Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 08:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c48adbaf41588c967a227cb4527ac1ad3112f48bf525e76d5b314369fb8ed965.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c48adbaf41588c967a227cb4527ac1ad3112f48bf525e76d5b314369fb8ed965.exe
-
Size
456KB
-
MD5
e3bebd5248980c4b3181392de3867535
-
SHA1
eddefbbb87e6e6cf2f9f870aae130a07369c489c
-
SHA256
c48adbaf41588c967a227cb4527ac1ad3112f48bf525e76d5b314369fb8ed965
-
SHA512
e17595173bda3392c361e22b91318118f91b752f08df509d89436080719fdc3cb5f5511985bc1d8af0a6bde158fc63c510c9958bf7d5c9605b8bb9e9a4d3bbe6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR5:q7Tc2NYHUrAwfMp3CDR5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2872-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1440-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/744-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-304-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2384-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-379-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2628-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/856-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-492-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/444-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/280-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-581-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2924-694-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-740-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1988-886-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-928-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2264-966-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-973-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2420-1024-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2080 tnhnbb.exe 1232 7ddvj.exe 2900 fxrxffr.exe 2124 nbhhhh.exe 2820 vpjpv.exe 2168 hbtntt.exe 2640 1jjdj.exe 2696 rlfxfll.exe 2772 nhttbb.exe 2520 jvjpp.exe 2432 xrllrxx.exe 2544 nbhhhb.exe 2000 hbbnnt.exe 1824 3rxxxfr.exe 1804 nhttbb.exe 1740 pjddj.exe 1440 7lrxlll.exe 1792 nhbhnn.exe 1256 jjvdp.exe 1296 lxrllfl.exe 848 hhtbhh.exe 1640 3jvjd.exe 908 djjpv.exe 744 xlfxxrx.exe 604 3bttbb.exe 2352 7vppp.exe 1076 nhnnnn.exe 836 pjvvj.exe 912 lxfflrx.exe 3000 5hbbbb.exe 3048 jdppp.exe 2092 hnbnnh.exe 2452 nhnnhh.exe 2384 fxlxlfl.exe 2368 rfxrxxf.exe 2896 nbtttt.exe 2128 jdvvj.exe 1228 7rfflrr.exe 1328 ffxfflr.exe 2780 5bhhhn.exe 1980 vpjdj.exe 2704 xxfxfrx.exe 2916 nbtthb.exe 2644 nbnhhb.exe 2748 pdjdv.exe 2628 7xlxrll.exe 2516 tttthn.exe 2540 vppvv.exe 2544 frxxxxr.exe 2504 xlfffxx.exe 856 tthnnn.exe 2488 3djjp.exe 2300 fxrllll.exe 2296 rlflllr.exe 1680 bntnnn.exe 1548 jdpjj.exe 1992 9vjjd.exe 1196 5llxxrr.exe 1296 3hnhnn.exe 2256 3hbbbt.exe 1900 jjvdd.exe 444 xrfffxx.exe 680 bnbhnn.exe 1144 dvpjv.exe -
resource yara_rule behavioral1/memory/2872-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/744-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/280-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-740-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1876-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-837-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-886-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-911-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-928-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2532-951-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-959-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-966-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-980-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrlfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrflxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxflrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c48adbaf41588c967a227cb4527ac1ad3112f48bf525e76d5b314369fb8ed965.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2080 2872 c48adbaf41588c967a227cb4527ac1ad3112f48bf525e76d5b314369fb8ed965.exe 28 PID 2872 wrote to memory of 2080 2872 c48adbaf41588c967a227cb4527ac1ad3112f48bf525e76d5b314369fb8ed965.exe 28 PID 2872 wrote to memory of 2080 2872 c48adbaf41588c967a227cb4527ac1ad3112f48bf525e76d5b314369fb8ed965.exe 28 PID 2872 wrote to memory of 2080 2872 c48adbaf41588c967a227cb4527ac1ad3112f48bf525e76d5b314369fb8ed965.exe 28 PID 2080 wrote to memory of 1232 2080 tnhnbb.exe 29 PID 2080 wrote to memory of 1232 2080 tnhnbb.exe 29 PID 2080 wrote to memory of 1232 2080 tnhnbb.exe 29 PID 2080 wrote to memory of 1232 2080 tnhnbb.exe 29 PID 1232 wrote to memory of 2900 1232 7ddvj.exe 30 PID 1232 wrote to memory of 2900 1232 7ddvj.exe 30 PID 1232 wrote to memory of 2900 1232 7ddvj.exe 30 PID 1232 wrote to memory of 2900 1232 7ddvj.exe 30 PID 2900 wrote to memory of 2124 2900 fxrxffr.exe 31 PID 2900 wrote to memory of 2124 2900 fxrxffr.exe 31 PID 2900 wrote to memory of 2124 2900 fxrxffr.exe 31 PID 2900 wrote to memory of 2124 2900 fxrxffr.exe 31 PID 2124 wrote to memory of 2820 2124 nbhhhh.exe 32 PID 2124 wrote to memory of 2820 2124 nbhhhh.exe 32 PID 2124 wrote to memory of 2820 2124 nbhhhh.exe 32 PID 2124 wrote to memory of 2820 2124 nbhhhh.exe 32 PID 2820 wrote to memory of 2168 2820 vpjpv.exe 33 PID 2820 wrote to memory of 2168 2820 vpjpv.exe 33 PID 2820 wrote to memory of 2168 2820 vpjpv.exe 33 PID 2820 wrote to memory of 2168 2820 vpjpv.exe 33 PID 2168 wrote to memory of 2640 2168 hbtntt.exe 34 PID 2168 wrote to memory of 2640 2168 hbtntt.exe 34 PID 2168 wrote to memory of 2640 2168 hbtntt.exe 34 PID 2168 wrote to memory of 2640 2168 hbtntt.exe 34 PID 2640 wrote to memory of 2696 2640 1jjdj.exe 35 PID 2640 wrote to memory of 2696 2640 1jjdj.exe 35 PID 2640 wrote to memory of 2696 2640 1jjdj.exe 35 PID 2640 wrote to memory of 2696 2640 1jjdj.exe 35 PID 2696 wrote to memory of 2772 2696 rlfxfll.exe 36 PID 2696 wrote to memory of 2772 2696 rlfxfll.exe 36 PID 2696 wrote to memory of 2772 2696 rlfxfll.exe 36 PID 2696 wrote to memory of 2772 2696 rlfxfll.exe 36 PID 2772 wrote to memory of 2520 2772 nhttbb.exe 37 PID 2772 wrote to memory of 2520 2772 nhttbb.exe 37 PID 2772 wrote to memory of 2520 2772 nhttbb.exe 37 PID 2772 wrote to memory of 2520 2772 nhttbb.exe 37 PID 2520 wrote to memory of 2432 2520 jvjpp.exe 38 PID 2520 wrote to memory of 2432 2520 jvjpp.exe 38 PID 2520 wrote to memory of 2432 2520 jvjpp.exe 38 PID 2520 wrote to memory of 2432 2520 jvjpp.exe 38 PID 2432 wrote to memory of 2544 2432 xrllrxx.exe 39 PID 2432 wrote to memory of 2544 2432 xrllrxx.exe 39 PID 2432 wrote to memory of 2544 2432 xrllrxx.exe 39 PID 2432 wrote to memory of 2544 2432 xrllrxx.exe 39 PID 2544 wrote to memory of 2000 2544 nbhhhb.exe 40 PID 2544 wrote to memory of 2000 2544 nbhhhb.exe 40 PID 2544 wrote to memory of 2000 2544 nbhhhb.exe 40 PID 2544 wrote to memory of 2000 2544 nbhhhb.exe 40 PID 2000 wrote to memory of 1824 2000 hbbnnt.exe 41 PID 2000 wrote to memory of 1824 2000 hbbnnt.exe 41 PID 2000 wrote to memory of 1824 2000 hbbnnt.exe 41 PID 2000 wrote to memory of 1824 2000 hbbnnt.exe 41 PID 1824 wrote to memory of 1804 1824 3rxxxfr.exe 42 PID 1824 wrote to memory of 1804 1824 3rxxxfr.exe 42 PID 1824 wrote to memory of 1804 1824 3rxxxfr.exe 42 PID 1824 wrote to memory of 1804 1824 3rxxxfr.exe 42 PID 1804 wrote to memory of 1740 1804 nhttbb.exe 43 PID 1804 wrote to memory of 1740 1804 nhttbb.exe 43 PID 1804 wrote to memory of 1740 1804 nhttbb.exe 43 PID 1804 wrote to memory of 1740 1804 nhttbb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\c48adbaf41588c967a227cb4527ac1ad3112f48bf525e76d5b314369fb8ed965.exe"C:\Users\Admin\AppData\Local\Temp\c48adbaf41588c967a227cb4527ac1ad3112f48bf525e76d5b314369fb8ed965.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\tnhnbb.exec:\tnhnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\7ddvj.exec:\7ddvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\fxrxffr.exec:\fxrxffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\nbhhhh.exec:\nbhhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\vpjpv.exec:\vpjpv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\hbtntt.exec:\hbtntt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\1jjdj.exec:\1jjdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\rlfxfll.exec:\rlfxfll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\nhttbb.exec:\nhttbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\jvjpp.exec:\jvjpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\xrllrxx.exec:\xrllrxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\nbhhhb.exec:\nbhhhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\hbbnnt.exec:\hbbnnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\3rxxxfr.exec:\3rxxxfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\nhttbb.exec:\nhttbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\pjddj.exec:\pjddj.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1740 -
\??\c:\7lrxlll.exec:\7lrxlll.exe18⤵
- Executes dropped EXE
PID:1440 -
\??\c:\nhbhnn.exec:\nhbhnn.exe19⤵
- Executes dropped EXE
PID:1792 -
\??\c:\jjvdp.exec:\jjvdp.exe20⤵
- Executes dropped EXE
PID:1256 -
\??\c:\lxrllfl.exec:\lxrllfl.exe21⤵
- Executes dropped EXE
PID:1296 -
\??\c:\hhtbhh.exec:\hhtbhh.exe22⤵
- Executes dropped EXE
PID:848 -
\??\c:\3jvjd.exec:\3jvjd.exe23⤵
- Executes dropped EXE
PID:1640 -
\??\c:\djjpv.exec:\djjpv.exe24⤵
- Executes dropped EXE
PID:908 -
\??\c:\xlfxxrx.exec:\xlfxxrx.exe25⤵
- Executes dropped EXE
PID:744 -
\??\c:\3bttbb.exec:\3bttbb.exe26⤵
- Executes dropped EXE
PID:604 -
\??\c:\7vppp.exec:\7vppp.exe27⤵
- Executes dropped EXE
PID:2352 -
\??\c:\nhnnnn.exec:\nhnnnn.exe28⤵
- Executes dropped EXE
PID:1076 -
\??\c:\pjvvj.exec:\pjvvj.exe29⤵
- Executes dropped EXE
PID:836 -
\??\c:\lxfflrx.exec:\lxfflrx.exe30⤵
- Executes dropped EXE
PID:912 -
\??\c:\5hbbbb.exec:\5hbbbb.exe31⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jdppp.exec:\jdppp.exe32⤵
- Executes dropped EXE
PID:3048 -
\??\c:\hnbnnh.exec:\hnbnnh.exe33⤵
- Executes dropped EXE
PID:2092 -
\??\c:\nhnnhh.exec:\nhnnhh.exe34⤵
- Executes dropped EXE
PID:2452 -
\??\c:\fxlxlfl.exec:\fxlxlfl.exe35⤵
- Executes dropped EXE
PID:2384 -
\??\c:\rfxrxxf.exec:\rfxrxxf.exe36⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nbtttt.exec:\nbtttt.exe37⤵
- Executes dropped EXE
PID:2896 -
\??\c:\jdvvj.exec:\jdvvj.exe38⤵
- Executes dropped EXE
PID:2128 -
\??\c:\7rfflrr.exec:\7rfflrr.exe39⤵
- Executes dropped EXE
PID:1228 -
\??\c:\ffxfflr.exec:\ffxfflr.exe40⤵
- Executes dropped EXE
PID:1328 -
\??\c:\5bhhhn.exec:\5bhhhn.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vpjdj.exec:\vpjdj.exe42⤵
- Executes dropped EXE
PID:1980 -
\??\c:\xxfxfrx.exec:\xxfxfrx.exe43⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nbtthb.exec:\nbtthb.exe44⤵
- Executes dropped EXE
PID:2916 -
\??\c:\nbnhhb.exec:\nbnhhb.exe45⤵
- Executes dropped EXE
PID:2644 -
\??\c:\pdjdv.exec:\pdjdv.exe46⤵
- Executes dropped EXE
PID:2748 -
\??\c:\7xlxrll.exec:\7xlxrll.exe47⤵
- Executes dropped EXE
PID:2628 -
\??\c:\tttthn.exec:\tttthn.exe48⤵
- Executes dropped EXE
PID:2516 -
\??\c:\vppvv.exec:\vppvv.exe49⤵
- Executes dropped EXE
PID:2540 -
\??\c:\frxxxxr.exec:\frxxxxr.exe50⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xlfffxx.exec:\xlfffxx.exe51⤵
- Executes dropped EXE
PID:2504 -
\??\c:\tthnnn.exec:\tthnnn.exe52⤵
- Executes dropped EXE
PID:856 -
\??\c:\3djjp.exec:\3djjp.exe53⤵
- Executes dropped EXE
PID:2488 -
\??\c:\fxrllll.exec:\fxrllll.exe54⤵
- Executes dropped EXE
PID:2300 -
\??\c:\rlflllr.exec:\rlflllr.exe55⤵
- Executes dropped EXE
PID:2296 -
\??\c:\bntnnn.exec:\bntnnn.exe56⤵
- Executes dropped EXE
PID:1680 -
\??\c:\jdpjj.exec:\jdpjj.exe57⤵
- Executes dropped EXE
PID:1548 -
\??\c:\9vjjd.exec:\9vjjd.exe58⤵
- Executes dropped EXE
PID:1992 -
\??\c:\5llxxrr.exec:\5llxxrr.exe59⤵
- Executes dropped EXE
PID:1196 -
\??\c:\3hnhnn.exec:\3hnhnn.exe60⤵
- Executes dropped EXE
PID:1296 -
\??\c:\3hbbbt.exec:\3hbbbt.exe61⤵
- Executes dropped EXE
PID:2256 -
\??\c:\jjvdd.exec:\jjvdd.exe62⤵
- Executes dropped EXE
PID:1900 -
\??\c:\xrfffxx.exec:\xrfffxx.exe63⤵
- Executes dropped EXE
PID:444 -
\??\c:\bnbhnn.exec:\bnbhnn.exe64⤵
- Executes dropped EXE
PID:680 -
\??\c:\dvpjv.exec:\dvpjv.exe65⤵
- Executes dropped EXE
PID:1144 -
\??\c:\9jdvd.exec:\9jdvd.exe66⤵PID:304
-
\??\c:\lfxxxff.exec:\lfxxxff.exe67⤵PID:1376
-
\??\c:\bhhbnn.exec:\bhhbnn.exe68⤵PID:1660
-
\??\c:\jvvpd.exec:\jvvpd.exe69⤵PID:876
-
\??\c:\9dvpp.exec:\9dvpp.exe70⤵PID:280
-
\??\c:\3xlfxxf.exec:\3xlfxxf.exe71⤵PID:3032
-
\??\c:\nhttbb.exec:\nhttbb.exe72⤵PID:2340
-
\??\c:\9bthbt.exec:\9bthbt.exe73⤵PID:2060
-
\??\c:\3vvpp.exec:\3vvpp.exe74⤵PID:1912
-
\??\c:\xrxrrlf.exec:\xrxrrlf.exe75⤵PID:2184
-
\??\c:\3nhbbb.exec:\3nhbbb.exe76⤵PID:888
-
\??\c:\hbnnnn.exec:\hbnnnn.exe77⤵PID:2332
-
\??\c:\vpvvd.exec:\vpvvd.exe78⤵PID:2100
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe79⤵PID:2876
-
\??\c:\1frlxxx.exec:\1frlxxx.exe80⤵PID:1952
-
\??\c:\5bnntt.exec:\5bnntt.exe81⤵PID:2128
-
\??\c:\pjpvd.exec:\pjpvd.exe82⤵PID:1756
-
\??\c:\9xllflr.exec:\9xllflr.exe83⤵PID:3036
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe84⤵PID:2600
-
\??\c:\1tbttt.exec:\1tbttt.exe85⤵PID:2712
-
\??\c:\tntntt.exec:\tntntt.exe86⤵PID:2844
-
\??\c:\vvpdj.exec:\vvpdj.exe87⤵PID:2624
-
\??\c:\lxxllxf.exec:\lxxllxf.exe88⤵PID:2916
-
\??\c:\9btnbb.exec:\9btnbb.exe89⤵PID:2796
-
\??\c:\nbhtbb.exec:\nbhtbb.exe90⤵PID:2660
-
\??\c:\9vjpv.exec:\9vjpv.exe91⤵PID:2628
-
\??\c:\fxlffxr.exec:\fxlffxr.exe92⤵PID:2612
-
\??\c:\5lxrxfl.exec:\5lxrxfl.exe93⤵PID:2924
-
\??\c:\jvddj.exec:\jvddj.exe94⤵PID:2544
-
\??\c:\1vdvv.exec:\1vdvv.exe95⤵PID:1816
-
\??\c:\3rxxfxf.exec:\3rxxfxf.exe96⤵PID:832
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe97⤵PID:296
-
\??\c:\hhtntt.exec:\hhtntt.exe98⤵PID:1716
-
\??\c:\5jvjp.exec:\5jvjp.exe99⤵PID:2292
-
\??\c:\vpjvp.exec:\vpjvp.exe100⤵PID:2420
-
\??\c:\rllrxxf.exec:\rllrxxf.exe101⤵PID:1792
-
\??\c:\tttbnt.exec:\tttbnt.exe102⤵PID:328
-
\??\c:\dvjjv.exec:\dvjjv.exe103⤵PID:372
-
\??\c:\dpdjp.exec:\dpdjp.exe104⤵PID:3016
-
\??\c:\frfllrx.exec:\frfllrx.exe105⤵PID:848
-
\??\c:\rfxrlfr.exec:\rfxrlfr.exe106⤵PID:2816
-
\??\c:\bbttbb.exec:\bbttbb.exe107⤵PID:480
-
\??\c:\vjddp.exec:\vjddp.exe108⤵PID:308
-
\??\c:\vpjvd.exec:\vpjvd.exe109⤵PID:1876
-
\??\c:\3lffllx.exec:\3lffllx.exe110⤵PID:1304
-
\??\c:\lfxxffr.exec:\lfxxffr.exe111⤵PID:1336
-
\??\c:\3hnnhn.exec:\3hnnhn.exe112⤵PID:1928
-
\??\c:\vvvvj.exec:\vvvvj.exe113⤵PID:1660
-
\??\c:\vpjpd.exec:\vpjpd.exe114⤵PID:872
-
\??\c:\rfxrxxl.exec:\rfxrxxl.exe115⤵PID:564
-
\??\c:\bthntn.exec:\bthntn.exe116⤵PID:1592
-
\??\c:\7btbbb.exec:\7btbbb.exe117⤵
- System Location Discovery: System Language Discovery
PID:684 -
\??\c:\pdppv.exec:\pdppv.exe118⤵PID:2188
-
\??\c:\rlxrffl.exec:\rlxrffl.exe119⤵PID:868
-
\??\c:\9flfffl.exec:\9flfffl.exe120⤵PID:2004
-
\??\c:\nbnhnb.exec:\nbnhnb.exe121⤵PID:2452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-