Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 09:43
Behavioral task
behavioral1
Sample
982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe
-
Size
344KB
-
MD5
620c97e244bcfb3d324dfa549280b4c8
-
SHA1
5ce5411c88c5099db7985828a284038d3f76528b
-
SHA256
982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc
-
SHA512
2fa57f9f95e77bfc1658d7ac946cc7389c1eb8729e1ece6b22d64e90b7cc4c6e09bf000f719ac743e95ae193692db918ef331d8b64fdd975c8c6bdcd168aa889
-
SSDEEP
6144:Lcm4FmowdHoSEYW5fNZWB5hFfci3Add4kGYA2:R4wFHoS3WXZshJX2VGd2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/1456-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2832-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-74-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2732-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/924-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1872-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/748-168-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1852-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1212-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/684-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2500-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2828-321-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2952-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-352-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/896-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1360-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1648-441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/448-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1412-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-502-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1860-508-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2408-511-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1592-573-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2940-834-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2928-867-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2052-6714-0x00000000773C0000-0x00000000774BA000-memory.dmp family_blackmoon behavioral1/memory/2052-13780-0x00000000774C0000-0x00000000775DF000-memory.dmp family_blackmoon behavioral1/memory/2052-18876-0x00000000774C0000-0x00000000775DF000-memory.dmp family_blackmoon behavioral1/memory/2052-19444-0x00000000773C0000-0x00000000774BA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2500 nttntt.exe 2804 jjvvj.exe 2728 lrrlllf.exe 2832 nhbhtb.exe 2856 7nbhnh.exe 2928 5tnbnb.exe 2968 rrxxllr.exe 2732 dvvpp.exe 2676 7flrfxx.exe 2204 nhntbb.exe 2892 7ffflrf.exe 2200 tnbnbt.exe 2560 dddjv.exe 2584 ppvpp.exe 2992 3httbh.exe 924 vvjpv.exe 1872 xxfflxl.exe 2904 bthhhn.exe 3004 pjpjp.exe 748 5nnnnt.exe 448 pppvp.exe 1852 lrrxfrf.exe 2600 hbnnbb.exe 2272 vvdpd.exe 1212 1rrflrf.exe 1792 nnnntt.exe 944 vdppv.exe 1676 btbhnt.exe 1964 fxrxxlf.exe 1700 tthbth.exe 2260 lrfrlfr.exe 992 xrfxxxl.exe 1848 jpjdd.exe 1076 jjpvd.exe 3056 rxfxffl.exe 684 nnhtbt.exe 1660 djpvv.exe 2500 ppdpv.exe 1644 rrlxlxl.exe 2248 bhhhnh.exe 1600 djvvj.exe 2912 3pjpj.exe 2828 flrxlrx.exe 2832 nntnbb.exe 2936 1jvdj.exe 2952 3frxllr.exe 1732 rlxxflx.exe 2620 9bbhhh.exe 2920 9jdjj.exe 2684 3xflrxx.exe 668 xfrrxxf.exe 896 7hhbbb.exe 2240 jjvdj.exe 2184 7frxflr.exe 2144 1xlxlxl.exe 2532 hbnbhn.exe 1632 jjppv.exe 1944 fxfflrf.exe 1408 3frrxlf.exe 1956 tthntn.exe 2852 vdppj.exe 572 7ffrlrl.exe 1360 ffflrxf.exe 1648 thnnnt.exe -
resource yara_rule behavioral1/memory/1456-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1456-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120fd-7.dat upx behavioral1/memory/1456-6-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000700000001933b-17.dat upx behavioral1/memory/2500-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2804-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001939b-25.dat upx behavioral1/memory/2728-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000193b3-31.dat upx behavioral1/files/0x00060000000193e8-42.dat upx behavioral1/memory/2832-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2856-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000193f7-48.dat upx behavioral1/files/0x000600000001949e-57.dat upx behavioral1/memory/2968-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2928-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000194c4-67.dat upx behavioral1/memory/2968-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000194cd-75.dat upx behavioral1/memory/2732-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a09e-83.dat upx behavioral1/files/0x000500000001a307-91.dat upx behavioral1/files/0x000500000001a359-98.dat upx behavioral1/files/0x000500000001a41b-105.dat upx behavioral1/memory/2200-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2560-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a41d-114.dat upx behavioral1/files/0x000500000001a41e-121.dat upx behavioral1/memory/2584-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a427-129.dat upx behavioral1/files/0x000500000001a42d-137.dat upx behavioral1/memory/924-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1872-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a46f-145.dat upx behavioral1/files/0x003000000001926b-154.dat upx behavioral1/files/0x000500000001a48b-161.dat upx behavioral1/files/0x000500000001a48d-169.dat upx behavioral1/files/0x000500000001a499-176.dat upx behavioral1/files/0x000500000001a49a-183.dat upx behavioral1/memory/1852-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4a9-192.dat upx behavioral1/memory/2600-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4af-200.dat upx behavioral1/memory/1212-203-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2272-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b1-209.dat upx behavioral1/memory/1792-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b3-217.dat upx behavioral1/files/0x000500000001a4b5-224.dat upx behavioral1/memory/1676-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b7-232.dat upx behavioral1/files/0x000500000001a4b9-239.dat upx behavioral1/files/0x000500000001a4bb-246.dat upx behavioral1/files/0x000500000001a4bd-253.dat upx behavioral1/memory/1076-270-0x00000000002A0000-0x00000000002C7000-memory.dmp upx behavioral1/memory/3056-273-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/684-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2500-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2828-322-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2828-320-0x00000000002B0000-0x00000000002D7000-memory.dmp upx behavioral1/memory/2952-340-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1732-346-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2620-353-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1456 wrote to memory of 2500 1456 982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe 29 PID 1456 wrote to memory of 2500 1456 982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe 29 PID 1456 wrote to memory of 2500 1456 982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe 29 PID 1456 wrote to memory of 2500 1456 982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe 29 PID 2500 wrote to memory of 2804 2500 nttntt.exe 30 PID 2500 wrote to memory of 2804 2500 nttntt.exe 30 PID 2500 wrote to memory of 2804 2500 nttntt.exe 30 PID 2500 wrote to memory of 2804 2500 nttntt.exe 30 PID 2804 wrote to memory of 2728 2804 jjvvj.exe 31 PID 2804 wrote to memory of 2728 2804 jjvvj.exe 31 PID 2804 wrote to memory of 2728 2804 jjvvj.exe 31 PID 2804 wrote to memory of 2728 2804 jjvvj.exe 31 PID 2728 wrote to memory of 2832 2728 lrrlllf.exe 32 PID 2728 wrote to memory of 2832 2728 lrrlllf.exe 32 PID 2728 wrote to memory of 2832 2728 lrrlllf.exe 32 PID 2728 wrote to memory of 2832 2728 lrrlllf.exe 32 PID 2832 wrote to memory of 2856 2832 nhbhtb.exe 33 PID 2832 wrote to memory of 2856 2832 nhbhtb.exe 33 PID 2832 wrote to memory of 2856 2832 nhbhtb.exe 33 PID 2832 wrote to memory of 2856 2832 nhbhtb.exe 33 PID 2856 wrote to memory of 2928 2856 7nbhnh.exe 34 PID 2856 wrote to memory of 2928 2856 7nbhnh.exe 34 PID 2856 wrote to memory of 2928 2856 7nbhnh.exe 34 PID 2856 wrote to memory of 2928 2856 7nbhnh.exe 34 PID 2928 wrote to memory of 2968 2928 5tnbnb.exe 35 PID 2928 wrote to memory of 2968 2928 5tnbnb.exe 35 PID 2928 wrote to memory of 2968 2928 5tnbnb.exe 35 PID 2928 wrote to memory of 2968 2928 5tnbnb.exe 35 PID 2968 wrote to memory of 2732 2968 rrxxllr.exe 36 PID 2968 wrote to memory of 2732 2968 rrxxllr.exe 36 PID 2968 wrote to memory of 2732 2968 rrxxllr.exe 36 PID 2968 wrote to memory of 2732 2968 rrxxllr.exe 36 PID 2732 wrote to memory of 2676 2732 dvvpp.exe 37 PID 2732 wrote to memory of 2676 2732 dvvpp.exe 37 PID 2732 wrote to memory of 2676 2732 dvvpp.exe 37 PID 2732 wrote to memory of 2676 2732 dvvpp.exe 37 PID 2676 wrote to memory of 2204 2676 7flrfxx.exe 38 PID 2676 wrote to memory of 2204 2676 7flrfxx.exe 38 PID 2676 wrote to memory of 2204 2676 7flrfxx.exe 38 PID 2676 wrote to memory of 2204 2676 7flrfxx.exe 38 PID 2204 wrote to memory of 2892 2204 nhntbb.exe 39 PID 2204 wrote to memory of 2892 2204 nhntbb.exe 39 PID 2204 wrote to memory of 2892 2204 nhntbb.exe 39 PID 2204 wrote to memory of 2892 2204 nhntbb.exe 39 PID 2892 wrote to memory of 2200 2892 7ffflrf.exe 40 PID 2892 wrote to memory of 2200 2892 7ffflrf.exe 40 PID 2892 wrote to memory of 2200 2892 7ffflrf.exe 40 PID 2892 wrote to memory of 2200 2892 7ffflrf.exe 40 PID 2200 wrote to memory of 2560 2200 tnbnbt.exe 41 PID 2200 wrote to memory of 2560 2200 tnbnbt.exe 41 PID 2200 wrote to memory of 2560 2200 tnbnbt.exe 41 PID 2200 wrote to memory of 2560 2200 tnbnbt.exe 41 PID 2560 wrote to memory of 2584 2560 dddjv.exe 42 PID 2560 wrote to memory of 2584 2560 dddjv.exe 42 PID 2560 wrote to memory of 2584 2560 dddjv.exe 42 PID 2560 wrote to memory of 2584 2560 dddjv.exe 42 PID 2584 wrote to memory of 2992 2584 ppvpp.exe 43 PID 2584 wrote to memory of 2992 2584 ppvpp.exe 43 PID 2584 wrote to memory of 2992 2584 ppvpp.exe 43 PID 2584 wrote to memory of 2992 2584 ppvpp.exe 43 PID 2992 wrote to memory of 924 2992 3httbh.exe 44 PID 2992 wrote to memory of 924 2992 3httbh.exe 44 PID 2992 wrote to memory of 924 2992 3httbh.exe 44 PID 2992 wrote to memory of 924 2992 3httbh.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe"C:\Users\Admin\AppData\Local\Temp\982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\nttntt.exec:\nttntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\jjvvj.exec:\jjvvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\lrrlllf.exec:\lrrlllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\nhbhtb.exec:\nhbhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\7nbhnh.exec:\7nbhnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\5tnbnb.exec:\5tnbnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\rrxxllr.exec:\rrxxllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\dvvpp.exec:\dvvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\7flrfxx.exec:\7flrfxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\nhntbb.exec:\nhntbb.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\7ffflrf.exec:\7ffflrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\tnbnbt.exec:\tnbnbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\dddjv.exec:\dddjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\ppvpp.exec:\ppvpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\3httbh.exec:\3httbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\vvjpv.exec:\vvjpv.exe17⤵
- Executes dropped EXE
PID:924 -
\??\c:\xxfflxl.exec:\xxfflxl.exe18⤵
- Executes dropped EXE
PID:1872 -
\??\c:\bthhhn.exec:\bthhhn.exe19⤵
- Executes dropped EXE
PID:2904 -
\??\c:\pjpjp.exec:\pjpjp.exe20⤵
- Executes dropped EXE
PID:3004 -
\??\c:\5nnnnt.exec:\5nnnnt.exe21⤵
- Executes dropped EXE
PID:748 -
\??\c:\pppvp.exec:\pppvp.exe22⤵
- Executes dropped EXE
PID:448 -
\??\c:\lrrxfrf.exec:\lrrxfrf.exe23⤵
- Executes dropped EXE
PID:1852 -
\??\c:\hbnnbb.exec:\hbnnbb.exe24⤵
- Executes dropped EXE
PID:2600 -
\??\c:\vvdpd.exec:\vvdpd.exe25⤵
- Executes dropped EXE
PID:2272 -
\??\c:\1rrflrf.exec:\1rrflrf.exe26⤵
- Executes dropped EXE
PID:1212 -
\??\c:\nnnntt.exec:\nnnntt.exe27⤵
- Executes dropped EXE
PID:1792 -
\??\c:\vdppv.exec:\vdppv.exe28⤵
- Executes dropped EXE
PID:944 -
\??\c:\btbhnt.exec:\btbhnt.exe29⤵
- Executes dropped EXE
PID:1676 -
\??\c:\fxrxxlf.exec:\fxrxxlf.exe30⤵
- Executes dropped EXE
PID:1964 -
\??\c:\tthbth.exec:\tthbth.exe31⤵
- Executes dropped EXE
PID:1700 -
\??\c:\lrfrlfr.exec:\lrfrlfr.exe32⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xrfxxxl.exec:\xrfxxxl.exe33⤵
- Executes dropped EXE
PID:992 -
\??\c:\jpjdd.exec:\jpjdd.exe34⤵
- Executes dropped EXE
PID:1848 -
\??\c:\jjpvd.exec:\jjpvd.exe35⤵
- Executes dropped EXE
PID:1076 -
\??\c:\rxfxffl.exec:\rxfxffl.exe36⤵
- Executes dropped EXE
PID:3056 -
\??\c:\nnhtbt.exec:\nnhtbt.exe37⤵
- Executes dropped EXE
PID:684 -
\??\c:\djpvv.exec:\djpvv.exe38⤵
- Executes dropped EXE
PID:1660 -
\??\c:\ppdpv.exec:\ppdpv.exe39⤵
- Executes dropped EXE
PID:2500 -
\??\c:\rrlxlxl.exec:\rrlxlxl.exe40⤵
- Executes dropped EXE
PID:1644 -
\??\c:\bhhhnh.exec:\bhhhnh.exe41⤵
- Executes dropped EXE
PID:2248 -
\??\c:\djvvj.exec:\djvvj.exe42⤵
- Executes dropped EXE
PID:1600 -
\??\c:\3pjpj.exec:\3pjpj.exe43⤵
- Executes dropped EXE
PID:2912 -
\??\c:\flrxlrx.exec:\flrxlrx.exe44⤵
- Executes dropped EXE
PID:2828 -
\??\c:\nntnbb.exec:\nntnbb.exe45⤵
- Executes dropped EXE
PID:2832 -
\??\c:\1jvdj.exec:\1jvdj.exe46⤵
- Executes dropped EXE
PID:2936 -
\??\c:\3frxllr.exec:\3frxllr.exe47⤵
- Executes dropped EXE
PID:2952 -
\??\c:\rlxxflx.exec:\rlxxflx.exe48⤵
- Executes dropped EXE
PID:1732 -
\??\c:\9bbhhh.exec:\9bbhhh.exe49⤵
- Executes dropped EXE
PID:2620 -
\??\c:\9jdjj.exec:\9jdjj.exe50⤵
- Executes dropped EXE
PID:2920 -
\??\c:\3xflrxx.exec:\3xflrxx.exe51⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xfrrxxf.exec:\xfrrxxf.exe52⤵
- Executes dropped EXE
PID:668 -
\??\c:\7hhbbb.exec:\7hhbbb.exe53⤵
- Executes dropped EXE
PID:896 -
\??\c:\jjvdj.exec:\jjvdj.exe54⤵
- Executes dropped EXE
PID:2240 -
\??\c:\7frxflr.exec:\7frxflr.exe55⤵
- Executes dropped EXE
PID:2184 -
\??\c:\1xlxlxl.exec:\1xlxlxl.exe56⤵
- Executes dropped EXE
PID:2144 -
\??\c:\hbnbhn.exec:\hbnbhn.exe57⤵
- Executes dropped EXE
PID:2532 -
\??\c:\jjppv.exec:\jjppv.exe58⤵
- Executes dropped EXE
PID:1632 -
\??\c:\fxfflrf.exec:\fxfflrf.exe59⤵
- Executes dropped EXE
PID:1944 -
\??\c:\3frrxlf.exec:\3frrxlf.exe60⤵
- Executes dropped EXE
PID:1408 -
\??\c:\tthntn.exec:\tthntn.exe61⤵
- Executes dropped EXE
PID:1956 -
\??\c:\vdppj.exec:\vdppj.exe62⤵
- Executes dropped EXE
PID:2852 -
\??\c:\7ffrlrl.exec:\7ffrlrl.exe63⤵
- Executes dropped EXE
PID:572 -
\??\c:\ffflrxf.exec:\ffflrxf.exe64⤵
- Executes dropped EXE
PID:1360 -
\??\c:\thnnnt.exec:\thnnnt.exe65⤵
- Executes dropped EXE
PID:1648 -
\??\c:\7pjpd.exec:\7pjpd.exe66⤵PID:1588
-
\??\c:\llxfllr.exec:\llxfllr.exe67⤵PID:448
-
\??\c:\ttnthn.exec:\ttnthn.exe68⤵PID:2124
-
\??\c:\1ddjp.exec:\1ddjp.exe69⤵PID:2600
-
\??\c:\fxllxxf.exec:\fxllxxf.exe70⤵PID:2012
-
\??\c:\rxlflrx.exec:\rxlflrx.exe71⤵PID:2420
-
\??\c:\3tntnt.exec:\3tntnt.exe72⤵PID:1856
-
\??\c:\9vpvd.exec:\9vpvd.exe73⤵PID:2220
-
\??\c:\3pjdj.exec:\3pjdj.exe74⤵PID:1412
-
\??\c:\llxlrrr.exec:\llxlrrr.exe75⤵PID:3052
-
\??\c:\5tnnbn.exec:\5tnnbn.exe76⤵PID:1960
-
\??\c:\ntbbnt.exec:\ntbbnt.exe77⤵PID:1860
-
\??\c:\vvjjj.exec:\vvjjj.exe78⤵PID:2408
-
\??\c:\1xxxffr.exec:\1xxxffr.exe79⤵PID:2120
-
\??\c:\7nbhnn.exec:\7nbhnn.exe80⤵PID:1684
-
\??\c:\nhtbnh.exec:\nhtbnh.exe81⤵PID:2208
-
\??\c:\vdppv.exec:\vdppv.exe82⤵PID:2412
-
\??\c:\ffrlrrx.exec:\ffrlrrx.exe83⤵PID:876
-
\??\c:\ntnhth.exec:\ntnhth.exe84⤵PID:2368
-
\??\c:\9tnbnh.exec:\9tnbnh.exe85⤵PID:2072
-
\??\c:\vdpvd.exec:\vdpvd.exe86⤵PID:2704
-
\??\c:\frlxlxl.exec:\frlxlxl.exe87⤵PID:2192
-
\??\c:\ntttnn.exec:\ntttnn.exe88⤵PID:2320
-
\??\c:\nbnhhb.exec:\nbnhhb.exe89⤵PID:1592
-
\??\c:\vdvvj.exec:\vdvvj.exe90⤵PID:3012
-
\??\c:\xrxlrfl.exec:\xrxlrfl.exe91⤵PID:2820
-
\??\c:\ffrxxxl.exec:\ffrxxxl.exe92⤵PID:2836
-
\??\c:\hthtbn.exec:\hthtbn.exe93⤵PID:2752
-
\??\c:\pppdj.exec:\pppdj.exe94⤵PID:1640
-
\??\c:\ffrrfxl.exec:\ffrrfxl.exe95⤵PID:2312
-
\??\c:\rrffrlr.exec:\rrffrlr.exe96⤵PID:2664
-
\??\c:\hbbnbn.exec:\hbbnbn.exe97⤵PID:2632
-
\??\c:\bthbth.exec:\bthbth.exe98⤵PID:2612
-
\??\c:\ddvdj.exec:\ddvdj.exe99⤵PID:2668
-
\??\c:\9xfxrff.exec:\9xfxrff.exe100⤵PID:2168
-
\??\c:\9hnbnb.exec:\9hnbnb.exe101⤵PID:1624
-
\??\c:\nnnbbt.exec:\nnnbbt.exe102⤵PID:1708
-
\??\c:\jvdvj.exec:\jvdvj.exe103⤵PID:2240
-
\??\c:\flflrrx.exec:\flflrrx.exe104⤵PID:2200
-
\??\c:\xfxflrx.exec:\xfxflrx.exe105⤵PID:2144
-
\??\c:\7tnnnt.exec:\7tnnnt.exe106⤵PID:2328
-
\??\c:\pdvjp.exec:\pdvjp.exe107⤵PID:2348
-
\??\c:\1lxlxxf.exec:\1lxlxxf.exe108⤵PID:1016
-
\??\c:\ffxrflx.exec:\ffxrflx.exe109⤵PID:2688
-
\??\c:\tbnntb.exec:\tbnntb.exe110⤵PID:2888
-
\??\c:\jpppv.exec:\jpppv.exe111⤵PID:2976
-
\??\c:\9jddd.exec:\9jddd.exe112⤵PID:1056
-
\??\c:\fffrfrl.exec:\fffrfrl.exe113⤵PID:820
-
\??\c:\5hbhbh.exec:\5hbhbh.exe114⤵PID:984
-
\??\c:\hhhhth.exec:\hhhhth.exe115⤵PID:1588
-
\??\c:\ddjjv.exec:\ddjjv.exe116⤵PID:1852
-
\??\c:\lxxfxfl.exec:\lxxfxfl.exe117⤵PID:2148
-
\??\c:\rfxxlrx.exec:\rfxxlrx.exe118⤵PID:2296
-
\??\c:\tbhnnt.exec:\tbhnnt.exe119⤵PID:2428
-
\??\c:\jjddj.exec:\jjddj.exe120⤵PID:1044
-
\??\c:\ddpvp.exec:\ddpvp.exe121⤵PID:824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-