Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 15:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7ebe843212271d6360c3c840deb713a2e063b6ab35727b6caa272ce49d82d0af.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
7ebe843212271d6360c3c840deb713a2e063b6ab35727b6caa272ce49d82d0af.exe
-
Size
453KB
-
MD5
2d9e64dac154b68e4c611618b24011ac
-
SHA1
0efcaddf18eb50ee38416e2ba8530e6f1809e309
-
SHA256
7ebe843212271d6360c3c840deb713a2e063b6ab35727b6caa272ce49d82d0af
-
SHA512
baf2057ca023ff6c50d8a8abb496f9041118a21c443b4d2fb90c9ed9705a5f8c43261112d1a2e4b8a4dc7ea6e93413d6470aee3c05d8e0adf51f8ca32530d047
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe3:q7Tc2NYHUrAwfMp3CD3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2264-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/548-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-31-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3040-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-127-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1756-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1840-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/548-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-341-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2828-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/780-425-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1032-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/780-453-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1064-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-506-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1168-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-672-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/652-752-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2620-929-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2100 9dppp.exe 548 bnhnhh.exe 3040 lflffxf.exe 1208 5tnhtt.exe 2868 vpppd.exe 2740 rrrlrrl.exe 2792 5dvvd.exe 2408 xrffxxx.exe 2664 dvjpd.exe 2672 pvjdp.exe 3032 hhbtbb.exe 1096 vpdvd.exe 2032 3lxxlfl.exe 2348 bbttbh.exe 1756 pjvdj.exe 1840 jdpvj.exe 1032 hntbbb.exe 1608 vvvvp.exe 1888 nhnthn.exe 1700 bntnbb.exe 112 hhhhtt.exe 408 rrxxxxf.exe 1312 3thhnn.exe 2004 7fxxlxr.exe 1560 ntbhnh.exe 1016 5lffllr.exe 2244 bnhbnn.exe 2184 fffrxlr.exe 1780 7frfrrx.exe 2272 ppvdp.exe 2484 1rxxlff.exe 2020 1jvvv.exe 2264 ppvjv.exe 1628 9tnnbt.exe 2364 5htntb.exe 548 dvpvv.exe 2436 xxxxxrx.exe 3040 rrrxflr.exe 2812 btbbhh.exe 2732 vdjdj.exe 2944 7pjjp.exe 2784 xllxxrf.exe 2828 9httbb.exe 2772 dvdvd.exe 2620 ppvjd.exe 2664 httnht.exe 2388 nhtthn.exe 3032 pvdjj.exe 1796 flxfxlf.exe 856 nhtbnn.exe 2512 nhthhn.exe 780 5pdvj.exe 2096 xrxrrrx.exe 1384 bbhhnn.exe 2676 3hbtnh.exe 1032 1vjpd.exe 2088 vpjjp.exe 2460 1rfxfrr.exe 1572 hhnhnh.exe 604 vjppj.exe 1064 ffrxfrl.exe 1636 rrfrflx.exe 2280 bbbhtt.exe 2160 ppjjp.exe -
resource yara_rule behavioral1/memory/2264-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-341-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2828-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-411-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1032-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1168-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-784-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-859-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-937-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-1000-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-1158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-1196-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lffrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ttbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdjp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2100 2264 7ebe843212271d6360c3c840deb713a2e063b6ab35727b6caa272ce49d82d0af.exe 30 PID 2264 wrote to memory of 2100 2264 7ebe843212271d6360c3c840deb713a2e063b6ab35727b6caa272ce49d82d0af.exe 30 PID 2264 wrote to memory of 2100 2264 7ebe843212271d6360c3c840deb713a2e063b6ab35727b6caa272ce49d82d0af.exe 30 PID 2264 wrote to memory of 2100 2264 7ebe843212271d6360c3c840deb713a2e063b6ab35727b6caa272ce49d82d0af.exe 30 PID 2100 wrote to memory of 548 2100 9dppp.exe 31 PID 2100 wrote to memory of 548 2100 9dppp.exe 31 PID 2100 wrote to memory of 548 2100 9dppp.exe 31 PID 2100 wrote to memory of 548 2100 9dppp.exe 31 PID 548 wrote to memory of 3040 548 bnhnhh.exe 32 PID 548 wrote to memory of 3040 548 bnhnhh.exe 32 PID 548 wrote to memory of 3040 548 bnhnhh.exe 32 PID 548 wrote to memory of 3040 548 bnhnhh.exe 32 PID 3040 wrote to memory of 1208 3040 lflffxf.exe 33 PID 3040 wrote to memory of 1208 3040 lflffxf.exe 33 PID 3040 wrote to memory of 1208 3040 lflffxf.exe 33 PID 3040 wrote to memory of 1208 3040 lflffxf.exe 33 PID 1208 wrote to memory of 2868 1208 5tnhtt.exe 34 PID 1208 wrote to memory of 2868 1208 5tnhtt.exe 34 PID 1208 wrote to memory of 2868 1208 5tnhtt.exe 34 PID 1208 wrote to memory of 2868 1208 5tnhtt.exe 34 PID 2868 wrote to memory of 2740 2868 vpppd.exe 35 PID 2868 wrote to memory of 2740 2868 vpppd.exe 35 PID 2868 wrote to memory of 2740 2868 vpppd.exe 35 PID 2868 wrote to memory of 2740 2868 vpppd.exe 35 PID 2740 wrote to memory of 2792 2740 rrrlrrl.exe 36 PID 2740 wrote to memory of 2792 2740 rrrlrrl.exe 36 PID 2740 wrote to memory of 2792 2740 rrrlrrl.exe 36 PID 2740 wrote to memory of 2792 2740 rrrlrrl.exe 36 PID 2792 wrote to memory of 2408 2792 5dvvd.exe 37 PID 2792 wrote to memory of 2408 2792 5dvvd.exe 37 PID 2792 wrote to memory of 2408 2792 5dvvd.exe 37 PID 2792 wrote to memory of 2408 2792 5dvvd.exe 37 PID 2408 wrote to memory of 2664 2408 xrffxxx.exe 38 PID 2408 wrote to memory of 2664 2408 xrffxxx.exe 38 PID 2408 wrote to memory of 2664 2408 xrffxxx.exe 38 PID 2408 wrote to memory of 2664 2408 xrffxxx.exe 38 PID 2664 wrote to memory of 2672 2664 dvjpd.exe 39 PID 2664 wrote to memory of 2672 2664 dvjpd.exe 39 PID 2664 wrote to memory of 2672 2664 dvjpd.exe 39 PID 2664 wrote to memory of 2672 2664 dvjpd.exe 39 PID 2672 wrote to memory of 3032 2672 pvjdp.exe 40 PID 2672 wrote to memory of 3032 2672 pvjdp.exe 40 PID 2672 wrote to memory of 3032 2672 pvjdp.exe 40 PID 2672 wrote to memory of 3032 2672 pvjdp.exe 40 PID 3032 wrote to memory of 1096 3032 hhbtbb.exe 41 PID 3032 wrote to memory of 1096 3032 hhbtbb.exe 41 PID 3032 wrote to memory of 1096 3032 hhbtbb.exe 41 PID 3032 wrote to memory of 1096 3032 hhbtbb.exe 41 PID 1096 wrote to memory of 2032 1096 vpdvd.exe 42 PID 1096 wrote to memory of 2032 1096 vpdvd.exe 42 PID 1096 wrote to memory of 2032 1096 vpdvd.exe 42 PID 1096 wrote to memory of 2032 1096 vpdvd.exe 42 PID 2032 wrote to memory of 2348 2032 3lxxlfl.exe 43 PID 2032 wrote to memory of 2348 2032 3lxxlfl.exe 43 PID 2032 wrote to memory of 2348 2032 3lxxlfl.exe 43 PID 2032 wrote to memory of 2348 2032 3lxxlfl.exe 43 PID 2348 wrote to memory of 1756 2348 bbttbh.exe 44 PID 2348 wrote to memory of 1756 2348 bbttbh.exe 44 PID 2348 wrote to memory of 1756 2348 bbttbh.exe 44 PID 2348 wrote to memory of 1756 2348 bbttbh.exe 44 PID 1756 wrote to memory of 1840 1756 pjvdj.exe 45 PID 1756 wrote to memory of 1840 1756 pjvdj.exe 45 PID 1756 wrote to memory of 1840 1756 pjvdj.exe 45 PID 1756 wrote to memory of 1840 1756 pjvdj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ebe843212271d6360c3c840deb713a2e063b6ab35727b6caa272ce49d82d0af.exe"C:\Users\Admin\AppData\Local\Temp\7ebe843212271d6360c3c840deb713a2e063b6ab35727b6caa272ce49d82d0af.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\9dppp.exec:\9dppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\bnhnhh.exec:\bnhnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\lflffxf.exec:\lflffxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\5tnhtt.exec:\5tnhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\vpppd.exec:\vpppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\rrrlrrl.exec:\rrrlrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\5dvvd.exec:\5dvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\xrffxxx.exec:\xrffxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\dvjpd.exec:\dvjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\pvjdp.exec:\pvjdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\hhbtbb.exec:\hhbtbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\vpdvd.exec:\vpdvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\3lxxlfl.exec:\3lxxlfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\bbttbh.exec:\bbttbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\pjvdj.exec:\pjvdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\jdpvj.exec:\jdpvj.exe17⤵
- Executes dropped EXE
PID:1840 -
\??\c:\hntbbb.exec:\hntbbb.exe18⤵
- Executes dropped EXE
PID:1032 -
\??\c:\vvvvp.exec:\vvvvp.exe19⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nhnthn.exec:\nhnthn.exe20⤵
- Executes dropped EXE
PID:1888 -
\??\c:\bntnbb.exec:\bntnbb.exe21⤵
- Executes dropped EXE
PID:1700 -
\??\c:\hhhhtt.exec:\hhhhtt.exe22⤵
- Executes dropped EXE
PID:112 -
\??\c:\rrxxxxf.exec:\rrxxxxf.exe23⤵
- Executes dropped EXE
PID:408 -
\??\c:\3thhnn.exec:\3thhnn.exe24⤵
- Executes dropped EXE
PID:1312 -
\??\c:\7fxxlxr.exec:\7fxxlxr.exe25⤵
- Executes dropped EXE
PID:2004 -
\??\c:\ntbhnh.exec:\ntbhnh.exe26⤵
- Executes dropped EXE
PID:1560 -
\??\c:\5lffllr.exec:\5lffllr.exe27⤵
- Executes dropped EXE
PID:1016 -
\??\c:\bnhbnn.exec:\bnhbnn.exe28⤵
- Executes dropped EXE
PID:2244 -
\??\c:\fffrxlr.exec:\fffrxlr.exe29⤵
- Executes dropped EXE
PID:2184 -
\??\c:\7frfrrx.exec:\7frfrrx.exe30⤵
- Executes dropped EXE
PID:1780 -
\??\c:\ppvdp.exec:\ppvdp.exe31⤵
- Executes dropped EXE
PID:2272 -
\??\c:\1rxxlff.exec:\1rxxlff.exe32⤵
- Executes dropped EXE
PID:2484 -
\??\c:\1jvvv.exec:\1jvvv.exe33⤵
- Executes dropped EXE
PID:2020 -
\??\c:\ppvjv.exec:\ppvjv.exe34⤵
- Executes dropped EXE
PID:2264 -
\??\c:\9tnnbt.exec:\9tnnbt.exe35⤵
- Executes dropped EXE
PID:1628 -
\??\c:\5htntb.exec:\5htntb.exe36⤵
- Executes dropped EXE
PID:2364 -
\??\c:\dvpvv.exec:\dvpvv.exe37⤵
- Executes dropped EXE
PID:548 -
\??\c:\xxxxxrx.exec:\xxxxxrx.exe38⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rrrxflr.exec:\rrrxflr.exe39⤵
- Executes dropped EXE
PID:3040 -
\??\c:\btbbhh.exec:\btbbhh.exe40⤵
- Executes dropped EXE
PID:2812 -
\??\c:\vdjdj.exec:\vdjdj.exe41⤵
- Executes dropped EXE
PID:2732 -
\??\c:\7pjjp.exec:\7pjjp.exe42⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xllxxrf.exec:\xllxxrf.exe43⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9httbb.exec:\9httbb.exe44⤵
- Executes dropped EXE
PID:2828 -
\??\c:\dvdvd.exec:\dvdvd.exe45⤵
- Executes dropped EXE
PID:2772 -
\??\c:\ppvjd.exec:\ppvjd.exe46⤵
- Executes dropped EXE
PID:2620 -
\??\c:\httnht.exec:\httnht.exe47⤵
- Executes dropped EXE
PID:2664 -
\??\c:\nhtthn.exec:\nhtthn.exe48⤵
- Executes dropped EXE
PID:2388 -
\??\c:\pvdjj.exec:\pvdjj.exe49⤵
- Executes dropped EXE
PID:3032 -
\??\c:\flxfxlf.exec:\flxfxlf.exe50⤵
- Executes dropped EXE
PID:1796 -
\??\c:\nhtbnn.exec:\nhtbnn.exe51⤵
- Executes dropped EXE
PID:856 -
\??\c:\nhthhn.exec:\nhthhn.exe52⤵
- Executes dropped EXE
PID:2512 -
\??\c:\5pdvj.exec:\5pdvj.exe53⤵
- Executes dropped EXE
PID:780 -
\??\c:\xrxrrrx.exec:\xrxrrrx.exe54⤵
- Executes dropped EXE
PID:2096 -
\??\c:\bbhhnn.exec:\bbhhnn.exe55⤵
- Executes dropped EXE
PID:1384 -
\??\c:\3hbtnh.exec:\3hbtnh.exe56⤵
- Executes dropped EXE
PID:2676 -
\??\c:\1vjpd.exec:\1vjpd.exe57⤵
- Executes dropped EXE
PID:1032 -
\??\c:\vpjjp.exec:\vpjjp.exe58⤵
- Executes dropped EXE
PID:2088 -
\??\c:\1rfxfrr.exec:\1rfxfrr.exe59⤵
- Executes dropped EXE
PID:2460 -
\??\c:\hhnhnh.exec:\hhnhnh.exe60⤵
- Executes dropped EXE
PID:1572 -
\??\c:\vjppj.exec:\vjppj.exe61⤵
- Executes dropped EXE
PID:604 -
\??\c:\ffrxfrl.exec:\ffrxfrl.exe62⤵
- Executes dropped EXE
PID:1064 -
\??\c:\rrfrflx.exec:\rrfrflx.exe63⤵
- Executes dropped EXE
PID:1636 -
\??\c:\bbbhtt.exec:\bbbhtt.exe64⤵
- Executes dropped EXE
PID:2280 -
\??\c:\ppjjp.exec:\ppjjp.exe65⤵
- Executes dropped EXE
PID:2160 -
\??\c:\pppjj.exec:\pppjj.exe66⤵PID:1552
-
\??\c:\lfxflrx.exec:\lfxflrx.exe67⤵PID:1560
-
\??\c:\5nttbb.exec:\5nttbb.exe68⤵PID:1004
-
\??\c:\hbnnhn.exec:\hbnnhn.exe69⤵PID:2268
-
\??\c:\djddj.exec:\djddj.exe70⤵PID:3056
-
\??\c:\3rlrrxf.exec:\3rlrrxf.exe71⤵PID:2492
-
\??\c:\9nhntb.exec:\9nhntb.exe72⤵PID:2188
-
\??\c:\bbhbbb.exec:\bbhbbb.exe73⤵PID:2272
-
\??\c:\3pddd.exec:\3pddd.exe74⤵PID:2380
-
\??\c:\lrflrrx.exec:\lrflrrx.exe75⤵PID:1596
-
\??\c:\tthhhh.exec:\tthhhh.exe76⤵PID:1584
-
\??\c:\5bnnbb.exec:\5bnnbb.exe77⤵PID:1680
-
\??\c:\jvjdd.exec:\jvjdd.exe78⤵PID:1388
-
\??\c:\xlrrrxf.exec:\xlrrrxf.exe79⤵PID:2148
-
\??\c:\frxxffl.exec:\frxxffl.exe80⤵PID:1168
-
\??\c:\bbbhhb.exec:\bbbhhb.exe81⤵PID:2748
-
\??\c:\vpvvv.exec:\vpvvv.exe82⤵PID:1208
-
\??\c:\vvdvv.exec:\vvdvv.exe83⤵PID:2808
-
\??\c:\7xflxxf.exec:\7xflxxf.exe84⤵PID:2872
-
\??\c:\5xllrrx.exec:\5xllrrx.exe85⤵PID:2192
-
\??\c:\nnnnbt.exec:\nnnnbt.exe86⤵PID:2840
-
\??\c:\9dppv.exec:\9dppv.exe87⤵PID:2644
-
\??\c:\vvddp.exec:\vvddp.exe88⤵PID:2608
-
\??\c:\flxxfrr.exec:\flxxfrr.exe89⤵PID:2640
-
\??\c:\nnttnn.exec:\nnttnn.exe90⤵PID:2684
-
\??\c:\hhtnth.exec:\hhtnth.exe91⤵PID:2664
-
\??\c:\vdpdj.exec:\vdpdj.exe92⤵PID:2392
-
\??\c:\rfrxflr.exec:\rfrxflr.exe93⤵PID:1732
-
\??\c:\rxflflx.exec:\rxflflx.exe94⤵PID:1796
-
\??\c:\ttthtt.exec:\ttthtt.exe95⤵PID:856
-
\??\c:\dvvpd.exec:\dvvpd.exe96⤵PID:1752
-
\??\c:\ffllrll.exec:\ffllrll.exe97⤵PID:1736
-
\??\c:\xxrxfrf.exec:\xxrxfrf.exe98⤵PID:1772
-
\??\c:\ttttbb.exec:\ttttbb.exe99⤵PID:2848
-
\??\c:\1pvjd.exec:\1pvjd.exe100⤵PID:2904
-
\??\c:\1pvvv.exec:\1pvvv.exe101⤵PID:1104
-
\??\c:\rlfxffl.exec:\rlfxffl.exe102⤵PID:2300
-
\??\c:\1tntbb.exec:\1tntbb.exe103⤵PID:1976
-
\??\c:\bbhhhn.exec:\bbhhhn.exe104⤵PID:1664
-
\??\c:\pvppv.exec:\pvppv.exe105⤵PID:652
-
\??\c:\ffffllr.exec:\ffffllr.exe106⤵PID:604
-
\??\c:\hhnnnh.exec:\hhnnnh.exe107⤵PID:2312
-
\??\c:\nnbhnb.exec:\nnbhnb.exe108⤵PID:1328
-
\??\c:\5jjjj.exec:\5jjjj.exe109⤵PID:2004
-
\??\c:\ffrfrrl.exec:\ffrfrrl.exe110⤵PID:2160
-
\??\c:\xflrrrr.exec:\xflrrrr.exe111⤵PID:2968
-
\??\c:\3nhtbh.exec:\3nhtbh.exe112⤵PID:920
-
\??\c:\9dpjp.exec:\9dpjp.exe113⤵PID:1004
-
\??\c:\llxfrrx.exec:\llxfrrx.exe114⤵PID:2992
-
\??\c:\xrfrfff.exec:\xrfrfff.exe115⤵PID:3056
-
\??\c:\bhbntb.exec:\bhbntb.exe116⤵PID:1780
-
\??\c:\pjddd.exec:\pjddd.exe117⤵PID:1992
-
\??\c:\1lxflxf.exec:\1lxflxf.exe118⤵PID:344
-
\??\c:\xxlfflr.exec:\xxlfflr.exe119⤵PID:1996
-
\??\c:\hhtbnn.exec:\hhtbnn.exe120⤵PID:1716
-
\??\c:\vvjjd.exec:\vvjjd.exe121⤵PID:1908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-