Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 05:10
Static task
static1
Behavioral task
behavioral1
Sample
1736376b090e6f3776955926d598c0a025649d5d0f8872601d55e9c1780bb142.exe
Resource
win7-20240903-en
General
-
Target
1736376b090e6f3776955926d598c0a025649d5d0f8872601d55e9c1780bb142.exe
-
Size
456KB
-
MD5
46587820306ccc5ffdaaeb8d521c3f77
-
SHA1
698ccd51d7de7529f6f011a543cf4e1019b22b88
-
SHA256
1736376b090e6f3776955926d598c0a025649d5d0f8872601d55e9c1780bb142
-
SHA512
d41a3fb95ce5ec167583249aadc5e2eae2ea365fe27a987560395be226d1ec413c803de84562fb2691eb7fd40a107f2334b513dd66f93d9ac14fe40cffb650f1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeLK:q7Tc2NYHUrAwfMp3CDLK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2388-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-92-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2124-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-110-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2860-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-201-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2576-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/608-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/608-221-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1592-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/388-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-505-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2184-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-553-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1640-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-587-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2688-603-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2980-623-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-664-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-744-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-941-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1628 pvjvv.exe 2516 pdvvd.exe 2684 3lxlfrr.exe 2192 3vvpv.exe 2744 fxllflx.exe 2980 pdppv.exe 2760 rfllrrr.exe 2904 vjdvd.exe 1932 lfflllf.exe 2676 thbbbb.exe 2124 xrrxfrx.exe 668 nhhnbh.exe 2860 7pdjj.exe 2440 9rxxxrr.exe 2672 9ntnnh.exe 1056 ppjjp.exe 1964 xrflxxl.exe 1352 jvpvp.exe 1952 xrfxlll.exe 2172 hbttnn.exe 2576 jdpdp.exe 2252 hbbntb.exe 608 9nnnnt.exe 2940 9lrrlrx.exe 1540 9ntbbb.exe 272 jvjpp.exe 1592 fxfxxrx.exe 344 9dppv.exe 2384 9pjpp.exe 1960 9frfxrr.exe 2060 hntnhh.exe 2084 rrfrffr.exe 1532 3nbttt.exe 1500 1pddd.exe 2496 rflllfx.exe 2684 ttnbnt.exe 2696 btbhnh.exe 2868 7jvdp.exe 2744 lfxlxxr.exe 2896 xrffrrf.exe 2968 hhbhtt.exe 2772 ddpdp.exe 2604 9jvvv.exe 1704 fxxrlfl.exe 2660 rfrxfxf.exe 2356 nnbtbb.exe 2460 pdddj.exe 668 xxlxfxl.exe 1888 xflfrff.exe 388 3nbbnt.exe 2440 1dppp.exe 692 5pvdp.exe 2664 xrflxfr.exe 1984 hthhbn.exe 112 bthhhb.exe 2528 vjdvd.exe 2196 7rfllll.exe 1952 7xlxrxx.exe 2172 nhhhtt.exe 2700 9vdpv.exe 2208 jdppj.exe 1464 ffxrfxf.exe 2984 lxllrff.exe 3000 hhtbnh.exe -
resource yara_rule behavioral1/memory/2388-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/388-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-624-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2316-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-744-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-745-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-820-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-941-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1404-948-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 1628 2388 1736376b090e6f3776955926d598c0a025649d5d0f8872601d55e9c1780bb142.exe 30 PID 2388 wrote to memory of 1628 2388 1736376b090e6f3776955926d598c0a025649d5d0f8872601d55e9c1780bb142.exe 30 PID 2388 wrote to memory of 1628 2388 1736376b090e6f3776955926d598c0a025649d5d0f8872601d55e9c1780bb142.exe 30 PID 2388 wrote to memory of 1628 2388 1736376b090e6f3776955926d598c0a025649d5d0f8872601d55e9c1780bb142.exe 30 PID 1628 wrote to memory of 2516 1628 pvjvv.exe 31 PID 1628 wrote to memory of 2516 1628 pvjvv.exe 31 PID 1628 wrote to memory of 2516 1628 pvjvv.exe 31 PID 1628 wrote to memory of 2516 1628 pvjvv.exe 31 PID 2516 wrote to memory of 2684 2516 pdvvd.exe 32 PID 2516 wrote to memory of 2684 2516 pdvvd.exe 32 PID 2516 wrote to memory of 2684 2516 pdvvd.exe 32 PID 2516 wrote to memory of 2684 2516 pdvvd.exe 32 PID 2684 wrote to memory of 2192 2684 3lxlfrr.exe 33 PID 2684 wrote to memory of 2192 2684 3lxlfrr.exe 33 PID 2684 wrote to memory of 2192 2684 3lxlfrr.exe 33 PID 2684 wrote to memory of 2192 2684 3lxlfrr.exe 33 PID 2192 wrote to memory of 2744 2192 3vvpv.exe 34 PID 2192 wrote to memory of 2744 2192 3vvpv.exe 34 PID 2192 wrote to memory of 2744 2192 3vvpv.exe 34 PID 2192 wrote to memory of 2744 2192 3vvpv.exe 34 PID 2744 wrote to memory of 2980 2744 fxllflx.exe 35 PID 2744 wrote to memory of 2980 2744 fxllflx.exe 35 PID 2744 wrote to memory of 2980 2744 fxllflx.exe 35 PID 2744 wrote to memory of 2980 2744 fxllflx.exe 35 PID 2980 wrote to memory of 2760 2980 pdppv.exe 36 PID 2980 wrote to memory of 2760 2980 pdppv.exe 36 PID 2980 wrote to memory of 2760 2980 pdppv.exe 36 PID 2980 wrote to memory of 2760 2980 pdppv.exe 36 PID 2760 wrote to memory of 2904 2760 rfllrrr.exe 37 PID 2760 wrote to memory of 2904 2760 rfllrrr.exe 37 PID 2760 wrote to memory of 2904 2760 rfllrrr.exe 37 PID 2760 wrote to memory of 2904 2760 rfllrrr.exe 37 PID 2904 wrote to memory of 1932 2904 vjdvd.exe 38 PID 2904 wrote to memory of 1932 2904 vjdvd.exe 38 PID 2904 wrote to memory of 1932 2904 vjdvd.exe 38 PID 2904 wrote to memory of 1932 2904 vjdvd.exe 38 PID 1932 wrote to memory of 2676 1932 lfflllf.exe 39 PID 1932 wrote to memory of 2676 1932 lfflllf.exe 39 PID 1932 wrote to memory of 2676 1932 lfflllf.exe 39 PID 1932 wrote to memory of 2676 1932 lfflllf.exe 39 PID 2676 wrote to memory of 2124 2676 thbbbb.exe 40 PID 2676 wrote to memory of 2124 2676 thbbbb.exe 40 PID 2676 wrote to memory of 2124 2676 thbbbb.exe 40 PID 2676 wrote to memory of 2124 2676 thbbbb.exe 40 PID 2124 wrote to memory of 668 2124 xrrxfrx.exe 41 PID 2124 wrote to memory of 668 2124 xrrxfrx.exe 41 PID 2124 wrote to memory of 668 2124 xrrxfrx.exe 41 PID 2124 wrote to memory of 668 2124 xrrxfrx.exe 41 PID 668 wrote to memory of 2860 668 nhhnbh.exe 42 PID 668 wrote to memory of 2860 668 nhhnbh.exe 42 PID 668 wrote to memory of 2860 668 nhhnbh.exe 42 PID 668 wrote to memory of 2860 668 nhhnbh.exe 42 PID 2860 wrote to memory of 2440 2860 7pdjj.exe 43 PID 2860 wrote to memory of 2440 2860 7pdjj.exe 43 PID 2860 wrote to memory of 2440 2860 7pdjj.exe 43 PID 2860 wrote to memory of 2440 2860 7pdjj.exe 43 PID 2440 wrote to memory of 2672 2440 9rxxxrr.exe 44 PID 2440 wrote to memory of 2672 2440 9rxxxrr.exe 44 PID 2440 wrote to memory of 2672 2440 9rxxxrr.exe 44 PID 2440 wrote to memory of 2672 2440 9rxxxrr.exe 44 PID 2672 wrote to memory of 1056 2672 9ntnnh.exe 45 PID 2672 wrote to memory of 1056 2672 9ntnnh.exe 45 PID 2672 wrote to memory of 1056 2672 9ntnnh.exe 45 PID 2672 wrote to memory of 1056 2672 9ntnnh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1736376b090e6f3776955926d598c0a025649d5d0f8872601d55e9c1780bb142.exe"C:\Users\Admin\AppData\Local\Temp\1736376b090e6f3776955926d598c0a025649d5d0f8872601d55e9c1780bb142.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\pvjvv.exec:\pvjvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\pdvvd.exec:\pdvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\3lxlfrr.exec:\3lxlfrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\3vvpv.exec:\3vvpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\fxllflx.exec:\fxllflx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\pdppv.exec:\pdppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\rfllrrr.exec:\rfllrrr.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\vjdvd.exec:\vjdvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\lfflllf.exec:\lfflllf.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\thbbbb.exec:\thbbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\xrrxfrx.exec:\xrrxfrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\nhhnbh.exec:\nhhnbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\7pdjj.exec:\7pdjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\9rxxxrr.exec:\9rxxxrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\9ntnnh.exec:\9ntnnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\ppjjp.exec:\ppjjp.exe17⤵
- Executes dropped EXE
PID:1056 -
\??\c:\xrflxxl.exec:\xrflxxl.exe18⤵
- Executes dropped EXE
PID:1964 -
\??\c:\jvpvp.exec:\jvpvp.exe19⤵
- Executes dropped EXE
PID:1352 -
\??\c:\xrfxlll.exec:\xrfxlll.exe20⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hbttnn.exec:\hbttnn.exe21⤵
- Executes dropped EXE
PID:2172 -
\??\c:\jdpdp.exec:\jdpdp.exe22⤵
- Executes dropped EXE
PID:2576 -
\??\c:\hbbntb.exec:\hbbntb.exe23⤵
- Executes dropped EXE
PID:2252 -
\??\c:\9nnnnt.exec:\9nnnnt.exe24⤵
- Executes dropped EXE
PID:608 -
\??\c:\9lrrlrx.exec:\9lrrlrx.exe25⤵
- Executes dropped EXE
PID:2940 -
\??\c:\9ntbbb.exec:\9ntbbb.exe26⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jvjpp.exec:\jvjpp.exe27⤵
- Executes dropped EXE
PID:272 -
\??\c:\fxfxxrx.exec:\fxfxxrx.exe28⤵
- Executes dropped EXE
PID:1592 -
\??\c:\9dppv.exec:\9dppv.exe29⤵
- Executes dropped EXE
PID:344 -
\??\c:\9pjpp.exec:\9pjpp.exe30⤵
- Executes dropped EXE
PID:2384 -
\??\c:\9frfxrr.exec:\9frfxrr.exe31⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hntnhh.exec:\hntnhh.exe32⤵
- Executes dropped EXE
PID:2060 -
\??\c:\rrfrffr.exec:\rrfrffr.exe33⤵
- Executes dropped EXE
PID:2084 -
\??\c:\3nbttt.exec:\3nbttt.exe34⤵
- Executes dropped EXE
PID:1532 -
\??\c:\1pddd.exec:\1pddd.exe35⤵
- Executes dropped EXE
PID:1500 -
\??\c:\rflllfx.exec:\rflllfx.exe36⤵
- Executes dropped EXE
PID:2496 -
\??\c:\ttnbnt.exec:\ttnbnt.exe37⤵
- Executes dropped EXE
PID:2684 -
\??\c:\btbhnh.exec:\btbhnh.exe38⤵
- Executes dropped EXE
PID:2696 -
\??\c:\7jvdp.exec:\7jvdp.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\lfxlxxr.exec:\lfxlxxr.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\xrffrrf.exec:\xrffrrf.exe41⤵
- Executes dropped EXE
PID:2896 -
\??\c:\hhbhtt.exec:\hhbhtt.exe42⤵
- Executes dropped EXE
PID:2968 -
\??\c:\ddpdp.exec:\ddpdp.exe43⤵
- Executes dropped EXE
PID:2772 -
\??\c:\9jvvv.exec:\9jvvv.exe44⤵
- Executes dropped EXE
PID:2604 -
\??\c:\fxxrlfl.exec:\fxxrlfl.exe45⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rfrxfxf.exec:\rfrxfxf.exe46⤵
- Executes dropped EXE
PID:2660 -
\??\c:\nnbtbb.exec:\nnbtbb.exe47⤵
- Executes dropped EXE
PID:2356 -
\??\c:\pdddj.exec:\pdddj.exe48⤵
- Executes dropped EXE
PID:2460 -
\??\c:\xxlxfxl.exec:\xxlxfxl.exe49⤵
- Executes dropped EXE
PID:668 -
\??\c:\xflfrff.exec:\xflfrff.exe50⤵
- Executes dropped EXE
PID:1888 -
\??\c:\3nbbnt.exec:\3nbbnt.exe51⤵
- Executes dropped EXE
PID:388 -
\??\c:\1dppp.exec:\1dppp.exe52⤵
- Executes dropped EXE
PID:2440 -
\??\c:\5pvdp.exec:\5pvdp.exe53⤵
- Executes dropped EXE
PID:692 -
\??\c:\xrflxfr.exec:\xrflxfr.exe54⤵
- Executes dropped EXE
PID:2664 -
\??\c:\hthhbn.exec:\hthhbn.exe55⤵
- Executes dropped EXE
PID:1984 -
\??\c:\bthhhb.exec:\bthhhb.exe56⤵
- Executes dropped EXE
PID:112 -
\??\c:\vjdvd.exec:\vjdvd.exe57⤵
- Executes dropped EXE
PID:2528 -
\??\c:\7rfllll.exec:\7rfllll.exe58⤵
- Executes dropped EXE
PID:2196 -
\??\c:\7xlxrxx.exec:\7xlxrxx.exe59⤵
- Executes dropped EXE
PID:1952 -
\??\c:\nhhhtt.exec:\nhhhtt.exe60⤵
- Executes dropped EXE
PID:2172 -
\??\c:\9vdpv.exec:\9vdpv.exe61⤵
- Executes dropped EXE
PID:2700 -
\??\c:\jdppj.exec:\jdppj.exe62⤵
- Executes dropped EXE
PID:2208 -
\??\c:\ffxrfxf.exec:\ffxrfxf.exe63⤵
- Executes dropped EXE
PID:1464 -
\??\c:\lxllrff.exec:\lxllrff.exe64⤵
- Executes dropped EXE
PID:2984 -
\??\c:\hhtbnh.exec:\hhtbnh.exe65⤵
- Executes dropped EXE
PID:3000 -
\??\c:\1jppj.exec:\1jppj.exe66⤵PID:1784
-
\??\c:\5lllfrl.exec:\5lllfrl.exe67⤵PID:2184
-
\??\c:\9flflff.exec:\9flflff.exe68⤵PID:2484
-
\??\c:\httntt.exec:\httntt.exe69⤵PID:1568
-
\??\c:\pjpvj.exec:\pjpvj.exe70⤵PID:3004
-
\??\c:\vpdjj.exec:\vpdjj.exe71⤵PID:1944
-
\??\c:\xfrrxrr.exec:\xfrrxrr.exe72⤵PID:2360
-
\??\c:\hhtbnh.exec:\hhtbnh.exe73⤵PID:2468
-
\??\c:\nbnntt.exec:\nbnntt.exe74⤵PID:1640
-
\??\c:\pjddp.exec:\pjddp.exe75⤵PID:2404
-
\??\c:\pjvpp.exec:\pjvpp.exe76⤵PID:2028
-
\??\c:\frxxllr.exec:\frxxllr.exe77⤵PID:1524
-
\??\c:\rfrllff.exec:\rfrllff.exe78⤵PID:2088
-
\??\c:\nhtbbt.exec:\nhtbbt.exe79⤵PID:2688
-
\??\c:\vjvjj.exec:\vjvjj.exe80⤵PID:2832
-
\??\c:\frfflrr.exec:\frfflrr.exe81⤵PID:2748
-
\??\c:\rflrrxf.exec:\rflrrxf.exe82⤵PID:2980
-
\??\c:\nhtbbb.exec:\nhtbbb.exe83⤵
- System Location Discovery: System Language Discovery
PID:2792 -
\??\c:\pdjjj.exec:\pdjjj.exe84⤵PID:2724
-
\??\c:\3jvpv.exec:\3jvpv.exe85⤵PID:2316
-
\??\c:\xrflffl.exec:\xrflffl.exe86⤵PID:2924
-
\??\c:\bntnbb.exec:\bntnbb.exe87⤵PID:2620
-
\??\c:\nhnbnh.exec:\nhnbnh.exe88⤵PID:2352
-
\??\c:\dpvdv.exec:\dpvdv.exe89⤵PID:820
-
\??\c:\pdvdj.exec:\pdvdj.exe90⤵PID:2692
-
\??\c:\fxxlrxr.exec:\fxxlrxr.exe91⤵PID:668
-
\??\c:\fxlrrrx.exec:\fxlrrrx.exe92⤵PID:532
-
\??\c:\nbbttt.exec:\nbbttt.exe93⤵PID:388
-
\??\c:\1pjpd.exec:\1pjpd.exe94⤵PID:2440
-
\??\c:\dvpvd.exec:\dvpvd.exe95⤵PID:692
-
\??\c:\9xllrrx.exec:\9xllrrx.exe96⤵PID:2664
-
\??\c:\5hbhhh.exec:\5hbhhh.exe97⤵PID:1964
-
\??\c:\1pvdd.exec:\1pvdd.exe98⤵PID:1680
-
\??\c:\dvjpv.exec:\dvjpv.exe99⤵PID:2160
-
\??\c:\lfrrxfr.exec:\lfrrxfr.exe100⤵
- System Location Discovery: System Language Discovery
PID:3040 -
\??\c:\9rxllff.exec:\9rxllff.exe101⤵PID:2052
-
\??\c:\5tnhnh.exec:\5tnhnh.exe102⤵PID:2576
-
\??\c:\5bntbb.exec:\5bntbb.exe103⤵PID:2252
-
\??\c:\vjvdp.exec:\vjvdp.exe104⤵PID:1700
-
\??\c:\lfxxxfl.exec:\lfxxxfl.exe105⤵PID:2992
-
\??\c:\xrfffxf.exec:\xrfffxf.exe106⤵PID:2564
-
\??\c:\httttb.exec:\httttb.exe107⤵PID:1540
-
\??\c:\thtnnh.exec:\thtnnh.exe108⤵PID:956
-
\??\c:\ppdvj.exec:\ppdvj.exe109⤵PID:940
-
\??\c:\1frfffr.exec:\1frfffr.exe110⤵PID:1832
-
\??\c:\xrffllr.exec:\xrffllr.exe111⤵PID:2236
-
\??\c:\hbthhn.exec:\hbthhn.exe112⤵PID:900
-
\??\c:\vpjvd.exec:\vpjvd.exe113⤵PID:1424
-
\??\c:\vdvjd.exec:\vdvjd.exe114⤵PID:1940
-
\??\c:\fxllllx.exec:\fxllllx.exe115⤵PID:2132
-
\??\c:\1rfrflr.exec:\1rfrflr.exe116⤵PID:1640
-
\??\c:\9nbhnn.exec:\9nbhnn.exe117⤵PID:2536
-
\??\c:\dpdjp.exec:\dpdjp.exe118⤵PID:2512
-
\??\c:\1jdjj.exec:\1jdjj.exe119⤵PID:1500
-
\??\c:\rrlrrlr.exec:\rrlrrlr.exe120⤵PID:2260
-
\??\c:\bthtbb.exec:\bthtbb.exe121⤵PID:2684
-
\??\c:\bthhhb.exec:\bthhhb.exe122⤵PID:2040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-