Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 04:55
Static task
static1
Behavioral task
behavioral1
Sample
2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe
Resource
win7-20240903-en
General
-
Target
2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe
-
Size
455KB
-
MD5
99b0e89fcc039943b0e4ba46c02e3d2e
-
SHA1
14ea75bd4995909017847cf1cfbb2de046517296
-
SHA256
2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5
-
SHA512
df322442f85a58413474a6c47e53fc51dce4b086271f3f4eb73230f41b2c2fb6cb1f82ac0effe0a63dab8bde25b6a546c99d649f1031195f7ac126085ad23e6b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRI7:q7Tc2NYHUrAwfMp3CDRg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/2388-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-65-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2832-46-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2624-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-83-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2776-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-93-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2128-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1228-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/596-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/940-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/440-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-233-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1272-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-251-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1040-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-384-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2496-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-414-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1240-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-424-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2416-477-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2416-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-503-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2320-502-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1352-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-523-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2012-536-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1552-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-550-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1484-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-659-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2328-708-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1804-715-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/596-748-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2548-807-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2548-827-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1016-840-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3004-939-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2840-956-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1468-1029-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/940-1038-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1348 nnbbnh.exe 2404 1jddd.exe 2268 xrlrrrr.exe 2832 7bttnt.exe 2932 lxllffl.exe 2848 rrfxrxx.exe 2624 hbtbnn.exe 2776 5djdv.exe 2676 5ffxfff.exe 2128 vpjpp.exe 1228 lfrrxxf.exe 1832 3tbhnt.exe 2024 pjppv.exe 2348 nnhhtt.exe 3016 pdpjp.exe 1932 jvjpv.exe 1036 3xrrxxl.exe 1736 djvjv.exe 596 lfrxffl.exe 940 nbtttt.exe 1292 vdjpd.exe 440 xlxxfll.exe 2320 7ntbhh.exe 1612 1pjvd.exe 1272 1jvjp.exe 2172 1tnttt.exe 1244 jjdjp.exe 2260 rlxxxfl.exe 2468 bnbbnh.exe 1040 9pjjv.exe 1728 xrllxrf.exe 1600 5hhbhn.exe 2876 xrlrxfl.exe 2476 tnhhtt.exe 2748 5vjjp.exe 2000 pdjjp.exe 2800 fxfflfl.exe 2752 1bnntt.exe 2796 nhbtnt.exe 2848 9jvvd.exe 2700 xlffflr.exe 2668 fxlrffx.exe 3000 hhbhtt.exe 3028 dvvvv.exe 2496 jdvjp.exe 892 xxrxxfl.exe 1304 bnnthb.exe 2912 7vpvv.exe 1240 dvpvj.exe 1248 fxlfffr.exe 2672 9nbtbh.exe 2692 ppvpv.exe 1984 jvpvv.exe 1516 rlxfrrr.exe 1752 bthhhh.exe 2224 nhttnn.exe 264 7djjj.exe 864 5ffxfxx.exe 2416 btnhnn.exe 2584 7nttnn.exe 2952 jdvvv.exe 2320 9xlflll.exe 1544 llxflrf.exe 1612 nhttnn.exe -
resource yara_rule behavioral1/memory/2388-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/440-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-283-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1040-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-322-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2000-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-353-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2496-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-414-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1240-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-477-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2416-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-502-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1352-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-781-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1960-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-886-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2908-912-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-999-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvjj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 1348 2388 2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe 30 PID 2388 wrote to memory of 1348 2388 2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe 30 PID 2388 wrote to memory of 1348 2388 2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe 30 PID 2388 wrote to memory of 1348 2388 2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe 30 PID 1348 wrote to memory of 2404 1348 nnbbnh.exe 31 PID 1348 wrote to memory of 2404 1348 nnbbnh.exe 31 PID 1348 wrote to memory of 2404 1348 nnbbnh.exe 31 PID 1348 wrote to memory of 2404 1348 nnbbnh.exe 31 PID 2404 wrote to memory of 2268 2404 1jddd.exe 32 PID 2404 wrote to memory of 2268 2404 1jddd.exe 32 PID 2404 wrote to memory of 2268 2404 1jddd.exe 32 PID 2404 wrote to memory of 2268 2404 1jddd.exe 32 PID 2268 wrote to memory of 2832 2268 xrlrrrr.exe 33 PID 2268 wrote to memory of 2832 2268 xrlrrrr.exe 33 PID 2268 wrote to memory of 2832 2268 xrlrrrr.exe 33 PID 2268 wrote to memory of 2832 2268 xrlrrrr.exe 33 PID 2832 wrote to memory of 2932 2832 7bttnt.exe 34 PID 2832 wrote to memory of 2932 2832 7bttnt.exe 34 PID 2832 wrote to memory of 2932 2832 7bttnt.exe 34 PID 2832 wrote to memory of 2932 2832 7bttnt.exe 34 PID 2932 wrote to memory of 2848 2932 lxllffl.exe 35 PID 2932 wrote to memory of 2848 2932 lxllffl.exe 35 PID 2932 wrote to memory of 2848 2932 lxllffl.exe 35 PID 2932 wrote to memory of 2848 2932 lxllffl.exe 35 PID 2848 wrote to memory of 2624 2848 rrfxrxx.exe 36 PID 2848 wrote to memory of 2624 2848 rrfxrxx.exe 36 PID 2848 wrote to memory of 2624 2848 rrfxrxx.exe 36 PID 2848 wrote to memory of 2624 2848 rrfxrxx.exe 36 PID 2624 wrote to memory of 2776 2624 hbtbnn.exe 37 PID 2624 wrote to memory of 2776 2624 hbtbnn.exe 37 PID 2624 wrote to memory of 2776 2624 hbtbnn.exe 37 PID 2624 wrote to memory of 2776 2624 hbtbnn.exe 37 PID 2776 wrote to memory of 2676 2776 5djdv.exe 38 PID 2776 wrote to memory of 2676 2776 5djdv.exe 38 PID 2776 wrote to memory of 2676 2776 5djdv.exe 38 PID 2776 wrote to memory of 2676 2776 5djdv.exe 38 PID 2676 wrote to memory of 2128 2676 5ffxfff.exe 39 PID 2676 wrote to memory of 2128 2676 5ffxfff.exe 39 PID 2676 wrote to memory of 2128 2676 5ffxfff.exe 39 PID 2676 wrote to memory of 2128 2676 5ffxfff.exe 39 PID 2128 wrote to memory of 1228 2128 vpjpp.exe 40 PID 2128 wrote to memory of 1228 2128 vpjpp.exe 40 PID 2128 wrote to memory of 1228 2128 vpjpp.exe 40 PID 2128 wrote to memory of 1228 2128 vpjpp.exe 40 PID 1228 wrote to memory of 1832 1228 lfrrxxf.exe 41 PID 1228 wrote to memory of 1832 1228 lfrrxxf.exe 41 PID 1228 wrote to memory of 1832 1228 lfrrxxf.exe 41 PID 1228 wrote to memory of 1832 1228 lfrrxxf.exe 41 PID 1832 wrote to memory of 2024 1832 3tbhnt.exe 42 PID 1832 wrote to memory of 2024 1832 3tbhnt.exe 42 PID 1832 wrote to memory of 2024 1832 3tbhnt.exe 42 PID 1832 wrote to memory of 2024 1832 3tbhnt.exe 42 PID 2024 wrote to memory of 2348 2024 pjppv.exe 43 PID 2024 wrote to memory of 2348 2024 pjppv.exe 43 PID 2024 wrote to memory of 2348 2024 pjppv.exe 43 PID 2024 wrote to memory of 2348 2024 pjppv.exe 43 PID 2348 wrote to memory of 3016 2348 nnhhtt.exe 44 PID 2348 wrote to memory of 3016 2348 nnhhtt.exe 44 PID 2348 wrote to memory of 3016 2348 nnhhtt.exe 44 PID 2348 wrote to memory of 3016 2348 nnhhtt.exe 44 PID 3016 wrote to memory of 1932 3016 pdpjp.exe 45 PID 3016 wrote to memory of 1932 3016 pdpjp.exe 45 PID 3016 wrote to memory of 1932 3016 pdpjp.exe 45 PID 3016 wrote to memory of 1932 3016 pdpjp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe"C:\Users\Admin\AppData\Local\Temp\2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\nnbbnh.exec:\nnbbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\1jddd.exec:\1jddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\xrlrrrr.exec:\xrlrrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\7bttnt.exec:\7bttnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\lxllffl.exec:\lxllffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\rrfxrxx.exec:\rrfxrxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\hbtbnn.exec:\hbtbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\5djdv.exec:\5djdv.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\5ffxfff.exec:\5ffxfff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\vpjpp.exec:\vpjpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\3tbhnt.exec:\3tbhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\pjppv.exec:\pjppv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\nnhhtt.exec:\nnhhtt.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\pdpjp.exec:\pdpjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\jvjpv.exec:\jvjpv.exe17⤵
- Executes dropped EXE
PID:1932 -
\??\c:\3xrrxxl.exec:\3xrrxxl.exe18⤵
- Executes dropped EXE
PID:1036 -
\??\c:\djvjv.exec:\djvjv.exe19⤵
- Executes dropped EXE
PID:1736 -
\??\c:\lfrxffl.exec:\lfrxffl.exe20⤵
- Executes dropped EXE
PID:596 -
\??\c:\nbtttt.exec:\nbtttt.exe21⤵
- Executes dropped EXE
PID:940 -
\??\c:\vdjpd.exec:\vdjpd.exe22⤵
- Executes dropped EXE
PID:1292 -
\??\c:\xlxxfll.exec:\xlxxfll.exe23⤵
- Executes dropped EXE
PID:440 -
\??\c:\7ntbhh.exec:\7ntbhh.exe24⤵
- Executes dropped EXE
PID:2320 -
\??\c:\1pjvd.exec:\1pjvd.exe25⤵
- Executes dropped EXE
PID:1612 -
\??\c:\1jvjp.exec:\1jvjp.exe26⤵
- Executes dropped EXE
PID:1272 -
\??\c:\1tnttt.exec:\1tnttt.exe27⤵
- Executes dropped EXE
PID:2172 -
\??\c:\jjdjp.exec:\jjdjp.exe28⤵
- Executes dropped EXE
PID:1244 -
\??\c:\rlxxxfl.exec:\rlxxxfl.exe29⤵
- Executes dropped EXE
PID:2260 -
\??\c:\bnbbnh.exec:\bnbbnh.exe30⤵
- Executes dropped EXE
PID:2468 -
\??\c:\9pjjv.exec:\9pjjv.exe31⤵
- Executes dropped EXE
PID:1040 -
\??\c:\xrllxrf.exec:\xrllxrf.exe32⤵
- Executes dropped EXE
PID:1728 -
\??\c:\5hhbhn.exec:\5hhbhn.exe33⤵
- Executes dropped EXE
PID:1600 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe34⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tnhhtt.exec:\tnhhtt.exe35⤵
- Executes dropped EXE
PID:2476 -
\??\c:\5vjjp.exec:\5vjjp.exe36⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pdjjp.exec:\pdjjp.exe37⤵
- Executes dropped EXE
PID:2000 -
\??\c:\fxfflfl.exec:\fxfflfl.exe38⤵
- Executes dropped EXE
PID:2800 -
\??\c:\1bnntt.exec:\1bnntt.exe39⤵
- Executes dropped EXE
PID:2752 -
\??\c:\nhbtnt.exec:\nhbtnt.exe40⤵
- Executes dropped EXE
PID:2796 -
\??\c:\9jvvd.exec:\9jvvd.exe41⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xlffflr.exec:\xlffflr.exe42⤵
- Executes dropped EXE
PID:2700 -
\??\c:\fxlrffx.exec:\fxlrffx.exe43⤵
- Executes dropped EXE
PID:2668 -
\??\c:\hhbhtt.exec:\hhbhtt.exe44⤵
- Executes dropped EXE
PID:3000 -
\??\c:\dvvvv.exec:\dvvvv.exe45⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jdvjp.exec:\jdvjp.exe46⤵
- Executes dropped EXE
PID:2496 -
\??\c:\xxrxxfl.exec:\xxrxxfl.exe47⤵
- Executes dropped EXE
PID:892 -
\??\c:\bnnthb.exec:\bnnthb.exe48⤵
- Executes dropped EXE
PID:1304 -
\??\c:\7vpvv.exec:\7vpvv.exe49⤵
- Executes dropped EXE
PID:2912 -
\??\c:\dvpvj.exec:\dvpvj.exe50⤵
- Executes dropped EXE
PID:1240 -
\??\c:\fxlfffr.exec:\fxlfffr.exe51⤵
- Executes dropped EXE
PID:1248 -
\??\c:\9nbtbh.exec:\9nbtbh.exe52⤵
- Executes dropped EXE
PID:2672 -
\??\c:\ppvpv.exec:\ppvpv.exe53⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jvpvv.exec:\jvpvv.exe54⤵
- Executes dropped EXE
PID:1984 -
\??\c:\rlxfrrr.exec:\rlxfrrr.exe55⤵
- Executes dropped EXE
PID:1516 -
\??\c:\bthhhh.exec:\bthhhh.exe56⤵
- Executes dropped EXE
PID:1752 -
\??\c:\nhttnn.exec:\nhttnn.exe57⤵
- Executes dropped EXE
PID:2224 -
\??\c:\7djjj.exec:\7djjj.exe58⤵
- Executes dropped EXE
PID:264 -
\??\c:\5ffxfxx.exec:\5ffxfxx.exe59⤵
- Executes dropped EXE
PID:864 -
\??\c:\btnhnn.exec:\btnhnn.exe60⤵
- Executes dropped EXE
PID:2416 -
\??\c:\7nttnn.exec:\7nttnn.exe61⤵
- Executes dropped EXE
PID:2584 -
\??\c:\jdvvv.exec:\jdvvv.exe62⤵
- Executes dropped EXE
PID:2952 -
\??\c:\9xlflll.exec:\9xlflll.exe63⤵
- Executes dropped EXE
PID:2320 -
\??\c:\llxflrf.exec:\llxflrf.exe64⤵
- Executes dropped EXE
PID:1544 -
\??\c:\nhttnn.exec:\nhttnn.exe65⤵
- Executes dropped EXE
PID:1612 -
\??\c:\htnntt.exec:\htnntt.exe66⤵PID:1352
-
\??\c:\jjvdv.exec:\jjvdv.exe67⤵PID:2440
-
\??\c:\ffrrxfr.exec:\ffrrxfr.exe68⤵PID:2012
-
\??\c:\rllrflr.exec:\rllrflr.exe69⤵PID:1244
-
\??\c:\hhbbhb.exec:\hhbbhb.exe70⤵PID:1552
-
\??\c:\jdjjv.exec:\jdjjv.exe71⤵PID:1484
-
\??\c:\7jdvv.exec:\7jdvv.exe72⤵PID:904
-
\??\c:\rllffrr.exec:\rllffrr.exe73⤵PID:1044
-
\??\c:\tnbbhh.exec:\tnbbhh.exe74⤵PID:1724
-
\??\c:\7nbttt.exec:\7nbttt.exe75⤵PID:2508
-
\??\c:\pdjdd.exec:\pdjdd.exe76⤵PID:1348
-
\??\c:\ffrfllx.exec:\ffrfllx.exe77⤵PID:2916
-
\??\c:\rfffffl.exec:\rfffffl.exe78⤵PID:2744
-
\??\c:\btnthh.exec:\btnthh.exe79⤵PID:2428
-
\??\c:\1vjdj.exec:\1vjdj.exe80⤵PID:2000
-
\??\c:\pvjdp.exec:\pvjdp.exe81⤵PID:2800
-
\??\c:\bnhhtt.exec:\bnhhtt.exe82⤵PID:2708
-
\??\c:\bttbtt.exec:\bttbtt.exe83⤵PID:2140
-
\??\c:\5jjjj.exec:\5jjjj.exe84⤵PID:2908
-
\??\c:\frfxxrr.exec:\frfxxrr.exe85⤵PID:2856
-
\??\c:\rlllxfr.exec:\rlllxfr.exe86⤵PID:2648
-
\??\c:\nbhbbh.exec:\nbhbbh.exe87⤵PID:2644
-
\??\c:\1dpjd.exec:\1dpjd.exe88⤵PID:1680
-
\??\c:\jvjjp.exec:\jvjjp.exe89⤵PID:2128
-
\??\c:\lxlflff.exec:\lxlflff.exe90⤵PID:856
-
\??\c:\rfxxfll.exec:\rfxxfll.exe91⤵PID:2432
-
\??\c:\1hhntt.exec:\1hhntt.exe92⤵PID:2328
-
\??\c:\3vppv.exec:\3vppv.exe93⤵PID:1684
-
\??\c:\fxllxxl.exec:\fxllxxl.exe94⤵
- System Location Discovery: System Language Discovery
PID:1252 -
\??\c:\fxrrxxf.exec:\fxrrxxf.exe95⤵PID:2884
-
\??\c:\3thhnt.exec:\3thhnt.exe96⤵PID:1804
-
\??\c:\jjjdv.exec:\jjjdv.exe97⤵PID:2488
-
\??\c:\xlfxffl.exec:\xlfxffl.exe98⤵PID:2004
-
\??\c:\rlxlffl.exec:\rlxlffl.exe99⤵PID:2276
-
\??\c:\7hntbh.exec:\7hntbh.exe100⤵PID:1736
-
\??\c:\dvvvj.exec:\dvvvj.exe101⤵PID:596
-
\??\c:\jdvvj.exec:\jdvvj.exe102⤵PID:532
-
\??\c:\3lxfllx.exec:\3lxfllx.exe103⤵PID:2288
-
\??\c:\ttbtbh.exec:\ttbtbh.exe104⤵PID:2464
-
\??\c:\bnhntb.exec:\bnhntb.exe105⤵PID:404
-
\??\c:\dvdvj.exec:\dvdvj.exe106⤵PID:1368
-
\??\c:\9lxffff.exec:\9lxffff.exe107⤵PID:1852
-
\??\c:\lrrrlff.exec:\lrrrlff.exe108⤵PID:1308
-
\??\c:\nhthnn.exec:\nhthnn.exe109⤵PID:492
-
\??\c:\5dppj.exec:\5dppj.exe110⤵PID:2548
-
\??\c:\vjdjj.exec:\vjdjj.exe111⤵PID:2324
-
\??\c:\xrlrrll.exec:\xrlrrll.exe112⤵PID:1960
-
\??\c:\7bthbb.exec:\7bthbb.exe113⤵PID:2260
-
\??\c:\htbbhb.exec:\htbbhb.exe114⤵PID:2356
-
\??\c:\5vppj.exec:\5vppj.exe115⤵PID:1016
-
\??\c:\rfllfxr.exec:\rfllfxr.exe116⤵PID:2372
-
\??\c:\lrfxxrr.exec:\lrfxxrr.exe117⤵PID:1708
-
\??\c:\hhttbb.exec:\hhttbb.exe118⤵PID:2520
-
\??\c:\vjjpv.exec:\vjjpv.exe119⤵PID:2684
-
\??\c:\vjvpp.exec:\vjvpp.exe120⤵PID:2112
-
\??\c:\xlrffrl.exec:\xlrffrl.exe121⤵PID:1788
-
\??\c:\lxlllfl.exec:\lxlllfl.exe122⤵PID:2868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-