Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 16:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ed2c7f64ab992a408410fd67fe23f2072ca25dec65a75ab6d0976171863ecfd5N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
ed2c7f64ab992a408410fd67fe23f2072ca25dec65a75ab6d0976171863ecfd5N.exe
-
Size
453KB
-
MD5
1f19ac3b94d3d65b58ab29ed24606db0
-
SHA1
068f6bebc60d8eaf37a9a3cbaa6ef0464defd143
-
SHA256
ed2c7f64ab992a408410fd67fe23f2072ca25dec65a75ab6d0976171863ecfd5
-
SHA512
0e46d6dea2ef5879958553c37371374df034d31b41355e042604a754735eb2e4b511813c23cf647d8e204aa94427f5a101b0d479117eaa7a2b6bbc694fc6332d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe7:q7Tc2NYHUrAwfMp3CD7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2076-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-93-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/3064-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/852-128-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1740-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/812-172-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/820-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1284-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-302-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2796-354-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2880-365-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2880-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-381-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2700-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/780-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-684-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1608-713-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/820-729-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1560-757-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2540 jpvdv.exe 2084 5rfrflr.exe 2236 5bntbt.exe 2348 fxxfllx.exe 2832 vpppd.exe 2836 3fxxllf.exe 2356 bhthtb.exe 2820 fllrffr.exe 2748 rlrxrrr.exe 2652 bthnhh.exe 3064 xfffxxx.exe 1736 dppvv.exe 852 llxxlrx.exe 1740 tnhnhh.exe 2160 xxrxrfr.exe 1792 3pdjj.exe 812 5lxfxfl.exe 820 jdpvj.exe 2204 djpvj.exe 2196 htnbnn.exe 3008 vpddj.exe 1284 bbtbnt.exe 1920 1jddp.exe 1980 1xlxllr.exe 848 thbhhh.exe 572 3dvvd.exe 1852 fxflflr.exe 2352 thbbhn.exe 1584 vvvdp.exe 2976 tttbhn.exe 1652 ddppd.exe 2716 lrrfxlr.exe 1636 ddjvv.exe 1644 9ppdj.exe 2728 rlxlfff.exe 3044 bnttnt.exe 2844 hhtbnn.exe 2448 dpjjj.exe 2888 rlxxrxl.exe 2796 llfxllf.exe 2980 hbhnbn.exe 2880 3pdjv.exe 2636 pjddj.exe 2700 lfrrlrf.exe 2600 tnbbbb.exe 2240 hbhnhb.exe 868 pjdpv.exe 1672 fxlxxfl.exe 1604 1nhntb.exe 2180 hhhhbh.exe 1324 pjdjp.exe 1712 xrfllll.exe 1368 nhbnhh.exe 1588 nbntnn.exe 2952 djpvv.exe 3056 vjvdd.exe 2928 xrllxxr.exe 2312 hhnbhn.exe 1560 ddddd.exe 780 vpdvj.exe 904 frfrflx.exe 1468 htbbbn.exe 912 nbtbhn.exe 1476 djvjv.exe -
resource yara_rule behavioral1/memory/2076-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-55-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2832-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/780-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-784-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-865-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-909-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbntn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2540 2076 ed2c7f64ab992a408410fd67fe23f2072ca25dec65a75ab6d0976171863ecfd5N.exe 30 PID 2076 wrote to memory of 2540 2076 ed2c7f64ab992a408410fd67fe23f2072ca25dec65a75ab6d0976171863ecfd5N.exe 30 PID 2076 wrote to memory of 2540 2076 ed2c7f64ab992a408410fd67fe23f2072ca25dec65a75ab6d0976171863ecfd5N.exe 30 PID 2076 wrote to memory of 2540 2076 ed2c7f64ab992a408410fd67fe23f2072ca25dec65a75ab6d0976171863ecfd5N.exe 30 PID 2540 wrote to memory of 2084 2540 jpvdv.exe 31 PID 2540 wrote to memory of 2084 2540 jpvdv.exe 31 PID 2540 wrote to memory of 2084 2540 jpvdv.exe 31 PID 2540 wrote to memory of 2084 2540 jpvdv.exe 31 PID 2084 wrote to memory of 2236 2084 5rfrflr.exe 32 PID 2084 wrote to memory of 2236 2084 5rfrflr.exe 32 PID 2084 wrote to memory of 2236 2084 5rfrflr.exe 32 PID 2084 wrote to memory of 2236 2084 5rfrflr.exe 32 PID 2236 wrote to memory of 2348 2236 5bntbt.exe 33 PID 2236 wrote to memory of 2348 2236 5bntbt.exe 33 PID 2236 wrote to memory of 2348 2236 5bntbt.exe 33 PID 2236 wrote to memory of 2348 2236 5bntbt.exe 33 PID 2348 wrote to memory of 2832 2348 fxxfllx.exe 34 PID 2348 wrote to memory of 2832 2348 fxxfllx.exe 34 PID 2348 wrote to memory of 2832 2348 fxxfllx.exe 34 PID 2348 wrote to memory of 2832 2348 fxxfllx.exe 34 PID 2832 wrote to memory of 2836 2832 vpppd.exe 35 PID 2832 wrote to memory of 2836 2832 vpppd.exe 35 PID 2832 wrote to memory of 2836 2832 vpppd.exe 35 PID 2832 wrote to memory of 2836 2832 vpppd.exe 35 PID 2836 wrote to memory of 2356 2836 3fxxllf.exe 36 PID 2836 wrote to memory of 2356 2836 3fxxllf.exe 36 PID 2836 wrote to memory of 2356 2836 3fxxllf.exe 36 PID 2836 wrote to memory of 2356 2836 3fxxllf.exe 36 PID 2356 wrote to memory of 2820 2356 bhthtb.exe 37 PID 2356 wrote to memory of 2820 2356 bhthtb.exe 37 PID 2356 wrote to memory of 2820 2356 bhthtb.exe 37 PID 2356 wrote to memory of 2820 2356 bhthtb.exe 37 PID 2820 wrote to memory of 2748 2820 fllrffr.exe 38 PID 2820 wrote to memory of 2748 2820 fllrffr.exe 38 PID 2820 wrote to memory of 2748 2820 fllrffr.exe 38 PID 2820 wrote to memory of 2748 2820 fllrffr.exe 38 PID 2748 wrote to memory of 2652 2748 rlrxrrr.exe 39 PID 2748 wrote to memory of 2652 2748 rlrxrrr.exe 39 PID 2748 wrote to memory of 2652 2748 rlrxrrr.exe 39 PID 2748 wrote to memory of 2652 2748 rlrxrrr.exe 39 PID 2652 wrote to memory of 3064 2652 bthnhh.exe 40 PID 2652 wrote to memory of 3064 2652 bthnhh.exe 40 PID 2652 wrote to memory of 3064 2652 bthnhh.exe 40 PID 2652 wrote to memory of 3064 2652 bthnhh.exe 40 PID 3064 wrote to memory of 1736 3064 xfffxxx.exe 41 PID 3064 wrote to memory of 1736 3064 xfffxxx.exe 41 PID 3064 wrote to memory of 1736 3064 xfffxxx.exe 41 PID 3064 wrote to memory of 1736 3064 xfffxxx.exe 41 PID 1736 wrote to memory of 852 1736 dppvv.exe 42 PID 1736 wrote to memory of 852 1736 dppvv.exe 42 PID 1736 wrote to memory of 852 1736 dppvv.exe 42 PID 1736 wrote to memory of 852 1736 dppvv.exe 42 PID 852 wrote to memory of 1740 852 llxxlrx.exe 43 PID 852 wrote to memory of 1740 852 llxxlrx.exe 43 PID 852 wrote to memory of 1740 852 llxxlrx.exe 43 PID 852 wrote to memory of 1740 852 llxxlrx.exe 43 PID 1740 wrote to memory of 2160 1740 tnhnhh.exe 44 PID 1740 wrote to memory of 2160 1740 tnhnhh.exe 44 PID 1740 wrote to memory of 2160 1740 tnhnhh.exe 44 PID 1740 wrote to memory of 2160 1740 tnhnhh.exe 44 PID 2160 wrote to memory of 1792 2160 xxrxrfr.exe 45 PID 2160 wrote to memory of 1792 2160 xxrxrfr.exe 45 PID 2160 wrote to memory of 1792 2160 xxrxrfr.exe 45 PID 2160 wrote to memory of 1792 2160 xxrxrfr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed2c7f64ab992a408410fd67fe23f2072ca25dec65a75ab6d0976171863ecfd5N.exe"C:\Users\Admin\AppData\Local\Temp\ed2c7f64ab992a408410fd67fe23f2072ca25dec65a75ab6d0976171863ecfd5N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\jpvdv.exec:\jpvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\5rfrflr.exec:\5rfrflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\5bntbt.exec:\5bntbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\fxxfllx.exec:\fxxfllx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\vpppd.exec:\vpppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\3fxxllf.exec:\3fxxllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\bhthtb.exec:\bhthtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\fllrffr.exec:\fllrffr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\rlrxrrr.exec:\rlrxrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\bthnhh.exec:\bthnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\xfffxxx.exec:\xfffxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\dppvv.exec:\dppvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\llxxlrx.exec:\llxxlrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\tnhnhh.exec:\tnhnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\xxrxrfr.exec:\xxrxrfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\3pdjj.exec:\3pdjj.exe17⤵
- Executes dropped EXE
PID:1792 -
\??\c:\5lxfxfl.exec:\5lxfxfl.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:812 -
\??\c:\jdpvj.exec:\jdpvj.exe19⤵
- Executes dropped EXE
PID:820 -
\??\c:\djpvj.exec:\djpvj.exe20⤵
- Executes dropped EXE
PID:2204 -
\??\c:\htnbnn.exec:\htnbnn.exe21⤵
- Executes dropped EXE
PID:2196 -
\??\c:\vpddj.exec:\vpddj.exe22⤵
- Executes dropped EXE
PID:3008 -
\??\c:\bbtbnt.exec:\bbtbnt.exe23⤵
- Executes dropped EXE
PID:1284 -
\??\c:\1jddp.exec:\1jddp.exe24⤵
- Executes dropped EXE
PID:1920 -
\??\c:\1xlxllr.exec:\1xlxllr.exe25⤵
- Executes dropped EXE
PID:1980 -
\??\c:\thbhhh.exec:\thbhhh.exe26⤵
- Executes dropped EXE
PID:848 -
\??\c:\3dvvd.exec:\3dvvd.exe27⤵
- Executes dropped EXE
PID:572 -
\??\c:\fxflflr.exec:\fxflflr.exe28⤵
- Executes dropped EXE
PID:1852 -
\??\c:\thbbhn.exec:\thbbhn.exe29⤵
- Executes dropped EXE
PID:2352 -
\??\c:\vvvdp.exec:\vvvdp.exe30⤵
- Executes dropped EXE
PID:1584 -
\??\c:\tttbhn.exec:\tttbhn.exe31⤵
- Executes dropped EXE
PID:2976 -
\??\c:\ddppd.exec:\ddppd.exe32⤵
- Executes dropped EXE
PID:1652 -
\??\c:\lrrfxlr.exec:\lrrfxlr.exe33⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ddjvv.exec:\ddjvv.exe34⤵
- Executes dropped EXE
PID:1636 -
\??\c:\9ppdj.exec:\9ppdj.exe35⤵
- Executes dropped EXE
PID:1644 -
\??\c:\rlxlfff.exec:\rlxlfff.exe36⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bnttnt.exec:\bnttnt.exe37⤵
- Executes dropped EXE
PID:3044 -
\??\c:\hhtbnn.exec:\hhtbnn.exe38⤵
- Executes dropped EXE
PID:2844 -
\??\c:\dpjjj.exec:\dpjjj.exe39⤵
- Executes dropped EXE
PID:2448 -
\??\c:\rlxxrxl.exec:\rlxxrxl.exe40⤵
- Executes dropped EXE
PID:2888 -
\??\c:\llfxllf.exec:\llfxllf.exe41⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hbhnbn.exec:\hbhnbn.exe42⤵
- Executes dropped EXE
PID:2980 -
\??\c:\3pdjv.exec:\3pdjv.exe43⤵
- Executes dropped EXE
PID:2880 -
\??\c:\pjddj.exec:\pjddj.exe44⤵
- Executes dropped EXE
PID:2636 -
\??\c:\lfrrlrf.exec:\lfrrlrf.exe45⤵
- Executes dropped EXE
PID:2700 -
\??\c:\tnbbbb.exec:\tnbbbb.exe46⤵
- Executes dropped EXE
PID:2600 -
\??\c:\hbhnhb.exec:\hbhnhb.exe47⤵
- Executes dropped EXE
PID:2240 -
\??\c:\pjdpv.exec:\pjdpv.exe48⤵
- Executes dropped EXE
PID:868 -
\??\c:\fxlxxfl.exec:\fxlxxfl.exe49⤵
- Executes dropped EXE
PID:1672 -
\??\c:\1nhntb.exec:\1nhntb.exe50⤵
- Executes dropped EXE
PID:1604 -
\??\c:\hhhhbh.exec:\hhhhbh.exe51⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pjdjp.exec:\pjdjp.exe52⤵
- Executes dropped EXE
PID:1324 -
\??\c:\xrfllll.exec:\xrfllll.exe53⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nhbnhh.exec:\nhbnhh.exe54⤵
- Executes dropped EXE
PID:1368 -
\??\c:\nbntnn.exec:\nbntnn.exe55⤵
- Executes dropped EXE
PID:1588 -
\??\c:\djpvv.exec:\djpvv.exe56⤵
- Executes dropped EXE
PID:2952 -
\??\c:\vjvdd.exec:\vjvdd.exe57⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xrllxxr.exec:\xrllxxr.exe58⤵
- Executes dropped EXE
PID:2928 -
\??\c:\hhnbhn.exec:\hhnbhn.exe59⤵
- Executes dropped EXE
PID:2312 -
\??\c:\ddddd.exec:\ddddd.exe60⤵
- Executes dropped EXE
PID:1560 -
\??\c:\vpdvj.exec:\vpdvj.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:780 -
\??\c:\frfrflx.exec:\frfrflx.exe62⤵
- Executes dropped EXE
PID:904 -
\??\c:\htbbbn.exec:\htbbbn.exe63⤵
- Executes dropped EXE
PID:1468 -
\??\c:\nbtbhn.exec:\nbtbhn.exe64⤵
- Executes dropped EXE
PID:912 -
\??\c:\djvjv.exec:\djvjv.exe65⤵
- Executes dropped EXE
PID:1476 -
\??\c:\rlflxxf.exec:\rlflxxf.exe66⤵PID:848
-
\??\c:\ffrrxxl.exec:\ffrrxxl.exe67⤵PID:2484
-
\??\c:\tnbhtt.exec:\tnbhtt.exe68⤵PID:1872
-
\??\c:\jdpvj.exec:\jdpvj.exe69⤵PID:1648
-
\??\c:\lfxfrxf.exec:\lfxfrxf.exe70⤵PID:1412
-
\??\c:\ffrrfxl.exec:\ffrrfxl.exe71⤵PID:1584
-
\??\c:\tbttbn.exec:\tbttbn.exe72⤵PID:2372
-
\??\c:\pppvv.exec:\pppvv.exe73⤵PID:1652
-
\??\c:\lfrxffr.exec:\lfrxffr.exe74⤵PID:1496
-
\??\c:\rlxfxlx.exec:\rlxfxlx.exe75⤵PID:1532
-
\??\c:\1bnhnh.exec:\1bnhnh.exe76⤵PID:2328
-
\??\c:\vppvv.exec:\vppvv.exe77⤵PID:2184
-
\??\c:\dvdvd.exec:\dvdvd.exe78⤵PID:2304
-
\??\c:\1ffxrrx.exec:\1ffxrrx.exe79⤵PID:2852
-
\??\c:\hbnhnh.exec:\hbnhnh.exe80⤵PID:2584
-
\??\c:\7bbnbb.exec:\7bbnbb.exe81⤵PID:2896
-
\??\c:\9pppp.exec:\9pppp.exe82⤵PID:2892
-
\??\c:\3llrxlr.exec:\3llrxlr.exe83⤵PID:2820
-
\??\c:\hhthhn.exec:\hhthhn.exe84⤵PID:2648
-
\??\c:\bnhnbb.exec:\bnhnbb.exe85⤵PID:2772
-
\??\c:\pdppv.exec:\pdppv.exe86⤵PID:2284
-
\??\c:\pppdj.exec:\pppdj.exe87⤵PID:1660
-
\??\c:\xxxflxl.exec:\xxxflxl.exe88⤵PID:3068
-
\??\c:\bbnbhn.exec:\bbnbhn.exe89⤵PID:2624
-
\??\c:\dvjjp.exec:\dvjjp.exe90⤵PID:1732
-
\??\c:\ppdvp.exec:\ppdvp.exe91⤵PID:1880
-
\??\c:\lfxxrrf.exec:\lfxxrrf.exe92⤵PID:328
-
\??\c:\3nbhtb.exec:\3nbhtb.exe93⤵PID:1728
-
\??\c:\nbhtbb.exec:\nbhtbb.exe94⤵PID:2916
-
\??\c:\5pjjv.exec:\5pjjv.exe95⤵PID:1608
-
\??\c:\lxflxfl.exec:\lxflxfl.exe96⤵PID:1568
-
\??\c:\xxrxrrl.exec:\xxrxrrl.exe97⤵PID:820
-
\??\c:\1hhtbb.exec:\1hhtbb.exe98⤵PID:2136
-
\??\c:\jddjv.exec:\jddjv.exe99⤵PID:2928
-
\??\c:\7jdjp.exec:\7jdjp.exe100⤵PID:396
-
\??\c:\xrrxrfl.exec:\xrrxrfl.exe101⤵PID:1560
-
\??\c:\1bhnbh.exec:\1bhnbh.exe102⤵PID:780
-
\??\c:\tnhhtt.exec:\tnhhtt.exe103⤵PID:2588
-
\??\c:\3pvvv.exec:\3pvvv.exe104⤵PID:1468
-
\??\c:\lfxfxxl.exec:\lfxfxxl.exe105⤵PID:912
-
\??\c:\rfrxlfl.exec:\rfrxlfl.exe106⤵PID:2128
-
\??\c:\hhnthb.exec:\hhnthb.exe107⤵PID:108
-
\??\c:\jjjvp.exec:\jjjvp.exe108⤵PID:1984
-
\??\c:\dvpdp.exec:\dvpdp.exe109⤵PID:1684
-
\??\c:\rllrfrf.exec:\rllrfrf.exe110⤵PID:648
-
\??\c:\ttntnn.exec:\ttntnn.exe111⤵PID:2352
-
\??\c:\nhhnbh.exec:\nhhnbh.exe112⤵PID:564
-
\??\c:\pppjp.exec:\pppjp.exe113⤵PID:1428
-
\??\c:\fflrxxr.exec:\fflrxxr.exe114⤵PID:1000
-
\??\c:\nhbhnt.exec:\nhbhnt.exe115⤵PID:2716
-
\??\c:\hhnnhh.exec:\hhnnhh.exe116⤵PID:1496
-
\??\c:\jdddj.exec:\jdddj.exe117⤵PID:2780
-
\??\c:\vvjpd.exec:\vvjpd.exe118⤵PID:1644
-
\??\c:\rlffllf.exec:\rlffllf.exe119⤵PID:3044
-
\??\c:\btnbnn.exec:\btnbnn.exe120⤵PID:2304
-
\??\c:\tnbbtb.exec:\tnbbtb.exe121⤵PID:2844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-