Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 18:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
732579d15d8704274a520082830eec612992aede56bceb1419f92a624bc5ba72N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
732579d15d8704274a520082830eec612992aede56bceb1419f92a624bc5ba72N.exe
-
Size
454KB
-
MD5
6cfbf66dfa57d2fea3557c3f8054be40
-
SHA1
c81a594dac7c84aa202b523789c8e253a6bfd30b
-
SHA256
732579d15d8704274a520082830eec612992aede56bceb1419f92a624bc5ba72
-
SHA512
9a39697ad38c10f357c786a476159cbe5c6286770e909098691a43b080f27a441284d0a726766219335b8d1aba4ec488cef6b1ffa43e5c787281d77e10ce4e93
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTP:q7Tc2NYHUrAwfMp3CDb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/1916-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-65-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2968-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-76-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2540-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-86-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2664-96-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2336-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-105-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1816-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-169-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2408-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/820-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/820-224-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1820-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-375-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2584-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-409-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2212-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-455-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/972-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-633-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2932-640-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/3008-647-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1728-701-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2076-725-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/972-741-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1636-760-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1932-767-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1032-774-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1712-793-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/316-813-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-869-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1048-1029-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2388-1099-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2284-1106-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2628-1107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1732 vvpdj.exe 2824 lfrxxxx.exe 3016 bnbtbt.exe 2772 jdvpv.exe 2668 5rxxxxf.exe 2812 hntthb.exe 2968 xlflllr.exe 2540 7nhhhh.exe 2664 dpvpj.exe 2336 7frllll.exe 1816 nnbtnh.exe 1556 7ntnnh.exe 1996 1vdvd.exe 640 btbhnb.exe 2760 pdpvv.exe 324 vdvvv.exe 2004 fxlxxrx.exe 2416 nbnhhn.exe 952 vpvdd.exe 2408 fxrxxfl.exe 2120 hthbtn.exe 2872 pjddd.exe 820 lxlrrrr.exe 1820 rlxfllx.exe 1644 hbbbhb.exe 1712 1xxxxxx.exe 1876 9thhnn.exe 2104 1pdvv.exe 2100 rrfxxxx.exe 2988 1bnbhb.exe 2444 jdjdj.exe 1732 pdpjj.exe 2728 7thbtn.exe 2652 vpjpp.exe 3016 3pddv.exe 2992 tbhhbb.exe 2660 7djjj.exe 2780 pdjdd.exe 2740 rflrrlr.exe 2716 bnthhh.exe 2680 jppdd.exe 2540 7bnnhb.exe 2360 9pvvv.exe 2584 vjvvv.exe 2940 lfrxxxx.exe 916 tnbbbh.exe 2008 hhttbb.exe 1088 1dddp.exe 1996 jdppv.exe 1788 lrxrrlr.exe 1728 bntbtt.exe 976 jvvvd.exe 320 pjpjj.exe 2212 rrfxxxl.exe 2416 tnbhtn.exe 476 5httnn.exe 972 3dddv.exe 2380 dpvvp.exe 2120 lfrxxrx.exe 1048 1bntbt.exe 1076 hntttn.exe 820 3pvpp.exe 800 xlxxxxf.exe 760 rlffllr.exe -
resource yara_rule behavioral1/memory/1916-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-76-0x00000000001C0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/2540-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/972-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-701-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/972-741-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2420-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-775-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-813-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-978-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-1030-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-1092-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-1107-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1916 wrote to memory of 1732 1916 732579d15d8704274a520082830eec612992aede56bceb1419f92a624bc5ba72N.exe 31 PID 1916 wrote to memory of 1732 1916 732579d15d8704274a520082830eec612992aede56bceb1419f92a624bc5ba72N.exe 31 PID 1916 wrote to memory of 1732 1916 732579d15d8704274a520082830eec612992aede56bceb1419f92a624bc5ba72N.exe 31 PID 1916 wrote to memory of 1732 1916 732579d15d8704274a520082830eec612992aede56bceb1419f92a624bc5ba72N.exe 31 PID 1732 wrote to memory of 2824 1732 vvpdj.exe 32 PID 1732 wrote to memory of 2824 1732 vvpdj.exe 32 PID 1732 wrote to memory of 2824 1732 vvpdj.exe 32 PID 1732 wrote to memory of 2824 1732 vvpdj.exe 32 PID 2824 wrote to memory of 3016 2824 lfrxxxx.exe 33 PID 2824 wrote to memory of 3016 2824 lfrxxxx.exe 33 PID 2824 wrote to memory of 3016 2824 lfrxxxx.exe 33 PID 2824 wrote to memory of 3016 2824 lfrxxxx.exe 33 PID 3016 wrote to memory of 2772 3016 bnbtbt.exe 34 PID 3016 wrote to memory of 2772 3016 bnbtbt.exe 34 PID 3016 wrote to memory of 2772 3016 bnbtbt.exe 34 PID 3016 wrote to memory of 2772 3016 bnbtbt.exe 34 PID 2772 wrote to memory of 2668 2772 jdvpv.exe 35 PID 2772 wrote to memory of 2668 2772 jdvpv.exe 35 PID 2772 wrote to memory of 2668 2772 jdvpv.exe 35 PID 2772 wrote to memory of 2668 2772 jdvpv.exe 35 PID 2668 wrote to memory of 2812 2668 5rxxxxf.exe 36 PID 2668 wrote to memory of 2812 2668 5rxxxxf.exe 36 PID 2668 wrote to memory of 2812 2668 5rxxxxf.exe 36 PID 2668 wrote to memory of 2812 2668 5rxxxxf.exe 36 PID 2812 wrote to memory of 2968 2812 hntthb.exe 37 PID 2812 wrote to memory of 2968 2812 hntthb.exe 37 PID 2812 wrote to memory of 2968 2812 hntthb.exe 37 PID 2812 wrote to memory of 2968 2812 hntthb.exe 37 PID 2968 wrote to memory of 2540 2968 xlflllr.exe 38 PID 2968 wrote to memory of 2540 2968 xlflllr.exe 38 PID 2968 wrote to memory of 2540 2968 xlflllr.exe 38 PID 2968 wrote to memory of 2540 2968 xlflllr.exe 38 PID 2540 wrote to memory of 2664 2540 7nhhhh.exe 39 PID 2540 wrote to memory of 2664 2540 7nhhhh.exe 39 PID 2540 wrote to memory of 2664 2540 7nhhhh.exe 39 PID 2540 wrote to memory of 2664 2540 7nhhhh.exe 39 PID 2664 wrote to memory of 2336 2664 dpvpj.exe 40 PID 2664 wrote to memory of 2336 2664 dpvpj.exe 40 PID 2664 wrote to memory of 2336 2664 dpvpj.exe 40 PID 2664 wrote to memory of 2336 2664 dpvpj.exe 40 PID 2336 wrote to memory of 1816 2336 7frllll.exe 41 PID 2336 wrote to memory of 1816 2336 7frllll.exe 41 PID 2336 wrote to memory of 1816 2336 7frllll.exe 41 PID 2336 wrote to memory of 1816 2336 7frllll.exe 41 PID 1816 wrote to memory of 1556 1816 nnbtnh.exe 42 PID 1816 wrote to memory of 1556 1816 nnbtnh.exe 42 PID 1816 wrote to memory of 1556 1816 nnbtnh.exe 42 PID 1816 wrote to memory of 1556 1816 nnbtnh.exe 42 PID 1556 wrote to memory of 1996 1556 7ntnnh.exe 43 PID 1556 wrote to memory of 1996 1556 7ntnnh.exe 43 PID 1556 wrote to memory of 1996 1556 7ntnnh.exe 43 PID 1556 wrote to memory of 1996 1556 7ntnnh.exe 43 PID 1996 wrote to memory of 640 1996 1vdvd.exe 44 PID 1996 wrote to memory of 640 1996 1vdvd.exe 44 PID 1996 wrote to memory of 640 1996 1vdvd.exe 44 PID 1996 wrote to memory of 640 1996 1vdvd.exe 44 PID 640 wrote to memory of 2760 640 btbhnb.exe 45 PID 640 wrote to memory of 2760 640 btbhnb.exe 45 PID 640 wrote to memory of 2760 640 btbhnb.exe 45 PID 640 wrote to memory of 2760 640 btbhnb.exe 45 PID 2760 wrote to memory of 324 2760 pdpvv.exe 46 PID 2760 wrote to memory of 324 2760 pdpvv.exe 46 PID 2760 wrote to memory of 324 2760 pdpvv.exe 46 PID 2760 wrote to memory of 324 2760 pdpvv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\732579d15d8704274a520082830eec612992aede56bceb1419f92a624bc5ba72N.exe"C:\Users\Admin\AppData\Local\Temp\732579d15d8704274a520082830eec612992aede56bceb1419f92a624bc5ba72N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\vvpdj.exec:\vvpdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\lfrxxxx.exec:\lfrxxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\bnbtbt.exec:\bnbtbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\jdvpv.exec:\jdvpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\5rxxxxf.exec:\5rxxxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\hntthb.exec:\hntthb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\xlflllr.exec:\xlflllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\7nhhhh.exec:\7nhhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\dpvpj.exec:\dpvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\7frllll.exec:\7frllll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\nnbtnh.exec:\nnbtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\7ntnnh.exec:\7ntnnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\1vdvd.exec:\1vdvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\btbhnb.exec:\btbhnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\pdpvv.exec:\pdpvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\vdvvv.exec:\vdvvv.exe17⤵
- Executes dropped EXE
PID:324 -
\??\c:\fxlxxrx.exec:\fxlxxrx.exe18⤵
- Executes dropped EXE
PID:2004 -
\??\c:\nbnhhn.exec:\nbnhhn.exe19⤵
- Executes dropped EXE
PID:2416 -
\??\c:\vpvdd.exec:\vpvdd.exe20⤵
- Executes dropped EXE
PID:952 -
\??\c:\fxrxxfl.exec:\fxrxxfl.exe21⤵
- Executes dropped EXE
PID:2408 -
\??\c:\hthbtn.exec:\hthbtn.exe22⤵
- Executes dropped EXE
PID:2120 -
\??\c:\pjddd.exec:\pjddd.exe23⤵
- Executes dropped EXE
PID:2872 -
\??\c:\lxlrrrr.exec:\lxlrrrr.exe24⤵
- Executes dropped EXE
PID:820 -
\??\c:\rlxfllx.exec:\rlxfllx.exe25⤵
- Executes dropped EXE
PID:1820 -
\??\c:\hbbbhb.exec:\hbbbhb.exe26⤵
- Executes dropped EXE
PID:1644 -
\??\c:\1xxxxxx.exec:\1xxxxxx.exe27⤵
- Executes dropped EXE
PID:1712 -
\??\c:\9thhnn.exec:\9thhnn.exe28⤵
- Executes dropped EXE
PID:1876 -
\??\c:\1pdvv.exec:\1pdvv.exe29⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rrfxxxx.exec:\rrfxxxx.exe30⤵
- Executes dropped EXE
PID:2100 -
\??\c:\1bnbhb.exec:\1bnbhb.exe31⤵
- Executes dropped EXE
PID:2988 -
\??\c:\jdjdj.exec:\jdjdj.exe32⤵
- Executes dropped EXE
PID:2444 -
\??\c:\pdpjj.exec:\pdpjj.exe33⤵
- Executes dropped EXE
PID:1732 -
\??\c:\7thbtn.exec:\7thbtn.exe34⤵
- Executes dropped EXE
PID:2728 -
\??\c:\vpjpp.exec:\vpjpp.exe35⤵
- Executes dropped EXE
PID:2652 -
\??\c:\3pddv.exec:\3pddv.exe36⤵
- Executes dropped EXE
PID:3016 -
\??\c:\tbhhbb.exec:\tbhhbb.exe37⤵
- Executes dropped EXE
PID:2992 -
\??\c:\7djjj.exec:\7djjj.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pdjdd.exec:\pdjdd.exe39⤵
- Executes dropped EXE
PID:2780 -
\??\c:\rflrrlr.exec:\rflrrlr.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\bnthhh.exec:\bnthhh.exe41⤵
- Executes dropped EXE
PID:2716 -
\??\c:\jppdd.exec:\jppdd.exe42⤵
- Executes dropped EXE
PID:2680 -
\??\c:\7bnnhb.exec:\7bnnhb.exe43⤵
- Executes dropped EXE
PID:2540 -
\??\c:\9pvvv.exec:\9pvvv.exe44⤵
- Executes dropped EXE
PID:2360 -
\??\c:\vjvvv.exec:\vjvvv.exe45⤵
- Executes dropped EXE
PID:2584 -
\??\c:\lfrxxxx.exec:\lfrxxxx.exe46⤵
- Executes dropped EXE
PID:2940 -
\??\c:\tnbbbh.exec:\tnbbbh.exe47⤵
- Executes dropped EXE
PID:916 -
\??\c:\hhttbb.exec:\hhttbb.exe48⤵
- Executes dropped EXE
PID:2008 -
\??\c:\1dddp.exec:\1dddp.exe49⤵
- Executes dropped EXE
PID:1088 -
\??\c:\jdppv.exec:\jdppv.exe50⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lrxrrlr.exec:\lrxrrlr.exe51⤵
- Executes dropped EXE
PID:1788 -
\??\c:\bntbtt.exec:\bntbtt.exe52⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jvvvd.exec:\jvvvd.exe53⤵
- Executes dropped EXE
PID:976 -
\??\c:\pjpjj.exec:\pjpjj.exe54⤵
- Executes dropped EXE
PID:320 -
\??\c:\rrfxxxl.exec:\rrfxxxl.exe55⤵
- Executes dropped EXE
PID:2212 -
\??\c:\tnbhtn.exec:\tnbhtn.exe56⤵
- Executes dropped EXE
PID:2416 -
\??\c:\5httnn.exec:\5httnn.exe57⤵
- Executes dropped EXE
PID:476 -
\??\c:\3dddv.exec:\3dddv.exe58⤵
- Executes dropped EXE
PID:972 -
\??\c:\dpvvp.exec:\dpvvp.exe59⤵
- Executes dropped EXE
PID:2380 -
\??\c:\lfrxxrx.exec:\lfrxxrx.exe60⤵
- Executes dropped EXE
PID:2120 -
\??\c:\1bntbt.exec:\1bntbt.exe61⤵
- Executes dropped EXE
PID:1048 -
\??\c:\hntttn.exec:\hntttn.exe62⤵
- Executes dropped EXE
PID:1076 -
\??\c:\3pvpp.exec:\3pvpp.exe63⤵
- Executes dropped EXE
PID:820 -
\??\c:\xlxxxxf.exec:\xlxxxxf.exe64⤵
- Executes dropped EXE
PID:800 -
\??\c:\rlffllr.exec:\rlffllr.exe65⤵
- Executes dropped EXE
PID:760 -
\??\c:\hnbtbt.exec:\hnbtbt.exe66⤵PID:2896
-
\??\c:\jjjvp.exec:\jjjvp.exe67⤵PID:2504
-
\??\c:\5pjjj.exec:\5pjjj.exe68⤵PID:296
-
\??\c:\rlxrxxr.exec:\rlxrxxr.exe69⤵PID:1480
-
\??\c:\9rffrxr.exec:\9rffrxr.exe70⤵PID:784
-
\??\c:\ntbbbt.exec:\ntbbbt.exe71⤵PID:2100
-
\??\c:\vjddv.exec:\vjddv.exe72⤵PID:2952
-
\??\c:\pdvvd.exec:\pdvvd.exe73⤵PID:1872
-
\??\c:\fxrllfl.exec:\fxrllfl.exe74⤵PID:1608
-
\??\c:\9flxrlf.exec:\9flxrlf.exe75⤵PID:2516
-
\??\c:\tthtnh.exec:\tthtnh.exe76⤵PID:2996
-
\??\c:\7ddjd.exec:\7ddjd.exe77⤵PID:2116
-
\??\c:\vpdvd.exec:\vpdvd.exe78⤵
- System Location Discovery: System Language Discovery
PID:1760 -
\??\c:\lxlfxrr.exec:\lxlfxrr.exe79⤵PID:2768
-
\??\c:\5nbbbt.exec:\5nbbbt.exe80⤵PID:2676
-
\??\c:\nhbhhn.exec:\nhbhhn.exe81⤵PID:2748
-
\??\c:\pjvdj.exec:\pjvdj.exe82⤵PID:2708
-
\??\c:\lxllrlr.exec:\lxllrlr.exe83⤵PID:2564
-
\??\c:\3flxrlf.exec:\3flxrlf.exe84⤵PID:2632
-
\??\c:\ttnhhb.exec:\ttnhhb.exe85⤵PID:2932
-
\??\c:\thbbbb.exec:\thbbbb.exe86⤵PID:3008
-
\??\c:\dvjpp.exec:\dvjpp.exe87⤵PID:2712
-
\??\c:\rfrlxxl.exec:\rfrlxxl.exe88⤵PID:2484
-
\??\c:\lxllllr.exec:\lxllllr.exe89⤵
- System Location Discovery: System Language Discovery
PID:1680 -
\??\c:\bnbbht.exec:\bnbbht.exe90⤵
- System Location Discovery: System Language Discovery
PID:916 -
\??\c:\dvdvp.exec:\dvdvp.exe91⤵PID:2364
-
\??\c:\5vvvj.exec:\5vvvj.exe92⤵PID:492
-
\??\c:\3lrllfl.exec:\3lrllfl.exe93⤵PID:1676
-
\??\c:\7nhtbt.exec:\7nhtbt.exe94⤵PID:1788
-
\??\c:\nbnntn.exec:\nbnntn.exe95⤵PID:1728
-
\??\c:\pjvpp.exec:\pjvpp.exe96⤵PID:2372
-
\??\c:\1ntnhh.exec:\1ntnhh.exe97⤵PID:2000
-
\??\c:\thtbbb.exec:\thtbbb.exe98⤵PID:2076
-
\??\c:\jdppv.exec:\jdppv.exe99⤵PID:1080
-
\??\c:\frffxfl.exec:\frffxfl.exe100⤵PID:2580
-
\??\c:\3xrrllf.exec:\3xrrllf.exe101⤵PID:972
-
\??\c:\bnnbhb.exec:\bnnbhb.exe102⤵PID:2420
-
\??\c:\9vjdp.exec:\9vjdp.exe103⤵PID:1636
-
\??\c:\vjpvj.exec:\vjpvj.exe104⤵PID:1932
-
\??\c:\xllllfr.exec:\xllllfr.exe105⤵PID:1032
-
\??\c:\nbnhnn.exec:\nbnhnn.exe106⤵PID:1500
-
\??\c:\jdddd.exec:\jdddd.exe107⤵PID:2344
-
\??\c:\vjvvv.exec:\vjvvv.exe108⤵PID:1712
-
\??\c:\3lrlfrr.exec:\3lrlfrr.exe109⤵PID:1388
-
\??\c:\fxlflll.exec:\fxlflll.exe110⤵PID:788
-
\??\c:\3bntbh.exec:\3bntbh.exe111⤵PID:316
-
\??\c:\vjvvp.exec:\vjvvp.exe112⤵PID:1020
-
\??\c:\7djjd.exec:\7djjd.exe113⤵PID:2388
-
\??\c:\9rxlrrl.exec:\9rxlrrl.exe114⤵PID:2284
-
\??\c:\nbhhht.exec:\nbhhht.exe115⤵PID:2056
-
\??\c:\bnbnbt.exec:\bnbnbt.exe116⤵PID:2636
-
\??\c:\3ppjd.exec:\3ppjd.exe117⤵PID:1732
-
\??\c:\3jjdv.exec:\3jjdv.exe118⤵PID:2128
-
\??\c:\xlfflfx.exec:\xlfflfx.exe119⤵PID:2116
-
\??\c:\5nnbnn.exec:\5nnbnn.exe120⤵PID:2800
-
\??\c:\1vddv.exec:\1vddv.exe121⤵PID:2832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-