??\c:\thttnh.exec:\thttnh.exe104⤵PID:1884
-
\??\c:\pdvjv.exec:\pdvjv.exe105⤵PID:776
-
\??\c:\7xllrlr.exec:\7xllrlr.exe106⤵PID:956
-
\??\c:\fxllffl.exec:\fxllffl.exe107⤵PID:1528
-
\??\c:\tthtbb.exec:\tthtbb.exe108⤵PID:2596
-
\??\c:\9djjp.exec:\9djjp.exe109⤵PID:1768
-
\??\c:\3djjj.exec:\3djjj.exe110⤵PID:2448
-
\??\c:\frrxflr.exec:\frrxflr.exe111⤵PID:1928
-
\??\c:\3tbnnb.exec:\3tbnnb.exe112⤵PID:2568
-
\??\c:\nhtbnt.exec:\nhtbnt.exe113⤵PID:2440
-
\??\c:\dpvvp.exec:\dpvvp.exe114⤵PID:2444
-
\??\c:\lrlxlrx.exec:\lrlxlrx.exe115⤵PID:2248
-
\??\c:\nbbttn.exec:\nbbttn.exe116⤵PID:2508
-
\??\c:\7nthbb.exec:\7nthbb.exe117⤵PID:1740
-
\??\c:\jdpvj.exec:\jdpvj.exe118⤵PID:1276
-
\??\c:\xfrrxxf.exec:\xfrrxxf.exe119⤵PID:1588
-
\??\c:\hbhnbh.exec:\hbhnbh.exe120⤵PID:1584
-
\??\c:\nhhhtt.exec:\nhhhtt.exe121⤵PID:2544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-