Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 16:57
Static task
static1
Behavioral task
behavioral1
Sample
5997c21c83b9bda568c721c5e072f88394bb82f97b57b7b4cf5f9fde341b4f99.exe
Resource
win7-20240903-en
General
-
Target
5997c21c83b9bda568c721c5e072f88394bb82f97b57b7b4cf5f9fde341b4f99.exe
-
Size
453KB
-
MD5
ff12cce6f28003906be1bf1600dcd20b
-
SHA1
c3fc64a3520c166d4d27fdb472cda71fa2fff3cb
-
SHA256
5997c21c83b9bda568c721c5e072f88394bb82f97b57b7b4cf5f9fde341b4f99
-
SHA512
1d5bd843186ec038605524e709564555584ff81d94a94cf6f8a55cb3e55831233541d757ac0ccca3fdc25e26d8a6600a25f4fad93234f7bc1457051b76fff325
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeY:q7Tc2NYHUrAwfMp3CDY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/1884-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-73-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2656-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/808-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-181-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3028-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-234-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1548-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/708-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-303-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2600-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-349-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2212-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1448-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-746-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-757-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2396-758-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1992-785-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1992-804-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1716-830-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-861-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2812-1170-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/852-1248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-1290-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2296-1309-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2548 ntthbh.exe 2556 lfrrffl.exe 2512 nnthbn.exe 2240 rxlllrx.exe 2932 9vpjd.exe 2268 rxlrxxf.exe 2792 lxrrllx.exe 2656 vdpvd.exe 1912 7hnbbt.exe 2444 xrrfxlx.exe 560 pjvjp.exe 2860 lrfflxx.exe 784 fllxlxr.exe 808 rxxrxxx.exe 484 nbnntb.exe 2848 rxrlllr.exe 1044 hbhhbb.exe 1776 tbbtnt.exe 2672 3djdd.exe 2296 frxllfr.exe 2336 djvjp.exe 3028 pjdpj.exe 2836 xrlrflr.exe 1416 fflfxrl.exe 1548 pdjjv.exe 704 tthttn.exe 1784 jpvpv.exe 1716 dvppv.exe 2484 nnthbn.exe 1832 pvppp.exe 708 llfxrxl.exe 1068 pvddd.exe 2600 jddpp.exe 348 bhnnbh.exe 2560 5dvjj.exe 2272 bnthnt.exe 2476 1ppdv.exe 2512 lxllffx.exe 2908 tnthht.exe 2896 btthtn.exe 2212 jppjj.exe 2764 1hnthn.exe 2988 djdpd.exe 2448 9xlxxfx.exe 2804 bbhbtb.exe 2644 jpjvj.exe 2312 rlflrrr.exe 2444 thtnbb.exe 1048 3ppdv.exe 592 lllxxlx.exe 1516 htbhnb.exe 600 jpvvp.exe 2036 rxfrfll.exe 2832 xrllxlr.exe 1888 dddpj.exe 2040 pjvvp.exe 3016 1rfrrlx.exe 3004 nbhnhb.exe 2372 jvvvp.exe 2384 xrlrflx.exe 2220 bthhhn.exe 1448 1vpvd.exe 840 nnbtbb.exe 2612 5pvjj.exe -
resource yara_rule behavioral1/memory/1884-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/708-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/708-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-830-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-895-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-1098-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-1172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-1203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-1228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-1248-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrllxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrllfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1884 wrote to memory of 2548 1884 5997c21c83b9bda568c721c5e072f88394bb82f97b57b7b4cf5f9fde341b4f99.exe 30 PID 1884 wrote to memory of 2548 1884 5997c21c83b9bda568c721c5e072f88394bb82f97b57b7b4cf5f9fde341b4f99.exe 30 PID 1884 wrote to memory of 2548 1884 5997c21c83b9bda568c721c5e072f88394bb82f97b57b7b4cf5f9fde341b4f99.exe 30 PID 1884 wrote to memory of 2548 1884 5997c21c83b9bda568c721c5e072f88394bb82f97b57b7b4cf5f9fde341b4f99.exe 30 PID 2548 wrote to memory of 2556 2548 ntthbh.exe 31 PID 2548 wrote to memory of 2556 2548 ntthbh.exe 31 PID 2548 wrote to memory of 2556 2548 ntthbh.exe 31 PID 2548 wrote to memory of 2556 2548 ntthbh.exe 31 PID 2556 wrote to memory of 2512 2556 lfrrffl.exe 32 PID 2556 wrote to memory of 2512 2556 lfrrffl.exe 32 PID 2556 wrote to memory of 2512 2556 lfrrffl.exe 32 PID 2556 wrote to memory of 2512 2556 lfrrffl.exe 32 PID 2512 wrote to memory of 2240 2512 nnthbn.exe 33 PID 2512 wrote to memory of 2240 2512 nnthbn.exe 33 PID 2512 wrote to memory of 2240 2512 nnthbn.exe 33 PID 2512 wrote to memory of 2240 2512 nnthbn.exe 33 PID 2240 wrote to memory of 2932 2240 rxlllrx.exe 34 PID 2240 wrote to memory of 2932 2240 rxlllrx.exe 34 PID 2240 wrote to memory of 2932 2240 rxlllrx.exe 34 PID 2240 wrote to memory of 2932 2240 rxlllrx.exe 34 PID 2932 wrote to memory of 2268 2932 9vpjd.exe 35 PID 2932 wrote to memory of 2268 2932 9vpjd.exe 35 PID 2932 wrote to memory of 2268 2932 9vpjd.exe 35 PID 2932 wrote to memory of 2268 2932 9vpjd.exe 35 PID 2268 wrote to memory of 2792 2268 rxlrxxf.exe 36 PID 2268 wrote to memory of 2792 2268 rxlrxxf.exe 36 PID 2268 wrote to memory of 2792 2268 rxlrxxf.exe 36 PID 2268 wrote to memory of 2792 2268 rxlrxxf.exe 36 PID 2792 wrote to memory of 2656 2792 lxrrllx.exe 37 PID 2792 wrote to memory of 2656 2792 lxrrllx.exe 37 PID 2792 wrote to memory of 2656 2792 lxrrllx.exe 37 PID 2792 wrote to memory of 2656 2792 lxrrllx.exe 37 PID 2656 wrote to memory of 1912 2656 vdpvd.exe 38 PID 2656 wrote to memory of 1912 2656 vdpvd.exe 38 PID 2656 wrote to memory of 1912 2656 vdpvd.exe 38 PID 2656 wrote to memory of 1912 2656 vdpvd.exe 38 PID 1912 wrote to memory of 2444 1912 7hnbbt.exe 39 PID 1912 wrote to memory of 2444 1912 7hnbbt.exe 39 PID 1912 wrote to memory of 2444 1912 7hnbbt.exe 39 PID 1912 wrote to memory of 2444 1912 7hnbbt.exe 39 PID 2444 wrote to memory of 560 2444 xrrfxlx.exe 40 PID 2444 wrote to memory of 560 2444 xrrfxlx.exe 40 PID 2444 wrote to memory of 560 2444 xrrfxlx.exe 40 PID 2444 wrote to memory of 560 2444 xrrfxlx.exe 40 PID 560 wrote to memory of 2860 560 pjvjp.exe 41 PID 560 wrote to memory of 2860 560 pjvjp.exe 41 PID 560 wrote to memory of 2860 560 pjvjp.exe 41 PID 560 wrote to memory of 2860 560 pjvjp.exe 41 PID 2860 wrote to memory of 784 2860 lrfflxx.exe 42 PID 2860 wrote to memory of 784 2860 lrfflxx.exe 42 PID 2860 wrote to memory of 784 2860 lrfflxx.exe 42 PID 2860 wrote to memory of 784 2860 lrfflxx.exe 42 PID 784 wrote to memory of 808 784 fllxlxr.exe 43 PID 784 wrote to memory of 808 784 fllxlxr.exe 43 PID 784 wrote to memory of 808 784 fllxlxr.exe 43 PID 784 wrote to memory of 808 784 fllxlxr.exe 43 PID 808 wrote to memory of 484 808 rxxrxxx.exe 44 PID 808 wrote to memory of 484 808 rxxrxxx.exe 44 PID 808 wrote to memory of 484 808 rxxrxxx.exe 44 PID 808 wrote to memory of 484 808 rxxrxxx.exe 44 PID 484 wrote to memory of 2848 484 nbnntb.exe 45 PID 484 wrote to memory of 2848 484 nbnntb.exe 45 PID 484 wrote to memory of 2848 484 nbnntb.exe 45 PID 484 wrote to memory of 2848 484 nbnntb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5997c21c83b9bda568c721c5e072f88394bb82f97b57b7b4cf5f9fde341b4f99.exe"C:\Users\Admin\AppData\Local\Temp\5997c21c83b9bda568c721c5e072f88394bb82f97b57b7b4cf5f9fde341b4f99.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\ntthbh.exec:\ntthbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\lfrrffl.exec:\lfrrffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\nnthbn.exec:\nnthbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\rxlllrx.exec:\rxlllrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\9vpjd.exec:\9vpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\rxlrxxf.exec:\rxlrxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\lxrrllx.exec:\lxrrllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\vdpvd.exec:\vdpvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\7hnbbt.exec:\7hnbbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\xrrfxlx.exec:\xrrfxlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\pjvjp.exec:\pjvjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\lrfflxx.exec:\lrfflxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\fllxlxr.exec:\fllxlxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\rxxrxxx.exec:\rxxrxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\nbnntb.exec:\nbnntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\rxrlllr.exec:\rxrlllr.exe17⤵
- Executes dropped EXE
PID:2848 -
\??\c:\hbhhbb.exec:\hbhhbb.exe18⤵
- Executes dropped EXE
PID:1044 -
\??\c:\tbbtnt.exec:\tbbtnt.exe19⤵
- Executes dropped EXE
PID:1776 -
\??\c:\3djdd.exec:\3djdd.exe20⤵
- Executes dropped EXE
PID:2672 -
\??\c:\frxllfr.exec:\frxllfr.exe21⤵
- Executes dropped EXE
PID:2296 -
\??\c:\djvjp.exec:\djvjp.exe22⤵
- Executes dropped EXE
PID:2336 -
\??\c:\pjdpj.exec:\pjdpj.exe23⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xrlrflr.exec:\xrlrflr.exe24⤵
- Executes dropped EXE
PID:2836 -
\??\c:\fflfxrl.exec:\fflfxrl.exe25⤵
- Executes dropped EXE
PID:1416 -
\??\c:\pdjjv.exec:\pdjjv.exe26⤵
- Executes dropped EXE
PID:1548 -
\??\c:\tthttn.exec:\tthttn.exe27⤵
- Executes dropped EXE
PID:704 -
\??\c:\jpvpv.exec:\jpvpv.exe28⤵
- Executes dropped EXE
PID:1784 -
\??\c:\dvppv.exec:\dvppv.exe29⤵
- Executes dropped EXE
PID:1716 -
\??\c:\nnthbn.exec:\nnthbn.exe30⤵
- Executes dropped EXE
PID:2484 -
\??\c:\pvppp.exec:\pvppp.exe31⤵
- Executes dropped EXE
PID:1832 -
\??\c:\llfxrxl.exec:\llfxrxl.exe32⤵
- Executes dropped EXE
PID:708 -
\??\c:\pvddd.exec:\pvddd.exe33⤵
- Executes dropped EXE
PID:1068 -
\??\c:\jddpp.exec:\jddpp.exe34⤵
- Executes dropped EXE
PID:2600 -
\??\c:\bhnnbh.exec:\bhnnbh.exe35⤵
- Executes dropped EXE
PID:348 -
\??\c:\5dvjj.exec:\5dvjj.exe36⤵
- Executes dropped EXE
PID:2560 -
\??\c:\bnthnt.exec:\bnthnt.exe37⤵
- Executes dropped EXE
PID:2272 -
\??\c:\1ppdv.exec:\1ppdv.exe38⤵
- Executes dropped EXE
PID:2476 -
\??\c:\lxllffx.exec:\lxllffx.exe39⤵
- Executes dropped EXE
PID:2512 -
\??\c:\tnthht.exec:\tnthht.exe40⤵
- Executes dropped EXE
PID:2908 -
\??\c:\btthtn.exec:\btthtn.exe41⤵
- Executes dropped EXE
PID:2896 -
\??\c:\jppjj.exec:\jppjj.exe42⤵
- Executes dropped EXE
PID:2212 -
\??\c:\1hnthn.exec:\1hnthn.exe43⤵
- Executes dropped EXE
PID:2764 -
\??\c:\djdpd.exec:\djdpd.exe44⤵
- Executes dropped EXE
PID:2988 -
\??\c:\9xlxxfx.exec:\9xlxxfx.exe45⤵
- Executes dropped EXE
PID:2448 -
\??\c:\bbhbtb.exec:\bbhbtb.exe46⤵
- Executes dropped EXE
PID:2804 -
\??\c:\jpjvj.exec:\jpjvj.exe47⤵
- Executes dropped EXE
PID:2644 -
\??\c:\rlflrrr.exec:\rlflrrr.exe48⤵
- Executes dropped EXE
PID:2312 -
\??\c:\thtnbb.exec:\thtnbb.exe49⤵
- Executes dropped EXE
PID:2444 -
\??\c:\3ppdv.exec:\3ppdv.exe50⤵
- Executes dropped EXE
PID:1048 -
\??\c:\lllxxlx.exec:\lllxxlx.exe51⤵
- Executes dropped EXE
PID:592 -
\??\c:\htbhnb.exec:\htbhnb.exe52⤵
- Executes dropped EXE
PID:1516 -
\??\c:\jpvvp.exec:\jpvvp.exe53⤵
- Executes dropped EXE
PID:600 -
\??\c:\rxfrfll.exec:\rxfrfll.exe54⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xrllxlr.exec:\xrllxlr.exe55⤵
- Executes dropped EXE
PID:2832 -
\??\c:\dddpj.exec:\dddpj.exe56⤵
- Executes dropped EXE
PID:1888 -
\??\c:\pjvvp.exec:\pjvvp.exe57⤵
- Executes dropped EXE
PID:2040 -
\??\c:\1rfrrlx.exec:\1rfrrlx.exe58⤵
- Executes dropped EXE
PID:3016 -
\??\c:\nbhnhb.exec:\nbhnhb.exe59⤵
- Executes dropped EXE
PID:3004 -
\??\c:\jvvvp.exec:\jvvvp.exe60⤵
- Executes dropped EXE
PID:2372 -
\??\c:\xrlrflx.exec:\xrlrflx.exe61⤵
- Executes dropped EXE
PID:2384 -
\??\c:\bthhhn.exec:\bthhhn.exe62⤵
- Executes dropped EXE
PID:2220 -
\??\c:\1vpvd.exec:\1vpvd.exe63⤵
- Executes dropped EXE
PID:1448 -
\??\c:\nnbtbb.exec:\nnbtbb.exe64⤵
- Executes dropped EXE
PID:840 -
\??\c:\5pvjj.exec:\5pvjj.exe65⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rlrflfr.exec:\rlrflfr.exe66⤵PID:2616
-
\??\c:\hnntnb.exec:\hnntnb.exe67⤵PID:1036
-
\??\c:\djvpp.exec:\djvpp.exe68⤵PID:1568
-
\??\c:\1rflfrf.exec:\1rflfrf.exe69⤵PID:2128
-
\??\c:\nnnbhn.exec:\nnnbhn.exe70⤵PID:1800
-
\??\c:\7jpvv.exec:\7jpvv.exe71⤵PID:2104
-
\??\c:\3rlrfll.exec:\3rlrfll.exe72⤵PID:2544
-
\??\c:\nbnbbt.exec:\nbnbbt.exe73⤵PID:1916
-
\??\c:\djjdj.exec:\djjdj.exe74⤵PID:2484
-
\??\c:\nnhhbn.exec:\nnhhbn.exe75⤵PID:2288
-
\??\c:\dvpdv.exec:\dvpdv.exe76⤵PID:2076
-
\??\c:\5xfrflf.exec:\5xfrflf.exe77⤵PID:2344
-
\??\c:\bthhtb.exec:\bthhtb.exe78⤵PID:1684
-
\??\c:\9vdvv.exec:\9vdvv.exe79⤵PID:2160
-
\??\c:\lxxfflf.exec:\lxxfflf.exe80⤵PID:1620
-
\??\c:\hhbnhn.exec:\hhbnhn.exe81⤵PID:2308
-
\??\c:\lfrxlxx.exec:\lfrxlxx.exe82⤵PID:2316
-
\??\c:\ttnbnt.exec:\ttnbnt.exe83⤵PID:2320
-
\??\c:\vddjj.exec:\vddjj.exe84⤵PID:2760
-
\??\c:\5rlrxrf.exec:\5rlrxrf.exe85⤵PID:2904
-
\??\c:\tntttn.exec:\tntttn.exe86⤵PID:2300
-
\??\c:\dvpjv.exec:\dvpjv.exe87⤵PID:2216
-
\??\c:\fllxrfl.exec:\fllxrfl.exe88⤵PID:2596
-
\??\c:\thtbnn.exec:\thtbnn.exe89⤵PID:2304
-
\??\c:\pdjpv.exec:\pdjpv.exe90⤵PID:2768
-
\??\c:\lfllxrr.exec:\lfllxrr.exe91⤵PID:2448
-
\??\c:\7dvpv.exec:\7dvpv.exe92⤵PID:2916
-
\??\c:\rfxxxfl.exec:\rfxxxfl.exe93⤵PID:2648
-
\??\c:\3nthnt.exec:\3nthnt.exe94⤵PID:1312
-
\??\c:\7jjdd.exec:\7jjdd.exe95⤵PID:1280
-
\??\c:\xflfflf.exec:\xflfflf.exe96⤵PID:2964
-
\??\c:\tbbthb.exec:\tbbthb.exe97⤵
- System Location Discovery: System Language Discovery
PID:580 -
\??\c:\dvjdj.exec:\dvjdj.exe98⤵PID:1644
-
\??\c:\frxffrf.exec:\frxffrf.exe99⤵PID:2856
-
\??\c:\tbhtth.exec:\tbhtth.exe100⤵PID:576
-
\??\c:\jddjp.exec:\jddjp.exe101⤵PID:928
-
\??\c:\rfrlxxf.exec:\rfrlxxf.exe102⤵
- System Location Discovery: System Language Discovery
PID:1796 -
\??\c:\tthbnt.exec:\tthbnt.exe103⤵PID:2972
-
\??\c:\9pddv.exec:\9pddv.exe104⤵PID:2060
-
\??\c:\ffxfxfx.exec:\ffxfxfx.exe105⤵PID:2996
-
\??\c:\tnhtth.exec:\tnhtth.exe106⤵PID:2672
-
\??\c:\dvvjv.exec:\dvvjv.exe107⤵PID:2396
-
\??\c:\rlrxrfr.exec:\rlrxrfr.exe108⤵PID:1632
-
\??\c:\tnbtnh.exec:\tnbtnh.exe109⤵PID:2404
-
\??\c:\pdppj.exec:\pdppj.exe110⤵PID:780
-
\??\c:\rffffxx.exec:\rffffxx.exe111⤵PID:1992
-
\??\c:\5bthtn.exec:\5bthtn.exe112⤵PID:1388
-
\??\c:\rrxfxlf.exec:\rrxfxlf.exe113⤵PID:960
-
\??\c:\7hhbnt.exec:\7hhbnt.exe114⤵PID:1768
-
\??\c:\dddjv.exec:\dddjv.exe115⤵PID:704
-
\??\c:\llfffrf.exec:\llfffrf.exe116⤵PID:944
-
\??\c:\btbthn.exec:\btbthn.exe117⤵PID:2244
-
\??\c:\5jjjd.exec:\5jjjd.exe118⤵PID:1716
-
\??\c:\rxxrxrr.exec:\rxxrxrr.exe119⤵PID:3044
-
\??\c:\1bhthb.exec:\1bhthb.exe120⤵PID:1832
-
\??\c:\pdpdv.exec:\pdpdv.exe121⤵PID:2576
-
\??\c:\xflxrff.exec:\xflxrff.exe122⤵PID:904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-