Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 18:42
Static task
static1
Behavioral task
behavioral1
Sample
2bd657e04132b5b1fff810ab08a0f29bfd63aed0693d70a26efb17e7c1ba0355.exe
Resource
win7-20240903-en
General
-
Target
2bd657e04132b5b1fff810ab08a0f29bfd63aed0693d70a26efb17e7c1ba0355.exe
-
Size
456KB
-
MD5
356c47031a54e3043e8012b6a732d2c0
-
SHA1
22b9fc21fabdc3e4b74582da706e7b9018b60d15
-
SHA256
2bd657e04132b5b1fff810ab08a0f29bfd63aed0693d70a26efb17e7c1ba0355
-
SHA512
86166b7e17d063d3417adc9ad0c89bf16c2443fa293ed9050347300888a9d0a5168245c4ffec18f74395ae33313b03eca8fbdf7ac9eaf54203440e39f595da1c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR8:q7Tc2NYHUrAwfMp3CDR8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2400-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-101-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1360-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1064-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1292-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1324-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-413-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1984-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-553-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2920-572-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1904-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/920-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/300-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-660-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-668-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/280-721-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1584-803-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2172 lrlrrxx.exe 1844 bbnhhb.exe 2888 rrlllrr.exe 2716 hthhbt.exe 2860 jdjvd.exe 2744 htnbbn.exe 2852 pppjv.exe 2784 lfxrxrx.exe 2620 nhhthb.exe 3044 rrflxxf.exe 1360 thhnnn.exe 1864 pvvjj.exe 1064 rfrrxrf.exe 1256 tnbbnn.exe 2440 dpddj.exe 1040 rlxlrrf.exe 1192 9dpjv.exe 300 vvjjv.exe 1292 1rrrflx.exe 588 hbtbhh.exe 1396 xrllxff.exe 920 nthhtb.exe 1348 vjddp.exe 2116 frfflfr.exe 1324 3hbhtn.exe 2320 vpjpv.exe 2044 3lllxfl.exe 2164 9nbbnn.exe 2200 btnttt.exe 1856 7jjjv.exe 2552 lflrfrx.exe 1524 bbtthb.exe 2212 3frfxxl.exe 2204 fxlrxlr.exe 2696 bntttt.exe 2888 vjppv.exe 1916 pjdvd.exe 2768 lfrxflx.exe 2312 nhntbb.exe 2432 vvpvp.exe 2852 jdjdj.exe 2604 5fxlflr.exe 3052 nhnttt.exe 2628 ttnthh.exe 3040 jdddv.exe 1820 rfrxffr.exe 1688 rlxfxfr.exe 800 hhtbhn.exe 1984 jjddj.exe 576 pjdjj.exe 2440 1lfflrx.exe 764 5bhhtb.exe 2504 hhhhhn.exe 1444 vjvvd.exe 2396 frxrfxf.exe 1888 rlxlxfr.exe 1904 htnntb.exe 588 jdddj.exe 1556 xrrfxlf.exe 396 hbtnbb.exe 2488 bnhnbb.exe 832 jdvdp.exe 2116 llffllx.exe 2420 fxllrrf.exe -
resource yara_rule behavioral1/memory/2400-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-728-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2668-920-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-957-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2172 2400 2bd657e04132b5b1fff810ab08a0f29bfd63aed0693d70a26efb17e7c1ba0355.exe 30 PID 2400 wrote to memory of 2172 2400 2bd657e04132b5b1fff810ab08a0f29bfd63aed0693d70a26efb17e7c1ba0355.exe 30 PID 2400 wrote to memory of 2172 2400 2bd657e04132b5b1fff810ab08a0f29bfd63aed0693d70a26efb17e7c1ba0355.exe 30 PID 2400 wrote to memory of 2172 2400 2bd657e04132b5b1fff810ab08a0f29bfd63aed0693d70a26efb17e7c1ba0355.exe 30 PID 2172 wrote to memory of 1844 2172 lrlrrxx.exe 31 PID 2172 wrote to memory of 1844 2172 lrlrrxx.exe 31 PID 2172 wrote to memory of 1844 2172 lrlrrxx.exe 31 PID 2172 wrote to memory of 1844 2172 lrlrrxx.exe 31 PID 1844 wrote to memory of 2888 1844 bbnhhb.exe 32 PID 1844 wrote to memory of 2888 1844 bbnhhb.exe 32 PID 1844 wrote to memory of 2888 1844 bbnhhb.exe 32 PID 1844 wrote to memory of 2888 1844 bbnhhb.exe 32 PID 2888 wrote to memory of 2716 2888 rrlllrr.exe 33 PID 2888 wrote to memory of 2716 2888 rrlllrr.exe 33 PID 2888 wrote to memory of 2716 2888 rrlllrr.exe 33 PID 2888 wrote to memory of 2716 2888 rrlllrr.exe 33 PID 2716 wrote to memory of 2860 2716 hthhbt.exe 34 PID 2716 wrote to memory of 2860 2716 hthhbt.exe 34 PID 2716 wrote to memory of 2860 2716 hthhbt.exe 34 PID 2716 wrote to memory of 2860 2716 hthhbt.exe 34 PID 2860 wrote to memory of 2744 2860 jdjvd.exe 35 PID 2860 wrote to memory of 2744 2860 jdjvd.exe 35 PID 2860 wrote to memory of 2744 2860 jdjvd.exe 35 PID 2860 wrote to memory of 2744 2860 jdjvd.exe 35 PID 2744 wrote to memory of 2852 2744 htnbbn.exe 36 PID 2744 wrote to memory of 2852 2744 htnbbn.exe 36 PID 2744 wrote to memory of 2852 2744 htnbbn.exe 36 PID 2744 wrote to memory of 2852 2744 htnbbn.exe 36 PID 2852 wrote to memory of 2784 2852 pppjv.exe 37 PID 2852 wrote to memory of 2784 2852 pppjv.exe 37 PID 2852 wrote to memory of 2784 2852 pppjv.exe 37 PID 2852 wrote to memory of 2784 2852 pppjv.exe 37 PID 2784 wrote to memory of 2620 2784 lfxrxrx.exe 38 PID 2784 wrote to memory of 2620 2784 lfxrxrx.exe 38 PID 2784 wrote to memory of 2620 2784 lfxrxrx.exe 38 PID 2784 wrote to memory of 2620 2784 lfxrxrx.exe 38 PID 2620 wrote to memory of 3044 2620 nhhthb.exe 39 PID 2620 wrote to memory of 3044 2620 nhhthb.exe 39 PID 2620 wrote to memory of 3044 2620 nhhthb.exe 39 PID 2620 wrote to memory of 3044 2620 nhhthb.exe 39 PID 3044 wrote to memory of 1360 3044 rrflxxf.exe 40 PID 3044 wrote to memory of 1360 3044 rrflxxf.exe 40 PID 3044 wrote to memory of 1360 3044 rrflxxf.exe 40 PID 3044 wrote to memory of 1360 3044 rrflxxf.exe 40 PID 1360 wrote to memory of 1864 1360 thhnnn.exe 41 PID 1360 wrote to memory of 1864 1360 thhnnn.exe 41 PID 1360 wrote to memory of 1864 1360 thhnnn.exe 41 PID 1360 wrote to memory of 1864 1360 thhnnn.exe 41 PID 1864 wrote to memory of 1064 1864 pvvjj.exe 42 PID 1864 wrote to memory of 1064 1864 pvvjj.exe 42 PID 1864 wrote to memory of 1064 1864 pvvjj.exe 42 PID 1864 wrote to memory of 1064 1864 pvvjj.exe 42 PID 1064 wrote to memory of 1256 1064 rfrrxrf.exe 43 PID 1064 wrote to memory of 1256 1064 rfrrxrf.exe 43 PID 1064 wrote to memory of 1256 1064 rfrrxrf.exe 43 PID 1064 wrote to memory of 1256 1064 rfrrxrf.exe 43 PID 1256 wrote to memory of 2440 1256 tnbbnn.exe 80 PID 1256 wrote to memory of 2440 1256 tnbbnn.exe 80 PID 1256 wrote to memory of 2440 1256 tnbbnn.exe 80 PID 1256 wrote to memory of 2440 1256 tnbbnn.exe 80 PID 2440 wrote to memory of 1040 2440 dpddj.exe 45 PID 2440 wrote to memory of 1040 2440 dpddj.exe 45 PID 2440 wrote to memory of 1040 2440 dpddj.exe 45 PID 2440 wrote to memory of 1040 2440 dpddj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bd657e04132b5b1fff810ab08a0f29bfd63aed0693d70a26efb17e7c1ba0355.exe"C:\Users\Admin\AppData\Local\Temp\2bd657e04132b5b1fff810ab08a0f29bfd63aed0693d70a26efb17e7c1ba0355.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\lrlrrxx.exec:\lrlrrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\bbnhhb.exec:\bbnhhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\rrlllrr.exec:\rrlllrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\hthhbt.exec:\hthhbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\jdjvd.exec:\jdjvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\htnbbn.exec:\htnbbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\pppjv.exec:\pppjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\lfxrxrx.exec:\lfxrxrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\nhhthb.exec:\nhhthb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\rrflxxf.exec:\rrflxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\thhnnn.exec:\thhnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\pvvjj.exec:\pvvjj.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\rfrrxrf.exec:\rfrrxrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\tnbbnn.exec:\tnbbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\dpddj.exec:\dpddj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\rlxlrrf.exec:\rlxlrrf.exe17⤵
- Executes dropped EXE
PID:1040 -
\??\c:\9dpjv.exec:\9dpjv.exe18⤵
- Executes dropped EXE
PID:1192 -
\??\c:\vvjjv.exec:\vvjjv.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:300 -
\??\c:\1rrrflx.exec:\1rrrflx.exe20⤵
- Executes dropped EXE
PID:1292 -
\??\c:\hbtbhh.exec:\hbtbhh.exe21⤵
- Executes dropped EXE
PID:588 -
\??\c:\xrllxff.exec:\xrllxff.exe22⤵
- Executes dropped EXE
PID:1396 -
\??\c:\nthhtb.exec:\nthhtb.exe23⤵
- Executes dropped EXE
PID:920 -
\??\c:\vjddp.exec:\vjddp.exe24⤵
- Executes dropped EXE
PID:1348 -
\??\c:\frfflfr.exec:\frfflfr.exe25⤵
- Executes dropped EXE
PID:2116 -
\??\c:\3hbhtn.exec:\3hbhtn.exe26⤵
- Executes dropped EXE
PID:1324 -
\??\c:\vpjpv.exec:\vpjpv.exe27⤵
- Executes dropped EXE
PID:2320 -
\??\c:\3lllxfl.exec:\3lllxfl.exe28⤵
- Executes dropped EXE
PID:2044 -
\??\c:\9nbbnn.exec:\9nbbnn.exe29⤵
- Executes dropped EXE
PID:2164 -
\??\c:\btnttt.exec:\btnttt.exe30⤵
- Executes dropped EXE
PID:2200 -
\??\c:\7jjjv.exec:\7jjjv.exe31⤵
- Executes dropped EXE
PID:1856 -
\??\c:\lflrfrx.exec:\lflrfrx.exe32⤵
- Executes dropped EXE
PID:2552 -
\??\c:\bbtthb.exec:\bbtthb.exe33⤵
- Executes dropped EXE
PID:1524 -
\??\c:\3frfxxl.exec:\3frfxxl.exe34⤵
- Executes dropped EXE
PID:2212 -
\??\c:\fxlrxlr.exec:\fxlrxlr.exe35⤵
- Executes dropped EXE
PID:2204 -
\??\c:\bntttt.exec:\bntttt.exe36⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vjppv.exec:\vjppv.exe37⤵
- Executes dropped EXE
PID:2888 -
\??\c:\pjdvd.exec:\pjdvd.exe38⤵
- Executes dropped EXE
PID:1916 -
\??\c:\lfrxflx.exec:\lfrxflx.exe39⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nhntbb.exec:\nhntbb.exe40⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vvpvp.exec:\vvpvp.exe41⤵
- Executes dropped EXE
PID:2432 -
\??\c:\jdjdj.exec:\jdjdj.exe42⤵
- Executes dropped EXE
PID:2852 -
\??\c:\5fxlflr.exec:\5fxlflr.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\nhnttt.exec:\nhnttt.exe44⤵
- Executes dropped EXE
PID:3052 -
\??\c:\ttnthh.exec:\ttnthh.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2628 -
\??\c:\jdddv.exec:\jdddv.exe46⤵
- Executes dropped EXE
PID:3040 -
\??\c:\rfrxffr.exec:\rfrxffr.exe47⤵
- Executes dropped EXE
PID:1820 -
\??\c:\rlxfxfr.exec:\rlxfxfr.exe48⤵
- Executes dropped EXE
PID:1688 -
\??\c:\hhtbhn.exec:\hhtbhn.exe49⤵
- Executes dropped EXE
PID:800 -
\??\c:\jjddj.exec:\jjddj.exe50⤵
- Executes dropped EXE
PID:1984 -
\??\c:\pjdjj.exec:\pjdjj.exe51⤵
- Executes dropped EXE
PID:576 -
\??\c:\1lfflrx.exec:\1lfflrx.exe52⤵
- Executes dropped EXE
PID:2440 -
\??\c:\5bhhtb.exec:\5bhhtb.exe53⤵
- Executes dropped EXE
PID:764 -
\??\c:\hhhhhn.exec:\hhhhhn.exe54⤵
- Executes dropped EXE
PID:2504 -
\??\c:\vjvvd.exec:\vjvvd.exe55⤵
- Executes dropped EXE
PID:1444 -
\??\c:\frxrfxf.exec:\frxrfxf.exe56⤵
- Executes dropped EXE
PID:2396 -
\??\c:\rlxlxfr.exec:\rlxlxfr.exe57⤵
- Executes dropped EXE
PID:1888 -
\??\c:\htnntb.exec:\htnntb.exe58⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jdddj.exec:\jdddj.exe59⤵
- Executes dropped EXE
PID:588 -
\??\c:\xrrfxlf.exec:\xrrfxlf.exe60⤵
- Executes dropped EXE
PID:1556 -
\??\c:\hbtnbb.exec:\hbtnbb.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:396 -
\??\c:\bnhnbb.exec:\bnhnbb.exe62⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jdvdp.exec:\jdvdp.exe63⤵
- Executes dropped EXE
PID:832 -
\??\c:\llffllx.exec:\llffllx.exe64⤵
- Executes dropped EXE
PID:2116 -
\??\c:\fxllrrf.exec:\fxllrrf.exe65⤵
- Executes dropped EXE
PID:2420 -
\??\c:\hbthhb.exec:\hbthhb.exe66⤵PID:2352
-
\??\c:\3jvpp.exec:\3jvpp.exe67⤵PID:2044
-
\??\c:\jdvpd.exec:\jdvpd.exe68⤵PID:1492
-
\??\c:\fllrxfr.exec:\fllrxfr.exe69⤵PID:1992
-
\??\c:\hbntnn.exec:\hbntnn.exe70⤵PID:892
-
\??\c:\hhbhtb.exec:\hhbhtb.exe71⤵PID:1652
-
\??\c:\jdjjd.exec:\jdjjd.exe72⤵PID:2920
-
\??\c:\5pjjv.exec:\5pjjv.exe73⤵PID:696
-
\??\c:\rfrflxr.exec:\rfrflxr.exe74⤵PID:1792
-
\??\c:\rrffllx.exec:\rrffllx.exe75⤵PID:1152
-
\??\c:\9ttbhh.exec:\9ttbhh.exe76⤵PID:1844
-
\??\c:\9pdpv.exec:\9pdpv.exe77⤵PID:2720
-
\??\c:\7dddd.exec:\7dddd.exe78⤵PID:2332
-
\??\c:\rlxlflf.exec:\rlxlflf.exe79⤵PID:2764
-
\??\c:\lfxxflr.exec:\lfxxflr.exe80⤵PID:1780
-
\??\c:\7nbntt.exec:\7nbntt.exe81⤵PID:2728
-
\??\c:\jdvjp.exec:\jdvjp.exe82⤵PID:2312
-
\??\c:\fffrxxl.exec:\fffrxxl.exe83⤵PID:2432
-
\??\c:\hthnbb.exec:\hthnbb.exe84⤵PID:1960
-
\??\c:\btntbh.exec:\btntbh.exe85⤵PID:2536
-
\??\c:\dvjpd.exec:\dvjpd.exe86⤵PID:2732
-
\??\c:\fxrxxxr.exec:\fxrxxxr.exe87⤵PID:3068
-
\??\c:\5hbttt.exec:\5hbttt.exe88⤵PID:2080
-
\??\c:\vpjjv.exec:\vpjjv.exe89⤵PID:2436
-
\??\c:\7xxlrrx.exec:\7xxlrrx.exe90⤵PID:1028
-
\??\c:\tbntbb.exec:\tbntbb.exe91⤵PID:2124
-
\??\c:\xrfxfll.exec:\xrfxfll.exe92⤵PID:1564
-
\??\c:\btnttn.exec:\btnttn.exe93⤵
- System Location Discovery: System Language Discovery
PID:1032 -
\??\c:\xxrflxl.exec:\xxrflxl.exe94⤵PID:768
-
\??\c:\tnnthn.exec:\tnnthn.exe95⤵PID:280
-
\??\c:\xrlllrx.exec:\xrlllrx.exe96⤵PID:2128
-
\??\c:\dpjvp.exec:\dpjvp.exe97⤵PID:2260
-
\??\c:\xlrlrrf.exec:\xlrlrrf.exe98⤵PID:2308
-
\??\c:\5hhbnb.exec:\5hhbnb.exe99⤵PID:956
-
\??\c:\7vjjv.exec:\7vjjv.exe100⤵PID:2192
-
\??\c:\9bhhhh.exec:\9bhhhh.exe101⤵PID:1904
-
\??\c:\vjvdp.exec:\vjvdp.exe102⤵PID:2184
-
\??\c:\fxrrffl.exec:\fxrrffl.exe103⤵PID:1912
-
\??\c:\nhtttn.exec:\nhtttn.exe104⤵PID:2096
-
\??\c:\vpjvp.exec:\vpjvp.exe105⤵PID:1584
-
\??\c:\lxrrxxf.exec:\lxrrxxf.exe106⤵PID:552
-
\??\c:\tnhnhn.exec:\tnhnhn.exe107⤵PID:988
-
\??\c:\ddvdj.exec:\ddvdj.exe108⤵PID:2252
-
\??\c:\9vvvv.exec:\9vvvv.exe109⤵PID:2328
-
\??\c:\rlxxrrx.exec:\rlxxrrx.exe110⤵PID:984
-
\??\c:\bthntb.exec:\bthntb.exe111⤵PID:608
-
\??\c:\jdjdp.exec:\jdjdp.exe112⤵PID:888
-
\??\c:\fxrrflr.exec:\fxrrflr.exe113⤵PID:1884
-
\??\c:\5rxxxxr.exec:\5rxxxxr.exe114⤵PID:1576
-
\??\c:\btnbbt.exec:\btnbbt.exe115⤵PID:2276
-
\??\c:\jdpvd.exec:\jdpvd.exe116⤵PID:2916
-
\??\c:\xrlxfrx.exec:\xrlxfrx.exe117⤵PID:1848
-
\??\c:\3xllxxx.exec:\3xllxxx.exe118⤵PID:1488
-
\??\c:\bbthtn.exec:\bbthtn.exe119⤵PID:2444
-
\??\c:\1jvdj.exec:\1jvdj.exe120⤵PID:916
-
\??\c:\xfxlxfr.exec:\xfxlxfr.exe121⤵PID:2720
-
\??\c:\7ddvv.exec:\7ddvv.exe122⤵PID:2332
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-