Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 04:51
Static task
static1
Behavioral task
behavioral1
Sample
2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe
Resource
win7-20240903-en
General
-
Target
2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe
-
Size
455KB
-
MD5
99b0e89fcc039943b0e4ba46c02e3d2e
-
SHA1
14ea75bd4995909017847cf1cfbb2de046517296
-
SHA256
2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5
-
SHA512
df322442f85a58413474a6c47e53fc51dce4b086271f3f4eb73230f41b2c2fb6cb1f82ac0effe0a63dab8bde25b6a546c99d649f1031195f7ac126085ad23e6b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRI7:q7Tc2NYHUrAwfMp3CDRg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2496-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/744-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-113-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2028-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/288-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-204-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/288-203-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1696-210-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2820-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-270-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/616-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/108-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-382-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2844-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-498-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2460-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-553-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2868-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-702-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-860-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1472-873-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2184-996-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-1108-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2508-1134-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2316 tnbtbb.exe 744 nnthhb.exe 2380 djvvd.exe 2188 llflrxl.exe 2776 1jvvj.exe 2732 5lfllfx.exe 2396 jdjvd.exe 2836 1lffffr.exe 2576 1pvdp.exe 2744 fxrxllr.exe 2076 dvjjd.exe 2028 xlrrffr.exe 1680 9vpvp.exe 1876 tbntnt.exe 2000 flxfffl.exe 2752 7lflxfl.exe 288 1vppd.exe 2908 xxrrffl.exe 2408 7dpvp.exe 2252 rlflrrf.exe 1696 fxxflll.exe 2820 lrlrfxf.exe 896 vddjj.exe 1772 hbtbtb.exe 352 rrfrffr.exe 3028 9jdjd.exe 2344 3ttnhb.exe 616 vpppd.exe 1728 7tntth.exe 3044 nnhhnt.exe 1928 1rlllfl.exe 1860 nhbthn.exe 768 lflfflx.exe 804 1hthtt.exe 108 jjjvj.exe 2724 fxllrrf.exe 2780 hhthth.exe 2448 nnhhnt.exe 2732 jjjjd.exe 2852 flxrffr.exe 2688 1xrxllr.exe 2572 hbbbhh.exe 2652 dvppv.exe 2884 rlxlxfr.exe 1156 lfrxllf.exe 2844 tthntb.exe 1668 9dpdj.exe 1672 vvjpj.exe 1372 lfrxflx.exe 1084 nhtbtt.exe 1220 hhnnnn.exe 856 5jvvd.exe 2832 xxxfrrx.exe 288 rxxfrxl.exe 2848 bhthnb.exe 2144 dpjjp.exe 2356 ppdpd.exe 1288 9thhbh.exe 1128 hbnnbh.exe 1532 dvpvp.exe 2368 5lfflfl.exe 1792 lrlfllx.exe 2460 5tnthb.exe 3048 9vpvj.exe -
resource yara_rule behavioral1/memory/2496-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/744-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-118-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2028-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-182-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/1696-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/616-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-476-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2356-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-996-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-1057-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/616-1089-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-1172-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xfxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2496 wrote to memory of 2316 2496 2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe 31 PID 2496 wrote to memory of 2316 2496 2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe 31 PID 2496 wrote to memory of 2316 2496 2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe 31 PID 2496 wrote to memory of 2316 2496 2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe 31 PID 2316 wrote to memory of 744 2316 tnbtbb.exe 32 PID 2316 wrote to memory of 744 2316 tnbtbb.exe 32 PID 2316 wrote to memory of 744 2316 tnbtbb.exe 32 PID 2316 wrote to memory of 744 2316 tnbtbb.exe 32 PID 744 wrote to memory of 2380 744 nnthhb.exe 33 PID 744 wrote to memory of 2380 744 nnthhb.exe 33 PID 744 wrote to memory of 2380 744 nnthhb.exe 33 PID 744 wrote to memory of 2380 744 nnthhb.exe 33 PID 2380 wrote to memory of 2188 2380 djvvd.exe 34 PID 2380 wrote to memory of 2188 2380 djvvd.exe 34 PID 2380 wrote to memory of 2188 2380 djvvd.exe 34 PID 2380 wrote to memory of 2188 2380 djvvd.exe 34 PID 2188 wrote to memory of 2776 2188 llflrxl.exe 35 PID 2188 wrote to memory of 2776 2188 llflrxl.exe 35 PID 2188 wrote to memory of 2776 2188 llflrxl.exe 35 PID 2188 wrote to memory of 2776 2188 llflrxl.exe 35 PID 2776 wrote to memory of 2732 2776 1jvvj.exe 36 PID 2776 wrote to memory of 2732 2776 1jvvj.exe 36 PID 2776 wrote to memory of 2732 2776 1jvvj.exe 36 PID 2776 wrote to memory of 2732 2776 1jvvj.exe 36 PID 2732 wrote to memory of 2396 2732 5lfllfx.exe 37 PID 2732 wrote to memory of 2396 2732 5lfllfx.exe 37 PID 2732 wrote to memory of 2396 2732 5lfllfx.exe 37 PID 2732 wrote to memory of 2396 2732 5lfllfx.exe 37 PID 2396 wrote to memory of 2836 2396 jdjvd.exe 38 PID 2396 wrote to memory of 2836 2396 jdjvd.exe 38 PID 2396 wrote to memory of 2836 2396 jdjvd.exe 38 PID 2396 wrote to memory of 2836 2396 jdjvd.exe 38 PID 2836 wrote to memory of 2576 2836 1lffffr.exe 39 PID 2836 wrote to memory of 2576 2836 1lffffr.exe 39 PID 2836 wrote to memory of 2576 2836 1lffffr.exe 39 PID 2836 wrote to memory of 2576 2836 1lffffr.exe 39 PID 2576 wrote to memory of 2744 2576 1pvdp.exe 40 PID 2576 wrote to memory of 2744 2576 1pvdp.exe 40 PID 2576 wrote to memory of 2744 2576 1pvdp.exe 40 PID 2576 wrote to memory of 2744 2576 1pvdp.exe 40 PID 2744 wrote to memory of 2076 2744 fxrxllr.exe 41 PID 2744 wrote to memory of 2076 2744 fxrxllr.exe 41 PID 2744 wrote to memory of 2076 2744 fxrxllr.exe 41 PID 2744 wrote to memory of 2076 2744 fxrxllr.exe 41 PID 2076 wrote to memory of 2028 2076 dvjjd.exe 42 PID 2076 wrote to memory of 2028 2076 dvjjd.exe 42 PID 2076 wrote to memory of 2028 2076 dvjjd.exe 42 PID 2076 wrote to memory of 2028 2076 dvjjd.exe 42 PID 2028 wrote to memory of 1680 2028 xlrrffr.exe 43 PID 2028 wrote to memory of 1680 2028 xlrrffr.exe 43 PID 2028 wrote to memory of 1680 2028 xlrrffr.exe 43 PID 2028 wrote to memory of 1680 2028 xlrrffr.exe 43 PID 1680 wrote to memory of 1876 1680 9vpvp.exe 44 PID 1680 wrote to memory of 1876 1680 9vpvp.exe 44 PID 1680 wrote to memory of 1876 1680 9vpvp.exe 44 PID 1680 wrote to memory of 1876 1680 9vpvp.exe 44 PID 1876 wrote to memory of 2000 1876 tbntnt.exe 45 PID 1876 wrote to memory of 2000 1876 tbntnt.exe 45 PID 1876 wrote to memory of 2000 1876 tbntnt.exe 45 PID 1876 wrote to memory of 2000 1876 tbntnt.exe 45 PID 2000 wrote to memory of 2752 2000 flxfffl.exe 46 PID 2000 wrote to memory of 2752 2000 flxfffl.exe 46 PID 2000 wrote to memory of 2752 2000 flxfffl.exe 46 PID 2000 wrote to memory of 2752 2000 flxfffl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe"C:\Users\Admin\AppData\Local\Temp\2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\tnbtbb.exec:\tnbtbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\nnthhb.exec:\nnthhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\djvvd.exec:\djvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\llflrxl.exec:\llflrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\1jvvj.exec:\1jvvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\5lfllfx.exec:\5lfllfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\jdjvd.exec:\jdjvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\1lffffr.exec:\1lffffr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\1pvdp.exec:\1pvdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\fxrxllr.exec:\fxrxllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\dvjjd.exec:\dvjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\xlrrffr.exec:\xlrrffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\9vpvp.exec:\9vpvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\tbntnt.exec:\tbntnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\flxfffl.exec:\flxfffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\7lflxfl.exec:\7lflxfl.exe17⤵
- Executes dropped EXE
PID:2752 -
\??\c:\1vppd.exec:\1vppd.exe18⤵
- Executes dropped EXE
PID:288 -
\??\c:\xxrrffl.exec:\xxrrffl.exe19⤵
- Executes dropped EXE
PID:2908 -
\??\c:\7dpvp.exec:\7dpvp.exe20⤵
- Executes dropped EXE
PID:2408 -
\??\c:\rlflrrf.exec:\rlflrrf.exe21⤵
- Executes dropped EXE
PID:2252 -
\??\c:\fxxflll.exec:\fxxflll.exe22⤵
- Executes dropped EXE
PID:1696 -
\??\c:\lrlrfxf.exec:\lrlrfxf.exe23⤵
- Executes dropped EXE
PID:2820 -
\??\c:\vddjj.exec:\vddjj.exe24⤵
- Executes dropped EXE
PID:896 -
\??\c:\hbtbtb.exec:\hbtbtb.exe25⤵
- Executes dropped EXE
PID:1772 -
\??\c:\rrfrffr.exec:\rrfrffr.exe26⤵
- Executes dropped EXE
PID:352 -
\??\c:\9jdjd.exec:\9jdjd.exe27⤵
- Executes dropped EXE
PID:3028 -
\??\c:\3ttnhb.exec:\3ttnhb.exe28⤵
- Executes dropped EXE
PID:2344 -
\??\c:\vpppd.exec:\vpppd.exe29⤵
- Executes dropped EXE
PID:616 -
\??\c:\7tntth.exec:\7tntth.exe30⤵
- Executes dropped EXE
PID:1728 -
\??\c:\nnhhnt.exec:\nnhhnt.exe31⤵
- Executes dropped EXE
PID:3044 -
\??\c:\1rlllfl.exec:\1rlllfl.exe32⤵
- Executes dropped EXE
PID:1928 -
\??\c:\nhbthn.exec:\nhbthn.exe33⤵
- Executes dropped EXE
PID:1860 -
\??\c:\lflfflx.exec:\lflfflx.exe34⤵
- Executes dropped EXE
PID:768 -
\??\c:\1hthtt.exec:\1hthtt.exe35⤵
- Executes dropped EXE
PID:804 -
\??\c:\jjjvj.exec:\jjjvj.exe36⤵
- Executes dropped EXE
PID:108 -
\??\c:\fxllrrf.exec:\fxllrrf.exe37⤵
- Executes dropped EXE
PID:2724 -
\??\c:\hhthth.exec:\hhthth.exe38⤵
- Executes dropped EXE
PID:2780 -
\??\c:\nnhhnt.exec:\nnhhnt.exe39⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jjjjd.exec:\jjjjd.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\flxrffr.exec:\flxrffr.exe41⤵
- Executes dropped EXE
PID:2852 -
\??\c:\1xrxllr.exec:\1xrxllr.exe42⤵
- Executes dropped EXE
PID:2688 -
\??\c:\hbbbhh.exec:\hbbbhh.exe43⤵
- Executes dropped EXE
PID:2572 -
\??\c:\dvppv.exec:\dvppv.exe44⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rlxlxfr.exec:\rlxlxfr.exe45⤵
- Executes dropped EXE
PID:2884 -
\??\c:\lfrxllf.exec:\lfrxllf.exe46⤵
- Executes dropped EXE
PID:1156 -
\??\c:\tthntb.exec:\tthntb.exe47⤵
- Executes dropped EXE
PID:2844 -
\??\c:\9dpdj.exec:\9dpdj.exe48⤵
- Executes dropped EXE
PID:1668 -
\??\c:\vvjpj.exec:\vvjpj.exe49⤵
- Executes dropped EXE
PID:1672 -
\??\c:\lfrxflx.exec:\lfrxflx.exe50⤵
- Executes dropped EXE
PID:1372 -
\??\c:\nhtbtt.exec:\nhtbtt.exe51⤵
- Executes dropped EXE
PID:1084 -
\??\c:\hhnnnn.exec:\hhnnnn.exe52⤵
- Executes dropped EXE
PID:1220 -
\??\c:\5jvvd.exec:\5jvvd.exe53⤵
- Executes dropped EXE
PID:856 -
\??\c:\xxxfrrx.exec:\xxxfrrx.exe54⤵
- Executes dropped EXE
PID:2832 -
\??\c:\rxxfrxl.exec:\rxxfrxl.exe55⤵
- Executes dropped EXE
PID:288 -
\??\c:\bhthnb.exec:\bhthnb.exe56⤵
- Executes dropped EXE
PID:2848 -
\??\c:\dpjjp.exec:\dpjjp.exe57⤵
- Executes dropped EXE
PID:2144 -
\??\c:\ppdpd.exec:\ppdpd.exe58⤵
- Executes dropped EXE
PID:2356 -
\??\c:\9thhbh.exec:\9thhbh.exe59⤵
- Executes dropped EXE
PID:1288 -
\??\c:\hbnnbh.exec:\hbnnbh.exe60⤵
- Executes dropped EXE
PID:1128 -
\??\c:\dvpvp.exec:\dvpvp.exe61⤵
- Executes dropped EXE
PID:1532 -
\??\c:\5lfflfl.exec:\5lfflfl.exe62⤵
- Executes dropped EXE
PID:2368 -
\??\c:\lrlfllx.exec:\lrlfllx.exe63⤵
- Executes dropped EXE
PID:1792 -
\??\c:\5tnthb.exec:\5tnthb.exe64⤵
- Executes dropped EXE
PID:2460 -
\??\c:\9vpvj.exec:\9vpvj.exe65⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xlflxxl.exec:\xlflxxl.exe66⤵PID:1468
-
\??\c:\fxrflrr.exec:\fxrflrr.exe67⤵PID:2420
-
\??\c:\bnhbnn.exec:\bnhbnn.exe68⤵PID:2424
-
\??\c:\hhhtbh.exec:\hhhtbh.exe69⤵PID:2080
-
\??\c:\ddjjp.exec:\ddjjp.exe70⤵PID:940
-
\??\c:\ffxflxr.exec:\ffxflxr.exe71⤵PID:2112
-
\??\c:\3tthnt.exec:\3tthnt.exe72⤵PID:1568
-
\??\c:\ntbtbt.exec:\ntbtbt.exe73⤵PID:1880
-
\??\c:\3vpvv.exec:\3vpvv.exe74⤵PID:2968
-
\??\c:\5vdvd.exec:\5vdvd.exe75⤵PID:2472
-
\??\c:\llxflrf.exec:\llxflrf.exe76⤵PID:2128
-
\??\c:\ntntbh.exec:\ntntbh.exe77⤵PID:2380
-
\??\c:\nntbbh.exec:\nntbbh.exe78⤵PID:1864
-
\??\c:\vdvjv.exec:\vdvjv.exe79⤵PID:2868
-
\??\c:\7ffxflr.exec:\7ffxflr.exe80⤵PID:2784
-
\??\c:\3bnthh.exec:\3bnthh.exe81⤵PID:2716
-
\??\c:\5thnbb.exec:\5thnbb.exe82⤵PID:2936
-
\??\c:\pjddj.exec:\pjddj.exe83⤵PID:2880
-
\??\c:\lrxxxxf.exec:\lrxxxxf.exe84⤵PID:2596
-
\??\c:\7llxlfl.exec:\7llxlfl.exe85⤵PID:2648
-
\??\c:\7btbbh.exec:\7btbbh.exe86⤵PID:3060
-
\??\c:\pjvdd.exec:\pjvdd.exe87⤵PID:2744
-
\??\c:\1jpdd.exec:\1jpdd.exe88⤵PID:2036
-
\??\c:\xxfflrx.exec:\xxfflrx.exe89⤵PID:1516
-
\??\c:\hhbhnh.exec:\hhbhnh.exe90⤵PID:1664
-
\??\c:\nnbbhh.exec:\nnbbhh.exe91⤵PID:1632
-
\??\c:\9jpdp.exec:\9jpdp.exe92⤵PID:2468
-
\??\c:\vdvdj.exec:\vdvdj.exe93⤵PID:1680
-
\??\c:\frrllll.exec:\frrllll.exe94⤵PID:2312
-
\??\c:\1nhhhn.exec:\1nhhhn.exe95⤵PID:2032
-
\??\c:\vpdvv.exec:\vpdvv.exe96⤵PID:856
-
\??\c:\vvjvj.exec:\vvjvj.exe97⤵PID:2800
-
\??\c:\xxlxxlx.exec:\xxlxxlx.exe98⤵PID:288
-
\??\c:\1bhnth.exec:\1bhnth.exe99⤵PID:2848
-
\??\c:\btbnnt.exec:\btbnnt.exe100⤵PID:2952
-
\??\c:\vppvv.exec:\vppvv.exe101⤵PID:1660
-
\??\c:\llllxxl.exec:\llllxxl.exe102⤵PID:1288
-
\??\c:\7flfxff.exec:\7flfxff.exe103⤵PID:1736
-
\??\c:\9nhnbh.exec:\9nhnbh.exe104⤵PID:1708
-
\??\c:\pvjjp.exec:\pvjjp.exe105⤵PID:924
-
\??\c:\vpvvd.exec:\vpvvd.exe106⤵PID:1520
-
\??\c:\9fxfxfr.exec:\9fxfxfr.exe107⤵
- System Location Discovery: System Language Discovery
PID:2400 -
\??\c:\bbthbh.exec:\bbthbh.exe108⤵PID:2432
-
\??\c:\hhbthb.exec:\hhbthb.exe109⤵PID:2412
-
\??\c:\1pdpp.exec:\1pdpp.exe110⤵PID:2924
-
\??\c:\xfrrxxf.exec:\xfrrxxf.exe111⤵PID:1320
-
\??\c:\xxrrfxr.exec:\xxrrfxr.exe112⤵PID:2524
-
\??\c:\nnhtnt.exec:\nnhtnt.exe113⤵PID:1740
-
\??\c:\1jvvd.exec:\1jvvd.exe114⤵PID:740
-
\??\c:\vpdjp.exec:\vpdjp.exe115⤵PID:1564
-
\??\c:\rlfflrl.exec:\rlfflrl.exe116⤵PID:2348
-
\??\c:\1nhntn.exec:\1nhntn.exe117⤵PID:2068
-
\??\c:\5bhbnt.exec:\5bhbnt.exe118⤵PID:2768
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe119⤵PID:2508
-
\??\c:\xffrlfl.exec:\xffrlfl.exe120⤵PID:2236
-
\??\c:\tbthtb.exec:\tbthtb.exe121⤵PID:1472
-
\??\c:\dvvvp.exec:\dvvvp.exe122⤵PID:2856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-