Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 09:36
Static task
static1
Behavioral task
behavioral1
Sample
0f4f0e105344c7d24319964e14463bf8fd89c63716e87ac4dd3b77a24a304e34N.exe
Resource
win7-20240903-en
General
-
Target
0f4f0e105344c7d24319964e14463bf8fd89c63716e87ac4dd3b77a24a304e34N.exe
-
Size
454KB
-
MD5
7e7a0ce49f0ebe34135869685452ac80
-
SHA1
56c44d6a9b5a0f81765d7b126d27039e935b8b05
-
SHA256
0f4f0e105344c7d24319964e14463bf8fd89c63716e87ac4dd3b77a24a304e34
-
SHA512
7e2c43e91f862be6d8bca504d59590c180599524baf13daf835acbad4e2d1af35f5893cfd980a320e91c2257ecd2124acd2f72d626dfe05a0ac4f02e745fe872
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1i:q7Tc2NYHUrAwfMp3CD1i
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2204-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1360-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-180-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2196-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-337-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2224-389-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2224-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/780-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1340-586-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/564-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-803-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1692-830-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2112-872-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-989-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2192 tthhhh.exe 2368 frffllx.exe 1360 xrxxlfx.exe 2268 ppvpv.exe 2700 lrrlllf.exe 3012 lrfrlfl.exe 2712 1hhhbn.exe 2936 ddpdd.exe 2644 lxlfrrf.exe 2660 nthbnn.exe 2320 pvppp.exe 536 xxxxrfr.exe 604 nbhhnn.exe 2932 3jjdp.exe 532 fxlxlrr.exe 1484 jvdvv.exe 1640 pvjvp.exe 1164 9rlllll.exe 2196 nhthhh.exe 2536 vpppj.exe 764 frxrllf.exe 1240 5hnntn.exe 1824 7lxrrrf.exe 2556 7hnhhb.exe 336 ppdvd.exe 2240 xrxxxrr.exe 2992 vdddp.exe 2228 7fflrxr.exe 992 hbthtb.exe 2436 xfrrrlx.exe 2312 5tttth.exe 2236 3nnnnn.exe 1608 jpppd.exe 2288 jpvpp.exe 2368 rflflff.exe 2688 7tnhbb.exe 2800 bnbtbt.exe 2740 pjppp.exe 2744 frfxfrx.exe 3012 5bnbhb.exe 2756 tbtthh.exe 2124 1pddd.exe 2936 rfrrrrx.exe 2644 5lrrlfl.exe 2224 3tnbbt.exe 2960 djdvj.exe 2160 dpdvv.exe 2696 9llllff.exe 3068 tnbhbt.exe 2664 1nhhbt.exe 264 pdppp.exe 2848 vjjpp.exe 1904 xlflllr.exe 1592 nbntbh.exe 2116 nbhbbb.exe 780 9pjvv.exe 2316 lxrrllr.exe 1500 rrfxffl.exe 1864 1bnttb.exe 2108 pjpjp.exe 2444 jvdvp.exe 840 rfrrrll.exe 2024 rffxlll.exe 1620 htttnh.exe -
resource yara_rule behavioral1/memory/2204-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1164-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/780-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/792-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-784-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-852-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-885-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-1008-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxfrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2204 wrote to memory of 2192 2204 0f4f0e105344c7d24319964e14463bf8fd89c63716e87ac4dd3b77a24a304e34N.exe 30 PID 2204 wrote to memory of 2192 2204 0f4f0e105344c7d24319964e14463bf8fd89c63716e87ac4dd3b77a24a304e34N.exe 30 PID 2204 wrote to memory of 2192 2204 0f4f0e105344c7d24319964e14463bf8fd89c63716e87ac4dd3b77a24a304e34N.exe 30 PID 2204 wrote to memory of 2192 2204 0f4f0e105344c7d24319964e14463bf8fd89c63716e87ac4dd3b77a24a304e34N.exe 30 PID 2192 wrote to memory of 2368 2192 tthhhh.exe 31 PID 2192 wrote to memory of 2368 2192 tthhhh.exe 31 PID 2192 wrote to memory of 2368 2192 tthhhh.exe 31 PID 2192 wrote to memory of 2368 2192 tthhhh.exe 31 PID 2368 wrote to memory of 1360 2368 frffllx.exe 32 PID 2368 wrote to memory of 1360 2368 frffllx.exe 32 PID 2368 wrote to memory of 1360 2368 frffllx.exe 32 PID 2368 wrote to memory of 1360 2368 frffllx.exe 32 PID 1360 wrote to memory of 2268 1360 xrxxlfx.exe 33 PID 1360 wrote to memory of 2268 1360 xrxxlfx.exe 33 PID 1360 wrote to memory of 2268 1360 xrxxlfx.exe 33 PID 1360 wrote to memory of 2268 1360 xrxxlfx.exe 33 PID 2268 wrote to memory of 2700 2268 ppvpv.exe 34 PID 2268 wrote to memory of 2700 2268 ppvpv.exe 34 PID 2268 wrote to memory of 2700 2268 ppvpv.exe 34 PID 2268 wrote to memory of 2700 2268 ppvpv.exe 34 PID 2700 wrote to memory of 3012 2700 lrrlllf.exe 35 PID 2700 wrote to memory of 3012 2700 lrrlllf.exe 35 PID 2700 wrote to memory of 3012 2700 lrrlllf.exe 35 PID 2700 wrote to memory of 3012 2700 lrrlllf.exe 35 PID 3012 wrote to memory of 2712 3012 lrfrlfl.exe 36 PID 3012 wrote to memory of 2712 3012 lrfrlfl.exe 36 PID 3012 wrote to memory of 2712 3012 lrfrlfl.exe 36 PID 3012 wrote to memory of 2712 3012 lrfrlfl.exe 36 PID 2712 wrote to memory of 2936 2712 1hhhbn.exe 37 PID 2712 wrote to memory of 2936 2712 1hhhbn.exe 37 PID 2712 wrote to memory of 2936 2712 1hhhbn.exe 37 PID 2712 wrote to memory of 2936 2712 1hhhbn.exe 37 PID 2936 wrote to memory of 2644 2936 ddpdd.exe 38 PID 2936 wrote to memory of 2644 2936 ddpdd.exe 38 PID 2936 wrote to memory of 2644 2936 ddpdd.exe 38 PID 2936 wrote to memory of 2644 2936 ddpdd.exe 38 PID 2644 wrote to memory of 2660 2644 lxlfrrf.exe 39 PID 2644 wrote to memory of 2660 2644 lxlfrrf.exe 39 PID 2644 wrote to memory of 2660 2644 lxlfrrf.exe 39 PID 2644 wrote to memory of 2660 2644 lxlfrrf.exe 39 PID 2660 wrote to memory of 2320 2660 nthbnn.exe 40 PID 2660 wrote to memory of 2320 2660 nthbnn.exe 40 PID 2660 wrote to memory of 2320 2660 nthbnn.exe 40 PID 2660 wrote to memory of 2320 2660 nthbnn.exe 40 PID 2320 wrote to memory of 536 2320 pvppp.exe 41 PID 2320 wrote to memory of 536 2320 pvppp.exe 41 PID 2320 wrote to memory of 536 2320 pvppp.exe 41 PID 2320 wrote to memory of 536 2320 pvppp.exe 41 PID 536 wrote to memory of 604 536 xxxxrfr.exe 42 PID 536 wrote to memory of 604 536 xxxxrfr.exe 42 PID 536 wrote to memory of 604 536 xxxxrfr.exe 42 PID 536 wrote to memory of 604 536 xxxxrfr.exe 42 PID 604 wrote to memory of 2932 604 nbhhnn.exe 43 PID 604 wrote to memory of 2932 604 nbhhnn.exe 43 PID 604 wrote to memory of 2932 604 nbhhnn.exe 43 PID 604 wrote to memory of 2932 604 nbhhnn.exe 43 PID 2932 wrote to memory of 532 2932 3jjdp.exe 44 PID 2932 wrote to memory of 532 2932 3jjdp.exe 44 PID 2932 wrote to memory of 532 2932 3jjdp.exe 44 PID 2932 wrote to memory of 532 2932 3jjdp.exe 44 PID 532 wrote to memory of 1484 532 fxlxlrr.exe 45 PID 532 wrote to memory of 1484 532 fxlxlrr.exe 45 PID 532 wrote to memory of 1484 532 fxlxlrr.exe 45 PID 532 wrote to memory of 1484 532 fxlxlrr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f4f0e105344c7d24319964e14463bf8fd89c63716e87ac4dd3b77a24a304e34N.exe"C:\Users\Admin\AppData\Local\Temp\0f4f0e105344c7d24319964e14463bf8fd89c63716e87ac4dd3b77a24a304e34N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\tthhhh.exec:\tthhhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\frffllx.exec:\frffllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\xrxxlfx.exec:\xrxxlfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\ppvpv.exec:\ppvpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\lrrlllf.exec:\lrrlllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\lrfrlfl.exec:\lrfrlfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\1hhhbn.exec:\1hhhbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\ddpdd.exec:\ddpdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\lxlfrrf.exec:\lxlfrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\nthbnn.exec:\nthbnn.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\pvppp.exec:\pvppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\xxxxrfr.exec:\xxxxrfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\nbhhnn.exec:\nbhhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\3jjdp.exec:\3jjdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\fxlxlrr.exec:\fxlxlrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\jvdvv.exec:\jvdvv.exe17⤵
- Executes dropped EXE
PID:1484 -
\??\c:\pvjvp.exec:\pvjvp.exe18⤵
- Executes dropped EXE
PID:1640 -
\??\c:\9rlllll.exec:\9rlllll.exe19⤵
- Executes dropped EXE
PID:1164 -
\??\c:\nhthhh.exec:\nhthhh.exe20⤵
- Executes dropped EXE
PID:2196 -
\??\c:\vpppj.exec:\vpppj.exe21⤵
- Executes dropped EXE
PID:2536 -
\??\c:\frxrllf.exec:\frxrllf.exe22⤵
- Executes dropped EXE
PID:764 -
\??\c:\5hnntn.exec:\5hnntn.exe23⤵
- Executes dropped EXE
PID:1240 -
\??\c:\7lxrrrf.exec:\7lxrrrf.exe24⤵
- Executes dropped EXE
PID:1824 -
\??\c:\7hnhhb.exec:\7hnhhb.exe25⤵
- Executes dropped EXE
PID:2556 -
\??\c:\ppdvd.exec:\ppdvd.exe26⤵
- Executes dropped EXE
PID:336 -
\??\c:\xrxxxrr.exec:\xrxxxrr.exe27⤵
- Executes dropped EXE
PID:2240 -
\??\c:\vdddp.exec:\vdddp.exe28⤵
- Executes dropped EXE
PID:2992 -
\??\c:\7fflrxr.exec:\7fflrxr.exe29⤵
- Executes dropped EXE
PID:2228 -
\??\c:\hbthtb.exec:\hbthtb.exe30⤵
- Executes dropped EXE
PID:992 -
\??\c:\xfrrrlx.exec:\xfrrrlx.exe31⤵
- Executes dropped EXE
PID:2436 -
\??\c:\5tttth.exec:\5tttth.exe32⤵
- Executes dropped EXE
PID:2312 -
\??\c:\3nnnnn.exec:\3nnnnn.exe33⤵
- Executes dropped EXE
PID:2236 -
\??\c:\jpppd.exec:\jpppd.exe34⤵
- Executes dropped EXE
PID:1608 -
\??\c:\jpvpp.exec:\jpvpp.exe35⤵
- Executes dropped EXE
PID:2288 -
\??\c:\rflflff.exec:\rflflff.exe36⤵
- Executes dropped EXE
PID:2368 -
\??\c:\7tnhbb.exec:\7tnhbb.exe37⤵
- Executes dropped EXE
PID:2688 -
\??\c:\bnbtbt.exec:\bnbtbt.exe38⤵
- Executes dropped EXE
PID:2800 -
\??\c:\pjppp.exec:\pjppp.exe39⤵
- Executes dropped EXE
PID:2740 -
\??\c:\frfxfrx.exec:\frfxfrx.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\5bnbhb.exec:\5bnbhb.exe41⤵
- Executes dropped EXE
PID:3012 -
\??\c:\tbtthh.exec:\tbtthh.exe42⤵
- Executes dropped EXE
PID:2756 -
\??\c:\1pddd.exec:\1pddd.exe43⤵
- Executes dropped EXE
PID:2124 -
\??\c:\rfrrrrx.exec:\rfrrrrx.exe44⤵
- Executes dropped EXE
PID:2936 -
\??\c:\5lrrlfl.exec:\5lrrlfl.exe45⤵
- Executes dropped EXE
PID:2644 -
\??\c:\3tnbbt.exec:\3tnbbt.exe46⤵
- Executes dropped EXE
PID:2224 -
\??\c:\djdvj.exec:\djdvj.exe47⤵
- Executes dropped EXE
PID:2960 -
\??\c:\dpdvv.exec:\dpdvv.exe48⤵
- Executes dropped EXE
PID:2160 -
\??\c:\9llllff.exec:\9llllff.exe49⤵
- Executes dropped EXE
PID:2696 -
\??\c:\tnbhbt.exec:\tnbhbt.exe50⤵
- Executes dropped EXE
PID:3068 -
\??\c:\1nhhbt.exec:\1nhhbt.exe51⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pdppp.exec:\pdppp.exe52⤵
- Executes dropped EXE
PID:264 -
\??\c:\vjjpp.exec:\vjjpp.exe53⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xlflllr.exec:\xlflllr.exe54⤵
- Executes dropped EXE
PID:1904 -
\??\c:\nbntbh.exec:\nbntbh.exe55⤵
- Executes dropped EXE
PID:1592 -
\??\c:\nbhbbb.exec:\nbhbbb.exe56⤵
- Executes dropped EXE
PID:2116 -
\??\c:\9pjvv.exec:\9pjvv.exe57⤵
- Executes dropped EXE
PID:780 -
\??\c:\lxrrllr.exec:\lxrrllr.exe58⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rrfxffl.exec:\rrfxffl.exe59⤵
- Executes dropped EXE
PID:1500 -
\??\c:\1bnttb.exec:\1bnttb.exe60⤵
- Executes dropped EXE
PID:1864 -
\??\c:\pjpjp.exec:\pjpjp.exe61⤵
- Executes dropped EXE
PID:2108 -
\??\c:\jvdvp.exec:\jvdvp.exe62⤵
- Executes dropped EXE
PID:2444 -
\??\c:\rfrrrll.exec:\rfrrrll.exe63⤵
- Executes dropped EXE
PID:840 -
\??\c:\rffxlll.exec:\rffxlll.exe64⤵
- Executes dropped EXE
PID:2024 -
\??\c:\htttnh.exec:\htttnh.exe65⤵
- Executes dropped EXE
PID:1620 -
\??\c:\3vpdj.exec:\3vpdj.exe66⤵PID:336
-
\??\c:\lxfffxf.exec:\lxfffxf.exe67⤵
- System Location Discovery: System Language Discovery
PID:956 -
\??\c:\flxxfff.exec:\flxxfff.exe68⤵PID:2508
-
\??\c:\bntbhb.exec:\bntbhb.exe69⤵PID:1648
-
\??\c:\vdjpp.exec:\vdjpp.exe70⤵PID:2044
-
\??\c:\xllflxx.exec:\xllflxx.exe71⤵PID:1696
-
\??\c:\1flfxrx.exec:\1flfxrx.exe72⤵PID:2436
-
\??\c:\hbnnhh.exec:\hbnnhh.exe73⤵PID:2068
-
\??\c:\5nhhbh.exec:\5nhhbh.exe74⤵PID:2076
-
\??\c:\pdjjj.exec:\pdjjj.exe75⤵PID:1340
-
\??\c:\lxllffr.exec:\lxllffr.exe76⤵PID:2388
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe77⤵PID:2516
-
\??\c:\nbbnhh.exec:\nbbnhh.exe78⤵PID:2216
-
\??\c:\7nbhnn.exec:\7nbhnn.exe79⤵PID:2688
-
\??\c:\5pdvv.exec:\5pdvv.exe80⤵PID:2292
-
\??\c:\xlrrxrx.exec:\xlrrxrx.exe81⤵PID:3000
-
\??\c:\lfxxfxf.exec:\lfxxfxf.exe82⤵PID:2844
-
\??\c:\5ttnhh.exec:\5ttnhh.exe83⤵
- System Location Discovery: System Language Discovery
PID:2828 -
\??\c:\5jvvj.exec:\5jvvj.exe84⤵PID:2732
-
\??\c:\pdvvp.exec:\pdvvp.exe85⤵PID:2796
-
\??\c:\xlxxlrr.exec:\xlxxlrr.exe86⤵PID:2648
-
\??\c:\5thnbt.exec:\5thnbt.exe87⤵PID:2824
-
\??\c:\hnnhnn.exec:\hnnhnn.exe88⤵PID:792
-
\??\c:\3pvpp.exec:\3pvpp.exe89⤵PID:2612
-
\??\c:\frxfffr.exec:\frxfffr.exe90⤵PID:2960
-
\??\c:\xlxxllr.exec:\xlxxllr.exe91⤵PID:1916
-
\??\c:\tttthb.exec:\tttthb.exe92⤵PID:1624
-
\??\c:\1nhhnh.exec:\1nhhnh.exe93⤵PID:1636
-
\??\c:\1jpjj.exec:\1jpjj.exe94⤵PID:564
-
\??\c:\lrrffrx.exec:\lrrffrx.exe95⤵PID:1552
-
\??\c:\lxlxlff.exec:\lxlxlff.exe96⤵PID:1680
-
\??\c:\7tbtnn.exec:\7tbtnn.exe97⤵PID:1712
-
\??\c:\pdppp.exec:\pdppp.exe98⤵PID:896
-
\??\c:\jvdvv.exec:\jvdvv.exe99⤵PID:1660
-
\??\c:\lrxflfl.exec:\lrxflfl.exe100⤵PID:1796
-
\??\c:\3lrlrrf.exec:\3lrlrrf.exe101⤵PID:2308
-
\??\c:\bnttbb.exec:\bnttbb.exe102⤵PID:1644
-
\??\c:\5vvpp.exec:\5vvpp.exe103⤵PID:2220
-
\??\c:\xlxxxll.exec:\xlxxxll.exe104⤵PID:652
-
\??\c:\rflffff.exec:\rflffff.exe105⤵PID:2576
-
\??\c:\nbnnnb.exec:\nbnnnb.exe106⤵PID:3024
-
\??\c:\bhtbbb.exec:\bhtbbb.exe107⤵PID:1316
-
\??\c:\pdjjj.exec:\pdjjj.exe108⤵PID:1544
-
\??\c:\lxlrrrx.exec:\lxlrrrx.exe109⤵PID:1692
-
\??\c:\fxlflfl.exec:\fxlflfl.exe110⤵PID:336
-
\??\c:\nhnnbt.exec:\nhnnbt.exe111⤵PID:2572
-
\??\c:\jvjjj.exec:\jvjjj.exe112⤵PID:2228
-
\??\c:\frfxxxx.exec:\frfxxxx.exe113⤵PID:704
-
\??\c:\5lxxxff.exec:\5lxxxff.exe114⤵PID:2420
-
\??\c:\hntnbt.exec:\hntnbt.exe115⤵PID:544
-
\??\c:\nhtbbb.exec:\nhtbbb.exe116⤵PID:1728
-
\??\c:\dpjpv.exec:\dpjpv.exe117⤵PID:1612
-
\??\c:\1frxxxf.exec:\1frxxxf.exe118⤵PID:2236
-
\??\c:\xlxxxff.exec:\xlxxxff.exe119⤵PID:2100
-
\??\c:\hbbhbb.exec:\hbbhbb.exe120⤵PID:2112
-
\??\c:\jjpdd.exec:\jjpdd.exe121⤵PID:2368
-
\??\c:\3lxxllr.exec:\3lxxllr.exe122⤵PID:2352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-