Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 18:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1945e699342ffe3fa7be7a6af083f4392a62f25148c045e80c805903629f3d86.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
120 seconds
General
-
Target
1945e699342ffe3fa7be7a6af083f4392a62f25148c045e80c805903629f3d86.exe
-
Size
453KB
-
MD5
10f1042cda32e59b525d23ce6bd8f2ce
-
SHA1
cb673be2ce0ecb760fd27822a90498fc8b31c5e7
-
SHA256
1945e699342ffe3fa7be7a6af083f4392a62f25148c045e80c805903629f3d86
-
SHA512
8cc9005e0bd0cf30344930846a8d1f522f123a34f8aa651a987585fc97bc66bd000b24a1a035d924a2de7d2c316971872e204a0bddf2ce83d5d065b748ee56f1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeM:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/2264-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-45-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2096-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-85-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2772-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-106-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2292-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-104-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1292-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-158-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1428-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-262-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2792-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-485-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1948-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-536-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2124-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/376-683-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/376-682-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1260-729-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-772-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-826-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1688-951-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2428-980-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1320-1047-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1528-1061-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2464-1164-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2840-1171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-1184-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2416 a6844.exe 2992 g4666.exe 2524 3bhnnn.exe 2912 m6888.exe 2836 a8600.exe 2096 i460606.exe 2728 64824.exe 2928 nhtttt.exe 2772 3vjjd.exe 2292 ttnbhn.exe 920 fxfflfl.exe 768 428888.exe 1292 g0228.exe 1988 u422884.exe 1844 4824668.exe 772 080060.exe 2956 u644628.exe 1428 208866.exe 1680 i622446.exe 328 424006.exe 2808 48280.exe 1308 4244440.exe 1968 dpvdj.exe 1468 tnhnht.exe 944 vjppj.exe 1720 424404.exe 336 208888.exe 2124 864062.exe 2556 206622.exe 1960 w24460.exe 1440 5rxrllr.exe 2240 httntt.exe 2652 xrlrxfx.exe 2792 k08806.exe 2040 nbtnbb.exe 2464 08284.exe 2904 6468402.exe 2860 3jvdp.exe 536 042222.exe 2980 q86244.exe 568 08024.exe 2708 pjvvd.exe 2752 tbtbnh.exe 2784 2028062.exe 1688 9lfxxxx.exe 2428 7xlfllx.exe 2076 4206440.exe 1848 8684068.exe 2376 608844.exe 1684 208062.exe 2164 lfrrxrx.exe 820 e08440.exe 1500 7hbtnn.exe 2768 20882.exe 2896 vpjpv.exe 2564 pdpjj.exe 1884 s6446.exe 2476 ttnthn.exe 2160 6680886.exe 2168 602244.exe 844 9frrrlx.exe 2300 vpddj.exe 1948 hhnhnn.exe 1152 486688.exe -
resource yara_rule behavioral1/memory/2264-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-119-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1292-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-682-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1260-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-772-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-840-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-877-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-914-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-961-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-966-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-973-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1320-1047-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1528-1061-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2368-1082-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-1109-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2840-1171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-1185-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language g2624.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42400.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 860622.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m2680.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 604022.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8622268.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 822228.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s6408.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2264 wrote to memory of 2416 2264 1945e699342ffe3fa7be7a6af083f4392a62f25148c045e80c805903629f3d86.exe 31 PID 2264 wrote to memory of 2416 2264 1945e699342ffe3fa7be7a6af083f4392a62f25148c045e80c805903629f3d86.exe 31 PID 2264 wrote to memory of 2416 2264 1945e699342ffe3fa7be7a6af083f4392a62f25148c045e80c805903629f3d86.exe 31 PID 2264 wrote to memory of 2416 2264 1945e699342ffe3fa7be7a6af083f4392a62f25148c045e80c805903629f3d86.exe 31 PID 2416 wrote to memory of 2992 2416 a6844.exe 32 PID 2416 wrote to memory of 2992 2416 a6844.exe 32 PID 2416 wrote to memory of 2992 2416 a6844.exe 32 PID 2416 wrote to memory of 2992 2416 a6844.exe 32 PID 2992 wrote to memory of 2524 2992 g4666.exe 33 PID 2992 wrote to memory of 2524 2992 g4666.exe 33 PID 2992 wrote to memory of 2524 2992 g4666.exe 33 PID 2992 wrote to memory of 2524 2992 g4666.exe 33 PID 2524 wrote to memory of 2912 2524 3bhnnn.exe 34 PID 2524 wrote to memory of 2912 2524 3bhnnn.exe 34 PID 2524 wrote to memory of 2912 2524 3bhnnn.exe 34 PID 2524 wrote to memory of 2912 2524 3bhnnn.exe 34 PID 2912 wrote to memory of 2836 2912 m6888.exe 35 PID 2912 wrote to memory of 2836 2912 m6888.exe 35 PID 2912 wrote to memory of 2836 2912 m6888.exe 35 PID 2912 wrote to memory of 2836 2912 m6888.exe 35 PID 2836 wrote to memory of 2096 2836 a8600.exe 36 PID 2836 wrote to memory of 2096 2836 a8600.exe 36 PID 2836 wrote to memory of 2096 2836 a8600.exe 36 PID 2836 wrote to memory of 2096 2836 a8600.exe 36 PID 2096 wrote to memory of 2728 2096 i460606.exe 37 PID 2096 wrote to memory of 2728 2096 i460606.exe 37 PID 2096 wrote to memory of 2728 2096 i460606.exe 37 PID 2096 wrote to memory of 2728 2096 i460606.exe 37 PID 2728 wrote to memory of 2928 2728 64824.exe 38 PID 2728 wrote to memory of 2928 2728 64824.exe 38 PID 2728 wrote to memory of 2928 2728 64824.exe 38 PID 2728 wrote to memory of 2928 2728 64824.exe 38 PID 2928 wrote to memory of 2772 2928 nhtttt.exe 39 PID 2928 wrote to memory of 2772 2928 nhtttt.exe 39 PID 2928 wrote to memory of 2772 2928 nhtttt.exe 39 PID 2928 wrote to memory of 2772 2928 nhtttt.exe 39 PID 2772 wrote to memory of 2292 2772 3vjjd.exe 40 PID 2772 wrote to memory of 2292 2772 3vjjd.exe 40 PID 2772 wrote to memory of 2292 2772 3vjjd.exe 40 PID 2772 wrote to memory of 2292 2772 3vjjd.exe 40 PID 2292 wrote to memory of 920 2292 ttnbhn.exe 41 PID 2292 wrote to memory of 920 2292 ttnbhn.exe 41 PID 2292 wrote to memory of 920 2292 ttnbhn.exe 41 PID 2292 wrote to memory of 920 2292 ttnbhn.exe 41 PID 920 wrote to memory of 768 920 fxfflfl.exe 42 PID 920 wrote to memory of 768 920 fxfflfl.exe 42 PID 920 wrote to memory of 768 920 fxfflfl.exe 42 PID 920 wrote to memory of 768 920 fxfflfl.exe 42 PID 768 wrote to memory of 1292 768 428888.exe 43 PID 768 wrote to memory of 1292 768 428888.exe 43 PID 768 wrote to memory of 1292 768 428888.exe 43 PID 768 wrote to memory of 1292 768 428888.exe 43 PID 1292 wrote to memory of 1988 1292 g0228.exe 44 PID 1292 wrote to memory of 1988 1292 g0228.exe 44 PID 1292 wrote to memory of 1988 1292 g0228.exe 44 PID 1292 wrote to memory of 1988 1292 g0228.exe 44 PID 1988 wrote to memory of 1844 1988 u422884.exe 45 PID 1988 wrote to memory of 1844 1988 u422884.exe 45 PID 1988 wrote to memory of 1844 1988 u422884.exe 45 PID 1988 wrote to memory of 1844 1988 u422884.exe 45 PID 1844 wrote to memory of 772 1844 4824668.exe 46 PID 1844 wrote to memory of 772 1844 4824668.exe 46 PID 1844 wrote to memory of 772 1844 4824668.exe 46 PID 1844 wrote to memory of 772 1844 4824668.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\1945e699342ffe3fa7be7a6af083f4392a62f25148c045e80c805903629f3d86.exe"C:\Users\Admin\AppData\Local\Temp\1945e699342ffe3fa7be7a6af083f4392a62f25148c045e80c805903629f3d86.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\a6844.exec:\a6844.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\g4666.exec:\g4666.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\3bhnnn.exec:\3bhnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\m6888.exec:\m6888.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\a8600.exec:\a8600.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\i460606.exec:\i460606.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\64824.exec:\64824.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\nhtttt.exec:\nhtttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\3vjjd.exec:\3vjjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\ttnbhn.exec:\ttnbhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\fxfflfl.exec:\fxfflfl.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\428888.exec:\428888.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\g0228.exec:\g0228.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\u422884.exec:\u422884.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\4824668.exec:\4824668.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\080060.exec:\080060.exe17⤵
- Executes dropped EXE
PID:772 -
\??\c:\u644628.exec:\u644628.exe18⤵
- Executes dropped EXE
PID:2956 -
\??\c:\208866.exec:\208866.exe19⤵
- Executes dropped EXE
PID:1428 -
\??\c:\i622446.exec:\i622446.exe20⤵
- Executes dropped EXE
PID:1680 -
\??\c:\424006.exec:\424006.exe21⤵
- Executes dropped EXE
PID:328 -
\??\c:\48280.exec:\48280.exe22⤵
- Executes dropped EXE
PID:2808 -
\??\c:\4244440.exec:\4244440.exe23⤵
- Executes dropped EXE
PID:1308 -
\??\c:\dpvdj.exec:\dpvdj.exe24⤵
- Executes dropped EXE
PID:1968 -
\??\c:\tnhnht.exec:\tnhnht.exe25⤵
- Executes dropped EXE
PID:1468 -
\??\c:\vjppj.exec:\vjppj.exe26⤵
- Executes dropped EXE
PID:944 -
\??\c:\424404.exec:\424404.exe27⤵
- Executes dropped EXE
PID:1720 -
\??\c:\208888.exec:\208888.exe28⤵
- Executes dropped EXE
PID:336 -
\??\c:\864062.exec:\864062.exe29⤵
- Executes dropped EXE
PID:2124 -
\??\c:\206622.exec:\206622.exe30⤵
- Executes dropped EXE
PID:2556 -
\??\c:\w24460.exec:\w24460.exe31⤵
- Executes dropped EXE
PID:1960 -
\??\c:\5rxrllr.exec:\5rxrllr.exe32⤵
- Executes dropped EXE
PID:1440 -
\??\c:\httntt.exec:\httntt.exe33⤵
- Executes dropped EXE
PID:2240 -
\??\c:\xrlrxfx.exec:\xrlrxfx.exe34⤵
- Executes dropped EXE
PID:2652 -
\??\c:\k08806.exec:\k08806.exe35⤵
- Executes dropped EXE
PID:2792 -
\??\c:\nbtnbb.exec:\nbtnbb.exe36⤵
- Executes dropped EXE
PID:2040 -
\??\c:\08284.exec:\08284.exe37⤵
- Executes dropped EXE
PID:2464 -
\??\c:\6468402.exec:\6468402.exe38⤵
- Executes dropped EXE
PID:2904 -
\??\c:\3jvdp.exec:\3jvdp.exe39⤵
- Executes dropped EXE
PID:2860 -
\??\c:\042222.exec:\042222.exe40⤵
- Executes dropped EXE
PID:536 -
\??\c:\q86244.exec:\q86244.exe41⤵
- Executes dropped EXE
PID:2980 -
\??\c:\08024.exec:\08024.exe42⤵
- Executes dropped EXE
PID:568 -
\??\c:\pjvvd.exec:\pjvvd.exe43⤵
- Executes dropped EXE
PID:2708 -
\??\c:\tbtbnh.exec:\tbtbnh.exe44⤵
- Executes dropped EXE
PID:2752 -
\??\c:\2028062.exec:\2028062.exe45⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9lfxxxx.exec:\9lfxxxx.exe46⤵
- Executes dropped EXE
PID:1688 -
\??\c:\7xlfllx.exec:\7xlfllx.exe47⤵
- Executes dropped EXE
PID:2428 -
\??\c:\4206440.exec:\4206440.exe48⤵
- Executes dropped EXE
PID:2076 -
\??\c:\8684068.exec:\8684068.exe49⤵
- Executes dropped EXE
PID:1848 -
\??\c:\608844.exec:\608844.exe50⤵
- Executes dropped EXE
PID:2376 -
\??\c:\208062.exec:\208062.exe51⤵
- Executes dropped EXE
PID:1684 -
\??\c:\lfrrxrx.exec:\lfrrxrx.exe52⤵
- Executes dropped EXE
PID:2164 -
\??\c:\e08440.exec:\e08440.exe53⤵
- Executes dropped EXE
PID:820 -
\??\c:\7hbtnn.exec:\7hbtnn.exe54⤵
- Executes dropped EXE
PID:1500 -
\??\c:\20882.exec:\20882.exe55⤵
- Executes dropped EXE
PID:2768 -
\??\c:\vpjpv.exec:\vpjpv.exe56⤵
- Executes dropped EXE
PID:2896 -
\??\c:\pdpjj.exec:\pdpjj.exe57⤵
- Executes dropped EXE
PID:2564 -
\??\c:\s6446.exec:\s6446.exe58⤵
- Executes dropped EXE
PID:1884 -
\??\c:\ttnthn.exec:\ttnthn.exe59⤵
- Executes dropped EXE
PID:2476 -
\??\c:\6680886.exec:\6680886.exe60⤵
- Executes dropped EXE
PID:2160 -
\??\c:\602244.exec:\602244.exe61⤵
- Executes dropped EXE
PID:2168 -
\??\c:\9frrrlx.exec:\9frrrlx.exe62⤵
- Executes dropped EXE
PID:844 -
\??\c:\vpddj.exec:\vpddj.exe63⤵
- Executes dropped EXE
PID:2300 -
\??\c:\hhnhnn.exec:\hhnhnn.exe64⤵
- Executes dropped EXE
PID:1948 -
\??\c:\486688.exec:\486688.exe65⤵
- Executes dropped EXE
PID:1152 -
\??\c:\280600.exec:\280600.exe66⤵PID:2052
-
\??\c:\vvppv.exec:\vvppv.exe67⤵PID:944
-
\??\c:\e86666.exec:\e86666.exe68⤵PID:1736
-
\??\c:\dpjjv.exec:\dpjjv.exe69⤵PID:2200
-
\??\c:\vpvjj.exec:\vpvjj.exe70⤵PID:2404
-
\??\c:\s6406.exec:\s6406.exe71⤵PID:2124
-
\??\c:\20666.exec:\20666.exe72⤵PID:1444
-
\??\c:\frfffxf.exec:\frfffxf.exe73⤵PID:2596
-
\??\c:\208800.exec:\208800.exe74⤵PID:1960
-
\??\c:\fxllxxl.exec:\fxllxxl.exe75⤵PID:2312
-
\??\c:\0684624.exec:\0684624.exe76⤵PID:1652
-
\??\c:\xlxxlrf.exec:\xlxxlrf.exe77⤵PID:372
-
\??\c:\86486.exec:\86486.exe78⤵PID:2320
-
\??\c:\fflrxrr.exec:\fflrxrr.exe79⤵PID:2800
-
\??\c:\80226.exec:\80226.exe80⤵PID:2356
-
\??\c:\2600606.exec:\2600606.exe81⤵PID:2976
-
\??\c:\vppvj.exec:\vppvj.exe82⤵PID:2840
-
\??\c:\jvjpv.exec:\jvjpv.exe83⤵PID:2836
-
\??\c:\e82666.exec:\e82666.exe84⤵PID:2900
-
\??\c:\jdpvj.exec:\jdpvj.exe85⤵PID:2988
-
\??\c:\0862440.exec:\0862440.exe86⤵PID:2824
-
\??\c:\260684.exec:\260684.exe87⤵PID:2972
-
\??\c:\6426662.exec:\6426662.exe88⤵PID:2432
-
\??\c:\2680202.exec:\2680202.exe89⤵PID:1820
-
\??\c:\w26862.exec:\w26862.exe90⤵PID:728
-
\??\c:\1bntbb.exec:\1bntbb.exe91⤵PID:2292
-
\??\c:\vjpvp.exec:\vjpvp.exe92⤵PID:376
-
\??\c:\bbntbh.exec:\bbntbh.exe93⤵PID:1848
-
\??\c:\bhtttn.exec:\bhtttn.exe94⤵PID:2444
-
\??\c:\86406.exec:\86406.exe95⤵PID:1684
-
\??\c:\g2406.exec:\g2406.exe96⤵PID:2016
-
\??\c:\vpjjp.exec:\vpjjp.exe97⤵PID:820
-
\??\c:\dpvpp.exec:\dpvpp.exe98⤵PID:468
-
\??\c:\q08466.exec:\q08466.exe99⤵PID:1260
-
\??\c:\tntbhh.exec:\tntbhh.exe100⤵PID:2940
-
\??\c:\g4846.exec:\g4846.exe101⤵PID:2744
-
\??\c:\ffrxfll.exec:\ffrxfll.exe102⤵PID:2576
-
\??\c:\2606288.exec:\2606288.exe103⤵PID:2272
-
\??\c:\bnttbb.exec:\bnttbb.exe104⤵PID:3032
-
\??\c:\vjpvd.exec:\vjpvd.exe105⤵PID:1320
-
\??\c:\thtttt.exec:\thtttt.exe106⤵PID:2944
-
\??\c:\u466666.exec:\u466666.exe107⤵PID:2024
-
\??\c:\jdjdj.exec:\jdjdj.exe108⤵PID:1952
-
\??\c:\tnhnnh.exec:\tnhnnh.exe109⤵PID:236
-
\??\c:\jjdjv.exec:\jjdjv.exe110⤵PID:1376
-
\??\c:\vpvdd.exec:\vpvdd.exe111⤵PID:2196
-
\??\c:\xrfllll.exec:\xrfllll.exe112⤵PID:956
-
\??\c:\xxlrrlr.exec:\xxlrrlr.exe113⤵PID:1088
-
\??\c:\lfflrrx.exec:\lfflrrx.exe114⤵PID:1696
-
\??\c:\dpvvd.exec:\dpvvd.exe115⤵PID:2608
-
\??\c:\vjvpd.exec:\vjvpd.exe116⤵PID:1944
-
\??\c:\1rfffff.exec:\1rfffff.exe117⤵PID:1436
-
\??\c:\tnnbhn.exec:\tnnbhn.exe118⤵PID:904
-
\??\c:\jdvvd.exec:\jdvvd.exe119⤵PID:2180
-
\??\c:\nhnhnn.exec:\nhnhnn.exe120⤵PID:2264
-
\??\c:\i222002.exec:\i222002.exe121⤵PID:2788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-