Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 07:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
61eb459df28a7d8c922209d1f11702ae443fa9583cd310c283926d831492e4c5N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
61eb459df28a7d8c922209d1f11702ae443fa9583cd310c283926d831492e4c5N.exe
-
Size
454KB
-
MD5
869e18d4e4bfaff7bf890f739191ffa0
-
SHA1
94a9de2ba4ffd9d5a7bf596e9ee714cbb7e65b31
-
SHA256
61eb459df28a7d8c922209d1f11702ae443fa9583cd310c283926d831492e4c5
-
SHA512
2660b96410abd94b20a6dd156be3c945f140796f0bb99a68b19287cf9f138927b0cc2ebc732a1fa1419b07591ad2be7cb7bbe084220c64efcaf9b3ba394c5b38
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2192-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-63-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2576-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-115-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2796-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-191-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2544-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-327-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2764-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-405-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/324-408-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1820-422-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2912-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-442-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2936-447-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2880-454-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2000-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/304-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-512-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/996-562-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1596-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-648-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-687-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/648-771-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-833-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-889-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-896-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2880-1007-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/304-1021-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1676-1099-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2012-1138-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1040-1141-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2648-1261-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1712-1330-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2192 3rllrrf.exe 2304 jvdvd.exe 2892 nnbbbb.exe 2700 tnbbtt.exe 2864 jdpvj.exe 2684 lfxffll.exe 2432 hnttbb.exe 2728 lllrrxl.exe 2576 tntbnt.exe 3052 nbttbb.exe 2288 vpjpd.exe 2796 1rfrlxl.exe 772 nnttbb.exe 1048 lfxlxfr.exe 1300 btttbh.exe 3024 dpvpp.exe 2656 xlxfffx.exe 2944 9bhhbt.exe 1984 vvvdd.exe 448 1bnhnn.exe 2544 djdvd.exe 1348 xrfflll.exe 1472 9jppj.exe 908 rfrxllr.exe 652 nhtbhn.exe 1368 fflrrrl.exe 1540 lfrxffr.exe 1724 dvddj.exe 1760 hbttbh.exe 3036 jdvdd.exe 1732 dvjjp.exe 2640 nnhntb.exe 1556 ffrxflr.exe 1848 btnnbb.exe 2192 nhtttt.exe 2212 dpddj.exe 2764 7lflxfr.exe 2704 ffxxrrf.exe 2864 5thhnt.exe 2692 5pjjv.exe 2584 fxlfllx.exe 2732 llflxrf.exe 2572 nhbhtt.exe 2636 pvjvd.exe 2140 pvjjd.exe 1264 frxrlfl.exe 2628 tnhnbb.exe 2096 1httbt.exe 324 jvddd.exe 1816 7fxxffr.exe 1820 xrxfffr.exe 852 1bntbh.exe 2912 jdpvv.exe 2936 dpjjv.exe 2880 rfxlflx.exe 2000 nhttbh.exe 304 ppdjp.exe 1120 jjjjp.exe 1856 rrflrrf.exe 1924 hbtbnn.exe 1600 nhnhnn.exe 2512 dpddj.exe 1712 7frrfxf.exe 2520 5rrrxxl.exe -
resource yara_rule behavioral1/memory/2192-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-174-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/448-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-327-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2764-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/648-771-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-820-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-833-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-889-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-896-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2624-1200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-1261-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2920-1262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-1330-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/1860-1349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-1362-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ffxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2072 wrote to memory of 2192 2072 61eb459df28a7d8c922209d1f11702ae443fa9583cd310c283926d831492e4c5N.exe 31 PID 2072 wrote to memory of 2192 2072 61eb459df28a7d8c922209d1f11702ae443fa9583cd310c283926d831492e4c5N.exe 31 PID 2072 wrote to memory of 2192 2072 61eb459df28a7d8c922209d1f11702ae443fa9583cd310c283926d831492e4c5N.exe 31 PID 2072 wrote to memory of 2192 2072 61eb459df28a7d8c922209d1f11702ae443fa9583cd310c283926d831492e4c5N.exe 31 PID 2192 wrote to memory of 2304 2192 3rllrrf.exe 32 PID 2192 wrote to memory of 2304 2192 3rllrrf.exe 32 PID 2192 wrote to memory of 2304 2192 3rllrrf.exe 32 PID 2192 wrote to memory of 2304 2192 3rllrrf.exe 32 PID 2304 wrote to memory of 2892 2304 jvdvd.exe 33 PID 2304 wrote to memory of 2892 2304 jvdvd.exe 33 PID 2304 wrote to memory of 2892 2304 jvdvd.exe 33 PID 2304 wrote to memory of 2892 2304 jvdvd.exe 33 PID 2892 wrote to memory of 2700 2892 nnbbbb.exe 34 PID 2892 wrote to memory of 2700 2892 nnbbbb.exe 34 PID 2892 wrote to memory of 2700 2892 nnbbbb.exe 34 PID 2892 wrote to memory of 2700 2892 nnbbbb.exe 34 PID 2700 wrote to memory of 2864 2700 tnbbtt.exe 35 PID 2700 wrote to memory of 2864 2700 tnbbtt.exe 35 PID 2700 wrote to memory of 2864 2700 tnbbtt.exe 35 PID 2700 wrote to memory of 2864 2700 tnbbtt.exe 35 PID 2864 wrote to memory of 2684 2864 jdpvj.exe 36 PID 2864 wrote to memory of 2684 2864 jdpvj.exe 36 PID 2864 wrote to memory of 2684 2864 jdpvj.exe 36 PID 2864 wrote to memory of 2684 2864 jdpvj.exe 36 PID 2684 wrote to memory of 2432 2684 lfxffll.exe 37 PID 2684 wrote to memory of 2432 2684 lfxffll.exe 37 PID 2684 wrote to memory of 2432 2684 lfxffll.exe 37 PID 2684 wrote to memory of 2432 2684 lfxffll.exe 37 PID 2432 wrote to memory of 2728 2432 hnttbb.exe 38 PID 2432 wrote to memory of 2728 2432 hnttbb.exe 38 PID 2432 wrote to memory of 2728 2432 hnttbb.exe 38 PID 2432 wrote to memory of 2728 2432 hnttbb.exe 38 PID 2728 wrote to memory of 2576 2728 lllrrxl.exe 39 PID 2728 wrote to memory of 2576 2728 lllrrxl.exe 39 PID 2728 wrote to memory of 2576 2728 lllrrxl.exe 39 PID 2728 wrote to memory of 2576 2728 lllrrxl.exe 39 PID 2576 wrote to memory of 3052 2576 tntbnt.exe 40 PID 2576 wrote to memory of 3052 2576 tntbnt.exe 40 PID 2576 wrote to memory of 3052 2576 tntbnt.exe 40 PID 2576 wrote to memory of 3052 2576 tntbnt.exe 40 PID 3052 wrote to memory of 2288 3052 nbttbb.exe 41 PID 3052 wrote to memory of 2288 3052 nbttbb.exe 41 PID 3052 wrote to memory of 2288 3052 nbttbb.exe 41 PID 3052 wrote to memory of 2288 3052 nbttbb.exe 41 PID 2288 wrote to memory of 2796 2288 vpjpd.exe 42 PID 2288 wrote to memory of 2796 2288 vpjpd.exe 42 PID 2288 wrote to memory of 2796 2288 vpjpd.exe 42 PID 2288 wrote to memory of 2796 2288 vpjpd.exe 42 PID 2796 wrote to memory of 772 2796 1rfrlxl.exe 43 PID 2796 wrote to memory of 772 2796 1rfrlxl.exe 43 PID 2796 wrote to memory of 772 2796 1rfrlxl.exe 43 PID 2796 wrote to memory of 772 2796 1rfrlxl.exe 43 PID 772 wrote to memory of 1048 772 nnttbb.exe 44 PID 772 wrote to memory of 1048 772 nnttbb.exe 44 PID 772 wrote to memory of 1048 772 nnttbb.exe 44 PID 772 wrote to memory of 1048 772 nnttbb.exe 44 PID 1048 wrote to memory of 1300 1048 lfxlxfr.exe 45 PID 1048 wrote to memory of 1300 1048 lfxlxfr.exe 45 PID 1048 wrote to memory of 1300 1048 lfxlxfr.exe 45 PID 1048 wrote to memory of 1300 1048 lfxlxfr.exe 45 PID 1300 wrote to memory of 3024 1300 btttbh.exe 46 PID 1300 wrote to memory of 3024 1300 btttbh.exe 46 PID 1300 wrote to memory of 3024 1300 btttbh.exe 46 PID 1300 wrote to memory of 3024 1300 btttbh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\61eb459df28a7d8c922209d1f11702ae443fa9583cd310c283926d831492e4c5N.exe"C:\Users\Admin\AppData\Local\Temp\61eb459df28a7d8c922209d1f11702ae443fa9583cd310c283926d831492e4c5N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\3rllrrf.exec:\3rllrrf.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\jvdvd.exec:\jvdvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\nnbbbb.exec:\nnbbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\tnbbtt.exec:\tnbbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\jdpvj.exec:\jdpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\lfxffll.exec:\lfxffll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\hnttbb.exec:\hnttbb.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\lllrrxl.exec:\lllrrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\tntbnt.exec:\tntbnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\nbttbb.exec:\nbttbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\vpjpd.exec:\vpjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\1rfrlxl.exec:\1rfrlxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\nnttbb.exec:\nnttbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\lfxlxfr.exec:\lfxlxfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\btttbh.exec:\btttbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\dpvpp.exec:\dpvpp.exe17⤵
- Executes dropped EXE
PID:3024 -
\??\c:\xlxfffx.exec:\xlxfffx.exe18⤵
- Executes dropped EXE
PID:2656 -
\??\c:\9bhhbt.exec:\9bhhbt.exe19⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vvvdd.exec:\vvvdd.exe20⤵
- Executes dropped EXE
PID:1984 -
\??\c:\1bnhnn.exec:\1bnhnn.exe21⤵
- Executes dropped EXE
PID:448 -
\??\c:\djdvd.exec:\djdvd.exe22⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xrfflll.exec:\xrfflll.exe23⤵
- Executes dropped EXE
PID:1348 -
\??\c:\9jppj.exec:\9jppj.exe24⤵
- Executes dropped EXE
PID:1472 -
\??\c:\rfrxllr.exec:\rfrxllr.exe25⤵
- Executes dropped EXE
PID:908 -
\??\c:\nhtbhn.exec:\nhtbhn.exe26⤵
- Executes dropped EXE
PID:652 -
\??\c:\fflrrrl.exec:\fflrrrl.exe27⤵
- Executes dropped EXE
PID:1368 -
\??\c:\lfrxffr.exec:\lfrxffr.exe28⤵
- Executes dropped EXE
PID:1540 -
\??\c:\dvddj.exec:\dvddj.exe29⤵
- Executes dropped EXE
PID:1724 -
\??\c:\hbttbh.exec:\hbttbh.exe30⤵
- Executes dropped EXE
PID:1760 -
\??\c:\jdvdd.exec:\jdvdd.exe31⤵
- Executes dropped EXE
PID:3036 -
\??\c:\dvjjp.exec:\dvjjp.exe32⤵
- Executes dropped EXE
PID:1732 -
\??\c:\nnhntb.exec:\nnhntb.exe33⤵
- Executes dropped EXE
PID:2640 -
\??\c:\ffrxflr.exec:\ffrxflr.exe34⤵
- Executes dropped EXE
PID:1556 -
\??\c:\btnnbb.exec:\btnnbb.exe35⤵
- Executes dropped EXE
PID:1848 -
\??\c:\nhtttt.exec:\nhtttt.exe36⤵
- Executes dropped EXE
PID:2192 -
\??\c:\dpddj.exec:\dpddj.exe37⤵
- Executes dropped EXE
PID:2212 -
\??\c:\7lflxfr.exec:\7lflxfr.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\ffxxrrf.exec:\ffxxrrf.exe39⤵
- Executes dropped EXE
PID:2704 -
\??\c:\5thhnt.exec:\5thhnt.exe40⤵
- Executes dropped EXE
PID:2864 -
\??\c:\5pjjv.exec:\5pjjv.exe41⤵
- Executes dropped EXE
PID:2692 -
\??\c:\fxlfllx.exec:\fxlfllx.exe42⤵
- Executes dropped EXE
PID:2584 -
\??\c:\llflxrf.exec:\llflxrf.exe43⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nhbhtt.exec:\nhbhtt.exe44⤵
- Executes dropped EXE
PID:2572 -
\??\c:\pvjvd.exec:\pvjvd.exe45⤵
- Executes dropped EXE
PID:2636 -
\??\c:\pvjjd.exec:\pvjjd.exe46⤵
- Executes dropped EXE
PID:2140 -
\??\c:\frxrlfl.exec:\frxrlfl.exe47⤵
- Executes dropped EXE
PID:1264 -
\??\c:\tnhnbb.exec:\tnhnbb.exe48⤵
- Executes dropped EXE
PID:2628 -
\??\c:\1httbt.exec:\1httbt.exe49⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jvddd.exec:\jvddd.exe50⤵
- Executes dropped EXE
PID:324 -
\??\c:\7fxxffr.exec:\7fxxffr.exe51⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xrxfffr.exec:\xrxfffr.exe52⤵
- Executes dropped EXE
PID:1820 -
\??\c:\1bntbh.exec:\1bntbh.exe53⤵
- Executes dropped EXE
PID:852 -
\??\c:\jdpvv.exec:\jdpvv.exe54⤵
- Executes dropped EXE
PID:2912 -
\??\c:\dpjjv.exec:\dpjjv.exe55⤵
- Executes dropped EXE
PID:2936 -
\??\c:\rfxlflx.exec:\rfxlflx.exe56⤵
- Executes dropped EXE
PID:2880 -
\??\c:\nhttbh.exec:\nhttbh.exe57⤵
- Executes dropped EXE
PID:2000 -
\??\c:\ppdjp.exec:\ppdjp.exe58⤵
- Executes dropped EXE
PID:304 -
\??\c:\jjjjp.exec:\jjjjp.exe59⤵
- Executes dropped EXE
PID:1120 -
\??\c:\rrflrrf.exec:\rrflrrf.exe60⤵
- Executes dropped EXE
PID:1856 -
\??\c:\hbtbnn.exec:\hbtbnn.exe61⤵
- Executes dropped EXE
PID:1924 -
\??\c:\nhnhnn.exec:\nhnhnn.exe62⤵
- Executes dropped EXE
PID:1600 -
\??\c:\dpddj.exec:\dpddj.exe63⤵
- Executes dropped EXE
PID:2512 -
\??\c:\7frrfxf.exec:\7frrfxf.exe64⤵
- Executes dropped EXE
PID:1712 -
\??\c:\5rrrxxl.exec:\5rrrxxl.exe65⤵
- Executes dropped EXE
PID:2520 -
\??\c:\5tnnhh.exec:\5tnnhh.exe66⤵PID:1776
-
\??\c:\jdppd.exec:\jdppd.exe67⤵PID:1780
-
\??\c:\lxfxllr.exec:\lxfxllr.exe68⤵PID:1604
-
\??\c:\rrxxflr.exec:\rrxxflr.exe69⤵PID:2260
-
\??\c:\nhttbt.exec:\nhttbt.exe70⤵PID:3028
-
\??\c:\pppdp.exec:\pppdp.exe71⤵PID:2216
-
\??\c:\jvjdp.exec:\jvjdp.exe72⤵PID:2092
-
\??\c:\fxxfrrl.exec:\fxxfrrl.exe73⤵PID:996
-
\??\c:\rxllllr.exec:\rxllllr.exe74⤵PID:3012
-
\??\c:\nhhhtb.exec:\nhhhtb.exe75⤵PID:1972
-
\??\c:\dvppd.exec:\dvppd.exe76⤵PID:2484
-
\??\c:\dvppv.exec:\dvppv.exe77⤵PID:1596
-
\??\c:\rfrrllr.exec:\rfrrllr.exe78⤵PID:2328
-
\??\c:\bthhnn.exec:\bthhnn.exe79⤵PID:2752
-
\??\c:\jdjpv.exec:\jdjpv.exe80⤵PID:2892
-
\??\c:\vpjjp.exec:\vpjjp.exe81⤵PID:2664
-
\??\c:\3lrlfxx.exec:\3lrlfxx.exe82⤵PID:2760
-
\??\c:\thtbnt.exec:\thtbnt.exe83⤵PID:2860
-
\??\c:\9nhbbh.exec:\9nhbbh.exe84⤵PID:2676
-
\??\c:\dvpvd.exec:\dvpvd.exe85⤵PID:2164
-
\??\c:\lfxflfr.exec:\lfxflfr.exe86⤵PID:2748
-
\??\c:\9fxrlxf.exec:\9fxrlxf.exe87⤵PID:2728
-
\??\c:\tnbbhh.exec:\tnbbhh.exe88⤵PID:2624
-
\??\c:\jjvvv.exec:\jjvvv.exe89⤵PID:2052
-
\??\c:\frxxffl.exec:\frxxffl.exe90⤵PID:2392
-
\??\c:\xxflffl.exec:\xxflffl.exe91⤵PID:2800
-
\??\c:\tnbbbb.exec:\tnbbbb.exe92⤵PID:1804
-
\??\c:\9jddp.exec:\9jddp.exe93⤵PID:2796
-
\??\c:\pdpjp.exec:\pdpjp.exe94⤵PID:1128
-
\??\c:\9frlrrx.exec:\9frlrrx.exe95⤵PID:772
-
\??\c:\bnbttt.exec:\bnbttt.exe96⤵PID:1160
-
\??\c:\thnttb.exec:\thnttb.exe97⤵PID:2908
-
\??\c:\3jdjv.exec:\3jdjv.exe98⤵PID:2660
-
\??\c:\xrflxrx.exec:\xrflxrx.exe99⤵PID:2384
-
\??\c:\lxfffll.exec:\lxfffll.exe100⤵PID:576
-
\??\c:\hbnnbb.exec:\hbnnbb.exe101⤵PID:1312
-
\??\c:\7jppj.exec:\7jppj.exe102⤵PID:2380
-
\??\c:\pdppd.exec:\pdppd.exe103⤵PID:2540
-
\??\c:\ffxfflf.exec:\ffxfflf.exe104⤵PID:2176
-
\??\c:\tntntb.exec:\tntntb.exe105⤵PID:844
-
\??\c:\bntnnh.exec:\bntnnh.exe106⤵PID:956
-
\??\c:\jvjjj.exec:\jvjjj.exe107⤵PID:1536
-
\??\c:\xlfflll.exec:\xlfflll.exe108⤵PID:648
-
\??\c:\rffrxxl.exec:\rffrxxl.exe109⤵PID:1752
-
\??\c:\nhtttt.exec:\nhtttt.exe110⤵PID:2396
-
\??\c:\bntttb.exec:\bntttb.exe111⤵PID:652
-
\??\c:\5djjj.exec:\5djjj.exe112⤵PID:1608
-
\??\c:\fxxrxxf.exec:\fxxrxxf.exe113⤵PID:1068
-
\??\c:\lllrrxx.exec:\lllrrxx.exe114⤵PID:2244
-
\??\c:\bnbbbb.exec:\bnbbbb.exe115⤵PID:2220
-
\??\c:\9vddd.exec:\9vddd.exe116⤵PID:984
-
\??\c:\1dvvj.exec:\1dvvj.exe117⤵PID:2076
-
\??\c:\7ffxxff.exec:\7ffxxff.exe118⤵
- System Location Discovery: System Language Discovery
PID:544 -
\??\c:\1nbbbt.exec:\1nbbbt.exe119⤵PID:1732
-
\??\c:\htnnhb.exec:\htnnhb.exe120⤵PID:3016
-
\??\c:\ppdjp.exec:\ppdjp.exe121⤵PID:2460
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-