Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 10:06
Static task
static1
Behavioral task
behavioral1
Sample
1673809f57a324d864a1281330eca760c4b1a6d351de82acd31905ff8d803d38.exe
Resource
win7-20240903-en
General
-
Target
1673809f57a324d864a1281330eca760c4b1a6d351de82acd31905ff8d803d38.exe
-
Size
453KB
-
MD5
4266a5bf9a89d5a443e3fb62308f9867
-
SHA1
7ab3f62ce74a276c137b3ca9fda651f0ec9d75f5
-
SHA256
1673809f57a324d864a1281330eca760c4b1a6d351de82acd31905ff8d803d38
-
SHA512
78d5d3cdcf162cd618d9703165b28cc7355ff26e3876c9f92abb8ee96cd3b767080a1242314911f0f1deb5441fa8c6196c8b70f0ae7e6c2c4b5f29f6b4b6de93
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeD:q7Tc2NYHUrAwfMp3CDD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2160-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/692-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-300-0x0000000076FF0000-0x000000007710F000-memory.dmp family_blackmoon behavioral1/memory/2560-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-370-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3048-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-448-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/3064-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-477-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/604-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-632-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2836-658-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-697-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2732-761-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1336-798-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1536-819-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-826-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-926-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-1029-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/824-1056-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/824-1054-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3052-1084-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2332-1145-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1912 jpjjj.exe 2916 lrlxrfl.exe 2812 djppp.exe 2880 9vvdj.exe 2816 bhthtn.exe 2620 5vvdp.exe 2612 rllfrfr.exe 2644 1dvvj.exe 2412 xrflfrl.exe 1796 rrrrxrf.exe 2324 3fxfrlf.exe 2844 pdvvj.exe 948 3hbhtb.exe 1920 jvddd.exe 332 xxfrlxx.exe 2124 dvvvp.exe 1964 htnbhh.exe 2904 7vvjj.exe 3064 hbnnnn.exe 3020 pppdv.exe 692 bbhnth.exe 2508 xlllrxx.exe 848 7dvdd.exe 2284 bhhtth.exe 1764 xxrxflx.exe 3000 5nbhtb.exe 1264 lrrffff.exe 2112 nhbttb.exe 1984 nhttbt.exe 772 jjjvv.exe 1732 5hbbhh.exe 2832 3jpdv.exe 2004 thbhbb.exe 2700 ntbhtn.exe 2776 jdddd.exe 2560 bnnhht.exe 2716 pvjvj.exe 2908 xlrrrfr.exe 2720 djdjv.exe 2552 xlrrfxr.exe 2632 btnhtb.exe 3008 5ppdp.exe 2184 lfrfllr.exe 2196 nbbhbb.exe 836 pppdd.exe 2392 rlxflrf.exe 1616 7pvjv.exe 1276 lfxrlxf.exe 3048 tbbtnt.exe 2616 vjjdv.exe 2848 xrrxlxx.exe 2132 5nhhth.exe 536 pjvvd.exe 2208 xlfxlxx.exe 1908 nttnht.exe 436 vddjj.exe 3060 vvvjd.exe 2952 7xfrxfr.exe 3064 dvdpp.exe 2656 1lflrxf.exe 1404 rlrxllx.exe 1988 htbthb.exe 896 5lflxlf.exe 2492 bnbbhh.exe -
resource yara_rule behavioral1/memory/2160-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-65-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2612-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-87-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2412-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-448-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/3064-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-819-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-826-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-926-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-1054-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2680-1182-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2160 wrote to memory of 1912 2160 1673809f57a324d864a1281330eca760c4b1a6d351de82acd31905ff8d803d38.exe 30 PID 2160 wrote to memory of 1912 2160 1673809f57a324d864a1281330eca760c4b1a6d351de82acd31905ff8d803d38.exe 30 PID 2160 wrote to memory of 1912 2160 1673809f57a324d864a1281330eca760c4b1a6d351de82acd31905ff8d803d38.exe 30 PID 2160 wrote to memory of 1912 2160 1673809f57a324d864a1281330eca760c4b1a6d351de82acd31905ff8d803d38.exe 30 PID 1912 wrote to memory of 2916 1912 jpjjj.exe 31 PID 1912 wrote to memory of 2916 1912 jpjjj.exe 31 PID 1912 wrote to memory of 2916 1912 jpjjj.exe 31 PID 1912 wrote to memory of 2916 1912 jpjjj.exe 31 PID 2916 wrote to memory of 2812 2916 lrlxrfl.exe 32 PID 2916 wrote to memory of 2812 2916 lrlxrfl.exe 32 PID 2916 wrote to memory of 2812 2916 lrlxrfl.exe 32 PID 2916 wrote to memory of 2812 2916 lrlxrfl.exe 32 PID 2812 wrote to memory of 2880 2812 djppp.exe 33 PID 2812 wrote to memory of 2880 2812 djppp.exe 33 PID 2812 wrote to memory of 2880 2812 djppp.exe 33 PID 2812 wrote to memory of 2880 2812 djppp.exe 33 PID 2880 wrote to memory of 2816 2880 9vvdj.exe 34 PID 2880 wrote to memory of 2816 2880 9vvdj.exe 34 PID 2880 wrote to memory of 2816 2880 9vvdj.exe 34 PID 2880 wrote to memory of 2816 2880 9vvdj.exe 34 PID 2816 wrote to memory of 2620 2816 bhthtn.exe 35 PID 2816 wrote to memory of 2620 2816 bhthtn.exe 35 PID 2816 wrote to memory of 2620 2816 bhthtn.exe 35 PID 2816 wrote to memory of 2620 2816 bhthtn.exe 35 PID 2620 wrote to memory of 2612 2620 5vvdp.exe 36 PID 2620 wrote to memory of 2612 2620 5vvdp.exe 36 PID 2620 wrote to memory of 2612 2620 5vvdp.exe 36 PID 2620 wrote to memory of 2612 2620 5vvdp.exe 36 PID 2612 wrote to memory of 2644 2612 rllfrfr.exe 37 PID 2612 wrote to memory of 2644 2612 rllfrfr.exe 37 PID 2612 wrote to memory of 2644 2612 rllfrfr.exe 37 PID 2612 wrote to memory of 2644 2612 rllfrfr.exe 37 PID 2644 wrote to memory of 2412 2644 1dvvj.exe 38 PID 2644 wrote to memory of 2412 2644 1dvvj.exe 38 PID 2644 wrote to memory of 2412 2644 1dvvj.exe 38 PID 2644 wrote to memory of 2412 2644 1dvvj.exe 38 PID 2412 wrote to memory of 1796 2412 xrflfrl.exe 39 PID 2412 wrote to memory of 1796 2412 xrflfrl.exe 39 PID 2412 wrote to memory of 1796 2412 xrflfrl.exe 39 PID 2412 wrote to memory of 1796 2412 xrflfrl.exe 39 PID 1796 wrote to memory of 2324 1796 rrrrxrf.exe 40 PID 1796 wrote to memory of 2324 1796 rrrrxrf.exe 40 PID 1796 wrote to memory of 2324 1796 rrrrxrf.exe 40 PID 1796 wrote to memory of 2324 1796 rrrrxrf.exe 40 PID 2324 wrote to memory of 2844 2324 3fxfrlf.exe 41 PID 2324 wrote to memory of 2844 2324 3fxfrlf.exe 41 PID 2324 wrote to memory of 2844 2324 3fxfrlf.exe 41 PID 2324 wrote to memory of 2844 2324 3fxfrlf.exe 41 PID 2844 wrote to memory of 948 2844 pdvvj.exe 42 PID 2844 wrote to memory of 948 2844 pdvvj.exe 42 PID 2844 wrote to memory of 948 2844 pdvvj.exe 42 PID 2844 wrote to memory of 948 2844 pdvvj.exe 42 PID 948 wrote to memory of 1920 948 3hbhtb.exe 43 PID 948 wrote to memory of 1920 948 3hbhtb.exe 43 PID 948 wrote to memory of 1920 948 3hbhtb.exe 43 PID 948 wrote to memory of 1920 948 3hbhtb.exe 43 PID 1920 wrote to memory of 332 1920 jvddd.exe 44 PID 1920 wrote to memory of 332 1920 jvddd.exe 44 PID 1920 wrote to memory of 332 1920 jvddd.exe 44 PID 1920 wrote to memory of 332 1920 jvddd.exe 44 PID 332 wrote to memory of 2124 332 xxfrlxx.exe 45 PID 332 wrote to memory of 2124 332 xxfrlxx.exe 45 PID 332 wrote to memory of 2124 332 xxfrlxx.exe 45 PID 332 wrote to memory of 2124 332 xxfrlxx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1673809f57a324d864a1281330eca760c4b1a6d351de82acd31905ff8d803d38.exe"C:\Users\Admin\AppData\Local\Temp\1673809f57a324d864a1281330eca760c4b1a6d351de82acd31905ff8d803d38.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\jpjjj.exec:\jpjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\lrlxrfl.exec:\lrlxrfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\djppp.exec:\djppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\9vvdj.exec:\9vvdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\bhthtn.exec:\bhthtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\5vvdp.exec:\5vvdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\rllfrfr.exec:\rllfrfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\1dvvj.exec:\1dvvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\xrflfrl.exec:\xrflfrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\rrrrxrf.exec:\rrrrxrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\3fxfrlf.exec:\3fxfrlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\pdvvj.exec:\pdvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\3hbhtb.exec:\3hbhtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\jvddd.exec:\jvddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\xxfrlxx.exec:\xxfrlxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\dvvvp.exec:\dvvvp.exe17⤵
- Executes dropped EXE
PID:2124 -
\??\c:\htnbhh.exec:\htnbhh.exe18⤵
- Executes dropped EXE
PID:1964 -
\??\c:\7vvjj.exec:\7vvjj.exe19⤵
- Executes dropped EXE
PID:2904 -
\??\c:\hbnnnn.exec:\hbnnnn.exe20⤵
- Executes dropped EXE
PID:3064 -
\??\c:\pppdv.exec:\pppdv.exe21⤵
- Executes dropped EXE
PID:3020 -
\??\c:\bbhnth.exec:\bbhnth.exe22⤵
- Executes dropped EXE
PID:692 -
\??\c:\xlllrxx.exec:\xlllrxx.exe23⤵
- Executes dropped EXE
PID:2508 -
\??\c:\7dvdd.exec:\7dvdd.exe24⤵
- Executes dropped EXE
PID:848 -
\??\c:\bhhtth.exec:\bhhtth.exe25⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xxrxflx.exec:\xxrxflx.exe26⤵
- Executes dropped EXE
PID:1764 -
\??\c:\5nbhtb.exec:\5nbhtb.exe27⤵
- Executes dropped EXE
PID:3000 -
\??\c:\lrrffff.exec:\lrrffff.exe28⤵
- Executes dropped EXE
PID:1264 -
\??\c:\nhbttb.exec:\nhbttb.exe29⤵
- Executes dropped EXE
PID:2112 -
\??\c:\nhttbt.exec:\nhttbt.exe30⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jjjvv.exec:\jjjvv.exe31⤵
- Executes dropped EXE
PID:772 -
\??\c:\5hbbhh.exec:\5hbbhh.exe32⤵
- Executes dropped EXE
PID:1732 -
\??\c:\3jpdv.exec:\3jpdv.exe33⤵
- Executes dropped EXE
PID:2832 -
\??\c:\thbhbb.exec:\thbhbb.exe34⤵
- Executes dropped EXE
PID:2004 -
\??\c:\5dpvj.exec:\5dpvj.exe35⤵PID:2236
-
\??\c:\ntbhtn.exec:\ntbhtn.exe36⤵
- Executes dropped EXE
PID:2700 -
\??\c:\jdddd.exec:\jdddd.exe37⤵
- Executes dropped EXE
PID:2776 -
\??\c:\bnnhht.exec:\bnnhht.exe38⤵
- Executes dropped EXE
PID:2560 -
\??\c:\pvjvj.exec:\pvjvj.exe39⤵
- Executes dropped EXE
PID:2716 -
\??\c:\xlrrrfr.exec:\xlrrrfr.exe40⤵
- Executes dropped EXE
PID:2908 -
\??\c:\djdjv.exec:\djdjv.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2720 -
\??\c:\xlrrfxr.exec:\xlrrfxr.exe42⤵
- Executes dropped EXE
PID:2552 -
\??\c:\btnhtb.exec:\btnhtb.exe43⤵
- Executes dropped EXE
PID:2632 -
\??\c:\5ppdp.exec:\5ppdp.exe44⤵
- Executes dropped EXE
PID:3008 -
\??\c:\lfrfllr.exec:\lfrfllr.exe45⤵
- Executes dropped EXE
PID:2184 -
\??\c:\nbbhbb.exec:\nbbhbb.exe46⤵
- Executes dropped EXE
PID:2196 -
\??\c:\pppdd.exec:\pppdd.exe47⤵
- Executes dropped EXE
PID:836 -
\??\c:\rlxflrf.exec:\rlxflrf.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2392 -
\??\c:\7pvjv.exec:\7pvjv.exe49⤵
- Executes dropped EXE
PID:1616 -
\??\c:\lfxrlxf.exec:\lfxrlxf.exe50⤵
- Executes dropped EXE
PID:1276 -
\??\c:\tbbtnt.exec:\tbbtnt.exe51⤵
- Executes dropped EXE
PID:3048 -
\??\c:\vjjdv.exec:\vjjdv.exe52⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xrrxlxx.exec:\xrrxlxx.exe53⤵
- Executes dropped EXE
PID:2848 -
\??\c:\5nhhth.exec:\5nhhth.exe54⤵
- Executes dropped EXE
PID:2132 -
\??\c:\pjvvd.exec:\pjvvd.exe55⤵
- Executes dropped EXE
PID:536 -
\??\c:\xlfxlxx.exec:\xlfxlxx.exe56⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nttnht.exec:\nttnht.exe57⤵
- Executes dropped EXE
PID:1908 -
\??\c:\vddjj.exec:\vddjj.exe58⤵
- Executes dropped EXE
PID:436 -
\??\c:\vvvjd.exec:\vvvjd.exe59⤵
- Executes dropped EXE
PID:3060 -
\??\c:\7xfrxfr.exec:\7xfrxfr.exe60⤵
- Executes dropped EXE
PID:2952 -
\??\c:\dvdpp.exec:\dvdpp.exe61⤵
- Executes dropped EXE
PID:3064 -
\??\c:\1lflrxf.exec:\1lflrxf.exe62⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rlrxllx.exec:\rlrxllx.exe63⤵
- Executes dropped EXE
PID:1404 -
\??\c:\htbthb.exec:\htbthb.exe64⤵
- Executes dropped EXE
PID:1988 -
\??\c:\5lflxlf.exec:\5lflxlf.exe65⤵
- Executes dropped EXE
PID:896 -
\??\c:\bnbbhh.exec:\bnbbhh.exe66⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jjvpj.exec:\jjvpj.exe67⤵PID:1848
-
\??\c:\xfxllfl.exec:\xfxllfl.exe68⤵PID:2284
-
\??\c:\3hntth.exec:\3hntth.exe69⤵PID:1700
-
\??\c:\ddvjv.exec:\ddvjv.exe70⤵PID:604
-
\??\c:\llrlfrf.exec:\llrlfrf.exe71⤵PID:3068
-
\??\c:\nhhnhn.exec:\nhhnhn.exe72⤵PID:1872
-
\??\c:\jjvdd.exec:\jjvdd.exe73⤵PID:2504
-
\??\c:\frfffxf.exec:\frfffxf.exe74⤵PID:2360
-
\??\c:\tnnnnn.exec:\tnnnnn.exe75⤵PID:2228
-
\??\c:\jjjvv.exec:\jjjvv.exe76⤵PID:272
-
\??\c:\xrrxfrl.exec:\xrrxfrl.exe77⤵PID:876
-
\??\c:\vdvvp.exec:\vdvvp.exe78⤵PID:2664
-
\??\c:\rxlrxxl.exec:\rxlrxxl.exe79⤵PID:1576
-
\??\c:\3thbth.exec:\3thbth.exe80⤵PID:1912
-
\??\c:\dddpd.exec:\dddpd.exe81⤵PID:2684
-
\??\c:\lrrlrxl.exec:\lrrlrxl.exe82⤵PID:2820
-
\??\c:\hnnhht.exec:\hnnhht.exe83⤵
- System Location Discovery: System Language Discovery
PID:2588 -
\??\c:\pvvjj.exec:\pvvjj.exe84⤵PID:2808
-
\??\c:\rrrlxfx.exec:\rrrlxfx.exe85⤵PID:1056
-
\??\c:\nnhthn.exec:\nnhthn.exe86⤵PID:2816
-
\??\c:\pjjpv.exec:\pjjpv.exe87⤵PID:3012
-
\??\c:\frxrrrx.exec:\frxrrrx.exe88⤵PID:2620
-
\??\c:\lfrlffx.exec:\lfrlffx.exe89⤵PID:2836
-
\??\c:\hnnbnt.exec:\hnnbnt.exe90⤵PID:1484
-
\??\c:\pjvpv.exec:\pjvpv.exe91⤵PID:2204
-
\??\c:\fllrlxl.exec:\fllrlxl.exe92⤵PID:2984
-
\??\c:\tnbhth.exec:\tnbhth.exe93⤵PID:1260
-
\??\c:\jvdpj.exec:\jvdpj.exe94⤵PID:1796
-
\??\c:\hhnbtn.exec:\hhnbtn.exe95⤵PID:2324
-
\??\c:\jdjpv.exec:\jdjpv.exe96⤵PID:2272
-
\??\c:\7dppp.exec:\7dppp.exe97⤵PID:2844
-
\??\c:\bbtbnb.exec:\bbtbnb.exe98⤵PID:2020
-
\??\c:\tbbnhb.exec:\tbbnhb.exe99⤵PID:1904
-
\??\c:\9xrxrxr.exec:\9xrxrxr.exe100⤵PID:2044
-
\??\c:\nhhtbh.exec:\nhhtbh.exe101⤵PID:1944
-
\??\c:\bbhbth.exec:\bbhbth.exe102⤵
- System Location Discovery: System Language Discovery
PID:1668 -
\??\c:\pdpjj.exec:\pdpjj.exe103⤵PID:436
-
\??\c:\7fxxlxl.exec:\7fxxlxl.exe104⤵PID:1488
-
\??\c:\ntbnbn.exec:\ntbnbn.exe105⤵PID:2732
-
\??\c:\5pjvd.exec:\5pjvd.exe106⤵PID:1972
-
\??\c:\ffflxfx.exec:\ffflxfx.exe107⤵PID:1600
-
\??\c:\bbbnhb.exec:\bbbnhb.exe108⤵PID:2436
-
\??\c:\ppdpp.exec:\ppdpp.exe109⤵PID:2508
-
\??\c:\xfrxxff.exec:\xfrxxff.exe110⤵PID:2940
-
\??\c:\hbnhtn.exec:\hbnhtn.exe111⤵PID:1336
-
\??\c:\1dvvj.exec:\1dvvj.exe112⤵PID:1092
-
\??\c:\xfllrfl.exec:\xfllrfl.exe113⤵PID:1968
-
\??\c:\flxxlxl.exec:\flxxlxl.exe114⤵PID:1536
-
\??\c:\nnhthh.exec:\nnhthh.exe115⤵PID:2408
-
\??\c:\jpvjv.exec:\jpvjv.exe116⤵PID:2232
-
\??\c:\lfxrflr.exec:\lfxrflr.exe117⤵PID:2636
-
\??\c:\llxfllx.exec:\llxfllx.exe118⤵PID:1984
-
\??\c:\7hbbhn.exec:\7hbbhn.exe119⤵PID:2640
-
\??\c:\1pdjp.exec:\1pdjp.exe120⤵PID:2068
-
\??\c:\5xxlxlr.exec:\5xxlxlr.exe121⤵PID:2900
-
\??\c:\3bbhtb.exec:\3bbhtb.exe122⤵PID:1556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-