Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 11:12
Static task
static1
Behavioral task
behavioral1
Sample
a730c7928d48338f2b0ca072585ccf95901f7dd35f73a8cea92b8e85ac11cb41N.exe
Resource
win7-20240903-en
General
-
Target
a730c7928d48338f2b0ca072585ccf95901f7dd35f73a8cea92b8e85ac11cb41N.exe
-
Size
453KB
-
MD5
9faebdeedd066ef8fef5bd2a18868370
-
SHA1
5baef415cc595543fa22492ebf01468a3a14db85
-
SHA256
a730c7928d48338f2b0ca072585ccf95901f7dd35f73a8cea92b8e85ac11cb41
-
SHA512
3691dbf72f175b963caaf861144c95e290ba491d14151bfa17f3ad8431192cbd9d6f8be58f49a8b50d0cb1e4fb8ad56d0968c6fe5fd3df05d817c710abd1f749
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2788-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-82-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/3008-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/712-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/492-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-660-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2708-661-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-673-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2108-713-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-814-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-843-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2144-875-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-1052-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2664 bnbbbb.exe 2788 pjvvd.exe 2652 1xlrxxl.exe 2556 9nhhnb.exe 2688 jdpvj.exe 2532 5ffflrf.exe 2984 bthhnn.exe 2000 1jvpp.exe 3008 xrfllfr.exe 2160 9thhhh.exe 2060 7xlrrxf.exe 2212 5hhhnh.exe 1660 vpjdp.exe 2508 thnntt.exe 2952 rlffllx.exe 1636 5htntt.exe 1696 fxflxxf.exe 2396 1htbht.exe 2180 7dpdd.exe 2476 xfxfxlf.exe 2356 vvjjj.exe 1836 fxlxlxf.exe 2032 htbbhh.exe 1936 ddddp.exe 2020 9bnntn.exe 2800 5ppvj.exe 712 thhnht.exe 2348 jjdjv.exe 900 1rflrfx.exe 484 djdpv.exe 1584 fxlrllr.exe 2720 pjpvd.exe 2528 3pjpv.exe 2780 xlxflrf.exe 2764 9tbttt.exe 2636 7vjjj.exe 2540 xlrlrlr.exe 2520 frflrxf.exe 1756 9ttbbb.exe 2984 dvppv.exe 2052 lflxffr.exe 2168 hththh.exe 1516 7pddj.exe 2400 3jvjp.exe 1924 xrlrxrf.exe 2420 lfrxllx.exe 2816 tnhntn.exe 2264 pdppp.exe 2832 ffflxxl.exe 2964 rxrxllr.exe 1100 9thhhb.exe 2864 jpjjv.exe 492 xxxfxlx.exe 1108 rxlrxlr.exe 2244 bbhhtt.exe 2108 dvppv.exe 2288 lfrxffr.exe 2608 tnhnbh.exe 1040 ddppd.exe 1060 xxrxflr.exe 1336 1xxfflx.exe 616 hbtbnh.exe 944 dvpvd.exe 856 lfxlrxl.exe -
resource yara_rule behavioral1/memory/2652-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/712-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/492-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-741-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1564-814-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2484-825-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-875-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-882-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-986-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-1038-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfllfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2664 3068 a730c7928d48338f2b0ca072585ccf95901f7dd35f73a8cea92b8e85ac11cb41N.exe 30 PID 3068 wrote to memory of 2664 3068 a730c7928d48338f2b0ca072585ccf95901f7dd35f73a8cea92b8e85ac11cb41N.exe 30 PID 3068 wrote to memory of 2664 3068 a730c7928d48338f2b0ca072585ccf95901f7dd35f73a8cea92b8e85ac11cb41N.exe 30 PID 3068 wrote to memory of 2664 3068 a730c7928d48338f2b0ca072585ccf95901f7dd35f73a8cea92b8e85ac11cb41N.exe 30 PID 2664 wrote to memory of 2788 2664 bnbbbb.exe 31 PID 2664 wrote to memory of 2788 2664 bnbbbb.exe 31 PID 2664 wrote to memory of 2788 2664 bnbbbb.exe 31 PID 2664 wrote to memory of 2788 2664 bnbbbb.exe 31 PID 2788 wrote to memory of 2652 2788 pjvvd.exe 32 PID 2788 wrote to memory of 2652 2788 pjvvd.exe 32 PID 2788 wrote to memory of 2652 2788 pjvvd.exe 32 PID 2788 wrote to memory of 2652 2788 pjvvd.exe 32 PID 2652 wrote to memory of 2556 2652 1xlrxxl.exe 33 PID 2652 wrote to memory of 2556 2652 1xlrxxl.exe 33 PID 2652 wrote to memory of 2556 2652 1xlrxxl.exe 33 PID 2652 wrote to memory of 2556 2652 1xlrxxl.exe 33 PID 2556 wrote to memory of 2688 2556 9nhhnb.exe 34 PID 2556 wrote to memory of 2688 2556 9nhhnb.exe 34 PID 2556 wrote to memory of 2688 2556 9nhhnb.exe 34 PID 2556 wrote to memory of 2688 2556 9nhhnb.exe 34 PID 2688 wrote to memory of 2532 2688 jdpvj.exe 35 PID 2688 wrote to memory of 2532 2688 jdpvj.exe 35 PID 2688 wrote to memory of 2532 2688 jdpvj.exe 35 PID 2688 wrote to memory of 2532 2688 jdpvj.exe 35 PID 2532 wrote to memory of 2984 2532 5ffflrf.exe 36 PID 2532 wrote to memory of 2984 2532 5ffflrf.exe 36 PID 2532 wrote to memory of 2984 2532 5ffflrf.exe 36 PID 2532 wrote to memory of 2984 2532 5ffflrf.exe 36 PID 2984 wrote to memory of 2000 2984 bthhnn.exe 37 PID 2984 wrote to memory of 2000 2984 bthhnn.exe 37 PID 2984 wrote to memory of 2000 2984 bthhnn.exe 37 PID 2984 wrote to memory of 2000 2984 bthhnn.exe 37 PID 2000 wrote to memory of 3008 2000 1jvpp.exe 38 PID 2000 wrote to memory of 3008 2000 1jvpp.exe 38 PID 2000 wrote to memory of 3008 2000 1jvpp.exe 38 PID 2000 wrote to memory of 3008 2000 1jvpp.exe 38 PID 3008 wrote to memory of 2160 3008 xrfllfr.exe 39 PID 3008 wrote to memory of 2160 3008 xrfllfr.exe 39 PID 3008 wrote to memory of 2160 3008 xrfllfr.exe 39 PID 3008 wrote to memory of 2160 3008 xrfllfr.exe 39 PID 2160 wrote to memory of 2060 2160 9thhhh.exe 40 PID 2160 wrote to memory of 2060 2160 9thhhh.exe 40 PID 2160 wrote to memory of 2060 2160 9thhhh.exe 40 PID 2160 wrote to memory of 2060 2160 9thhhh.exe 40 PID 2060 wrote to memory of 2212 2060 7xlrrxf.exe 41 PID 2060 wrote to memory of 2212 2060 7xlrrxf.exe 41 PID 2060 wrote to memory of 2212 2060 7xlrrxf.exe 41 PID 2060 wrote to memory of 2212 2060 7xlrrxf.exe 41 PID 2212 wrote to memory of 1660 2212 5hhhnh.exe 42 PID 2212 wrote to memory of 1660 2212 5hhhnh.exe 42 PID 2212 wrote to memory of 1660 2212 5hhhnh.exe 42 PID 2212 wrote to memory of 1660 2212 5hhhnh.exe 42 PID 1660 wrote to memory of 2508 1660 vpjdp.exe 43 PID 1660 wrote to memory of 2508 1660 vpjdp.exe 43 PID 1660 wrote to memory of 2508 1660 vpjdp.exe 43 PID 1660 wrote to memory of 2508 1660 vpjdp.exe 43 PID 2508 wrote to memory of 2952 2508 thnntt.exe 44 PID 2508 wrote to memory of 2952 2508 thnntt.exe 44 PID 2508 wrote to memory of 2952 2508 thnntt.exe 44 PID 2508 wrote to memory of 2952 2508 thnntt.exe 44 PID 2952 wrote to memory of 1636 2952 rlffllx.exe 45 PID 2952 wrote to memory of 1636 2952 rlffllx.exe 45 PID 2952 wrote to memory of 1636 2952 rlffllx.exe 45 PID 2952 wrote to memory of 1636 2952 rlffllx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a730c7928d48338f2b0ca072585ccf95901f7dd35f73a8cea92b8e85ac11cb41N.exe"C:\Users\Admin\AppData\Local\Temp\a730c7928d48338f2b0ca072585ccf95901f7dd35f73a8cea92b8e85ac11cb41N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\bnbbbb.exec:\bnbbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\pjvvd.exec:\pjvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\1xlrxxl.exec:\1xlrxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\9nhhnb.exec:\9nhhnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\jdpvj.exec:\jdpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\5ffflrf.exec:\5ffflrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\bthhnn.exec:\bthhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\1jvpp.exec:\1jvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\xrfllfr.exec:\xrfllfr.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\9thhhh.exec:\9thhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\7xlrrxf.exec:\7xlrrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\5hhhnh.exec:\5hhhnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\vpjdp.exec:\vpjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\thnntt.exec:\thnntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\rlffllx.exec:\rlffllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\5htntt.exec:\5htntt.exe17⤵
- Executes dropped EXE
PID:1636 -
\??\c:\fxflxxf.exec:\fxflxxf.exe18⤵
- Executes dropped EXE
PID:1696 -
\??\c:\1htbht.exec:\1htbht.exe19⤵
- Executes dropped EXE
PID:2396 -
\??\c:\7dpdd.exec:\7dpdd.exe20⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xfxfxlf.exec:\xfxfxlf.exe21⤵
- Executes dropped EXE
PID:2476 -
\??\c:\vvjjj.exec:\vvjjj.exe22⤵
- Executes dropped EXE
PID:2356 -
\??\c:\fxlxlxf.exec:\fxlxlxf.exe23⤵
- Executes dropped EXE
PID:1836 -
\??\c:\htbbhh.exec:\htbbhh.exe24⤵
- Executes dropped EXE
PID:2032 -
\??\c:\ddddp.exec:\ddddp.exe25⤵
- Executes dropped EXE
PID:1936 -
\??\c:\9bnntn.exec:\9bnntn.exe26⤵
- Executes dropped EXE
PID:2020 -
\??\c:\5ppvj.exec:\5ppvj.exe27⤵
- Executes dropped EXE
PID:2800 -
\??\c:\thhnht.exec:\thhnht.exe28⤵
- Executes dropped EXE
PID:712 -
\??\c:\jjdjv.exec:\jjdjv.exe29⤵
- Executes dropped EXE
PID:2348 -
\??\c:\1rflrfx.exec:\1rflrfx.exe30⤵
- Executes dropped EXE
PID:900 -
\??\c:\djdpv.exec:\djdpv.exe31⤵
- Executes dropped EXE
PID:484 -
\??\c:\fxlrllr.exec:\fxlrllr.exe32⤵
- Executes dropped EXE
PID:1584 -
\??\c:\pjpvd.exec:\pjpvd.exe33⤵
- Executes dropped EXE
PID:2720 -
\??\c:\3pjpv.exec:\3pjpv.exe34⤵
- Executes dropped EXE
PID:2528 -
\??\c:\xlxflrf.exec:\xlxflrf.exe35⤵
- Executes dropped EXE
PID:2780 -
\??\c:\9tbttt.exec:\9tbttt.exe36⤵
- Executes dropped EXE
PID:2764 -
\??\c:\7vjjj.exec:\7vjjj.exe37⤵
- Executes dropped EXE
PID:2636 -
\??\c:\xlrlrlr.exec:\xlrlrlr.exe38⤵
- Executes dropped EXE
PID:2540 -
\??\c:\frflrxf.exec:\frflrxf.exe39⤵
- Executes dropped EXE
PID:2520 -
\??\c:\9ttbbb.exec:\9ttbbb.exe40⤵
- Executes dropped EXE
PID:1756 -
\??\c:\dvppv.exec:\dvppv.exe41⤵
- Executes dropped EXE
PID:2984 -
\??\c:\lflxffr.exec:\lflxffr.exe42⤵
- Executes dropped EXE
PID:2052 -
\??\c:\hththh.exec:\hththh.exe43⤵
- Executes dropped EXE
PID:2168 -
\??\c:\7pddj.exec:\7pddj.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1516 -
\??\c:\3jvjp.exec:\3jvjp.exe45⤵
- Executes dropped EXE
PID:2400 -
\??\c:\xrlrxrf.exec:\xrlrxrf.exe46⤵
- Executes dropped EXE
PID:1924 -
\??\c:\lfrxllx.exec:\lfrxllx.exe47⤵
- Executes dropped EXE
PID:2420 -
\??\c:\tnhntn.exec:\tnhntn.exe48⤵
- Executes dropped EXE
PID:2816 -
\??\c:\pdppp.exec:\pdppp.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2264 -
\??\c:\ffflxxl.exec:\ffflxxl.exe50⤵
- Executes dropped EXE
PID:2832 -
\??\c:\rxrxllr.exec:\rxrxllr.exe51⤵
- Executes dropped EXE
PID:2964 -
\??\c:\9thhhb.exec:\9thhhb.exe52⤵
- Executes dropped EXE
PID:1100 -
\??\c:\jpjjv.exec:\jpjjv.exe53⤵
- Executes dropped EXE
PID:2864 -
\??\c:\xxxfxlx.exec:\xxxfxlx.exe54⤵
- Executes dropped EXE
PID:492 -
\??\c:\rxlrxlr.exec:\rxlrxlr.exe55⤵
- Executes dropped EXE
PID:1108 -
\??\c:\bbhhtt.exec:\bbhhtt.exe56⤵
- Executes dropped EXE
PID:2244 -
\??\c:\dvppv.exec:\dvppv.exe57⤵
- Executes dropped EXE
PID:2108 -
\??\c:\lfrxffr.exec:\lfrxffr.exe58⤵
- Executes dropped EXE
PID:2288 -
\??\c:\tnhnbh.exec:\tnhnbh.exe59⤵
- Executes dropped EXE
PID:2608 -
\??\c:\ddppd.exec:\ddppd.exe60⤵
- Executes dropped EXE
PID:1040 -
\??\c:\xxrxflr.exec:\xxrxflr.exe61⤵
- Executes dropped EXE
PID:1060 -
\??\c:\1xxfflx.exec:\1xxfflx.exe62⤵
- Executes dropped EXE
PID:1336 -
\??\c:\hbtbnh.exec:\hbtbnh.exe63⤵
- Executes dropped EXE
PID:616 -
\??\c:\dvpvd.exec:\dvpvd.exe64⤵
- Executes dropped EXE
PID:944 -
\??\c:\lfxlrxl.exec:\lfxlrxl.exe65⤵
- Executes dropped EXE
PID:856 -
\??\c:\hbthbn.exec:\hbthbn.exe66⤵PID:2140
-
\??\c:\bnbhnh.exec:\bnbhnh.exe67⤵PID:2156
-
\??\c:\vpddj.exec:\vpddj.exe68⤵PID:1956
-
\??\c:\3rffxff.exec:\3rffxff.exe69⤵PID:2612
-
\??\c:\5bnnnn.exec:\5bnnnn.exe70⤵PID:1804
-
\??\c:\tbbbhh.exec:\tbbbhh.exe71⤵PID:1964
-
\??\c:\5vjpd.exec:\5vjpd.exe72⤵PID:2724
-
\??\c:\fxlfflx.exec:\fxlfflx.exe73⤵PID:2668
-
\??\c:\lffrlrl.exec:\lffrlrl.exe74⤵PID:2884
-
\??\c:\bhtnth.exec:\bhtnth.exe75⤵PID:2736
-
\??\c:\pdddd.exec:\pdddd.exe76⤵PID:2700
-
\??\c:\rffffll.exec:\rffffll.exe77⤵PID:2752
-
\??\c:\tnhtbb.exec:\tnhtbb.exe78⤵PID:2224
-
\??\c:\jdpvv.exec:\jdpvv.exe79⤵PID:2636
-
\??\c:\jdjpp.exec:\jdjpp.exe80⤵PID:2576
-
\??\c:\xrflrrr.exec:\xrflrrr.exe81⤵PID:1044
-
\??\c:\htbthh.exec:\htbthh.exe82⤵PID:1764
-
\??\c:\7htnnt.exec:\7htnnt.exe83⤵PID:2000
-
\??\c:\1jppj.exec:\1jppj.exe84⤵PID:340
-
\??\c:\xrfllfl.exec:\xrfllfl.exe85⤵PID:2084
-
\??\c:\5nbnhb.exec:\5nbnhb.exe86⤵PID:2820
-
\??\c:\nnhnnb.exec:\nnhnnb.exe87⤵PID:1676
-
\??\c:\jvjjp.exec:\jvjjp.exe88⤵PID:2256
-
\??\c:\vpdvv.exec:\vpdvv.exe89⤵PID:2856
-
\??\c:\xrxxrfl.exec:\xrxxrfl.exe90⤵PID:2708
-
\??\c:\1nthnt.exec:\1nthnt.exe91⤵PID:2508
-
\??\c:\bnbnbt.exec:\bnbnbt.exe92⤵PID:532
-
\??\c:\5djjd.exec:\5djjd.exe93⤵PID:1052
-
\??\c:\9ffxxrl.exec:\9ffxxrl.exe94⤵PID:2412
-
\??\c:\rffflff.exec:\rffflff.exe95⤵PID:2900
-
\??\c:\thbbhb.exec:\thbbhb.exe96⤵PID:1108
-
\??\c:\ppdvv.exec:\ppdvv.exe97⤵PID:2148
-
\??\c:\jvpjd.exec:\jvpjd.exe98⤵PID:2108
-
\??\c:\xfrlxrx.exec:\xfrlxrx.exe99⤵PID:448
-
\??\c:\ttnbhh.exec:\ttnbhh.exe100⤵PID:2608
-
\??\c:\vjdvd.exec:\vjdvd.exe101⤵PID:1736
-
\??\c:\5jvdj.exec:\5jvdj.exe102⤵PID:1060
-
\??\c:\3llrxff.exec:\3llrxff.exe103⤵PID:316
-
\??\c:\9bhbhh.exec:\9bhbhh.exe104⤵PID:2384
-
\??\c:\1dpjd.exec:\1dpjd.exe105⤵PID:1524
-
\??\c:\3dvdd.exec:\3dvdd.exe106⤵PID:2496
-
\??\c:\9lxxffl.exec:\9lxxffl.exe107⤵PID:2112
-
\??\c:\1thnnn.exec:\1thnnn.exe108⤵PID:1700
-
\??\c:\1vjvj.exec:\1vjvj.exe109⤵PID:2348
-
\??\c:\5pdjj.exec:\5pdjj.exe110⤵PID:2428
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe111⤵PID:1288
-
\??\c:\7tnbbh.exec:\7tnbbh.exe112⤵PID:2484
-
\??\c:\ttthnn.exec:\ttthnn.exe113⤵PID:1564
-
\??\c:\3pvpp.exec:\3pvpp.exe114⤵PID:2664
-
\??\c:\1xrrlrl.exec:\1xrrlrl.exe115⤵PID:2528
-
\??\c:\llllrff.exec:\llllrff.exe116⤵PID:2544
-
\??\c:\5hnntb.exec:\5hnntb.exe117⤵PID:2692
-
\??\c:\1jdjv.exec:\1jdjv.exe118⤵PID:2516
-
\??\c:\rrlrxfr.exec:\rrlrxfr.exe119⤵PID:2696
-
\??\c:\xrrlxff.exec:\xrrlxff.exe120⤵PID:2532
-
\??\c:\thtttt.exec:\thtttt.exe121⤵PID:2588
-
\??\c:\vdddd.exec:\vdddd.exe122⤵PID:2144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-