Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 07:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bf41aac8d8c37ff65eb2167bca3491545c4c7291504789c17fd209c726cb07c1N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
bf41aac8d8c37ff65eb2167bca3491545c4c7291504789c17fd209c726cb07c1N.exe
-
Size
456KB
-
MD5
d66914a5f3b2ec342f3430dee2122f20
-
SHA1
f4adac19822a9305fe0093fbc3de5d315d0e07ab
-
SHA256
bf41aac8d8c37ff65eb2167bca3491545c4c7291504789c17fd209c726cb07c1
-
SHA512
4dbb190cb7563a617e326a06d2ab61c4e4eecfafa9fa25f4aeb7b500899f205d66c3fc55fba046682203d0b7725b6aae0054c19b6e273f4e72b763b8517201ee
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRw:q7Tc2NYHUrAwfMp3CDRw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2508-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-130-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2792-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-147-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2120-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1176-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-184-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/700-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-229-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/896-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-274-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2520-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-463-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/700-476-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1404-480-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1404-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-492-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/672-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1136-507-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1944-680-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2688-699-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-881-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/624-999-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1320-1123-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1320 bnbhnn.exe 2540 jdpvd.exe 2328 fxlrrrx.exe 1852 nbtnbt.exe 2852 1pddj.exe 3016 rrfflxf.exe 2716 7bhhhh.exe 1272 jvdvv.exe 2496 7jppj.exe 2664 ththbb.exe 2440 jdddj.exe 840 fxfffxf.exe 2796 5nbhbb.exe 1580 1vpvp.exe 2792 bbnbbb.exe 2656 5nhnbb.exe 2120 hbtbnn.exe 1176 rrxflfl.exe 2064 tnbbbt.exe 700 xfrrffx.exe 572 thnhtn.exe 2580 hnbthn.exe 956 rflrrxf.exe 2468 7nbnht.exe 1784 dvppv.exe 896 pjvdd.exe 1948 1djdd.exe 2480 7tnnnn.exe 2180 vjjvp.exe 2684 1xrlrlr.exe 1696 5bhhhb.exe 2520 rrffllx.exe 1588 nbtttn.exe 1260 jdpjp.exe 1736 rlflrrf.exe 2264 thtbnt.exe 2744 3ntbnh.exe 2860 jvpvp.exe 2872 frflrrf.exe 3016 1hbthh.exe 2988 3nbbbb.exe 2624 dpdjj.exe 2772 7lxxrrf.exe 2652 9flffxx.exe 1444 nbnnbb.exe 2672 pjvjv.exe 1408 9jvdj.exe 756 lfxfffr.exe 828 bthhnn.exe 868 7nhntb.exe 2776 ddpjp.exe 2948 xrflllf.exe 2936 bbnbnn.exe 2656 nbbnnh.exe 1956 vdjvv.exe 624 fxrxffl.exe 2000 rrlfrrl.exe 2696 hnthht.exe 332 dvjdv.exe 700 vjvvj.exe 1404 3xrrxfl.exe 1772 ttthnt.exe 672 ppjjv.exe 1136 rfxrfff.exe -
resource yara_rule behavioral1/memory/2508-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-90-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2664-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-184-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/700-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1404-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-492-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/672-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-881-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-906-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-937-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-975-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-994-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-1092-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-1336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-1349-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ntbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxlrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2508 wrote to memory of 1320 2508 bf41aac8d8c37ff65eb2167bca3491545c4c7291504789c17fd209c726cb07c1N.exe 30 PID 2508 wrote to memory of 1320 2508 bf41aac8d8c37ff65eb2167bca3491545c4c7291504789c17fd209c726cb07c1N.exe 30 PID 2508 wrote to memory of 1320 2508 bf41aac8d8c37ff65eb2167bca3491545c4c7291504789c17fd209c726cb07c1N.exe 30 PID 2508 wrote to memory of 1320 2508 bf41aac8d8c37ff65eb2167bca3491545c4c7291504789c17fd209c726cb07c1N.exe 30 PID 1320 wrote to memory of 2540 1320 bnbhnn.exe 31 PID 1320 wrote to memory of 2540 1320 bnbhnn.exe 31 PID 1320 wrote to memory of 2540 1320 bnbhnn.exe 31 PID 1320 wrote to memory of 2540 1320 bnbhnn.exe 31 PID 2540 wrote to memory of 2328 2540 jdpvd.exe 32 PID 2540 wrote to memory of 2328 2540 jdpvd.exe 32 PID 2540 wrote to memory of 2328 2540 jdpvd.exe 32 PID 2540 wrote to memory of 2328 2540 jdpvd.exe 32 PID 2328 wrote to memory of 1852 2328 fxlrrrx.exe 33 PID 2328 wrote to memory of 1852 2328 fxlrrrx.exe 33 PID 2328 wrote to memory of 1852 2328 fxlrrrx.exe 33 PID 2328 wrote to memory of 1852 2328 fxlrrrx.exe 33 PID 1852 wrote to memory of 2852 1852 nbtnbt.exe 34 PID 1852 wrote to memory of 2852 1852 nbtnbt.exe 34 PID 1852 wrote to memory of 2852 1852 nbtnbt.exe 34 PID 1852 wrote to memory of 2852 1852 nbtnbt.exe 34 PID 2852 wrote to memory of 3016 2852 1pddj.exe 35 PID 2852 wrote to memory of 3016 2852 1pddj.exe 35 PID 2852 wrote to memory of 3016 2852 1pddj.exe 35 PID 2852 wrote to memory of 3016 2852 1pddj.exe 35 PID 3016 wrote to memory of 2716 3016 rrfflxf.exe 36 PID 3016 wrote to memory of 2716 3016 rrfflxf.exe 36 PID 3016 wrote to memory of 2716 3016 rrfflxf.exe 36 PID 3016 wrote to memory of 2716 3016 rrfflxf.exe 36 PID 2716 wrote to memory of 1272 2716 7bhhhh.exe 37 PID 2716 wrote to memory of 1272 2716 7bhhhh.exe 37 PID 2716 wrote to memory of 1272 2716 7bhhhh.exe 37 PID 2716 wrote to memory of 1272 2716 7bhhhh.exe 37 PID 1272 wrote to memory of 2496 1272 jvdvv.exe 38 PID 1272 wrote to memory of 2496 1272 jvdvv.exe 38 PID 1272 wrote to memory of 2496 1272 jvdvv.exe 38 PID 1272 wrote to memory of 2496 1272 jvdvv.exe 38 PID 2496 wrote to memory of 2664 2496 7jppj.exe 39 PID 2496 wrote to memory of 2664 2496 7jppj.exe 39 PID 2496 wrote to memory of 2664 2496 7jppj.exe 39 PID 2496 wrote to memory of 2664 2496 7jppj.exe 39 PID 2664 wrote to memory of 2440 2664 ththbb.exe 40 PID 2664 wrote to memory of 2440 2664 ththbb.exe 40 PID 2664 wrote to memory of 2440 2664 ththbb.exe 40 PID 2664 wrote to memory of 2440 2664 ththbb.exe 40 PID 2440 wrote to memory of 840 2440 jdddj.exe 41 PID 2440 wrote to memory of 840 2440 jdddj.exe 41 PID 2440 wrote to memory of 840 2440 jdddj.exe 41 PID 2440 wrote to memory of 840 2440 jdddj.exe 41 PID 840 wrote to memory of 2796 840 fxfffxf.exe 42 PID 840 wrote to memory of 2796 840 fxfffxf.exe 42 PID 840 wrote to memory of 2796 840 fxfffxf.exe 42 PID 840 wrote to memory of 2796 840 fxfffxf.exe 42 PID 2796 wrote to memory of 1580 2796 5nbhbb.exe 43 PID 2796 wrote to memory of 1580 2796 5nbhbb.exe 43 PID 2796 wrote to memory of 1580 2796 5nbhbb.exe 43 PID 2796 wrote to memory of 1580 2796 5nbhbb.exe 43 PID 1580 wrote to memory of 2792 1580 1vpvp.exe 44 PID 1580 wrote to memory of 2792 1580 1vpvp.exe 44 PID 1580 wrote to memory of 2792 1580 1vpvp.exe 44 PID 1580 wrote to memory of 2792 1580 1vpvp.exe 44 PID 2792 wrote to memory of 2656 2792 bbnbbb.exe 45 PID 2792 wrote to memory of 2656 2792 bbnbbb.exe 45 PID 2792 wrote to memory of 2656 2792 bbnbbb.exe 45 PID 2792 wrote to memory of 2656 2792 bbnbbb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf41aac8d8c37ff65eb2167bca3491545c4c7291504789c17fd209c726cb07c1N.exe"C:\Users\Admin\AppData\Local\Temp\bf41aac8d8c37ff65eb2167bca3491545c4c7291504789c17fd209c726cb07c1N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\bnbhnn.exec:\bnbhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\jdpvd.exec:\jdpvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\fxlrrrx.exec:\fxlrrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\nbtnbt.exec:\nbtnbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\1pddj.exec:\1pddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\rrfflxf.exec:\rrfflxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\7bhhhh.exec:\7bhhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\jvdvv.exec:\jvdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\7jppj.exec:\7jppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\ththbb.exec:\ththbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\jdddj.exec:\jdddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\fxfffxf.exec:\fxfffxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\5nbhbb.exec:\5nbhbb.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\1vpvp.exec:\1vpvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\bbnbbb.exec:\bbnbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\5nhnbb.exec:\5nhnbb.exe17⤵
- Executes dropped EXE
PID:2656 -
\??\c:\hbtbnn.exec:\hbtbnn.exe18⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rrxflfl.exec:\rrxflfl.exe19⤵
- Executes dropped EXE
PID:1176 -
\??\c:\tnbbbt.exec:\tnbbbt.exe20⤵
- Executes dropped EXE
PID:2064 -
\??\c:\xfrrffx.exec:\xfrrffx.exe21⤵
- Executes dropped EXE
PID:700 -
\??\c:\thnhtn.exec:\thnhtn.exe22⤵
- Executes dropped EXE
PID:572 -
\??\c:\hnbthn.exec:\hnbthn.exe23⤵
- Executes dropped EXE
PID:2580 -
\??\c:\rflrrxf.exec:\rflrrxf.exe24⤵
- Executes dropped EXE
PID:956 -
\??\c:\7nbnht.exec:\7nbnht.exe25⤵
- Executes dropped EXE
PID:2468 -
\??\c:\dvppv.exec:\dvppv.exe26⤵
- Executes dropped EXE
PID:1784 -
\??\c:\pjvdd.exec:\pjvdd.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:896 -
\??\c:\1djdd.exec:\1djdd.exe28⤵
- Executes dropped EXE
PID:1948 -
\??\c:\7tnnnn.exec:\7tnnnn.exe29⤵
- Executes dropped EXE
PID:2480 -
\??\c:\vjjvp.exec:\vjjvp.exe30⤵
- Executes dropped EXE
PID:2180 -
\??\c:\1xrlrlr.exec:\1xrlrlr.exe31⤵
- Executes dropped EXE
PID:2684 -
\??\c:\5bhhhb.exec:\5bhhhb.exe32⤵
- Executes dropped EXE
PID:1696 -
\??\c:\rrffllx.exec:\rrffllx.exe33⤵
- Executes dropped EXE
PID:2520 -
\??\c:\nbtttn.exec:\nbtttn.exe34⤵
- Executes dropped EXE
PID:1588 -
\??\c:\jdpjp.exec:\jdpjp.exe35⤵
- Executes dropped EXE
PID:1260 -
\??\c:\rlflrrf.exec:\rlflrrf.exe36⤵
- Executes dropped EXE
PID:1736 -
\??\c:\thtbnt.exec:\thtbnt.exe37⤵
- Executes dropped EXE
PID:2264 -
\??\c:\3ntbnh.exec:\3ntbnh.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2744 -
\??\c:\jvpvp.exec:\jvpvp.exe39⤵
- Executes dropped EXE
PID:2860 -
\??\c:\frflrrf.exec:\frflrrf.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\1hbthh.exec:\1hbthh.exe41⤵
- Executes dropped EXE
PID:3016 -
\??\c:\3nbbbb.exec:\3nbbbb.exe42⤵
- Executes dropped EXE
PID:2988 -
\??\c:\dpdjj.exec:\dpdjj.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\7lxxrrf.exec:\7lxxrrf.exe44⤵
- Executes dropped EXE
PID:2772 -
\??\c:\9flffxx.exec:\9flffxx.exe45⤵
- Executes dropped EXE
PID:2652 -
\??\c:\nbnnbb.exec:\nbnnbb.exe46⤵
- Executes dropped EXE
PID:1444 -
\??\c:\pjvjv.exec:\pjvjv.exe47⤵
- Executes dropped EXE
PID:2672 -
\??\c:\9jvdj.exec:\9jvdj.exe48⤵
- Executes dropped EXE
PID:1408 -
\??\c:\lfxfffr.exec:\lfxfffr.exe49⤵
- Executes dropped EXE
PID:756 -
\??\c:\bthhnn.exec:\bthhnn.exe50⤵
- Executes dropped EXE
PID:828 -
\??\c:\7nhntb.exec:\7nhntb.exe51⤵
- Executes dropped EXE
PID:868 -
\??\c:\ddpjp.exec:\ddpjp.exe52⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xrflllf.exec:\xrflllf.exe53⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bbnbnn.exec:\bbnbnn.exe54⤵
- Executes dropped EXE
PID:2936 -
\??\c:\nbbnnh.exec:\nbbnnh.exe55⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vdjvv.exec:\vdjvv.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1956 -
\??\c:\fxrxffl.exec:\fxrxffl.exe57⤵
- Executes dropped EXE
PID:624 -
\??\c:\rrlfrrl.exec:\rrlfrrl.exe58⤵
- Executes dropped EXE
PID:2000 -
\??\c:\hnthht.exec:\hnthht.exe59⤵
- Executes dropped EXE
PID:2696 -
\??\c:\dvjdv.exec:\dvjdv.exe60⤵
- Executes dropped EXE
PID:332 -
\??\c:\vjvvj.exec:\vjvvj.exe61⤵
- Executes dropped EXE
PID:700 -
\??\c:\3xrrxfl.exec:\3xrrxfl.exe62⤵
- Executes dropped EXE
PID:1404 -
\??\c:\ttthnt.exec:\ttthnt.exe63⤵
- Executes dropped EXE
PID:1772 -
\??\c:\ppjjv.exec:\ppjjv.exe64⤵
- Executes dropped EXE
PID:672 -
\??\c:\rfxrfff.exec:\rfxrfff.exe65⤵
- Executes dropped EXE
PID:1136 -
\??\c:\xrffrrf.exec:\xrffrrf.exe66⤵PID:1540
-
\??\c:\5bntbh.exec:\5bntbh.exe67⤵PID:1760
-
\??\c:\7jdpp.exec:\7jdpp.exe68⤵PID:688
-
\??\c:\1lffrrx.exec:\1lffrrx.exe69⤵PID:2412
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe70⤵PID:2436
-
\??\c:\nhtbnt.exec:\nhtbnt.exe71⤵PID:344
-
\??\c:\vjddd.exec:\vjddd.exe72⤵PID:2248
-
\??\c:\9lrrrrr.exec:\9lrrrrr.exe73⤵PID:2180
-
\??\c:\lxfxfxf.exec:\lxfxfxf.exe74⤵PID:1692
-
\??\c:\7ttbhh.exec:\7ttbhh.exe75⤵PID:872
-
\??\c:\vjvdj.exec:\vjvdj.exe76⤵PID:2556
-
\??\c:\rflfffl.exec:\rflfffl.exe77⤵PID:1592
-
\??\c:\rrxflfl.exec:\rrxflfl.exe78⤵PID:1720
-
\??\c:\bnbtnh.exec:\bnbtnh.exe79⤵PID:1264
-
\??\c:\pddjj.exec:\pddjj.exe80⤵PID:2784
-
\??\c:\jvjjp.exec:\jvjjp.exe81⤵PID:2264
-
\??\c:\1lxfrxf.exec:\1lxfrxf.exe82⤵PID:2728
-
\??\c:\bthbbh.exec:\bthbbh.exe83⤵PID:2860
-
\??\c:\jvjjj.exec:\jvjjj.exe84⤵PID:2872
-
\??\c:\3jddv.exec:\3jddv.exe85⤵PID:3016
-
\??\c:\frlffxf.exec:\frlffxf.exe86⤵
- System Location Discovery: System Language Discovery
PID:2924 -
\??\c:\xrxllxf.exec:\xrxllxf.exe87⤵PID:2972
-
\??\c:\nbnhhh.exec:\nbnhhh.exe88⤵PID:2616
-
\??\c:\5dppv.exec:\5dppv.exe89⤵PID:2676
-
\??\c:\5vdvp.exec:\5vdvp.exe90⤵PID:2056
-
\??\c:\fxllrrx.exec:\fxllrrx.exe91⤵PID:1940
-
\??\c:\btbbht.exec:\btbbht.exe92⤵PID:2440
-
\??\c:\5tbttn.exec:\5tbttn.exe93⤵PID:1944
-
\??\c:\vjjjj.exec:\vjjjj.exe94⤵PID:2808
-
\??\c:\fxflllr.exec:\fxflllr.exe95⤵PID:2956
-
\??\c:\bthnth.exec:\bthnth.exe96⤵PID:2688
-
\??\c:\hthnnt.exec:\hthnnt.exe97⤵PID:2844
-
\??\c:\jpdvd.exec:\jpdvd.exe98⤵PID:1844
-
\??\c:\rrxxfxl.exec:\rrxxfxl.exe99⤵PID:2668
-
\??\c:\nbnhhh.exec:\nbnhhh.exe100⤵PID:1956
-
\??\c:\nntnnh.exec:\nntnnh.exe101⤵PID:1996
-
\??\c:\jdpvd.exec:\jdpvd.exe102⤵PID:2396
-
\??\c:\xffrrfr.exec:\xffrrfr.exe103⤵PID:2012
-
\??\c:\lxfrrll.exec:\lxfrrll.exe104⤵PID:576
-
\??\c:\9thhnn.exec:\9thhnn.exe105⤵
- System Location Discovery: System Language Discovery
PID:1076 -
\??\c:\7ddpp.exec:\7ddpp.exe106⤵PID:572
-
\??\c:\9dvpj.exec:\9dvpj.exe107⤵PID:3032
-
\??\c:\xrlffxf.exec:\xrlffxf.exe108⤵PID:1664
-
\??\c:\bbtnbb.exec:\bbtnbb.exe109⤵PID:1684
-
\??\c:\thtnnh.exec:\thtnnh.exe110⤵PID:2224
-
\??\c:\djvjp.exec:\djvjp.exe111⤵PID:2428
-
\??\c:\xlxxxrx.exec:\xlxxxrx.exe112⤵PID:1760
-
\??\c:\1llrxrr.exec:\1llrxrr.exe113⤵PID:1680
-
\??\c:\httnnh.exec:\httnnh.exe114⤵PID:2152
-
\??\c:\ddpjp.exec:\ddpjp.exe115⤵PID:3056
-
\??\c:\9djdd.exec:\9djdd.exe116⤵PID:344
-
\??\c:\rrflxxf.exec:\rrflxxf.exe117⤵PID:604
-
\??\c:\5thnnn.exec:\5thnnn.exe118⤵PID:3024
-
\??\c:\ntttth.exec:\ntttth.exe119⤵PID:1032
-
\??\c:\vpjpd.exec:\vpjpd.exe120⤵PID:2420
-
\??\c:\vjvdd.exec:\vjvdd.exe121⤵PID:2096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-