Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
1273a594a6afb7683d8af6905d1af3608891b1792450ae608f54761044421108.exe
Resource
win7-20240903-en
General
-
Target
1273a594a6afb7683d8af6905d1af3608891b1792450ae608f54761044421108.exe
-
Size
454KB
-
MD5
4431bc822bc994164ec19348049647bf
-
SHA1
0ef4aea2d83d2bedb102a899971d73be6103e173
-
SHA256
1273a594a6afb7683d8af6905d1af3608891b1792450ae608f54761044421108
-
SHA512
44460bfa3b96bf37a7f0291cd8f93785775011434a47adde5b460f0e14f6ecb6ec1796561126b89a543032a2deb19d9fed1222053e957cfa75cf96500d1c69f2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2520-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-53-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3016-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-73-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2612-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-94-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2296-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1196-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-198-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1916-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-217-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2224-234-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2224-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/660-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-318-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1832-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-320-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2728-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-531-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2476-540-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2400-571-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2676-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-652-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2252-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-820-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1712-894-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/808-997-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/3008-1093-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1860 pjdvv.exe 1736 1lfxllr.exe 2328 3tnntt.exe 1852 flrllfx.exe 2852 tbbhbb.exe 3016 7vjvv.exe 2760 jdjjj.exe 2736 9bbbhb.exe 2612 7hhhth.exe 2296 vvvjv.exe 2648 vpjjp.exe 1788 3flrffl.exe 2808 bbntbb.exe 2840 xxrfrrx.exe 2944 rlxrxlx.exe 1304 jjvdv.exe 1740 7xrxxxx.exe 2252 jjpdp.exe 1196 9llrxfl.exe 2964 ntntbb.exe 1916 pvvdp.exe 1772 7btbhn.exe 1952 jdjjv.exe 324 dddjv.exe 2224 dvjpv.exe 2196 bttbtb.exe 2680 vpjvd.exe 1796 llxxffr.exe 2036 bbtbnn.exe 1624 xlfflxf.exe 2028 hbtbnn.exe 2352 1dvdd.exe 2408 tbtnht.exe 660 jppvj.exe 1832 9xrlrxf.exe 2728 rlxlrxf.exe 2912 nbbbhh.exe 2732 dpddp.exe 2892 xrlxxfx.exe 2632 rllflrf.exe 1288 1bhttb.exe 2736 vdjpd.exe 2596 1flxxfl.exe 2056 xrflrxf.exe 2156 hhbthh.exe 840 jdvdj.exe 1628 vpjpp.exe 2356 ffxllrx.exe 2700 xrlfrxr.exe 2936 btnhhh.exe 2800 vdjvv.exe 2584 rrrxrxl.exe 2128 xrxxxfl.exe 1500 tnnnbh.exe 2252 jdppv.exe 2024 ppvvv.exe 1672 rxrxrxl.exe 1436 tnbbnb.exe 352 nbnttb.exe 1772 1pdjj.exe 1372 llxfxrf.exe 1952 xrlrflx.exe 1776 hbtntb.exe 772 pvdvv.exe -
resource yara_rule behavioral1/memory/2520-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/660-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-518-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2436-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-813-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-820-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2364-821-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-828-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-874-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-894-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-944-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-963-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-970-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-998-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-1023-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-1048-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-1079-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-1092-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-1093-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1864-1103-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfflxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2520 wrote to memory of 1860 2520 1273a594a6afb7683d8af6905d1af3608891b1792450ae608f54761044421108.exe 30 PID 2520 wrote to memory of 1860 2520 1273a594a6afb7683d8af6905d1af3608891b1792450ae608f54761044421108.exe 30 PID 2520 wrote to memory of 1860 2520 1273a594a6afb7683d8af6905d1af3608891b1792450ae608f54761044421108.exe 30 PID 2520 wrote to memory of 1860 2520 1273a594a6afb7683d8af6905d1af3608891b1792450ae608f54761044421108.exe 30 PID 1860 wrote to memory of 1736 1860 pjdvv.exe 31 PID 1860 wrote to memory of 1736 1860 pjdvv.exe 31 PID 1860 wrote to memory of 1736 1860 pjdvv.exe 31 PID 1860 wrote to memory of 1736 1860 pjdvv.exe 31 PID 1736 wrote to memory of 2328 1736 1lfxllr.exe 32 PID 1736 wrote to memory of 2328 1736 1lfxllr.exe 32 PID 1736 wrote to memory of 2328 1736 1lfxllr.exe 32 PID 1736 wrote to memory of 2328 1736 1lfxllr.exe 32 PID 2328 wrote to memory of 1852 2328 3tnntt.exe 33 PID 2328 wrote to memory of 1852 2328 3tnntt.exe 33 PID 2328 wrote to memory of 1852 2328 3tnntt.exe 33 PID 2328 wrote to memory of 1852 2328 3tnntt.exe 33 PID 1852 wrote to memory of 2852 1852 flrllfx.exe 34 PID 1852 wrote to memory of 2852 1852 flrllfx.exe 34 PID 1852 wrote to memory of 2852 1852 flrllfx.exe 34 PID 1852 wrote to memory of 2852 1852 flrllfx.exe 34 PID 2852 wrote to memory of 3016 2852 tbbhbb.exe 35 PID 2852 wrote to memory of 3016 2852 tbbhbb.exe 35 PID 2852 wrote to memory of 3016 2852 tbbhbb.exe 35 PID 2852 wrote to memory of 3016 2852 tbbhbb.exe 35 PID 3016 wrote to memory of 2760 3016 7vjvv.exe 36 PID 3016 wrote to memory of 2760 3016 7vjvv.exe 36 PID 3016 wrote to memory of 2760 3016 7vjvv.exe 36 PID 3016 wrote to memory of 2760 3016 7vjvv.exe 36 PID 2760 wrote to memory of 2736 2760 jdjjj.exe 37 PID 2760 wrote to memory of 2736 2760 jdjjj.exe 37 PID 2760 wrote to memory of 2736 2760 jdjjj.exe 37 PID 2760 wrote to memory of 2736 2760 jdjjj.exe 37 PID 2736 wrote to memory of 2612 2736 9bbbhb.exe 38 PID 2736 wrote to memory of 2612 2736 9bbbhb.exe 38 PID 2736 wrote to memory of 2612 2736 9bbbhb.exe 38 PID 2736 wrote to memory of 2612 2736 9bbbhb.exe 38 PID 2612 wrote to memory of 2296 2612 7hhhth.exe 39 PID 2612 wrote to memory of 2296 2612 7hhhth.exe 39 PID 2612 wrote to memory of 2296 2612 7hhhth.exe 39 PID 2612 wrote to memory of 2296 2612 7hhhth.exe 39 PID 2296 wrote to memory of 2648 2296 vvvjv.exe 40 PID 2296 wrote to memory of 2648 2296 vvvjv.exe 40 PID 2296 wrote to memory of 2648 2296 vvvjv.exe 40 PID 2296 wrote to memory of 2648 2296 vvvjv.exe 40 PID 2648 wrote to memory of 1788 2648 vpjjp.exe 41 PID 2648 wrote to memory of 1788 2648 vpjjp.exe 41 PID 2648 wrote to memory of 1788 2648 vpjjp.exe 41 PID 2648 wrote to memory of 1788 2648 vpjjp.exe 41 PID 1788 wrote to memory of 2808 1788 3flrffl.exe 42 PID 1788 wrote to memory of 2808 1788 3flrffl.exe 42 PID 1788 wrote to memory of 2808 1788 3flrffl.exe 42 PID 1788 wrote to memory of 2808 1788 3flrffl.exe 42 PID 2808 wrote to memory of 2840 2808 bbntbb.exe 43 PID 2808 wrote to memory of 2840 2808 bbntbb.exe 43 PID 2808 wrote to memory of 2840 2808 bbntbb.exe 43 PID 2808 wrote to memory of 2840 2808 bbntbb.exe 43 PID 2840 wrote to memory of 2944 2840 xxrfrrx.exe 44 PID 2840 wrote to memory of 2944 2840 xxrfrrx.exe 44 PID 2840 wrote to memory of 2944 2840 xxrfrrx.exe 44 PID 2840 wrote to memory of 2944 2840 xxrfrrx.exe 44 PID 2944 wrote to memory of 1304 2944 rlxrxlx.exe 45 PID 2944 wrote to memory of 1304 2944 rlxrxlx.exe 45 PID 2944 wrote to memory of 1304 2944 rlxrxlx.exe 45 PID 2944 wrote to memory of 1304 2944 rlxrxlx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1273a594a6afb7683d8af6905d1af3608891b1792450ae608f54761044421108.exe"C:\Users\Admin\AppData\Local\Temp\1273a594a6afb7683d8af6905d1af3608891b1792450ae608f54761044421108.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\pjdvv.exec:\pjdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\1lfxllr.exec:\1lfxllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\3tnntt.exec:\3tnntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\flrllfx.exec:\flrllfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\tbbhbb.exec:\tbbhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\7vjvv.exec:\7vjvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\jdjjj.exec:\jdjjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\9bbbhb.exec:\9bbbhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\7hhhth.exec:\7hhhth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\vvvjv.exec:\vvvjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\vpjjp.exec:\vpjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\3flrffl.exec:\3flrffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\bbntbb.exec:\bbntbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\xxrfrrx.exec:\xxrfrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rlxrxlx.exec:\rlxrxlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\jjvdv.exec:\jjvdv.exe17⤵
- Executes dropped EXE
PID:1304 -
\??\c:\7xrxxxx.exec:\7xrxxxx.exe18⤵
- Executes dropped EXE
PID:1740 -
\??\c:\jjpdp.exec:\jjpdp.exe19⤵
- Executes dropped EXE
PID:2252 -
\??\c:\9llrxfl.exec:\9llrxfl.exe20⤵
- Executes dropped EXE
PID:1196 -
\??\c:\ntntbb.exec:\ntntbb.exe21⤵
- Executes dropped EXE
PID:2964 -
\??\c:\pvvdp.exec:\pvvdp.exe22⤵
- Executes dropped EXE
PID:1916 -
\??\c:\7btbhn.exec:\7btbhn.exe23⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jdjjv.exec:\jdjjv.exe24⤵
- Executes dropped EXE
PID:1952 -
\??\c:\dddjv.exec:\dddjv.exe25⤵
- Executes dropped EXE
PID:324 -
\??\c:\dvjpv.exec:\dvjpv.exe26⤵
- Executes dropped EXE
PID:2224 -
\??\c:\bttbtb.exec:\bttbtb.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2196 -
\??\c:\vpjvd.exec:\vpjvd.exe28⤵
- Executes dropped EXE
PID:2680 -
\??\c:\llxxffr.exec:\llxxffr.exe29⤵
- Executes dropped EXE
PID:1796 -
\??\c:\bbtbnn.exec:\bbtbnn.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2036 -
\??\c:\xlfflxf.exec:\xlfflxf.exe31⤵
- Executes dropped EXE
PID:1624 -
\??\c:\hbtbnn.exec:\hbtbnn.exe32⤵
- Executes dropped EXE
PID:2028 -
\??\c:\1dvdd.exec:\1dvdd.exe33⤵
- Executes dropped EXE
PID:2352 -
\??\c:\tbtnht.exec:\tbtnht.exe34⤵
- Executes dropped EXE
PID:2408 -
\??\c:\jppvj.exec:\jppvj.exe35⤵
- Executes dropped EXE
PID:660 -
\??\c:\9xrlrxf.exec:\9xrlrxf.exe36⤵
- Executes dropped EXE
PID:1832 -
\??\c:\rlxlrxf.exec:\rlxlrxf.exe37⤵
- Executes dropped EXE
PID:2728 -
\??\c:\nbbbhh.exec:\nbbbhh.exe38⤵
- Executes dropped EXE
PID:2912 -
\??\c:\dpddp.exec:\dpddp.exe39⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xrlxxfx.exec:\xrlxxfx.exe40⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rllflrf.exec:\rllflrf.exe41⤵
- Executes dropped EXE
PID:2632 -
\??\c:\1bhttb.exec:\1bhttb.exe42⤵
- Executes dropped EXE
PID:1288 -
\??\c:\vdjpd.exec:\vdjpd.exe43⤵
- Executes dropped EXE
PID:2736 -
\??\c:\1flxxfl.exec:\1flxxfl.exe44⤵
- Executes dropped EXE
PID:2596 -
\??\c:\xrflrxf.exec:\xrflrxf.exe45⤵
- Executes dropped EXE
PID:2056 -
\??\c:\hhbthh.exec:\hhbthh.exe46⤵
- Executes dropped EXE
PID:2156 -
\??\c:\jdvdj.exec:\jdvdj.exe47⤵
- Executes dropped EXE
PID:840 -
\??\c:\vpjpp.exec:\vpjpp.exe48⤵
- Executes dropped EXE
PID:1628 -
\??\c:\ffxllrx.exec:\ffxllrx.exe49⤵
- Executes dropped EXE
PID:2356 -
\??\c:\xrlfrxr.exec:\xrlfrxr.exe50⤵
- Executes dropped EXE
PID:2700 -
\??\c:\btnhhh.exec:\btnhhh.exe51⤵
- Executes dropped EXE
PID:2936 -
\??\c:\vdjvv.exec:\vdjvv.exe52⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rrrxrxl.exec:\rrrxrxl.exe53⤵
- Executes dropped EXE
PID:2584 -
\??\c:\xrxxxfl.exec:\xrxxxfl.exe54⤵
- Executes dropped EXE
PID:2128 -
\??\c:\tnnnbh.exec:\tnnnbh.exe55⤵
- Executes dropped EXE
PID:1500 -
\??\c:\jdppv.exec:\jdppv.exe56⤵
- Executes dropped EXE
PID:2252 -
\??\c:\ppvvv.exec:\ppvvv.exe57⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rxrxrxl.exec:\rxrxrxl.exe58⤵
- Executes dropped EXE
PID:1672 -
\??\c:\tnbbnb.exec:\tnbbnb.exe59⤵
- Executes dropped EXE
PID:1436 -
\??\c:\nbnttb.exec:\nbnttb.exe60⤵
- Executes dropped EXE
PID:352 -
\??\c:\1pdjj.exec:\1pdjj.exe61⤵
- Executes dropped EXE
PID:1772 -
\??\c:\llxfxrf.exec:\llxfxrf.exe62⤵
- Executes dropped EXE
PID:1372 -
\??\c:\xrlrflx.exec:\xrlrflx.exe63⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hbtntb.exec:\hbtntb.exe64⤵
- Executes dropped EXE
PID:1776 -
\??\c:\pvdvv.exec:\pvdvv.exe65⤵
- Executes dropped EXE
PID:772 -
\??\c:\1ddpd.exec:\1ddpd.exe66⤵PID:2260
-
\??\c:\7xrrfxl.exec:\7xrrfxl.exe67⤵PID:2436
-
\??\c:\9tnhnn.exec:\9tnhnn.exe68⤵PID:2680
-
\??\c:\bnbtbn.exec:\bnbtbn.exe69⤵PID:2476
-
\??\c:\djvvj.exec:\djvvj.exe70⤵PID:2684
-
\??\c:\fxllrrf.exec:\fxllrrf.exe71⤵PID:2348
-
\??\c:\7xffrxl.exec:\7xffrxl.exe72⤵PID:3024
-
\??\c:\3nhhnh.exec:\3nhhnh.exe73⤵PID:1816
-
\??\c:\jjvpv.exec:\jjvpv.exe74⤵PID:2400
-
\??\c:\jvppv.exec:\jvppv.exe75⤵PID:1588
-
\??\c:\7xrrllr.exec:\7xrrllr.exe76⤵PID:1720
-
\??\c:\btbbbb.exec:\btbbbb.exe77⤵PID:660
-
\??\c:\7bthnb.exec:\7bthnb.exe78⤵PID:2748
-
\??\c:\9vvjv.exec:\9vvjv.exe79⤵PID:2092
-
\??\c:\frffllr.exec:\frffllr.exe80⤵PID:2852
-
\??\c:\xrxxffl.exec:\xrxxffl.exe81⤵PID:2604
-
\??\c:\7hnbnb.exec:\7hnbnb.exe82⤵PID:3016
-
\??\c:\dvjjp.exec:\dvjjp.exe83⤵PID:2972
-
\??\c:\xfflxfx.exec:\xfflxfx.exe84⤵
- System Location Discovery: System Language Discovery
PID:2768 -
\??\c:\xrfflrx.exec:\xrfflrx.exe85⤵PID:2712
-
\??\c:\tnhntb.exec:\tnhntb.exe86⤵PID:2676
-
\??\c:\vjdpd.exec:\vjdpd.exe87⤵PID:1892
-
\??\c:\xrrllfl.exec:\xrrllfl.exe88⤵PID:1896
-
\??\c:\xrrrllf.exec:\xrrrllf.exe89⤵PID:1944
-
\??\c:\hnbbtt.exec:\hnbbtt.exe90⤵PID:1788
-
\??\c:\pjdpp.exec:\pjdpp.exe91⤵PID:2956
-
\??\c:\5jddd.exec:\5jddd.exe92⤵PID:2828
-
\??\c:\xlxfllx.exec:\xlxfllx.exe93⤵PID:2940
-
\??\c:\hbbntn.exec:\hbbntn.exe94⤵PID:2792
-
\??\c:\nhttbh.exec:\nhttbh.exe95⤵PID:2800
-
\??\c:\dvvjj.exec:\dvvjj.exe96⤵PID:1904
-
\??\c:\9lfxxxx.exec:\9lfxxxx.exe97⤵PID:1508
-
\??\c:\fxllllx.exec:\fxllllx.exe98⤵PID:2064
-
\??\c:\7nhhhn.exec:\7nhhhn.exe99⤵PID:2252
-
\??\c:\7vvdj.exec:\7vvdj.exe100⤵PID:1484
-
\??\c:\pjvjp.exec:\pjvjp.exe101⤵PID:1240
-
\??\c:\xlffrrf.exec:\xlffrrf.exe102⤵PID:3032
-
\??\c:\thtttn.exec:\thtttn.exe103⤵PID:1524
-
\??\c:\bbtnnh.exec:\bbtnnh.exe104⤵PID:1640
-
\??\c:\jdvjv.exec:\jdvjv.exe105⤵PID:1660
-
\??\c:\rlxfrxr.exec:\rlxfrxr.exe106⤵PID:1540
-
\??\c:\thbbbb.exec:\thbbbb.exe107⤵PID:2460
-
\??\c:\nbbbbt.exec:\nbbbbt.exe108⤵PID:768
-
\??\c:\3ddjp.exec:\3ddjp.exe109⤵PID:2412
-
\??\c:\fxrxxxx.exec:\fxrxxxx.exe110⤵PID:580
-
\??\c:\ffxfllr.exec:\ffxfllr.exe111⤵PID:2332
-
\??\c:\btnntb.exec:\btnntb.exe112⤵PID:2680
-
\??\c:\jpdjp.exec:\jpdjp.exe113⤵PID:2076
-
\??\c:\9vpjp.exec:\9vpjp.exe114⤵PID:2684
-
\??\c:\lfxrffl.exec:\lfxrffl.exe115⤵PID:2364
-
\??\c:\hhnthn.exec:\hhnthn.exe116⤵PID:1860
-
\??\c:\hbtntt.exec:\hbtntt.exe117⤵PID:1560
-
\??\c:\vdvpp.exec:\vdvpp.exe118⤵PID:1140
-
\??\c:\7fffxxl.exec:\7fffxxl.exe119⤵PID:2328
-
\??\c:\xlffxfl.exec:\xlffxfl.exe120⤵PID:2168
-
\??\c:\hhtthb.exec:\hhtthb.exe121⤵PID:2324
-
\??\c:\jvjdv.exec:\jvjdv.exe122⤵PID:2916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-