Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 19:36
Behavioral task
behavioral1
Sample
367af4763e8ab5aeaa3e717d59dcd7f9ffa294866c455573137f70357f018531.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
367af4763e8ab5aeaa3e717d59dcd7f9ffa294866c455573137f70357f018531.exe
-
Size
331KB
-
MD5
49b10c18a28c9c8fc07828133614fe18
-
SHA1
34d3fb13bb553d947c321b7942c2df6354634086
-
SHA256
367af4763e8ab5aeaa3e717d59dcd7f9ffa294866c455573137f70357f018531
-
SHA512
3ffb628a6a01c22cf47b25ca6ca5fa934a91dfd6d5b7a7253cd682e8d2f0ef4536d95388f9bf397c05b64676658d44f4ebcb5c84bbf3ea9d5ff67fc9e074db83
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeW:R4wFHoSHYHUrAwfMp3CDW
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2996-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2696-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2136-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-65-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2980-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1964-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-99-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1984-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2296-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1192-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1368-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2472-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-392-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/580-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2104-490-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-571-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-584-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2992-639-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2404-693-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2232-705-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2824-6241-0x00000000770C0000-0x00000000771BA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3044 nbnttb.exe 2768 pdppv.exe 2696 hbnnbh.exe 2136 pjvvv.exe 2864 lxrxfxf.exe 2596 nhnnbb.exe 2580 1fxllfl.exe 2980 thnbhn.exe 1964 jjvjv.exe 1968 xrfrxfr.exe 2652 1nhbhb.exe 1700 ddvdd.exe 764 7rxlrrr.exe 1984 hbhntt.exe 2296 dvdvd.exe 1192 xfrrlff.exe 1528 nhtthh.exe 776 1dvvj.exe 2920 rrlrxfl.exe 2928 dvpjv.exe 2276 xrfrxxl.exe 2120 tbhhtt.exe 1368 9djdp.exe 2316 5rlffff.exe 704 pdpvd.exe 1688 rlfflrx.exe 1552 3rxlrrl.exe 1716 9vvdj.exe 2956 1jvpd.exe 3012 ffxrlrf.exe 2472 nhbhhh.exe 2132 xlfrflf.exe 996 5nbntt.exe 3004 vpvdp.exe 1224 vpdjp.exe 2148 xlxxxxx.exe 2168 9htntt.exe 1576 ppdjp.exe 1604 dvdpv.exe 2736 7frxrrf.exe 2908 hthbhn.exe 2380 tthnnn.exe 2584 vjddp.exe 2856 llrffxf.exe 2720 lfxxrxf.exe 2516 btbhtt.exe 2596 jdpvv.exe 2984 pdjpv.exe 2988 xxrlrxl.exe 1028 ttnnhn.exe 988 vpdpj.exe 2832 3dvvp.exe 2880 5flllrr.exe 2788 1hhhtb.exe 2444 tnhhhn.exe 2964 pjjdj.exe 1620 pjjdp.exe 2076 3lrxffl.exe 3020 1bnhtt.exe 676 dvvjp.exe 572 dvjjp.exe 640 3fxfllr.exe 580 9hbtbb.exe 2312 ppdvj.exe -
resource yara_rule behavioral1/memory/2996-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012117-7.dat upx behavioral1/memory/2996-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016df8-15.dat upx behavioral1/memory/3044-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016edc-23.dat upx behavioral1/memory/2696-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2696-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2136-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016f02-31.dat upx behavioral1/files/0x00070000000174b4-41.dat upx behavioral1/memory/2136-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000174f8-49.dat upx behavioral1/files/0x0007000000017570-58.dat upx behavioral1/memory/2596-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2580-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000175f7-66.dat upx behavioral1/files/0x000500000001924f-75.dat upx behavioral1/memory/2980-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019261-83.dat upx behavioral1/memory/1964-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019274-92.dat upx behavioral1/memory/1968-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2652-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001927a-100.dat upx behavioral1/files/0x0005000000019299-108.dat upx behavioral1/memory/764-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000192a1-117.dat upx behavioral1/files/0x0005000000019354-125.dat upx behavioral1/memory/1984-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019358-132.dat upx behavioral1/memory/1192-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2296-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001938e-142.dat upx behavioral1/memory/1192-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001939f-149.dat upx behavioral1/files/0x00050000000193cc-156.dat upx behavioral1/files/0x0033000000016dd9-163.dat upx behavioral1/files/0x00050000000193d0-171.dat upx behavioral1/memory/2928-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2120-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193dc-181.dat upx behavioral1/memory/2276-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193f9-188.dat upx behavioral1/memory/1368-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019426-196.dat upx behavioral1/files/0x0005000000019428-203.dat upx behavioral1/files/0x00050000000194ad-210.dat upx behavioral1/files/0x00050000000194c3-217.dat upx behavioral1/files/0x00050000000194d5-224.dat upx behavioral1/memory/1716-232-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194e1-231.dat upx behavioral1/files/0x0005000000019502-239.dat upx behavioral1/files/0x0005000000019508-247.dat upx behavioral1/memory/3012-246-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2472-254-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019510-255.dat upx behavioral1/memory/3004-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2148-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2168-290-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1576-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2984-348-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxlrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2996 wrote to memory of 3044 2996 367af4763e8ab5aeaa3e717d59dcd7f9ffa294866c455573137f70357f018531.exe 30 PID 2996 wrote to memory of 3044 2996 367af4763e8ab5aeaa3e717d59dcd7f9ffa294866c455573137f70357f018531.exe 30 PID 2996 wrote to memory of 3044 2996 367af4763e8ab5aeaa3e717d59dcd7f9ffa294866c455573137f70357f018531.exe 30 PID 2996 wrote to memory of 3044 2996 367af4763e8ab5aeaa3e717d59dcd7f9ffa294866c455573137f70357f018531.exe 30 PID 3044 wrote to memory of 2768 3044 nbnttb.exe 31 PID 3044 wrote to memory of 2768 3044 nbnttb.exe 31 PID 3044 wrote to memory of 2768 3044 nbnttb.exe 31 PID 3044 wrote to memory of 2768 3044 nbnttb.exe 31 PID 2768 wrote to memory of 2696 2768 pdppv.exe 32 PID 2768 wrote to memory of 2696 2768 pdppv.exe 32 PID 2768 wrote to memory of 2696 2768 pdppv.exe 32 PID 2768 wrote to memory of 2696 2768 pdppv.exe 32 PID 2696 wrote to memory of 2136 2696 hbnnbh.exe 33 PID 2696 wrote to memory of 2136 2696 hbnnbh.exe 33 PID 2696 wrote to memory of 2136 2696 hbnnbh.exe 33 PID 2696 wrote to memory of 2136 2696 hbnnbh.exe 33 PID 2136 wrote to memory of 2864 2136 pjvvv.exe 34 PID 2136 wrote to memory of 2864 2136 pjvvv.exe 34 PID 2136 wrote to memory of 2864 2136 pjvvv.exe 34 PID 2136 wrote to memory of 2864 2136 pjvvv.exe 34 PID 2864 wrote to memory of 2596 2864 lxrxfxf.exe 35 PID 2864 wrote to memory of 2596 2864 lxrxfxf.exe 35 PID 2864 wrote to memory of 2596 2864 lxrxfxf.exe 35 PID 2864 wrote to memory of 2596 2864 lxrxfxf.exe 35 PID 2596 wrote to memory of 2580 2596 nhnnbb.exe 36 PID 2596 wrote to memory of 2580 2596 nhnnbb.exe 36 PID 2596 wrote to memory of 2580 2596 nhnnbb.exe 36 PID 2596 wrote to memory of 2580 2596 nhnnbb.exe 36 PID 2580 wrote to memory of 2980 2580 1fxllfl.exe 37 PID 2580 wrote to memory of 2980 2580 1fxllfl.exe 37 PID 2580 wrote to memory of 2980 2580 1fxllfl.exe 37 PID 2580 wrote to memory of 2980 2580 1fxllfl.exe 37 PID 2980 wrote to memory of 1964 2980 thnbhn.exe 38 PID 2980 wrote to memory of 1964 2980 thnbhn.exe 38 PID 2980 wrote to memory of 1964 2980 thnbhn.exe 38 PID 2980 wrote to memory of 1964 2980 thnbhn.exe 38 PID 1964 wrote to memory of 1968 1964 jjvjv.exe 39 PID 1964 wrote to memory of 1968 1964 jjvjv.exe 39 PID 1964 wrote to memory of 1968 1964 jjvjv.exe 39 PID 1964 wrote to memory of 1968 1964 jjvjv.exe 39 PID 1968 wrote to memory of 2652 1968 xrfrxfr.exe 40 PID 1968 wrote to memory of 2652 1968 xrfrxfr.exe 40 PID 1968 wrote to memory of 2652 1968 xrfrxfr.exe 40 PID 1968 wrote to memory of 2652 1968 xrfrxfr.exe 40 PID 2652 wrote to memory of 1700 2652 1nhbhb.exe 41 PID 2652 wrote to memory of 1700 2652 1nhbhb.exe 41 PID 2652 wrote to memory of 1700 2652 1nhbhb.exe 41 PID 2652 wrote to memory of 1700 2652 1nhbhb.exe 41 PID 1700 wrote to memory of 764 1700 ddvdd.exe 42 PID 1700 wrote to memory of 764 1700 ddvdd.exe 42 PID 1700 wrote to memory of 764 1700 ddvdd.exe 42 PID 1700 wrote to memory of 764 1700 ddvdd.exe 42 PID 764 wrote to memory of 1984 764 7rxlrrr.exe 43 PID 764 wrote to memory of 1984 764 7rxlrrr.exe 43 PID 764 wrote to memory of 1984 764 7rxlrrr.exe 43 PID 764 wrote to memory of 1984 764 7rxlrrr.exe 43 PID 1984 wrote to memory of 2296 1984 hbhntt.exe 44 PID 1984 wrote to memory of 2296 1984 hbhntt.exe 44 PID 1984 wrote to memory of 2296 1984 hbhntt.exe 44 PID 1984 wrote to memory of 2296 1984 hbhntt.exe 44 PID 2296 wrote to memory of 1192 2296 dvdvd.exe 45 PID 2296 wrote to memory of 1192 2296 dvdvd.exe 45 PID 2296 wrote to memory of 1192 2296 dvdvd.exe 45 PID 2296 wrote to memory of 1192 2296 dvdvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\367af4763e8ab5aeaa3e717d59dcd7f9ffa294866c455573137f70357f018531.exe"C:\Users\Admin\AppData\Local\Temp\367af4763e8ab5aeaa3e717d59dcd7f9ffa294866c455573137f70357f018531.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\nbnttb.exec:\nbnttb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\pdppv.exec:\pdppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\hbnnbh.exec:\hbnnbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\pjvvv.exec:\pjvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\lxrxfxf.exec:\lxrxfxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\nhnnbb.exec:\nhnnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\1fxllfl.exec:\1fxllfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\thnbhn.exec:\thnbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\jjvjv.exec:\jjvjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\xrfrxfr.exec:\xrfrxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\1nhbhb.exec:\1nhbhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\ddvdd.exec:\ddvdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\7rxlrrr.exec:\7rxlrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\hbhntt.exec:\hbhntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\dvdvd.exec:\dvdvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\xfrrlff.exec:\xfrrlff.exe17⤵
- Executes dropped EXE
PID:1192 -
\??\c:\nhtthh.exec:\nhtthh.exe18⤵
- Executes dropped EXE
PID:1528 -
\??\c:\1dvvj.exec:\1dvvj.exe19⤵
- Executes dropped EXE
PID:776 -
\??\c:\rrlrxfl.exec:\rrlrxfl.exe20⤵
- Executes dropped EXE
PID:2920 -
\??\c:\dvpjv.exec:\dvpjv.exe21⤵
- Executes dropped EXE
PID:2928 -
\??\c:\xrfrxxl.exec:\xrfrxxl.exe22⤵
- Executes dropped EXE
PID:2276 -
\??\c:\tbhhtt.exec:\tbhhtt.exe23⤵
- Executes dropped EXE
PID:2120 -
\??\c:\9djdp.exec:\9djdp.exe24⤵
- Executes dropped EXE
PID:1368 -
\??\c:\5rlffff.exec:\5rlffff.exe25⤵
- Executes dropped EXE
PID:2316 -
\??\c:\pdpvd.exec:\pdpvd.exe26⤵
- Executes dropped EXE
PID:704 -
\??\c:\rlfflrx.exec:\rlfflrx.exe27⤵
- Executes dropped EXE
PID:1688 -
\??\c:\3rxlrrl.exec:\3rxlrrl.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1552 -
\??\c:\9vvdj.exec:\9vvdj.exe29⤵
- Executes dropped EXE
PID:1716 -
\??\c:\1jvpd.exec:\1jvpd.exe30⤵
- Executes dropped EXE
PID:2956 -
\??\c:\ffxrlrf.exec:\ffxrlrf.exe31⤵
- Executes dropped EXE
PID:3012 -
\??\c:\nhbhhh.exec:\nhbhhh.exe32⤵
- Executes dropped EXE
PID:2472 -
\??\c:\xlfrflf.exec:\xlfrflf.exe33⤵
- Executes dropped EXE
PID:2132 -
\??\c:\5nbntt.exec:\5nbntt.exe34⤵
- Executes dropped EXE
PID:996 -
\??\c:\vpvdp.exec:\vpvdp.exe35⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vpdjp.exec:\vpdjp.exe36⤵
- Executes dropped EXE
PID:1224 -
\??\c:\xlxxxxx.exec:\xlxxxxx.exe37⤵
- Executes dropped EXE
PID:2148 -
\??\c:\9htntt.exec:\9htntt.exe38⤵
- Executes dropped EXE
PID:2168 -
\??\c:\ppdjp.exec:\ppdjp.exe39⤵
- Executes dropped EXE
PID:1576 -
\??\c:\dvdpv.exec:\dvdpv.exe40⤵
- Executes dropped EXE
PID:1604 -
\??\c:\7frxrrf.exec:\7frxrrf.exe41⤵
- Executes dropped EXE
PID:2736 -
\??\c:\hthbhn.exec:\hthbhn.exe42⤵
- Executes dropped EXE
PID:2908 -
\??\c:\tthnnn.exec:\tthnnn.exe43⤵
- Executes dropped EXE
PID:2380 -
\??\c:\vjddp.exec:\vjddp.exe44⤵
- Executes dropped EXE
PID:2584 -
\??\c:\llrffxf.exec:\llrffxf.exe45⤵
- Executes dropped EXE
PID:2856 -
\??\c:\lfxxrxf.exec:\lfxxrxf.exe46⤵
- Executes dropped EXE
PID:2720 -
\??\c:\btbhtt.exec:\btbhtt.exe47⤵
- Executes dropped EXE
PID:2516 -
\??\c:\jdpvv.exec:\jdpvv.exe48⤵
- Executes dropped EXE
PID:2596 -
\??\c:\pdjpv.exec:\pdjpv.exe49⤵
- Executes dropped EXE
PID:2984 -
\??\c:\xxrlrxl.exec:\xxrlrxl.exe50⤵
- Executes dropped EXE
PID:2988 -
\??\c:\ttnnhn.exec:\ttnnhn.exe51⤵
- Executes dropped EXE
PID:1028 -
\??\c:\vpdpj.exec:\vpdpj.exe52⤵
- Executes dropped EXE
PID:988 -
\??\c:\3dvvp.exec:\3dvvp.exe53⤵
- Executes dropped EXE
PID:2832 -
\??\c:\5flllrr.exec:\5flllrr.exe54⤵
- Executes dropped EXE
PID:2880 -
\??\c:\1hhhtb.exec:\1hhhtb.exe55⤵
- Executes dropped EXE
PID:2788 -
\??\c:\tnhhhn.exec:\tnhhhn.exe56⤵
- Executes dropped EXE
PID:2444 -
\??\c:\pjjdj.exec:\pjjdj.exe57⤵
- Executes dropped EXE
PID:2964 -
\??\c:\pjjdp.exec:\pjjdp.exe58⤵
- Executes dropped EXE
PID:1620 -
\??\c:\3lrxffl.exec:\3lrxffl.exe59⤵
- Executes dropped EXE
PID:2076 -
\??\c:\1bnhtt.exec:\1bnhtt.exe60⤵
- Executes dropped EXE
PID:3020 -
\??\c:\dvvjp.exec:\dvvjp.exe61⤵
- Executes dropped EXE
PID:676 -
\??\c:\dvjjp.exec:\dvjjp.exe62⤵
- Executes dropped EXE
PID:572 -
\??\c:\3fxfllr.exec:\3fxfllr.exe63⤵
- Executes dropped EXE
PID:640 -
\??\c:\9hbtbb.exec:\9hbtbb.exe64⤵
- Executes dropped EXE
PID:580 -
\??\c:\ppdvj.exec:\ppdvj.exe65⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vpddp.exec:\vpddp.exe66⤵
- System Location Discovery: System Language Discovery
PID:2352 -
\??\c:\fxxrxfl.exec:\fxxrxfl.exe67⤵PID:1080
-
\??\c:\9hbhbh.exec:\9hbhbh.exe68⤵PID:2400
-
\??\c:\bbbhbh.exec:\bbbhbh.exe69⤵PID:1772
-
\??\c:\dvjpv.exec:\dvjpv.exe70⤵PID:1140
-
\??\c:\xrfxlrx.exec:\xrfxlrx.exe71⤵PID:852
-
\??\c:\xlrlrrr.exec:\xlrlrrr.exe72⤵PID:1648
-
\??\c:\bttbhh.exec:\bttbhh.exe73⤵PID:2940
-
\??\c:\7bbttb.exec:\7bbttb.exe74⤵PID:2104
-
\??\c:\vpdjp.exec:\vpdjp.exe75⤵PID:2084
-
\??\c:\rrxxrrx.exec:\rrxxrrx.exe76⤵PID:1720
-
\??\c:\bbnnth.exec:\bbnnth.exe77⤵PID:1328
-
\??\c:\vjddj.exec:\vjddj.exe78⤵PID:3008
-
\??\c:\vvjvp.exec:\vvjvp.exe79⤵PID:1804
-
\??\c:\xrxxlxl.exec:\xrxxlxl.exe80⤵PID:1316
-
\??\c:\1htbhh.exec:\1htbhh.exe81⤵PID:268
-
\??\c:\bbnhtt.exec:\bbnhtt.exe82⤵PID:1120
-
\??\c:\vjdvj.exec:\vjdvj.exe83⤵PID:2036
-
\??\c:\pjvvj.exec:\pjvvj.exe84⤵PID:3036
-
\??\c:\flfxxlx.exec:\flfxxlx.exe85⤵PID:2644
-
\??\c:\btttbb.exec:\btttbb.exe86⤵PID:2680
-
\??\c:\nthhnt.exec:\nthhnt.exe87⤵PID:2748
-
\??\c:\3jvjj.exec:\3jvjj.exe88⤵PID:2744
-
\??\c:\5fllxfl.exec:\5fllxfl.exe89⤵PID:2392
-
\??\c:\5llxfrx.exec:\5llxfrx.exe90⤵PID:2684
-
\??\c:\bnbttt.exec:\bnbttt.exe91⤵PID:2668
-
\??\c:\tntbnb.exec:\tntbnb.exe92⤵PID:2224
-
\??\c:\vjvdj.exec:\vjvdj.exe93⤵PID:2856
-
\??\c:\ffrrxxf.exec:\ffrrxxf.exe94⤵PID:2724
-
\??\c:\hhtttt.exec:\hhtttt.exe95⤵PID:2516
-
\??\c:\bbtbbn.exec:\bbtbbn.exe96⤵PID:2600
-
\??\c:\pjpdj.exec:\pjpdj.exe97⤵PID:2992
-
\??\c:\5vppv.exec:\5vppv.exe98⤵PID:2220
-
\??\c:\3frxfrr.exec:\3frxfrr.exe99⤵PID:2620
-
\??\c:\3nttbh.exec:\3nttbh.exe100⤵PID:2612
-
\??\c:\tnnhnn.exec:\tnnhnn.exe101⤵PID:2852
-
\??\c:\3dddp.exec:\3dddp.exe102⤵PID:1488
-
\??\c:\lxrrfxf.exec:\lxrrfxf.exe103⤵PID:1484
-
\??\c:\9lfflrx.exec:\9lfflrx.exe104⤵PID:336
-
\??\c:\hhbntt.exec:\hhbntt.exe105⤵PID:2000
-
\??\c:\btttbb.exec:\btttbb.exe106⤵PID:1980
-
\??\c:\jdjpj.exec:\jdjpj.exe107⤵PID:2076
-
\??\c:\jdppv.exec:\jdppv.exe108⤵PID:2284
-
\??\c:\3flllfl.exec:\3flllfl.exe109⤵PID:932
-
\??\c:\9hbbhh.exec:\9hbbhh.exe110⤵PID:2404
-
\??\c:\tnhnbn.exec:\tnhnbn.exe111⤵PID:1820
-
\??\c:\vpjpv.exec:\vpjpv.exe112⤵PID:2232
-
\??\c:\9dpdj.exec:\9dpdj.exe113⤵PID:2140
-
\??\c:\3fxlrxl.exec:\3fxlrxl.exe114⤵PID:448
-
\??\c:\btnhnn.exec:\btnhnn.exe115⤵PID:2236
-
\??\c:\bbthnh.exec:\bbthnh.exe116⤵PID:2120
-
\??\c:\jdpdd.exec:\jdpdd.exe117⤵PID:1856
-
\??\c:\flxllxx.exec:\flxllxx.exe118⤵PID:1368
-
\??\c:\ffxfrrx.exec:\ffxfrrx.exe119⤵PID:848
-
\??\c:\btnntt.exec:\btnntt.exe120⤵PID:2460
-
\??\c:\vpdjp.exec:\vpdjp.exe121⤵PID:2484
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-