Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/12/2024, 06:31
Behavioral task
behavioral1
Sample
92152ddcad49daba8d7344aed4dba33eb07844bd02f7bd78f691e7d0615b863b.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
General
-
Target
92152ddcad49daba8d7344aed4dba33eb07844bd02f7bd78f691e7d0615b863b.exe
-
Size
3.7MB
-
MD5
bcb7fbe544a5cb5cce83b81a3387fa51
-
SHA1
fdb957330a0ceece59d7b9d493a568eeed95a178
-
SHA256
92152ddcad49daba8d7344aed4dba33eb07844bd02f7bd78f691e7d0615b863b
-
SHA512
3c44b0ff6a207f9bb325d59b13e2e8891a34ef6619c647a49edf2bc673ca2d55ce0af87df615d429a83edd6543d249ecf3a8ff89ca6e5c81bc99cc7b10e156cc
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98P:U6XLq/qPPslzKx/dJg1ErmNY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/3048-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3044-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-36-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2668-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-92-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1752-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1996-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1496-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/380-144-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/380-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1904-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1768-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-270-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1120-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1320-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1484-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-410-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1440-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/964-494-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1512-510-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2132-573-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1120-576-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2396-593-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/3064-602-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/3064-607-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-632-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2548-639-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-659-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2244-736-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1036-758-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1772-776-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2824-867-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/840-881-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2672-926-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 3044 9rrrlrr.exe 2768 rlllfxl.exe 2908 pjdjp.exe 2668 fxrrffr.exe 2796 pjvdp.exe 2544 dpjvd.exe 2976 vppvp.exe 2552 pdvvp.exe 2652 lfrrffl.exe 2444 rllfffr.exe 1752 5bnbhb.exe 1996 fxffllx.exe 324 9xrxrfl.exe 1496 jjvpd.exe 380 vpjjp.exe 1904 3bnthh.exe 2124 rrxxxxf.exe 2772 xrllllr.exe 2928 jvjjj.exe 2480 bnhhth.exe 900 1tnhbh.exe 1400 hhbbth.exe 1312 pdddv.exe 1768 hhbnht.exe 1788 htttnb.exe 2968 xxxlxxf.exe 1556 lfrrlrf.exe 2896 vjjjj.exe 2900 bthhbb.exe 2916 tnhtnh.exe 1120 lfxffff.exe 1508 vvpjv.exe 1792 btbbhn.exe 1604 nbhbtb.exe 2700 bnhnnn.exe 2780 rxxxffl.exe 2812 xlrfrlx.exe 2816 rrlxlxl.exe 2860 jjpjd.exe 2608 3vjpv.exe 2796 pjjvd.exe 3024 tnbbnn.exe 2976 5tthnt.exe 1588 hthhtt.exe 1320 lffrflr.exe 864 ffrfrxf.exe 1484 jppdj.exe 2884 dpvdj.exe 1936 dpddp.exe 1440 9ntbtt.exe 1848 1bbnbh.exe 568 3llrrxf.exe 1376 lxxrfxf.exe 1756 9jjdv.exe 2932 vpdvv.exe 2176 9hbntb.exe 2920 xllrxxr.exe 2184 7xxxxfl.exe 1080 9ddvp.exe 2188 3tthnh.exe 964 3bnnbn.exe 2500 fffrrfx.exe 1512 7vvjp.exe 2460 vvjvj.exe -
resource yara_rule behavioral1/memory/3048-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012117-8.dat upx behavioral1/memory/3048-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016df8-17.dat upx behavioral1/memory/3044-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016edc-28.dat upx behavioral1/memory/2908-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2668-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016f02-40.dat upx behavioral1/memory/2908-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2796-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000174b4-49.dat upx behavioral1/files/0x0033000000016dd9-57.dat upx behavioral1/memory/2544-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000174f8-66.dat upx behavioral1/memory/2976-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2552-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000017570-76.dat upx behavioral1/files/0x00080000000175f7-84.dat upx behavioral1/memory/2652-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001924f-94.dat upx behavioral1/memory/1752-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019261-103.dat upx behavioral1/files/0x0005000000019274-113.dat upx behavioral1/memory/1996-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001927a-122.dat upx behavioral1/files/0x0005000000019299-130.dat upx behavioral1/memory/1496-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000192a1-140.dat upx behavioral1/files/0x0005000000019354-149.dat upx behavioral1/memory/380-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1904-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2124-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019358-160.dat upx behavioral1/memory/1904-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001938e-169.dat upx behavioral1/files/0x000500000001939f-177.dat upx behavioral1/files/0x00050000000193cc-186.dat upx behavioral1/memory/2928-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193d0-195.dat upx behavioral1/memory/2480-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193dc-203.dat upx behavioral1/files/0x00050000000193f9-211.dat upx behavioral1/memory/1768-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019426-220.dat upx behavioral1/memory/1788-229-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019428-228.dat upx behavioral1/files/0x00050000000194ad-237.dat upx behavioral1/files/0x00050000000194c3-245.dat upx behavioral1/memory/2896-254-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194d5-253.dat upx behavioral1/files/0x00050000000194e1-263.dat upx behavioral1/memory/2896-262-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-270-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/files/0x0005000000019502-273.dat upx behavioral1/files/0x0005000000019508-280.dat upx behavioral1/memory/1120-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019510-290.dat upx behavioral1/memory/1508-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1792-306-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2812-326-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2860-339-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rfllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lflrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3llrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrlrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfrrf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 3044 3048 92152ddcad49daba8d7344aed4dba33eb07844bd02f7bd78f691e7d0615b863b.exe 30 PID 3048 wrote to memory of 3044 3048 92152ddcad49daba8d7344aed4dba33eb07844bd02f7bd78f691e7d0615b863b.exe 30 PID 3048 wrote to memory of 3044 3048 92152ddcad49daba8d7344aed4dba33eb07844bd02f7bd78f691e7d0615b863b.exe 30 PID 3048 wrote to memory of 3044 3048 92152ddcad49daba8d7344aed4dba33eb07844bd02f7bd78f691e7d0615b863b.exe 30 PID 3044 wrote to memory of 2768 3044 9rrrlrr.exe 31 PID 3044 wrote to memory of 2768 3044 9rrrlrr.exe 31 PID 3044 wrote to memory of 2768 3044 9rrrlrr.exe 31 PID 3044 wrote to memory of 2768 3044 9rrrlrr.exe 31 PID 2768 wrote to memory of 2908 2768 rlllfxl.exe 32 PID 2768 wrote to memory of 2908 2768 rlllfxl.exe 32 PID 2768 wrote to memory of 2908 2768 rlllfxl.exe 32 PID 2768 wrote to memory of 2908 2768 rlllfxl.exe 32 PID 2908 wrote to memory of 2668 2908 pjdjp.exe 33 PID 2908 wrote to memory of 2668 2908 pjdjp.exe 33 PID 2908 wrote to memory of 2668 2908 pjdjp.exe 33 PID 2908 wrote to memory of 2668 2908 pjdjp.exe 33 PID 2668 wrote to memory of 2796 2668 fxrrffr.exe 34 PID 2668 wrote to memory of 2796 2668 fxrrffr.exe 34 PID 2668 wrote to memory of 2796 2668 fxrrffr.exe 34 PID 2668 wrote to memory of 2796 2668 fxrrffr.exe 34 PID 2796 wrote to memory of 2544 2796 pjvdp.exe 35 PID 2796 wrote to memory of 2544 2796 pjvdp.exe 35 PID 2796 wrote to memory of 2544 2796 pjvdp.exe 35 PID 2796 wrote to memory of 2544 2796 pjvdp.exe 35 PID 2544 wrote to memory of 2976 2544 dpjvd.exe 36 PID 2544 wrote to memory of 2976 2544 dpjvd.exe 36 PID 2544 wrote to memory of 2976 2544 dpjvd.exe 36 PID 2544 wrote to memory of 2976 2544 dpjvd.exe 36 PID 2976 wrote to memory of 2552 2976 vppvp.exe 37 PID 2976 wrote to memory of 2552 2976 vppvp.exe 37 PID 2976 wrote to memory of 2552 2976 vppvp.exe 37 PID 2976 wrote to memory of 2552 2976 vppvp.exe 37 PID 2552 wrote to memory of 2652 2552 pdvvp.exe 38 PID 2552 wrote to memory of 2652 2552 pdvvp.exe 38 PID 2552 wrote to memory of 2652 2552 pdvvp.exe 38 PID 2552 wrote to memory of 2652 2552 pdvvp.exe 38 PID 2652 wrote to memory of 2444 2652 lfrrffl.exe 39 PID 2652 wrote to memory of 2444 2652 lfrrffl.exe 39 PID 2652 wrote to memory of 2444 2652 lfrrffl.exe 39 PID 2652 wrote to memory of 2444 2652 lfrrffl.exe 39 PID 2444 wrote to memory of 1752 2444 rllfffr.exe 40 PID 2444 wrote to memory of 1752 2444 rllfffr.exe 40 PID 2444 wrote to memory of 1752 2444 rllfffr.exe 40 PID 2444 wrote to memory of 1752 2444 rllfffr.exe 40 PID 1752 wrote to memory of 1996 1752 5bnbhb.exe 41 PID 1752 wrote to memory of 1996 1752 5bnbhb.exe 41 PID 1752 wrote to memory of 1996 1752 5bnbhb.exe 41 PID 1752 wrote to memory of 1996 1752 5bnbhb.exe 41 PID 1996 wrote to memory of 324 1996 fxffllx.exe 42 PID 1996 wrote to memory of 324 1996 fxffllx.exe 42 PID 1996 wrote to memory of 324 1996 fxffllx.exe 42 PID 1996 wrote to memory of 324 1996 fxffllx.exe 42 PID 324 wrote to memory of 1496 324 9xrxrfl.exe 43 PID 324 wrote to memory of 1496 324 9xrxrfl.exe 43 PID 324 wrote to memory of 1496 324 9xrxrfl.exe 43 PID 324 wrote to memory of 1496 324 9xrxrfl.exe 43 PID 1496 wrote to memory of 380 1496 jjvpd.exe 44 PID 1496 wrote to memory of 380 1496 jjvpd.exe 44 PID 1496 wrote to memory of 380 1496 jjvpd.exe 44 PID 1496 wrote to memory of 380 1496 jjvpd.exe 44 PID 380 wrote to memory of 1904 380 vpjjp.exe 45 PID 380 wrote to memory of 1904 380 vpjjp.exe 45 PID 380 wrote to memory of 1904 380 vpjjp.exe 45 PID 380 wrote to memory of 1904 380 vpjjp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\92152ddcad49daba8d7344aed4dba33eb07844bd02f7bd78f691e7d0615b863b.exe"C:\Users\Admin\AppData\Local\Temp\92152ddcad49daba8d7344aed4dba33eb07844bd02f7bd78f691e7d0615b863b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\9rrrlrr.exec:\9rrrlrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\rlllfxl.exec:\rlllfxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\pjdjp.exec:\pjdjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\fxrrffr.exec:\fxrrffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\pjvdp.exec:\pjvdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\dpjvd.exec:\dpjvd.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\vppvp.exec:\vppvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\pdvvp.exec:\pdvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\lfrrffl.exec:\lfrrffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\rllfffr.exec:\rllfffr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\5bnbhb.exec:\5bnbhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\fxffllx.exec:\fxffllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\9xrxrfl.exec:\9xrxrfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\jjvpd.exec:\jjvpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\vpjjp.exec:\vpjjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\3bnthh.exec:\3bnthh.exe17⤵
- Executes dropped EXE
PID:1904 -
\??\c:\rrxxxxf.exec:\rrxxxxf.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2124 -
\??\c:\xrllllr.exec:\xrllllr.exe19⤵
- Executes dropped EXE
PID:2772 -
\??\c:\jvjjj.exec:\jvjjj.exe20⤵
- Executes dropped EXE
PID:2928 -
\??\c:\bnhhth.exec:\bnhhth.exe21⤵
- Executes dropped EXE
PID:2480 -
\??\c:\1tnhbh.exec:\1tnhbh.exe22⤵
- Executes dropped EXE
PID:900 -
\??\c:\hhbbth.exec:\hhbbth.exe23⤵
- Executes dropped EXE
PID:1400 -
\??\c:\pdddv.exec:\pdddv.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1312 -
\??\c:\hhbnht.exec:\hhbnht.exe25⤵
- Executes dropped EXE
PID:1768 -
\??\c:\htttnb.exec:\htttnb.exe26⤵
- Executes dropped EXE
PID:1788 -
\??\c:\xxxlxxf.exec:\xxxlxxf.exe27⤵
- Executes dropped EXE
PID:2968 -
\??\c:\lfrrlrf.exec:\lfrrlrf.exe28⤵
- Executes dropped EXE
PID:1556 -
\??\c:\vjjjj.exec:\vjjjj.exe29⤵
- Executes dropped EXE
PID:2896 -
\??\c:\bthhbb.exec:\bthhbb.exe30⤵
- Executes dropped EXE
PID:2900 -
\??\c:\tnhtnh.exec:\tnhtnh.exe31⤵
- Executes dropped EXE
PID:2916 -
\??\c:\lfxffff.exec:\lfxffff.exe32⤵
- Executes dropped EXE
PID:1120 -
\??\c:\vvpjv.exec:\vvpjv.exe33⤵
- Executes dropped EXE
PID:1508 -
\??\c:\btbbhn.exec:\btbbhn.exe34⤵
- Executes dropped EXE
PID:1792 -
\??\c:\nbhbtb.exec:\nbhbtb.exe35⤵
- Executes dropped EXE
PID:1604 -
\??\c:\bnhnnn.exec:\bnhnnn.exe36⤵
- Executes dropped EXE
PID:2700 -
\??\c:\rxxxffl.exec:\rxxxffl.exe37⤵
- Executes dropped EXE
PID:2780 -
\??\c:\xlrfrlx.exec:\xlrfrlx.exe38⤵
- Executes dropped EXE
PID:2812 -
\??\c:\rrlxlxl.exec:\rrlxlxl.exe39⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jjpjd.exec:\jjpjd.exe40⤵
- Executes dropped EXE
PID:2860 -
\??\c:\3vjpv.exec:\3vjpv.exe41⤵
- Executes dropped EXE
PID:2608 -
\??\c:\pjjvd.exec:\pjjvd.exe42⤵
- Executes dropped EXE
PID:2796 -
\??\c:\tnbbnn.exec:\tnbbnn.exe43⤵
- Executes dropped EXE
PID:3024 -
\??\c:\5tthnt.exec:\5tthnt.exe44⤵
- Executes dropped EXE
PID:2976 -
\??\c:\hthhtt.exec:\hthhtt.exe45⤵
- Executes dropped EXE
PID:1588 -
\??\c:\lffrflr.exec:\lffrflr.exe46⤵
- Executes dropped EXE
PID:1320 -
\??\c:\ffrfrxf.exec:\ffrfrxf.exe47⤵
- Executes dropped EXE
PID:864 -
\??\c:\jppdj.exec:\jppdj.exe48⤵
- Executes dropped EXE
PID:1484 -
\??\c:\dpvdj.exec:\dpvdj.exe49⤵
- Executes dropped EXE
PID:2884 -
\??\c:\dpddp.exec:\dpddp.exe50⤵
- Executes dropped EXE
PID:1936 -
\??\c:\9ntbtt.exec:\9ntbtt.exe51⤵
- Executes dropped EXE
PID:1440 -
\??\c:\1bbnbh.exec:\1bbnbh.exe52⤵
- Executes dropped EXE
PID:1848 -
\??\c:\3llrrxf.exec:\3llrrxf.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:568 -
\??\c:\lxxrfxf.exec:\lxxrfxf.exe54⤵
- Executes dropped EXE
PID:1376 -
\??\c:\9jjdv.exec:\9jjdv.exe55⤵
- Executes dropped EXE
PID:1756 -
\??\c:\vpdvv.exec:\vpdvv.exe56⤵
- Executes dropped EXE
PID:2932 -
\??\c:\9hbntb.exec:\9hbntb.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2176 -
\??\c:\xllrxxr.exec:\xllrxxr.exe58⤵
- Executes dropped EXE
PID:2920 -
\??\c:\7xxxxfl.exec:\7xxxxfl.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2184 -
\??\c:\9ddvp.exec:\9ddvp.exe60⤵
- Executes dropped EXE
PID:1080 -
\??\c:\3tthnh.exec:\3tthnh.exe61⤵
- Executes dropped EXE
PID:2188 -
\??\c:\3bnnbn.exec:\3bnnbn.exe62⤵
- Executes dropped EXE
PID:964 -
\??\c:\fffrrfx.exec:\fffrrfx.exe63⤵
- Executes dropped EXE
PID:2500 -
\??\c:\7vvjp.exec:\7vvjp.exe64⤵
- Executes dropped EXE
PID:1512 -
\??\c:\vvjvj.exec:\vvjvj.exe65⤵
- Executes dropped EXE
PID:2460 -
\??\c:\nhhhnh.exec:\nhhhnh.exe66⤵PID:1672
-
\??\c:\lfrxrrf.exec:\lfrxrrf.exe67⤵PID:1716
-
\??\c:\ppdpj.exec:\ppdpj.exe68⤵PID:2968
-
\??\c:\vppdj.exec:\vppdj.exe69⤵PID:704
-
\??\c:\bnntnn.exec:\bnntnn.exe70⤵PID:3008
-
\??\c:\xlfrxfl.exec:\xlfrxfl.exe71⤵
- System Location Discovery: System Language Discovery
PID:632 -
\??\c:\lxlllrr.exec:\lxlllrr.exe72⤵PID:268
-
\??\c:\3dpdp.exec:\3dpdp.exe73⤵PID:2632
-
\??\c:\1tnhnb.exec:\1tnhnb.exe74⤵PID:2132
-
\??\c:\7bntbt.exec:\7bntbt.exe75⤵PID:1120
-
\??\c:\ffrflfr.exec:\ffrflfr.exe76⤵PID:1280
-
\??\c:\fxlflfr.exec:\fxlflfr.exe77⤵PID:2396
-
\??\c:\vdvjv.exec:\vdvjv.exe78⤵PID:2692
-
\??\c:\bnhntb.exec:\bnhntb.exe79⤵PID:3064
-
\??\c:\bnttnh.exec:\bnttnh.exe80⤵PID:2696
-
\??\c:\xrfxxxf.exec:\xrfxxxf.exe81⤵PID:2708
-
\??\c:\vjdjv.exec:\vjdjv.exe82⤵PID:2136
-
\??\c:\ppjjp.exec:\ppjjp.exe83⤵PID:2720
-
\??\c:\9ntbbb.exec:\9ntbbb.exe84⤵PID:2548
-
\??\c:\fxflrrx.exec:\fxflrrx.exe85⤵PID:2616
-
\??\c:\5lxrxfl.exec:\5lxrxfl.exe86⤵PID:2796
-
\??\c:\9jdpp.exec:\9jdpp.exe87⤵PID:3024
-
\??\c:\3tnnhh.exec:\3tnnhh.exe88⤵PID:2976
-
\??\c:\bthhtb.exec:\bthhtb.exe89⤵PID:1588
-
\??\c:\fxfxffl.exec:\fxfxffl.exe90⤵PID:2964
-
\??\c:\9dvpd.exec:\9dvpd.exe91⤵PID:2000
-
\??\c:\vppvj.exec:\vppvj.exe92⤵PID:1504
-
\??\c:\btntnh.exec:\btntnh.exe93⤵PID:1532
-
\??\c:\xlfllrr.exec:\xlfllrr.exe94⤵PID:556
-
\??\c:\xxrrfrx.exec:\xxrrfrx.exe95⤵PID:308
-
\??\c:\3jppv.exec:\3jppv.exe96⤵PID:2284
-
\??\c:\vpddj.exec:\vpddj.exe97⤵PID:580
-
\??\c:\jjvvd.exec:\jjvvd.exe98⤵PID:380
-
\??\c:\bnhhtb.exec:\bnhhtb.exe99⤵PID:796
-
\??\c:\3rlrfrr.exec:\3rlrfrr.exe100⤵PID:2244
-
\??\c:\7fxxllr.exec:\7fxxllr.exe101⤵PID:2356
-
\??\c:\7pjdv.exec:\7pjdv.exe102⤵PID:2936
-
\??\c:\1nhntb.exec:\1nhntb.exe103⤵PID:1036
-
\??\c:\1bntbh.exec:\1bntbh.exe104⤵PID:2480
-
\??\c:\flrrffr.exec:\flrrffr.exe105⤵PID:1772
-
\??\c:\llxxllr.exec:\llxxllr.exe106⤵PID:1616
-
\??\c:\pjddd.exec:\pjddd.exe107⤵PID:2512
-
\??\c:\dvjdj.exec:\dvjdj.exe108⤵PID:1960
-
\??\c:\bbhthn.exec:\bbhthn.exe109⤵PID:1544
-
\??\c:\bththn.exec:\bththn.exe110⤵PID:1764
-
\??\c:\rrfxrff.exec:\rrfxrff.exe111⤵PID:1664
-
\??\c:\5pdpp.exec:\5pdpp.exe112⤵PID:1328
-
\??\c:\7dpdp.exec:\7dpdp.exe113⤵PID:1556
-
\??\c:\hbhnth.exec:\hbhnth.exe114⤵PID:2508
-
\??\c:\nnhnbb.exec:\nnhnbb.exe115⤵PID:1492
-
\??\c:\5lxffll.exec:\5lxffll.exe116⤵PID:3004
-
\??\c:\pjvdp.exec:\pjvdp.exe117⤵PID:1152
-
\??\c:\pddjd.exec:\pddjd.exe118⤵PID:1836
-
\??\c:\tnbhtb.exec:\tnbhtb.exe119⤵PID:2824
-
\??\c:\tntbhn.exec:\tntbhn.exe120⤵PID:1600
-
\??\c:\fxrlrfr.exec:\fxrlrfr.exe121⤵PID:840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-