Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 16:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fcc7f07253567f3d24d1b9b37b6fb2176277f235ca191216bb1b533c5ad82752N.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
120 seconds
General
-
Target
fcc7f07253567f3d24d1b9b37b6fb2176277f235ca191216bb1b533c5ad82752N.exe
-
Size
454KB
-
MD5
96c6733c872c40739541d6fbc5e13990
-
SHA1
b16bea653d4caa5f8ff08cb856517f63f5cda651
-
SHA256
fcc7f07253567f3d24d1b9b37b6fb2176277f235ca191216bb1b533c5ad82752
-
SHA512
3b9c7389f1aebc8722ef483055c4a11027400aa515cf26d81005433acceaa0e40a7156fda34056bc552d8c202692907f2ab980d6d00bfab5277035e3bf1c0e24
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2396-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1372-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-54-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-91-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2812-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1340-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/920-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/948-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1064-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-611-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2964-648-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2964-653-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2852-681-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2296-693-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1724-732-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-759-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-959-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1268-984-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1672-1010-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2888-1023-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-1172-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2840-1185-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2380 u640660.exe 2604 7tbthb.exe 2572 20262.exe 1372 824688.exe 2460 vjvvd.exe 2952 604644.exe 2816 5jppp.exe 3048 vvpvd.exe 3028 8206864.exe 1684 u884628.exe 2812 2602446.exe 2352 lflrxxx.exe 1828 2044046.exe 1572 8644006.exe 1672 thtttb.exe 1340 202882.exe 2024 642400.exe 1976 c426284.exe 1764 c600662.exe 556 rlrrflf.exe 3032 4622420.exe 1020 hbtntn.exe 2792 64668.exe 696 8268002.exe 1776 20606.exe 920 o024064.exe 948 26440.exe 2216 3xllllx.exe 2528 2602820.exe 344 7xlxfxf.exe 564 7rxrrll.exe 1752 jpdjv.exe 2416 dvpdj.exe 2372 jjppp.exe 2380 vpddd.exe 2612 dvjpv.exe 2096 42002.exe 1676 7nbbht.exe 536 9frxllr.exe 2300 00008.exe 3056 60842.exe 2824 8688440.exe 2852 u480002.exe 2808 q02466.exe 2724 4448440.exe 2720 e08800.exe 2340 e88466.exe 1204 1pjpv.exe 2552 86842.exe 2332 048404.exe 2628 7ffxrll.exe 2456 lfxfrrx.exe 2116 dpddd.exe 2496 5rrlrll.exe 1064 3djpp.exe 1912 42088.exe 1976 68222.exe 1956 20288.exe 1640 nhnhhh.exe 2272 82040.exe 3032 5rxflfr.exe 2348 5llllff.exe 2912 nbhbbt.exe 2792 602244.exe -
resource yara_rule behavioral1/memory/2396-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-759-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-821-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-864-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-878-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-891-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-934-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-972-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-1023-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-1108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-1133-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2204-1135-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e04444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42662.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 024882.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0844440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u640842.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m4288.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c060600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64284.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2396 wrote to memory of 2380 2396 fcc7f07253567f3d24d1b9b37b6fb2176277f235ca191216bb1b533c5ad82752N.exe 30 PID 2396 wrote to memory of 2380 2396 fcc7f07253567f3d24d1b9b37b6fb2176277f235ca191216bb1b533c5ad82752N.exe 30 PID 2396 wrote to memory of 2380 2396 fcc7f07253567f3d24d1b9b37b6fb2176277f235ca191216bb1b533c5ad82752N.exe 30 PID 2396 wrote to memory of 2380 2396 fcc7f07253567f3d24d1b9b37b6fb2176277f235ca191216bb1b533c5ad82752N.exe 30 PID 2380 wrote to memory of 2604 2380 u640660.exe 31 PID 2380 wrote to memory of 2604 2380 u640660.exe 31 PID 2380 wrote to memory of 2604 2380 u640660.exe 31 PID 2380 wrote to memory of 2604 2380 u640660.exe 31 PID 2604 wrote to memory of 2572 2604 7tbthb.exe 32 PID 2604 wrote to memory of 2572 2604 7tbthb.exe 32 PID 2604 wrote to memory of 2572 2604 7tbthb.exe 32 PID 2604 wrote to memory of 2572 2604 7tbthb.exe 32 PID 2572 wrote to memory of 1372 2572 20262.exe 33 PID 2572 wrote to memory of 1372 2572 20262.exe 33 PID 2572 wrote to memory of 1372 2572 20262.exe 33 PID 2572 wrote to memory of 1372 2572 20262.exe 33 PID 1372 wrote to memory of 2460 1372 824688.exe 34 PID 1372 wrote to memory of 2460 1372 824688.exe 34 PID 1372 wrote to memory of 2460 1372 824688.exe 34 PID 1372 wrote to memory of 2460 1372 824688.exe 34 PID 2460 wrote to memory of 2952 2460 vjvvd.exe 35 PID 2460 wrote to memory of 2952 2460 vjvvd.exe 35 PID 2460 wrote to memory of 2952 2460 vjvvd.exe 35 PID 2460 wrote to memory of 2952 2460 vjvvd.exe 35 PID 2952 wrote to memory of 2816 2952 604644.exe 36 PID 2952 wrote to memory of 2816 2952 604644.exe 36 PID 2952 wrote to memory of 2816 2952 604644.exe 36 PID 2952 wrote to memory of 2816 2952 604644.exe 36 PID 2816 wrote to memory of 3048 2816 5jppp.exe 37 PID 2816 wrote to memory of 3048 2816 5jppp.exe 37 PID 2816 wrote to memory of 3048 2816 5jppp.exe 37 PID 2816 wrote to memory of 3048 2816 5jppp.exe 37 PID 3048 wrote to memory of 3028 3048 vvpvd.exe 38 PID 3048 wrote to memory of 3028 3048 vvpvd.exe 38 PID 3048 wrote to memory of 3028 3048 vvpvd.exe 38 PID 3048 wrote to memory of 3028 3048 vvpvd.exe 38 PID 3028 wrote to memory of 1684 3028 8206864.exe 39 PID 3028 wrote to memory of 1684 3028 8206864.exe 39 PID 3028 wrote to memory of 1684 3028 8206864.exe 39 PID 3028 wrote to memory of 1684 3028 8206864.exe 39 PID 1684 wrote to memory of 2812 1684 u884628.exe 40 PID 1684 wrote to memory of 2812 1684 u884628.exe 40 PID 1684 wrote to memory of 2812 1684 u884628.exe 40 PID 1684 wrote to memory of 2812 1684 u884628.exe 40 PID 2812 wrote to memory of 2352 2812 2602446.exe 41 PID 2812 wrote to memory of 2352 2812 2602446.exe 41 PID 2812 wrote to memory of 2352 2812 2602446.exe 41 PID 2812 wrote to memory of 2352 2812 2602446.exe 41 PID 2352 wrote to memory of 1828 2352 lflrxxx.exe 42 PID 2352 wrote to memory of 1828 2352 lflrxxx.exe 42 PID 2352 wrote to memory of 1828 2352 lflrxxx.exe 42 PID 2352 wrote to memory of 1828 2352 lflrxxx.exe 42 PID 1828 wrote to memory of 1572 1828 2044046.exe 43 PID 1828 wrote to memory of 1572 1828 2044046.exe 43 PID 1828 wrote to memory of 1572 1828 2044046.exe 43 PID 1828 wrote to memory of 1572 1828 2044046.exe 43 PID 1572 wrote to memory of 1672 1572 8644006.exe 44 PID 1572 wrote to memory of 1672 1572 8644006.exe 44 PID 1572 wrote to memory of 1672 1572 8644006.exe 44 PID 1572 wrote to memory of 1672 1572 8644006.exe 44 PID 1672 wrote to memory of 1340 1672 thtttb.exe 45 PID 1672 wrote to memory of 1340 1672 thtttb.exe 45 PID 1672 wrote to memory of 1340 1672 thtttb.exe 45 PID 1672 wrote to memory of 1340 1672 thtttb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcc7f07253567f3d24d1b9b37b6fb2176277f235ca191216bb1b533c5ad82752N.exe"C:\Users\Admin\AppData\Local\Temp\fcc7f07253567f3d24d1b9b37b6fb2176277f235ca191216bb1b533c5ad82752N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\u640660.exec:\u640660.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\7tbthb.exec:\7tbthb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\20262.exec:\20262.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\824688.exec:\824688.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\vjvvd.exec:\vjvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\604644.exec:\604644.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\5jppp.exec:\5jppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\vvpvd.exec:\vvpvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\8206864.exec:\8206864.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\u884628.exec:\u884628.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\2602446.exec:\2602446.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\lflrxxx.exec:\lflrxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\2044046.exec:\2044046.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\8644006.exec:\8644006.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\thtttb.exec:\thtttb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\202882.exec:\202882.exe17⤵
- Executes dropped EXE
PID:1340 -
\??\c:\642400.exec:\642400.exe18⤵
- Executes dropped EXE
PID:2024 -
\??\c:\c426284.exec:\c426284.exe19⤵
- Executes dropped EXE
PID:1976 -
\??\c:\c600662.exec:\c600662.exe20⤵
- Executes dropped EXE
PID:1764 -
\??\c:\rlrrflf.exec:\rlrrflf.exe21⤵
- Executes dropped EXE
PID:556 -
\??\c:\4622420.exec:\4622420.exe22⤵
- Executes dropped EXE
PID:3032 -
\??\c:\hbtntn.exec:\hbtntn.exe23⤵
- Executes dropped EXE
PID:1020 -
\??\c:\64668.exec:\64668.exe24⤵
- Executes dropped EXE
PID:2792 -
\??\c:\8268002.exec:\8268002.exe25⤵
- Executes dropped EXE
PID:696 -
\??\c:\20606.exec:\20606.exe26⤵
- Executes dropped EXE
PID:1776 -
\??\c:\o024064.exec:\o024064.exe27⤵
- Executes dropped EXE
PID:920 -
\??\c:\26440.exec:\26440.exe28⤵
- Executes dropped EXE
PID:948 -
\??\c:\3xllllx.exec:\3xllllx.exe29⤵
- Executes dropped EXE
PID:2216 -
\??\c:\2602820.exec:\2602820.exe30⤵
- Executes dropped EXE
PID:2528 -
\??\c:\7xlxfxf.exec:\7xlxfxf.exe31⤵
- Executes dropped EXE
PID:344 -
\??\c:\7rxrrll.exec:\7rxrrll.exe32⤵
- Executes dropped EXE
PID:564 -
\??\c:\jpdjv.exec:\jpdjv.exe33⤵
- Executes dropped EXE
PID:1752 -
\??\c:\dvpdj.exec:\dvpdj.exe34⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jjppp.exec:\jjppp.exe35⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vpddd.exec:\vpddd.exe36⤵
- Executes dropped EXE
PID:2380 -
\??\c:\dvjpv.exec:\dvjpv.exe37⤵
- Executes dropped EXE
PID:2612 -
\??\c:\42002.exec:\42002.exe38⤵
- Executes dropped EXE
PID:2096 -
\??\c:\7nbbht.exec:\7nbbht.exe39⤵
- Executes dropped EXE
PID:1676 -
\??\c:\9frxllr.exec:\9frxllr.exe40⤵
- Executes dropped EXE
PID:536 -
\??\c:\00008.exec:\00008.exe41⤵
- Executes dropped EXE
PID:2300 -
\??\c:\60842.exec:\60842.exe42⤵
- Executes dropped EXE
PID:3056 -
\??\c:\8688440.exec:\8688440.exe43⤵
- Executes dropped EXE
PID:2824 -
\??\c:\u480002.exec:\u480002.exe44⤵
- Executes dropped EXE
PID:2852 -
\??\c:\q02466.exec:\q02466.exe45⤵
- Executes dropped EXE
PID:2808 -
\??\c:\4448440.exec:\4448440.exe46⤵
- Executes dropped EXE
PID:2724 -
\??\c:\e08800.exec:\e08800.exe47⤵
- Executes dropped EXE
PID:2720 -
\??\c:\e88466.exec:\e88466.exe48⤵
- Executes dropped EXE
PID:2340 -
\??\c:\1pjpv.exec:\1pjpv.exe49⤵
- Executes dropped EXE
PID:1204 -
\??\c:\86842.exec:\86842.exe50⤵
- Executes dropped EXE
PID:2552 -
\??\c:\048404.exec:\048404.exe51⤵
- Executes dropped EXE
PID:2332 -
\??\c:\7ffxrll.exec:\7ffxrll.exe52⤵
- Executes dropped EXE
PID:2628 -
\??\c:\lfxfrrx.exec:\lfxfrrx.exe53⤵
- Executes dropped EXE
PID:2456 -
\??\c:\dpddd.exec:\dpddd.exe54⤵
- Executes dropped EXE
PID:2116 -
\??\c:\5rrlrll.exec:\5rrlrll.exe55⤵
- Executes dropped EXE
PID:2496 -
\??\c:\3djpp.exec:\3djpp.exe56⤵
- Executes dropped EXE
PID:1064 -
\??\c:\42088.exec:\42088.exe57⤵
- Executes dropped EXE
PID:1912 -
\??\c:\68222.exec:\68222.exe58⤵
- Executes dropped EXE
PID:1976 -
\??\c:\20288.exec:\20288.exe59⤵
- Executes dropped EXE
PID:1956 -
\??\c:\nhnhhh.exec:\nhnhhh.exe60⤵
- Executes dropped EXE
PID:1640 -
\??\c:\82040.exec:\82040.exe61⤵
- Executes dropped EXE
PID:2272 -
\??\c:\5rxflfr.exec:\5rxflfr.exe62⤵
- Executes dropped EXE
PID:3032 -
\??\c:\5llllff.exec:\5llllff.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2348 -
\??\c:\nbhbbt.exec:\nbhbbt.exe64⤵
- Executes dropped EXE
PID:2912 -
\??\c:\602244.exec:\602244.exe65⤵
- Executes dropped EXE
PID:2792 -
\??\c:\ddjjd.exec:\ddjjd.exe66⤵PID:1612
-
\??\c:\dvjpv.exec:\dvjpv.exe67⤵PID:1656
-
\??\c:\rlrxxxl.exec:\rlrxxxl.exe68⤵PID:1036
-
\??\c:\jdppd.exec:\jdppd.exe69⤵
- System Location Discovery: System Language Discovery
PID:1780 -
\??\c:\bthntb.exec:\bthntb.exe70⤵PID:948
-
\??\c:\thtbbh.exec:\thtbbh.exe71⤵PID:2516
-
\??\c:\46406.exec:\46406.exe72⤵PID:2288
-
\??\c:\864400.exec:\864400.exe73⤵PID:2600
-
\??\c:\2028426.exec:\2028426.exe74⤵PID:344
-
\??\c:\9xfxrrr.exec:\9xfxrrr.exe75⤵PID:908
-
\??\c:\xlxxxrx.exec:\xlxxxrx.exe76⤵PID:2204
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe77⤵PID:1568
-
\??\c:\24020.exec:\24020.exe78⤵PID:2384
-
\??\c:\7bhhtt.exec:\7bhhtt.exe79⤵PID:1600
-
\??\c:\rfllrrr.exec:\rfllrrr.exe80⤵PID:2560
-
\??\c:\1vjjj.exec:\1vjjj.exe81⤵PID:2612
-
\??\c:\bnbtnn.exec:\bnbtnn.exe82⤵PID:2868
-
\??\c:\hbnbtb.exec:\hbnbtb.exe83⤵PID:2580
-
\??\c:\20884.exec:\20884.exe84⤵PID:2512
-
\??\c:\6422200.exec:\6422200.exe85⤵PID:2584
-
\??\c:\dpddj.exec:\dpddj.exe86⤵PID:2844
-
\??\c:\1jvvv.exec:\1jvvv.exe87⤵PID:2964
-
\??\c:\i088006.exec:\i088006.exe88⤵PID:2852
-
\??\c:\0222884.exec:\0222884.exe89⤵PID:2828
-
\??\c:\08002.exec:\08002.exe90⤵PID:2740
-
\??\c:\6426666.exec:\6426666.exe91⤵PID:1684
-
\??\c:\q48400.exec:\q48400.exe92⤵PID:2736
-
\??\c:\o206440.exec:\o206440.exe93⤵PID:2296
-
\??\c:\2466602.exec:\2466602.exe94⤵PID:2552
-
\??\c:\5nbbhb.exec:\5nbbhb.exe95⤵PID:1404
-
\??\c:\hhbntb.exec:\hhbntb.exe96⤵PID:2144
-
\??\c:\64280.exec:\64280.exe97⤵PID:1732
-
\??\c:\frfrrlr.exec:\frfrrlr.exe98⤵PID:2116
-
\??\c:\lflfrrx.exec:\lflfrrx.exe99⤵PID:1512
-
\??\c:\86284.exec:\86284.exe100⤵PID:1724
-
\??\c:\646228.exec:\646228.exe101⤵PID:2756
-
\??\c:\424622.exec:\424622.exe102⤵PID:2916
-
\??\c:\6426662.exec:\6426662.exe103⤵PID:852
-
\??\c:\w42666.exec:\w42666.exe104⤵PID:1640
-
\??\c:\lxrxxxx.exec:\lxrxxxx.exe105⤵PID:2272
-
\??\c:\vpppv.exec:\vpppv.exe106⤵PID:3032
-
\??\c:\dvdvd.exec:\dvdvd.exe107⤵PID:2348
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe108⤵PID:1092
-
\??\c:\26068.exec:\26068.exe109⤵PID:1868
-
\??\c:\5frxfff.exec:\5frxfff.exe110⤵PID:2112
-
\??\c:\1frrrxx.exec:\1frrrxx.exe111⤵PID:1776
-
\??\c:\jjvdp.exec:\jjvdp.exe112⤵PID:1344
-
\??\c:\608406.exec:\608406.exe113⤵PID:2392
-
\??\c:\hhbhnt.exec:\hhbhnt.exe114⤵PID:948
-
\??\c:\3vjpj.exec:\3vjpj.exe115⤵PID:1688
-
\??\c:\82462.exec:\82462.exe116⤵PID:2288
-
\??\c:\c424668.exec:\c424668.exe117⤵PID:1852
-
\??\c:\k80804.exec:\k80804.exe118⤵PID:1000
-
\??\c:\602840.exec:\602840.exe119⤵PID:2292
-
\??\c:\o022484.exec:\o022484.exe120⤵PID:2648
-
\??\c:\2462288.exec:\2462288.exe121⤵PID:1704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-