Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 15:41
Static task
static1
Behavioral task
behavioral1
Sample
7d4e5a991dc90508f420573b7b3bfebeee329bf2b26d91bd972acd3327940e41.exe
Resource
win7-20240903-en
General
-
Target
7d4e5a991dc90508f420573b7b3bfebeee329bf2b26d91bd972acd3327940e41.exe
-
Size
454KB
-
MD5
a665cc6203e7c92f90676d458e9dffb1
-
SHA1
9e10bb4afdf9c4e79485da562ec15223a65a4ef5
-
SHA256
7d4e5a991dc90508f420573b7b3bfebeee329bf2b26d91bd972acd3327940e41
-
SHA512
1301250d8939359f8af928ecda718341b0352bc6a4b211f48c5c758443f747b62edb8f88b4ff3f68be000be964fbf513912e31815228e26bf3defeb97da1eec7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeO:q7Tc2NYHUrAwfMp3CDO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/1668-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-95-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2608-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/992-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/992-116-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/568-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/828-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/828-221-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1428-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1452-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-431-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2160-466-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1860-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1452-662-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-679-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2768-703-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2500-746-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2660 3jjdp.exe 2820 1bhbhn.exe 2556 ppddp.exe 2144 rlxflrf.exe 3032 5hnhhb.exe 2552 7vppp.exe 2988 ttnnbh.exe 2464 nhbbnn.exe 2608 5xrrfff.exe 2872 5hbhnn.exe 2440 9vdvv.exe 992 nhbbnn.exe 1408 hthhtn.exe 568 5jddj.exe 1912 frxfffl.exe 2536 vdpdj.exe 484 fxfrlxr.exe 620 tbhtbb.exe 2124 vjdjp.exe 2280 7rffllr.exe 2944 btnnbb.exe 2168 5pppv.exe 828 xlfflrx.exe 1784 dpjpv.exe 1656 frffxxf.exe 1856 9httbb.exe 1636 ddpvj.exe 1428 nnbhtt.exe 3012 1vdvv.exe 2696 9bttnn.exe 2408 nhttbh.exe 2820 jvjdp.exe 2844 lxllrxx.exe 2676 dvjjv.exe 2744 lfrxflr.exe 2824 9fxflfr.exe 2728 9tnhnt.exe 2724 vjjjp.exe 2624 frlfrrx.exe 2848 tthbbn.exe 108 5nbnnn.exe 2976 pvvpp.exe 1616 rlfxffl.exe 2384 7xfflrr.exe 992 bbtbhn.exe 1408 3pdvd.exe 1452 9xffrxl.exe 1416 1xllllr.exe 1956 bntbhh.exe 1348 3djdd.exe 484 pjvdd.exe 2136 rflffrr.exe 2428 hthhtn.exe 988 jdjdd.exe 2280 7lxrrxx.exe 2160 7xrrlxf.exe 2948 bnbbhh.exe 396 vjpvv.exe 2468 9vvdp.exe 1784 rffrrfx.exe 340 btnntn.exe 2328 3hnhnh.exe 1584 vpddj.exe 1860 frxxxrl.exe -
resource yara_rule behavioral1/memory/1668-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/992-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-493-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2328-506-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1860-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-679-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2768-703-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1916-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-753-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllllxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7d4e5a991dc90508f420573b7b3bfebeee329bf2b26d91bd972acd3327940e41.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1668 wrote to memory of 2660 1668 7d4e5a991dc90508f420573b7b3bfebeee329bf2b26d91bd972acd3327940e41.exe 31 PID 1668 wrote to memory of 2660 1668 7d4e5a991dc90508f420573b7b3bfebeee329bf2b26d91bd972acd3327940e41.exe 31 PID 1668 wrote to memory of 2660 1668 7d4e5a991dc90508f420573b7b3bfebeee329bf2b26d91bd972acd3327940e41.exe 31 PID 1668 wrote to memory of 2660 1668 7d4e5a991dc90508f420573b7b3bfebeee329bf2b26d91bd972acd3327940e41.exe 31 PID 2660 wrote to memory of 2820 2660 3jjdp.exe 32 PID 2660 wrote to memory of 2820 2660 3jjdp.exe 32 PID 2660 wrote to memory of 2820 2660 3jjdp.exe 32 PID 2660 wrote to memory of 2820 2660 3jjdp.exe 32 PID 2820 wrote to memory of 2556 2820 1bhbhn.exe 33 PID 2820 wrote to memory of 2556 2820 1bhbhn.exe 33 PID 2820 wrote to memory of 2556 2820 1bhbhn.exe 33 PID 2820 wrote to memory of 2556 2820 1bhbhn.exe 33 PID 2556 wrote to memory of 2144 2556 ppddp.exe 34 PID 2556 wrote to memory of 2144 2556 ppddp.exe 34 PID 2556 wrote to memory of 2144 2556 ppddp.exe 34 PID 2556 wrote to memory of 2144 2556 ppddp.exe 34 PID 2144 wrote to memory of 3032 2144 rlxflrf.exe 35 PID 2144 wrote to memory of 3032 2144 rlxflrf.exe 35 PID 2144 wrote to memory of 3032 2144 rlxflrf.exe 35 PID 2144 wrote to memory of 3032 2144 rlxflrf.exe 35 PID 3032 wrote to memory of 2552 3032 5hnhhb.exe 36 PID 3032 wrote to memory of 2552 3032 5hnhhb.exe 36 PID 3032 wrote to memory of 2552 3032 5hnhhb.exe 36 PID 3032 wrote to memory of 2552 3032 5hnhhb.exe 36 PID 2552 wrote to memory of 2988 2552 7vppp.exe 37 PID 2552 wrote to memory of 2988 2552 7vppp.exe 37 PID 2552 wrote to memory of 2988 2552 7vppp.exe 37 PID 2552 wrote to memory of 2988 2552 7vppp.exe 37 PID 2988 wrote to memory of 2464 2988 ttnnbh.exe 38 PID 2988 wrote to memory of 2464 2988 ttnnbh.exe 38 PID 2988 wrote to memory of 2464 2988 ttnnbh.exe 38 PID 2988 wrote to memory of 2464 2988 ttnnbh.exe 38 PID 2464 wrote to memory of 2608 2464 nhbbnn.exe 39 PID 2464 wrote to memory of 2608 2464 nhbbnn.exe 39 PID 2464 wrote to memory of 2608 2464 nhbbnn.exe 39 PID 2464 wrote to memory of 2608 2464 nhbbnn.exe 39 PID 2608 wrote to memory of 2872 2608 5xrrfff.exe 40 PID 2608 wrote to memory of 2872 2608 5xrrfff.exe 40 PID 2608 wrote to memory of 2872 2608 5xrrfff.exe 40 PID 2608 wrote to memory of 2872 2608 5xrrfff.exe 40 PID 2872 wrote to memory of 2440 2872 5hbhnn.exe 41 PID 2872 wrote to memory of 2440 2872 5hbhnn.exe 41 PID 2872 wrote to memory of 2440 2872 5hbhnn.exe 41 PID 2872 wrote to memory of 2440 2872 5hbhnn.exe 41 PID 2440 wrote to memory of 992 2440 9vdvv.exe 42 PID 2440 wrote to memory of 992 2440 9vdvv.exe 42 PID 2440 wrote to memory of 992 2440 9vdvv.exe 42 PID 2440 wrote to memory of 992 2440 9vdvv.exe 42 PID 992 wrote to memory of 1408 992 nhbbnn.exe 43 PID 992 wrote to memory of 1408 992 nhbbnn.exe 43 PID 992 wrote to memory of 1408 992 nhbbnn.exe 43 PID 992 wrote to memory of 1408 992 nhbbnn.exe 43 PID 1408 wrote to memory of 568 1408 hthhtn.exe 44 PID 1408 wrote to memory of 568 1408 hthhtn.exe 44 PID 1408 wrote to memory of 568 1408 hthhtn.exe 44 PID 1408 wrote to memory of 568 1408 hthhtn.exe 44 PID 568 wrote to memory of 1912 568 5jddj.exe 45 PID 568 wrote to memory of 1912 568 5jddj.exe 45 PID 568 wrote to memory of 1912 568 5jddj.exe 45 PID 568 wrote to memory of 1912 568 5jddj.exe 45 PID 1912 wrote to memory of 2536 1912 frxfffl.exe 46 PID 1912 wrote to memory of 2536 1912 frxfffl.exe 46 PID 1912 wrote to memory of 2536 1912 frxfffl.exe 46 PID 1912 wrote to memory of 2536 1912 frxfffl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d4e5a991dc90508f420573b7b3bfebeee329bf2b26d91bd972acd3327940e41.exe"C:\Users\Admin\AppData\Local\Temp\7d4e5a991dc90508f420573b7b3bfebeee329bf2b26d91bd972acd3327940e41.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\3jjdp.exec:\3jjdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\1bhbhn.exec:\1bhbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\ppddp.exec:\ppddp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\rlxflrf.exec:\rlxflrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\5hnhhb.exec:\5hnhhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\7vppp.exec:\7vppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\ttnnbh.exec:\ttnnbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\nhbbnn.exec:\nhbbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\5xrrfff.exec:\5xrrfff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\5hbhnn.exec:\5hbhnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\9vdvv.exec:\9vdvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\nhbbnn.exec:\nhbbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\hthhtn.exec:\hthhtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\5jddj.exec:\5jddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\frxfffl.exec:\frxfffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\vdpdj.exec:\vdpdj.exe17⤵
- Executes dropped EXE
PID:2536 -
\??\c:\fxfrlxr.exec:\fxfrlxr.exe18⤵
- Executes dropped EXE
PID:484 -
\??\c:\tbhtbb.exec:\tbhtbb.exe19⤵
- Executes dropped EXE
PID:620 -
\??\c:\vjdjp.exec:\vjdjp.exe20⤵
- Executes dropped EXE
PID:2124 -
\??\c:\7rffllr.exec:\7rffllr.exe21⤵
- Executes dropped EXE
PID:2280 -
\??\c:\btnnbb.exec:\btnnbb.exe22⤵
- Executes dropped EXE
PID:2944 -
\??\c:\5pppv.exec:\5pppv.exe23⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xlfflrx.exec:\xlfflrx.exe24⤵
- Executes dropped EXE
PID:828 -
\??\c:\dpjpv.exec:\dpjpv.exe25⤵
- Executes dropped EXE
PID:1784 -
\??\c:\frffxxf.exec:\frffxxf.exe26⤵
- Executes dropped EXE
PID:1656 -
\??\c:\9httbb.exec:\9httbb.exe27⤵
- Executes dropped EXE
PID:1856 -
\??\c:\ddpvj.exec:\ddpvj.exe28⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nnbhtt.exec:\nnbhtt.exe29⤵
- Executes dropped EXE
PID:1428 -
\??\c:\1vdvv.exec:\1vdvv.exe30⤵
- Executes dropped EXE
PID:3012 -
\??\c:\9bttnn.exec:\9bttnn.exe31⤵
- Executes dropped EXE
PID:2696 -
\??\c:\nhttbh.exec:\nhttbh.exe32⤵
- Executes dropped EXE
PID:2408 -
\??\c:\jvjdp.exec:\jvjdp.exe33⤵
- Executes dropped EXE
PID:2820 -
\??\c:\lxllrxx.exec:\lxllrxx.exe34⤵
- Executes dropped EXE
PID:2844 -
\??\c:\dvjjv.exec:\dvjjv.exe35⤵
- Executes dropped EXE
PID:2676 -
\??\c:\lfrxflr.exec:\lfrxflr.exe36⤵
- Executes dropped EXE
PID:2744 -
\??\c:\9fxflfr.exec:\9fxflfr.exe37⤵
- Executes dropped EXE
PID:2824 -
\??\c:\9tnhnt.exec:\9tnhnt.exe38⤵
- Executes dropped EXE
PID:2728 -
\??\c:\vjjjp.exec:\vjjjp.exe39⤵
- Executes dropped EXE
PID:2724 -
\??\c:\frlfrrx.exec:\frlfrrx.exe40⤵
- Executes dropped EXE
PID:2624 -
\??\c:\tthbbn.exec:\tthbbn.exe41⤵
- Executes dropped EXE
PID:2848 -
\??\c:\5nbnnn.exec:\5nbnnn.exe42⤵
- Executes dropped EXE
PID:108 -
\??\c:\pvvpp.exec:\pvvpp.exe43⤵
- Executes dropped EXE
PID:2976 -
\??\c:\rlfxffl.exec:\rlfxffl.exe44⤵
- Executes dropped EXE
PID:1616 -
\??\c:\7xfflrr.exec:\7xfflrr.exe45⤵
- Executes dropped EXE
PID:2384 -
\??\c:\bbtbhn.exec:\bbtbhn.exe46⤵
- Executes dropped EXE
PID:992 -
\??\c:\3pdvd.exec:\3pdvd.exe47⤵
- Executes dropped EXE
PID:1408 -
\??\c:\9xffrxl.exec:\9xffrxl.exe48⤵
- Executes dropped EXE
PID:1452 -
\??\c:\1xllllr.exec:\1xllllr.exe49⤵
- Executes dropped EXE
PID:1416 -
\??\c:\bntbhh.exec:\bntbhh.exe50⤵
- Executes dropped EXE
PID:1956 -
\??\c:\3djdd.exec:\3djdd.exe51⤵
- Executes dropped EXE
PID:1348 -
\??\c:\pjvdd.exec:\pjvdd.exe52⤵
- Executes dropped EXE
PID:484 -
\??\c:\rflffrr.exec:\rflffrr.exe53⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hthhtn.exec:\hthhtn.exe54⤵
- Executes dropped EXE
PID:2428 -
\??\c:\jdjdd.exec:\jdjdd.exe55⤵
- Executes dropped EXE
PID:988 -
\??\c:\7lxrrxx.exec:\7lxrrxx.exe56⤵
- Executes dropped EXE
PID:2280 -
\??\c:\7xrrlxf.exec:\7xrrlxf.exe57⤵
- Executes dropped EXE
PID:2160 -
\??\c:\bnbbhh.exec:\bnbbhh.exe58⤵
- Executes dropped EXE
PID:2948 -
\??\c:\vjpvv.exec:\vjpvv.exe59⤵
- Executes dropped EXE
PID:396 -
\??\c:\9vvdp.exec:\9vvdp.exe60⤵
- Executes dropped EXE
PID:2468 -
\??\c:\rffrrfx.exec:\rffrrfx.exe61⤵
- Executes dropped EXE
PID:1784 -
\??\c:\btnntn.exec:\btnntn.exe62⤵
- Executes dropped EXE
PID:340 -
\??\c:\3hnhnh.exec:\3hnhnh.exe63⤵
- Executes dropped EXE
PID:2328 -
\??\c:\vpddj.exec:\vpddj.exe64⤵
- Executes dropped EXE
PID:1584 -
\??\c:\frxxxrl.exec:\frxxxrl.exe65⤵
- Executes dropped EXE
PID:1860 -
\??\c:\fxlrrrr.exec:\fxlrrrr.exe66⤵PID:1552
-
\??\c:\hthbbt.exec:\hthbbt.exe67⤵PID:2212
-
\??\c:\ppddj.exec:\ppddj.exe68⤵PID:3012
-
\??\c:\lllllxf.exec:\lllllxf.exe69⤵
- System Location Discovery: System Language Discovery
PID:2776 -
\??\c:\5tttbt.exec:\5tttbt.exe70⤵PID:2660
-
\??\c:\3vjvv.exec:\3vjvv.exe71⤵PID:2088
-
\??\c:\dpvvj.exec:\dpvvj.exe72⤵PID:2652
-
\??\c:\1rxrxrr.exec:\1rxrxrr.exe73⤵PID:2240
-
\??\c:\tntbhh.exec:\tntbhh.exe74⤵PID:2748
-
\??\c:\7hbnhh.exec:\7hbnhh.exe75⤵
- System Location Discovery: System Language Discovery
PID:2688 -
\??\c:\7jvpj.exec:\7jvpj.exe76⤵PID:2592
-
\??\c:\frxfxxx.exec:\frxfxxx.exe77⤵PID:3036
-
\??\c:\nbhtnh.exec:\nbhtnh.exe78⤵PID:3000
-
\??\c:\bnbhhb.exec:\bnbhhb.exe79⤵PID:2672
-
\??\c:\pjvvd.exec:\pjvvd.exe80⤵PID:2888
-
\??\c:\9frllll.exec:\9frllll.exe81⤵PID:2608
-
\??\c:\rrlffff.exec:\rrlffff.exe82⤵PID:1400
-
\??\c:\tntntn.exec:\tntntn.exe83⤵PID:2064
-
\??\c:\pjdvd.exec:\pjdvd.exe84⤵PID:1904
-
\??\c:\vpjpp.exec:\vpjpp.exe85⤵PID:1360
-
\??\c:\fxllllr.exec:\fxllllr.exe86⤵PID:568
-
\??\c:\xxlffxf.exec:\xxlffxf.exe87⤵PID:1452
-
\??\c:\nbhntt.exec:\nbhntt.exe88⤵PID:1972
-
\??\c:\ppvvv.exec:\ppvvv.exe89⤵PID:764
-
\??\c:\pdjdj.exec:\pdjdj.exe90⤵PID:1348
-
\??\c:\lxxllff.exec:\lxxllff.exe91⤵PID:772
-
\??\c:\thtttt.exec:\thtttt.exe92⤵PID:840
-
\??\c:\7ntnbb.exec:\7ntnbb.exe93⤵PID:2768
-
\??\c:\pjdjj.exec:\pjdjj.exe94⤵PID:1364
-
\??\c:\xfrlffl.exec:\xfrlffl.exe95⤵PID:1916
-
\??\c:\nhtntn.exec:\nhtntn.exe96⤵PID:2936
-
\??\c:\3nbtbt.exec:\3nbtbt.exe97⤵PID:408
-
\??\c:\1pddj.exec:\1pddj.exe98⤵PID:1544
-
\??\c:\lxfxfxx.exec:\lxfxfxx.exe99⤵PID:2500
-
\??\c:\9frrrxx.exec:\9frrrxx.exe100⤵PID:2016
-
\??\c:\tnttnn.exec:\tnttnn.exe101⤵PID:1632
-
\??\c:\vjdjj.exec:\vjdjj.exe102⤵PID:1856
-
\??\c:\7vddv.exec:\7vddv.exe103⤵PID:1264
-
\??\c:\llxffff.exec:\llxffff.exe104⤵PID:884
-
\??\c:\hhtttt.exec:\hhtttt.exe105⤵PID:2692
-
\??\c:\9bhbbh.exec:\9bhbbh.exe106⤵PID:2208
-
\??\c:\dpddd.exec:\dpddd.exe107⤵PID:2192
-
\??\c:\xrfffxl.exec:\xrfffxl.exe108⤵PID:1536
-
\??\c:\bbhhhh.exec:\bbhhhh.exe109⤵PID:2668
-
\??\c:\1tbtbb.exec:\1tbtbb.exe110⤵PID:2636
-
\??\c:\jjvvj.exec:\jjvvj.exe111⤵PID:2700
-
\??\c:\jdjjp.exec:\jdjjp.exe112⤵PID:2144
-
\??\c:\xrfllfl.exec:\xrfllfl.exe113⤵PID:2560
-
\??\c:\thnttt.exec:\thnttt.exe114⤵PID:2992
-
\??\c:\bthhnn.exec:\bthhnn.exe115⤵PID:2032
-
\??\c:\3jpjj.exec:\3jpjj.exe116⤵PID:2620
-
\??\c:\fxfxxrx.exec:\fxfxxrx.exe117⤵PID:2840
-
\??\c:\fxlrxfx.exec:\fxlrxfx.exe118⤵PID:1564
-
\??\c:\bhtnnh.exec:\bhtnnh.exe119⤵PID:2896
-
\??\c:\pdjdd.exec:\pdjdd.exe120⤵PID:2888
-
\??\c:\1frrrfl.exec:\1frrrfl.exe121⤵PID:2440
-
\??\c:\xlflrrx.exec:\xlflrrx.exe122⤵PID:2588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-