Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 08:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fc395f47aab22178de06a06c699b65dff797970b8d062a7bac191a4a808212c0.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
fc395f47aab22178de06a06c699b65dff797970b8d062a7bac191a4a808212c0.exe
-
Size
453KB
-
MD5
e4c1fa87cd6106e0871ee7aec5a53a56
-
SHA1
500ac3d042b8ff6f0a4f5ca95d2c5a5f60b1f4d5
-
SHA256
fc395f47aab22178de06a06c699b65dff797970b8d062a7bac191a4a808212c0
-
SHA512
37e79e8978aa9c7255d90e1024bd57fb75254bf28174bcc96276f62f3a1ef81f7eac3bedb8c63498441c79b07bfa1c4067dbe540e35d5b7596653c519e06a424
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2648-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-26-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2840-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-47-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2952-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-77-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1356-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1356-93-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2892-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-160-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1584-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-55-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2376-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-186-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2396-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1196-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-215-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1296-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-350-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1844-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-502-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1468-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1404-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1404-622-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2724-662-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-661-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1196-745-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-790-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1212-795-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2660-847-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-941-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3048-953-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1948-968-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1608-975-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2760 rlffrrl.exe 3028 5ntnnb.exe 2840 jvddj.exe 2952 rlxfllr.exe 2544 bttnnn.exe 2712 3jvvv.exe 1260 lxlfrll.exe 1844 nhbbnn.exe 1356 3pddp.exe 2140 jpvjj.exe 3000 5ntntt.exe 2728 pdpjp.exe 2844 rflrrrx.exe 2892 nhhhtn.exe 2956 pdpdd.exe 1584 lxlffxx.exe 112 1hnnbt.exe 2784 jvddd.exe 2376 pjddp.exe 2396 nhthhh.exe 1196 vdppp.exe 2068 1lxrflr.exe 1296 7hnbtt.exe 1192 dpdvp.exe 2492 lxffllf.exe 2268 vjvpv.exe 1980 vjppp.exe 1772 1llxrrr.exe 1436 nhhhnh.exe 2764 9jpvp.exe 2788 5flrfff.exe 1528 nhnbbn.exe 2580 9vdvj.exe 2700 lxffrrf.exe 2704 nbbntn.exe 2976 hbttbh.exe 2812 5djjd.exe 2248 xrrrlrx.exe 1556 thbbhb.exe 2980 9pddv.exe 1844 xlxrxxx.exe 2152 7lxrlfx.exe 2264 tnnhnh.exe 1616 1dppj.exe 2060 frxrrlr.exe 2940 xlfxfrf.exe 2912 thnhbt.exe 2748 pdppd.exe 2900 5jdvv.exe 2868 3rfxfxx.exe 1840 hthntn.exe 2196 7ppjp.exe 112 pdpjj.exe 2392 5rfrrxf.exe 3056 tnthtn.exe 2224 3nttbt.exe 2044 1vdvd.exe 1320 9fxxffx.exe 968 xrfrlll.exe 2300 tntbhh.exe 1324 pdpjj.exe 1960 1vpjp.exe 1468 3rrlrrr.exe 3060 5hnhbt.exe -
resource yara_rule behavioral1/memory/2648-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1404-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-745-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-798-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-847-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-861-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-961-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2760 2648 fc395f47aab22178de06a06c699b65dff797970b8d062a7bac191a4a808212c0.exe 31 PID 2648 wrote to memory of 2760 2648 fc395f47aab22178de06a06c699b65dff797970b8d062a7bac191a4a808212c0.exe 31 PID 2648 wrote to memory of 2760 2648 fc395f47aab22178de06a06c699b65dff797970b8d062a7bac191a4a808212c0.exe 31 PID 2648 wrote to memory of 2760 2648 fc395f47aab22178de06a06c699b65dff797970b8d062a7bac191a4a808212c0.exe 31 PID 2760 wrote to memory of 3028 2760 rlffrrl.exe 32 PID 2760 wrote to memory of 3028 2760 rlffrrl.exe 32 PID 2760 wrote to memory of 3028 2760 rlffrrl.exe 32 PID 2760 wrote to memory of 3028 2760 rlffrrl.exe 32 PID 3028 wrote to memory of 2840 3028 5ntnnb.exe 33 PID 3028 wrote to memory of 2840 3028 5ntnnb.exe 33 PID 3028 wrote to memory of 2840 3028 5ntnnb.exe 33 PID 3028 wrote to memory of 2840 3028 5ntnnb.exe 33 PID 2840 wrote to memory of 2952 2840 jvddj.exe 34 PID 2840 wrote to memory of 2952 2840 jvddj.exe 34 PID 2840 wrote to memory of 2952 2840 jvddj.exe 34 PID 2840 wrote to memory of 2952 2840 jvddj.exe 34 PID 2952 wrote to memory of 2544 2952 rlxfllr.exe 35 PID 2952 wrote to memory of 2544 2952 rlxfllr.exe 35 PID 2952 wrote to memory of 2544 2952 rlxfllr.exe 35 PID 2952 wrote to memory of 2544 2952 rlxfllr.exe 35 PID 2544 wrote to memory of 2712 2544 bttnnn.exe 36 PID 2544 wrote to memory of 2712 2544 bttnnn.exe 36 PID 2544 wrote to memory of 2712 2544 bttnnn.exe 36 PID 2544 wrote to memory of 2712 2544 bttnnn.exe 36 PID 2712 wrote to memory of 1260 2712 3jvvv.exe 37 PID 2712 wrote to memory of 1260 2712 3jvvv.exe 37 PID 2712 wrote to memory of 1260 2712 3jvvv.exe 37 PID 2712 wrote to memory of 1260 2712 3jvvv.exe 37 PID 1260 wrote to memory of 1844 1260 lxlfrll.exe 38 PID 1260 wrote to memory of 1844 1260 lxlfrll.exe 38 PID 1260 wrote to memory of 1844 1260 lxlfrll.exe 38 PID 1260 wrote to memory of 1844 1260 lxlfrll.exe 38 PID 1844 wrote to memory of 1356 1844 nhbbnn.exe 39 PID 1844 wrote to memory of 1356 1844 nhbbnn.exe 39 PID 1844 wrote to memory of 1356 1844 nhbbnn.exe 39 PID 1844 wrote to memory of 1356 1844 nhbbnn.exe 39 PID 1356 wrote to memory of 2140 1356 3pddp.exe 40 PID 1356 wrote to memory of 2140 1356 3pddp.exe 40 PID 1356 wrote to memory of 2140 1356 3pddp.exe 40 PID 1356 wrote to memory of 2140 1356 3pddp.exe 40 PID 2140 wrote to memory of 3000 2140 jpvjj.exe 41 PID 2140 wrote to memory of 3000 2140 jpvjj.exe 41 PID 2140 wrote to memory of 3000 2140 jpvjj.exe 41 PID 2140 wrote to memory of 3000 2140 jpvjj.exe 41 PID 3000 wrote to memory of 2728 3000 5ntntt.exe 42 PID 3000 wrote to memory of 2728 3000 5ntntt.exe 42 PID 3000 wrote to memory of 2728 3000 5ntntt.exe 42 PID 3000 wrote to memory of 2728 3000 5ntntt.exe 42 PID 2728 wrote to memory of 2844 2728 pdpjp.exe 43 PID 2728 wrote to memory of 2844 2728 pdpjp.exe 43 PID 2728 wrote to memory of 2844 2728 pdpjp.exe 43 PID 2728 wrote to memory of 2844 2728 pdpjp.exe 43 PID 2844 wrote to memory of 2892 2844 rflrrrx.exe 44 PID 2844 wrote to memory of 2892 2844 rflrrrx.exe 44 PID 2844 wrote to memory of 2892 2844 rflrrrx.exe 44 PID 2844 wrote to memory of 2892 2844 rflrrrx.exe 44 PID 2892 wrote to memory of 2956 2892 nhhhtn.exe 45 PID 2892 wrote to memory of 2956 2892 nhhhtn.exe 45 PID 2892 wrote to memory of 2956 2892 nhhhtn.exe 45 PID 2892 wrote to memory of 2956 2892 nhhhtn.exe 45 PID 2956 wrote to memory of 1584 2956 pdpdd.exe 46 PID 2956 wrote to memory of 1584 2956 pdpdd.exe 46 PID 2956 wrote to memory of 1584 2956 pdpdd.exe 46 PID 2956 wrote to memory of 1584 2956 pdpdd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc395f47aab22178de06a06c699b65dff797970b8d062a7bac191a4a808212c0.exe"C:\Users\Admin\AppData\Local\Temp\fc395f47aab22178de06a06c699b65dff797970b8d062a7bac191a4a808212c0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\rlffrrl.exec:\rlffrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\5ntnnb.exec:\5ntnnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\jvddj.exec:\jvddj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rlxfllr.exec:\rlxfllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\bttnnn.exec:\bttnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\3jvvv.exec:\3jvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\lxlfrll.exec:\lxlfrll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\nhbbnn.exec:\nhbbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\3pddp.exec:\3pddp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\jpvjj.exec:\jpvjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\5ntntt.exec:\5ntntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\pdpjp.exec:\pdpjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\rflrrrx.exec:\rflrrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\nhhhtn.exec:\nhhhtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\pdpdd.exec:\pdpdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\lxlffxx.exec:\lxlffxx.exe17⤵
- Executes dropped EXE
PID:1584 -
\??\c:\1hnnbt.exec:\1hnnbt.exe18⤵
- Executes dropped EXE
PID:112 -
\??\c:\jvddd.exec:\jvddd.exe19⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pjddp.exec:\pjddp.exe20⤵
- Executes dropped EXE
PID:2376 -
\??\c:\nhthhh.exec:\nhthhh.exe21⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vdppp.exec:\vdppp.exe22⤵
- Executes dropped EXE
PID:1196 -
\??\c:\1lxrflr.exec:\1lxrflr.exe23⤵
- Executes dropped EXE
PID:2068 -
\??\c:\7hnbtt.exec:\7hnbtt.exe24⤵
- Executes dropped EXE
PID:1296 -
\??\c:\dpdvp.exec:\dpdvp.exe25⤵
- Executes dropped EXE
PID:1192 -
\??\c:\lxffllf.exec:\lxffllf.exe26⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vjvpv.exec:\vjvpv.exe27⤵
- Executes dropped EXE
PID:2268 -
\??\c:\vjppp.exec:\vjppp.exe28⤵
- Executes dropped EXE
PID:1980 -
\??\c:\1llxrrr.exec:\1llxrrr.exe29⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nhhhnh.exec:\nhhhnh.exe30⤵
- Executes dropped EXE
PID:1436 -
\??\c:\9jpvp.exec:\9jpvp.exe31⤵
- Executes dropped EXE
PID:2764 -
\??\c:\5flrfff.exec:\5flrfff.exe32⤵
- Executes dropped EXE
PID:2788 -
\??\c:\nhnbbn.exec:\nhnbbn.exe33⤵
- Executes dropped EXE
PID:1528 -
\??\c:\9vdvj.exec:\9vdvj.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2580 -
\??\c:\lxffrrf.exec:\lxffrrf.exe35⤵
- Executes dropped EXE
PID:2700 -
\??\c:\nbbntn.exec:\nbbntn.exe36⤵
- Executes dropped EXE
PID:2704 -
\??\c:\hbttbh.exec:\hbttbh.exe37⤵
- Executes dropped EXE
PID:2976 -
\??\c:\5djjd.exec:\5djjd.exe38⤵
- Executes dropped EXE
PID:2812 -
\??\c:\xrrrlrx.exec:\xrrrlrx.exe39⤵
- Executes dropped EXE
PID:2248 -
\??\c:\thbbhb.exec:\thbbhb.exe40⤵
- Executes dropped EXE
PID:1556 -
\??\c:\9pddv.exec:\9pddv.exe41⤵
- Executes dropped EXE
PID:2980 -
\??\c:\xlxrxxx.exec:\xlxrxxx.exe42⤵
- Executes dropped EXE
PID:1844 -
\??\c:\7lxrlfx.exec:\7lxrlfx.exe43⤵
- Executes dropped EXE
PID:2152 -
\??\c:\tnnhnh.exec:\tnnhnh.exe44⤵
- Executes dropped EXE
PID:2264 -
\??\c:\1dppj.exec:\1dppj.exe45⤵
- Executes dropped EXE
PID:1616 -
\??\c:\frxrrlr.exec:\frxrrlr.exe46⤵
- Executes dropped EXE
PID:2060 -
\??\c:\xlfxfrf.exec:\xlfxfrf.exe47⤵
- Executes dropped EXE
PID:2940 -
\??\c:\thnhbt.exec:\thnhbt.exe48⤵
- Executes dropped EXE
PID:2912 -
\??\c:\pdppd.exec:\pdppd.exe49⤵
- Executes dropped EXE
PID:2748 -
\??\c:\5jdvv.exec:\5jdvv.exe50⤵
- Executes dropped EXE
PID:2900 -
\??\c:\3rfxfxx.exec:\3rfxfxx.exe51⤵
- Executes dropped EXE
PID:2868 -
\??\c:\hthntn.exec:\hthntn.exe52⤵
- Executes dropped EXE
PID:1840 -
\??\c:\7ppjp.exec:\7ppjp.exe53⤵
- Executes dropped EXE
PID:2196 -
\??\c:\pdpjj.exec:\pdpjj.exe54⤵
- Executes dropped EXE
PID:112 -
\??\c:\5rfrrxf.exec:\5rfrrxf.exe55⤵
- Executes dropped EXE
PID:2392 -
\??\c:\tnthtn.exec:\tnthtn.exe56⤵
- Executes dropped EXE
PID:3056 -
\??\c:\3nttbt.exec:\3nttbt.exe57⤵
- Executes dropped EXE
PID:2224 -
\??\c:\1vdvd.exec:\1vdvd.exe58⤵
- Executes dropped EXE
PID:2044 -
\??\c:\9fxxffx.exec:\9fxxffx.exe59⤵
- Executes dropped EXE
PID:1320 -
\??\c:\xrfrlll.exec:\xrfrlll.exe60⤵
- Executes dropped EXE
PID:968 -
\??\c:\tntbhh.exec:\tntbhh.exe61⤵
- Executes dropped EXE
PID:2300 -
\??\c:\pdpjj.exec:\pdpjj.exe62⤵
- Executes dropped EXE
PID:1324 -
\??\c:\1vpjp.exec:\1vpjp.exe63⤵
- Executes dropped EXE
PID:1960 -
\??\c:\3rrlrrr.exec:\3rrlrrr.exe64⤵
- Executes dropped EXE
PID:1468 -
\??\c:\5hnhbt.exec:\5hnhbt.exe65⤵
- Executes dropped EXE
PID:3060 -
\??\c:\nbhbhb.exec:\nbhbhb.exe66⤵PID:2624
-
\??\c:\pdppv.exec:\pdppv.exe67⤵PID:2136
-
\??\c:\3rffrrx.exec:\3rffrrx.exe68⤵PID:1580
-
\??\c:\lfxxfxx.exec:\lfxxfxx.exe69⤵PID:880
-
\??\c:\1bhhhh.exec:\1bhhhh.exe70⤵PID:2040
-
\??\c:\jpvvv.exec:\jpvvv.exe71⤵PID:2128
-
\??\c:\pdpjj.exec:\pdpjj.exe72⤵PID:1524
-
\??\c:\rxxfllr.exec:\rxxfllr.exe73⤵PID:2788
-
\??\c:\1tbbbt.exec:\1tbbbt.exe74⤵PID:2772
-
\??\c:\vjppp.exec:\vjppp.exe75⤵PID:1632
-
\??\c:\pddvv.exec:\pddvv.exe76⤵PID:2696
-
\??\c:\xlxxxrx.exec:\xlxxxrx.exe77⤵PID:2540
-
\??\c:\tbbtnh.exec:\tbbtnh.exe78⤵PID:2588
-
\??\c:\hnttbt.exec:\hnttbt.exe79⤵PID:2664
-
\??\c:\djjvv.exec:\djjvv.exe80⤵PID:2904
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe81⤵PID:1404
-
\??\c:\rlxffrx.exec:\rlxffrx.exe82⤵PID:2616
-
\??\c:\nbtnhn.exec:\nbtnhn.exe83⤵PID:2084
-
\??\c:\7djjp.exec:\7djjp.exe84⤵
- System Location Discovery: System Language Discovery
PID:1356 -
\??\c:\dvpvp.exec:\dvpvp.exe85⤵PID:2280
-
\??\c:\1xllfff.exec:\1xllfff.exe86⤵PID:1616
-
\??\c:\7flfxxf.exec:\7flfxxf.exe87⤵PID:2724
-
\??\c:\5btnhn.exec:\5btnhn.exe88⤵PID:700
-
\??\c:\ppvpj.exec:\ppvpj.exe89⤵PID:2852
-
\??\c:\dpvvd.exec:\dpvvd.exe90⤵PID:2748
-
\??\c:\xrrfxll.exec:\xrrfxll.exe91⤵PID:2892
-
\??\c:\7tbttn.exec:\7tbttn.exe92⤵PID:2884
-
\??\c:\5bnntt.exec:\5bnntt.exe93⤵PID:1972
-
\??\c:\pjpjd.exec:\pjpjd.exe94⤵PID:1836
-
\??\c:\9fxrllr.exec:\9fxrllr.exe95⤵
- System Location Discovery: System Language Discovery
PID:3036 -
\??\c:\7fffxxf.exec:\7fffxxf.exe96⤵PID:2168
-
\??\c:\nbhhnh.exec:\nbhhnh.exe97⤵PID:884
-
\??\c:\7nbbbb.exec:\7nbbbb.exe98⤵PID:1628
-
\??\c:\dpvpj.exec:\dpvpj.exe99⤵PID:2020
-
\??\c:\frlfffl.exec:\frlfffl.exe100⤵PID:1196
-
\??\c:\3fxflfr.exec:\3fxflfr.exe101⤵PID:1144
-
\??\c:\1ntntt.exec:\1ntntt.exe102⤵PID:1508
-
\??\c:\jpvpp.exec:\jpvpp.exe103⤵PID:1640
-
\??\c:\pvdpj.exec:\pvdpj.exe104⤵PID:2516
-
\??\c:\5lxrlff.exec:\5lxrlff.exe105⤵PID:1560
-
\??\c:\1bhbbb.exec:\1bhbbb.exe106⤵PID:2292
-
\??\c:\nbttbb.exec:\nbttbb.exe107⤵PID:2384
-
\??\c:\pdpvp.exec:\pdpvp.exe108⤵PID:1212
-
\??\c:\xlrrfxx.exec:\xlrrfxx.exe109⤵PID:1432
-
\??\c:\bnhhnh.exec:\bnhhnh.exe110⤵PID:2464
-
\??\c:\thnbnn.exec:\thnbnn.exe111⤵PID:2692
-
\??\c:\3pvjv.exec:\3pvjv.exe112⤵PID:2744
-
\??\c:\jvdjp.exec:\jvdjp.exe113⤵PID:1532
-
\??\c:\rxlxxrf.exec:\rxlxxrf.exe114⤵PID:3024
-
\??\c:\hbttbh.exec:\hbttbh.exe115⤵PID:2632
-
\??\c:\thnhbb.exec:\thnhbb.exe116⤵PID:2680
-
\??\c:\7jvvv.exec:\7jvvv.exe117⤵PID:2660
-
\??\c:\fxlflll.exec:\fxlflll.exe118⤵PID:2108
-
\??\c:\5lrrxrr.exec:\5lrrxrr.exe119⤵PID:2548
-
\??\c:\hbtbhh.exec:\hbtbhh.exe120⤵PID:2812
-
\??\c:\7vddd.exec:\7vddd.exe121⤵PID:2816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-