Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 06:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
82e0289334bdbeaaa422b046ef8e78070a82cc6037a096276b80d4a4f9441eba.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
82e0289334bdbeaaa422b046ef8e78070a82cc6037a096276b80d4a4f9441eba.exe
-
Size
453KB
-
MD5
c31c82689bfd832165f324cd0fe7680b
-
SHA1
ec50b33342ec64f8d92eebbc351ac74449671d36
-
SHA256
82e0289334bdbeaaa422b046ef8e78070a82cc6037a096276b80d4a4f9441eba
-
SHA512
4125e4dbaed9a2282d222b45f3c7039d91f9f7c581afb9516e3e1e6f745c369257d3c8feacf74497a397766739402f2168f476decf31befea014202f37af58f4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe0:q7Tc2NYHUrAwfMp3CD0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2776-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-200-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/864-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-246-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1624-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-376-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2484-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-426-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1968-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-544-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1984-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-725-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-900-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1036-919-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2796-949-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/700-960-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2800-963-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2824 fflffxx.exe 2684 hbhnhn.exe 2652 3xffffl.exe 1236 pjvvd.exe 2564 rrflxxx.exe 2056 jdpjj.exe 1240 fxflxxf.exe 1160 hbntbt.exe 2788 vjvpj.exe 2936 tthntb.exe 2864 httttt.exe 2900 5xllrrf.exe 2968 nhbnbh.exe 2984 llllrrf.exe 660 7rfxrrr.exe 588 vpjpp.exe 2220 xlrrrrx.exe 1432 tttbhn.exe 2180 jjvvj.exe 2228 hbnthn.exe 1788 3pdvd.exe 864 1lrlrfl.exe 1620 rrfflrx.exe 2500 vpddp.exe 1520 lfllxrr.exe 1732 tnbnbh.exe 2632 pdddj.exe 1624 frffxxf.exe 2424 ththht.exe 1984 ddvpj.exe 2508 xrflxrx.exe 1612 nbhnbt.exe 2032 dvjpv.exe 2684 xrffrxx.exe 2596 9bnttb.exe 2692 dvjdd.exe 2616 jdjdv.exe 2564 xrflxxf.exe 2056 thttnn.exe 1456 ddvvj.exe 2044 3jvvd.exe 1160 ffxfllr.exe 2484 3httbb.exe 584 nnbhbb.exe 2800 5ppjv.exe 2932 xrffrrx.exe 824 9hnbnt.exe 2532 1tttbb.exe 3056 pdjvd.exe 3020 frxxffl.exe 1968 9btbnn.exe 588 hbtbnn.exe 2144 pjvdp.exe 2204 rrlxfxl.exe 1876 tnbhnh.exe 2200 bnhhtt.exe 2228 dvjpd.exe 1088 fxrxffr.exe 868 xfxrxrr.exe 1044 nnhntb.exe 2316 pjpjd.exe 636 9ppjp.exe 2360 rllrflr.exe 2476 frfllll.exe -
resource yara_rule behavioral1/memory/2776-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/660-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-426-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1968-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-842-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-874-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-881-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-920-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-934-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2776 wrote to memory of 2824 2776 82e0289334bdbeaaa422b046ef8e78070a82cc6037a096276b80d4a4f9441eba.exe 30 PID 2776 wrote to memory of 2824 2776 82e0289334bdbeaaa422b046ef8e78070a82cc6037a096276b80d4a4f9441eba.exe 30 PID 2776 wrote to memory of 2824 2776 82e0289334bdbeaaa422b046ef8e78070a82cc6037a096276b80d4a4f9441eba.exe 30 PID 2776 wrote to memory of 2824 2776 82e0289334bdbeaaa422b046ef8e78070a82cc6037a096276b80d4a4f9441eba.exe 30 PID 2824 wrote to memory of 2684 2824 fflffxx.exe 31 PID 2824 wrote to memory of 2684 2824 fflffxx.exe 31 PID 2824 wrote to memory of 2684 2824 fflffxx.exe 31 PID 2824 wrote to memory of 2684 2824 fflffxx.exe 31 PID 2684 wrote to memory of 2652 2684 hbhnhn.exe 32 PID 2684 wrote to memory of 2652 2684 hbhnhn.exe 32 PID 2684 wrote to memory of 2652 2684 hbhnhn.exe 32 PID 2684 wrote to memory of 2652 2684 hbhnhn.exe 32 PID 2652 wrote to memory of 1236 2652 3xffffl.exe 33 PID 2652 wrote to memory of 1236 2652 3xffffl.exe 33 PID 2652 wrote to memory of 1236 2652 3xffffl.exe 33 PID 2652 wrote to memory of 1236 2652 3xffffl.exe 33 PID 1236 wrote to memory of 2564 1236 pjvvd.exe 34 PID 1236 wrote to memory of 2564 1236 pjvvd.exe 34 PID 1236 wrote to memory of 2564 1236 pjvvd.exe 34 PID 1236 wrote to memory of 2564 1236 pjvvd.exe 34 PID 2564 wrote to memory of 2056 2564 rrflxxx.exe 35 PID 2564 wrote to memory of 2056 2564 rrflxxx.exe 35 PID 2564 wrote to memory of 2056 2564 rrflxxx.exe 35 PID 2564 wrote to memory of 2056 2564 rrflxxx.exe 35 PID 2056 wrote to memory of 1240 2056 jdpjj.exe 36 PID 2056 wrote to memory of 1240 2056 jdpjj.exe 36 PID 2056 wrote to memory of 1240 2056 jdpjj.exe 36 PID 2056 wrote to memory of 1240 2056 jdpjj.exe 36 PID 1240 wrote to memory of 1160 1240 fxflxxf.exe 37 PID 1240 wrote to memory of 1160 1240 fxflxxf.exe 37 PID 1240 wrote to memory of 1160 1240 fxflxxf.exe 37 PID 1240 wrote to memory of 1160 1240 fxflxxf.exe 37 PID 1160 wrote to memory of 2788 1160 hbntbt.exe 38 PID 1160 wrote to memory of 2788 1160 hbntbt.exe 38 PID 1160 wrote to memory of 2788 1160 hbntbt.exe 38 PID 1160 wrote to memory of 2788 1160 hbntbt.exe 38 PID 2788 wrote to memory of 2936 2788 vjvpj.exe 39 PID 2788 wrote to memory of 2936 2788 vjvpj.exe 39 PID 2788 wrote to memory of 2936 2788 vjvpj.exe 39 PID 2788 wrote to memory of 2936 2788 vjvpj.exe 39 PID 2936 wrote to memory of 2864 2936 tthntb.exe 40 PID 2936 wrote to memory of 2864 2936 tthntb.exe 40 PID 2936 wrote to memory of 2864 2936 tthntb.exe 40 PID 2936 wrote to memory of 2864 2936 tthntb.exe 40 PID 2864 wrote to memory of 2900 2864 httttt.exe 41 PID 2864 wrote to memory of 2900 2864 httttt.exe 41 PID 2864 wrote to memory of 2900 2864 httttt.exe 41 PID 2864 wrote to memory of 2900 2864 httttt.exe 41 PID 2900 wrote to memory of 2968 2900 5xllrrf.exe 42 PID 2900 wrote to memory of 2968 2900 5xllrrf.exe 42 PID 2900 wrote to memory of 2968 2900 5xllrrf.exe 42 PID 2900 wrote to memory of 2968 2900 5xllrrf.exe 42 PID 2968 wrote to memory of 2984 2968 nhbnbh.exe 43 PID 2968 wrote to memory of 2984 2968 nhbnbh.exe 43 PID 2968 wrote to memory of 2984 2968 nhbnbh.exe 43 PID 2968 wrote to memory of 2984 2968 nhbnbh.exe 43 PID 2984 wrote to memory of 660 2984 llllrrf.exe 44 PID 2984 wrote to memory of 660 2984 llllrrf.exe 44 PID 2984 wrote to memory of 660 2984 llllrrf.exe 44 PID 2984 wrote to memory of 660 2984 llllrrf.exe 44 PID 660 wrote to memory of 588 660 7rfxrrr.exe 45 PID 660 wrote to memory of 588 660 7rfxrrr.exe 45 PID 660 wrote to memory of 588 660 7rfxrrr.exe 45 PID 660 wrote to memory of 588 660 7rfxrrr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\82e0289334bdbeaaa422b046ef8e78070a82cc6037a096276b80d4a4f9441eba.exe"C:\Users\Admin\AppData\Local\Temp\82e0289334bdbeaaa422b046ef8e78070a82cc6037a096276b80d4a4f9441eba.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\fflffxx.exec:\fflffxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\hbhnhn.exec:\hbhnhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\3xffffl.exec:\3xffffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\pjvvd.exec:\pjvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\rrflxxx.exec:\rrflxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\jdpjj.exec:\jdpjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\fxflxxf.exec:\fxflxxf.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\hbntbt.exec:\hbntbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\vjvpj.exec:\vjvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\tthntb.exec:\tthntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\httttt.exec:\httttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\5xllrrf.exec:\5xllrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\nhbnbh.exec:\nhbnbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\llllrrf.exec:\llllrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\7rfxrrr.exec:\7rfxrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\vpjpp.exec:\vpjpp.exe17⤵
- Executes dropped EXE
PID:588 -
\??\c:\xlrrrrx.exec:\xlrrrrx.exe18⤵
- Executes dropped EXE
PID:2220 -
\??\c:\tttbhn.exec:\tttbhn.exe19⤵
- Executes dropped EXE
PID:1432 -
\??\c:\jjvvj.exec:\jjvvj.exe20⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hbnthn.exec:\hbnthn.exe21⤵
- Executes dropped EXE
PID:2228 -
\??\c:\3pdvd.exec:\3pdvd.exe22⤵
- Executes dropped EXE
PID:1788 -
\??\c:\1lrlrfl.exec:\1lrlrfl.exe23⤵
- Executes dropped EXE
PID:864 -
\??\c:\rrfflrx.exec:\rrfflrx.exe24⤵
- Executes dropped EXE
PID:1620 -
\??\c:\vpddp.exec:\vpddp.exe25⤵
- Executes dropped EXE
PID:2500 -
\??\c:\lfllxrr.exec:\lfllxrr.exe26⤵
- Executes dropped EXE
PID:1520 -
\??\c:\tnbnbh.exec:\tnbnbh.exe27⤵
- Executes dropped EXE
PID:1732 -
\??\c:\pdddj.exec:\pdddj.exe28⤵
- Executes dropped EXE
PID:2632 -
\??\c:\frffxxf.exec:\frffxxf.exe29⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ththht.exec:\ththht.exe30⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ddvpj.exec:\ddvpj.exe31⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xrflxrx.exec:\xrflxrx.exe32⤵
- Executes dropped EXE
PID:2508 -
\??\c:\nbhnbt.exec:\nbhnbt.exe33⤵
- Executes dropped EXE
PID:1612 -
\??\c:\dvjpv.exec:\dvjpv.exe34⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xrffrxx.exec:\xrffrxx.exe35⤵
- Executes dropped EXE
PID:2684 -
\??\c:\9bnttb.exec:\9bnttb.exe36⤵
- Executes dropped EXE
PID:2596 -
\??\c:\dvjdd.exec:\dvjdd.exe37⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jdjdv.exec:\jdjdv.exe38⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xrflxxf.exec:\xrflxxf.exe39⤵
- Executes dropped EXE
PID:2564 -
\??\c:\thttnn.exec:\thttnn.exe40⤵
- Executes dropped EXE
PID:2056 -
\??\c:\ddvvj.exec:\ddvvj.exe41⤵
- Executes dropped EXE
PID:1456 -
\??\c:\3jvvd.exec:\3jvvd.exe42⤵
- Executes dropped EXE
PID:2044 -
\??\c:\ffxfllr.exec:\ffxfllr.exe43⤵
- Executes dropped EXE
PID:1160 -
\??\c:\3httbb.exec:\3httbb.exe44⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nnbhbb.exec:\nnbhbb.exe45⤵
- Executes dropped EXE
PID:584 -
\??\c:\5ppjv.exec:\5ppjv.exe46⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xrffrrx.exec:\xrffrrx.exe47⤵
- Executes dropped EXE
PID:2932 -
\??\c:\9hnbnt.exec:\9hnbnt.exe48⤵
- Executes dropped EXE
PID:824 -
\??\c:\1tttbb.exec:\1tttbb.exe49⤵
- Executes dropped EXE
PID:2532 -
\??\c:\pdjvd.exec:\pdjvd.exe50⤵
- Executes dropped EXE
PID:3056 -
\??\c:\frxxffl.exec:\frxxffl.exe51⤵
- Executes dropped EXE
PID:3020 -
\??\c:\9btbnn.exec:\9btbnn.exe52⤵
- Executes dropped EXE
PID:1968 -
\??\c:\hbtbnn.exec:\hbtbnn.exe53⤵
- Executes dropped EXE
PID:588 -
\??\c:\pjvdp.exec:\pjvdp.exe54⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rrlxfxl.exec:\rrlxfxl.exe55⤵
- Executes dropped EXE
PID:2204 -
\??\c:\tnbhnh.exec:\tnbhnh.exe56⤵
- Executes dropped EXE
PID:1876 -
\??\c:\bnhhtt.exec:\bnhhtt.exe57⤵
- Executes dropped EXE
PID:2200 -
\??\c:\dvjpd.exec:\dvjpd.exe58⤵
- Executes dropped EXE
PID:2228 -
\??\c:\fxrxffr.exec:\fxrxffr.exe59⤵
- Executes dropped EXE
PID:1088 -
\??\c:\xfxrxrr.exec:\xfxrxrr.exe60⤵
- Executes dropped EXE
PID:868 -
\??\c:\nnhntb.exec:\nnhntb.exe61⤵
- Executes dropped EXE
PID:1044 -
\??\c:\pjpjd.exec:\pjpjd.exe62⤵
- Executes dropped EXE
PID:2316 -
\??\c:\9ppjp.exec:\9ppjp.exe63⤵
- Executes dropped EXE
PID:636 -
\??\c:\rllrflr.exec:\rllrflr.exe64⤵
- Executes dropped EXE
PID:2360 -
\??\c:\frfllll.exec:\frfllll.exe65⤵
- Executes dropped EXE
PID:2476 -
\??\c:\9hntbh.exec:\9hntbh.exe66⤵PID:2256
-
\??\c:\vjvvv.exec:\vjvvv.exe67⤵PID:3032
-
\??\c:\rlxlrfl.exec:\rlxlrfl.exe68⤵PID:2988
-
\??\c:\1xffrrx.exec:\1xffrrx.exe69⤵PID:2456
-
\??\c:\9tntht.exec:\9tntht.exe70⤵PID:2424
-
\??\c:\3vddj.exec:\3vddj.exe71⤵PID:1984
-
\??\c:\djvpp.exec:\djvpp.exe72⤵PID:2460
-
\??\c:\3lxrfxf.exec:\3lxrfxf.exe73⤵PID:1144
-
\??\c:\hthhhn.exec:\hthhhn.exe74⤵PID:1580
-
\??\c:\tnnhhh.exec:\tnnhhh.exe75⤵PID:2032
-
\??\c:\7djdv.exec:\7djdv.exe76⤵PID:2732
-
\??\c:\rflrxxl.exec:\rflrxxl.exe77⤵PID:1528
-
\??\c:\frrrxrr.exec:\frrrxrr.exe78⤵PID:2676
-
\??\c:\bbtthn.exec:\bbtthn.exe79⤵PID:2544
-
\??\c:\pvppv.exec:\pvppv.exe80⤵PID:2052
-
\??\c:\vjjjp.exec:\vjjjp.exe81⤵PID:2108
-
\??\c:\rlrlxrl.exec:\rlrlxrl.exe82⤵PID:1348
-
\??\c:\ttbhnt.exec:\ttbhnt.exe83⤵PID:1840
-
\??\c:\5tbthh.exec:\5tbthh.exe84⤵PID:2184
-
\??\c:\pjpvv.exec:\pjpvv.exe85⤵PID:1388
-
\??\c:\jdjdp.exec:\jdjdp.exe86⤵PID:540
-
\??\c:\rfrlrxx.exec:\rfrlrxx.exe87⤵
- System Location Discovery: System Language Discovery
PID:1504 -
\??\c:\bnnnbt.exec:\bnnnbt.exe88⤵PID:2792
-
\??\c:\btbhnn.exec:\btbhnn.exe89⤵PID:2272
-
\??\c:\pdppp.exec:\pdppp.exe90⤵PID:2900
-
\??\c:\flxlxrf.exec:\flxlxrf.exe91⤵PID:3068
-
\??\c:\lxfrffr.exec:\lxfrffr.exe92⤵PID:2948
-
\??\c:\bthbnh.exec:\bthbnh.exe93⤵PID:1060
-
\??\c:\dpddj.exec:\dpddj.exe94⤵PID:1072
-
\??\c:\9vvvd.exec:\9vvvd.exe95⤵PID:2492
-
\??\c:\5xlllfl.exec:\5xlllfl.exe96⤵PID:2208
-
\??\c:\5thbhb.exec:\5thbhb.exe97⤵PID:2164
-
\??\c:\pdjvv.exec:\pdjvv.exe98⤵PID:444
-
\??\c:\9dddp.exec:\9dddp.exe99⤵PID:2180
-
\??\c:\rlrrfxl.exec:\rlrrfxl.exe100⤵PID:1836
-
\??\c:\nhnhtb.exec:\nhnhtb.exe101⤵PID:1088
-
\??\c:\1tthbt.exec:\1tthbt.exe102⤵PID:852
-
\??\c:\5djjp.exec:\5djjp.exe103⤵PID:616
-
\??\c:\djvpp.exec:\djvpp.exe104⤵PID:1000
-
\??\c:\rfrlrrf.exec:\rfrlrrf.exe105⤵PID:2196
-
\??\c:\tbhhnh.exec:\tbhhnh.exe106⤵PID:944
-
\??\c:\tnhhtt.exec:\tnhhtt.exe107⤵PID:2000
-
\??\c:\jdpvp.exec:\jdpvp.exe108⤵PID:2300
-
\??\c:\1lxffxf.exec:\1lxffxf.exe109⤵PID:2632
-
\??\c:\rrxfxrr.exec:\rrxfxrr.exe110⤵PID:1624
-
\??\c:\tnnnhh.exec:\tnnnhh.exe111⤵PID:2480
-
\??\c:\hhntbb.exec:\hhntbb.exe112⤵PID:2520
-
\??\c:\vjvpv.exec:\vjvpv.exe113⤵PID:2424
-
\??\c:\rxfxfxf.exec:\rxfxfxf.exe114⤵PID:2772
-
\??\c:\fxrrffl.exec:\fxrrffl.exe115⤵PID:2468
-
\??\c:\thnbnn.exec:\thnbnn.exe116⤵PID:2764
-
\??\c:\1jjpv.exec:\1jjpv.exe117⤵PID:2996
-
\??\c:\jvvvd.exec:\jvvvd.exe118⤵PID:2572
-
\??\c:\xlxxrlr.exec:\xlxxrlr.exe119⤵PID:2596
-
\??\c:\5lxrxrf.exec:\5lxrxrf.exe120⤵PID:2716
-
\??\c:\thnntt.exec:\thnntt.exe121⤵PID:2552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-