Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/01/2025, 06:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1c04fbda54fae00586dde576da10ec87044d94d2f4209c984c69d7ceada7fb53.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
1c04fbda54fae00586dde576da10ec87044d94d2f4209c984c69d7ceada7fb53.exe
-
Size
454KB
-
MD5
ff3b153115e8d447f337f367fce1b628
-
SHA1
e289c693a86aa23fd1e9eea67777514601ad3b4c
-
SHA256
1c04fbda54fae00586dde576da10ec87044d94d2f4209c984c69d7ceada7fb53
-
SHA512
87ecbb6608e95cfd3ce3f44cac33fd7e5f81ac94a3d624860df6305af05a8efb4782351b601fd31bc3583b4173561ce0aae75a76430614b15217ded966a7853e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe11:q7Tc2NYHUrAwfMp3CD11
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2524-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/540-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/340-39-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/340-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-54-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2848-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-61-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2236-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-65-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2724-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/660-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/492-117-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/848-135-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/848-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-178-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2220-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-194-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/884-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-217-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1996-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-301-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2456-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/712-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-479-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2252-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/684-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-612-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2632-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-675-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2624-695-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2276-769-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2164-889-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-953-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1984-958-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-1013-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-1183-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1232 rlrrxrr.exe 540 tbbnnt.exe 1872 djjdv.exe 340 jjdpj.exe 2848 tbbtbt.exe 2236 btntnb.exe 2792 3nntbn.exe 2724 pppjd.exe 2620 1pdjd.exe 1988 ddjdv.exe 660 jpvjp.exe 492 jpppp.exe 2952 vvvpd.exe 848 pvddj.exe 1896 xlrxxxr.exe 2900 rfxfxrl.exe 1952 bbbhth.exe 2964 xxfxfxf.exe 2220 tnnhbh.exe 2288 rrxxffl.exe 884 bbbnnn.exe 1848 hnthbh.exe 1996 dpvpv.exe 3020 lrlrxlx.exe 2024 jpvpj.exe 1716 bthbhh.exe 2380 vpjjv.exe 1364 fxrfxlx.exe 2412 tbtnnb.exe 1772 9xrxrrl.exe 872 thbthn.exe 2576 thhbbt.exe 2456 dpjvp.exe 2272 flrlllf.exe 1508 thhhhn.exe 2716 jjdvj.exe 712 pdppd.exe 2868 fflfllf.exe 2616 ntbtnb.exe 2772 3pjpj.exe 2788 lrlllrr.exe 1984 btbhnn.exe 1008 bnttnh.exe 2640 vvpdv.exe 2228 9lxfxlf.exe 2296 bnnhht.exe 1316 9jvjj.exe 292 vjppj.exe 2436 llffxll.exe 2700 hhhtbn.exe 2860 djdjd.exe 1804 frxrrxx.exe 2596 9bnhhh.exe 1464 jpvvp.exe 316 7xfxfrl.exe 1752 btbhbn.exe 2964 ttttnt.exe 2648 5jjdd.exe 2116 9rxrlxl.exe 2224 1tbnbb.exe 444 7pdpj.exe 2092 xrrlxlx.exe 1656 7hbtbn.exe 2252 bbbhth.exe -
resource yara_rule behavioral1/memory/2524-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/340-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/660-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/492-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/660-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/712-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-769-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2460-770-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-795-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-850-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-876-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-889-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-958-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-1013-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2896-1082-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-1107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-1145-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2524 wrote to memory of 1232 2524 1c04fbda54fae00586dde576da10ec87044d94d2f4209c984c69d7ceada7fb53.exe 30 PID 2524 wrote to memory of 1232 2524 1c04fbda54fae00586dde576da10ec87044d94d2f4209c984c69d7ceada7fb53.exe 30 PID 2524 wrote to memory of 1232 2524 1c04fbda54fae00586dde576da10ec87044d94d2f4209c984c69d7ceada7fb53.exe 30 PID 2524 wrote to memory of 1232 2524 1c04fbda54fae00586dde576da10ec87044d94d2f4209c984c69d7ceada7fb53.exe 30 PID 1232 wrote to memory of 540 1232 rlrrxrr.exe 31 PID 1232 wrote to memory of 540 1232 rlrrxrr.exe 31 PID 1232 wrote to memory of 540 1232 rlrrxrr.exe 31 PID 1232 wrote to memory of 540 1232 rlrrxrr.exe 31 PID 540 wrote to memory of 1872 540 tbbnnt.exe 32 PID 540 wrote to memory of 1872 540 tbbnnt.exe 32 PID 540 wrote to memory of 1872 540 tbbnnt.exe 32 PID 540 wrote to memory of 1872 540 tbbnnt.exe 32 PID 1872 wrote to memory of 340 1872 djjdv.exe 33 PID 1872 wrote to memory of 340 1872 djjdv.exe 33 PID 1872 wrote to memory of 340 1872 djjdv.exe 33 PID 1872 wrote to memory of 340 1872 djjdv.exe 33 PID 340 wrote to memory of 2848 340 jjdpj.exe 34 PID 340 wrote to memory of 2848 340 jjdpj.exe 34 PID 340 wrote to memory of 2848 340 jjdpj.exe 34 PID 340 wrote to memory of 2848 340 jjdpj.exe 34 PID 2848 wrote to memory of 2236 2848 tbbtbt.exe 35 PID 2848 wrote to memory of 2236 2848 tbbtbt.exe 35 PID 2848 wrote to memory of 2236 2848 tbbtbt.exe 35 PID 2848 wrote to memory of 2236 2848 tbbtbt.exe 35 PID 2236 wrote to memory of 2792 2236 btntnb.exe 36 PID 2236 wrote to memory of 2792 2236 btntnb.exe 36 PID 2236 wrote to memory of 2792 2236 btntnb.exe 36 PID 2236 wrote to memory of 2792 2236 btntnb.exe 36 PID 2792 wrote to memory of 2724 2792 3nntbn.exe 37 PID 2792 wrote to memory of 2724 2792 3nntbn.exe 37 PID 2792 wrote to memory of 2724 2792 3nntbn.exe 37 PID 2792 wrote to memory of 2724 2792 3nntbn.exe 37 PID 2724 wrote to memory of 2620 2724 pppjd.exe 38 PID 2724 wrote to memory of 2620 2724 pppjd.exe 38 PID 2724 wrote to memory of 2620 2724 pppjd.exe 38 PID 2724 wrote to memory of 2620 2724 pppjd.exe 38 PID 2620 wrote to memory of 1988 2620 1pdjd.exe 39 PID 2620 wrote to memory of 1988 2620 1pdjd.exe 39 PID 2620 wrote to memory of 1988 2620 1pdjd.exe 39 PID 2620 wrote to memory of 1988 2620 1pdjd.exe 39 PID 1988 wrote to memory of 660 1988 ddjdv.exe 40 PID 1988 wrote to memory of 660 1988 ddjdv.exe 40 PID 1988 wrote to memory of 660 1988 ddjdv.exe 40 PID 1988 wrote to memory of 660 1988 ddjdv.exe 40 PID 660 wrote to memory of 492 660 jpvjp.exe 41 PID 660 wrote to memory of 492 660 jpvjp.exe 41 PID 660 wrote to memory of 492 660 jpvjp.exe 41 PID 660 wrote to memory of 492 660 jpvjp.exe 41 PID 492 wrote to memory of 2952 492 jpppp.exe 42 PID 492 wrote to memory of 2952 492 jpppp.exe 42 PID 492 wrote to memory of 2952 492 jpppp.exe 42 PID 492 wrote to memory of 2952 492 jpppp.exe 42 PID 2952 wrote to memory of 848 2952 vvvpd.exe 43 PID 2952 wrote to memory of 848 2952 vvvpd.exe 43 PID 2952 wrote to memory of 848 2952 vvvpd.exe 43 PID 2952 wrote to memory of 848 2952 vvvpd.exe 43 PID 848 wrote to memory of 1896 848 pvddj.exe 44 PID 848 wrote to memory of 1896 848 pvddj.exe 44 PID 848 wrote to memory of 1896 848 pvddj.exe 44 PID 848 wrote to memory of 1896 848 pvddj.exe 44 PID 1896 wrote to memory of 2900 1896 xlrxxxr.exe 45 PID 1896 wrote to memory of 2900 1896 xlrxxxr.exe 45 PID 1896 wrote to memory of 2900 1896 xlrxxxr.exe 45 PID 1896 wrote to memory of 2900 1896 xlrxxxr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c04fbda54fae00586dde576da10ec87044d94d2f4209c984c69d7ceada7fb53.exe"C:\Users\Admin\AppData\Local\Temp\1c04fbda54fae00586dde576da10ec87044d94d2f4209c984c69d7ceada7fb53.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\rlrrxrr.exec:\rlrrxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\tbbnnt.exec:\tbbnnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\djjdv.exec:\djjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\jjdpj.exec:\jjdpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
\??\c:\tbbtbt.exec:\tbbtbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\btntnb.exec:\btntnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\3nntbn.exec:\3nntbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\pppjd.exec:\pppjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\1pdjd.exec:\1pdjd.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\ddjdv.exec:\ddjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\jpvjp.exec:\jpvjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\jpppp.exec:\jpppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:492 -
\??\c:\vvvpd.exec:\vvvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\pvddj.exec:\pvddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\xlrxxxr.exec:\xlrxxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\rfxfxrl.exec:\rfxfxrl.exe17⤵
- Executes dropped EXE
PID:2900 -
\??\c:\bbbhth.exec:\bbbhth.exe18⤵
- Executes dropped EXE
PID:1952 -
\??\c:\xxfxfxf.exec:\xxfxfxf.exe19⤵
- Executes dropped EXE
PID:2964 -
\??\c:\tnnhbh.exec:\tnnhbh.exe20⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rrxxffl.exec:\rrxxffl.exe21⤵
- Executes dropped EXE
PID:2288 -
\??\c:\bbbnnn.exec:\bbbnnn.exe22⤵
- Executes dropped EXE
PID:884 -
\??\c:\hnthbh.exec:\hnthbh.exe23⤵
- Executes dropped EXE
PID:1848 -
\??\c:\dpvpv.exec:\dpvpv.exe24⤵
- Executes dropped EXE
PID:1996 -
\??\c:\lrlrxlx.exec:\lrlrxlx.exe25⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jpvpj.exec:\jpvpj.exe26⤵
- Executes dropped EXE
PID:2024 -
\??\c:\bthbhh.exec:\bthbhh.exe27⤵
- Executes dropped EXE
PID:1716 -
\??\c:\vpjjv.exec:\vpjjv.exe28⤵
- Executes dropped EXE
PID:2380 -
\??\c:\fxrfxlx.exec:\fxrfxlx.exe29⤵
- Executes dropped EXE
PID:1364 -
\??\c:\tbtnnb.exec:\tbtnnb.exe30⤵
- Executes dropped EXE
PID:2412 -
\??\c:\9xrxrrl.exec:\9xrxrrl.exe31⤵
- Executes dropped EXE
PID:1772 -
\??\c:\thbthn.exec:\thbthn.exe32⤵
- Executes dropped EXE
PID:872 -
\??\c:\thhbbt.exec:\thhbbt.exe33⤵
- Executes dropped EXE
PID:2576 -
\??\c:\dpjvp.exec:\dpjvp.exe34⤵
- Executes dropped EXE
PID:2456 -
\??\c:\flrlllf.exec:\flrlllf.exe35⤵
- Executes dropped EXE
PID:2272 -
\??\c:\thhhhn.exec:\thhhhn.exe36⤵
- Executes dropped EXE
PID:1508 -
\??\c:\jjdvj.exec:\jjdvj.exe37⤵
- Executes dropped EXE
PID:2716 -
\??\c:\pdppd.exec:\pdppd.exe38⤵
- Executes dropped EXE
PID:712 -
\??\c:\fflfllf.exec:\fflfllf.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\ntbtnb.exec:\ntbtnb.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\3pjpj.exec:\3pjpj.exe41⤵
- Executes dropped EXE
PID:2772 -
\??\c:\lrlllrr.exec:\lrlllrr.exe42⤵
- Executes dropped EXE
PID:2788 -
\??\c:\btbhnn.exec:\btbhnn.exe43⤵
- Executes dropped EXE
PID:1984 -
\??\c:\bnttnh.exec:\bnttnh.exe44⤵
- Executes dropped EXE
PID:1008 -
\??\c:\vvpdv.exec:\vvpdv.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\9lxfxlf.exec:\9lxfxlf.exe46⤵
- Executes dropped EXE
PID:2228 -
\??\c:\bnnhht.exec:\bnnhht.exe47⤵
- Executes dropped EXE
PID:2296 -
\??\c:\9jvjj.exec:\9jvjj.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1316 -
\??\c:\vjppj.exec:\vjppj.exe49⤵
- Executes dropped EXE
PID:292 -
\??\c:\llffxll.exec:\llffxll.exe50⤵
- Executes dropped EXE
PID:2436 -
\??\c:\hhhtbn.exec:\hhhtbn.exe51⤵
- Executes dropped EXE
PID:2700 -
\??\c:\djdjd.exec:\djdjd.exe52⤵
- Executes dropped EXE
PID:2860 -
\??\c:\frxrrxx.exec:\frxrrxx.exe53⤵
- Executes dropped EXE
PID:1804 -
\??\c:\9bnhhh.exec:\9bnhhh.exe54⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jpvvp.exec:\jpvvp.exe55⤵
- Executes dropped EXE
PID:1464 -
\??\c:\7xfxfrl.exec:\7xfxfrl.exe56⤵
- Executes dropped EXE
PID:316 -
\??\c:\btbhbn.exec:\btbhbn.exe57⤵
- Executes dropped EXE
PID:1752 -
\??\c:\ttttnt.exec:\ttttnt.exe58⤵
- Executes dropped EXE
PID:2964 -
\??\c:\5jjdd.exec:\5jjdd.exe59⤵
- Executes dropped EXE
PID:2648 -
\??\c:\9rxrlxl.exec:\9rxrlxl.exe60⤵
- Executes dropped EXE
PID:2116 -
\??\c:\1tbnbb.exec:\1tbnbb.exe61⤵
- Executes dropped EXE
PID:2224 -
\??\c:\7pdpj.exec:\7pdpj.exe62⤵
- Executes dropped EXE
PID:444 -
\??\c:\xrrlxlx.exec:\xrrlxlx.exe63⤵
- Executes dropped EXE
PID:2092 -
\??\c:\7hbtbn.exec:\7hbtbn.exe64⤵
- Executes dropped EXE
PID:1656 -
\??\c:\bbbhth.exec:\bbbhth.exe65⤵
- Executes dropped EXE
PID:2252 -
\??\c:\jdvpj.exec:\jdvpj.exe66⤵PID:684
-
\??\c:\xfxrlxl.exec:\xfxrlxl.exe67⤵PID:1576
-
\??\c:\bbtbnb.exec:\bbtbnb.exe68⤵PID:1700
-
\??\c:\bbnthn.exec:\bbnthn.exe69⤵PID:2292
-
\??\c:\vddpv.exec:\vddpv.exe70⤵PID:2232
-
\??\c:\7fflflf.exec:\7fflflf.exe71⤵PID:2988
-
\??\c:\hhtnbt.exec:\hhtnbt.exe72⤵PID:688
-
\??\c:\7btnth.exec:\7btnth.exe73⤵PID:1744
-
\??\c:\pjddj.exec:\pjddj.exe74⤵PID:1756
-
\??\c:\lllxflx.exec:\lllxflx.exe75⤵PID:2528
-
\??\c:\fxlrxlf.exec:\fxlrxlf.exe76⤵PID:2452
-
\??\c:\nbbnhb.exec:\nbbnhb.exe77⤵PID:2576
-
\??\c:\7pjvp.exec:\7pjvp.exe78⤵PID:2892
-
\??\c:\xfxfffl.exec:\xfxfffl.exe79⤵PID:1512
-
\??\c:\rrxflxl.exec:\rrxflxl.exe80⤵PID:2756
-
\??\c:\hhbnhn.exec:\hhbnhn.exe81⤵PID:2716
-
\??\c:\ppvpd.exec:\ppvpd.exe82⤵PID:2872
-
\??\c:\llrfrfr.exec:\llrfrfr.exe83⤵PID:2868
-
\??\c:\llrrxfx.exec:\llrrxfx.exe84⤵
- System Location Discovery: System Language Discovery
PID:2616 -
\??\c:\hbbhnt.exec:\hbbhnt.exe85⤵PID:2820
-
\??\c:\jpvdv.exec:\jpvdv.exe86⤵PID:2632
-
\??\c:\dddjp.exec:\dddjp.exe87⤵PID:2776
-
\??\c:\flrlxxf.exec:\flrlxxf.exe88⤵PID:1008
-
\??\c:\7bhhbh.exec:\7bhhbh.exe89⤵PID:2676
-
\??\c:\nnbnbn.exec:\nnbnbn.exe90⤵PID:2624
-
\??\c:\1djjv.exec:\1djjv.exe91⤵PID:2296
-
\??\c:\xlxrxrl.exec:\xlxrxrl.exe92⤵PID:2960
-
\??\c:\llfrfrf.exec:\llfrfrf.exe93⤵PID:292
-
\??\c:\3nthth.exec:\3nthth.exe94⤵PID:2436
-
\??\c:\djjvv.exec:\djjvv.exe95⤵PID:616
-
\??\c:\llfxfrx.exec:\llfxfrx.exe96⤵PID:2860
-
\??\c:\bhntht.exec:\bhntht.exe97⤵PID:1540
-
\??\c:\nbnnbn.exec:\nbnnbn.exe98⤵PID:1216
-
\??\c:\pdpdd.exec:\pdpdd.exe99⤵PID:2920
-
\??\c:\llrfxxl.exec:\llrfxxl.exe100⤵PID:1252
-
\??\c:\ttnbbb.exec:\ttnbbb.exe101⤵PID:1724
-
\??\c:\ttnbtt.exec:\ttnbtt.exe102⤵PID:1668
-
\??\c:\pvpvj.exec:\pvpvj.exe103⤵PID:1928
-
\??\c:\rxfrlfl.exec:\rxfrlfl.exe104⤵PID:2220
-
\??\c:\7tbnnb.exec:\7tbnnb.exe105⤵PID:2276
-
\??\c:\3vvjd.exec:\3vvjd.exe106⤵PID:2460
-
\??\c:\rxxxlxl.exec:\rxxxlxl.exe107⤵PID:444
-
\??\c:\tnntnt.exec:\tnntnt.exe108⤵PID:936
-
\??\c:\vddpv.exec:\vddpv.exe109⤵PID:1548
-
\??\c:\jjjjj.exec:\jjjjj.exe110⤵PID:3020
-
\??\c:\xlrllff.exec:\xlrllff.exe111⤵PID:684
-
\??\c:\bntttb.exec:\bntttb.exe112⤵PID:1576
-
\??\c:\jpjdd.exec:\jpjdd.exe113⤵PID:324
-
\??\c:\dddjd.exec:\dddjd.exe114⤵PID:2292
-
\??\c:\frlrfxr.exec:\frlrfxr.exe115⤵PID:2380
-
\??\c:\bbbhtb.exec:\bbbhtb.exe116⤵PID:2496
-
\??\c:\7btbnt.exec:\7btbnt.exe117⤵PID:3048
-
\??\c:\dpjjv.exec:\dpjjv.exe118⤵PID:2560
-
\??\c:\xlrfxrr.exec:\xlrfxrr.exe119⤵PID:1876
-
\??\c:\1nntbb.exec:\1nntbb.exe120⤵PID:2540
-
\??\c:\ththht.exec:\ththht.exe121⤵PID:2124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-