Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 10:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b1f6b1bb63f8e9ec0bd6691c41b1221ccb1463a18e4080f24864174b3fcd0a5aN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b1f6b1bb63f8e9ec0bd6691c41b1221ccb1463a18e4080f24864174b3fcd0a5aN.exe
-
Size
454KB
-
MD5
483f1a72619d1f27b52dc73259819d30
-
SHA1
75275e298e9e1fc74f9de91bc0cb26f3fc5fa4a2
-
SHA256
b1f6b1bb63f8e9ec0bd6691c41b1221ccb1463a18e4080f24864174b3fcd0a5a
-
SHA512
ed642b91a5fea7d2b3f7369d639d4f5715e05d2bbef054d7948273441b814016f2b936655dd235a87b2d5265f32d4e4d093627ce99ad9ac9d02f4aad0168a3c5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeg:q7Tc2NYHUrAwfMp3CDg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2036-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-26-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/1484-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-46-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2808-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-103-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/672-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-139-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2128-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-166-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2180-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-197-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/900-214-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2388-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-250-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2472-263-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2224-273-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1864-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-283-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2080-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/664-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-492-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1864-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-560-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1288-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-662-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2304-761-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-774-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-846-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/964-983-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2356-1271-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2660-1382-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2240 dvppv.exe 1484 llfrrxl.exe 2216 xlllxfr.exe 2808 dvjpj.exe 2676 bbnbhn.exe 2812 7pvjj.exe 2680 1lllrxl.exe 2536 3btthh.exe 2616 rrlrllf.exe 3024 hhbnbn.exe 1652 5llxfrr.exe 672 bttbbh.exe 320 nhtntb.exe 1680 ntbbnn.exe 1664 fllrflr.exe 2028 hhhhbb.exe 2128 1lflxlx.exe 2180 fxlrffr.exe 2396 5ffrffl.exe 2992 7nbhbb.exe 1608 jvpvd.exe 1692 llxxflx.exe 900 dvjpv.exe 616 rrffllf.exe 2388 9jdjv.exe 740 7xrlxfr.exe 560 jddjp.exe 2472 xrlxflx.exe 2224 tbhhnn.exe 1864 dvvdv.exe 2080 ddvdp.exe 1288 7dvvv.exe 2636 dvpvd.exe 2648 9ffxrfx.exe 2216 nnhhnt.exe 2912 dvpjp.exe 2784 pjddp.exe 2848 fxrxxxl.exe 2708 3nhtnn.exe 2680 1pjjv.exe 2596 pjvdd.exe 3060 5xffffl.exe 1560 9nntbh.exe 1000 7pjvd.exe 1940 pdvpv.exe 1724 xfxfrxr.exe 1300 1tnhtt.exe 664 ttnbnh.exe 548 ddpvp.exe 1680 7xxfflx.exe 1144 nhhnhn.exe 1228 jdppd.exe 2044 vdppv.exe 1624 rlxrxxf.exe 1344 3nhthn.exe 2516 3jpdp.exe 1372 jjdpv.exe 764 3xffflr.exe 2356 ntnhnt.exe 840 btntbb.exe 1508 ddppv.exe 2412 xrflxxl.exe 2512 bhhnbn.exe 2476 hbtbth.exe -
resource yara_rule behavioral1/memory/2036-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-259-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1864-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/664-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-805-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-846-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-908-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-1019-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-1026-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-1033-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-1122-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2584-1165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-1195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/704-1253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-1353-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2240 2036 b1f6b1bb63f8e9ec0bd6691c41b1221ccb1463a18e4080f24864174b3fcd0a5aN.exe 31 PID 2036 wrote to memory of 2240 2036 b1f6b1bb63f8e9ec0bd6691c41b1221ccb1463a18e4080f24864174b3fcd0a5aN.exe 31 PID 2036 wrote to memory of 2240 2036 b1f6b1bb63f8e9ec0bd6691c41b1221ccb1463a18e4080f24864174b3fcd0a5aN.exe 31 PID 2036 wrote to memory of 2240 2036 b1f6b1bb63f8e9ec0bd6691c41b1221ccb1463a18e4080f24864174b3fcd0a5aN.exe 31 PID 2240 wrote to memory of 1484 2240 dvppv.exe 32 PID 2240 wrote to memory of 1484 2240 dvppv.exe 32 PID 2240 wrote to memory of 1484 2240 dvppv.exe 32 PID 2240 wrote to memory of 1484 2240 dvppv.exe 32 PID 1484 wrote to memory of 2216 1484 llfrrxl.exe 33 PID 1484 wrote to memory of 2216 1484 llfrrxl.exe 33 PID 1484 wrote to memory of 2216 1484 llfrrxl.exe 33 PID 1484 wrote to memory of 2216 1484 llfrrxl.exe 33 PID 2216 wrote to memory of 2808 2216 xlllxfr.exe 34 PID 2216 wrote to memory of 2808 2216 xlllxfr.exe 34 PID 2216 wrote to memory of 2808 2216 xlllxfr.exe 34 PID 2216 wrote to memory of 2808 2216 xlllxfr.exe 34 PID 2808 wrote to memory of 2676 2808 dvjpj.exe 35 PID 2808 wrote to memory of 2676 2808 dvjpj.exe 35 PID 2808 wrote to memory of 2676 2808 dvjpj.exe 35 PID 2808 wrote to memory of 2676 2808 dvjpj.exe 35 PID 2676 wrote to memory of 2812 2676 bbnbhn.exe 36 PID 2676 wrote to memory of 2812 2676 bbnbhn.exe 36 PID 2676 wrote to memory of 2812 2676 bbnbhn.exe 36 PID 2676 wrote to memory of 2812 2676 bbnbhn.exe 36 PID 2812 wrote to memory of 2680 2812 7pvjj.exe 37 PID 2812 wrote to memory of 2680 2812 7pvjj.exe 37 PID 2812 wrote to memory of 2680 2812 7pvjj.exe 37 PID 2812 wrote to memory of 2680 2812 7pvjj.exe 37 PID 2680 wrote to memory of 2536 2680 1lllrxl.exe 38 PID 2680 wrote to memory of 2536 2680 1lllrxl.exe 38 PID 2680 wrote to memory of 2536 2680 1lllrxl.exe 38 PID 2680 wrote to memory of 2536 2680 1lllrxl.exe 38 PID 2536 wrote to memory of 2616 2536 3btthh.exe 39 PID 2536 wrote to memory of 2616 2536 3btthh.exe 39 PID 2536 wrote to memory of 2616 2536 3btthh.exe 39 PID 2536 wrote to memory of 2616 2536 3btthh.exe 39 PID 2616 wrote to memory of 3024 2616 rrlrllf.exe 40 PID 2616 wrote to memory of 3024 2616 rrlrllf.exe 40 PID 2616 wrote to memory of 3024 2616 rrlrllf.exe 40 PID 2616 wrote to memory of 3024 2616 rrlrllf.exe 40 PID 3024 wrote to memory of 1652 3024 hhbnbn.exe 41 PID 3024 wrote to memory of 1652 3024 hhbnbn.exe 41 PID 3024 wrote to memory of 1652 3024 hhbnbn.exe 41 PID 3024 wrote to memory of 1652 3024 hhbnbn.exe 41 PID 1652 wrote to memory of 672 1652 5llxfrr.exe 42 PID 1652 wrote to memory of 672 1652 5llxfrr.exe 42 PID 1652 wrote to memory of 672 1652 5llxfrr.exe 42 PID 1652 wrote to memory of 672 1652 5llxfrr.exe 42 PID 672 wrote to memory of 320 672 bttbbh.exe 43 PID 672 wrote to memory of 320 672 bttbbh.exe 43 PID 672 wrote to memory of 320 672 bttbbh.exe 43 PID 672 wrote to memory of 320 672 bttbbh.exe 43 PID 320 wrote to memory of 1680 320 nhtntb.exe 44 PID 320 wrote to memory of 1680 320 nhtntb.exe 44 PID 320 wrote to memory of 1680 320 nhtntb.exe 44 PID 320 wrote to memory of 1680 320 nhtntb.exe 44 PID 1680 wrote to memory of 1664 1680 ntbbnn.exe 45 PID 1680 wrote to memory of 1664 1680 ntbbnn.exe 45 PID 1680 wrote to memory of 1664 1680 ntbbnn.exe 45 PID 1680 wrote to memory of 1664 1680 ntbbnn.exe 45 PID 1664 wrote to memory of 2028 1664 fllrflr.exe 46 PID 1664 wrote to memory of 2028 1664 fllrflr.exe 46 PID 1664 wrote to memory of 2028 1664 fllrflr.exe 46 PID 1664 wrote to memory of 2028 1664 fllrflr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1f6b1bb63f8e9ec0bd6691c41b1221ccb1463a18e4080f24864174b3fcd0a5aN.exe"C:\Users\Admin\AppData\Local\Temp\b1f6b1bb63f8e9ec0bd6691c41b1221ccb1463a18e4080f24864174b3fcd0a5aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\dvppv.exec:\dvppv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\llfrrxl.exec:\llfrrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\xlllxfr.exec:\xlllxfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\dvjpj.exec:\dvjpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\bbnbhn.exec:\bbnbhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\7pvjj.exec:\7pvjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\1lllrxl.exec:\1lllrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\3btthh.exec:\3btthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\rrlrllf.exec:\rrlrllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\hhbnbn.exec:\hhbnbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\5llxfrr.exec:\5llxfrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\bttbbh.exec:\bttbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\nhtntb.exec:\nhtntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\ntbbnn.exec:\ntbbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\fllrflr.exec:\fllrflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\hhhhbb.exec:\hhhhbb.exe17⤵
- Executes dropped EXE
PID:2028 -
\??\c:\1lflxlx.exec:\1lflxlx.exe18⤵
- Executes dropped EXE
PID:2128 -
\??\c:\fxlrffr.exec:\fxlrffr.exe19⤵
- Executes dropped EXE
PID:2180 -
\??\c:\5ffrffl.exec:\5ffrffl.exe20⤵
- Executes dropped EXE
PID:2396 -
\??\c:\7nbhbb.exec:\7nbhbb.exe21⤵
- Executes dropped EXE
PID:2992 -
\??\c:\jvpvd.exec:\jvpvd.exe22⤵
- Executes dropped EXE
PID:1608 -
\??\c:\llxxflx.exec:\llxxflx.exe23⤵
- Executes dropped EXE
PID:1692 -
\??\c:\dvjpv.exec:\dvjpv.exe24⤵
- Executes dropped EXE
PID:900 -
\??\c:\rrffllf.exec:\rrffllf.exe25⤵
- Executes dropped EXE
PID:616 -
\??\c:\9jdjv.exec:\9jdjv.exe26⤵
- Executes dropped EXE
PID:2388 -
\??\c:\7xrlxfr.exec:\7xrlxfr.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:740 -
\??\c:\jddjp.exec:\jddjp.exe28⤵
- Executes dropped EXE
PID:560 -
\??\c:\xrlxflx.exec:\xrlxflx.exe29⤵
- Executes dropped EXE
PID:2472 -
\??\c:\tbhhnn.exec:\tbhhnn.exe30⤵
- Executes dropped EXE
PID:2224 -
\??\c:\dvvdv.exec:\dvvdv.exe31⤵
- Executes dropped EXE
PID:1864 -
\??\c:\ddvdp.exec:\ddvdp.exe32⤵
- Executes dropped EXE
PID:2080 -
\??\c:\7dvvv.exec:\7dvvv.exe33⤵
- Executes dropped EXE
PID:1288 -
\??\c:\dvpvd.exec:\dvpvd.exe34⤵
- Executes dropped EXE
PID:2636 -
\??\c:\9ffxrfx.exec:\9ffxrfx.exe35⤵
- Executes dropped EXE
PID:2648 -
\??\c:\nnhhnt.exec:\nnhhnt.exe36⤵
- Executes dropped EXE
PID:2216 -
\??\c:\dvpjp.exec:\dvpjp.exe37⤵
- Executes dropped EXE
PID:2912 -
\??\c:\pjddp.exec:\pjddp.exe38⤵
- Executes dropped EXE
PID:2784 -
\??\c:\fxrxxxl.exec:\fxrxxxl.exe39⤵
- Executes dropped EXE
PID:2848 -
\??\c:\3nhtnn.exec:\3nhtnn.exe40⤵
- Executes dropped EXE
PID:2708 -
\??\c:\1pjjv.exec:\1pjjv.exe41⤵
- Executes dropped EXE
PID:2680 -
\??\c:\pjvdd.exec:\pjvdd.exe42⤵
- Executes dropped EXE
PID:2596 -
\??\c:\5xffffl.exec:\5xffffl.exe43⤵
- Executes dropped EXE
PID:3060 -
\??\c:\9nntbh.exec:\9nntbh.exe44⤵
- Executes dropped EXE
PID:1560 -
\??\c:\7pjvd.exec:\7pjvd.exe45⤵
- Executes dropped EXE
PID:1000 -
\??\c:\pdvpv.exec:\pdvpv.exe46⤵
- Executes dropped EXE
PID:1940 -
\??\c:\xfxfrxr.exec:\xfxfrxr.exe47⤵
- Executes dropped EXE
PID:1724 -
\??\c:\1tnhtt.exec:\1tnhtt.exe48⤵
- Executes dropped EXE
PID:1300 -
\??\c:\ttnbnh.exec:\ttnbnh.exe49⤵
- Executes dropped EXE
PID:664 -
\??\c:\ddpvp.exec:\ddpvp.exe50⤵
- Executes dropped EXE
PID:548 -
\??\c:\7xxfflx.exec:\7xxfflx.exe51⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nhhnhn.exec:\nhhnhn.exe52⤵
- Executes dropped EXE
PID:1144 -
\??\c:\jdppd.exec:\jdppd.exe53⤵
- Executes dropped EXE
PID:1228 -
\??\c:\vdppv.exec:\vdppv.exe54⤵
- Executes dropped EXE
PID:2044 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe55⤵
- Executes dropped EXE
PID:1624 -
\??\c:\3nhthn.exec:\3nhthn.exe56⤵
- Executes dropped EXE
PID:1344 -
\??\c:\3jpdp.exec:\3jpdp.exe57⤵
- Executes dropped EXE
PID:2516 -
\??\c:\jjdpv.exec:\jjdpv.exe58⤵
- Executes dropped EXE
PID:1372 -
\??\c:\3xffflr.exec:\3xffflr.exe59⤵
- Executes dropped EXE
PID:764 -
\??\c:\ntnhnt.exec:\ntnhnt.exe60⤵
- Executes dropped EXE
PID:2356 -
\??\c:\btntbb.exec:\btntbb.exe61⤵
- Executes dropped EXE
PID:840 -
\??\c:\ddppv.exec:\ddppv.exe62⤵
- Executes dropped EXE
PID:1508 -
\??\c:\xrflxxl.exec:\xrflxxl.exe63⤵
- Executes dropped EXE
PID:2412 -
\??\c:\bhhnbn.exec:\bhhnbn.exe64⤵
- Executes dropped EXE
PID:2512 -
\??\c:\hbtbth.exec:\hbtbth.exe65⤵
- Executes dropped EXE
PID:2476 -
\??\c:\dpjdp.exec:\dpjdp.exe66⤵PID:2480
-
\??\c:\1xllrxl.exec:\1xllrxl.exe67⤵PID:1932
-
\??\c:\ffrxffl.exec:\ffrxffl.exe68⤵PID:2220
-
\??\c:\hbhnhb.exec:\hbhnhb.exe69⤵PID:1796
-
\??\c:\jdvvj.exec:\jdvvj.exe70⤵PID:880
-
\??\c:\xxrxrxl.exec:\xxrxrxl.exe71⤵PID:2628
-
\??\c:\rrxfrrf.exec:\rrxfrrf.exe72⤵PID:1864
-
\??\c:\tnhtbh.exec:\tnhtbh.exe73⤵PID:3012
-
\??\c:\jddjp.exec:\jddjp.exe74⤵PID:1600
-
\??\c:\3xxxxfr.exec:\3xxxxfr.exe75⤵PID:1288
-
\??\c:\5lflrrf.exec:\5lflrrf.exe76⤵PID:2636
-
\??\c:\tnbtbb.exec:\tnbtbb.exe77⤵PID:2648
-
\??\c:\pjddp.exec:\pjddp.exe78⤵PID:2216
-
\??\c:\jjdjj.exec:\jjdjj.exe79⤵PID:2660
-
\??\c:\lfllxfr.exec:\lfllxfr.exe80⤵PID:2704
-
\??\c:\9hntnh.exec:\9hntnh.exe81⤵PID:2812
-
\??\c:\5tnthn.exec:\5tnthn.exe82⤵PID:2656
-
\??\c:\jdjjj.exec:\jdjjj.exe83⤵
- System Location Discovery: System Language Discovery
PID:2580 -
\??\c:\rrxxffx.exec:\rrxxffx.exe84⤵PID:2508
-
\??\c:\hhbhbn.exec:\hhbhbn.exe85⤵PID:1768
-
\??\c:\nnbtbh.exec:\nnbtbh.exe86⤵PID:348
-
\??\c:\vvvvp.exec:\vvvvp.exe87⤵
- System Location Discovery: System Language Discovery
PID:2064 -
\??\c:\lffrflr.exec:\lffrflr.exe88⤵PID:2280
-
\??\c:\5llxrrl.exec:\5llxrrl.exe89⤵PID:1784
-
\??\c:\5nbbhn.exec:\5nbbhn.exe90⤵PID:1676
-
\??\c:\jvjdj.exec:\jvjdj.exe91⤵PID:1780
-
\??\c:\xxrxllx.exec:\xxrxllx.exe92⤵PID:884
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe93⤵PID:552
-
\??\c:\nhbhbb.exec:\nhbhbb.exe94⤵PID:1048
-
\??\c:\9dvvj.exec:\9dvvj.exe95⤵PID:1156
-
\??\c:\vppvj.exec:\vppvj.exe96⤵PID:1196
-
\??\c:\xrrrxfr.exec:\xrrrxfr.exe97⤵PID:912
-
\??\c:\bhttht.exec:\bhttht.exe98⤵PID:1076
-
\??\c:\ppjvj.exec:\ppjvj.exe99⤵PID:1344
-
\??\c:\1vjpp.exec:\1vjpp.exe100⤵PID:1584
-
\??\c:\rrxxffl.exec:\rrxxffl.exe101⤵PID:1712
-
\??\c:\7btbhn.exec:\7btbhn.exe102⤵PID:1032
-
\??\c:\vpvvd.exec:\vpvvd.exe103⤵PID:2920
-
\??\c:\vvppj.exec:\vvppj.exe104⤵PID:2032
-
\??\c:\lllrllf.exec:\lllrllf.exe105⤵PID:2304
-
\??\c:\3nbhtb.exec:\3nbhtb.exe106⤵PID:2412
-
\??\c:\bhtbtb.exec:\bhtbtb.exe107⤵PID:2092
-
\??\c:\jdppp.exec:\jdppp.exe108⤵
- System Location Discovery: System Language Discovery
PID:2476 -
\??\c:\xrlllrf.exec:\xrlllrf.exe109⤵PID:2916
-
\??\c:\bhbtbb.exec:\bhbtbb.exe110⤵PID:1848
-
\??\c:\7htbhn.exec:\7htbhn.exe111⤵PID:2220
-
\??\c:\ddpvj.exec:\ddpvj.exe112⤵PID:2624
-
\??\c:\3fflxxf.exec:\3fflxxf.exe113⤵PID:2056
-
\??\c:\bbbtth.exec:\bbbtth.exe114⤵PID:2452
-
\??\c:\nhntbh.exec:\nhntbh.exe115⤵PID:2736
-
\??\c:\jvjdj.exec:\jvjdj.exe116⤵PID:3012
-
\??\c:\7xxrxff.exec:\7xxrxff.exe117⤵PID:1592
-
\??\c:\tnhnbh.exec:\tnhnbh.exe118⤵PID:2088
-
\??\c:\jdpdj.exec:\jdpdj.exe119⤵PID:2636
-
\??\c:\1ddjp.exec:\1ddjp.exe120⤵PID:2924
-
\??\c:\nnhhtt.exec:\nnhhtt.exe121⤵PID:2216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-