Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 14:10
Static task
static1
Behavioral task
behavioral1
Sample
a16c3203f87b58ae2247950e66499eb31c720170d786b1d37ed3304f9eb6e639N.exe
Resource
win7-20240903-en
General
-
Target
a16c3203f87b58ae2247950e66499eb31c720170d786b1d37ed3304f9eb6e639N.exe
-
Size
454KB
-
MD5
7f1afc6a8cdb558b3d0939c622ca1410
-
SHA1
9a48a872f1815d2edebfddb2530529a648c95c91
-
SHA256
a16c3203f87b58ae2247950e66499eb31c720170d786b1d37ed3304f9eb6e639
-
SHA512
ff439d0659790c109fa2ce27abb7bec9c517ab93e6fb2a65c48939553bb7f75de344ad25ed61fb1f77b90679612789170add74a8ec04ae0c5f4f3745573d2121
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbez:q7Tc2NYHUrAwfMp3CDz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2488-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-36-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2680-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-53-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2848-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-125-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2604-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-182-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2156-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-200-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2448-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-259-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2768-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-269-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-321-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1920-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-446-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2124-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/964-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-631-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2720-645-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-688-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1676-919-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1704-952-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/2876-1076-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1720-1238-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/536-1382-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2484 3vvpv.exe 2616 5pppd.exe 2216 bbntbh.exe 2680 bbhnhb.exe 2736 9jdpj.exe 2888 lfrlxfl.exe 2848 3jdjp.exe 1316 3fffrlr.exe 2556 fxllxxf.exe 2192 xrxxffr.exe 1668 nnhbtt.exe 1640 pdvpv.exe 2604 1ttnbn.exe 276 lxrxffx.exe 2724 9htnbb.exe 2624 nbbbnt.exe 2872 lfxxlrf.exe 2976 ffllxxr.exe 2972 5llxrxl.exe 2188 nnbbnn.exe 2156 fflrrxf.exe 408 7rxflrx.exe 2912 ppjpd.exe 1608 fxfxllx.exe 696 hbhnbh.exe 2448 ddvdp.exe 2768 xrrxflr.exe 3032 vvpvd.exe 1256 nbhbnn.exe 2488 7lxxrxf.exe 2832 tbbnhn.exe 1400 lfxlxxl.exe 1592 nhbhtb.exe 2772 pvdpp.exe 2084 3fxfrfx.exe 2816 3nhnht.exe 1920 5hhntb.exe 2800 5jvvv.exe 1316 rfxxfxr.exe 2864 5tbtbb.exe 2656 tbthnn.exe 576 djdpd.exe 2164 rlllxff.exe 1676 fxxfllx.exe 1380 htnntt.exe 1304 9vjvp.exe 2860 pjppj.exe 1852 xxxxllx.exe 2596 ntthnn.exe 1444 tnthhn.exe 1936 dvpvj.exe 496 7lrllrf.exe 2576 fxxxlxr.exe 3036 ntthtt.exe 2124 vpvdj.exe 2972 vvppv.exe 2148 lfflrfl.exe 1632 bthhnb.exe 448 nhbhnt.exe 964 pdvpd.exe 1088 fllffrl.exe 1644 rfffllx.exe 1812 bhhhtb.exe 1364 5djjp.exe -
resource yara_rule behavioral1/memory/2488-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-321-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1920-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/496-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/964-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-741-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1624-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-793-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-806-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-919-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2712-920-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-995-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-1044-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-1063-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-1096-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-1103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/964-1245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-1270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-1375-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2484 2488 a16c3203f87b58ae2247950e66499eb31c720170d786b1d37ed3304f9eb6e639N.exe 31 PID 2488 wrote to memory of 2484 2488 a16c3203f87b58ae2247950e66499eb31c720170d786b1d37ed3304f9eb6e639N.exe 31 PID 2488 wrote to memory of 2484 2488 a16c3203f87b58ae2247950e66499eb31c720170d786b1d37ed3304f9eb6e639N.exe 31 PID 2488 wrote to memory of 2484 2488 a16c3203f87b58ae2247950e66499eb31c720170d786b1d37ed3304f9eb6e639N.exe 31 PID 2484 wrote to memory of 2616 2484 3vvpv.exe 32 PID 2484 wrote to memory of 2616 2484 3vvpv.exe 32 PID 2484 wrote to memory of 2616 2484 3vvpv.exe 32 PID 2484 wrote to memory of 2616 2484 3vvpv.exe 32 PID 2616 wrote to memory of 2216 2616 5pppd.exe 33 PID 2616 wrote to memory of 2216 2616 5pppd.exe 33 PID 2616 wrote to memory of 2216 2616 5pppd.exe 33 PID 2616 wrote to memory of 2216 2616 5pppd.exe 33 PID 2216 wrote to memory of 2680 2216 bbntbh.exe 34 PID 2216 wrote to memory of 2680 2216 bbntbh.exe 34 PID 2216 wrote to memory of 2680 2216 bbntbh.exe 34 PID 2216 wrote to memory of 2680 2216 bbntbh.exe 34 PID 2680 wrote to memory of 2736 2680 bbhnhb.exe 35 PID 2680 wrote to memory of 2736 2680 bbhnhb.exe 35 PID 2680 wrote to memory of 2736 2680 bbhnhb.exe 35 PID 2680 wrote to memory of 2736 2680 bbhnhb.exe 35 PID 2736 wrote to memory of 2888 2736 9jdpj.exe 36 PID 2736 wrote to memory of 2888 2736 9jdpj.exe 36 PID 2736 wrote to memory of 2888 2736 9jdpj.exe 36 PID 2736 wrote to memory of 2888 2736 9jdpj.exe 36 PID 2888 wrote to memory of 2848 2888 lfrlxfl.exe 37 PID 2888 wrote to memory of 2848 2888 lfrlxfl.exe 37 PID 2888 wrote to memory of 2848 2888 lfrlxfl.exe 37 PID 2888 wrote to memory of 2848 2888 lfrlxfl.exe 37 PID 2848 wrote to memory of 1316 2848 3jdjp.exe 38 PID 2848 wrote to memory of 1316 2848 3jdjp.exe 38 PID 2848 wrote to memory of 1316 2848 3jdjp.exe 38 PID 2848 wrote to memory of 1316 2848 3jdjp.exe 38 PID 1316 wrote to memory of 2556 1316 3fffrlr.exe 39 PID 1316 wrote to memory of 2556 1316 3fffrlr.exe 39 PID 1316 wrote to memory of 2556 1316 3fffrlr.exe 39 PID 1316 wrote to memory of 2556 1316 3fffrlr.exe 39 PID 2556 wrote to memory of 2192 2556 fxllxxf.exe 40 PID 2556 wrote to memory of 2192 2556 fxllxxf.exe 40 PID 2556 wrote to memory of 2192 2556 fxllxxf.exe 40 PID 2556 wrote to memory of 2192 2556 fxllxxf.exe 40 PID 2192 wrote to memory of 1668 2192 xrxxffr.exe 41 PID 2192 wrote to memory of 1668 2192 xrxxffr.exe 41 PID 2192 wrote to memory of 1668 2192 xrxxffr.exe 41 PID 2192 wrote to memory of 1668 2192 xrxxffr.exe 41 PID 1668 wrote to memory of 1640 1668 nnhbtt.exe 42 PID 1668 wrote to memory of 1640 1668 nnhbtt.exe 42 PID 1668 wrote to memory of 1640 1668 nnhbtt.exe 42 PID 1668 wrote to memory of 1640 1668 nnhbtt.exe 42 PID 1640 wrote to memory of 2604 1640 pdvpv.exe 43 PID 1640 wrote to memory of 2604 1640 pdvpv.exe 43 PID 1640 wrote to memory of 2604 1640 pdvpv.exe 43 PID 1640 wrote to memory of 2604 1640 pdvpv.exe 43 PID 2604 wrote to memory of 276 2604 1ttnbn.exe 44 PID 2604 wrote to memory of 276 2604 1ttnbn.exe 44 PID 2604 wrote to memory of 276 2604 1ttnbn.exe 44 PID 2604 wrote to memory of 276 2604 1ttnbn.exe 44 PID 276 wrote to memory of 2724 276 lxrxffx.exe 45 PID 276 wrote to memory of 2724 276 lxrxffx.exe 45 PID 276 wrote to memory of 2724 276 lxrxffx.exe 45 PID 276 wrote to memory of 2724 276 lxrxffx.exe 45 PID 2724 wrote to memory of 2624 2724 9htnbb.exe 46 PID 2724 wrote to memory of 2624 2724 9htnbb.exe 46 PID 2724 wrote to memory of 2624 2724 9htnbb.exe 46 PID 2724 wrote to memory of 2624 2724 9htnbb.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\a16c3203f87b58ae2247950e66499eb31c720170d786b1d37ed3304f9eb6e639N.exe"C:\Users\Admin\AppData\Local\Temp\a16c3203f87b58ae2247950e66499eb31c720170d786b1d37ed3304f9eb6e639N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\3vvpv.exec:\3vvpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\5pppd.exec:\5pppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\bbntbh.exec:\bbntbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\bbhnhb.exec:\bbhnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\9jdpj.exec:\9jdpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\lfrlxfl.exec:\lfrlxfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\3jdjp.exec:\3jdjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\3fffrlr.exec:\3fffrlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\fxllxxf.exec:\fxllxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\xrxxffr.exec:\xrxxffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\nnhbtt.exec:\nnhbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\pdvpv.exec:\pdvpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\1ttnbn.exec:\1ttnbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\lxrxffx.exec:\lxrxffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:276 -
\??\c:\9htnbb.exec:\9htnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\nbbbnt.exec:\nbbbnt.exe17⤵
- Executes dropped EXE
PID:2624 -
\??\c:\lfxxlrf.exec:\lfxxlrf.exe18⤵
- Executes dropped EXE
PID:2872 -
\??\c:\ffllxxr.exec:\ffllxxr.exe19⤵
- Executes dropped EXE
PID:2976 -
\??\c:\5llxrxl.exec:\5llxrxl.exe20⤵
- Executes dropped EXE
PID:2972 -
\??\c:\nnbbnn.exec:\nnbbnn.exe21⤵
- Executes dropped EXE
PID:2188 -
\??\c:\fflrrxf.exec:\fflrrxf.exe22⤵
- Executes dropped EXE
PID:2156 -
\??\c:\7rxflrx.exec:\7rxflrx.exe23⤵
- Executes dropped EXE
PID:408 -
\??\c:\ppjpd.exec:\ppjpd.exe24⤵
- Executes dropped EXE
PID:2912 -
\??\c:\fxfxllx.exec:\fxfxllx.exe25⤵
- Executes dropped EXE
PID:1608 -
\??\c:\hbhnbh.exec:\hbhnbh.exe26⤵
- Executes dropped EXE
PID:696 -
\??\c:\ddvdp.exec:\ddvdp.exe27⤵
- Executes dropped EXE
PID:2448 -
\??\c:\xrrxflr.exec:\xrrxflr.exe28⤵
- Executes dropped EXE
PID:2768 -
\??\c:\vvpvd.exec:\vvpvd.exe29⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nbhbnn.exec:\nbhbnn.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1256 -
\??\c:\7lxxrxf.exec:\7lxxrxf.exe31⤵
- Executes dropped EXE
PID:2488 -
\??\c:\tbbnhn.exec:\tbbnhn.exe32⤵
- Executes dropped EXE
PID:2832 -
\??\c:\lfxlxxl.exec:\lfxlxxl.exe33⤵
- Executes dropped EXE
PID:1400 -
\??\c:\nhbhtb.exec:\nhbhtb.exe34⤵
- Executes dropped EXE
PID:1592 -
\??\c:\pvdpp.exec:\pvdpp.exe35⤵
- Executes dropped EXE
PID:2772 -
\??\c:\3fxfrfx.exec:\3fxfrfx.exe36⤵
- Executes dropped EXE
PID:2084 -
\??\c:\3nhnht.exec:\3nhnht.exe37⤵
- Executes dropped EXE
PID:2816 -
\??\c:\5hhntb.exec:\5hhntb.exe38⤵
- Executes dropped EXE
PID:1920 -
\??\c:\5jvvv.exec:\5jvvv.exe39⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rfxxfxr.exec:\rfxxfxr.exe40⤵
- Executes dropped EXE
PID:1316 -
\??\c:\5tbtbb.exec:\5tbtbb.exe41⤵
- Executes dropped EXE
PID:2864 -
\??\c:\tbthnn.exec:\tbthnn.exe42⤵
- Executes dropped EXE
PID:2656 -
\??\c:\djdpd.exec:\djdpd.exe43⤵
- Executes dropped EXE
PID:576 -
\??\c:\rlllxff.exec:\rlllxff.exe44⤵
- Executes dropped EXE
PID:2164 -
\??\c:\fxxfllx.exec:\fxxfllx.exe45⤵
- Executes dropped EXE
PID:1676 -
\??\c:\htnntt.exec:\htnntt.exe46⤵
- Executes dropped EXE
PID:1380 -
\??\c:\9vjvp.exec:\9vjvp.exe47⤵
- Executes dropped EXE
PID:1304 -
\??\c:\pjppj.exec:\pjppj.exe48⤵
- Executes dropped EXE
PID:2860 -
\??\c:\xxxxllx.exec:\xxxxllx.exe49⤵
- Executes dropped EXE
PID:1852 -
\??\c:\ntthnn.exec:\ntthnn.exe50⤵
- Executes dropped EXE
PID:2596 -
\??\c:\tnthhn.exec:\tnthhn.exe51⤵
- Executes dropped EXE
PID:1444 -
\??\c:\dvpvj.exec:\dvpvj.exe52⤵
- Executes dropped EXE
PID:1936 -
\??\c:\7lrllrf.exec:\7lrllrf.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:496 -
\??\c:\fxxxlxr.exec:\fxxxlxr.exe54⤵
- Executes dropped EXE
PID:2576 -
\??\c:\ntthtt.exec:\ntthtt.exe55⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vpvdj.exec:\vpvdj.exe56⤵
- Executes dropped EXE
PID:2124 -
\??\c:\vvppv.exec:\vvppv.exe57⤵
- Executes dropped EXE
PID:2972 -
\??\c:\lfflrfl.exec:\lfflrfl.exe58⤵
- Executes dropped EXE
PID:2148 -
\??\c:\bthhnb.exec:\bthhnb.exe59⤵
- Executes dropped EXE
PID:1632 -
\??\c:\nhbhnt.exec:\nhbhnt.exe60⤵
- Executes dropped EXE
PID:448 -
\??\c:\pdvpd.exec:\pdvpd.exe61⤵
- Executes dropped EXE
PID:964 -
\??\c:\fllffrl.exec:\fllffrl.exe62⤵
- Executes dropped EXE
PID:1088 -
\??\c:\rfffllx.exec:\rfffllx.exe63⤵
- Executes dropped EXE
PID:1644 -
\??\c:\bhhhtb.exec:\bhhhtb.exe64⤵
- Executes dropped EXE
PID:1812 -
\??\c:\5djjp.exec:\5djjp.exe65⤵
- Executes dropped EXE
PID:1364 -
\??\c:\dvvpv.exec:\dvvpv.exe66⤵PID:2368
-
\??\c:\lxrrffl.exec:\lxrrffl.exe67⤵PID:896
-
\??\c:\btbbtt.exec:\btbbtt.exe68⤵PID:2936
-
\??\c:\bthtbh.exec:\bthtbh.exe69⤵PID:1360
-
\??\c:\vvpvp.exec:\vvpvp.exe70⤵PID:824
-
\??\c:\fxflxxr.exec:\fxflxxr.exe71⤵PID:320
-
\??\c:\5lrrxxr.exec:\5lrrxxr.exe72⤵PID:1972
-
\??\c:\bbthtb.exec:\bbthtb.exe73⤵PID:2628
-
\??\c:\5jjjp.exec:\5jjjp.exe74⤵PID:1600
-
\??\c:\vjddj.exec:\vjddj.exe75⤵PID:2268
-
\??\c:\9lfxlrr.exec:\9lfxlrr.exe76⤵PID:2684
-
\??\c:\nbtbhh.exec:\nbtbhh.exe77⤵PID:2892
-
\??\c:\7bthtb.exec:\7bthtb.exe78⤵PID:2736
-
\??\c:\3vjjp.exec:\3vjjp.exe79⤵PID:2848
-
\??\c:\rrlxllf.exec:\rrlxllf.exe80⤵PID:2800
-
\??\c:\lfflfff.exec:\lfflfff.exe81⤵PID:2648
-
\??\c:\5ttbbh.exec:\5ttbbh.exe82⤵PID:536
-
\??\c:\9nhnht.exec:\9nhnht.exe83⤵PID:2984
-
\??\c:\jjjpd.exec:\jjjpd.exe84⤵PID:1700
-
\??\c:\rrfllrl.exec:\rrfllrl.exe85⤵PID:1128
-
\??\c:\btnnbn.exec:\btnnbn.exe86⤵PID:1368
-
\??\c:\9hnntb.exec:\9hnntb.exe87⤵PID:2720
-
\??\c:\vpddj.exec:\vpddj.exe88⤵PID:1640
-
\??\c:\rfrrllf.exec:\rfrrllf.exe89⤵PID:1164
-
\??\c:\nhttnt.exec:\nhttnt.exe90⤵PID:1588
-
\??\c:\nhbtbh.exec:\nhbtbh.exe91⤵PID:1612
-
\??\c:\jvjjd.exec:\jvjjd.exe92⤵PID:1816
-
\??\c:\ffxlrrf.exec:\ffxlrrf.exe93⤵PID:768
-
\??\c:\xrlxffl.exec:\xrlxffl.exe94⤵PID:3012
-
\??\c:\nhbnbh.exec:\nhbnbh.exe95⤵PID:2968
-
\??\c:\dvjjv.exec:\dvjjv.exe96⤵PID:3036
-
\??\c:\7pvdp.exec:\7pvdp.exe97⤵PID:1860
-
\??\c:\rfxxffr.exec:\rfxxffr.exe98⤵PID:2972
-
\??\c:\hhbhnt.exec:\hhbhnt.exe99⤵PID:112
-
\??\c:\5bntnb.exec:\5bntnb.exe100⤵PID:2516
-
\??\c:\dvjjd.exec:\dvjjd.exe101⤵PID:3008
-
\??\c:\llrfrfx.exec:\llrfrfx.exe102⤵PID:1792
-
\??\c:\ttnbnt.exec:\ttnbnt.exe103⤵PID:1624
-
\??\c:\jdvvd.exec:\jdvvd.exe104⤵PID:2476
-
\??\c:\ffxfxfx.exec:\ffxfxfx.exe105⤵PID:2908
-
\??\c:\xxfrflf.exec:\xxfrflf.exe106⤵PID:1808
-
\??\c:\hhhnht.exec:\hhhnht.exe107⤵PID:1012
-
\??\c:\9jjpd.exec:\9jjpd.exe108⤵PID:2208
-
\??\c:\flfxflx.exec:\flfxflx.exe109⤵PID:2052
-
\??\c:\xxrxflf.exec:\xxrxflf.exe110⤵PID:1256
-
\??\c:\nntthn.exec:\nntthn.exe111⤵PID:2504
-
\??\c:\hbhthh.exec:\hbhthh.exe112⤵PID:1544
-
\??\c:\7vpdj.exec:\7vpdj.exe113⤵PID:1400
-
\??\c:\xrrlxlf.exec:\xrrlxlf.exe114⤵PID:2628
-
\??\c:\nnnhhh.exec:\nnnhhh.exe115⤵PID:2176
-
\??\c:\bbhnhn.exec:\bbhnhn.exe116⤵PID:2732
-
\??\c:\7vvdp.exec:\7vvdp.exe117⤵PID:2788
-
\??\c:\fxrxrfx.exec:\fxrxrfx.exe118⤵PID:2824
-
\??\c:\tbtbbb.exec:\tbtbbb.exe119⤵PID:2696
-
\??\c:\ddddd.exec:\ddddd.exe120⤵PID:2848
-
\??\c:\3pddj.exec:\3pddj.exe121⤵PID:2708
-
\??\c:\lfrxlxl.exec:\lfrxlxl.exe122⤵PID:2648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-