Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 11:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8ae177f3bb7dc69e0016152a51d784c60efccd0afdf2f0a50903952c1d15c696N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
8ae177f3bb7dc69e0016152a51d784c60efccd0afdf2f0a50903952c1d15c696N.exe
-
Size
454KB
-
MD5
2fa21b7cbba39836d175210921f62740
-
SHA1
ae2df66be3eba49b4391e9a05ad3f7c85efbd2ef
-
SHA256
8ae177f3bb7dc69e0016152a51d784c60efccd0afdf2f0a50903952c1d15c696
-
SHA512
eca315e7dd9b7ff65722f16f7d0aa63dc675bbc6cf6f18cae0b01a8ed64b99ea69b652f82ee684cf831ed17523314ddb96da34c247eff0dbd1555507f72c7bb0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbef:q7Tc2NYHUrAwfMp3CDf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2520-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-112-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1612-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-130-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2012-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1392-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/780-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-269-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1732-296-0x0000000076C90000-0x0000000076DAF000-memory.dmp family_blackmoon behavioral1/memory/1732-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-297-0x0000000076DB0000-0x0000000076EAA000-memory.dmp family_blackmoon behavioral1/memory/1436-311-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1436-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-408-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/860-415-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1560-422-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2340-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-552-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1828-564-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1516-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-819-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-895-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2752-912-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2616-921-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2644-957-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2732-1175-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1768-1268-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/1768-1267-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2212 9xrrflf.exe 2320 vvvvp.exe 2472 bbthtb.exe 1932 1rrxllr.exe 2740 7nhhtb.exe 2744 jjjvj.exe 2724 nthtbn.exe 2692 7hnhhh.exe 1952 lfxxlfl.exe 2612 vvpvj.exe 2900 flllxfx.exe 992 bbnbhn.exe 1612 vjddp.exe 1712 lfxxflr.exe 1896 hhbbnt.exe 2012 pvjvj.exe 1348 ttntht.exe 1744 5hhnbh.exe 2992 7djpd.exe 2948 3rrxrfl.exe 1392 hbntbh.exe 2784 vvpjp.exe 1300 rlrxlrf.exe 2944 hnhnhn.exe 3044 vvpjv.exe 916 5bnnbn.exe 780 1vppj.exe 1544 xrrxllx.exe 2024 pdpvv.exe 2476 llrfrlf.exe 1812 xxrlfrf.exe 2548 rxlfflr.exe 1732 thbhnb.exe 1436 lfxxffl.exe 2212 jjdvj.exe 2428 3rxfllr.exe 2940 nnhnbh.exe 1932 ttbnbh.exe 2868 vvpvp.exe 2532 xxxlrxl.exe 2744 xrrflrf.exe 2860 hbtbbh.exe 2724 jdvvj.exe 2852 pjddv.exe 2756 9flllrr.exe 2656 hbttnb.exe 2568 7bhbhb.exe 2388 9pddj.exe 568 9xlfffr.exe 860 7xrllrx.exe 1560 thtttb.exe 2340 5dvvd.exe 288 5jpvv.exe 800 3fllllr.exe 1888 tnbbhn.exe 2820 nbntbb.exe 2988 vvvdj.exe 2372 fxrlxxf.exe 2116 1ffrxxl.exe 2448 nntbnt.exe 1984 vjdjd.exe 2036 rxrlrxl.exe 1532 1lxxxll.exe 1252 hhttnn.exe -
resource yara_rule behavioral1/memory/2520-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/780-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-269-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2476-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-296-0x0000000076C90000-0x0000000076DAF000-memory.dmp upx behavioral1/memory/1732-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-708-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-819-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-882-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-896-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-950-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-1267-0x0000000001C60000-0x0000000001C8A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ffrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2212 2520 8ae177f3bb7dc69e0016152a51d784c60efccd0afdf2f0a50903952c1d15c696N.exe 30 PID 2520 wrote to memory of 2212 2520 8ae177f3bb7dc69e0016152a51d784c60efccd0afdf2f0a50903952c1d15c696N.exe 30 PID 2520 wrote to memory of 2212 2520 8ae177f3bb7dc69e0016152a51d784c60efccd0afdf2f0a50903952c1d15c696N.exe 30 PID 2520 wrote to memory of 2212 2520 8ae177f3bb7dc69e0016152a51d784c60efccd0afdf2f0a50903952c1d15c696N.exe 30 PID 2212 wrote to memory of 2320 2212 9xrrflf.exe 31 PID 2212 wrote to memory of 2320 2212 9xrrflf.exe 31 PID 2212 wrote to memory of 2320 2212 9xrrflf.exe 31 PID 2212 wrote to memory of 2320 2212 9xrrflf.exe 31 PID 2320 wrote to memory of 2472 2320 vvvvp.exe 32 PID 2320 wrote to memory of 2472 2320 vvvvp.exe 32 PID 2320 wrote to memory of 2472 2320 vvvvp.exe 32 PID 2320 wrote to memory of 2472 2320 vvvvp.exe 32 PID 2472 wrote to memory of 1932 2472 bbthtb.exe 33 PID 2472 wrote to memory of 1932 2472 bbthtb.exe 33 PID 2472 wrote to memory of 1932 2472 bbthtb.exe 33 PID 2472 wrote to memory of 1932 2472 bbthtb.exe 33 PID 1932 wrote to memory of 2740 1932 1rrxllr.exe 34 PID 1932 wrote to memory of 2740 1932 1rrxllr.exe 34 PID 1932 wrote to memory of 2740 1932 1rrxllr.exe 34 PID 1932 wrote to memory of 2740 1932 1rrxllr.exe 34 PID 2740 wrote to memory of 2744 2740 7nhhtb.exe 35 PID 2740 wrote to memory of 2744 2740 7nhhtb.exe 35 PID 2740 wrote to memory of 2744 2740 7nhhtb.exe 35 PID 2740 wrote to memory of 2744 2740 7nhhtb.exe 35 PID 2744 wrote to memory of 2724 2744 jjjvj.exe 36 PID 2744 wrote to memory of 2724 2744 jjjvj.exe 36 PID 2744 wrote to memory of 2724 2744 jjjvj.exe 36 PID 2744 wrote to memory of 2724 2744 jjjvj.exe 36 PID 2724 wrote to memory of 2692 2724 nthtbn.exe 37 PID 2724 wrote to memory of 2692 2724 nthtbn.exe 37 PID 2724 wrote to memory of 2692 2724 nthtbn.exe 37 PID 2724 wrote to memory of 2692 2724 nthtbn.exe 37 PID 2692 wrote to memory of 1952 2692 7hnhhh.exe 38 PID 2692 wrote to memory of 1952 2692 7hnhhh.exe 38 PID 2692 wrote to memory of 1952 2692 7hnhhh.exe 38 PID 2692 wrote to memory of 1952 2692 7hnhhh.exe 38 PID 1952 wrote to memory of 2612 1952 lfxxlfl.exe 39 PID 1952 wrote to memory of 2612 1952 lfxxlfl.exe 39 PID 1952 wrote to memory of 2612 1952 lfxxlfl.exe 39 PID 1952 wrote to memory of 2612 1952 lfxxlfl.exe 39 PID 2612 wrote to memory of 2900 2612 vvpvj.exe 40 PID 2612 wrote to memory of 2900 2612 vvpvj.exe 40 PID 2612 wrote to memory of 2900 2612 vvpvj.exe 40 PID 2612 wrote to memory of 2900 2612 vvpvj.exe 40 PID 2900 wrote to memory of 992 2900 flllxfx.exe 41 PID 2900 wrote to memory of 992 2900 flllxfx.exe 41 PID 2900 wrote to memory of 992 2900 flllxfx.exe 41 PID 2900 wrote to memory of 992 2900 flllxfx.exe 41 PID 992 wrote to memory of 1612 992 bbnbhn.exe 42 PID 992 wrote to memory of 1612 992 bbnbhn.exe 42 PID 992 wrote to memory of 1612 992 bbnbhn.exe 42 PID 992 wrote to memory of 1612 992 bbnbhn.exe 42 PID 1612 wrote to memory of 1712 1612 vjddp.exe 43 PID 1612 wrote to memory of 1712 1612 vjddp.exe 43 PID 1612 wrote to memory of 1712 1612 vjddp.exe 43 PID 1612 wrote to memory of 1712 1612 vjddp.exe 43 PID 1712 wrote to memory of 1896 1712 lfxxflr.exe 44 PID 1712 wrote to memory of 1896 1712 lfxxflr.exe 44 PID 1712 wrote to memory of 1896 1712 lfxxflr.exe 44 PID 1712 wrote to memory of 1896 1712 lfxxflr.exe 44 PID 1896 wrote to memory of 2012 1896 hhbbnt.exe 45 PID 1896 wrote to memory of 2012 1896 hhbbnt.exe 45 PID 1896 wrote to memory of 2012 1896 hhbbnt.exe 45 PID 1896 wrote to memory of 2012 1896 hhbbnt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ae177f3bb7dc69e0016152a51d784c60efccd0afdf2f0a50903952c1d15c696N.exe"C:\Users\Admin\AppData\Local\Temp\8ae177f3bb7dc69e0016152a51d784c60efccd0afdf2f0a50903952c1d15c696N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\9xrrflf.exec:\9xrrflf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\vvvvp.exec:\vvvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\bbthtb.exec:\bbthtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\1rrxllr.exec:\1rrxllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\7nhhtb.exec:\7nhhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\jjjvj.exec:\jjjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\nthtbn.exec:\nthtbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\7hnhhh.exec:\7hnhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\lfxxlfl.exec:\lfxxlfl.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\vvpvj.exec:\vvpvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\flllxfx.exec:\flllxfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\bbnbhn.exec:\bbnbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\vjddp.exec:\vjddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\lfxxflr.exec:\lfxxflr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\hhbbnt.exec:\hhbbnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\pvjvj.exec:\pvjvj.exe17⤵
- Executes dropped EXE
PID:2012 -
\??\c:\ttntht.exec:\ttntht.exe18⤵
- Executes dropped EXE
PID:1348 -
\??\c:\5hhnbh.exec:\5hhnbh.exe19⤵
- Executes dropped EXE
PID:1744 -
\??\c:\7djpd.exec:\7djpd.exe20⤵
- Executes dropped EXE
PID:2992 -
\??\c:\3rrxrfl.exec:\3rrxrfl.exe21⤵
- Executes dropped EXE
PID:2948 -
\??\c:\hbntbh.exec:\hbntbh.exe22⤵
- Executes dropped EXE
PID:1392 -
\??\c:\vvpjp.exec:\vvpjp.exe23⤵
- Executes dropped EXE
PID:2784 -
\??\c:\rlrxlrf.exec:\rlrxlrf.exe24⤵
- Executes dropped EXE
PID:1300 -
\??\c:\hnhnhn.exec:\hnhnhn.exe25⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vvpjv.exec:\vvpjv.exe26⤵
- Executes dropped EXE
PID:3044 -
\??\c:\5bnnbn.exec:\5bnnbn.exe27⤵
- Executes dropped EXE
PID:916 -
\??\c:\1vppj.exec:\1vppj.exe28⤵
- Executes dropped EXE
PID:780 -
\??\c:\xrrxllx.exec:\xrrxllx.exe29⤵
- Executes dropped EXE
PID:1544 -
\??\c:\pdpvv.exec:\pdpvv.exe30⤵
- Executes dropped EXE
PID:2024 -
\??\c:\llrfrlf.exec:\llrfrlf.exe31⤵
- Executes dropped EXE
PID:2476 -
\??\c:\xxrlfrf.exec:\xxrlfrf.exe32⤵
- Executes dropped EXE
PID:1812 -
\??\c:\rxlfflr.exec:\rxlfflr.exe33⤵
- Executes dropped EXE
PID:2548 -
\??\c:\thbhnb.exec:\thbhnb.exe34⤵
- Executes dropped EXE
PID:1732 -
\??\c:\7jddj.exec:\7jddj.exe35⤵PID:1632
-
\??\c:\lfxxffl.exec:\lfxxffl.exe36⤵
- Executes dropped EXE
PID:1436 -
\??\c:\jjdvj.exec:\jjdvj.exe37⤵
- Executes dropped EXE
PID:2212 -
\??\c:\3rxfllr.exec:\3rxfllr.exe38⤵
- Executes dropped EXE
PID:2428 -
\??\c:\nnhnbh.exec:\nnhnbh.exe39⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ttbnbh.exec:\ttbnbh.exe40⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vvpvp.exec:\vvpvp.exe41⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xxxlrxl.exec:\xxxlrxl.exe42⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xrrflrf.exec:\xrrflrf.exe43⤵
- Executes dropped EXE
PID:2744 -
\??\c:\hbtbbh.exec:\hbtbbh.exe44⤵
- Executes dropped EXE
PID:2860 -
\??\c:\jdvvj.exec:\jdvvj.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2724 -
\??\c:\pjddv.exec:\pjddv.exe46⤵
- Executes dropped EXE
PID:2852 -
\??\c:\9flllrr.exec:\9flllrr.exe47⤵
- Executes dropped EXE
PID:2756 -
\??\c:\hbttnb.exec:\hbttnb.exe48⤵
- Executes dropped EXE
PID:2656 -
\??\c:\7bhbhb.exec:\7bhbhb.exe49⤵
- Executes dropped EXE
PID:2568 -
\??\c:\9pddj.exec:\9pddj.exe50⤵
- Executes dropped EXE
PID:2388 -
\??\c:\9xlfffr.exec:\9xlfffr.exe51⤵
- Executes dropped EXE
PID:568 -
\??\c:\7xrllrx.exec:\7xrllrx.exe52⤵
- Executes dropped EXE
PID:860 -
\??\c:\thtttb.exec:\thtttb.exe53⤵
- Executes dropped EXE
PID:1560 -
\??\c:\5dvvd.exec:\5dvvd.exe54⤵
- Executes dropped EXE
PID:2340 -
\??\c:\5jpvv.exec:\5jpvv.exe55⤵
- Executes dropped EXE
PID:288 -
\??\c:\3fllllr.exec:\3fllllr.exe56⤵
- Executes dropped EXE
PID:800 -
\??\c:\tnbbhn.exec:\tnbbhn.exe57⤵
- Executes dropped EXE
PID:1888 -
\??\c:\nbntbb.exec:\nbntbb.exe58⤵
- Executes dropped EXE
PID:2820 -
\??\c:\vvvdj.exec:\vvvdj.exe59⤵
- Executes dropped EXE
PID:2988 -
\??\c:\fxrlxxf.exec:\fxrlxxf.exe60⤵
- Executes dropped EXE
PID:2372 -
\??\c:\1ffrxxl.exec:\1ffrxxl.exe61⤵
- Executes dropped EXE
PID:2116 -
\??\c:\nntbnt.exec:\nntbnt.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2448 -
\??\c:\vjdjd.exec:\vjdjd.exe63⤵
- Executes dropped EXE
PID:1984 -
\??\c:\rxrlrxl.exec:\rxrlrxl.exe64⤵
- Executes dropped EXE
PID:2036 -
\??\c:\1lxxxll.exec:\1lxxxll.exe65⤵
- Executes dropped EXE
PID:1532 -
\??\c:\hhttnn.exec:\hhttnn.exe66⤵
- Executes dropped EXE
PID:1252 -
\??\c:\3vjjp.exec:\3vjjp.exe67⤵PID:2944
-
\??\c:\jdvpv.exec:\jdvpv.exe68⤵PID:2920
-
\??\c:\xfrxfll.exec:\xfrxfll.exe69⤵PID:1200
-
\??\c:\nbhbhb.exec:\nbhbhb.exe70⤵PID:2204
-
\??\c:\1nbhnn.exec:\1nbhnn.exe71⤵PID:1468
-
\??\c:\jpjjd.exec:\jpjjd.exe72⤵PID:688
-
\??\c:\7xrxfrr.exec:\7xrxfrr.exe73⤵PID:1052
-
\??\c:\7bbntt.exec:\7bbntt.exe74⤵PID:1976
-
\??\c:\9dppj.exec:\9dppj.exe75⤵PID:1828
-
\??\c:\7dddp.exec:\7dddp.exe76⤵PID:2068
-
\??\c:\rlflrxr.exec:\rlflrxr.exe77⤵PID:2080
-
\??\c:\htbhhh.exec:\htbhhh.exe78⤵PID:1516
-
\??\c:\vpddj.exec:\vpddj.exe79⤵PID:1520
-
\??\c:\xrffrrl.exec:\xrffrrl.exe80⤵PID:1920
-
\??\c:\bthnhh.exec:\bthnhh.exe81⤵PID:2252
-
\??\c:\nnnnbb.exec:\nnnnbb.exe82⤵PID:3004
-
\??\c:\vpddd.exec:\vpddd.exe83⤵PID:748
-
\??\c:\fxlllrf.exec:\fxlllrf.exe84⤵PID:1932
-
\??\c:\rlllffr.exec:\rlllffr.exe85⤵PID:2868
-
\??\c:\nhttbh.exec:\nhttbh.exe86⤵PID:2532
-
\??\c:\dvddd.exec:\dvddd.exe87⤵PID:2744
-
\??\c:\vjddj.exec:\vjddj.exe88⤵PID:2188
-
\??\c:\llxflfr.exec:\llxflfr.exe89⤵PID:2620
-
\??\c:\thbhtb.exec:\thbhtb.exe90⤵PID:2648
-
\??\c:\1ttbbh.exec:\1ttbbh.exe91⤵PID:2624
-
\??\c:\jpjjp.exec:\jpjjp.exe92⤵PID:1556
-
\??\c:\7lllrrf.exec:\7lllrrf.exe93⤵PID:588
-
\??\c:\lxllllx.exec:\lxllllx.exe94⤵PID:992
-
\??\c:\5bnntt.exec:\5bnntt.exe95⤵PID:1512
-
\??\c:\3pppp.exec:\3pppp.exe96⤵PID:1504
-
\??\c:\9xrlxfl.exec:\9xrlxfl.exe97⤵PID:2652
-
\??\c:\1fxxffl.exec:\1fxxffl.exe98⤵PID:2504
-
\??\c:\hbntbh.exec:\hbntbh.exe99⤵PID:1944
-
\??\c:\vvddv.exec:\vvddv.exe100⤵PID:1012
-
\??\c:\dvjjj.exec:\dvjjj.exe101⤵PID:1808
-
\??\c:\7flfrll.exec:\7flfrll.exe102⤵PID:1780
-
\??\c:\7tntbn.exec:\7tntbn.exe103⤵PID:2984
-
\??\c:\7hbbhn.exec:\7hbbhn.exe104⤵PID:2200
-
\??\c:\jjppv.exec:\jjppv.exe105⤵PID:2372
-
\??\c:\fflrfxl.exec:\fflrfxl.exe106⤵PID:1092
-
\??\c:\lfllrrx.exec:\lfllrrx.exe107⤵PID:1132
-
\??\c:\bthhtb.exec:\bthhtb.exe108⤵PID:1984
-
\??\c:\jdvvd.exec:\jdvvd.exe109⤵PID:2036
-
\??\c:\1jvdp.exec:\1jvdp.exe110⤵PID:1300
-
\??\c:\xxxlxrf.exec:\xxxlxrf.exe111⤵PID:1316
-
\??\c:\nhnhnh.exec:\nhnhnh.exe112⤵PID:1608
-
\??\c:\7tbbhb.exec:\7tbbhb.exe113⤵PID:916
-
\??\c:\vjddp.exec:\vjddp.exe114⤵PID:696
-
\??\c:\rlfrxrx.exec:\rlfrxrx.exe115⤵PID:2256
-
\??\c:\rrflrxl.exec:\rrflrxl.exe116⤵PID:1468
-
\??\c:\nnnbnt.exec:\nnnbnt.exe117⤵PID:2104
-
\??\c:\3pjjp.exec:\3pjjp.exe118⤵PID:2024
-
\??\c:\rrlrxxl.exec:\rrlrxxl.exe119⤵PID:1020
-
\??\c:\9xrrffl.exec:\9xrrffl.exe120⤵PID:2056
-
\??\c:\hbtbnt.exec:\hbtbnt.exe121⤵PID:2176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-