Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 09:18
Static task
static1
Behavioral task
behavioral1
Sample
9f9cdd3cef67d8122df141021bb1ca7fc235a5d57c727be52f67875707c63926N.exe
Resource
win7-20240903-en
General
-
Target
9f9cdd3cef67d8122df141021bb1ca7fc235a5d57c727be52f67875707c63926N.exe
-
Size
455KB
-
MD5
6ed1e75a18c068483a49b4bea7cd1950
-
SHA1
fb0771eab409b7c5a94729e677b153185fa1d796
-
SHA256
9f9cdd3cef67d8122df141021bb1ca7fc235a5d57c727be52f67875707c63926
-
SHA512
d983c53f072b2b3c07c3575266cdd18e1b93cbb71a803eaf24e314c5aec0a015e845190d9a8c07498ca8e02a33d6446d72f216811e057639a31ce04081dc6584
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe9:q7Tc2NYHUrAwfMp3CD9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 58 IoCs
resource yara_rule behavioral1/memory/2480-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-62-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2700-59-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2700-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-69-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2864-82-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2864-84-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2668-100-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2032-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-119-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2892-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-139-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2636-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-137-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2356-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-279-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1812-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-423-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1280-460-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/404-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-486-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1604-493-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1604-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-501-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2480-558-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1052-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-643-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2716-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-714-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-729-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1824-783-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/996-790-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/996-797-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2352-816-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-867-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2580-884-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2256-883-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2164-981-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2320 ppjjv.exe 1936 dvjpv.exe 1568 ntnhbh.exe 2176 1pvdp.exe 2804 3fxfrrf.exe 2700 1hhnbh.exe 2844 rxxxrrf.exe 2864 hnnnbb.exe 2544 fxfxlrf.exe 2668 btnthn.exe 3068 rffxfff.exe 2032 rrxrllx.exe 2892 rrfrxff.exe 1872 nnhhtb.exe 2636 7ppdj.exe 2356 xfrrffr.exe 1336 9fflflx.exe 1856 9tnnbh.exe 1944 7ffrffx.exe 2056 hhnthn.exe 2080 llflxrl.exe 2924 rlxxflx.exe 1800 dvpvj.exe 1352 1xlrrxf.exe 912 vvjvj.exe 1920 rrlxllx.exe 2200 llflxfx.exe 2436 5pdjp.exe 1448 jjdjv.exe 904 pdpvp.exe 1812 htnbnt.exe 1680 fxrxlfl.exe 560 ttnhth.exe 3012 jjdjp.exe 2736 xxflxfr.exe 2192 flrflrf.exe 2696 bbbhtt.exe 2812 dvppv.exe 1860 lfffrrf.exe 2664 3flllrr.exe 2848 5nhthh.exe 2920 vpjjp.exe 2556 llxflxl.exe 2716 fxxlrxl.exe 1932 9tttbh.exe 2104 vpdjj.exe 2616 dvjpd.exe 1732 9frxfxf.exe 2892 nnhtbh.exe 2604 djjdv.exe 2760 llfrxrl.exe 2024 rlxfrlx.exe 2040 hthnth.exe 824 jvpdp.exe 1160 vvvdv.exe 2136 rfrrrxf.exe 1280 hbtttt.exe 676 tbbnbn.exe 1664 ppdjv.exe 404 7rrrxxf.exe 1092 9bbthn.exe 1604 1tntbb.exe 2220 ppjvd.exe 900 xfxfffr.exe -
resource yara_rule behavioral1/memory/2480-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-59-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2700-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-84-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/3068-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-139-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2636-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-460-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/404-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-486-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1604-493-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/1604-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-558-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1080-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-643-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2716-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-729-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/996-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-816-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-841-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-907-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-922-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9f9cdd3cef67d8122df141021bb1ca7fc235a5d57c727be52f67875707c63926N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lfrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2480 wrote to memory of 2320 2480 9f9cdd3cef67d8122df141021bb1ca7fc235a5d57c727be52f67875707c63926N.exe 31 PID 2480 wrote to memory of 2320 2480 9f9cdd3cef67d8122df141021bb1ca7fc235a5d57c727be52f67875707c63926N.exe 31 PID 2480 wrote to memory of 2320 2480 9f9cdd3cef67d8122df141021bb1ca7fc235a5d57c727be52f67875707c63926N.exe 31 PID 2480 wrote to memory of 2320 2480 9f9cdd3cef67d8122df141021bb1ca7fc235a5d57c727be52f67875707c63926N.exe 31 PID 2320 wrote to memory of 1936 2320 ppjjv.exe 32 PID 2320 wrote to memory of 1936 2320 ppjjv.exe 32 PID 2320 wrote to memory of 1936 2320 ppjjv.exe 32 PID 2320 wrote to memory of 1936 2320 ppjjv.exe 32 PID 1936 wrote to memory of 1568 1936 dvjpv.exe 33 PID 1936 wrote to memory of 1568 1936 dvjpv.exe 33 PID 1936 wrote to memory of 1568 1936 dvjpv.exe 33 PID 1936 wrote to memory of 1568 1936 dvjpv.exe 33 PID 1568 wrote to memory of 2176 1568 ntnhbh.exe 34 PID 1568 wrote to memory of 2176 1568 ntnhbh.exe 34 PID 1568 wrote to memory of 2176 1568 ntnhbh.exe 34 PID 1568 wrote to memory of 2176 1568 ntnhbh.exe 34 PID 2176 wrote to memory of 2804 2176 1pvdp.exe 35 PID 2176 wrote to memory of 2804 2176 1pvdp.exe 35 PID 2176 wrote to memory of 2804 2176 1pvdp.exe 35 PID 2176 wrote to memory of 2804 2176 1pvdp.exe 35 PID 2804 wrote to memory of 2700 2804 3fxfrrf.exe 36 PID 2804 wrote to memory of 2700 2804 3fxfrrf.exe 36 PID 2804 wrote to memory of 2700 2804 3fxfrrf.exe 36 PID 2804 wrote to memory of 2700 2804 3fxfrrf.exe 36 PID 2700 wrote to memory of 2844 2700 1hhnbh.exe 37 PID 2700 wrote to memory of 2844 2700 1hhnbh.exe 37 PID 2700 wrote to memory of 2844 2700 1hhnbh.exe 37 PID 2700 wrote to memory of 2844 2700 1hhnbh.exe 37 PID 2844 wrote to memory of 2864 2844 rxxxrrf.exe 38 PID 2844 wrote to memory of 2864 2844 rxxxrrf.exe 38 PID 2844 wrote to memory of 2864 2844 rxxxrrf.exe 38 PID 2844 wrote to memory of 2864 2844 rxxxrrf.exe 38 PID 2864 wrote to memory of 2544 2864 hnnnbb.exe 39 PID 2864 wrote to memory of 2544 2864 hnnnbb.exe 39 PID 2864 wrote to memory of 2544 2864 hnnnbb.exe 39 PID 2864 wrote to memory of 2544 2864 hnnnbb.exe 39 PID 2544 wrote to memory of 2668 2544 fxfxlrf.exe 40 PID 2544 wrote to memory of 2668 2544 fxfxlrf.exe 40 PID 2544 wrote to memory of 2668 2544 fxfxlrf.exe 40 PID 2544 wrote to memory of 2668 2544 fxfxlrf.exe 40 PID 2668 wrote to memory of 3068 2668 btnthn.exe 41 PID 2668 wrote to memory of 3068 2668 btnthn.exe 41 PID 2668 wrote to memory of 3068 2668 btnthn.exe 41 PID 2668 wrote to memory of 3068 2668 btnthn.exe 41 PID 3068 wrote to memory of 2032 3068 rffxfff.exe 42 PID 3068 wrote to memory of 2032 3068 rffxfff.exe 42 PID 3068 wrote to memory of 2032 3068 rffxfff.exe 42 PID 3068 wrote to memory of 2032 3068 rffxfff.exe 42 PID 2032 wrote to memory of 2892 2032 rrxrllx.exe 43 PID 2032 wrote to memory of 2892 2032 rrxrllx.exe 43 PID 2032 wrote to memory of 2892 2032 rrxrllx.exe 43 PID 2032 wrote to memory of 2892 2032 rrxrllx.exe 43 PID 2892 wrote to memory of 1872 2892 rrfrxff.exe 44 PID 2892 wrote to memory of 1872 2892 rrfrxff.exe 44 PID 2892 wrote to memory of 1872 2892 rrfrxff.exe 44 PID 2892 wrote to memory of 1872 2892 rrfrxff.exe 44 PID 1872 wrote to memory of 2636 1872 nnhhtb.exe 45 PID 1872 wrote to memory of 2636 1872 nnhhtb.exe 45 PID 1872 wrote to memory of 2636 1872 nnhhtb.exe 45 PID 1872 wrote to memory of 2636 1872 nnhhtb.exe 45 PID 2636 wrote to memory of 2356 2636 7ppdj.exe 46 PID 2636 wrote to memory of 2356 2636 7ppdj.exe 46 PID 2636 wrote to memory of 2356 2636 7ppdj.exe 46 PID 2636 wrote to memory of 2356 2636 7ppdj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f9cdd3cef67d8122df141021bb1ca7fc235a5d57c727be52f67875707c63926N.exe"C:\Users\Admin\AppData\Local\Temp\9f9cdd3cef67d8122df141021bb1ca7fc235a5d57c727be52f67875707c63926N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\ppjjv.exec:\ppjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\dvjpv.exec:\dvjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\ntnhbh.exec:\ntnhbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\1pvdp.exec:\1pvdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\3fxfrrf.exec:\3fxfrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\1hhnbh.exec:\1hhnbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\rxxxrrf.exec:\rxxxrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\hnnnbb.exec:\hnnnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\fxfxlrf.exec:\fxfxlrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\btnthn.exec:\btnthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\rffxfff.exec:\rffxfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\rrxrllx.exec:\rrxrllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\rrfrxff.exec:\rrfrxff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\nnhhtb.exec:\nnhhtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\7ppdj.exec:\7ppdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\xfrrffr.exec:\xfrrffr.exe17⤵
- Executes dropped EXE
PID:2356 -
\??\c:\9fflflx.exec:\9fflflx.exe18⤵
- Executes dropped EXE
PID:1336 -
\??\c:\9tnnbh.exec:\9tnnbh.exe19⤵
- Executes dropped EXE
PID:1856 -
\??\c:\7ffrffx.exec:\7ffrffx.exe20⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hhnthn.exec:\hhnthn.exe21⤵
- Executes dropped EXE
PID:2056 -
\??\c:\llflxrl.exec:\llflxrl.exe22⤵
- Executes dropped EXE
PID:2080 -
\??\c:\rlxxflx.exec:\rlxxflx.exe23⤵
- Executes dropped EXE
PID:2924 -
\??\c:\dvpvj.exec:\dvpvj.exe24⤵
- Executes dropped EXE
PID:1800 -
\??\c:\1xlrrxf.exec:\1xlrrxf.exe25⤵
- Executes dropped EXE
PID:1352 -
\??\c:\vvjvj.exec:\vvjvj.exe26⤵
- Executes dropped EXE
PID:912 -
\??\c:\rrlxllx.exec:\rrlxllx.exe27⤵
- Executes dropped EXE
PID:1920 -
\??\c:\llflxfx.exec:\llflxfx.exe28⤵
- Executes dropped EXE
PID:2200 -
\??\c:\5pdjp.exec:\5pdjp.exe29⤵
- Executes dropped EXE
PID:2436 -
\??\c:\jjdjv.exec:\jjdjv.exe30⤵
- Executes dropped EXE
PID:1448 -
\??\c:\pdpvp.exec:\pdpvp.exe31⤵
- Executes dropped EXE
PID:904 -
\??\c:\htnbnt.exec:\htnbnt.exe32⤵
- Executes dropped EXE
PID:1812 -
\??\c:\fxrxlfl.exec:\fxrxlfl.exe33⤵
- Executes dropped EXE
PID:1680 -
\??\c:\ttnhth.exec:\ttnhth.exe34⤵
- Executes dropped EXE
PID:560 -
\??\c:\jjdjp.exec:\jjdjp.exe35⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xxflxfr.exec:\xxflxfr.exe36⤵
- Executes dropped EXE
PID:2736 -
\??\c:\flrflrf.exec:\flrflrf.exe37⤵
- Executes dropped EXE
PID:2192 -
\??\c:\bbbhtt.exec:\bbbhtt.exe38⤵
- Executes dropped EXE
PID:2696 -
\??\c:\dvppv.exec:\dvppv.exe39⤵
- Executes dropped EXE
PID:2812 -
\??\c:\lfffrrf.exec:\lfffrrf.exe40⤵
- Executes dropped EXE
PID:1860 -
\??\c:\3flllrr.exec:\3flllrr.exe41⤵
- Executes dropped EXE
PID:2664 -
\??\c:\5nhthh.exec:\5nhthh.exe42⤵
- Executes dropped EXE
PID:2848 -
\??\c:\vpjjp.exec:\vpjjp.exe43⤵
- Executes dropped EXE
PID:2920 -
\??\c:\llxflxl.exec:\llxflxl.exe44⤵
- Executes dropped EXE
PID:2556 -
\??\c:\fxxlrxl.exec:\fxxlrxl.exe45⤵
- Executes dropped EXE
PID:2716 -
\??\c:\9tttbh.exec:\9tttbh.exe46⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vpdjj.exec:\vpdjj.exe47⤵
- Executes dropped EXE
PID:2104 -
\??\c:\dvjpd.exec:\dvjpd.exe48⤵
- Executes dropped EXE
PID:2616 -
\??\c:\9frxfxf.exec:\9frxfxf.exe49⤵
- Executes dropped EXE
PID:1732 -
\??\c:\nnhtbh.exec:\nnhtbh.exe50⤵
- Executes dropped EXE
PID:2892 -
\??\c:\djjdv.exec:\djjdv.exe51⤵
- Executes dropped EXE
PID:2604 -
\??\c:\llfrxrl.exec:\llfrxrl.exe52⤵
- Executes dropped EXE
PID:2760 -
\??\c:\rlxfrlx.exec:\rlxfrlx.exe53⤵
- Executes dropped EXE
PID:2024 -
\??\c:\hthnth.exec:\hthnth.exe54⤵
- Executes dropped EXE
PID:2040 -
\??\c:\jvpdp.exec:\jvpdp.exe55⤵
- Executes dropped EXE
PID:824 -
\??\c:\vvvdv.exec:\vvvdv.exe56⤵
- Executes dropped EXE
PID:1160 -
\??\c:\rfrrrxf.exec:\rfrrrxf.exe57⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hbtttt.exec:\hbtttt.exe58⤵
- Executes dropped EXE
PID:1280 -
\??\c:\tbbnbn.exec:\tbbnbn.exe59⤵
- Executes dropped EXE
PID:676 -
\??\c:\ppdjv.exec:\ppdjv.exe60⤵
- Executes dropped EXE
PID:1664 -
\??\c:\7rrrxxf.exec:\7rrrxxf.exe61⤵
- Executes dropped EXE
PID:404 -
\??\c:\9bbthn.exec:\9bbthn.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1092 -
\??\c:\1tntbb.exec:\1tntbb.exe63⤵
- Executes dropped EXE
PID:1604 -
\??\c:\ppjvd.exec:\ppjvd.exe64⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xfxfffr.exec:\xfxfffr.exe65⤵
- Executes dropped EXE
PID:900 -
\??\c:\tnbhth.exec:\tnbhth.exe66⤵PID:788
-
\??\c:\tntbtb.exec:\tntbtb.exe67⤵PID:1920
-
\??\c:\jjddp.exec:\jjddp.exe68⤵PID:2444
-
\??\c:\5lrlrfr.exec:\5lrlrfr.exe69⤵PID:572
-
\??\c:\xfxlrrx.exec:\xfxlrrx.exe70⤵PID:1704
-
\??\c:\nhbthn.exec:\nhbthn.exe71⤵PID:2240
-
\??\c:\dddvp.exec:\dddvp.exe72⤵PID:1756
-
\??\c:\djddd.exec:\djddd.exe73⤵PID:2480
-
\??\c:\rfxfllr.exec:\rfxfllr.exe74⤵PID:1080
-
\??\c:\nhtbhn.exec:\nhtbhn.exe75⤵PID:1696
-
\??\c:\jjdpv.exec:\jjdpv.exe76⤵PID:1688
-
\??\c:\9jvdp.exec:\9jvdp.exe77⤵PID:1052
-
\??\c:\lfxfrxr.exec:\lfxfrxr.exe78⤵PID:2656
-
\??\c:\7hhntb.exec:\7hhntb.exe79⤵PID:2856
-
\??\c:\ntbnbn.exec:\ntbnbn.exe80⤵PID:2860
-
\??\c:\jjvdj.exec:\jjvdj.exe81⤵PID:2804
-
\??\c:\fxrxfrl.exec:\fxrxfrl.exe82⤵PID:2868
-
\??\c:\ntnthh.exec:\ntnthh.exe83⤵PID:2592
-
\??\c:\vvjdj.exec:\vvjdj.exe84⤵PID:2568
-
\??\c:\ddjvj.exec:\ddjvj.exe85⤵PID:2920
-
\??\c:\llxfrfr.exec:\llxfrfr.exe86⤵PID:3056
-
\??\c:\hhbnbn.exec:\hhbnbn.exe87⤵PID:2716
-
\??\c:\jjddj.exec:\jjddj.exe88⤵PID:1932
-
\??\c:\3dppv.exec:\3dppv.exe89⤵PID:600
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe90⤵PID:2440
-
\??\c:\tnbhbh.exec:\tnbhbh.exe91⤵PID:1732
-
\??\c:\dvpvd.exec:\dvpvd.exe92⤵PID:2900
-
\??\c:\djppd.exec:\djppd.exe93⤵PID:2604
-
\??\c:\llfrrff.exec:\llfrrff.exe94⤵PID:1972
-
\??\c:\bbtbth.exec:\bbtbth.exe95⤵PID:1948
-
\??\c:\dpvjv.exec:\dpvjv.exe96⤵PID:2040
-
\??\c:\rrrfffx.exec:\rrrfffx.exe97⤵PID:1772
-
\??\c:\9nntbn.exec:\9nntbn.exe98⤵PID:1160
-
\??\c:\7tnbhh.exec:\7tnbhh.exe99⤵PID:2136
-
\??\c:\pdvdp.exec:\pdvdp.exe100⤵PID:1912
-
\??\c:\fxxlrrf.exec:\fxxlrrf.exe101⤵PID:2288
-
\??\c:\nnnbnh.exec:\nnnbnh.exe102⤵PID:1664
-
\??\c:\nhttbb.exec:\nhttbb.exe103⤵PID:404
-
\??\c:\3dvjj.exec:\3dvjj.exe104⤵PID:1092
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe105⤵PID:1444
-
\??\c:\lllxllr.exec:\lllxllr.exe106⤵PID:2500
-
\??\c:\tntttt.exec:\tntttt.exe107⤵PID:1748
-
\??\c:\9vjjj.exec:\9vjjj.exe108⤵PID:1824
-
\??\c:\rrfrllf.exec:\rrfrllf.exe109⤵
- System Location Discovery: System Language Discovery
PID:2400 -
\??\c:\1lxrflx.exec:\1lxrflx.exe110⤵PID:996
-
\??\c:\ttnnnb.exec:\ttnnnb.exe111⤵PID:2324
-
\??\c:\pjdjp.exec:\pjdjp.exe112⤵PID:1292
-
\??\c:\pppdj.exec:\pppdj.exe113⤵PID:2352
-
\??\c:\xlflrrx.exec:\xlflrrx.exe114⤵PID:2468
-
\??\c:\9tthbh.exec:\9tthbh.exe115⤵PID:1848
-
\??\c:\3dvdp.exec:\3dvdp.exe116⤵PID:1680
-
\??\c:\9vjjp.exec:\9vjjp.exe117⤵PID:560
-
\??\c:\xxrfllx.exec:\xxrfllx.exe118⤵PID:3012
-
\??\c:\ntbnbh.exec:\ntbnbh.exe119⤵PID:1568
-
\??\c:\vpjpj.exec:\vpjpj.exe120⤵PID:2256
-
\??\c:\ffrxllx.exec:\ffrxllx.exe121⤵PID:2696
-
\??\c:\nnnthn.exec:\nnnthn.exe122⤵PID:2808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-