Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 09:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
de0ed8d8b1118436be59e4274ca81c7de7ae9b072abac13665f92816c869b259.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
de0ed8d8b1118436be59e4274ca81c7de7ae9b072abac13665f92816c869b259.exe
-
Size
454KB
-
MD5
b087cf0ec6733def35c4b347025dc11a
-
SHA1
f6f37a337fab92ea307f045d9f8775338db69c77
-
SHA256
de0ed8d8b1118436be59e4274ca81c7de7ae9b072abac13665f92816c869b259
-
SHA512
2ba78708aac82a4be078524666df115ed5710943a2e6a6b0dbfe8423d3b3888ef5e29b5420f564d9103a2efc6e3740c5a607072b10c2078a22af896539189902
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbex:q7Tc2NYHUrAwfMp3CDx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2516-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-49-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2908-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-94-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2628-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-126-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1988-144-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2980-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/804-170-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/804-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-219-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2484-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-273-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-295-0x0000000077820000-0x000000007793F000-memory.dmp family_blackmoon behavioral1/memory/1720-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-472-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2148-484-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2148-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-531-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1752-537-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2388-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/388-769-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1088-808-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2392-815-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/960-1079-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2392-1092-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-1118-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2784-1188-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1644 thbhbh.exe 2492 vpjpj.exe 2180 hbttbb.exe 2740 xxrrlxx.exe 2908 btttnn.exe 2620 3rfrffl.exe 2956 bttbhn.exe 2780 9rrxlrf.exe 2628 nhbnbt.exe 2664 3dvjj.exe 2804 lfflflf.exe 2044 dpdjp.exe 1008 xxxxffr.exe 1988 5jjpp.exe 2980 rllrlrf.exe 2984 pdjpv.exe 804 9flxxlx.exe 1764 9tnntt.exe 276 dvjjp.exe 1880 hbbhtb.exe 1288 3pjpv.exe 892 rrlrflr.exe 2484 ddvdp.exe 1256 lflxlxr.exe 3060 nhtbhn.exe 2544 7rflllx.exe 2392 bththn.exe 2276 rrxlxfr.exe 2692 dvjjp.exe 1760 xrlxlrf.exe 2696 nhnnhn.exe 1720 xrxlflf.exe 1776 jjpjv.exe 2452 lxrxffr.exe 2760 bthnnb.exe 3020 9dvdj.exe 2852 fxlxxll.exe 2912 lfrffxr.exe 2928 thttbb.exe 2772 pjddd.exe 2748 xxfllxr.exe 2660 5hnnnn.exe 2220 vjjpj.exe 2472 dpjjp.exe 664 lxfllfx.exe 1100 1nbbbb.exe 2456 7dpjj.exe 2880 rxlrxxf.exe 2860 1rlrffl.exe 2672 nnnhnt.exe 2568 ppjpv.exe 2988 3lfllrl.exe 1956 frrxllf.exe 1496 nnnbbh.exe 2116 pjdjp.exe 1764 1djvp.exe 1836 fxllllr.exe 1652 nnthbt.exe 2148 jdpvd.exe 1196 jddjj.exe 1084 rxrrrxf.exe 1140 nhbbht.exe 1328 pjpvd.exe 1256 5xrrxlr.exe -
resource yara_rule behavioral1/memory/2516-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/804-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-235-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2392-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-295-0x0000000077820000-0x000000007793F000-memory.dmp upx behavioral1/memory/1720-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-815-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-893-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-961-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-986-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-1118-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2844-1150-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlrrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2516 wrote to memory of 1644 2516 de0ed8d8b1118436be59e4274ca81c7de7ae9b072abac13665f92816c869b259.exe 30 PID 2516 wrote to memory of 1644 2516 de0ed8d8b1118436be59e4274ca81c7de7ae9b072abac13665f92816c869b259.exe 30 PID 2516 wrote to memory of 1644 2516 de0ed8d8b1118436be59e4274ca81c7de7ae9b072abac13665f92816c869b259.exe 30 PID 2516 wrote to memory of 1644 2516 de0ed8d8b1118436be59e4274ca81c7de7ae9b072abac13665f92816c869b259.exe 30 PID 1644 wrote to memory of 2492 1644 thbhbh.exe 31 PID 1644 wrote to memory of 2492 1644 thbhbh.exe 31 PID 1644 wrote to memory of 2492 1644 thbhbh.exe 31 PID 1644 wrote to memory of 2492 1644 thbhbh.exe 31 PID 2492 wrote to memory of 2180 2492 vpjpj.exe 32 PID 2492 wrote to memory of 2180 2492 vpjpj.exe 32 PID 2492 wrote to memory of 2180 2492 vpjpj.exe 32 PID 2492 wrote to memory of 2180 2492 vpjpj.exe 32 PID 2180 wrote to memory of 2740 2180 hbttbb.exe 33 PID 2180 wrote to memory of 2740 2180 hbttbb.exe 33 PID 2180 wrote to memory of 2740 2180 hbttbb.exe 33 PID 2180 wrote to memory of 2740 2180 hbttbb.exe 33 PID 2740 wrote to memory of 2908 2740 xxrrlxx.exe 34 PID 2740 wrote to memory of 2908 2740 xxrrlxx.exe 34 PID 2740 wrote to memory of 2908 2740 xxrrlxx.exe 34 PID 2740 wrote to memory of 2908 2740 xxrrlxx.exe 34 PID 2908 wrote to memory of 2620 2908 btttnn.exe 35 PID 2908 wrote to memory of 2620 2908 btttnn.exe 35 PID 2908 wrote to memory of 2620 2908 btttnn.exe 35 PID 2908 wrote to memory of 2620 2908 btttnn.exe 35 PID 2620 wrote to memory of 2956 2620 3rfrffl.exe 36 PID 2620 wrote to memory of 2956 2620 3rfrffl.exe 36 PID 2620 wrote to memory of 2956 2620 3rfrffl.exe 36 PID 2620 wrote to memory of 2956 2620 3rfrffl.exe 36 PID 2956 wrote to memory of 2780 2956 bttbhn.exe 37 PID 2956 wrote to memory of 2780 2956 bttbhn.exe 37 PID 2956 wrote to memory of 2780 2956 bttbhn.exe 37 PID 2956 wrote to memory of 2780 2956 bttbhn.exe 37 PID 2780 wrote to memory of 2628 2780 9rrxlrf.exe 38 PID 2780 wrote to memory of 2628 2780 9rrxlrf.exe 38 PID 2780 wrote to memory of 2628 2780 9rrxlrf.exe 38 PID 2780 wrote to memory of 2628 2780 9rrxlrf.exe 38 PID 2628 wrote to memory of 2664 2628 nhbnbt.exe 39 PID 2628 wrote to memory of 2664 2628 nhbnbt.exe 39 PID 2628 wrote to memory of 2664 2628 nhbnbt.exe 39 PID 2628 wrote to memory of 2664 2628 nhbnbt.exe 39 PID 2664 wrote to memory of 2804 2664 3dvjj.exe 40 PID 2664 wrote to memory of 2804 2664 3dvjj.exe 40 PID 2664 wrote to memory of 2804 2664 3dvjj.exe 40 PID 2664 wrote to memory of 2804 2664 3dvjj.exe 40 PID 2804 wrote to memory of 2044 2804 lfflflf.exe 41 PID 2804 wrote to memory of 2044 2804 lfflflf.exe 41 PID 2804 wrote to memory of 2044 2804 lfflflf.exe 41 PID 2804 wrote to memory of 2044 2804 lfflflf.exe 41 PID 2044 wrote to memory of 1008 2044 dpdjp.exe 42 PID 2044 wrote to memory of 1008 2044 dpdjp.exe 42 PID 2044 wrote to memory of 1008 2044 dpdjp.exe 42 PID 2044 wrote to memory of 1008 2044 dpdjp.exe 42 PID 1008 wrote to memory of 1988 1008 xxxxffr.exe 43 PID 1008 wrote to memory of 1988 1008 xxxxffr.exe 43 PID 1008 wrote to memory of 1988 1008 xxxxffr.exe 43 PID 1008 wrote to memory of 1988 1008 xxxxffr.exe 43 PID 1988 wrote to memory of 2980 1988 5jjpp.exe 44 PID 1988 wrote to memory of 2980 1988 5jjpp.exe 44 PID 1988 wrote to memory of 2980 1988 5jjpp.exe 44 PID 1988 wrote to memory of 2980 1988 5jjpp.exe 44 PID 2980 wrote to memory of 2984 2980 rllrlrf.exe 45 PID 2980 wrote to memory of 2984 2980 rllrlrf.exe 45 PID 2980 wrote to memory of 2984 2980 rllrlrf.exe 45 PID 2980 wrote to memory of 2984 2980 rllrlrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\de0ed8d8b1118436be59e4274ca81c7de7ae9b072abac13665f92816c869b259.exe"C:\Users\Admin\AppData\Local\Temp\de0ed8d8b1118436be59e4274ca81c7de7ae9b072abac13665f92816c869b259.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\thbhbh.exec:\thbhbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\vpjpj.exec:\vpjpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\hbttbb.exec:\hbttbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\xxrrlxx.exec:\xxrrlxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\btttnn.exec:\btttnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\3rfrffl.exec:\3rfrffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\bttbhn.exec:\bttbhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\9rrxlrf.exec:\9rrxlrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\nhbnbt.exec:\nhbnbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\3dvjj.exec:\3dvjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\lfflflf.exec:\lfflflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\dpdjp.exec:\dpdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\xxxxffr.exec:\xxxxffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\5jjpp.exec:\5jjpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\rllrlrf.exec:\rllrlrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\pdjpv.exec:\pdjpv.exe17⤵
- Executes dropped EXE
PID:2984 -
\??\c:\9flxxlx.exec:\9flxxlx.exe18⤵
- Executes dropped EXE
PID:804 -
\??\c:\9tnntt.exec:\9tnntt.exe19⤵
- Executes dropped EXE
PID:1764 -
\??\c:\dvjjp.exec:\dvjjp.exe20⤵
- Executes dropped EXE
PID:276 -
\??\c:\hbbhtb.exec:\hbbhtb.exe21⤵
- Executes dropped EXE
PID:1880 -
\??\c:\3pjpv.exec:\3pjpv.exe22⤵
- Executes dropped EXE
PID:1288 -
\??\c:\rrlrflr.exec:\rrlrflr.exe23⤵
- Executes dropped EXE
PID:892 -
\??\c:\ddvdp.exec:\ddvdp.exe24⤵
- Executes dropped EXE
PID:2484 -
\??\c:\lflxlxr.exec:\lflxlxr.exe25⤵
- Executes dropped EXE
PID:1256 -
\??\c:\nhtbhn.exec:\nhtbhn.exe26⤵
- Executes dropped EXE
PID:3060 -
\??\c:\7rflllx.exec:\7rflllx.exe27⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bththn.exec:\bththn.exe28⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rrxlxfr.exec:\rrxlxfr.exe29⤵
- Executes dropped EXE
PID:2276 -
\??\c:\dvjjp.exec:\dvjjp.exe30⤵
- Executes dropped EXE
PID:2692 -
\??\c:\xrlxlrf.exec:\xrlxlrf.exe31⤵
- Executes dropped EXE
PID:1760 -
\??\c:\nhnnhn.exec:\nhnnhn.exe32⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jvjjj.exec:\jvjjj.exe33⤵PID:2384
-
\??\c:\xrxlflf.exec:\xrxlflf.exe34⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jjpjv.exec:\jjpjv.exe35⤵
- Executes dropped EXE
PID:1776 -
\??\c:\lxrxffr.exec:\lxrxffr.exe36⤵
- Executes dropped EXE
PID:2452 -
\??\c:\bthnnb.exec:\bthnnb.exe37⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9dvdj.exec:\9dvdj.exe38⤵
- Executes dropped EXE
PID:3020 -
\??\c:\fxlxxll.exec:\fxlxxll.exe39⤵
- Executes dropped EXE
PID:2852 -
\??\c:\lfrffxr.exec:\lfrffxr.exe40⤵
- Executes dropped EXE
PID:2912 -
\??\c:\thttbb.exec:\thttbb.exe41⤵
- Executes dropped EXE
PID:2928 -
\??\c:\pjddd.exec:\pjddd.exe42⤵
- Executes dropped EXE
PID:2772 -
\??\c:\xxfllxr.exec:\xxfllxr.exe43⤵
- Executes dropped EXE
PID:2748 -
\??\c:\5hnnnn.exec:\5hnnnn.exe44⤵
- Executes dropped EXE
PID:2660 -
\??\c:\vjjpj.exec:\vjjpj.exe45⤵
- Executes dropped EXE
PID:2220 -
\??\c:\dpjjp.exec:\dpjjp.exe46⤵
- Executes dropped EXE
PID:2472 -
\??\c:\lxfllfx.exec:\lxfllfx.exe47⤵
- Executes dropped EXE
PID:664 -
\??\c:\1nbbbb.exec:\1nbbbb.exe48⤵
- Executes dropped EXE
PID:1100 -
\??\c:\7dpjj.exec:\7dpjj.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2456 -
\??\c:\rxlrxxf.exec:\rxlrxxf.exe50⤵
- Executes dropped EXE
PID:2880 -
\??\c:\1rlrffl.exec:\1rlrffl.exe51⤵
- Executes dropped EXE
PID:2860 -
\??\c:\nnnhnt.exec:\nnnhnt.exe52⤵
- Executes dropped EXE
PID:2672 -
\??\c:\ppjpv.exec:\ppjpv.exe53⤵
- Executes dropped EXE
PID:2568 -
\??\c:\3lfllrl.exec:\3lfllrl.exe54⤵
- Executes dropped EXE
PID:2988 -
\??\c:\frrxllf.exec:\frrxllf.exe55⤵
- Executes dropped EXE
PID:1956 -
\??\c:\nnnbbh.exec:\nnnbbh.exe56⤵
- Executes dropped EXE
PID:1496 -
\??\c:\pjdjp.exec:\pjdjp.exe57⤵
- Executes dropped EXE
PID:2116 -
\??\c:\1djvp.exec:\1djvp.exe58⤵
- Executes dropped EXE
PID:1764 -
\??\c:\fxllllr.exec:\fxllllr.exe59⤵
- Executes dropped EXE
PID:1836 -
\??\c:\nnthbt.exec:\nnthbt.exe60⤵
- Executes dropped EXE
PID:1652 -
\??\c:\jdpvd.exec:\jdpvd.exe61⤵
- Executes dropped EXE
PID:2148 -
\??\c:\jddjj.exec:\jddjj.exe62⤵
- Executes dropped EXE
PID:1196 -
\??\c:\rxrrrxf.exec:\rxrrrxf.exe63⤵
- Executes dropped EXE
PID:1084 -
\??\c:\nhbbht.exec:\nhbbht.exe64⤵
- Executes dropped EXE
PID:1140 -
\??\c:\pjpvd.exec:\pjpvd.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1328 -
\??\c:\5xrrxlr.exec:\5xrrxlr.exe66⤵
- Executes dropped EXE
PID:1256 -
\??\c:\nnhnbh.exec:\nnhnbh.exe67⤵PID:928
-
\??\c:\nhthnt.exec:\nhthnt.exe68⤵PID:1740
-
\??\c:\pjpvv.exec:\pjpvv.exe69⤵PID:1752
-
\??\c:\ffxlxxr.exec:\ffxlxxr.exe70⤵PID:2120
-
\??\c:\tbtnhb.exec:\tbtnhb.exe71⤵PID:2276
-
\??\c:\jdddj.exec:\jdddj.exe72⤵PID:2008
-
\??\c:\dpvjd.exec:\dpvjd.exe73⤵PID:2692
-
\??\c:\xrxxxrx.exec:\xrxxxrx.exe74⤵PID:2172
-
\??\c:\5nnbth.exec:\5nnbth.exe75⤵PID:1732
-
\??\c:\7ppvv.exec:\7ppvv.exe76⤵PID:2384
-
\??\c:\vjvvd.exec:\vjvvd.exe77⤵PID:2352
-
\??\c:\5xlffxf.exec:\5xlffxf.exe78⤵PID:2388
-
\??\c:\ttbntt.exec:\ttbntt.exe79⤵PID:2800
-
\??\c:\pjddd.exec:\pjddd.exe80⤵PID:2452
-
\??\c:\vpjpd.exec:\vpjpd.exe81⤵PID:2704
-
\??\c:\7fffllr.exec:\7fffllr.exe82⤵PID:2736
-
\??\c:\bhtnnb.exec:\bhtnnb.exe83⤵PID:2852
-
\??\c:\vvjjj.exec:\vvjjj.exe84⤵PID:2908
-
\??\c:\5xxflxr.exec:\5xxflxr.exe85⤵PID:2776
-
\??\c:\ttthbn.exec:\ttthbn.exe86⤵PID:2612
-
\??\c:\jdppv.exec:\jdppv.exe87⤵PID:2748
-
\??\c:\jdjpv.exec:\jdjpv.exe88⤵PID:2628
-
\??\c:\xfffrxl.exec:\xfffrxl.exe89⤵PID:2632
-
\??\c:\thtnhb.exec:\thtnhb.exe90⤵PID:808
-
\??\c:\pppdv.exec:\pppdv.exe91⤵PID:664
-
\??\c:\5xrrllr.exec:\5xrrllr.exe92⤵PID:1100
-
\??\c:\tnntbh.exec:\tnntbh.exe93⤵PID:2456
-
\??\c:\hthttn.exec:\hthttn.exe94⤵PID:2880
-
\??\c:\1dvdd.exec:\1dvdd.exe95⤵PID:2320
-
\??\c:\xxllllx.exec:\xxllllx.exe96⤵PID:2960
-
\??\c:\bhhhbt.exec:\bhhhbt.exe97⤵PID:2204
-
\??\c:\dvvvd.exec:\dvvvd.exe98⤵PID:2988
-
\??\c:\dvpdd.exec:\dvpdd.exe99⤵PID:1956
-
\??\c:\lfrrxxr.exec:\lfrrxxr.exe100⤵PID:1408
-
\??\c:\thhtbn.exec:\thhtbn.exe101⤵PID:2116
-
\??\c:\vvppd.exec:\vvppd.exe102⤵PID:2080
-
\??\c:\7jdpv.exec:\7jdpv.exe103⤵PID:388
-
\??\c:\7fxxflx.exec:\7fxxflx.exe104⤵PID:3044
-
\??\c:\1nthhh.exec:\1nthhh.exe105⤵PID:848
-
\??\c:\djjvv.exec:\djjvv.exe106⤵PID:2312
-
\??\c:\rlfxxxl.exec:\rlfxxxl.exe107⤵PID:1128
-
\??\c:\tthhhh.exec:\tthhhh.exe108⤵PID:2484
-
\??\c:\5vppp.exec:\5vppp.exe109⤵PID:1088
-
\??\c:\xrrfxfx.exec:\xrrfxfx.exe110⤵PID:912
-
\??\c:\7bttbh.exec:\7bttbh.exe111⤵PID:960
-
\??\c:\dvjjp.exec:\dvjjp.exe112⤵PID:2152
-
\??\c:\llfxxxx.exec:\llfxxxx.exe113⤵PID:2392
-
\??\c:\hbhnbb.exec:\hbhnbb.exe114⤵PID:2552
-
\??\c:\vvvjp.exec:\vvvjp.exe115⤵PID:1484
-
\??\c:\xrlxfxx.exec:\xrlxfxx.exe116⤵PID:884
-
\??\c:\9tbbtb.exec:\9tbbtb.exe117⤵PID:2408
-
\??\c:\vppdp.exec:\vppdp.exe118⤵PID:2516
-
\??\c:\lfrxxlr.exec:\lfrxxlr.exe119⤵PID:1644
-
\??\c:\hthhnn.exec:\hthhnn.exe120⤵PID:2384
-
\??\c:\jdvjp.exec:\jdvjp.exe121⤵PID:1520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-