Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 09:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f07756d90f1ebe179e441c012048d738134d7b240a0fb2becf75881402ec0b94.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
f07756d90f1ebe179e441c012048d738134d7b240a0fb2becf75881402ec0b94.exe
-
Size
454KB
-
MD5
e923c13b68357e17befed95e04380873
-
SHA1
29d10f5970269163b37dd4b02d5234119bc51bb2
-
SHA256
f07756d90f1ebe179e441c012048d738134d7b240a0fb2becf75881402ec0b94
-
SHA512
5f6102b90a01f37f6467d6870b31e15802bd5b7367bdb9f98b0a10c43c5dd8c829a4b332aab0af9e7ccfa364b69bc8ac93b15c4d4e70022c83ffac1c5178dada
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeC:q7Tc2NYHUrAwfMp3CDC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/1868-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-25-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2684-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-44-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2696-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-119-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1508-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-158-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/752-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-229-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1344-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-284-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1600-301-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-344-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2652-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-373-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2988-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-460-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2632-463-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/268-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-506-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3064-599-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2684-618-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2592-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-696-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/284-709-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2524-740-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/668-748-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/568-773-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2428-817-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-910-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2164-960-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2288-1238-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2080-1355-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3036-1380-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1780 vvpvj.exe 2216 dvppj.exe 2900 5rflrrx.exe 2684 hnbnbt.exe 2732 rrrrfrf.exe 2696 3tnhtt.exe 2564 jdppp.exe 2756 7thbnn.exe 2344 xlflrrx.exe 1060 tnbbnn.exe 616 vvjjv.exe 1508 rlrxxfr.exe 1700 btnhbb.exe 1932 llfxlrl.exe 1696 nhbhbh.exe 1624 bhbbnt.exe 752 jvvvd.exe 1812 9rlfffr.exe 2892 nhthnt.exe 1140 jdppd.exe 1620 btntnt.exe 2844 1xrxrxr.exe 916 1jjdv.exe 1332 vdvjv.exe 1344 fxrxrfx.exe 1588 5nbbht.exe 3020 1xflxxl.exe 1940 ntnbnh.exe 2972 xxxrfrl.exe 1512 hbhttb.exe 2908 7xxflrf.exe 1600 1fflxlf.exe 2244 pppvp.exe 2076 lfffrxl.exe 3056 1bbbbb.exe 2900 htthtt.exe 2728 jdpdj.exe 2684 rxrxfrl.exe 2732 fxrrllf.exe 2652 9hbnhn.exe 2336 ddvjv.exe 2564 xfflxrl.exe 2600 tnhtnn.exe 2988 1tnhtb.exe 2540 9pjdj.exe 1060 5xrxlxl.exe 2288 hnhhnt.exe 1720 nthnbh.exe 1652 jppdd.exe 1788 rrflxlf.exe 320 hbbhnn.exe 1960 9vdjv.exe 1696 ddvvp.exe 2604 rrxxllf.exe 2860 7htbtb.exe 1248 1dvvp.exe 2632 pjpvp.exe 2400 xxxrrxl.exe 268 nnhtbn.exe 1656 dddjv.exe 1736 ddvpj.exe 900 rlfrlxf.exe 916 ttthht.exe 932 5dddd.exe -
resource yara_rule behavioral1/memory/1868-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-506-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2684-618-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/2592-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-773-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2428-817-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-910-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2352-917-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-960-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2524-992-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-1263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-1355-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3036-1380-0x00000000005C0000-0x00000000005EA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hththt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflffrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1868 wrote to memory of 1780 1868 f07756d90f1ebe179e441c012048d738134d7b240a0fb2becf75881402ec0b94.exe 31 PID 1868 wrote to memory of 1780 1868 f07756d90f1ebe179e441c012048d738134d7b240a0fb2becf75881402ec0b94.exe 31 PID 1868 wrote to memory of 1780 1868 f07756d90f1ebe179e441c012048d738134d7b240a0fb2becf75881402ec0b94.exe 31 PID 1868 wrote to memory of 1780 1868 f07756d90f1ebe179e441c012048d738134d7b240a0fb2becf75881402ec0b94.exe 31 PID 1780 wrote to memory of 2216 1780 vvpvj.exe 32 PID 1780 wrote to memory of 2216 1780 vvpvj.exe 32 PID 1780 wrote to memory of 2216 1780 vvpvj.exe 32 PID 1780 wrote to memory of 2216 1780 vvpvj.exe 32 PID 2216 wrote to memory of 2900 2216 dvppj.exe 33 PID 2216 wrote to memory of 2900 2216 dvppj.exe 33 PID 2216 wrote to memory of 2900 2216 dvppj.exe 33 PID 2216 wrote to memory of 2900 2216 dvppj.exe 33 PID 2900 wrote to memory of 2684 2900 5rflrrx.exe 34 PID 2900 wrote to memory of 2684 2900 5rflrrx.exe 34 PID 2900 wrote to memory of 2684 2900 5rflrrx.exe 34 PID 2900 wrote to memory of 2684 2900 5rflrrx.exe 34 PID 2684 wrote to memory of 2732 2684 hnbnbt.exe 35 PID 2684 wrote to memory of 2732 2684 hnbnbt.exe 35 PID 2684 wrote to memory of 2732 2684 hnbnbt.exe 35 PID 2684 wrote to memory of 2732 2684 hnbnbt.exe 35 PID 2732 wrote to memory of 2696 2732 rrrrfrf.exe 36 PID 2732 wrote to memory of 2696 2732 rrrrfrf.exe 36 PID 2732 wrote to memory of 2696 2732 rrrrfrf.exe 36 PID 2732 wrote to memory of 2696 2732 rrrrfrf.exe 36 PID 2696 wrote to memory of 2564 2696 3tnhtt.exe 37 PID 2696 wrote to memory of 2564 2696 3tnhtt.exe 37 PID 2696 wrote to memory of 2564 2696 3tnhtt.exe 37 PID 2696 wrote to memory of 2564 2696 3tnhtt.exe 37 PID 2564 wrote to memory of 2756 2564 jdppp.exe 38 PID 2564 wrote to memory of 2756 2564 jdppp.exe 38 PID 2564 wrote to memory of 2756 2564 jdppp.exe 38 PID 2564 wrote to memory of 2756 2564 jdppp.exe 38 PID 2756 wrote to memory of 2344 2756 7thbnn.exe 39 PID 2756 wrote to memory of 2344 2756 7thbnn.exe 39 PID 2756 wrote to memory of 2344 2756 7thbnn.exe 39 PID 2756 wrote to memory of 2344 2756 7thbnn.exe 39 PID 2344 wrote to memory of 1060 2344 xlflrrx.exe 40 PID 2344 wrote to memory of 1060 2344 xlflrrx.exe 40 PID 2344 wrote to memory of 1060 2344 xlflrrx.exe 40 PID 2344 wrote to memory of 1060 2344 xlflrrx.exe 40 PID 1060 wrote to memory of 616 1060 tnbbnn.exe 41 PID 1060 wrote to memory of 616 1060 tnbbnn.exe 41 PID 1060 wrote to memory of 616 1060 tnbbnn.exe 41 PID 1060 wrote to memory of 616 1060 tnbbnn.exe 41 PID 616 wrote to memory of 1508 616 vvjjv.exe 42 PID 616 wrote to memory of 1508 616 vvjjv.exe 42 PID 616 wrote to memory of 1508 616 vvjjv.exe 42 PID 616 wrote to memory of 1508 616 vvjjv.exe 42 PID 1508 wrote to memory of 1700 1508 rlrxxfr.exe 43 PID 1508 wrote to memory of 1700 1508 rlrxxfr.exe 43 PID 1508 wrote to memory of 1700 1508 rlrxxfr.exe 43 PID 1508 wrote to memory of 1700 1508 rlrxxfr.exe 43 PID 1700 wrote to memory of 1932 1700 btnhbb.exe 44 PID 1700 wrote to memory of 1932 1700 btnhbb.exe 44 PID 1700 wrote to memory of 1932 1700 btnhbb.exe 44 PID 1700 wrote to memory of 1932 1700 btnhbb.exe 44 PID 1932 wrote to memory of 1696 1932 llfxlrl.exe 45 PID 1932 wrote to memory of 1696 1932 llfxlrl.exe 45 PID 1932 wrote to memory of 1696 1932 llfxlrl.exe 45 PID 1932 wrote to memory of 1696 1932 llfxlrl.exe 45 PID 1696 wrote to memory of 1624 1696 nhbhbh.exe 46 PID 1696 wrote to memory of 1624 1696 nhbhbh.exe 46 PID 1696 wrote to memory of 1624 1696 nhbhbh.exe 46 PID 1696 wrote to memory of 1624 1696 nhbhbh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\f07756d90f1ebe179e441c012048d738134d7b240a0fb2becf75881402ec0b94.exe"C:\Users\Admin\AppData\Local\Temp\f07756d90f1ebe179e441c012048d738134d7b240a0fb2becf75881402ec0b94.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\vvpvj.exec:\vvpvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\dvppj.exec:\dvppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\5rflrrx.exec:\5rflrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\hnbnbt.exec:\hnbnbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\rrrrfrf.exec:\rrrrfrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\3tnhtt.exec:\3tnhtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\jdppp.exec:\jdppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\7thbnn.exec:\7thbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\xlflrrx.exec:\xlflrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\tnbbnn.exec:\tnbbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\vvjjv.exec:\vvjjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:616 -
\??\c:\rlrxxfr.exec:\rlrxxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\btnhbb.exec:\btnhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\llfxlrl.exec:\llfxlrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\nhbhbh.exec:\nhbhbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\bhbbnt.exec:\bhbbnt.exe17⤵
- Executes dropped EXE
PID:1624 -
\??\c:\jvvvd.exec:\jvvvd.exe18⤵
- Executes dropped EXE
PID:752 -
\??\c:\9rlfffr.exec:\9rlfffr.exe19⤵
- Executes dropped EXE
PID:1812 -
\??\c:\nhthnt.exec:\nhthnt.exe20⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jdppd.exec:\jdppd.exe21⤵
- Executes dropped EXE
PID:1140 -
\??\c:\btntnt.exec:\btntnt.exe22⤵
- Executes dropped EXE
PID:1620 -
\??\c:\1xrxrxr.exec:\1xrxrxr.exe23⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1jjdv.exec:\1jjdv.exe24⤵
- Executes dropped EXE
PID:916 -
\??\c:\vdvjv.exec:\vdvjv.exe25⤵
- Executes dropped EXE
PID:1332 -
\??\c:\fxrxrfx.exec:\fxrxrfx.exe26⤵
- Executes dropped EXE
PID:1344 -
\??\c:\5nbbht.exec:\5nbbht.exe27⤵
- Executes dropped EXE
PID:1588 -
\??\c:\1xflxxl.exec:\1xflxxl.exe28⤵
- Executes dropped EXE
PID:3020 -
\??\c:\ntnbnh.exec:\ntnbnh.exe29⤵
- Executes dropped EXE
PID:1940 -
\??\c:\xxxrfrl.exec:\xxxrfrl.exe30⤵
- Executes dropped EXE
PID:2972 -
\??\c:\hbhttb.exec:\hbhttb.exe31⤵
- Executes dropped EXE
PID:1512 -
\??\c:\7xxflrf.exec:\7xxflrf.exe32⤵
- Executes dropped EXE
PID:2908 -
\??\c:\1fflxlf.exec:\1fflxlf.exe33⤵
- Executes dropped EXE
PID:1600 -
\??\c:\pppvp.exec:\pppvp.exe34⤵
- Executes dropped EXE
PID:2244 -
\??\c:\lfffrxl.exec:\lfffrxl.exe35⤵
- Executes dropped EXE
PID:2076 -
\??\c:\1bbbbb.exec:\1bbbbb.exe36⤵
- Executes dropped EXE
PID:3056 -
\??\c:\htthtt.exec:\htthtt.exe37⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jdpdj.exec:\jdpdj.exe38⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rxrxfrl.exec:\rxrxfrl.exe39⤵
- Executes dropped EXE
PID:2684 -
\??\c:\fxrrllf.exec:\fxrrllf.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\9hbnhn.exec:\9hbnhn.exe41⤵
- Executes dropped EXE
PID:2652 -
\??\c:\ddvjv.exec:\ddvjv.exe42⤵
- Executes dropped EXE
PID:2336 -
\??\c:\xfflxrl.exec:\xfflxrl.exe43⤵
- Executes dropped EXE
PID:2564 -
\??\c:\tnhtnn.exec:\tnhtnn.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\1tnhtb.exec:\1tnhtb.exe45⤵
- Executes dropped EXE
PID:2988 -
\??\c:\9pjdj.exec:\9pjdj.exe46⤵
- Executes dropped EXE
PID:2540 -
\??\c:\5xrxlxl.exec:\5xrxlxl.exe47⤵
- Executes dropped EXE
PID:1060 -
\??\c:\hnhhnt.exec:\hnhhnt.exe48⤵
- Executes dropped EXE
PID:2288 -
\??\c:\nthnbh.exec:\nthnbh.exe49⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jppdd.exec:\jppdd.exe50⤵
- Executes dropped EXE
PID:1652 -
\??\c:\rrflxlf.exec:\rrflxlf.exe51⤵
- Executes dropped EXE
PID:1788 -
\??\c:\hbbhnn.exec:\hbbhnn.exe52⤵
- Executes dropped EXE
PID:320 -
\??\c:\9vdjv.exec:\9vdjv.exe53⤵
- Executes dropped EXE
PID:1960 -
\??\c:\ddvvp.exec:\ddvvp.exe54⤵
- Executes dropped EXE
PID:1696 -
\??\c:\rrxxllf.exec:\rrxxllf.exe55⤵
- Executes dropped EXE
PID:2604 -
\??\c:\7htbtb.exec:\7htbtb.exe56⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1dvvp.exec:\1dvvp.exe57⤵
- Executes dropped EXE
PID:1248 -
\??\c:\pjpvp.exec:\pjpvp.exe58⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xxxrrxl.exec:\xxxrrxl.exe59⤵
- Executes dropped EXE
PID:2400 -
\??\c:\nnhtbn.exec:\nnhtbn.exe60⤵
- Executes dropped EXE
PID:268 -
\??\c:\dddjv.exec:\dddjv.exe61⤵
- Executes dropped EXE
PID:1656 -
\??\c:\ddvpj.exec:\ddvpj.exe62⤵
- Executes dropped EXE
PID:1736 -
\??\c:\rlfrlxf.exec:\rlfrlxf.exe63⤵
- Executes dropped EXE
PID:900 -
\??\c:\ttthht.exec:\ttthht.exe64⤵
- Executes dropped EXE
PID:916 -
\??\c:\5dddd.exec:\5dddd.exe65⤵
- Executes dropped EXE
PID:932 -
\??\c:\7jvpp.exec:\7jvpp.exe66⤵PID:1580
-
\??\c:\rlxlflf.exec:\rlxlflf.exe67⤵PID:1056
-
\??\c:\hbnthn.exec:\hbnthn.exe68⤵PID:1760
-
\??\c:\3vppp.exec:\3vppp.exe69⤵PID:3020
-
\??\c:\1xxflrf.exec:\1xxflrf.exe70⤵PID:2080
-
\??\c:\llflxxl.exec:\llflxxl.exe71⤵PID:2980
-
\??\c:\nnhntt.exec:\nnhntt.exe72⤵PID:2132
-
\??\c:\pjpdv.exec:\pjpdv.exe73⤵PID:2964
-
\??\c:\dvddj.exec:\dvddj.exe74⤵PID:2248
-
\??\c:\xxrlxfr.exec:\xxrlxfr.exe75⤵PID:2188
-
\??\c:\hnttht.exec:\hnttht.exe76⤵PID:1600
-
\??\c:\5dddp.exec:\5dddp.exe77⤵PID:2136
-
\??\c:\rrxrrrr.exec:\rrxrrrr.exe78⤵PID:2100
-
\??\c:\3xxllxl.exec:\3xxllxl.exe79⤵PID:3064
-
\??\c:\btnnbh.exec:\btnnbh.exe80⤵PID:2900
-
\??\c:\pvvjd.exec:\pvvjd.exe81⤵PID:2728
-
\??\c:\fxxlxfx.exec:\fxxlxfx.exe82⤵PID:2684
-
\??\c:\xrlxlxx.exec:\xrlxlxx.exe83⤵PID:2732
-
\??\c:\ntnbth.exec:\ntnbth.exe84⤵PID:2648
-
\??\c:\vpjpd.exec:\vpjpd.exe85⤵PID:2592
-
\??\c:\7xfllrx.exec:\7xfllrx.exe86⤵PID:2476
-
\??\c:\tnbhth.exec:\tnbhth.exe87⤵PID:2600
-
\??\c:\bttbtt.exec:\bttbtt.exe88⤵PID:3028
-
\??\c:\pppvp.exec:\pppvp.exe89⤵PID:1280
-
\??\c:\lxlllxf.exec:\lxlllxf.exe90⤵PID:616
-
\??\c:\hbnnbb.exec:\hbnnbb.exe91⤵PID:2024
-
\??\c:\vjvpv.exec:\vjvpv.exe92⤵PID:2012
-
\??\c:\vdvjd.exec:\vdvjd.exe93⤵PID:2016
-
\??\c:\xxrxflr.exec:\xxrxflr.exe94⤵PID:2000
-
\??\c:\btntnn.exec:\btntnn.exe95⤵PID:1928
-
\??\c:\vvvdj.exec:\vvvdj.exe96⤵PID:284
-
\??\c:\pvvvp.exec:\pvvvp.exe97⤵PID:1592
-
\??\c:\lxllxxf.exec:\lxllxxf.exe98⤵PID:2524
-
\??\c:\7ntbnt.exec:\7ntbnt.exe99⤵PID:2984
-
\??\c:\ddpvp.exec:\ddpvp.exe100⤵PID:2856
-
\??\c:\djdpv.exec:\djdpv.exe101⤵PID:2876
-
\??\c:\fxrfrrx.exec:\fxrfrrx.exe102⤵PID:668
-
\??\c:\1btbtt.exec:\1btbtt.exe103⤵PID:2060
-
\??\c:\jddjp.exec:\jddjp.exe104⤵PID:1620
-
\??\c:\dvvdp.exec:\dvvdp.exe105⤵PID:2364
-
\??\c:\lfrxxfr.exec:\lfrxxfr.exe106⤵PID:568
-
\??\c:\bbntht.exec:\bbntht.exe107⤵PID:836
-
\??\c:\pjvdd.exec:\pjvdd.exe108⤵PID:1676
-
\??\c:\rllrflr.exec:\rllrflr.exe109⤵PID:780
-
\??\c:\5xllllx.exec:\5xllllx.exe110⤵PID:2116
-
\??\c:\tnbhtb.exec:\tnbhtb.exe111⤵PID:2316
-
\??\c:\dvpdp.exec:\dvpdp.exe112⤵PID:2120
-
\??\c:\7pddl.exec:\7pddl.exe113⤵PID:2428
-
\??\c:\xfllrfx.exec:\xfllrfx.exe114⤵PID:2972
-
\??\c:\nnhttt.exec:\nnhttt.exe115⤵PID:1516
-
\??\c:\ppjdj.exec:\ppjdj.exe116⤵PID:3036
-
\??\c:\nbttbh.exec:\nbttbh.exe117⤵PID:1712
-
\??\c:\9tnbbb.exec:\9tnbbb.exe118⤵PID:1784
-
\??\c:\pjdjj.exec:\pjdjj.exe119⤵PID:1920
-
\??\c:\1lflllx.exec:\1lflllx.exe120⤵PID:3068
-
\??\c:\bbbthh.exec:\bbbthh.exe121⤵PID:2212
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-